diff --git a/.circleci/config.yml b/.circleci/config.yml index b0a705966a2..2f01b6de4f3 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -2731,7 +2731,7 @@ jobs: - ~/.cache/uv - restore_cache: keys: - - ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }} + - ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }} - run: name: Install Node dependencies and Playwright # The cimg/python:3.12-browsers image already ships the Chromium system @@ -2742,11 +2742,14 @@ jobs: command: | cd ui/litellm-dashboard npm ci + cd ../../tests/e2e/ui + npm ci npx playwright install chromium - save_cache: - key: ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }} + key: ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }} paths: - ui/litellm-dashboard/node_modules + - tests/e2e/ui/node_modules - ~/.cache/ms-playwright - run: name: Build UI from source @@ -2777,10 +2780,10 @@ jobs: name: Seed database command: | PGPASSWORD=e2epassword psql -h localhost -p 5432 -U e2euser -d litellm_e2e \ - -f ui/litellm-dashboard/e2e_tests/fixtures/seed.sql + -f tests/e2e/ui/fixtures/seed.sql - run: name: Start mock LLM server - command: uv run --no-sync python ui/litellm-dashboard/e2e_tests/fixtures/mock_llm_server/server.py + command: uv run --no-sync python tests/e2e/ui/fixtures/mock_llm_server/server.py background: true - run: name: Start LiteLLM proxy @@ -2798,7 +2801,7 @@ jobs: command: | LITELLM_LICENSE="$LITELLM_LICENSE" \ uv run --no-sync python -m litellm.proxy.proxy_cli \ - --config ui/litellm-dashboard/e2e_tests/fixtures/config.yml \ + --config tests/e2e/ui/fixtures/config.yml \ --port 4000 background: true - run: @@ -2819,15 +2822,15 @@ jobs: # Forward LITELLM_LICENSE so license.spec.ts can detect that the # proxy was launched with a license and assert premium_user=true. command: | - cd ui/litellm-dashboard + cd tests/e2e/ui LITELLM_LICENSE="$LITELLM_LICENSE" \ - npx playwright test --config e2e_tests/playwright.config.ts + npx playwright test --config playwright.config.ts no_output_timeout: 10m - store_artifacts: - path: ui/litellm-dashboard/test-results + path: tests/e2e/ui/test-results destination: e2e-test-results - store_artifacts: - path: ui/litellm-dashboard/playwright-report + path: tests/e2e/ui/playwright-report destination: e2e-playwright-report e2e_ui_testing_server_root_path: @@ -2870,17 +2873,20 @@ jobs: - ~/.cache/uv - restore_cache: keys: - - ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }} + - ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }} - run: name: Install Node dependencies and Playwright command: | cd ui/litellm-dashboard npm ci + cd ../../tests/e2e/ui + npm ci npx playwright install chromium - save_cache: - key: ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }} + key: ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }} paths: - ui/litellm-dashboard/node_modules + - tests/e2e/ui/node_modules - ~/.cache/ms-playwright - run: name: Build UI from source @@ -2902,10 +2908,10 @@ jobs: name: Seed database command: | PGPASSWORD=e2epassword psql -h localhost -p 5432 -U e2euser -d litellm_e2e \ - -f ui/litellm-dashboard/e2e_tests/fixtures/seed.sql + -f tests/e2e/ui/fixtures/seed.sql - run: name: Start mock LLM server - command: uv run --no-sync python ui/litellm-dashboard/e2e_tests/fixtures/mock_llm_server/server.py + command: uv run --no-sync python tests/e2e/ui/fixtures/mock_llm_server/server.py background: true - run: name: Start LiteLLM proxy under a server root path @@ -2918,7 +2924,7 @@ jobs: command: | LITELLM_LICENSE="$LITELLM_LICENSE" \ uv run --no-sync python -m litellm.proxy.proxy_cli \ - --config ui/litellm-dashboard/e2e_tests/fixtures/config.yml \ + --config tests/e2e/ui/fixtures/config.yml \ --port 4000 background: true - run: @@ -2937,15 +2943,15 @@ jobs: - run: name: Run migration smoke under SERVER_ROOT_PATH command: | - cd ui/litellm-dashboard + cd tests/e2e/ui LITELLM_LICENSE="$LITELLM_LICENSE" \ - npx playwright test --config e2e_tests/migration.serverRootPath.config.ts + npx playwright test --config migration.serverRootPath.config.ts no_output_timeout: 10m - store_artifacts: - path: ui/litellm-dashboard/test-results + path: tests/e2e/ui/test-results destination: e2e-server-root-path-test-results - store_artifacts: - path: ui/litellm-dashboard/playwright-report + path: tests/e2e/ui/playwright-report destination: e2e-server-root-path-playwright-report build_docker_database_image: diff --git a/.circleci/scripts/classify_changes.sh b/.circleci/scripts/classify_changes.sh index 2c15428be6a..2ca2654a207 100755 --- a/.circleci/scripts/classify_changes.sh +++ b/.circleci/scripts/classify_changes.sh @@ -8,7 +8,7 @@ has_backend=false while IFS= read -r file || [ -n "$file" ]; do [ -n "$file" ] || continue case "$file" in - ui/*) has_client=true ;; + ui/* | tests/e2e/ui/*) has_client=true ;; docs/* | *.md | *.mdx) : ;; *) has_backend=true ;; esac diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 00000000000..51d489459d9 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,3 @@ +/ui/ @yuneng-jiang @ryan-crabbe-berri +/litellm/proxy/_experimental/out/ @yuneng-jiang @ryan-crabbe-berri +/ui/litellm-dashboard/src/lib/http/schema.d.ts diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index bbe4b76775d..665f8456f0b 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -30,7 +30,7 @@ body: id: steps-to-reproduce attributes: label: Steps to Reproduce - description: Please provide detailed steps to reproduce this bug(A curl/python code to reproduce the bug) + description: Please provide a numbered list of the exact steps to reproduce this bug (include a curl/python snippet to reproduce it). Number each step (1., 2., 3., ...) in the order you performed them. placeholder: | 1. config.yaml file/ .env file/ etc. 2. Run the following code... diff --git a/.github/actions/detect-backend-changes/action.yml b/.github/actions/detect-backend-changes/action.yml new file mode 100644 index 00000000000..af01038f294 --- /dev/null +++ b/.github/actions/detect-backend-changes/action.yml @@ -0,0 +1,48 @@ +name: "Detect backend-relevant changes" +description: >- + Classify the pull request's changed files with .circleci/scripts/classify_changes.sh + and expose decision=run|skip. decision=skip means only ui/**, **.md or **.mdx files + changed, so callers can short-circuit expensive steps while the job still completes + successfully and satisfies its required status check. The decision defaults to run for + any non pull_request event or whenever the changed set cannot be resolved, so tests are + never skipped when the classification is uncertain. + +outputs: + decision: + description: "run when backend-relevant files changed, otherwise skip" + value: ${{ steps.classify.outputs.decision }} + +runs: + using: composite + steps: + - id: classify + shell: bash + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + run: | + set -uo pipefail + if [ -z "${BASE_SHA:-}" ]; then + echo "detect-backend-changes: not a pull_request event; running job" + echo "decision=run" >> "${GITHUB_OUTPUT}" + exit 0 + fi + if ! git fetch --no-tags --depth=1 origin "${BASE_SHA}" >/dev/null 2>&1; then + echo "detect-backend-changes: could not fetch base ${BASE_SHA}; running job" + echo "decision=run" >> "${GITHUB_OUTPUT}" + exit 0 + fi + changed="$(git diff --name-only "${BASE_SHA}" HEAD 2>/dev/null)" || { + echo "detect-backend-changes: git diff failed; running job" + echo "decision=run" >> "${GITHUB_OUTPUT}" + exit 0 + } + if [ -z "${changed}" ]; then + echo "detect-backend-changes: no changed files vs ${BASE_SHA}; skipping job" + echo "decision=skip" >> "${GITHUB_OUTPUT}" + exit 0 + fi + echo "detect-backend-changes: changed files vs ${BASE_SHA}:" + printf '%s\n' "${changed}" | sed 's/^/ /' + decision="$(printf '%s\n' "${changed}" | bash .circleci/scripts/classify_changes.sh backend)" || decision="run" + echo "detect-backend-changes: decision=${decision}" + echo "decision=${decision}" >> "${GITHUB_OUTPUT}" diff --git a/.github/actions/setup-uv-with-retries/action.yml b/.github/actions/setup-uv-with-retries/action.yml new file mode 100644 index 00000000000..1627038dc3d --- /dev/null +++ b/.github/actions/setup-uv-with-retries/action.yml @@ -0,0 +1,47 @@ +name: "Set up uv with retries" +description: >- + Install uv via astral-sh/setup-uv, retrying on transient failures. Even with + an exact pinned version, the action resolves the artifact URL by fetching + https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson in a + single request with no retry, timeout, or fallback, so one connection-level + network error ("fetch failed") fails the whole job before any test runs. + Retrying the full step covers the manifest fetch and the binary download. + +inputs: + version: + description: "uv version to install" + required: true + +runs: + using: composite + steps: + - name: Set up uv (attempt 1) + id: attempt-1 + continue-on-error: true + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + with: + version: ${{ inputs.version }} + + - name: Wait before attempt 2 + if: steps.attempt-1.outcome == 'failure' + shell: bash + run: sleep 15 + + - name: Set up uv (attempt 2) + id: attempt-2 + if: steps.attempt-1.outcome == 'failure' + continue-on-error: true + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + with: + version: ${{ inputs.version }} + + - name: Wait before attempt 3 + if: steps.attempt-2.outcome == 'failure' + shell: bash + run: sleep 30 + + - name: Set up uv (attempt 3) + if: steps.attempt-2.outcome == 'failure' + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + with: + version: ${{ inputs.version }} diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index bd9fc2285d1..1301bfb0e60 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,3 +1,18 @@ +## TLDR + + + +Problem this solves: + +- +- ... + +How it solves it: + +- +- ... + ## Relevant issues @@ -41,3 +56,27 @@ If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slac ✅ Test ## Changes + +## QA runbook + + + +### Final Attestation + +- [ ] The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR diff --git a/.github/workflows/_test-unit-base.yml b/.github/workflows/_test-unit-base.yml index 25c6d4a7019..7fd66e3325e 100644 --- a/.github/workflows/_test-unit-base.yml +++ b/.github/workflows/_test-unit-base.yml @@ -45,19 +45,25 @@ jobs: name: Run tests runs-on: ubuntu-latest timeout-minutes: ${{ inputs.timeout-minutes }} + outputs: + decision: ${{ steps.changes.outputs.decision }} steps: - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 with: persist-credentials: false + - name: Detect backend-relevant changes + id: changes + uses: ./.github/actions/detect-backend-changes + - name: Set up Python uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" @@ -72,16 +78,19 @@ jobs: ${{ runner.os }}-uv- - name: Install dependencies + if: steps.changes.outputs.decision != 'skip' run: | - .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router + .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml - name: Generate Prisma client + if: steps.changes.outputs.decision != 'skip' env: PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache run: | uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma - name: Run tests + if: steps.changes.outputs.decision != 'skip' env: TEST_PATH: ${{ inputs.test-path }} MAX_FAILURES: ${{ inputs.max-failures }} @@ -114,7 +123,7 @@ jobs: fi - name: Save coverage report - if: always() + if: always() && steps.changes.outputs.decision != 'skip' uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 with: name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }} @@ -124,7 +133,7 @@ jobs: upload-coverage: name: Upload coverage to Codecov needs: run - if: always() + if: always() && needs.run.outputs.decision != 'skip' runs-on: ubuntu-latest permissions: contents: read diff --git a/.github/workflows/auto_update_price_and_context_window.yml b/.github/workflows/auto_update_price_and_context_window.yml index 1c6c318c717..d391c0bd6ce 100644 --- a/.github/workflows/auto_update_price_and_context_window.yml +++ b/.github/workflows/auto_update_price_and_context_window.yml @@ -18,15 +18,18 @@ jobs: with: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" - name: Update JSON Data run: | uv run --frozen --with 'aiohttp==3.13.3' python ".github/workflows/auto_update_price_and_context_window_file.py" + - name: Regenerate JSON Schema + run: | + uv run --frozen python ci_cd/generate_model_prices_schema.py - name: Create Pull Request run: | - git add model_prices_and_context_window.json + git add model_prices_and_context_window.json model_prices_and_context_window.schema.json git commit -m "Update model_prices_and_context_window.json file: $(date +'%Y-%m-%d')" gh pr create --title "Update model_prices_and_context_window.json file" \ --body "Automated update for model_prices_and_context_window.json" \ diff --git a/.github/workflows/check-ui-api-types.yml b/.github/workflows/check-ui-api-types.yml index 439126aa1ee..9c24bad00f1 100644 --- a/.github/workflows/check-ui-api-types.yml +++ b/.github/workflows/check-ui-api-types.yml @@ -31,7 +31,7 @@ jobs: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml index a1772102b89..a69e50b5753 100644 --- a/.github/workflows/codspeed.yml +++ b/.github/workflows/codspeed.yml @@ -5,10 +5,24 @@ on: branches: - main - litellm_internal_staging + paths: + - "litellm/**" + - "tests/benchmarks/**" + - "pyproject.toml" + - "uv.lock" + - ".github/workflows/codspeed.yml" + - ".github/actions/setup-uv-with-retries/**" pull_request: branches: - main - litellm_internal_staging + paths: + - "litellm/**" + - "tests/benchmarks/**" + - "pyproject.toml" + - "uv.lock" + - ".github/workflows/codspeed.yml" + - ".github/actions/setup-uv-with-retries/**" # Allow CodSpeed to trigger backtest performance analysis # in order to generate initial data workflow_dispatch: @@ -37,7 +51,7 @@ jobs: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" diff --git a/.github/workflows/guard-main-branch.yml b/.github/workflows/guard-main-branch.yml index 21aad18d298..5bc561c6441 100644 --- a/.github/workflows/guard-main-branch.yml +++ b/.github/workflows/guard-main-branch.yml @@ -31,12 +31,12 @@ jobs: echo "PR head repo: $HEAD_REPO" echo "PR head branch: $HEAD_REF" if [ "$HEAD_REPO" != "$BASE_REPO" ]; then - echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO). External contributors should open PRs against the 'litellm_oss_staging' branch instead." + echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO). External contributors should open PRs against 'litellm_internal_staging' instead." exit 1 fi if [ "$HEAD_REF" = "litellm_internal_staging" ] || [[ "$HEAD_REF" == litellm_hotfix_?* ]]; then echo "Allowed source branch." exit 0 fi - echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'. If this is a contribution, retarget the PR against 'litellm_oss_staging' instead." + echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'. If this is a contribution, retarget the PR against 'litellm_internal_staging' instead." exit 1 diff --git a/.github/workflows/image-scan.yml b/.github/workflows/image-scan.yml index 90ede5a653f..4d4a3242399 100644 --- a/.github/workflows/image-scan.yml +++ b/.github/workflows/image-scan.yml @@ -9,6 +9,7 @@ on: - "litellm_**" paths: - docker/Dockerfile.non_root + - tests/proxy_migration_tests/test_offline_image_migration.py - uv.lock - ui/litellm-dashboard/package-lock.json - .github/workflows/image-scan.yml @@ -51,6 +52,23 @@ jobs: - name: Build runtime image run: docker build -f docker/Dockerfile.non_root -t litellm-image-scan:${{ github.sha }} . + # The prisma bake must migrate a fresh DB with no egress as an arbitrary + # non-root uid (OpenShift restricted-v2 / air-gapped / readOnlyRootFilesystem). + # `docker run` as the default uid with network hides a broken bake because + # the migration entrypoint exits 0 even when it applied nothing; asserting + # the schema was created is what catches it. + - name: Set up Python + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + with: + python-version: "3.12" + + - name: Verify offline migration as a non-root uid + env: + LITELLM_IMAGE: litellm-image-scan:${{ github.sha }} + run: | + python -m pip install "pytest==9.0.3" + python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py -v + # Scans the whole shipped artifact: OS/apk plus every language package # baked into the image, including ones no lockfile declares (e.g. prisma's # vendored node engine) that osv-scan cannot see. osv-scan stays the fast @@ -58,6 +76,8 @@ jobs: # free OSS, run as a pinned, checksum-verified binary; no GitHub Action # dependency and no vendor SaaS callout. - name: Scan image for fixable HIGH/CRITICAL CVEs + env: + GRYPE_MATCH_PYTHON_USING_CPES: "true" run: | "$RUNNER_TEMP/grype" litellm-image-scan:${{ github.sha }} \ --only-fixed \ diff --git a/.github/workflows/mutation-test.yml b/.github/workflows/mutation-test.yml index 183f12f969c..da4fe073a6a 100644 --- a/.github/workflows/mutation-test.yml +++ b/.github/workflows/mutation-test.yml @@ -39,7 +39,7 @@ jobs: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" @@ -55,7 +55,7 @@ jobs: - name: Install dependencies run: | - .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router + .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml - name: Generate Prisma client env: diff --git a/.github/workflows/test-code-quality.yml b/.github/workflows/test-code-quality.yml index 872a1799d98..ae31395521a 100644 --- a/.github/workflows/test-code-quality.yml +++ b/.github/workflows/test-code-quality.yml @@ -38,7 +38,7 @@ jobs: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" @@ -115,6 +115,9 @@ jobs: - name: check_fastuuid_usage run: uv run --no-sync python ./tests/code_coverage_tests/check_fastuuid_usage.py + - name: check_e2e_no_raw_requests + run: uv run --no-sync python ./tests/code_coverage_tests/check_e2e_no_raw_requests.py + - name: memory_test run: uv run --no-sync python ./tests/code_coverage_tests/memory_test.py diff --git a/.github/workflows/test-linting.yml b/.github/workflows/test-linting.yml index c2fc3453261..8d2b2c2f972 100644 --- a/.github/workflows/test-linting.yml +++ b/.github/workflows/test-linting.yml @@ -33,7 +33,7 @@ jobs: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" @@ -48,7 +48,7 @@ jobs: - name: Install dependencies run: | - uv sync --frozen --group proxy-dev + uv sync --frozen --group proxy-dev --group e2e-dev # basedpyright resolves Prisma's generated client (litellm/proxy/schema.prisma) # only after `prisma generate` writes prisma/client.py et al. Without this the @@ -104,9 +104,20 @@ jobs: - name: Check basedpyright budget (delta vs base) env: BASE_SHA: ${{ github.event.pull_request.base.sha }} + NODE_OPTIONS: --max-old-space-size=12288 run: | (uv run --no-sync basedpyright --outputjson || true) | uv run --no-sync python scripts/type_check_gate.py --base "$BASE_SHA" + - name: Check tests/e2e basedpyright (zero errors) + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + run: | + if git diff --name-only --diff-filter=ACMRD "$BASE_SHA"...HEAD -- 'tests/e2e/**/*.py' | grep -q .; then + uv run --no-sync basedpyright tests/e2e + else + echo "No changed tests/e2e Python files; skipping." + fi + - name: Check for circular imports run: | cd litellm @@ -162,7 +173,7 @@ jobs: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" diff --git a/.github/workflows/test-litellm-ui-build.yml b/.github/workflows/test-litellm-ui-build.yml index ce8d8cb9c95..525e2c5b949 100644 --- a/.github/workflows/test-litellm-ui-build.yml +++ b/.github/workflows/test-litellm-ui-build.yml @@ -36,79 +36,3 @@ jobs: - name: Build run: npm run build - - frontend-lint: - runs-on: ubuntu-latest - timeout-minutes: 8 - defaults: - run: - working-directory: ui/litellm-dashboard - - steps: - - name: Checkout repository - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - with: - fetch-depth: 0 - persist-credentials: false - - - name: Collect changed files - id: changed - env: - BASE_SHA: ${{ github.event.pull_request.base.sha }} - run: | - : > "$RUNNER_TEMP/prettier_files.txt" - : > "$RUNNER_TEMP/eslint_files.txt" - while IFS= read -r f; do - [ -f "$f" ] || continue - case "$f" in - *.js | *.jsx | *.ts | *.tsx | *.mjs | *.cjs) - printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt" - printf '%s\n' "$f" >> "$RUNNER_TEMP/eslint_files.txt" ;; - *.json | *.css | *.scss | *.md | *.mdx | *.yml | *.yaml | *.html) - printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt" ;; - esac - done < <(git diff --name-only --diff-filter=ACMR --relative "$BASE_SHA"...HEAD -- .) - if [ -s "$RUNNER_TEMP/prettier_files.txt" ] || [ -s "$RUNNER_TEMP/eslint_files.txt" ]; then - echo "has_files=true" >> "$GITHUB_OUTPUT" - else - echo "has_files=false" >> "$GITHUB_OUTPUT" - echo "No lintable UI files changed in this PR; nothing to check." - fi - - - name: Setup Node.js - if: steps.changed.outputs.has_files == 'true' - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 - with: - node-version: "20" - cache: "npm" - cache-dependency-path: ui/litellm-dashboard/package-lock.json - - - name: Install dependencies - if: steps.changed.outputs.has_files == 'true' - run: npm ci - - - name: Lint changed files (prettier + eslint) - if: steps.changed.outputs.has_files == 'true' - run: | - prettier_files=() - eslint_files=() - while IFS= read -r f; do prettier_files+=("$f"); done < "$RUNNER_TEMP/prettier_files.txt" - while IFS= read -r f; do eslint_files+=("$f"); done < "$RUNNER_TEMP/eslint_files.txt" - status=0 - if [ ${#prettier_files[@]} -gt 0 ]; then - echo "::group::Prettier (${#prettier_files[@]} files)" - npx prettier --check "${prettier_files[@]}" || { status=1; echo "::error::Unformatted files. Fix with: npm run format"; } - echo "::endgroup::" - fi - if [ ${#eslint_files[@]} -gt 0 ]; then - echo "::group::ESLint (${#eslint_files[@]} files)" - npx eslint --no-warn-ignored --pass-on-unpruned-suppressions "${eslint_files[@]}" || status=1 - echo "::endgroup::" - fi - exit $status - - - name: Check lint budgets - if: ${{ !cancelled() && steps.changed.outputs.has_files == 'true' }} - run: | - npx eslint . -f json -o "$RUNNER_TEMP/lint-report.json" || true - node scripts/check-lint-budgets.mjs "$RUNNER_TEMP/lint-report.json" eslint-budgets.json --check eslint-metrics.json diff --git a/.github/workflows/test-litellm-ui-lint.yml b/.github/workflows/test-litellm-ui-lint.yml new file mode 100644 index 00000000000..5173eb6da35 --- /dev/null +++ b/.github/workflows/test-litellm-ui-lint.yml @@ -0,0 +1,100 @@ +name: UI Lint +permissions: + contents: read + +on: + pull_request: + branches: + - main + - litellm_internal_staging + - litellm_oss_staging + - "litellm_**" + +jobs: + frontend-lint: + runs-on: ubuntu-latest + timeout-minutes: 8 + defaults: + run: + working-directory: ui/litellm-dashboard + + steps: + - name: Checkout repository + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + with: + fetch-depth: 0 + persist-credentials: false + + - name: Collect changed files + id: changed + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + # base.sha is the base branch tip from when the PR was opened, while + # actions/checkout leaves HEAD on a merge of the PR into the *current* + # base tip. "$BASE_SHA"...HEAD therefore spans every base-branch commit + # landed since, so a PR that touches no UI file still gets linted + # against hundreds of other people's files. Diff the PR head against its + # own merge base instead, which is exactly what this PR changed. + merge_base=$(git merge-base "$BASE_SHA" "$HEAD_SHA") + : > "$RUNNER_TEMP/prettier_files.txt" + : > "$RUNNER_TEMP/eslint_files.txt" + while IFS= read -r f; do + [ -f "$f" ] || continue + case "$f" in + *.js | *.jsx | *.ts | *.tsx | *.mjs | *.cjs) + printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt" + printf '%s\n' "$f" >> "$RUNNER_TEMP/eslint_files.txt" ;; + *.json | *.css | *.scss | *.md | *.mdx | *.yml | *.yaml | *.html) + printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt" ;; + esac + done < <(git diff --name-only --diff-filter=ACMR --relative "$merge_base" "$HEAD_SHA" -- .) + if [ -s "$RUNNER_TEMP/prettier_files.txt" ] || [ -s "$RUNNER_TEMP/eslint_files.txt" ]; then + echo "has_files=true" >> "$GITHUB_OUTPUT" + else + echo "has_files=false" >> "$GITHUB_OUTPUT" + echo "No lintable UI files changed in this PR; nothing to check." + fi + + - name: Setup Node.js + if: steps.changed.outputs.has_files == 'true' + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 + with: + node-version: "20" + cache: "npm" + cache-dependency-path: ui/litellm-dashboard/package-lock.json + + - name: Install dependencies + if: steps.changed.outputs.has_files == 'true' + run: npm ci + + - name: Lint changed files (prettier + eslint) + if: steps.changed.outputs.has_files == 'true' + run: | + prettier_files=() + eslint_files=() + while IFS= read -r f; do prettier_files+=("$f"); done < "$RUNNER_TEMP/prettier_files.txt" + while IFS= read -r f; do eslint_files+=("$f"); done < "$RUNNER_TEMP/eslint_files.txt" + status=0 + if [ ${#prettier_files[@]} -gt 0 ]; then + echo "::group::Prettier (${#prettier_files[@]} files)" + npx prettier --check "${prettier_files[@]}" || { status=1; echo "::error::Unformatted files. Fix with: npm run format"; } + echo "::endgroup::" + fi + if [ ${#eslint_files[@]} -gt 0 ]; then + echo "::group::ESLint (${#eslint_files[@]} files)" + npx eslint --no-warn-ignored --pass-on-unpruned-suppressions "${eslint_files[@]}" || status=1 + echo "::endgroup::" + fi + exit $status + + - name: Check lint budgets + if: ${{ !cancelled() && steps.changed.outputs.has_files == 'true' }} + run: | + npx eslint . -f json -o "$RUNNER_TEMP/lint-report.json" || true + node scripts/check-lint-budgets.mjs "$RUNNER_TEMP/lint-report.json" eslint-budgets.json + + - name: Check for dead code (knip) + if: ${{ !cancelled() && steps.changed.outputs.has_files == 'true' }} + run: npm run knip:ci diff --git a/.github/workflows/test-litellm-ui-unit.yml b/.github/workflows/test-litellm-ui-unit.yml new file mode 100644 index 00000000000..5374a0059de --- /dev/null +++ b/.github/workflows/test-litellm-ui-unit.yml @@ -0,0 +1,57 @@ +name: UI Unit Tests +permissions: + contents: read + +on: + pull_request: + branches: + - main + - litellm_internal_staging + - litellm_oss_staging + - "litellm_**" + push: + branches: + - litellm_internal_staging + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + ui-unit-tests: + runs-on: ubuntu-latest-16-cores + timeout-minutes: 20 + defaults: + run: + working-directory: ui/litellm-dashboard + + steps: + - name: Checkout repository + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + with: + fetch-depth: 0 + persist-credentials: false + + - name: Setup Node.js + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 + with: + node-version: "20" + cache: "npm" + cache-dependency-path: ui/litellm-dashboard/package-lock.json + + - name: Install dependencies + run: npm ci + + - name: Run UI unit tests (Vitest) + env: + CI: "true" + BASE_SHA: ${{ github.event.pull_request.base.sha }} + run: | + if [ -n "$BASE_SHA" ]; then + echo "Pull request: running only tests related to changes since $BASE_SHA" + npm run test -- --run --changed "$BASE_SHA" --passWithNoTests \ + --pool forks --poolOptions.forks.maxForks=14 + else + echo "Push to $GITHUB_REF_NAME: running the full suite" + npm run test -- --run --pool forks --poolOptions.forks.maxForks=14 + fi diff --git a/.github/workflows/test-mcp.yml b/.github/workflows/test-mcp.yml index 5b5290880c1..a5a4e722133 100644 --- a/.github/workflows/test-mcp.yml +++ b/.github/workflows/test-mcp.yml @@ -32,7 +32,7 @@ jobs: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" diff --git a/.github/workflows/test-model-map.yaml b/.github/workflows/test-model-map.yaml index b2170d9f6a4..cf4b0eb21a1 100644 --- a/.github/workflows/test-model-map.yaml +++ b/.github/workflows/test-model-map.yaml @@ -22,3 +22,12 @@ jobs: - name: Validate model_prices_and_context_window.json run: | jq empty model_prices_and_context_window.json + + - name: Set up uv + uses: ./.github/actions/setup-uv-with-retries + with: + version: "0.10.9" + + - name: Check model_prices_and_context_window.schema.json is in sync + run: | + uv run --frozen python ci_cd/generate_model_prices_schema.py --check diff --git a/.github/workflows/test-rust.yml b/.github/workflows/test-rust.yml index 13e1dc4ad5e..21e1bcb90c6 100644 --- a/.github/workflows/test-rust.yml +++ b/.github/workflows/test-rust.yml @@ -61,5 +61,11 @@ jobs: - name: Run Clippy run: cargo clippy --workspace --all-targets --locked -- -D warnings + - name: Run Clippy with Bedrock auth + run: cargo clippy -p litellm-core --all-targets --features bedrock-auth --locked -- -D warnings + - name: Run Rust tests run: cargo test --workspace --locked + + - name: Run core tests with Bedrock auth + run: cargo test -p litellm-core --features bedrock-auth --locked diff --git a/.github/workflows/test-semgrep.yml b/.github/workflows/test-semgrep.yml index f0dcb9887be..6e9f5e42fa2 100644 --- a/.github/workflows/test-semgrep.yml +++ b/.github/workflows/test-semgrep.yml @@ -31,7 +31,7 @@ jobs: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" diff --git a/.github/workflows/test-terraform-provider.yml b/.github/workflows/test-terraform-provider.yml index 03d8ff3461c..058a2538c15 100644 --- a/.github/workflows/test-terraform-provider.yml +++ b/.github/workflows/test-terraform-provider.yml @@ -74,7 +74,7 @@ jobs: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" diff --git a/.github/workflows/test-unit-documentation.yml b/.github/workflows/test-unit-documentation.yml index 4cef791a9b3..c12a289ce9f 100644 --- a/.github/workflows/test-unit-documentation.yml +++ b/.github/workflows/test-unit-documentation.yml @@ -32,13 +32,17 @@ jobs: path: docs/my-website persist-credentials: false + - name: Detect backend-relevant changes + id: changes + uses: ./.github/actions/detect-backend-changes + - name: Set up Python uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" @@ -53,10 +57,12 @@ jobs: ${{ runner.os }}-uv- - name: Install dependencies + if: steps.changes.outputs.decision != 'skip' run: | .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router - name: Generate Prisma client + if: steps.changes.outputs.decision != 'skip' env: PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache run: | @@ -64,6 +70,7 @@ jobs: # Run the same documentation tests that CircleCI ran (as direct Python scripts) - name: Run documentation validation tests + if: steps.changes.outputs.decision != 'skip' run: | uv run --no-sync python ./tests/documentation_tests/test_env_keys.py uv run --no-sync python ./tests/documentation_tests/test_router_settings.py diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows/test-unit-proxy-db.yml index 2ac9a3b7c1c..b0ee56f5a5c 100644 --- a/.github/workflows/test-unit-proxy-db.yml +++ b/.github/workflows/test-unit-proxy-db.yml @@ -5,6 +5,8 @@ on: branches: - main - litellm_internal_staging + - litellm_oss_staging + - "litellm_**" permissions: contents: read diff --git a/.github/workflows/test-unit-proxy-endpoints.yml b/.github/workflows/test-unit-proxy-endpoints.yml index cbb36eebdb9..b3eb8f79a43 100644 --- a/.github/workflows/test-unit-proxy-endpoints.yml +++ b/.github/workflows/test-unit-proxy-endpoints.yml @@ -46,6 +46,7 @@ jobs: tests/test_litellm/proxy/rag_endpoints tests/test_litellm/proxy/realtime_endpoints tests/test_litellm/proxy/ui_crud_endpoints + tests/test_litellm/proxy/config_resolvers tests/test_litellm/proxy/utils workers: 2 reruns: 2 diff --git a/.github/workflows/test-unit-proxy-legacy.yml b/.github/workflows/test-unit-proxy-legacy.yml index 8db218cd1fc..bcbf365babf 100644 --- a/.github/workflows/test-unit-proxy-legacy.yml +++ b/.github/workflows/test-unit-proxy-legacy.yml @@ -49,13 +49,17 @@ jobs: with: persist-credentials: false + - name: Detect backend-relevant changes + id: changes + uses: ./.github/actions/detect-backend-changes + - name: Set up Python uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.12" - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + uses: ./.github/actions/setup-uv-with-retries with: version: "0.10.9" @@ -70,16 +74,19 @@ jobs: ${{ runner.os }}-uv- - name: Install dependencies + if: steps.changes.outputs.decision != 'skip' run: | .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router - name: Generate Prisma client + if: steps.changes.outputs.decision != 'skip' env: PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache run: | uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma - name: Run tests - ${{ matrix.test-group.name }} + if: steps.changes.outputs.decision != 'skip' env: TEST_PATH: ${{ matrix.test-group.path }} run: | diff --git a/.github/workflows/test_server_root_path.yml b/.github/workflows/test_server_root_path.yml deleted file mode 100644 index f59cee29893..00000000000 --- a/.github/workflows/test_server_root_path.yml +++ /dev/null @@ -1,151 +0,0 @@ -name: Test Proxy SERVER_ROOT_PATH Routing -permissions: - contents: read - -on: - pull_request: - branches: - - main - - litellm_internal_staging - - litellm_oss_staging - - "litellm_**" - -jobs: - test-server-root-path: - runs-on: ubuntu-latest - timeout-minutes: 30 - - strategy: - fail-fast: false - matrix: - root_path: ["/api/v1", "/llmproxy"] - - steps: - - name: Checkout repository - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - with: - persist-credentials: false - - - name: Free up disk space - run: | - sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost - sudo apt-get clean - df -h / - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - - - name: Build Docker image - uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6.14.0 - with: - context: . - file: ./docker/Dockerfile.non_root - tags: litellm-test:${{ github.sha }} - load: true - push: false - - - name: Start LiteLLM container with SERVER_ROOT_PATH - run: | - docker run -d \ - --name litellm-test \ - -p 4000:4000 \ - -e SERVER_ROOT_PATH="${{ matrix.root_path }}" \ - -e LITELLM_MASTER_KEY="sk-1234" \ - litellm-test:${{ github.sha }} \ - --detailed_debug - - - name: Wait for container to be healthy - run: | - echo "Waiting for LiteLLM to start..." - max_attempts=30 - attempt=0 - - while [ $attempt -lt $max_attempts ]; do - if docker logs litellm-test 2>&1 | grep -q "Uvicorn running"; then - echo "LiteLLM started successfully" - break - fi - attempt=$((attempt + 1)) - echo "Attempt $attempt/$max_attempts - waiting for server to start..." - sleep 2 - done - - if [ $attempt -eq $max_attempts ]; then - echo "Server failed to start within timeout" - docker logs litellm-test - exit 1 - fi - - sleep 5 - - - name: Show container logs - if: always() - run: docker logs litellm-test - - - name: Test UI endpoint with root path - run: | - ROOT_PATH="${{ matrix.root_path }}" - echo "Testing UI at: http://localhost:4000${ROOT_PATH}/ui/" - - for i in 1 2 3; do - content=$(curl -sL --max-time 5 -H "Authorization: Bearer sk-1234" "http://localhost:4000${ROOT_PATH}/ui/") - if echo "$content" | grep -q -E "(html|- + --health-cmd "pg_isready -U llmproxy" + --health-interval 5s + --health-timeout 5s + --health-retries 10 + env: + DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm + LITELLM_MASTER_KEY: sk-weekly-anomaly-check + ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }} + steps: + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + with: + persist-credentials: false + + - name: Set up Python + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + with: + python-version: "3.12" + + - name: Set up uv + uses: ./.github/actions/setup-uv-with-retries + with: + version: "0.10.9" + + - name: Install dependencies + run: | + .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra proxy + + - name: Generate Prisma client + env: + PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache + run: | + uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma + + - name: Start the proxy + run: | + nohup uv run --no-sync litellm --config tests/e2e/load/weekly_anomaly_config.yml --port 4000 > proxy.log 2>&1 & + for _ in $(seq 1 90); do + if curl -fs http://localhost:4000/health/liveliness > /dev/null; then + exit 0 + fi + sleep 2 + done + echo "proxy never became live" + tail -n 100 proxy.log + exit 1 + + - name: Run the weekly session anomaly test + env: + E2E_WEEKLY_ANOMALY: "1" + run: | + uv run --no-sync pytest tests/e2e/load/test_weekly_session_anomaly_e2e.py -v --tb=short -rA + + - name: Show proxy log on failure + if: failure() + run: tail -n 300 proxy.log diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index db79fe43038..df242e5a3b6 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -4,7 +4,11 @@ on: push: branches: [main, litellm_internal_staging] pull_request: - branches: [main, litellm_internal_staging] + branches: + - main + - litellm_internal_staging + - litellm_oss_staging + - "litellm_**" concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} diff --git a/.gitignore b/.gitignore index e3ccf50508f..13f2202305d 100644 --- a/.gitignore +++ b/.gitignore @@ -15,6 +15,9 @@ litellm/rust_bridge/_native*.so litellm/rust_bridge/_native*.pyd litellm-rust/target/ +# Python package build output +dist/ + bun.lockb **/.DS_Store .aider* @@ -106,6 +109,13 @@ STABILIZATION_TODO.md **/coverage test-config +# Claude Code compatibility-matrix pytest artifact (CI-only output). +compat-results.json +compat-results.json.shards/ +compat-rate-limit-summary.json +# Matrix JSON produced by the daily-cron publisher (pushed to litellm-docs). +compatibility-matrix.json + # ---------- Terraform ---------- # Provider binaries + module cache — regenerated by `terraform init`. **/.terraform/ @@ -131,3 +141,4 @@ crash.*.log .coverage ui/litellm-dashboard/out/ +litellm.log diff --git a/CLAUDE.md b/CLAUDE.md index 5affa7748d7..1a4826d51e9 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -19,7 +19,7 @@ Same thing for bug fixes. The tests should make it so that this specific bug can End-to-end tests belong in `tests/e2e/` and must follow the harness conventions documented in that directory's `CLAUDE.md` -When creating PRs, don't set base to `main`. `litellm_internal_staging` serves that purpose +When creating PRs, don't set base to `main`. `litellm_internal_staging` is the default base branch and serves that purpose for both internal and external / OSS contributions When writing a PR body, treat the comments and imperative instructions inside @.github/pull_request_template.md as rules to follow, not just layout. Agent harnesses may strip HTML comments from copies of that file injected into context, so read .github/pull_request_template.md from disk before writing a PR body to make sure you see every comment rule @@ -39,6 +39,8 @@ Don't hesitate to use values in .env to get needed API keys and other secrets, a Python max line length is 120, not 88 +On a fresh worktree or clone, run `make bootstrap` before anything else. It provisions everything tests, `make pre-commit`, and a local proxy need + Run tests before you commit. Also, run `make pre-commit` right before each commit, which generates types (as needed) and formats/lints your code. Any errors found must be fixed. It only runs when there are staged frontend and/or backend changes and calculates violations, generates types, etc. based on the worktree, so stage what you need or stash/delete unwanted files in litellm/ or ui/ (where backend and frontend lint run, respectively) before running it. If it fails because dashboard api types are stale, it already regenerated them for you. You just need to stage the schema.d.ts, re-run `make pre-commit` to confirm it passes, and commit When you fix violations gated by `ruff-strict-budget.json`, `type-discipline-budget.json`, or `basedpyright-code-budget.json`, run `make lint-budget-update` and commit the lowered limits so the ceilings ratchet down instead of leaving stale headroom. It measures the working tree, so it must contain exactly the fixes you're committing diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1080579d0fa..d995ddcc87e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -322,7 +322,7 @@ npm run build ## Submitting Your PR 1. **Push your branch**: `git push origin your-feature-branch` -2. **Create a PR**: Go to GitHub and create a pull request +2. **Create a PR**: Go to GitHub and open a pull request against [`litellm_internal_staging`](https://github.com/BerriAI/litellm/tree/litellm_internal_staging), which is the default base branch. Do not target `main`. 3. **Fill out the PR template**: Provide clear description of changes 4. **Wait for review**: Maintainers will review and provide feedback 5. **Address feedback**: Make requested changes and push updates diff --git a/Dockerfile b/Dockerfile index bc0e6a5ca6f..a127cdabd59 100644 --- a/Dockerfile +++ b/Dockerfile @@ -64,6 +64,7 @@ RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-gr --extra proxy-runtime \ --extra extra_proxy \ --extra semantic-router \ + --extra saml \ --python python3 # Copy full source tree @@ -84,9 +85,12 @@ RUN uv sync --frozen --no-default-groups --no-editable \ --extra proxy-runtime \ --extra extra_proxy \ --extra semantic-router \ + --extra saml \ --python python3 -RUN prisma generate --schema=./schema.prisma +RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \ + npm_config_cache=/root/.npm \ + prisma generate --schema=./schema.prisma RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \ sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh @@ -100,7 +104,11 @@ USER root RUN apk add --no-cache bash openssl tzdata nodejs python3 libsndfile WORKDIR /app -ENV PATH="/app/.venv/bin:${PATH}" +ENV PATH="/app/.venv/bin:${PATH}" \ + PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \ + PRISMA_CLI_PATH=/opt/prisma/binaries/node_modules/.bin/prisma \ + PRISMA_CLI_QUERY_ENGINE_TYPE=binary \ + PRISMA_OFFLINE_MODE=true # Copy only what runtime needs. The application is installed inside the venv; # the rest of the builder's /app is source and build metadata that must not @@ -114,16 +122,19 @@ COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/pr # working directory on sys.path; litellm/proxy/hooks resolves # enterprise.enterprise_hooks from it) COPY --from=builder /app/enterprise /app/enterprise -# Prisma binaries live in $HOME/.cache (default prisma-python location), -# which is /root/.cache here. Copy only the Prisma subdirs — copying the -# whole /root/.cache drags in the uv build cache (~660 MB, includes a -# setuptools wheel that surfaces as a CVE finding even though it's not -# on the runtime sys.path). -COPY --from=builder /root/.cache/prisma /root/.cache/prisma -COPY --from=builder /root/.cache/prisma-python /root/.cache/prisma-python +COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras +# Prisma CLI + engines are baked under /opt/prisma, a fixed path every +# runtime uid can read and that no cache volume mount shadows. The paths are +# pinned via PRISMA_BINARY_CACHE_DIR / PRISMA_CLI_PATH and recorded into the +# generated client at build time, so `prisma migrate deploy` on a fresh +# database needs no npm and no network access (#33650, #24554). +COPY --from=builder /opt/prisma /opt/prisma RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \ - find /app/.venv -type d -path "*/tornado/test" -delete + find /app/.venv -type d -path "*/tornado/test" -delete && \ + chmod -R a+rX /opt/prisma && \ + test -x /opt/prisma/binaries/node_modules/.bin/prisma && \ + test -f /opt/prisma/binaries/node_modules/prisma/build/index.js EXPOSE 4000/tcp diff --git a/Makefile b/Makefile index f2753b09ff5..e9b2fb9d8f1 100644 --- a/Makefile +++ b/Makefile @@ -5,15 +5,16 @@ test-unit-integrations test-unit-core-utils test-unit-other test-unit-root \ test-proxy-unit-a test-proxy-unit-b test-integration test-unit-helm \ info lint lint-dev lint-checks format \ - lint-basedpyright lint-basedpyright-budget-update lint-type-discipline lint-type-discipline-budget-update \ + lint-basedpyright lint-e2e-basedpyright lint-basedpyright-budget-update lint-type-discipline lint-type-discipline-budget-update \ lint-ruff-budget lint-ruff-budget-update lint-budget-update lint-gate \ install-dev install-proxy-dev install-test-deps install-hooks \ install-helm-unittest check-circular-imports check-import-safety pre-commit \ - lint-install lint-fetch-base + lint-install lint-fetch-base bootstrap # Default target help: @echo "Available commands:" + @echo " make bootstrap - Provision a fresh clone/worktree" @echo " make install-dev - Install development dependencies" @echo " make install-proxy-dev - Install proxy development dependencies" @echo " make install-dev-ci - Install dev dependencies (CI-compatible, pins OpenAI)" @@ -27,6 +28,7 @@ help: @echo " make lint - Run all linting (Ruff, basedpyright, format check, circular imports, import safety)" @echo " make lint-ruff - Run Ruff linting only" @echo " make lint-basedpyright - Run basedpyright strict, gated by per-rule error counts" + @echo " make lint-e2e-basedpyright - Run basedpyright over tests/e2e (zero errors allowed)" @echo " make lint-basedpyright-budget-update - Ratchet basedpyright limits down by what this branch fixed" @echo " make lint-format - Check ruff format formatting (matches CI)" @echo " make lint-ruff-budget - Gate the codebase total of each strict ruff rule against its limit" @@ -54,6 +56,7 @@ UV := uv UV_RUN := $(UV) run --no-sync LINT_DEP_INSTALL ?= install-dev +LINT_E2E_DEP_INSTALL ?= lint-install LINT_DEP_BASE ?= lint-fetch-base LINT_JOBS := $(shell sysctl -n hw.ncpu 2>/dev/null || nproc 2>/dev/null || echo 4) LINT_OUTPUT_SYNC := $(if $(filter output-sync,$(.FEATURES)),--output-sync=target,) @@ -69,6 +72,18 @@ info: install-dev: $(UV) sync --inexact --frozen +bootstrap: + $(UV) sync --inexact --frozen --extra proxy --group proxy-dev --group e2e-dev + $(UV_RUN) python scripts/prisma_generate_if_needed.py + cd ui/litellm-dashboard && npm ci --no-audit --no-fund + @main_root=$$(git worktree list --porcelain | head -1 | sed 's/^worktree //'); \ + if [ "$$main_root" != "$$(git rev-parse --show-toplevel)" ] && [ -f "$$main_root/.env" ] && [ ! -f .env ]; then \ + cp "$$main_root/.env" .env && echo "bootstrap: copied .env from $$main_root"; \ + else \ + echo "bootstrap: .env left untouched"; \ + fi + @echo "bootstrap: done" + install-proxy-dev: $(UV) sync --frozen --group proxy-dev --extra proxy @@ -111,7 +126,7 @@ lint-fetch-base: # CI's). --inexact tops up the venv instead of pruning the proxy extras gen:api and the # running proxy need. lint-install: - $(UV) sync --inexact --frozen --group proxy-dev + $(UV) sync --inexact --frozen --group proxy-dev --group e2e-dev $(UV_RUN) python scripts/prisma_generate_if_needed.py # Diff-scoped format check, identical to test-linting.yml's "Check ruff format" step: @@ -161,9 +176,14 @@ lint-ruff-FULL-dev: install-dev if [ -n "$$files" ]; then echo "$$files" | xargs $(UV_RUN) ruff check; \ else echo "No changed .py files to check."; fi +lint-basedpyright lint-basedpyright-budget-update: export NODE_OPTIONS := --max-old-space-size=12288 + lint-basedpyright: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE) ($(UV_RUN) basedpyright --outputjson || true) | $(UV_RUN) python scripts/type_check_gate.py --base origin/litellm_internal_staging +lint-e2e-basedpyright: $(LINT_E2E_DEP_INSTALL) + $(UV_RUN) basedpyright tests/e2e + # Type-discipline budget (mutable collections / casts / type guards / kwargs / # unexplained suppressions), the test-linting.yml step `make lint` used to omit. lint-type-discipline: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE) @@ -208,9 +228,9 @@ check-import-safety: $(LINT_DEP_INSTALL) # base fetch) runs once up front; the checks themselves are independent, so a sub-make # fans them out with -j and the fast ones finish under basedpyright's shadow. lint: lint-install lint-fetch-base - $(MAKE) -j $(LINT_JOBS) $(LINT_OUTPUT_SYNC) LINT_DEP_INSTALL= LINT_DEP_BASE= lint-checks + $(MAKE) -j $(LINT_JOBS) $(LINT_OUTPUT_SYNC) LINT_DEP_INSTALL= LINT_E2E_DEP_INSTALL= LINT_DEP_BASE= lint-checks -lint-checks: lint-format-check-changed lint-ruff lint-gate lint-type-discipline lint-basedpyright check-circular-imports check-import-safety +lint-checks: lint-format-check-changed lint-ruff lint-gate lint-type-discipline lint-basedpyright lint-e2e-basedpyright check-circular-imports check-import-safety # Faster linting for local development (only checks changed code) lint-dev: lint-format-changed check-circular-imports check-import-safety diff --git a/README.md b/README.md index 90d3e944fcc..32b0160dbaa 100644 --- a/README.md +++ b/README.md @@ -552,17 +552,12 @@ The Terraform modules live at [`terraform/litellm/aws/`](./terraform/litellm/aws 2. Run dependent services `docker-compose up db prometheus` #### Backend -1. (In root) create virtual environment `python -m venv .venv` -2. Activate virtual environment `source .venv/bin/activate` -3. Install dependencies `uv sync --all-extras --group proxy-dev` -4. `uv run prisma generate` -5. `prisma generate` -6. Start proxy backend `python litellm/proxy/proxy_cli.py` +1. Run `make bootstrap` +2. Start proxy backend: `uv run python litellm/proxy/proxy_cli.py` #### Frontend -1. Navigate to `ui/litellm-dashboard` -2. Install dependencies `npm install` -3. Run `npm run dev` to start the dashboard +1. Navigate to `ui/litellm-dashboard` (dependencies were already installed w/ `make bootstrap`) +2. Start dashboard: `npm run dev` ### Verify Docker Image Signatures diff --git a/backend/routes/allowlist.py b/backend/routes/allowlist.py index b67f7d42127..a0efa19f320 100644 --- a/backend/routes/allowlist.py +++ b/backend/routes/allowlist.py @@ -18,6 +18,7 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = ( "/team/", "/v2/team/", "/organization/", + "/v2/organization/", "/customer/", "/end_user/", "/sso/", @@ -46,6 +47,7 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = ( "/fallback", "/fallbacks", "/cache_settings", + "/coordination_redis/", "/cost_tracking", "/cost/", "/credentials", @@ -68,6 +70,10 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = ( "/project/", "/memory/", "/mcp/", + # Control plane (see the List Endpoints + Tables standard). Every resource + # eventually moves under this prefix, so allowlist it once rather than + # per-resource. + "/management/v1/", # Spend / analytics "/spend/", "/analytics/", diff --git a/basedpyright-code-budget.json b/basedpyright-code-budget.json index cb3427bed4d..db3c2502e94 100644 --- a/basedpyright-code-budget.json +++ b/basedpyright-code-budget.json @@ -1,9 +1,9 @@ { "reportAny": { - "limit": 37484 + "limit": 33216 }, "reportArgumentType": { - "limit": 2704 + "limit": 2648 }, "reportAssignmentType": { "limit": 330 @@ -12,7 +12,7 @@ "limit": 516 }, "reportCallIssue": { - "limit": 124 + "limit": 123 }, "reportConstantRedefinition": { "limit": 59 @@ -24,7 +24,7 @@ "limit": 42 }, "reportExplicitAny": { - "limit": 10397 + "limit": 10228 }, "reportFunctionMemberAccess": { "limit": 11 @@ -54,10 +54,10 @@ "limit": 0 }, "reportMissingParameterType": { - "limit": 5900 + "limit": 5893 }, "reportMissingTypeArgument": { - "limit": 15918 + "limit": 15886 }, "reportMissingTypeStubs": { "limit": 41 @@ -99,31 +99,31 @@ "limit": 0 }, "reportUnknownArgumentType": { - "limit": 45894 + "limit": 45567 }, "reportUnknownLambdaType": { "limit": 113 }, "reportUnknownMemberType": { - "limit": 40541 + "limit": 40525 }, "reportUnknownParameterType": { - "limit": 20418 + "limit": 20384 }, "reportUnknownVariableType": { - "limit": 32151 + "limit": 32099 }, "reportUnnecessaryCast": { "limit": 177 }, "reportUnnecessaryComparison": { - "limit": 1025 + "limit": 1023 }, "reportUnnecessaryContains": { "limit": 7 }, "reportUnnecessaryIsInstance": { - "limit": 1212 + "limit": 1206 }, "reportUntypedBaseClass": { "limit": 165 diff --git a/ci_cd/generate_model_prices_schema.py b/ci_cd/generate_model_prices_schema.py new file mode 100644 index 00000000000..0f449f01ec9 --- /dev/null +++ b/ci_cd/generate_model_prices_schema.py @@ -0,0 +1,325 @@ +from __future__ import annotations + +import json +import sys +from pathlib import Path +from typing import Optional + +import jsonschema + +REPO_ROOT = Path(__file__).parent.parent +PRICES_PATH = REPO_ROOT / "model_prices_and_context_window.json" +SCHEMA_PATH = REPO_ROOT / "model_prices_and_context_window.schema.json" + +SPECIAL_ROOT_KEYS = frozenset({"sample_spec", "fallback_generalizations"}) + +JsonSchema = dict + +NONNEG_NUMBER: JsonSchema = {"type": "number", "minimum": 0} +NONNEG_INTEGER: JsonSchema = {"type": "integer", "minimum": 0} +BOOLEAN: JsonSchema = {"type": "boolean"} +STRING: JsonSchema = {"type": "string"} + +EXTRA_BOOLEAN_KEYS = frozenset( + { + "gemini_native_audio", + "gemini_audio_only_live", + "uses_embed_content", + "use_openai_responses_path", + "bedrock_converse_supports_strict_tools", + } +) + +OBJECT_KEYS: dict[str, JsonSchema] = { + "search_context_cost_per_query": { + "type": "object", + "description": "USD cost per web search query, keyed by search context size.", + "properties": { + "search_context_size_low": NONNEG_NUMBER, + "search_context_size_medium": NONNEG_NUMBER, + "search_context_size_high": NONNEG_NUMBER, + }, + "additionalProperties": False, + }, + "metadata": { + "type": "object", + "description": "Free-form notes about the entry (e.g. pricing derivation).", + }, + "provider_specific_entry": { + "type": "object", + "description": "Provider-internal routing hints (e.g. bedrock_invocation_schema).", + }, +} + +ARRAY_KEYS: dict[str, JsonSchema] = { + "supported_endpoints": { + "type": "array", + "description": "OpenAI-style API routes this model can be called through, e.g. /v1/chat/completions.", + "items": STRING, + }, + "supported_modalities": { + "type": "array", + "description": "Input modalities the model accepts.", + "items": {"type": "string", "enum": ["text", "image", "audio", "video"]}, + }, + "supported_output_modalities": { + "type": "array", + "description": "Output modalities the model can produce.", + "items": {"type": "string", "enum": ["text", "image", "audio", "video", "code"]}, + }, + "supported_regions": { + "type": "array", + "description": "Cloud regions the model is available in ('global' or region ids).", + "items": STRING, + }, + "tiered_pricing": { + "type": "array", + "description": "Context-length or result-count tiered rates; each tier's costs apply within its range.", + "items": { + "type": "object", + "properties": { + "range": { + "type": "array", + "description": "[min, max] prompt-token span this tier applies to.", + "items": NONNEG_NUMBER, + "minItems": 2, + "maxItems": 2, + }, + "max_results_range": { + "type": "array", + "description": "[min, max] result-count span this tier applies to (search models).", + "items": NONNEG_NUMBER, + "minItems": 2, + "maxItems": 2, + }, + "input_cost_per_token": NONNEG_NUMBER, + "output_cost_per_token": NONNEG_NUMBER, + "output_cost_per_reasoning_token": NONNEG_NUMBER, + "cache_read_input_token_cost": NONNEG_NUMBER, + "input_cost_per_query": NONNEG_NUMBER, + }, + "additionalProperties": False, + }, + }, +} + +INTEGER_KEYS: dict[str, JsonSchema] = { + "max_tokens": { + **NONNEG_INTEGER, + "description": "Legacy field: max output tokens if the provider specifies it, else max input tokens.", + }, + "max_input_tokens": { + **NONNEG_INTEGER, + "description": "Maximum prompt/context tokens the model accepts.", + }, + "max_output_tokens": { + **NONNEG_INTEGER, + "description": "Maximum tokens the model can generate in one response.", + }, + "output_vector_size": { + **NONNEG_INTEGER, + "description": "Embedding dimension for embedding models.", + }, + "prompt_cache_min_tokens": { + **NONNEG_INTEGER, + "description": "Smallest prefix the provider will actually cache; absent means the provider default applies.", + }, + "tpm": {**NONNEG_INTEGER, "description": "Provider default tokens-per-minute limit."}, + "rpm": {**NONNEG_INTEGER, "description": "Provider default requests-per-minute limit."}, +} + +NUMBER_KEYS: dict[str, JsonSchema] = { + "regional_processing_uplift_multiplier_eu": { + "type": "number", + "minimum": 1, + "description": "Multiplier applied to all token costs for EU data residency (e.g. 1.10 = +10%).", + }, + "regional_processing_uplift_multiplier_us": { + "type": "number", + "minimum": 1, + "description": "Multiplier applied to all token costs for US data residency (e.g. 1.10 = +10%).", + }, +} + +COST_DESCRIPTIONS: dict[str, str] = { + "input_cost_per_token": "USD per prompt token.", + "output_cost_per_token": "USD per generated token.", + "output_cost_per_reasoning_token": "USD per reasoning/thinking token, when billed separately.", + "cache_creation_input_token_cost": "USD per token written to the provider's prompt cache.", + "cache_read_input_token_cost": "USD per prompt token served from the provider's prompt cache.", + "input_cost_per_token_batches": "USD per prompt token via the provider's batch API.", + "output_cost_per_token_batches": "USD per generated token via the provider's batch API.", +} + + +def cost_description(key: str) -> Optional[str]: + if key in COST_DESCRIPTIONS: + return COST_DESCRIPTIONS[key] + if key.endswith("_flex"): + return "Flex service-tier rate for the same-named base field." + if key.endswith("_priority"): + return "Priority service-tier rate for the same-named base field." + if "_above_" in key: + return "Rate applied once the prompt exceeds the token threshold in the field name." + return None + + +def cost_schema(key: str) -> JsonSchema: + description = cost_description(key) + return {**NONNEG_NUMBER, "description": description} if description else dict(NONNEG_NUMBER) + + +def string_key_schemas(modes: tuple) -> dict[str, JsonSchema]: + return { + "litellm_provider": { + "type": "string", + "description": "LiteLLM provider slug; one of https://docs.litellm.ai/docs/providers.", + }, + "mode": { + "type": "string", + "description": "Primary API surface / task type of the model.", + "enum": list(modes), + }, + "source": { + "type": "string", + "description": "URL of the provider pricing/model page this entry was taken from.", + }, + "deprecation_date": { + "type": "string", + "description": "Date the provider deprecates the model, YYYY-MM-DD.", + "format": "date", + "pattern": "^\\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\\d|3[01])$", + }, + "web_search_billing_unit": { + "type": "string", + "description": "Whether web search is billed per query or per prompt.", + "enum": ["per_query", "per_prompt"], + }, + "bedrock_output_config_effort_ceiling": { + "type": "string", + "description": "Highest reasoning effort the Bedrock output_config accepts for this model.", + "enum": ["low", "medium", "high", "max", "xhigh"], + }, + "comment": STRING, + "audio_transcription_config": STRING, + } + + +def classify(key: str, modes: tuple) -> Optional[JsonSchema]: + curated = {**OBJECT_KEYS, **ARRAY_KEYS, **string_key_schemas(modes), **INTEGER_KEYS, **NUMBER_KEYS} + if key in curated: + return curated[key] + if key.startswith("supports_") or key in EXTRA_BOOLEAN_KEYS: + return BOOLEAN + if "cost" in key: + return cost_schema(key) + return None + + +def build_schema(prices: dict) -> JsonSchema: + entries = {name: entry for name, entry in prices.items() if name not in SPECIAL_ROOT_KEYS} + all_keys = tuple(sorted({key for entry in entries.values() for key in entry})) + modes = tuple(sorted({entry["mode"] for entry in entries.values() if "mode" in entry})) + unclassified = tuple(key for key in all_keys if classify(key, modes) is None) + if unclassified: + raise SystemExit( + f"Unclassified keys in {PRICES_PATH.name}: {', '.join(unclassified)}. " + f"Add them to the key tables in {Path(__file__).name} and rerun it." + ) + entry_properties = {key: classify(key, modes) for key in all_keys} + return { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "title": "LiteLLM model_prices_and_context_window.json", + "description": ( + "Schema for LiteLLM's model price and context window registry " + "(https://github.com/BerriAI/litellm/blob/main/model_prices_and_context_window.json). " + "Every top-level key except 'sample_spec' and 'fallback_generalizations' is a model id, " + "optionally prefixed with its provider (e.g. 'azure/gpt-5.4'), mapping to a model entry. " + "All costs are USD per unit. New optional fields are added regularly, so consumers should " + "ignore unknown fields rather than reject them." + ), + "type": "object", + "properties": { + "sample_spec": { + "type": "object", + "description": ( + "Documentation placeholder illustrating the entry shape; not a real model and not " + "schema-conformant (several values are prose)." + ), + }, + "fallback_generalizations": { + "type": "object", + "description": "Regex rules that generalize unknown model ids to known families; not a model entry.", + "properties": { + "rules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": STRING, + "pattern": STRING, + "description": STRING, + }, + "required": ["name", "pattern"], + "additionalProperties": True, + }, + } + }, + "additionalProperties": False, + }, + }, + "additionalProperties": {"$ref": "#/$defs/modelEntry"}, + "$defs": { + "modelEntry": { + "type": "object", + "description": ( + "Pricing, limits, and capability flags for one model. Fields other than litellm_provider " + "are optional; boolean capability flags are simply omitted when unknown or false." + ), + "required": ["litellm_provider"], + "properties": entry_properties, + "additionalProperties": True, + } + }, + } + + +def render(schema: JsonSchema) -> str: + return json.dumps(schema, indent=2) + "\n" + + +def validation_errors(prices: dict, schema: JsonSchema) -> tuple: + validator = jsonschema.Draft202012Validator( + schema, format_checker=jsonschema.Draft202012Validator.FORMAT_CHECKER + ) + return tuple( + f"{'.'.join(str(part) for part in error.absolute_path)}: {error.message}" + for error in validator.iter_errors(prices) + ) + + +def main() -> int: + check = "--check" in sys.argv[1:] + prices = json.loads(PRICES_PATH.read_text()) + rendered = render(build_schema(prices)) + errors = validation_errors(prices, json.loads(rendered)) + if errors: + print(f"{PRICES_PATH.name} does not validate against the generated schema:") + print("\n".join(errors[:20])) + return 1 + if not check: + SCHEMA_PATH.write_text(rendered) + print(f"wrote {SCHEMA_PATH}") + return 0 + if not SCHEMA_PATH.exists() or SCHEMA_PATH.read_text() != rendered: + print( + f"{SCHEMA_PATH.name} is out of sync with {PRICES_PATH.name}. " + f"Run `python {Path(__file__).relative_to(REPO_ROOT)}` and commit the result." + ) + return 1 + print(f"{SCHEMA_PATH.name} is in sync and {PRICES_PATH.name} validates against it") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/db_scripts/backfill_daily_tool_spend.sql b/db_scripts/backfill_daily_tool_spend.sql new file mode 100644 index 00000000000..309b9dbe0ff --- /dev/null +++ b/db_scripts/backfill_daily_tool_spend.sql @@ -0,0 +1,46 @@ +-- One-shot backfill of the LiteLLM_DailyToolSpend rollup from the per-request +-- LiteLLM_SpendLogToolIndex x LiteLLM_SpendLogs tables. +-- +-- This is an opt-in, manual operation. New deployments do not need it: the +-- rollup is written at request time from the moment the release is deployed. +-- Run it only if you want the Cost Optimization "Spend by tool" card to show +-- history from before the deploy, and only once. +-- +-- IMPORTANT caveats before running: +-- +-- 1. Pre-deploy index rows may include tools that were merely DECLARED in a +-- request body but never invoked (the release this ships with stops +-- recording those). For agentic clients that declare many tools per +-- request, backfilled history attributes each request's full spend to +-- every declared tool, overstating per-tool spend. Post-deploy rows do not +-- have this problem. If your traffic is mostly such clients, consider not +-- backfilling. +-- +-- 2. Coverage is bounded by spend-log retention: rows older than +-- maximum_spend_logs_retention_period are already gone. +-- +-- 3. Replace the cutover timestamp below with the time you deployed the +-- release, so backfilled per-request rows cannot double-count on top of +-- rollup rows the new writer already created. ON CONFLICT DO NOTHING is a +-- second guard for (date, tool_name) buckets the writer already touched: +-- such buckets keep the writer's numbers and skip the backfill's. +-- +-- Usage: +-- psql "$DATABASE_URL" -v cutover="'2026-07-25T00:00:00Z'" -f db_scripts/backfill_daily_tool_spend.sql + +SET TIME ZONE 'UTC'; + +INSERT INTO "LiteLLM_DailyToolSpend" (date, tool_name, spend, total_tokens, request_count, created_at, updated_at) +SELECT + to_char(ti.start_time, 'YYYY-MM-DD') AS date, + ti.tool_name, + COALESCE(SUM(sl.spend), 0) AS spend, + COALESCE(SUM(sl.total_tokens), 0) AS total_tokens, + COUNT(*) AS request_count, + now() AS created_at, + now() AS updated_at +FROM "LiteLLM_SpendLogToolIndex" ti +JOIN "LiteLLM_SpendLogs" sl ON sl.request_id = ti.request_id +WHERE ti.start_time < :cutover::timestamptz +GROUP BY 1, 2 +ON CONFLICT (date, tool_name) DO NOTHING; diff --git a/dist/litellm-1.79.1.tar.gz b/dist/litellm-1.79.1.tar.gz deleted file mode 100644 index 5980922c1b5..00000000000 Binary files a/dist/litellm-1.79.1.tar.gz and /dev/null differ diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database index 4564ee403fe..9ee076ce825 100644 --- a/docker/Dockerfile.database +++ b/docker/Dockerfile.database @@ -62,6 +62,7 @@ RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-gr --extra proxy-runtime \ --extra extra_proxy \ --extra semantic-router \ + --extra saml \ --python python3 # Copy full source tree @@ -82,9 +83,12 @@ RUN uv sync --frozen --no-default-groups --no-editable \ --extra proxy-runtime \ --extra extra_proxy \ --extra semantic-router \ + --extra saml \ --python python3 -RUN prisma generate --schema=./schema.prisma +RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \ + npm_config_cache=/root/.npm \ + prisma generate --schema=./schema.prisma RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \ sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh @@ -97,7 +101,11 @@ USER root RUN apk add --no-cache bash openssl tzdata nodejs python3 libsndfile WORKDIR /app -ENV PATH="/app/.venv/bin:${PATH}" +ENV PATH="/app/.venv/bin:${PATH}" \ + PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \ + PRISMA_CLI_PATH=/opt/prisma/binaries/node_modules/.bin/prisma \ + PRISMA_CLI_QUERY_ENGINE_TYPE=binary \ + PRISMA_OFFLINE_MODE=true # Copy only what runtime needs. The application is installed inside the venv; # the rest of the builder's /app is source and build metadata that must not @@ -111,16 +119,21 @@ COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/pr # working directory on sys.path; litellm/proxy/hooks resolves # enterprise.enterprise_hooks from it) COPY --from=builder /app/enterprise /app/enterprise -# Prisma binaries live in $HOME/.cache (default prisma-python location), -# which is /root/.cache here. Copy them from the builder so they survive -# deployments that volume-mount /app/.cache (e.g. readOnlyRootFilesystem -# + emptyDir) — otherwise the mount would shadow the baked-in query engine. -# Only the Prisma subdirs: the whole /root/.cache drags in the uv build cache. -COPY --from=builder /root/.cache/prisma /root/.cache/prisma -COPY --from=builder /root/.cache/prisma-python /root/.cache/prisma-python +COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras +# Prisma CLI + engines are baked under /opt/prisma, a fixed path every +# runtime uid can read and that no cache volume mount shadows (unlike +# /app/.cache or $HOME/.cache in readOnlyRootFilesystem + emptyDir setups). +# The paths are pinned via PRISMA_BINARY_CACHE_DIR / PRISMA_CLI_PATH and +# recorded into the generated client at build time, so `prisma migrate +# deploy` on a fresh database needs no npm and no network access +# (#33650, #24554). +COPY --from=builder /opt/prisma /opt/prisma RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \ - find /app/.venv -type d -path "*/tornado/test" -delete + find /app/.venv -type d -path "*/tornado/test" -delete && \ + chmod -R a+rX /opt/prisma && \ + test -x /opt/prisma/binaries/node_modules/.bin/prisma && \ + test -f /opt/prisma/binaries/node_modules/prisma/build/index.js EXPOSE 4000/tcp diff --git a/docker/Dockerfile.non_root b/docker/Dockerfile.non_root index 1883e87be60..946b4de6f5e 100644 --- a/docker/Dockerfile.non_root +++ b/docker/Dockerfile.non_root @@ -54,7 +54,6 @@ ENV UV_PROJECT_ENVIRONMENT=/app/.venv \ UV_LINK_MODE=copy \ PATH="/app/.venv/bin:${PATH}" \ LITELLM_NON_ROOT=true \ - PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ XDG_CACHE_HOME=/app/.cache # Copy dependency metadata first for layer caching @@ -69,6 +68,7 @@ RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \ --extra proxy-runtime \ --extra extra_proxy \ --extra semantic-router \ + --extra saml \ --python python3 # Copy full source tree @@ -95,6 +95,7 @@ RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \ --extra proxy-runtime \ --extra extra_proxy \ --extra semantic-router \ + --extra saml \ --python python3 \ --no-sources-package litellm-proxy-extras; \ else \ @@ -103,10 +104,13 @@ RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \ --extra proxy-runtime \ --extra extra_proxy \ --extra semantic-router \ + --extra saml \ --python python3; \ fi -RUN prisma generate --schema=./schema.prisma +RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \ + npm_config_cache=/root/.npm \ + prisma generate --schema=./schema.prisma RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \ sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh @@ -127,8 +131,6 @@ RUN for i in 1 2 3; do \ # the rest of the builder's /app is source and build metadata that must not # ship (manifest-scanning tools attribute everything in it to this image). # entrypoint.sh invokes litellm/proxy/prisma_migration.py by source path. -# Prisma caches live under /app/.cache here (XDG_CACHE_HOME / -# PRISMA_BINARY_CACHE_DIR) so the runtime prisma generate finds them. COPY --from=builder /app/.venv /app/.venv COPY --from=builder /app/docker /app/docker COPY --from=builder /app/schema.prisma /app/schema.prisma @@ -137,21 +139,36 @@ COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/pr # working directory on sys.path; litellm/proxy/hooks resolves # enterprise.enterprise_hooks from it) COPY --from=builder /app/enterprise /app/enterprise -COPY --from=builder /app/.cache /app/.cache +COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras +# Prisma CLI + engines are baked under /opt/prisma, a fixed path every runtime +# uid can read and that no cache volume mount shadows (unlike /app/.cache or +# $HOME/.cache under readOnlyRootFilesystem + emptyDir or arbitrary-uid setups). +# PRISMA_CLI_QUERY_ENGINE_TYPE=binary makes the CLI use the baked binary query +# engine directly, so `prisma migrate deploy` on a fresh database needs no npm +# and no network access; without it the CLI looks for the library engine, which +# prisma stopped baking, and falls back to a download that fails offline or as a +# non-writable uid (#33650, #24554). +COPY --from=builder /opt/prisma /opt/prisma COPY --from=builder /var/lib/litellm/ui /var/lib/litellm/ui COPY --from=builder /var/lib/litellm/assets /var/lib/litellm/assets +# XDG_CACHE_HOME is intentionally left unset so it falls back to $HOME/.cache +# (/app/.cache, writable by the runtime uid). The prisma bake at the read-only +# /opt/prisma is anchored by PRISMA_BINARY_CACHE_DIR / PRISMA_CLI_PATH, so +# nothing needs XDG to point there; pointing it at the read-only bake would +# deny any XDG-aware library that writes a cache at runtime. ENV PATH="/app/.venv/bin:${PATH}" \ - PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ + PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \ + PRISMA_CLI_PATH=/opt/prisma/binaries/node_modules/.bin/prisma \ + PRISMA_CLI_QUERY_ENGINE_TYPE=binary \ HOME=/app \ LITELLM_NON_ROOT=true \ - XDG_CACHE_HOME=/app/.cache \ PRISMA_SKIP_POSTINSTALL_GENERATE=1 \ PRISMA_HIDE_UPDATE_MESSAGE=1 \ PRISMA_ENGINES_CHECKSUM_IGNORE_MISSING=1 \ PRISMA_OFFLINE_MODE=true -RUN mkdir -p /nonexistent /var/lib/litellm/assets /var/lib/litellm/ui && \ +RUN mkdir -p /nonexistent /app/.cache /var/lib/litellm/assets /var/lib/litellm/ui && \ chown -R nobody:nogroup /app /var/lib/litellm/ui /var/lib/litellm/assets /nonexistent && \ PRISMA_PATH=$(python -c "import os, prisma; print(os.path.dirname(prisma.__file__))") && \ chown -R nobody:nogroup "$PRISMA_PATH" && \ @@ -164,12 +181,14 @@ RUN mkdir -p /nonexistent /var/lib/litellm/assets /var/lib/litellm/ui && \ [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g=u "$LITELLM_PROXY_EXTRAS_PATH" || true && \ chmod -R g+w "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \ [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g+w "$LITELLM_PROXY_EXTRAS_PATH" || true && \ - chmod -R g+rX "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets /app/.cache + chmod -R g+rX "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \ + chmod -R a+rX /opt/prisma && \ + test -x /opt/prisma/binaries/node_modules/.bin/prisma && \ + test -f /opt/prisma/binaries/node_modules/prisma/build/index.js && \ + ls /opt/prisma/binaries/node_modules/@prisma/engines/query-engine-* >/dev/null 2>&1 USER 65534 -RUN prisma generate --schema=./schema.prisma - EXPOSE 4000/tcp ENTRYPOINT ["/app/docker/prod_entrypoint.sh"] diff --git a/docker/build_from_pip/Dockerfile.build_from_pip b/docker/build_from_pip/Dockerfile.build_from_pip index bda742c71a9..372606a5b0f 100644 --- a/docker/build_from_pip/Dockerfile.build_from_pip +++ b/docker/build_from_pip/Dockerfile.build_from_pip @@ -36,7 +36,7 @@ RUN uv venv --python python && \ "opentelemetry-api==1.28.0" \ "opentelemetry-sdk==1.28.0" \ "opentelemetry-exporter-otlp==1.28.0" \ - "ddtrace==2.19.0" \ + "ddtrace==4.11.0" \ "sentry-sdk==2.21.0" \ "mangum==0.17.0" \ "azure-ai-contentsafety==1.0.0" \ diff --git a/enterprise/README.md b/enterprise/README.md index f5eb5078e81..c708dad5a06 100644 --- a/enterprise/README.md +++ b/enterprise/README.md @@ -6,4 +6,4 @@ Code in this folder is licensed under a commercial license. Please review the [L 👉 **Using in an Enterprise / Need specific features ?** Meet with us [here](https://enterprise.litellm.ai/demo?month=2024-02) -See all Enterprise Features here 👉 [Docs](https://docs.litellm.ai/docs/proxy/enterprise) +See all Enterprise Features here 👉 [Docs](https://docs.litellm.ai/docs/enterprise) diff --git a/enterprise/litellm_enterprise/enterprise_callbacks/llm_guard.py b/enterprise/litellm_enterprise/enterprise_callbacks/llm_guard.py index ad8aabf77b6..d10b5a2ab09 100644 --- a/enterprise/litellm_enterprise/enterprise_callbacks/llm_guard.py +++ b/enterprise/litellm_enterprise/enterprise_callbacks/llm_guard.py @@ -7,7 +7,8 @@ # Thank you users! We ❤️ you! - Krrish & Ishaan ## This provides an LLM Guard Integration for content moderation on the proxy -from typing import Literal, Optional +import asyncio +from typing import Optional import aiohttp from fastapi import HTTPException @@ -18,7 +19,6 @@ from litellm.integrations.custom_logger import CustomLogger from litellm.proxy._types import UserAPIKeyAuth from litellm.secret_managers.main import get_secret_str from litellm.types.utils import CallTypesLiteral -from litellm.utils import get_formatted_prompt class _ENTERPRISE_LLMGuard(CustomLogger): @@ -46,45 +46,44 @@ class _ENTERPRISE_LLMGuard(CustomLogger): except Exception: pass - async def moderation_check(self, text: str): + async def moderation_check(self, text: str) -> str: """ + Runs the LLM Guard moderation check on ``text``. + + Raises an HTTPException when the content violates the safety policy; + otherwise returns the sanitized prompt from LLM Guard, falling back to + the original text when the API does not provide one. + [TODO] make this more performant for high-throughput scenario """ try: - async with aiohttp.ClientSession() as session: - if self.mock_redacted_text is not None: - redacted_text = self.mock_redacted_text - else: - # Make the first request to /analyze - analyze_url = f"{self.llm_guard_api_base}analyze/prompt" - verbose_proxy_logger.debug("Making request to: %s", analyze_url) - analyze_payload = {"prompt": text} - redacted_text = None + if self.mock_redacted_text is not None: + redacted_text = self.mock_redacted_text + else: + analyze_url = f"{self.llm_guard_api_base}analyze/prompt" + verbose_proxy_logger.debug("Making request to: %s", analyze_url) + async with aiohttp.ClientSession() as session: async with session.post( - analyze_url, json=analyze_payload + analyze_url, json={"prompt": text} ) as response: redacted_text = await response.json() - verbose_proxy_logger.debug( - f"LLM Guard: Received response - {redacted_text}" + verbose_proxy_logger.debug( + f"LLM Guard: Received response - {redacted_text}" + ) + if redacted_text is None: + raise HTTPException( + status_code=500, + detail={ + "error": f"Invalid content moderation response: {redacted_text}" + }, ) - if redacted_text is not None: - if ( - redacted_text.get("is_valid", None) is not None - and redacted_text["is_valid"] is False - ): - raise HTTPException( - status_code=400, - detail={"error": "Violated content safety policy"}, - ) - else: - pass - else: - raise HTTPException( - status_code=500, - detail={ - "error": f"Invalid content moderation response: {redacted_text}" - }, - ) + if redacted_text.get("is_valid", None) is False: + raise HTTPException( + status_code=400, + detail={"error": "Violated content safety policy"}, + ) + sanitized_prompt = redacted_text.get("sanitized_prompt") + return sanitized_prompt if isinstance(sanitized_prompt, str) else text except Exception as e: verbose_proxy_logger.exception( "litellm.enterprise.enterprise_hooks.llm_guard::moderation_check - Exception occurred - {}".format( @@ -138,23 +137,75 @@ class _ENTERPRISE_LLMGuard(CustomLogger): return self.print_verbose("Makes LLM Guard Check") - try: - assert call_type in [ - "completion", - "embeddings", - "image_generation", - "moderation", - "audio_transcription", - ] - except Exception: + if call_type not in [ + "completion", + "embeddings", + "image_generation", + "moderation", + "audio_transcription", + ]: self.print_verbose( f"Call Type - {call_type}, not in accepted list - ['completion','embeddings','image_generation','moderation','audio_transcription']" ) return data - formatted_prompt = get_formatted_prompt(data=data, call_type=call_type) # type: ignore - self.print_verbose(f"LLM Guard, formatted_prompt: {formatted_prompt}") - return await self.moderation_check(text=formatted_prompt) + return await self._moderate_request(data=data) + + async def _moderate_request(self, data: dict) -> dict: + """ + Sanitizes the request in place using the prompt returned by LLM Guard so + the provider-bound request carries the redacted content, then returns it. + """ + messages = data.get("messages") + if messages is not None: + data["messages"] = list( + await asyncio.gather( + *(self._moderate_message(message) for message in messages) + ) + ) + return data + + input_ = data.get("input") + if input_ is not None: + data["input"] = await self._moderate_input(input_) + return data + + prompt = data.get("prompt") + if isinstance(prompt, str): + data["prompt"] = await self.moderation_check(text=prompt) + return data + + async def _moderate_message(self, message: dict) -> dict: + content = message.get("content") + if isinstance(content, str): + return {**message, "content": await self.moderation_check(text=content)} + if isinstance(content, list): + return { + **message, + "content": list( + await asyncio.gather( + *(self._moderate_content_part(part) for part in content) + ) + ), + } + return message + + async def _moderate_content_part(self, part: dict) -> dict: + if part.get("type") == "text" and isinstance(part.get("text"), str): + return {**part, "text": await self.moderation_check(text=part["text"])} + return part + + async def _moderate_input(self, input_: object) -> object: + if isinstance(input_, str): + return await self.moderation_check(text=input_) + if isinstance(input_, list): + return [ + await self.moderation_check(text=item) + if isinstance(item, str) + else item + for item in input_ + ] + return input_ async def async_post_call_streaming_hook( self, user_api_key_dict: UserAPIKeyAuth, response: str diff --git a/enterprise/litellm_enterprise/enterprise_callbacks/pagerduty/pagerduty.py b/enterprise/litellm_enterprise/enterprise_callbacks/pagerduty/pagerduty.py index 12fdaeb6a81..f920aa7ac13 100644 --- a/enterprise/litellm_enterprise/enterprise_callbacks/pagerduty/pagerduty.py +++ b/enterprise/litellm_enterprise/enterprise_callbacks/pagerduty/pagerduty.py @@ -113,6 +113,10 @@ class PagerDutyAlerting(SlackAlerting): user_api_key_spend=_meta.get("user_api_key_spend"), user_api_key_max_budget=_meta.get("user_api_key_max_budget"), user_api_key_budget_reset_at=_meta.get("user_api_key_budget_reset_at"), + user_api_key_user_spend=_meta.get("user_api_key_user_spend"), + user_api_key_user_max_budget=_meta.get("user_api_key_user_max_budget"), + user_api_key_team_spend=_meta.get("user_api_key_team_spend"), + user_api_key_team_max_budget=_meta.get("user_api_key_team_max_budget"), user_api_key_org_id=_meta.get("user_api_key_org_id"), user_api_key_org_alias=_meta.get("user_api_key_org_alias"), user_api_key_team_id=_meta.get("user_api_key_team_id"), @@ -196,6 +200,10 @@ class PagerDutyAlerting(SlackAlerting): if user_api_key_dict.budget_reset_at else None ), + user_api_key_user_spend=user_api_key_dict.user_spend, + user_api_key_user_max_budget=user_api_key_dict.user_max_budget, + user_api_key_team_spend=user_api_key_dict.team_spend, + user_api_key_team_max_budget=user_api_key_dict.team_max_budget, user_api_key_org_id=user_api_key_dict.org_id, user_api_key_org_alias=user_api_key_dict.organization_alias, user_api_key_team_id=user_api_key_dict.team_id, diff --git a/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py b/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py index b9ac98f515c..f209ab54f64 100644 --- a/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py +++ b/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py @@ -29,7 +29,7 @@ class CheckBatchCost: proxy_logging_obj: "ProxyLogging", prisma_client: "PrismaClient", llm_router: "Router", - track_unmanaged_vertex_batch_cost: bool = False, + track_unmanaged_batch_cost: bool = False, ): from litellm.proxy.utils import PrismaClient, ProxyLogging from litellm.router import Router @@ -37,7 +37,7 @@ class CheckBatchCost: self.proxy_logging_obj: ProxyLogging = proxy_logging_obj self.prisma_client: PrismaClient = prisma_client self.llm_router: Router = llm_router - self._track_unmanaged_vertex_batch_cost = track_unmanaged_vertex_batch_cost + self._track_unmanaged_batch_cost = track_unmanaged_batch_cost # Cached after the first poll cycle. Once we know the column is absent we skip # the guaranteed-failing primary query on every subsequent cycle. self._has_batch_processed_column: bool = True @@ -118,11 +118,11 @@ class CheckBatchCost: Resolve (model_id, batch_id) for a managed-object row, where model_id is a router deployment id and batch_id is the raw provider batch id. - Managed batches encode both in a base64 unified id. Unmanaged Vertex batches, created with - a raw gs:// input_file_id, store the raw provider job id as unified_object_id; when - track_unmanaged_vertex_batch_cost is enabled the model is derived from the gs:// path and - mapped to a configured vertex_ai deployment. Returns None (recording a metric) when the row - can't be routed. + Managed batches encode both in a base64 unified id. Unmanaged batches (created outside + LiteLLM's own /v1/batches with a raw input_file_id) store the raw provider job id as + unified_object_id instead; when track_unmanaged_batch_cost is enabled the model is derived + from the provider-specific input_file_id layout (Vertex gs:// or Bedrock s3://) and mapped + to a matching deployment. Returns None (recording a metric) when the row can't be routed. """ from litellm.proxy.openai_files_endpoints.common_utils import ( _is_base64_encoded_unified_file_id, @@ -142,8 +142,43 @@ class CheckBatchCost: return None return model_id, get_batch_id_from_unified_batch_id(decoded) - if self._track_unmanaged_vertex_batch_cost: - return self._resolve_unmanaged_vertex_routing(job, prom_logger) + if self._track_unmanaged_batch_cost: + from litellm.llms.bedrock.batches.transformation import ( + BedrockBatchesConfig, + ) + from litellm.llms.vertex_ai.batches.transformation import ( + VertexAIBatchTransformation, + ) + + input_file_id = self._get_input_file_id(job) + if VertexAIBatchTransformation.is_unmanaged_gcs_batch_input_file_id( + input_file_id + ): + assert input_file_id is not None # narrowed by is_unmanaged_gcs_batch_input_file_id + return self._resolve_unmanaged_provider_routing( + job=job, + prom_logger=prom_logger, + llm_provider="vertex_ai", + bare_model_name=VertexAIBatchTransformation.get_bare_model_name_from_gcs_file( + input_file_id + ), + ) + if BedrockBatchesConfig.is_unmanaged_s3_batch_input_file_id(input_file_id): + assert input_file_id is not None # narrowed by is_unmanaged_s3_batch_input_file_id + return self._resolve_unmanaged_provider_routing( + job=job, + prom_logger=prom_logger, + llm_provider="bedrock", + bare_model_name=BedrockBatchesConfig.get_bare_model_name_from_s3_file( + input_file_id + ), + ) + verbose_proxy_logger.info( + f"Skipping job {unified_object_id}: not a recognized unmanaged batch " + "(no gs:// or s3:// input_file_id with an embedded model)" + ) + self._record_error(prom_logger, "invalid_unified_id") + return None verbose_proxy_logger.info( f"Skipping job {unified_object_id} because it is not a valid unified object id" @@ -151,36 +186,17 @@ class CheckBatchCost: self._record_error(prom_logger, "invalid_unified_id") return None - def _resolve_unmanaged_vertex_routing( + def _resolve_unmanaged_provider_routing( self, job: "LiteLLM_ManagedObjectTable", prom_logger: Optional["PrometheusLogger"], + llm_provider: str, + bare_model_name: str, ) -> Optional[Tuple[str, str]]: - from litellm.llms.vertex_ai.batches.transformation import ( - VertexAIBatchTransformation, - ) - - input_file_id = self._get_input_file_id(job) - if not VertexAIBatchTransformation.is_unmanaged_gcs_batch_input_file_id( - input_file_id - ): - verbose_proxy_logger.info( - f"Skipping job {job.unified_object_id}: not an unmanaged vertex batch " - "(no gs:// input_file_id with a publishers/ model path)" - ) - self._record_error(prom_logger, "invalid_unified_id") - return None - assert input_file_id is not None # narrowed by is_unmanaged_gcs_batch_input_file_id - - bare_model_name = VertexAIBatchTransformation.get_bare_model_name_from_gcs_file( - input_file_id - ) - deployment_id = self._get_vertex_ai_deployment_id_for_bare_model( - bare_model_name - ) + deployment_id = self._get_deployment_id_for_bare_model(bare_model_name, llm_provider) if deployment_id is None: verbose_proxy_logger.info( - f"Skipping unmanaged vertex batch {job.unified_object_id}: no vertex_ai " + f"Skipping unmanaged {llm_provider} batch {job.unified_object_id}: no {llm_provider} " f"deployment configured for model {bare_model_name}" ) self._record_error(prom_logger, "unmanaged_no_matching_deployment") @@ -188,22 +204,22 @@ class CheckBatchCost: return deployment_id, job.unified_object_id - def _get_vertex_ai_deployment_id_for_bare_model( - self, bare_model_name: str + def _get_deployment_id_for_bare_model( + self, bare_model_name: str, llm_provider: str ) -> Optional[str]: model_group = self.llm_router.resolve_model_name_from_model_id(bare_model_name) deployment_id = ( - self._get_vertex_ai_deployment_id(model_group) if model_group else None + self._get_deployment_id_for_provider(model_group, llm_provider) if model_group else None ) if deployment_id is not None: return deployment_id - return self._get_vertex_ai_deployment_id_from_matching_deployments( - bare_model_name + return self._get_deployment_id_from_matching_deployments( + bare_model_name, llm_provider ) - def _get_vertex_ai_deployment_id_from_matching_deployments( - self, bare_model_name: str + def _get_deployment_id_from_matching_deployments( + self, bare_model_name: str, llm_provider: str ) -> Optional[str]: from litellm.litellm_core_utils.get_llm_provider_logic import get_llm_provider @@ -215,13 +231,13 @@ class CheckBatchCost: if not self._is_bare_model_match(actual_model, bare_model_name): continue try: - _, llm_provider, _, _ = get_llm_provider( + _, deployment_llm_provider, _, _ = get_llm_provider( model=actual_model, custom_llm_provider=litellm_params.get("custom_llm_provider"), ) except Exception: continue - if llm_provider != "vertex_ai": + if deployment_llm_provider != llm_provider: continue model_info = deployment.get("model_info") or {} deployment_id = model_info.get("id") @@ -231,15 +247,21 @@ class CheckBatchCost: @staticmethod def _is_bare_model_match(actual_model: str, bare_model_name: str) -> bool: + # Bedrock model ids may have ":" replaced with "-" in the S3 object key (see + # BedrockBatchesConfig.get_bare_model_name_from_s3_file), so normalize both sides; + # a no-op for providers like vertex_ai whose model ids never contain a colon. + normalized_actual = actual_model.replace(":", "-") + normalized_bare = bare_model_name.replace(":", "-") return ( - actual_model == bare_model_name - or actual_model.endswith(f"/{bare_model_name}") - or actual_model.endswith(f":{bare_model_name}") + normalized_actual == normalized_bare + or normalized_actual.endswith(f"/{normalized_bare}") ) - def _get_vertex_ai_deployment_id(self, model_group: str) -> Optional[str]: + def _get_deployment_id_for_provider( + self, model_group: str, llm_provider: str + ) -> Optional[str]: """ - Returns the first deployment id for `model_group` whose provider is vertex_ai, + Returns the first deployment id for `model_group` whose provider is `llm_provider`, skipping deployments from other providers that happen to share the model group name. """ from litellm.litellm_core_utils.get_llm_provider_logic import get_llm_provider @@ -249,13 +271,13 @@ class CheckBatchCost: if deployment_info is None: continue try: - _, llm_provider, _, _ = get_llm_provider( + _, deployment_llm_provider, _, _ = get_llm_provider( model=deployment_info.litellm_params.model, custom_llm_provider=deployment_info.litellm_params.custom_llm_provider, ) except Exception: continue - if llm_provider == "vertex_ai": + if deployment_llm_provider == llm_provider: return deployment_id return None diff --git a/enterprise/litellm_enterprise/proxy/hooks/managed_files.py b/enterprise/litellm_enterprise/proxy/hooks/managed_files.py index 3f42867d90e..8821736d0ff 100644 --- a/enterprise/litellm_enterprise/proxy/hooks/managed_files.py +++ b/enterprise/litellm_enterprise/proxy/hooks/managed_files.py @@ -316,26 +316,34 @@ class _PROXY_LiteLLMManagedFiles(CustomLogger, BaseFileEndpoints): where_clause: Dict[str, Any] = {"file_purpose": "batch", **owner_filter} if after: - where_clause["id"] = {"gt": after} + cursor_row = ( + await self.prisma_client.db.litellm_managedobjecttable.find_first( + where={**where_clause, "unified_object_id": after} + ) + ) + if cursor_row is None: + raise HTTPException( + status_code=400, + detail=f"Invalid 'after' cursor: no batch found with id '{after}'.", + ) - fetch_limit = limit or 20 - if target_model_names: - # Oversample so post-fetch model-name filtering still has enough rows. - fetch_limit = max(fetch_limit * 3, 100) + page_size = limit or 20 + cursor_args: Dict[str, Any] = ( + {"cursor": {"unified_object_id": after}, "skip": 1} if after else {} + ) batches = await self.prisma_client.db.litellm_managedobjecttable.find_many( where=where_clause, - take=fetch_limit, - order={"created_at": "desc"}, + take=page_size + 1, + order=[{"created_at": "desc"}, {"unified_object_id": "desc"}], + **cursor_args, ) - batch_objects: List[LiteLLMBatch] = [] - for batch in batches: - try: - # Stop once we have enough after filtering - if len(batch_objects) >= (limit or 20): - break + has_more = len(batches) > page_size + batch_objects: List[LiteLLMBatch] = [] + for batch in batches[:page_size]: + try: batch_data = ( json.loads(batch.file_object) if isinstance(batch.file_object, str) @@ -351,9 +359,7 @@ class _PROXY_LiteLLMManagedFiles(CustomLogger, BaseFileEndpoints): ) continue - return build_list_page( - batch_objects, has_more=len(batch_objects) == (limit or 20) - ) + return build_list_page(batch_objects, has_more=has_more) async def get_user_created_file_ids( self, user_api_key_dict: UserAPIKeyAuth, model_object_ids: List[str] diff --git a/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py b/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py index a057df65500..9d668985eb8 100644 --- a/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py +++ b/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py @@ -11,7 +11,8 @@ Endpoints for /project operations #### PROJECT MANAGEMENT #### import json -from typing import List, Optional, Union +from collections.abc import Mapping, Sequence +from typing import TYPE_CHECKING from fastapi import APIRouter, Depends, HTTPException, Request @@ -25,15 +26,24 @@ from litellm.proxy.management_helpers.utils import ( ) from litellm.proxy.utils import PrismaClient, handle_exception_on_proxy +if TYPE_CHECKING: + from prisma import models as prisma_models + from prisma.actions import LiteLLM_TeamTableActions + router = APIRouter() +def _team_table(prisma_client: PrismaClient) -> "LiteLLM_TeamTableActions[prisma_models.LiteLLM_TeamTable]": + team_table: LiteLLM_TeamTableActions[prisma_models.LiteLLM_TeamTable] = prisma_client.db.litellm_teamtable + return team_table + + async def _check_user_permission_for_project( user_api_key_dict: UserAPIKeyAuth, - team_id: Optional[str], + team_id: str | None, prisma_client: PrismaClient, require_admin: bool = False, - team_object: Optional[LiteLLM_TeamTable] = None, + team_object: LiteLLM_TeamTable | None = None, ) -> bool: """ Check if user has permission to manage a project. @@ -57,9 +67,7 @@ async def _check_user_permission_for_project( team = team_object if team is None: - team = await prisma_client.db.litellm_teamtable.find_unique( - where={"team_id": team_id} - ) + team = await _team_table(prisma_client).find_unique(where={"team_id": team_id}) if team and team.admins: return user_api_key_dict.user_id in team.admins @@ -70,9 +78,9 @@ async def _check_user_permission_for_project( async def _validate_team_exists( team_id: str, prisma_client: PrismaClient, -): +) -> "prisma_models.LiteLLM_TeamTable": """Validate that a team exists. Returns the team row.""" - team = await prisma_client.db.litellm_teamtable.find_unique( + team = await _team_table(prisma_client).find_unique( where={"team_id": team_id}, ) @@ -89,7 +97,7 @@ async def _validate_team_exists( def _check_team_project_limits( team_object: LiteLLM_TeamTable, - data: Union[NewProjectRequest, UpdateProjectRequest], + data: NewProjectRequest | UpdateProjectRequest, ) -> None: """ Check that project limits respect its parent Team's limits. @@ -108,16 +116,12 @@ def _check_team_project_limits( if data.max_budget is not None and data.max_budget < 0: raise HTTPException( status_code=400, - detail={ - "error": f"max_budget cannot be negative. Received: {data.max_budget}" - }, + detail={"error": f"max_budget cannot be negative. Received: {data.max_budget}"}, ) if data.soft_budget is not None and data.soft_budget < 0: raise HTTPException( status_code=400, - detail={ - "error": f"soft_budget cannot be negative. Received: {data.soft_budget}" - }, + detail={"error": f"soft_budget cannot be negative. Received: {data.soft_budget}"}, ) # --- soft_budget < max_budget --- @@ -131,7 +135,7 @@ def _check_team_project_limits( ) # --- Validate project models are a subset of team models --- - project_models = getattr(data, "models", None) + project_models = data.models team_models = team_object.models or [] if project_models and len(team_models) > 0: # If team has 'all-proxy-models', skip validation as it allows all models @@ -148,11 +152,7 @@ def _check_team_project_limits( # --- Validate project max_budget <= team max_budget --- # Team stores budget fields directly (max_budget, tpm_limit, rpm_limit) # unlike Project which uses a separate LiteLLM_BudgetTable relation - if ( - data.max_budget is not None - and team_object.max_budget is not None - and data.max_budget > team_object.max_budget - ): + if data.max_budget is not None and team_object.max_budget is not None and data.max_budget > team_object.max_budget: raise HTTPException( status_code=400, detail={ @@ -161,11 +161,7 @@ def _check_team_project_limits( ) # --- Validate project tpm_limit <= team tpm_limit --- - if ( - data.tpm_limit is not None - and team_object.tpm_limit is not None - and data.tpm_limit > team_object.tpm_limit - ): + if data.tpm_limit is not None and team_object.tpm_limit is not None and data.tpm_limit > team_object.tpm_limit: raise HTTPException( status_code=400, detail={ @@ -174,11 +170,7 @@ def _check_team_project_limits( ) # --- Validate project rpm_limit <= team rpm_limit --- - if ( - data.rpm_limit is not None - and team_object.rpm_limit is not None - and data.rpm_limit > team_object.rpm_limit - ): + if data.rpm_limit is not None and team_object.rpm_limit is not None and data.rpm_limit > team_object.rpm_limit: raise HTTPException( status_code=400, detail={ @@ -189,19 +181,19 @@ def _check_team_project_limits( async def _create_budget_for_project( data: NewProjectRequest, - user_id: Optional[str], + user_id: str | None, litellm_proxy_admin_name: str, prisma_client: PrismaClient, ) -> str: """Create a budget for the project and return budget_id.""" budget_params = LiteLLM_BudgetTable.model_fields.keys() - _json_data = data.json(exclude_none=True) + _json_data: Mapping[str, object] = data.json(exclude_none=True) _budget_data = {k: v for k, v in _json_data.items() if k in budget_params} - budget_row = LiteLLM_BudgetTable(**_budget_data) + budget_row = LiteLLM_BudgetTable.model_validate(_budget_data) new_budget = prisma_client.jsonify_object(budget_row.json(exclude_none=True)) - _budget = await prisma_client.db.litellm_budgettable.create( + _budget: prisma_models.LiteLLM_BudgetTable = await prisma_client.db.litellm_budgettable.create( data={ **new_budget, "created_by": user_id or litellm_proxy_admin_name, @@ -214,8 +206,8 @@ async def _create_budget_for_project( async def _set_project_object_permission( data: NewProjectRequest, - prisma_client: Optional[PrismaClient], -) -> Optional[str]: + prisma_client: PrismaClient | None, +) -> str | None: """ Creates the LiteLLM_ObjectPermissionTable record for the project. Returns the object_permission_id if created, otherwise None. @@ -224,7 +216,7 @@ async def _set_project_object_permission( return None if data.object_permission is not None: - created_object_permission = ( + created_object_permission: prisma_models.LiteLLM_ObjectPermissionTable = ( await prisma_client.db.litellm_objectpermissiontable.create( data=data.object_permission.model_dump(exclude_none=True), ) @@ -344,8 +336,7 @@ async def new_project( raise HTTPException( status_code=403, detail={ - "error": "Only premium users can add tags to projects. " - + CommonProxyErrors.not_premium_user.value + "error": "Only premium users can add tags to projects. " + CommonProxyErrors.not_premium_user.value }, ) @@ -353,8 +344,7 @@ async def new_project( raise HTTPException( status_code=403, detail={ - "error": "Project management is an enterprise feature. " - + CommonProxyErrors.not_premium_user.value + "error": "Project management is an enterprise feature. " + CommonProxyErrors.not_premium_user.value }, ) @@ -375,13 +365,11 @@ async def new_project( ) # Validate team exists and get team object with budget - team_object = await _validate_team_exists( - team_id=data.team_id, prisma_client=prisma_client - ) + team_object = await _validate_team_exists(team_id=data.team_id, prisma_client=prisma_client) # Validate project limits against team limits _check_team_project_limits( - team_object=LiteLLM_TeamTable(**team_object.model_dump()), + team_object=LiteLLM_TeamTable.model_validate(team_object.model_dump()), data=data, ) @@ -391,7 +379,7 @@ async def new_project( user_api_key_dict=user_api_key_dict, team_id=data.team_id, prisma_client=prisma_client, - team_object=LiteLLM_TeamTable(**team_object.model_dump()), + team_object=LiteLLM_TeamTable.model_validate(team_object.model_dump()), ) if not has_permission: @@ -449,17 +437,13 @@ async def new_project( value=getattr(data, field), ) - new_project_row = prisma_client.jsonify_object( - project_row.json(exclude_none=True) - ) + new_project_row = prisma_client.jsonify_object(project_row.json(exclude_none=True)) # Remove budget fields (following organization_endpoints.py pattern) new_project_row = _remove_budget_fields_from_project_data(new_project_row) - verbose_proxy_logger.info( - f"new_project_row: {json.dumps(new_project_row, indent=2)}" - ) - response = await prisma_client.db.litellm_projecttable.create( + verbose_proxy_logger.info(f"new_project_row: {json.dumps(new_project_row, indent=2)}") + response: prisma_models.LiteLLM_ProjectTable = await prisma_client.db.litellm_projecttable.create( data={ **new_project_row, # type: ignore }, @@ -469,9 +453,7 @@ async def new_project( return response except Exception as e: verbose_proxy_logger.exception( - "litellm.proxy.management_endpoints.project_endpoints.new_project(): Exception occured - {}".format( - str(e) - ) + "litellm.proxy.management_endpoints.project_endpoints.new_project(): Exception occured - {}".format(str(e)) ) raise handle_exception_on_proxy(e) @@ -539,8 +521,7 @@ async def update_project( raise HTTPException( status_code=403, detail={ - "error": "Only premium users can add tags to projects. " - + CommonProxyErrors.not_premium_user.value + "error": "Only premium users can add tags to projects. " + CommonProxyErrors.not_premium_user.value }, ) @@ -548,8 +529,7 @@ async def update_project( raise HTTPException( status_code=403, detail={ - "error": "Project management is an enterprise feature. " - + CommonProxyErrors.not_premium_user.value + "error": "Project management is an enterprise feature. " + CommonProxyErrors.not_premium_user.value }, ) @@ -576,9 +556,9 @@ async def update_project( ) # Fetch existing project - existing_project = await prisma_client.db.litellm_projecttable.find_unique( - where={"project_id": data.project_id} - ) + existing_project: ( + prisma_models.LiteLLM_ProjectTable | None + ) = await prisma_client.db.litellm_projecttable.find_unique(where={"project_id": data.project_id}) if existing_project is None: raise ProxyException( @@ -595,9 +575,7 @@ async def update_project( target_team_id = data.team_id or existing_project.team_id target_team_obj = None if target_team_id is not None: - target_team_obj = await _validate_team_exists( - team_id=target_team_id, prisma_client=prisma_client - ) + target_team_obj = await _validate_team_exists(team_id=target_team_id, prisma_client=prisma_client) has_permission = await _check_user_permission_for_project( user_api_key_dict=user_api_key_dict, @@ -620,32 +598,26 @@ async def update_project( team_id=data.team_id, prisma_client=prisma_client, team_object=( - LiteLLM_TeamTable(**target_team_obj.model_dump()) - if target_team_obj - else None + LiteLLM_TeamTable.model_validate(target_team_obj.model_dump()) if target_team_obj else None ), ) if not can_assign_to_target: raise HTTPException( status_code=403, - detail={ - "error": "Cannot reassign project to a team you are not an admin of" - }, + detail={"error": "Cannot reassign project to a team you are not an admin of"}, ) # Validate project limits against team limits if target_team_obj is not None: _check_team_project_limits( - team_object=LiteLLM_TeamTable(**target_team_obj.model_dump()), + team_object=LiteLLM_TeamTable.model_validate(target_team_obj.model_dump()), data=data, ) # Prepare update data update_data = data.json(exclude_none=True, exclude={"project_id"}) update_data = prisma_client.jsonify_object(update_data) - update_data["updated_by"] = ( - user_api_key_dict.user_id or litellm_proxy_admin_name - ) + update_data["updated_by"] = user_api_key_dict.user_id or litellm_proxy_admin_name # Handle budget updates budget_fields = LiteLLM_BudgetTable.model_fields.keys() @@ -671,21 +643,17 @@ async def update_project( if existing_project.object_permission_id: # Update existing permission await prisma_client.db.litellm_objectpermissiontable.update( - where={ - "object_permission_id": existing_project.object_permission_id - }, + where={"object_permission_id": existing_project.object_permission_id}, data=object_permission_data, ) else: # Create new permission - created_permission = ( + created_permission: prisma_models.LiteLLM_ObjectPermissionTable = ( await prisma_client.db.litellm_objectpermissiontable.create( data=object_permission_data, ) ) - update_data["object_permission_id"] = ( - created_permission.object_permission_id - ) + update_data["object_permission_id"] = created_permission.object_permission_id # Handle metadata fields for field in LiteLLM_ManagementEndpoint_MetadataFields: @@ -698,7 +666,7 @@ async def update_project( update_data = _remove_budget_fields_from_project_data(update_data) # Update project - updated_project = await prisma_client.db.litellm_projecttable.update( + updated_project: prisma_models.LiteLLM_ProjectTable | None = await prisma_client.db.litellm_projecttable.update( where={"project_id": data.project_id}, data=update_data, include={"litellm_budget_table": True, "object_permission": True}, @@ -718,7 +686,7 @@ async def update_project( "/project/delete", tags=["project management"], dependencies=[Depends(user_api_key_auth)], - response_model=List[LiteLLM_ProjectTable], + response_model=list[LiteLLM_ProjectTable], ) @management_endpoint_wrapper async def delete_project( @@ -749,8 +717,7 @@ async def delete_project( raise HTTPException( status_code=403, detail={ - "error": "Project management is an enterprise feature. " - + CommonProxyErrors.not_premium_user.value + "error": "Project management is an enterprise feature. " + CommonProxyErrors.not_premium_user.value }, ) @@ -778,9 +745,7 @@ async def delete_project( for project_id in data.project_ids: # Check if project exists - existing_project = await prisma_client.db.litellm_projecttable.find_unique( - where={"project_id": project_id} - ) + existing_project = await prisma_client.db.litellm_projecttable.find_unique(where={"project_id": project_id}) if existing_project is None: raise ProxyException( @@ -791,11 +756,9 @@ async def delete_project( ) # Check if there are any keys associated with this project - associated_keys = ( - await prisma_client.db.litellm_verificationtoken.find_many( - where={"project_id": project_id} - ) - ) + associated_keys: Sequence[ + prisma_models.LiteLLM_VerificationToken + ] = await prisma_client.db.litellm_verificationtoken.find_many(where={"project_id": project_id}) if len(associated_keys) > 0: raise ProxyException( @@ -806,9 +769,9 @@ async def delete_project( ) # Delete the project - deleted_project = await prisma_client.db.litellm_projecttable.delete( - where={"project_id": project_id} - ) + deleted_project: ( + prisma_models.LiteLLM_ProjectTable | None + ) = await prisma_client.db.litellm_projecttable.delete(where={"project_id": project_id}) deleted_projects.append(deleted_project) @@ -854,7 +817,7 @@ async def project_info( ) # Fetch project - project = await prisma_client.db.litellm_projecttable.find_unique( + project: prisma_models.LiteLLM_ProjectTable | None = await prisma_client.db.litellm_projecttable.find_unique( where={"project_id": project_id}, include={"litellm_budget_table": True, "object_permission": True}, ) @@ -872,17 +835,11 @@ async def project_info( is_team_member = False if project.team_id and user_api_key_dict.user_id: - team = await prisma_client.db.litellm_teamtable.find_unique( - where={"team_id": project.team_id} - ) + team = await _team_table(prisma_client).find_unique(where={"team_id": project.team_id}) if team: caller_user_id = user_api_key_dict.user_id for m in team.members_with_roles or []: - m_user_id = ( - m.get("user_id") - if isinstance(m, dict) - else getattr(m, "user_id", None) - ) + m_user_id = m.get("user_id") if isinstance(m, dict) else getattr(m, "user_id", None) if m_user_id == caller_user_id: is_team_member = True break @@ -896,9 +853,7 @@ async def project_info( return project except Exception as e: verbose_proxy_logger.exception( - "litellm.proxy.management_endpoints.project_endpoints.project_info(): Exception occured - {}".format( - str(e) - ) + "litellm.proxy.management_endpoints.project_endpoints.project_info(): Exception occured - {}".format(str(e)) ) raise handle_exception_on_proxy(e) @@ -907,7 +862,7 @@ async def project_info( "/project/list", tags=["project management"], dependencies=[Depends(user_api_key_auth)], - response_model=List[LiteLLM_ProjectTable], + response_model=list[LiteLLM_ProjectTable], ) async def list_projects( user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth), @@ -932,21 +887,19 @@ async def list_projects( # If proxy admin, get all projects if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN: - projects = await prisma_client.db.litellm_projecttable.find_many( + projects: Sequence[ + prisma_models.LiteLLM_ProjectTable + ] = await prisma_client.db.litellm_projecttable.find_many( include={"litellm_budget_table": True, "object_permission": True} ) else: # Look up the user's team memberships via the reverse-index on # LiteLLM_UserTable.teams (maintained by team_member_add alongside # members_with_roles). This avoids a full scan of all team rows. - user_record = await prisma_client.db.litellm_usertable.find_unique( + user_record: prisma_models.LiteLLM_UserTable | None = await prisma_client.db.litellm_usertable.find_unique( where={"user_id": user_api_key_dict.user_id}, ) - user_team_ids = ( - user_record.teams - if user_record is not None and user_record.teams - else [] - ) + user_team_ids: Sequence[str] = user_record.teams if user_record is not None and user_record.teams else [] projects = await prisma_client.db.litellm_projecttable.find_many( where={"team_id": {"in": user_team_ids}}, diff --git a/enterprise/pyproject.toml b/enterprise/pyproject.toml index b3864ce7878..fa209e55eb8 100644 --- a/enterprise/pyproject.toml +++ b/enterprise/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "litellm-enterprise" -version = "0.1.48" +version = "0.1.52" description = "Package for LiteLLM Enterprise features" readme = "README.md" requires-python = ">=3.9" @@ -26,7 +26,7 @@ required-version = ">=0.10.9" module-root = "" [tool.commitizen] -version = "0.1.48" +version = "0.1.52" version_files = [ "pyproject.toml:^version", "../pyproject.toml:litellm-enterprise==", diff --git a/gateway/Dockerfile b/gateway/Dockerfile index da2f2c9c1e0..4b000912393 100644 --- a/gateway/Dockerfile +++ b/gateway/Dockerfile @@ -46,6 +46,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \ --extra proxy-runtime \ --extra extra_proxy \ --extra semantic-router \ + --extra bedrock-realtime \ --python python3 # Stage 2 — copy source and install the project + workspace members. @@ -57,6 +58,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \ --extra proxy-runtime \ --extra extra_proxy \ --extra semantic-router \ + --extra bedrock-realtime \ --python python3 RUN mkdir -p /home/nonroot && \ diff --git a/gateway/routes/allowlist.py b/gateway/routes/allowlist.py index 792a56a2cd8..a80bbc9ca19 100644 --- a/gateway/routes/allowlist.py +++ b/gateway/routes/allowlist.py @@ -54,6 +54,7 @@ GATEWAY_PATH_PREFIXES: tuple[str, ...] = ( "/messages", "/v1/skills", "/v1/a2a/", + "/a2a/", # LiteLLM-native LLM surface "/v1/rerank", "/v2/rerank", diff --git a/helm/litellm-helm/Chart.lock b/helm/litellm-helm/Chart.lock index f13578d8d35..d626fbb472b 100644 --- a/helm/litellm-helm/Chart.lock +++ b/helm/litellm-helm/Chart.lock @@ -5,5 +5,5 @@ dependencies: - name: redis repository: oci://registry-1.docker.io/bitnamicharts version: 18.19.1 -digest: sha256:8660fe6287f9941d08c0902f3f13731079b8cecd2a5da2fbc54e5b7aae4a6f62 -generated: "2024-03-10T02:28:52.275022+05:30" +digest: sha256:38962e231f6596b93f82a8412bbe4cf5de696caecf5775dfbbd163383eb1c009 +generated: "2026-07-28T10:21:22.511401-07:00" diff --git a/helm/litellm-helm/Chart.yaml b/helm/litellm-helm/Chart.yaml index 0aef2442bfe..8ca217825b8 100644 --- a/helm/litellm-helm/Chart.yaml +++ b/helm/litellm-helm/Chart.yaml @@ -18,7 +18,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.1.0 +version: 1.1.1 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to @@ -32,10 +32,10 @@ annotations: dependencies: - name: "postgresql" - version: ">=13.3.0" + version: "14.3.1" repository: oci://registry-1.docker.io/bitnamicharts condition: db.deployStandalone - name: redis - version: ">=18.0.0" + version: "18.19.1" repository: oci://registry-1.docker.io/bitnamicharts condition: redis.enabled diff --git a/helm/litellm-helm/README.md b/helm/litellm-helm/README.md index 74e70f4aeb4..4e0884dd08c 100644 --- a/helm/litellm-helm/README.md +++ b/helm/litellm-helm/README.md @@ -54,6 +54,12 @@ If `db.useStackgresOperator` is used (not yet implemented): | `pdb.annotations` | Extra metadata annotations to add to the PDB | `{}` | | `pdb.labels` | Extra metadata labels to add to the PDB | `{}` | +| `billingMetrics.enabled` | Enable enterprise billable-request metering. Requires an enterprise license. | `false` | +| `billingMetrics.endpoint` | Collector that the billable-request counter is pushed to. | `https://telemetry.litellm.ai` | +| `billingMetrics.secretName` | Name of an existing Secret holding the mTLS client certificate, under the keys `tls.crt` and `tls.key`. | `litellm-billing-metrics-mtls` | +| `billingMetrics.caSecretName` | Name of an existing Secret holding a CA bundle under the key `ca.crt`. Only needed for a private or test collector whose server certificate is not on the public web PKI. | `""` | +| `billingMetrics.exportIntervalMs` | How often the counter is pushed, in milliseconds. The proxy defaults to `60000` when unset. | `""` | + #### Example `proxy_config` ConfigMap from values (default): ``` @@ -94,6 +100,21 @@ data: type: Opaque ``` +#### Enterprise billable-request metering + +Enterprise licenses meter billable requests by pushing a counter to LiteLLM's collector over mutual TLS. The chart does not create the client certificate; it mounts one you already hold, read-only, so the private key is never exposed through the environment. Create the Secret under the name the chart expects, then turn the block on: + +``` +kubectl create secret tls litellm-billing-metrics-mtls --cert=client.crt --key=client.key +``` + +``` +billingMetrics: + enabled: true +``` + +Set `billingMetrics.caSecretName` only when the collector is a private or test one whose server certificate is not on the public web PKI; the production collector needs no CA override. The chart fails the render rather than deploying a proxy that silently never exports, so a missing `secretName` or an emptied `endpoint` surfaces at `helm install` time. + ### Database Settings | Name | Description | Value | @@ -109,6 +130,16 @@ type: Opaque | `db.deployStandalone` | Deploy a standalone, single instance deployment of Postgres, using the Bitnami postgresql chart. This is useful for getting started but doesn't provide HA or (by default) data backups. | `true` | | `postgresql.*` | If `db.deployStandalone` is `true`, configuration passed to the Bitnami postgresql chart. See the [Bitnami Documentation](https://github.com/bitnami/charts/tree/main/bitnami/postgresql) for full configuration details. See [values.yaml](./values.yaml) for the default configuration. | See [values.yaml](./values.yaml) | | `postgresql.auth.*` | If `db.deployStandalone` is `true`, care should be taken to ensure the default `password` and `postgres-password` values are **NOT** used. | `NoTaGrEaTpAsSwOrD` | +| `postgresql.image.*` | If `db.deployStandalone` is `true`, the image for the bundled Postgres. Pinned to a `docker.io/bitnamilegacy` build because Bitnami retired the versioned tags under `docker.io/bitnami`. | `bitnamilegacy/postgresql:16.2.0-debian-12-r6` | +| `redis.image.*` | If `redis.enabled` is `true`, the image for the bundled Redis. Pinned to a `docker.io/bitnamilegacy` build for the same reason. | `bitnamilegacy/redis:7.2.4-debian-12-r9` | + +#### Bundled Postgres image + +Bitnami removed the versioned tags from `docker.io/bitnami` and republished the archived builds under `docker.io/bitnamilegacy`, so the image defaults that ship inside the `postgresql` and `redis` subcharts no longer pull. The chart pins both to the `bitnamilegacy` copies of the exact builds those subchart versions were released with, which keeps the on-disk data directory layout unchanged for existing installs. + +Keep `postgresql.image.tag` pinned. `docker.io/bitnami/postgresql` still publishes a floating `latest`, and pointing the bundled Postgres at a different major version starts the server against a data directory it cannot read (`database files are incompatible with server`). There is no in-place way back, so crossing a major version means dumping the database with the old image and restoring it into the new one. The chart refuses to render when the tag is empty or `latest`. + +Those images no longer receive updates. For anything beyond getting started, run Postgres outside the chart and point at it with `db.useExisting`. #### Example Postgres `db.useExisting` Secret diff --git a/helm/litellm-helm/templates/_helpers.tpl b/helm/litellm-helm/templates/_helpers.tpl index 25b02dd5f37..8f2acb20fce 100644 --- a/helm/litellm-helm/templates/_helpers.tpl +++ b/helm/litellm-helm/templates/_helpers.tpl @@ -50,6 +50,53 @@ app.kubernetes.io/name: {{ include "litellm.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} +{{/* +Enterprise billable-request metering. The client certificate identifies the +deployment to LiteLLM's collector, so it is mounted read-only from an existing +Secret rather than passed through the environment. +*/}} +{{- define "litellm.billingMetrics.certDir" -}}/etc/litellm/billing-mtls{{- end -}} +{{- define "litellm.billingMetrics.caDir" -}}/etc/litellm/billing-mtls-ca{{- end -}} + +{{- define "litellm.billingMetricsEnv" -}} +- name: LITELLM_BILLING_METRICS_ENDPOINT + value: {{ required "billingMetrics.endpoint is required when billingMetrics.enabled is true" .Values.billingMetrics.endpoint | quote }} +- name: LITELLM_BILLING_METRICS_CLIENT_CERT + value: {{ printf "%s/tls.crt" (include "litellm.billingMetrics.certDir" .) | quote }} +- name: LITELLM_BILLING_METRICS_CLIENT_KEY + value: {{ printf "%s/tls.key" (include "litellm.billingMetrics.certDir" .) | quote }} +{{- if .Values.billingMetrics.caSecretName }} +- name: LITELLM_BILLING_METRICS_CA_CERT + value: {{ printf "%s/ca.crt" (include "litellm.billingMetrics.caDir" .) | quote }} +{{- end }} +{{- with .Values.billingMetrics.exportIntervalMs }} +- name: LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS + value: {{ . | quote }} +{{- end }} +{{- end -}} + +{{- define "litellm.billingMetricsVolumes" -}} +- name: billing-metrics-mtls + secret: + secretName: {{ required "billingMetrics.secretName is required when billingMetrics.enabled is true (an existing Secret with tls.crt and tls.key)" .Values.billingMetrics.secretName }} +{{- if .Values.billingMetrics.caSecretName }} +- name: billing-metrics-mtls-ca + secret: + secretName: {{ .Values.billingMetrics.caSecretName }} +{{- end }} +{{- end -}} + +{{- define "litellm.billingMetricsVolumeMounts" -}} +- name: billing-metrics-mtls + mountPath: {{ include "litellm.billingMetrics.certDir" . }} + readOnly: true +{{- if .Values.billingMetrics.caSecretName }} +- name: billing-metrics-mtls-ca + mountPath: {{ include "litellm.billingMetrics.caDir" . }} + readOnly: true +{{- end }} +{{- end -}} + {{/* Create the name of the service account to use */}} @@ -76,10 +123,13 @@ so fall back to "default" (or an explicit override) to avoid a cyclic dependency {{- end }} {{/* -Get redis service name +Get redis service name. +The bundled Redis subchart only serves sentinel in "replication" architecture +(it rejects standalone + sentinel outright), and in that mode the sentinel +Service is named "-redis", not "-redis-master". */}} {{- define "litellm.redis.serviceName" -}} -{{- if and (eq .Values.redis.architecture "standalone") .Values.redis.sentinel.enabled -}} +{{- if .Values.redis.sentinel.enabled -}} {{- printf "%s-%s" .Release.Name (default "redis" .Values.redis.nameOverride | trunc 63 | trimSuffix "-") -}} {{- else -}} {{- printf "%s-%s-master" .Release.Name (default "redis" .Values.redis.nameOverride | trunc 63 | trimSuffix "-") -}} @@ -96,3 +146,18 @@ Get redis service port {{ .Values.redis.master.service.ports.redis }} {{- end -}} {{- end -}} + +{{/* +Reject an unpinned image tag for the bundled PostgreSQL. +A floating tag lets a chart upgrade start a newer PostgreSQL major against the +existing PersistentVolumeClaim. The server then refuses to start on a data +directory written by another major version, and the only way back is a dump +taken before the change, which by that point no longer exists. +*/}} +{{- define "litellm.validateBundledPostgresImageTag" -}} +{{- $tag := .Values.postgresql.image.tag | default "" | toString -}} +{{- $digest := .Values.postgresql.image.digest | default "" | toString -}} +{{- if and (eq $digest "") (or (eq $tag "") (eq $tag "latest")) -}} +{{- fail (printf "postgresql.image.tag must be pinned to an explicit version when db.deployStandalone is true (got %q). An unpinned tag can start a different PostgreSQL major against the existing data directory, which makes the database unreadable and is not recoverable in place. Crossing a major version requires a dump and restore." $tag) -}} +{{- end -}} +{{- end -}} diff --git a/helm/litellm-helm/templates/configmap-litellm.yaml b/helm/litellm-helm/templates/configmap-litellm.yaml index acbe4e3a4b5..03e4f620206 100644 --- a/helm/litellm-helm/templates/configmap-litellm.yaml +++ b/helm/litellm-helm/templates/configmap-litellm.yaml @@ -1,9 +1,22 @@ {{- if .Values.proxyConfigMap.create }} +{{- $config := deepCopy .Values.proxy_config }} +{{- if and .Values.redis.enabled (dig "coordination" "enabled" true .Values.redis) }} +{{- $generalSettings := (get $config "general_settings") | default dict }} +{{- if not (hasKey $generalSettings "coordination_redis") }} +{{- $coordinationRedis := dict "host" "os.environ/REDIS_HOST" "port" "os.environ/REDIS_PORT" "password" "os.environ/REDIS_PASSWORD" }} +{{- if .Values.redis.sentinel.enabled }} +{{- $sentinelNode := list (include "litellm.redis.serviceName" .) (include "litellm.redis.port" . | int) }} +{{- $coordinationRedis = dict "sentinel_nodes" (list $sentinelNode) "service_name" (default "mymaster" .Values.redis.sentinel.masterSet) "password" "os.environ/REDIS_PASSWORD" }} +{{- end }} +{{- $_ := set $generalSettings "coordination_redis" $coordinationRedis }} +{{- $_ := set $config "general_settings" $generalSettings }} +{{- end }} +{{- end }} apiVersion: v1 kind: ConfigMap metadata: name: {{ include "litellm.fullname" . }}-config data: config.yaml: | -{{ .Values.proxy_config | toYaml | indent 6 }} +{{ $config | toYaml | indent 6 }} {{- end }} diff --git a/helm/litellm-helm/templates/deployment.yaml b/helm/litellm-helm/templates/deployment.yaml index b9cd1be06ec..32bfa4b2647 100644 --- a/helm/litellm-helm/templates/deployment.yaml +++ b/helm/litellm-helm/templates/deployment.yaml @@ -142,6 +142,9 @@ spec: {{- with .Values.extraEnvVars }} {{- toYaml . | nindent 12 }} {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsEnv" . | nindent 12 }} + {{- end }} {{- if .Values.migrationJob.enabled }} # Schema updates are owned by the dedicated migrations Job; skip # the proxy's startup `prisma db push` so N replicas don't race @@ -220,6 +223,9 @@ spec: - name: npm mountPath: /.npm {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumeMounts" . | nindent 12 }} + {{- end }} {{- with .Values.volumeMounts }} {{- toYaml . | nindent 12 }} {{- end }} @@ -252,6 +258,9 @@ spec: items: - key: {{ .Values.proxyConfigMap.key | default "config.yaml" }} path: "config.yaml" + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumes" . | nindent 8 }} + {{- end }} {{- with .Values.volumes }} {{- toYaml . | nindent 8 }} {{- end }} diff --git a/helm/litellm-helm/templates/secret-dbcredentials.yaml b/helm/litellm-helm/templates/secret-dbcredentials.yaml index 8851f5802f2..8ab89a4579e 100644 --- a/helm/litellm-helm/templates/secret-dbcredentials.yaml +++ b/helm/litellm-helm/templates/secret-dbcredentials.yaml @@ -1,4 +1,5 @@ {{- if .Values.db.deployStandalone -}} +{{- include "litellm.validateBundledPostgresImageTag" . -}} apiVersion: v1 kind: Secret metadata: diff --git a/helm/litellm-helm/templates/tests/test-servicemonitor.yaml b/helm/litellm-helm/templates/tests/test-servicemonitor.yaml index c2a4f84ec21..ef8475339c3 100644 --- a/helm/litellm-helm/templates/tests/test-servicemonitor.yaml +++ b/helm/litellm-helm/templates/tests/test-servicemonitor.yaml @@ -10,7 +10,7 @@ metadata: spec: containers: - name: test - image: bitnami/kubectl:latest + image: docker.io/bitnamilegacy/kubectl:1.29.2-debian-12-r3 command: ['sh', '-c'] args: - | diff --git a/helm/litellm-helm/tests/billing_metrics_tests.yaml b/helm/litellm-helm/tests/billing_metrics_tests.yaml new file mode 100644 index 00000000000..71803df378c --- /dev/null +++ b/helm/litellm-helm/tests/billing_metrics_tests.yaml @@ -0,0 +1,297 @@ +suite: test billingMetrics wiring on the proxy deployment +templates: + - deployment.yaml + - configmap-litellm.yaml + - migrations-job.yaml +tests: + - it: is off by default, adding no env, volume, or mount + template: deployment.yaml + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: litellm-billing-metrics-mtls + - notContains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls + mountPath: /etc/litellm/billing-mtls + readOnly: true + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + + - it: renders the endpoint and the mounted cert paths when enabled + template: deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CLIENT_CERT + value: /etc/litellm/billing-mtls/tls.crt + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CLIENT_KEY + value: /etc/litellm/billing-mtls/tls.key + + # The conventional Secret name is the default, so enabling the block is enough. + - it: mounts the default cert secret read-only alongside the config volume + template: deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: litellm-billing-metrics-mtls + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls + mountPath: /etc/litellm/billing-mtls + readOnly: true + + - it: honours a secretName override + template: deployment.yaml + set: + billingMetrics: + enabled: true + secretName: my-billing-mtls + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: my-billing-mtls + - notContains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: litellm-billing-metrics-mtls + + - it: honours an endpoint override + template: deployment.yaml + set: + billingMetrics: + enabled: true + endpoint: https://collector.internal:4318 + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://collector.internal:4318 + + # The production collector presents a public web-PKI certificate, so the CA + # override must stay absent unless a private collector is configured. + - it: omits the CA env, volume, and mount when no caSecretName is set + template: deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls-ca + secret: + secretName: billing-ca + - notContains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls-ca + mountPath: /etc/litellm/billing-mtls-ca + readOnly: true + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CA_CERT + value: /etc/litellm/billing-mtls-ca/ca.crt + + - it: mounts the CA secret when caSecretName is set + template: deployment.yaml + set: + billingMetrics: + enabled: true + caSecretName: billing-ca + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CA_CERT + value: /etc/litellm/billing-mtls-ca/ca.crt + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls-ca + secret: + secretName: billing-ca + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls-ca + mountPath: /etc/litellm/billing-mtls-ca + readOnly: true + + - it: passes the export interval through only when set + template: deployment.yaml + set: + billingMetrics: + enabled: true + exportIntervalMs: 5000 + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS + value: "5000" + + - it: omits the export interval when unset + template: deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS + value: "60000" + + # Kubernetes resolves duplicate env names last-wins, so the chart-owned billing + # entries must render after .Values.envVars or a user could silently redirect + # the metering export. The three billing entries are the last ones emitted here + # (migrationJob, which appends DISABLE_SCHEMA_UPDATE, is off for this case). + - it: renders the billing endpoint after envVars so it cannot be shadowed + template: deployment.yaml + set: + migrationJob: + enabled: false + billingMetrics: + enabled: true + envVars: + LITELLM_BILLING_METRICS_ENDPOINT: https://shadowed.example + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://shadowed.example + - equal: + path: spec.template.spec.containers[0].env[-3] + value: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - equal: + path: spec.template.spec.containers[0].env[-2].name + value: LITELLM_BILLING_METRICS_CLIENT_CERT + - equal: + path: spec.template.spec.containers[0].env[-1].name + value: LITELLM_BILLING_METRICS_CLIENT_KEY + + - it: keeps user-supplied volumes and mounts alongside the billing secret + template: deployment.yaml + set: + billingMetrics: + enabled: true + volumes: + - name: custom-callbacks + configMap: + name: my-callbacks + volumeMounts: + - name: custom-callbacks + mountPath: /app/callbacks + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: custom-callbacks + configMap: + name: my-callbacks + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: litellm-billing-metrics-mtls + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: custom-callbacks + mountPath: /app/callbacks + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls + mountPath: /etc/litellm/billing-mtls + readOnly: true + + - it: still mounts the proxy config when enabled + template: deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: litellm-config + mountPath: /etc/litellm/config.yaml + subPath: config.yaml + + # Only the proxy serves billable traffic. The migrations Job must never mount + # the client certificate, and it renders its own env and volumes, so nothing + # stops a future edit from wiring the billing include into it by mistake. + - it: does not touch the migrations job when enabled + template: migrations-job.yaml + set: + billingMetrics: + enabled: true + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - notExists: + path: spec.template.spec.containers[0].volumeMounts + - notExists: + path: spec.template.spec.volumes + + - it: fails loudly when enabled with an emptied secretName + template: deployment.yaml + set: + billingMetrics: + enabled: true + secretName: "" + asserts: + - failedTemplate: + errorMessage: billingMetrics.secretName is required when billingMetrics.enabled is true (an existing Secret with tls.crt and tls.key) + + - it: fails loudly when enabled without an endpoint + template: deployment.yaml + set: + billingMetrics: + enabled: true + endpoint: "" + asserts: + - failedTemplate: + errorMessage: billingMetrics.endpoint is required when billingMetrics.enabled is true diff --git a/helm/litellm-helm/tests/bundled_db_images_tests.yaml b/helm/litellm-helm/tests/bundled_db_images_tests.yaml new file mode 100644 index 00000000000..8f0860c2721 --- /dev/null +++ b/helm/litellm-helm/tests/bundled_db_images_tests.yaml @@ -0,0 +1,94 @@ +suite: test bundled database images +templates: + - charts/postgresql/templates/primary/statefulset.yaml + - charts/redis/templates/master/application.yaml + - charts/redis/templates/configmap.yaml + - charts/redis/templates/health-configmap.yaml + - charts/redis/templates/scripts-configmap.yaml + - charts/redis/templates/secret.yaml + - secret-dbcredentials.yaml + - templates/tests/test-servicemonitor.yaml +tests: + - it: should pull the bundled postgres from a repository that still publishes the pinned tag + template: charts/postgresql/templates/primary/statefulset.yaml + set: + db.deployStandalone: true + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: docker.io/bitnamilegacy/postgresql:16.2.0-debian-12-r6 + + - it: should pull the bundled postgres metrics exporter from the same repository + template: charts/postgresql/templates/primary/statefulset.yaml + set: + db.deployStandalone: true + postgresql.metrics.enabled: true + asserts: + - equal: + path: spec.template.spec.containers[1].image + value: docker.io/bitnamilegacy/postgres-exporter:0.15.0-debian-12-r14 + + - it: should run the bundled postgres init container from the same repository + template: charts/postgresql/templates/primary/statefulset.yaml + set: + db.deployStandalone: true + postgresql.volumePermissions.enabled: true + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: docker.io/bitnamilegacy/os-shell:12-debian-12-r16 + + - it: should pull the bundled redis from a repository that still publishes the pinned tag + template: charts/redis/templates/master/application.yaml + set: + redis.enabled: true + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: docker.io/bitnamilegacy/redis:7.2.4-debian-12-r9 + + - it: should reject a floating postgres tag that could cross a major version on an existing volume + template: secret-dbcredentials.yaml + set: + db.deployStandalone: true + postgresql.image.tag: latest + asserts: + - failedTemplate: + errorMessage: 'postgresql.image.tag must be pinned to an explicit version when db.deployStandalone is true (got "latest"). An unpinned tag can start a different PostgreSQL major against the existing data directory, which makes the database unreadable and is not recoverable in place. Crossing a major version requires a dump and restore.' + + - it: should reject an empty postgres tag + template: secret-dbcredentials.yaml + set: + db.deployStandalone: true + postgresql.image.tag: "" + asserts: + - failedTemplate: + errorMessage: 'postgresql.image.tag must be pinned to an explicit version when db.deployStandalone is true (got ""). An unpinned tag can start a different PostgreSQL major against the existing data directory, which makes the database unreadable and is not recoverable in place. Crossing a major version requires a dump and restore.' + + - it: should accept an empty postgres tag when the image is pinned by digest + template: secret-dbcredentials.yaml + set: + db.deployStandalone: true + postgresql.image.tag: "" + postgresql.image.digest: sha256:0d0e2f1a5b3c4d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6 + asserts: + - hasDocuments: + count: 1 + + - it: should run the servicemonitor test pod from a pinned image + template: templates/tests/test-servicemonitor.yaml + set: + serviceMonitor.enabled: true + asserts: + - equal: + path: spec.containers[0].image + value: docker.io/bitnamilegacy/kubectl:1.29.2-debian-12-r3 + + - it: should not constrain the postgres tag when the bundled database is not deployed + template: secret-dbcredentials.yaml + set: + db.deployStandalone: false + postgresql.image.tag: latest + asserts: + - hasDocuments: + count: 0 diff --git a/helm/litellm-helm/tests/coordination_redis_tests.yaml b/helm/litellm-helm/tests/coordination_redis_tests.yaml new file mode 100644 index 00000000000..0b58b1e6bc8 --- /dev/null +++ b/helm/litellm-helm/tests/coordination_redis_tests.yaml @@ -0,0 +1,143 @@ +suite: test coordination redis +templates: + - configmap-litellm.yaml + - deployment.yaml +tests: + - it: should not render coordination_redis when redis is disabled + template: configmap-litellm.yaml + set: + redis.enabled: false + asserts: + - notMatchRegex: + path: data["config.yaml"] + pattern: coordination_redis + + - it: should not emit redis env vars when redis is disabled + template: deployment.yaml + set: + redis.enabled: false + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_HOST + value: RELEASE-NAME-redis-master + any: true + + - it: should render coordination_redis pointing at the bundled redis when enabled + template: configmap-litellm.yaml + set: + redis.enabled: true + asserts: + - matchRegex: + path: data["config.yaml"] + pattern: "coordination_redis:\n host: os.environ/REDIS_HOST\n password: os.environ/REDIS_PASSWORD\n port: os.environ/REDIS_PORT\n" + - matchRegex: + path: data["config.yaml"] + pattern: "master_key: os.environ/PROXY_MASTER_KEY" + + - it: should emit redis env vars backing the coordination_redis os.environ refs + template: deployment.yaml + set: + redis.enabled: true + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_HOST + value: RELEASE-NAME-redis-master + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_PORT + value: "6379" + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: RELEASE-NAME-redis + key: redis-password + + - it: should not render coordination_redis when coordination is opted out + template: configmap-litellm.yaml + set: + redis.enabled: true + redis.coordination.enabled: false + asserts: + - notMatchRegex: + path: data["config.yaml"] + pattern: coordination_redis + + - it: should keep emitting redis env vars when coordination is opted out + template: deployment.yaml + set: + redis.enabled: true + redis.coordination.enabled: false + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_HOST + value: RELEASE-NAME-redis-master + + - it: should not clobber a user supplied coordination_redis block + template: configmap-litellm.yaml + set: + redis.enabled: true + proxy_config.general_settings.coordination_redis: + url: os.environ/COORDINATION_REDIS_URL + asserts: + - matchRegex: + path: data["config.yaml"] + pattern: "coordination_redis:\n url: os.environ/COORDINATION_REDIS_URL\n" + - notMatchRegex: + path: data["config.yaml"] + pattern: "host: os.environ/REDIS_HOST" + + - it: should render sentinel_nodes and service_name in sentinel mode + template: configmap-litellm.yaml + set: + redis.enabled: true + redis.architecture: replication + redis.sentinel.enabled: true + asserts: + # The sentinel Service the redis subchart renders is "-redis", and a + # plain client cannot speak the sentinel protocol, so host/port must not appear + - matchRegex: + path: data["config.yaml"] + pattern: "coordination_redis:\n password: os.environ/REDIS_PASSWORD\n sentinel_nodes:\n - - RELEASE-NAME-redis\n - 26379\n service_name: mymaster\n" + - notMatchRegex: + path: data["config.yaml"] + pattern: "host: os.environ/REDIS_HOST" + + - it: should carry a custom sentinel masterSet into service_name + template: configmap-litellm.yaml + set: + redis.enabled: true + redis.architecture: replication + redis.sentinel.enabled: true + redis.sentinel.masterSet: litellm-master + asserts: + - matchRegex: + path: data["config.yaml"] + pattern: "service_name: litellm-master" + + - it: should point REDIS_HOST at the sentinel service in sentinel mode + template: deployment.yaml + set: + redis.enabled: true + redis.architecture: replication + redis.sentinel.enabled: true + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_HOST + value: RELEASE-NAME-redis + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_PORT + value: "26379" diff --git a/helm/litellm-helm/values.yaml b/helm/litellm-helm/values.yaml index 6e30a6af444..7235bb0bd78 100644 --- a/helm/litellm-helm/values.yaml +++ b/helm/litellm-helm/values.yaml @@ -139,6 +139,20 @@ masterkeySecretName: "" # if set, use this secret key for the master key; otherwise, use the default key masterkeySecretKey: "" +# Optional: enterprise billable-request metering. When enabled, the proxy counts +# successful requests to inference, MCP, and A2A endpoints and pushes them to +# LiteLLM's collector over mutual TLS. Requires an enterprise license. +# The client certificate identifies the deployment, so it is mounted read-only +# from an existing Secret and never passed through the environment. +billingMetrics: + enabled: false + endpoint: https://telemetry.litellm.ai # collector to push the counter to + secretName: litellm-billing-metrics-mtls # existing Secret holding tls.crt and tls.key + # Only for private or test collectors whose server certificate is not on the + # public web PKI. The production collector needs no CA override. + caSecretName: "" # existing Secret holding ca.crt + exportIntervalMs: "" # push cadence; the proxy defaults to 60000 + proxyConfigMap: # when true, creates a new configmap create: true @@ -314,8 +328,32 @@ lifecycle: {} # Settings for Bitnami postgresql chart (if db.deployStandalone is true, ignored # otherwise) +# +# Bitnami retired the versioned tags under docker.io/bitnami and republished the +# archived builds under docker.io/bitnamilegacy, so the subchart's own image +# defaults no longer resolve. The repository below points at the same build the +# subchart was released with, which keeps the on-disk data directory layout +# identical for existing installs. +# +# Keep the tag pinned. docker.io/bitnami still publishes a floating `latest`, +# and starting a newer PostgreSQL major against an existing data directory +# leaves the server refusing to boot ("database files are incompatible with +# server") with no way back other than a dump taken beforehand. Crossing a major +# version is a dump-and-restore, not an image bump. The chart refuses to render +# an unpinned tag for this reason postgresql: architecture: standalone + image: + repository: bitnamilegacy/postgresql + tag: 16.2.0-debian-12-r6 + volumePermissions: + image: + repository: bitnamilegacy/os-shell + tag: 12-debian-12-r16 + metrics: + image: + repository: bitnamilegacy/postgres-exporter + tag: 0.15.0-debian-12-r14 auth: username: litellm database: litellm @@ -331,12 +369,55 @@ postgresql: # secretKeys: # userPasswordKey: password -# requires cache: true in config file -# either enable this or pass a secret for REDIS_HOST, REDIS_PORT, REDIS_PASSWORD or REDIS_URL -# with cache: true to use existing redis instance +# Redis is the proxy's coordination store: cross-pod tpm/rpm rate limits, spend +# tracking, and the pod lock manager. Enabling this deploys the bundled Redis +# subchart, wires REDIS_HOST / REDIS_PORT / REDIS_PASSWORD into the proxy, and +# renders a `general_settings.coordination_redis` block into the proxy config. +# +# To point at an existing Redis instead, leave `enabled: false` and pass a +# secret for REDIS_HOST, REDIS_PORT, REDIS_PASSWORD or REDIS_URL; the proxy +# falls back to those env vars for coordination. Set `cache: true` in the proxy +# config only if you also want LLM response caching, which is independent of +# coordination +# +# When `redis.sentinel.enabled` is set, the coordination block is rendered with +# `sentinel_nodes` and `service_name` (from `redis.sentinel.masterSet`) instead +# of host/port, because a plain Redis client cannot talk to the sentinel port +# +# The image repositories carry the same bitnamilegacy repoint as postgresql +# above; the versioned tags the subchart ships with are gone from +# docker.io/bitnami redis: enabled: false architecture: standalone + image: + repository: bitnamilegacy/redis + tag: 7.2.4-debian-12-r9 + sentinel: + image: + repository: bitnamilegacy/redis-sentinel + tag: 7.2.4-debian-12-r7 + metrics: + image: + repository: bitnamilegacy/redis-exporter + tag: 1.58.0-debian-12-r4 + volumePermissions: + image: + repository: bitnamilegacy/os-shell + tag: 12-debian-12-r16 + sysctl: + image: + repository: bitnamilegacy/os-shell + tag: 12-debian-12-r16 + kubectl: + image: + repository: bitnamilegacy/kubectl + tag: 1.29.2-debian-12-r3 + coordination: + # Set to false to keep the bundled Redis for response caching only and leave + # `general_settings.coordination_redis` out of the rendered config. A + # `coordination_redis` block you define yourself in `proxy_config` always wins + enabled: true # Prisma migration job settings migrationJob: diff --git a/helm/litellm/templates/NOTES.txt b/helm/litellm/templates/NOTES.txt index 5b939fe480a..468cf621b32 100644 --- a/helm/litellm/templates/NOTES.txt +++ b/helm/litellm/templates/NOTES.txt @@ -46,4 +46,9 @@ Reminders: - gateway.config.proxy_config (rendered into a ConfigMap and mounted at /app/config/config.yaml; gateway reads it via CONFIG_FILE_PATH) + - {component}.pdb.{enabled,minAvailable,maxUnavailable} (per-component PodDisruptionBudget; disabled by + default — with hpa.minReplicas of 1, minAvailable: 1 + would block node drains) + - {component}.topologySpreadConstraints (standard k8s list, e.g. spread replicas across + topology.kubernetes.io/zone) - Enable ingress.enabled=true to dispatch / → ui, gateway data-plane prefixes → gateway, and the catch-all → backend. diff --git a/helm/litellm/templates/_helpers.tpl b/helm/litellm/templates/_helpers.tpl index 4319907883e..a0205c0a3a2 100644 --- a/helm/litellm/templates/_helpers.tpl +++ b/helm/litellm/templates/_helpers.tpl @@ -34,6 +34,57 @@ app.kubernetes.io/managed-by: {{ .Release.Service }} helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }} {{- end -}} +{{/* +Enterprise billable-request metering. Wired into gateway and backend, not the +migrations job. The gateway serves nearly all billable traffic, but the backend +keeps the named-server MCP transport (/{mcp_server_name}/mcp), which writes a +SpendLogs row, so metering only the gateway would silently drop that traffic. +The client certificate identifies the deployment to LiteLLM's collector, so it is +mounted read-only from an existing Secret rather than passed through the +environment. +*/}} +{{- define "litellm.billingMetrics.certDir" -}}/etc/litellm/billing-mtls{{- end -}} +{{- define "litellm.billingMetrics.caDir" -}}/etc/litellm/billing-mtls-ca{{- end -}} + +{{- define "litellm.billingMetricsEnv" -}} +- name: LITELLM_BILLING_METRICS_ENDPOINT + value: {{ required "billingMetrics.endpoint is required when billingMetrics.enabled is true" .Values.billingMetrics.endpoint | quote }} +- name: LITELLM_BILLING_METRICS_CLIENT_CERT + value: {{ printf "%s/tls.crt" (include "litellm.billingMetrics.certDir" .) | quote }} +- name: LITELLM_BILLING_METRICS_CLIENT_KEY + value: {{ printf "%s/tls.key" (include "litellm.billingMetrics.certDir" .) | quote }} +{{- if .Values.billingMetrics.caSecretName }} +- name: LITELLM_BILLING_METRICS_CA_CERT + value: {{ printf "%s/ca.crt" (include "litellm.billingMetrics.caDir" .) | quote }} +{{- end }} +{{- with .Values.billingMetrics.exportIntervalMs }} +- name: LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS + value: {{ . | quote }} +{{- end }} +{{- end -}} + +{{- define "litellm.billingMetricsVolumes" -}} +- name: billing-metrics-mtls + secret: + secretName: {{ required "billingMetrics.secretName is required when billingMetrics.enabled is true (an existing Secret with tls.crt and tls.key)" .Values.billingMetrics.secretName }} +{{- if .Values.billingMetrics.caSecretName }} +- name: billing-metrics-mtls-ca + secret: + secretName: {{ .Values.billingMetrics.caSecretName }} +{{- end }} +{{- end -}} + +{{- define "litellm.billingMetricsVolumeMounts" -}} +- name: billing-metrics-mtls + mountPath: {{ include "litellm.billingMetrics.certDir" . }} + readOnly: true +{{- if .Values.billingMetrics.caSecretName }} +- name: billing-metrics-mtls-ca + mountPath: {{ include "litellm.billingMetrics.caDir" . }} + readOnly: true +{{- end }} +{{- end -}} + {{/* Per-component selector labels — used in both Service selectors and Deployment matchLabels. */}} @@ -213,6 +264,10 @@ harmless no-op for the Job and authoritative for the app pods. */}} - name: DISABLE_SCHEMA_UPDATE value: "true" +{{/* These feed the proxy's coordination Redis (cross-pod rate limits, spend + tracking, pod lock manager) via its REDIS_* env fallback. An explicit + `general_settings.coordination_redis` block in proxy_config takes + precedence over anything emitted here. */}} {{- if $root.Values.redis.host }} - name: REDIS_HOST value: {{ $root.Values.redis.host | quote }} @@ -226,10 +281,11 @@ harmless no-op for the Job and authoritative for the app pods. key: {{ $root.Values.redis.passwordSecret.passwordKey | default "password" }} {{- end }} {{- if $root.Values.redis.cluster }} -{{/* The proxy's Cache() reads REDIS_CLUSTER_NODES as JSON and constructs a - RedisClusterCache when it's set (litellm/caching/caching.py:169-192). - We seed with the single configured endpoint — the cluster client - discovers the remaining nodes from CLUSTER SLOTS at startup. */}} +{{/* The proxy falls back to REDIS_CLUSTER_NODES (JSON) to build a cluster-mode + coordination client when `general_settings.coordination_redis` is absent + and no plain-Redis response cache is configured. We seed with the single + configured endpoint; the cluster client discovers the remaining nodes from + CLUSTER SLOTS at startup. */}} - name: REDIS_CLUSTER_NODES value: {{ printf "[{\"host\":%q,\"port\":%v}]" $root.Values.redis.host (int $root.Values.redis.port) | quote }} {{- end }} @@ -239,6 +295,52 @@ harmless no-op for the Job and authoritative for the app pods. {{- end }} {{- end -}} +{{/* +PodDisruptionBudget shared by gateway, backend, and ui. + +Invoke with a dict: + (dict "root" $ "component" .Values.gateway "componentName" "gateway" + "fullname" (include "litellm.gateway.fullname" .) + "selectorLabels" (include "litellm.gateway.selectorLabels" .)) + +Renders nothing unless both the component and its `pdb.enabled` are on. +Only one of minAvailable / maxUnavailable should be set; if both are, +minAvailable wins. If neither is set, falls back to `maxUnavailable: 1` so +an enabled-but-unconfigured PDB still permits node drains. + +"Set" means non-nil and non-empty-string, so an explicit 0 (e.g. +`maxUnavailable: 0` to forbid all voluntary disruptions) is honored rather +than silently replaced by the fallback. +*/}} +{{- define "litellm.pdb" -}} +{{- $root := .root -}} +{{- $component := .component -}} +{{- $min := $component.pdb.minAvailable -}} +{{- $max := $component.pdb.maxUnavailable -}} +{{- $minSet := not (or (kindIs "invalid" $min) (eq (printf "%v" $min) "")) -}} +{{- $maxSet := not (or (kindIs "invalid" $max) (eq (printf "%v" $max) "")) -}} +{{- if and $component.enabled $component.pdb $component.pdb.enabled }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ .fullname }} + labels: + {{- include "litellm.commonLabels" $root | nindent 4 }} + app.kubernetes.io/component: {{ .componentName }} +spec: + selector: + matchLabels: + {{- .selectorLabels | nindent 6 }} + {{- if $minSet }} + minAvailable: {{ $min }} + {{- else if $maxSet }} + maxUnavailable: {{ $max }} + {{- else }} + maxUnavailable: 1 + {{- end }} +{{- end }} +{{- end -}} + {{/* Renders `envFrom:` block for a component's `envConfigMaps` / `envSecrets` lists. Each entry is a resource name; the chart wires the whole ConfigMap / diff --git a/helm/litellm/templates/backend/deployment.yaml b/helm/litellm/templates/backend/deployment.yaml index 8b4552bf302..892b84ff7d5 100644 --- a/helm/litellm/templates/backend/deployment.yaml +++ b/helm/litellm/templates/backend/deployment.yaml @@ -44,14 +44,20 @@ spec: - name: CONFIG_FILE_PATH value: /app/config/config.yaml {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsEnv" . | nindent 12 }} + {{- end }} {{- include "litellm.envFrom" .Values.backend | nindent 10 }} - {{- if or .Values.gateway.config.create .Values.backend.volumeMounts }} + {{- if or .Values.gateway.config.create .Values.backend.volumeMounts .Values.billingMetrics.enabled }} volumeMounts: {{- if .Values.gateway.config.create }} - name: gateway-config mountPath: /app/config/config.yaml subPath: config.yaml {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumeMounts" . | nindent 12 }} + {{- end }} {{- with .Values.backend.volumeMounts }} {{- toYaml . | nindent 12 }} {{- end }} @@ -66,13 +72,16 @@ spec: {{- end }} resources: {{- toYaml .Values.backend.resources | nindent 12 }} - {{- if or .Values.gateway.config.create .Values.backend.volumes }} + {{- if or .Values.gateway.config.create .Values.backend.volumes .Values.billingMetrics.enabled }} volumes: {{- if .Values.gateway.config.create }} - name: gateway-config configMap: name: {{ include "litellm.gateway.fullname" . }}-config {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumes" . | nindent 8 }} + {{- end }} {{- with .Values.backend.volumes }} {{- toYaml . | nindent 8 }} {{- end }} @@ -89,4 +98,8 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} + {{- with .Values.backend.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml . | nindent 8 }} + {{- end }} {{- end }} diff --git a/helm/litellm/templates/backend/poddisruptionbudget.yaml b/helm/litellm/templates/backend/poddisruptionbudget.yaml new file mode 100644 index 00000000000..02853ac879c --- /dev/null +++ b/helm/litellm/templates/backend/poddisruptionbudget.yaml @@ -0,0 +1,6 @@ +{{- include "litellm.pdb" (dict + "root" $ + "component" .Values.backend + "componentName" "backend" + "fullname" (include "litellm.backend.fullname" .) + "selectorLabels" (include "litellm.backend.selectorLabels" .)) }} diff --git a/helm/litellm/templates/gateway/deployment.yaml b/helm/litellm/templates/gateway/deployment.yaml index bd491b69e0f..b2e22612905 100644 --- a/helm/litellm/templates/gateway/deployment.yaml +++ b/helm/litellm/templates/gateway/deployment.yaml @@ -46,14 +46,20 @@ spec: - name: NUM_WORKERS value: {{ .Values.gateway.numWorkers | quote }} {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsEnv" . | nindent 12 }} + {{- end }} {{- include "litellm.envFrom" .Values.gateway | nindent 10 }} - {{- if or .Values.gateway.config.create .Values.gateway.volumeMounts }} + {{- if or .Values.gateway.config.create .Values.gateway.volumeMounts .Values.billingMetrics.enabled }} volumeMounts: {{- if .Values.gateway.config.create }} - name: gateway-config mountPath: /app/config/config.yaml subPath: config.yaml {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumeMounts" . | nindent 12 }} + {{- end }} {{- with .Values.gateway.volumeMounts }} {{- toYaml . | nindent 12 }} {{- end }} @@ -68,13 +74,16 @@ spec: {{- end }} resources: {{- toYaml .Values.gateway.resources | nindent 12 }} - {{- if or .Values.gateway.config.create .Values.gateway.volumes }} + {{- if or .Values.gateway.config.create .Values.gateway.volumes .Values.billingMetrics.enabled }} volumes: {{- if .Values.gateway.config.create }} - name: gateway-config configMap: name: {{ include "litellm.gateway.fullname" . }}-config {{- end }} + {{- if .Values.billingMetrics.enabled }} + {{- include "litellm.billingMetricsVolumes" . | nindent 8 }} + {{- end }} {{- with .Values.gateway.volumes }} {{- toYaml . | nindent 8 }} {{- end }} @@ -91,4 +100,8 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} + {{- with .Values.gateway.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml . | nindent 8 }} + {{- end }} {{- end }} diff --git a/helm/litellm/templates/gateway/poddisruptionbudget.yaml b/helm/litellm/templates/gateway/poddisruptionbudget.yaml new file mode 100644 index 00000000000..15e89af17d7 --- /dev/null +++ b/helm/litellm/templates/gateway/poddisruptionbudget.yaml @@ -0,0 +1,6 @@ +{{- include "litellm.pdb" (dict + "root" $ + "component" .Values.gateway + "componentName" "gateway" + "fullname" (include "litellm.gateway.fullname" .) + "selectorLabels" (include "litellm.gateway.selectorLabels" .)) }} diff --git a/helm/litellm/templates/ingress.yaml b/helm/litellm/templates/ingress.yaml index 30a8e7c974b..b7c78d3fdad 100644 --- a/helm/litellm/templates/ingress.yaml +++ b/helm/litellm/templates/ingress.yaml @@ -19,7 +19,7 @@ "/v1/fine-tuning" "/fine-tuning" "/v1/responses" "/responses" "/v1/threads" "/threads" "/v1/assistants" "/assistants" "/v1/vector_stores" "/vector_stores" "/v1/indexes" "/v1/models" "/models" "/openai" "/engines" - "/v1/messages" "/messages" "/v1/skills" "/v1/a2a" + "/v1/messages" "/messages" "/v1/skills" "/v1/a2a" "/a2a" "/v1/rerank" "/v2/rerank" "/rerank" "/v1/ocr" "/ocr" "/v1/rag" "/rag" "/v1/video" "/v1/videos" "/video" "/videos" "/v1/search" "/search" "/v1/containers" "/containers" "/v1/evals" "/v1/memory" "/queue/chat" diff --git a/helm/litellm/templates/ui/deployment.yaml b/helm/litellm/templates/ui/deployment.yaml index 79e9a3e43bb..cd1f8c08fd4 100644 --- a/helm/litellm/templates/ui/deployment.yaml +++ b/helm/litellm/templates/ui/deployment.yaml @@ -76,4 +76,8 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} + {{- with .Values.ui.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml . | nindent 8 }} + {{- end }} {{- end }} diff --git a/helm/litellm/templates/ui/poddisruptionbudget.yaml b/helm/litellm/templates/ui/poddisruptionbudget.yaml new file mode 100644 index 00000000000..f7a3a694e9c --- /dev/null +++ b/helm/litellm/templates/ui/poddisruptionbudget.yaml @@ -0,0 +1,6 @@ +{{- include "litellm.pdb" (dict + "root" $ + "component" .Values.ui + "componentName" "ui" + "fullname" (include "litellm.ui.fullname" .) + "selectorLabels" (include "litellm.ui.selectorLabels" .)) }} diff --git a/helm/litellm/tests/billing_metrics_tests.yaml b/helm/litellm/tests/billing_metrics_tests.yaml new file mode 100644 index 00000000000..ceba0bd1430 --- /dev/null +++ b/helm/litellm/tests/billing_metrics_tests.yaml @@ -0,0 +1,249 @@ +suite: test billingMetrics wiring on gateway and backend +templates: + - gateway/deployment.yaml + - gateway/configmap.yaml + - backend/deployment.yaml + - migrations-job.yaml +values: + - ./values/required.yaml +tests: + - it: is off by default, adding no env, volume, or mount + template: gateway/deployment.yaml + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: billing-mtls + - equal: + path: spec.template.spec.containers[0].volumeMounts + value: + - name: gateway-config + mountPath: /app/config/config.yaml + subPath: config.yaml + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + + - it: renders the endpoint and the mounted cert paths when enabled + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CLIENT_CERT + value: /etc/litellm/billing-mtls/tls.crt + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CLIENT_KEY + value: /etc/litellm/billing-mtls/tls.key + + - it: mounts the cert secret read-only alongside the config volume + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: billing-mtls + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls + mountPath: /etc/litellm/billing-mtls + readOnly: true + + # The production collector presents a public web-PKI certificate, so the CA + # override must stay absent unless a private collector is configured. + - it: omits the CA env, volume, and mount when no caSecretName is set + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls-ca + secret: + secretName: billing-ca + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CA_CERT + value: /etc/litellm/billing-mtls-ca/ca.crt + + - it: mounts the CA secret when caSecretName is set + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + caSecretName: billing-ca + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_CA_CERT + value: /etc/litellm/billing-mtls-ca/ca.crt + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls-ca + secret: + secretName: billing-ca + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls-ca + mountPath: /etc/litellm/billing-mtls-ca + readOnly: true + + - it: passes the export interval through only when set + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + exportIntervalMs: 5000 + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_EXPORT_INTERVAL_MS + value: "5000" + + - it: keeps user-supplied gateway volumes alongside the billing secret + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + gateway.volumes: + - name: custom-callbacks + configMap: + name: my-callbacks + gateway.volumeMounts: + - name: custom-callbacks + mountPath: /app/callbacks + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: custom-callbacks + configMap: + name: my-callbacks + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: billing-mtls + + # The backend keeps the named-server MCP transport (/{mcp_server_name}/mcp), + # which writes a SpendLogs row, so it must meter too or that traffic is lost. + - it: meters the backend as well, since it serves the MCP transport + template: backend/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: billing-metrics-mtls + mountPath: /etc/litellm/billing-mtls + readOnly: true + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: billing-mtls + + - it: leaves the backend alone when metering is off + template: backend/deployment.yaml + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + + # The migrations job runs prisma and serves no traffic; it must never receive + # the client key. + - it: never mounts the billing cert on the migrations job + template: migrations-job.yaml + set: + billingMetrics: + enabled: true + secretName: billing-mtls + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - isNull: + path: spec.template.spec.volumes + + # The conventional Secret name is the default, so enabling metering needs no + # secretName at all; the guard below only fires on an explicitly blanked one. + - it: uses the conventional secret name by default + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: billing-metrics-mtls + secret: + secretName: litellm-billing-metrics-mtls + + - it: fails loudly when the secretName is explicitly blanked + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + secretName: "" + asserts: + - failedTemplate: + errorMessage: billingMetrics.secretName is required when billingMetrics.enabled is true (an existing Secret with tls.crt and tls.key) + + - it: fails loudly when enabled without an endpoint + template: gateway/deployment.yaml + set: + billingMetrics: + enabled: true + endpoint: "" + secretName: billing-mtls + asserts: + - failedTemplate: + errorMessage: billingMetrics.endpoint is required when billingMetrics.enabled is true diff --git a/helm/litellm/tests/pdb_topology_spread_tests.yaml b/helm/litellm/tests/pdb_topology_spread_tests.yaml new file mode 100644 index 00000000000..8aa05f3a969 --- /dev/null +++ b/helm/litellm/tests/pdb_topology_spread_tests.yaml @@ -0,0 +1,188 @@ +suite: test pod disruption budgets and topology spread constraints +templates: + - gateway/poddisruptionbudget.yaml + - backend/poddisruptionbudget.yaml + - ui/poddisruptionbudget.yaml + - gateway/deployment.yaml + - gateway/configmap.yaml + - backend/deployment.yaml + - ui/deployment.yaml +values: + - ./values/required.yaml +tests: + - it: renders no PDB by default + templates: + - gateway/poddisruptionbudget.yaml + - backend/poddisruptionbudget.yaml + - ui/poddisruptionbudget.yaml + asserts: + - hasDocuments: + count: 0 + + - it: gateway PDB uses minAvailable and matches the gateway selector labels + template: gateway/poddisruptionbudget.yaml + set: + gateway.pdb.enabled: true + gateway.pdb.minAvailable: 1 + asserts: + - isKind: + of: PodDisruptionBudget + - equal: + path: apiVersion + value: policy/v1 + - equal: + path: metadata.name + value: RELEASE-NAME-litellm-gateway + - equal: + path: spec.minAvailable + value: 1 + - notExists: + path: spec.maxUnavailable + - equal: + path: spec.selector.matchLabels + value: + app.kubernetes.io/name: litellm + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/component: gateway + + - it: backend PDB uses maxUnavailable when minAvailable is unset + template: backend/poddisruptionbudget.yaml + set: + backend.pdb.enabled: true + backend.pdb.maxUnavailable: 25% + asserts: + - equal: + path: spec.maxUnavailable + value: 25% + - notExists: + path: spec.minAvailable + - equal: + path: spec.selector.matchLabels + value: + app.kubernetes.io/name: litellm + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/component: backend + + - it: minAvailable wins when both minAvailable and maxUnavailable are set + template: gateway/poddisruptionbudget.yaml + set: + gateway.pdb.enabled: true + gateway.pdb.minAvailable: 2 + gateway.pdb.maxUnavailable: 1 + asserts: + - equal: + path: spec.minAvailable + value: 2 + - notExists: + path: spec.maxUnavailable + + - it: an explicit maxUnavailable 0 is honored instead of the fallback + template: backend/poddisruptionbudget.yaml + set: + backend.pdb.enabled: true + backend.pdb.maxUnavailable: 0 + asserts: + - equal: + path: spec.maxUnavailable + value: 0 + - notExists: + path: spec.minAvailable + + - it: an explicit minAvailable 0 is honored and beats a set maxUnavailable + template: gateway/poddisruptionbudget.yaml + set: + gateway.pdb.enabled: true + gateway.pdb.minAvailable: 0 + gateway.pdb.maxUnavailable: 1 + asserts: + - equal: + path: spec.minAvailable + value: 0 + - notExists: + path: spec.maxUnavailable + + - it: enabled PDB with neither knob set falls back to maxUnavailable 1 + template: ui/poddisruptionbudget.yaml + set: + ui.pdb.enabled: true + asserts: + - equal: + path: spec.maxUnavailable + value: 1 + - notExists: + path: spec.minAvailable + - equal: + path: spec.selector.matchLabels + value: + app.kubernetes.io/name: litellm + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/component: ui + + - it: renders no PDB for a disabled component even when its pdb is enabled + template: gateway/poddisruptionbudget.yaml + set: + gateway.enabled: false + gateway.pdb.enabled: true + asserts: + - hasDocuments: + count: 0 + + - it: deployments omit topologySpreadConstraints by default + templates: + - gateway/deployment.yaml + - backend/deployment.yaml + - ui/deployment.yaml + asserts: + - notExists: + path: spec.template.spec.topologySpreadConstraints + + - it: gateway deployment renders configured topologySpreadConstraints + template: gateway/deployment.yaml + set: + gateway.topologySpreadConstraints: + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app.kubernetes.io/component: gateway + asserts: + - equal: + path: spec.template.spec.topologySpreadConstraints + value: + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app.kubernetes.io/component: gateway + + - it: backend deployment renders configured topologySpreadConstraints + template: backend/deployment.yaml + set: + backend.topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + app.kubernetes.io/component: backend + asserts: + - equal: + path: spec.template.spec.topologySpreadConstraints[0].topologyKey + value: kubernetes.io/hostname + - equal: + path: spec.template.spec.topologySpreadConstraints[0].whenUnsatisfiable + value: DoNotSchedule + + - it: ui deployment renders configured topologySpreadConstraints + template: ui/deployment.yaml + set: + ui.topologySpreadConstraints: + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + asserts: + - equal: + path: spec.template.spec.topologySpreadConstraints[0].topologyKey + value: topology.kubernetes.io/zone diff --git a/helm/litellm/tests/redis_env_tests.yaml b/helm/litellm/tests/redis_env_tests.yaml new file mode 100644 index 00000000000..684d7071b35 --- /dev/null +++ b/helm/litellm/tests/redis_env_tests.yaml @@ -0,0 +1,109 @@ +suite: test redis coordination env vars +templates: + - gateway/deployment.yaml + - gateway/configmap.yaml + - backend/deployment.yaml +values: + - ./values/required.yaml +tests: + - it: gateway omits redis env vars when no host is configured + template: gateway/deployment.yaml + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_HOST + value: redis.example.com + any: true + - notContains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_CLUSTER_NODES + any: true + + - it: gateway emits host, port and password when redis is configured + template: gateway/deployment.yaml + set: + redis.host: redis.example.com + redis.port: 6380 + redis.passwordSecret.name: redis-secret + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_HOST + value: redis.example.com + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_PORT + value: "6380" + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis-secret + key: password + + - it: backend emits the same redis env vars so both pods coordinate on one redis + template: backend/deployment.yaml + set: + redis.host: redis.example.com + redis.passwordSecret.name: redis-secret + redis.passwordSecret.passwordKey: redis-password + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_HOST + value: redis.example.com + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis-secret + key: redis-password + + - it: gateway omits REDIS_PASSWORD for an auth-less redis + template: gateway/deployment.yaml + set: + redis.host: redis.example.com + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_PASSWORD + any: true + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_HOST + value: redis.example.com + + - it: gateway seeds REDIS_CLUSTER_NODES from host and port in cluster mode + template: gateway/deployment.yaml + set: + redis.host: redis.example.com + redis.port: 6380 + redis.cluster: true + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_CLUSTER_NODES + value: '[{"host":"redis.example.com","port":6380}]' + + - it: gateway omits REDIS_CLUSTER_NODES when cluster mode is off + template: gateway/deployment.yaml + set: + redis.host: redis.example.com + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: REDIS_CLUSTER_NODES + any: true diff --git a/helm/litellm/values.yaml b/helm/litellm/values.yaml index 6aa5dd39cd0..461935b2f50 100644 --- a/helm/litellm/values.yaml +++ b/helm/litellm/values.yaml @@ -73,6 +73,25 @@ masterKey: secretName: litellm-master-key-secret # name of a Secret containing the master key secretKey: master-key +# Optional: enterprise billable-request metering. When enabled, the gateway and +# backend count successful requests to inference, MCP, and A2A endpoints and push +# them to LiteLLM's collector over mutual TLS. Both components serve billable +# routes: the backend keeps the named-server MCP transport. Requires an +# enterprise license. The client certificate identifies the deployment, so it is +# mounted read-only from an existing Secret and never passed through the env. +billingMetrics: + enabled: false + endpoint: https://telemetry.litellm.ai # collector to push the counter to + # An existing Secret holding the client certificate under tls.crt and its key + # under tls.key, usually created from the onboarding artifact. The default is + # the conventional name, so the common path is to create that Secret and set + # enabled: true. Override only if yours is named differently. + secretName: litellm-billing-metrics-mtls + # Only for private or test collectors whose server certificate is not on the + # public web PKI. The production collector needs no CA override. + caSecretName: "" # existing Secret holding ca.crt + exportIntervalMs: "" # push cadence; the proxy defaults to 60000 + # External Postgres connection. database: writer: @@ -100,7 +119,18 @@ database: usernameKey: username passwordKey: password -# Optional Redis (caching, rate limiting). Leave host empty to disable. +# Optional Redis. Leave host empty to disable. +# +# This is the proxy's coordination store: cross-pod tpm/rpm rate limits, spend +# tracking, and the pod lock manager. The chart emits REDIS_HOST / REDIS_PORT / +# REDIS_PASSWORD, which the proxy picks up through its coordination Redis env +# fallback. Response caching is separate and off unless you enable it in +# `proxy_config.litellm_settings.cache`. +# +# For full control, define `general_settings.coordination_redis` in +# `proxy_config` (host/port/password/username/url/ssl/startup_nodes/ +# sentinel_nodes/sentinel_password/service_name, each accepting os.environ/VAR +# refs). An explicit block overrides these env vars. # # Set `cluster: true` for Redis Cluster mode (e.g. AWS ElastiCache Cluster, # self-hosted Redis Cluster). The chart emits REDIS_CLUSTER_NODES from @@ -160,10 +190,28 @@ gateway: maxReplicas: 10 targetCPUUtilizationPercentage: 70 targetMemoryUtilizationPercentage: 80 + # PodDisruptionBudget for the gateway pods. Set exactly one of + # `minAvailable` / `maxUnavailable` (minAvailable wins if both are set; + # enabling without either falls back to `maxUnavailable: 1`). Disabled by + # default: with the default hpa.minReplicas of 1, a `minAvailable: 1` PDB + # would block node drains entirely. + pdb: + enabled: false + minAvailable: "" + maxUnavailable: "" podAnnotations: {} nodeSelector: {} tolerations: [] affinity: {} + # Standard k8s topologySpreadConstraints for the gateway pods, e.g. to + # spread replicas across zones: + # - maxSkew: 1 + # topologyKey: topology.kubernetes.io/zone + # whenUnsatisfiable: ScheduleAnyway + # labelSelector: + # matchLabels: + # app.kubernetes.io/component: gateway + topologySpreadConstraints: [] # ---------- backend (UI / management API) ---------- backend: @@ -203,10 +251,17 @@ backend: minReplicas: 1 maxReplicas: 4 targetCPUUtilizationPercentage: 70 + # Same shape as gateway.pdb. + pdb: + enabled: false + minAvailable: "" + maxUnavailable: "" podAnnotations: {} nodeSelector: {} tolerations: [] affinity: {} + # Same shape as gateway.topologySpreadConstraints. + topologySpreadConstraints: [] # ---------- ui (Next.js static dashboard) ---------- ui: @@ -249,7 +304,14 @@ ui: minReplicas: 1 maxReplicas: 3 targetCPUUtilizationPercentage: 80 + # Same shape as gateway.pdb. + pdb: + enabled: false + minAvailable: "" + maxUnavailable: "" podAnnotations: {} nodeSelector: {} tolerations: [] affinity: {} + # Same shape as gateway.topologySpreadConstraints. + topologySpreadConstraints: [] diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260710000000_add_dcr_bridge_to_mcp_server_table/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260710000000_add_dcr_bridge_to_mcp_server_table/migration.sql new file mode 100644 index 00000000000..2cfabb9c02e --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260710000000_add_dcr_bridge_to_mcp_server_table/migration.sql @@ -0,0 +1,2 @@ +-- AlterTable +ALTER TABLE "LiteLLM_MCPServerTable" ADD COLUMN "dcr_bridge" BOOLEAN; diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260713230852_add_key_type_to_litellm_verification_token/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260713230852_add_key_type_to_litellm_verification_token/migration.sql new file mode 100644 index 00000000000..708b7601346 --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260713230852_add_key_type_to_litellm_verification_token/migration.sql @@ -0,0 +1,6 @@ +-- AlterTable +ALTER TABLE "LiteLLM_DeletedVerificationToken" ADD COLUMN "key_type" TEXT; + +-- AlterTable +ALTER TABLE "LiteLLM_VerificationToken" ADD COLUMN "key_type" TEXT; + diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260715000000_add_issuer_to_mcp_server_table/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260715000000_add_issuer_to_mcp_server_table/migration.sql new file mode 100644 index 00000000000..f7f23e6a55e --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260715000000_add_issuer_to_mcp_server_table/migration.sql @@ -0,0 +1,2 @@ +-- AlterTable +ALTER TABLE "LiteLLM_MCPServerTable" ADD COLUMN IF NOT EXISTS "issuer" TEXT; diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260717000000_add_compression_saved_tokens/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260717000000_add_compression_saved_tokens/migration.sql new file mode 100644 index 00000000000..dff889bc7fb --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260717000000_add_compression_saved_tokens/migration.sql @@ -0,0 +1,17 @@ +-- AlterTable +ALTER TABLE "LiteLLM_DailyUserSpend" ADD COLUMN IF NOT EXISTS "compression_saved_tokens" BIGINT NOT NULL DEFAULT 0; + +-- AlterTable +ALTER TABLE "LiteLLM_DailyOrganizationSpend" ADD COLUMN IF NOT EXISTS "compression_saved_tokens" BIGINT NOT NULL DEFAULT 0; + +-- AlterTable +ALTER TABLE "LiteLLM_DailyEndUserSpend" ADD COLUMN IF NOT EXISTS "compression_saved_tokens" BIGINT NOT NULL DEFAULT 0; + +-- AlterTable +ALTER TABLE "LiteLLM_DailyAgentSpend" ADD COLUMN IF NOT EXISTS "compression_saved_tokens" BIGINT NOT NULL DEFAULT 0; + +-- AlterTable +ALTER TABLE "LiteLLM_DailyTeamSpend" ADD COLUMN IF NOT EXISTS "compression_saved_tokens" BIGINT NOT NULL DEFAULT 0; + +-- AlterTable +ALTER TABLE "LiteLLM_DailyTagSpend" ADD COLUMN IF NOT EXISTS "compression_saved_tokens" BIGINT NOT NULL DEFAULT 0; diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260717000000_add_mcp_server_oauth_client_table/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260717000000_add_mcp_server_oauth_client_table/migration.sql new file mode 100644 index 00000000000..7aa6cdb1e33 --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260717000000_add_mcp_server_oauth_client_table/migration.sql @@ -0,0 +1,9 @@ +-- CreateTable +CREATE TABLE IF NOT EXISTS "LiteLLM_MCPServerOAuthClient" ( + "server_id" TEXT NOT NULL, + "credentials" JSONB, + "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP, + "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP, + + CONSTRAINT "LiteLLM_MCPServerOAuthClient_pkey" PRIMARY KEY ("server_id") +); diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260718000000_add_savings_spend/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260718000000_add_savings_spend/migration.sql new file mode 100644 index 00000000000..f4cca662850 --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260718000000_add_savings_spend/migration.sql @@ -0,0 +1,23 @@ +-- AlterTable +ALTER TABLE "LiteLLM_DailyUserSpend" ADD COLUMN IF NOT EXISTS "compression_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; +ALTER TABLE "LiteLLM_DailyUserSpend" ADD COLUMN IF NOT EXISTS "prompt_caching_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; + +-- AlterTable +ALTER TABLE "LiteLLM_DailyOrganizationSpend" ADD COLUMN IF NOT EXISTS "compression_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; +ALTER TABLE "LiteLLM_DailyOrganizationSpend" ADD COLUMN IF NOT EXISTS "prompt_caching_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; + +-- AlterTable +ALTER TABLE "LiteLLM_DailyEndUserSpend" ADD COLUMN IF NOT EXISTS "compression_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; +ALTER TABLE "LiteLLM_DailyEndUserSpend" ADD COLUMN IF NOT EXISTS "prompt_caching_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; + +-- AlterTable +ALTER TABLE "LiteLLM_DailyAgentSpend" ADD COLUMN IF NOT EXISTS "compression_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; +ALTER TABLE "LiteLLM_DailyAgentSpend" ADD COLUMN IF NOT EXISTS "prompt_caching_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; + +-- AlterTable +ALTER TABLE "LiteLLM_DailyTeamSpend" ADD COLUMN IF NOT EXISTS "compression_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; +ALTER TABLE "LiteLLM_DailyTeamSpend" ADD COLUMN IF NOT EXISTS "prompt_caching_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; + +-- AlterTable +ALTER TABLE "LiteLLM_DailyTagSpend" ADD COLUMN IF NOT EXISTS "compression_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; +ALTER TABLE "LiteLLM_DailyTagSpend" ADD COLUMN IF NOT EXISTS "prompt_caching_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260721000000_add_sso_identity_assertion/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260721000000_add_sso_identity_assertion/migration.sql new file mode 100644 index 00000000000..95412df0a96 --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260721000000_add_sso_identity_assertion/migration.sql @@ -0,0 +1,9 @@ +-- CreateTable +CREATE TABLE IF NOT EXISTS "LiteLLM_SSOIdentityAssertion" ( + "user_id" TEXT NOT NULL, + "assertion_b64" TEXT NOT NULL, + "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP, + "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP, + + CONSTRAINT "LiteLLM_SSOIdentityAssertion_pkey" PRIMARY KEY ("user_id") +); diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260724000000_add_spend_log_tool_index_start_time_idx/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260724000000_add_spend_log_tool_index_start_time_idx/migration.sql new file mode 100644 index 00000000000..548c3bd5683 --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260724000000_add_spend_log_tool_index_start_time_idx/migration.sql @@ -0,0 +1,2 @@ +-- CreateIndex +CREATE INDEX IF NOT EXISTS "LiteLLM_SpendLogToolIndex_start_time_idx" ON "LiteLLM_SpendLogToolIndex"("start_time"); diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260725000000_add_daily_tool_spend/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260725000000_add_daily_tool_spend/migration.sql new file mode 100644 index 00000000000..e02ed01a554 --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260725000000_add_daily_tool_spend/migration.sql @@ -0,0 +1,12 @@ +-- CreateTable +CREATE TABLE IF NOT EXISTS "LiteLLM_DailyToolSpend" ( + "date" TEXT NOT NULL, + "tool_name" TEXT NOT NULL, + "spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0, + "total_tokens" BIGINT NOT NULL DEFAULT 0, + "request_count" BIGINT NOT NULL DEFAULT 0, + "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP, + "updated_at" TIMESTAMP(3) NOT NULL, + + CONSTRAINT "LiteLLM_DailyToolSpend_pkey" PRIMARY KEY ("date","tool_name") +); diff --git a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma index 6d87102a3f3..37ea55f8c13 100644 --- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma +++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma @@ -325,6 +325,7 @@ model LiteLLM_MCPServerTable { command String? args String[] @default([]) env Json? @default("{}") + issuer String? authorization_url String? token_url String? registration_url String? @@ -339,6 +340,7 @@ model LiteLLM_MCPServerTable { available_on_public_internet Boolean @default(true) delegate_auth_to_upstream Boolean @default(false) oauth_passthrough Boolean @default(false) + dcr_bridge Boolean? is_byok Boolean @default(false) byok_description String[] @default([]) byok_api_key_help_url String? @@ -394,6 +396,22 @@ model LiteLLM_MCPUserEnvVars { @@index([server_id]) } +model LiteLLM_MCPServerOAuthClient { + server_id String @id + credentials Json? + created_at DateTime @default(now()) @map("created_at") + updated_at DateTime @default(now()) @updatedAt @map("updated_at") +} + +// The enterprise IdP identity assertion captured at SSO login, one row per user. +// assertion_b64 is an encrypted JSON payload: {id_token, refresh_token?, issuer?, expires_at?}. +model LiteLLM_SSOIdentityAssertion { + user_id String @id + assertion_b64 String + created_at DateTime @default(now()) @map("created_at") + updated_at DateTime @default(now()) @updatedAt @map("updated_at") +} + // Generate Tokens for Proxy model LiteLLM_VerificationToken { token String @id @@ -421,6 +439,7 @@ model LiteLLM_VerificationToken { budget_reset_at DateTime? allowed_cache_controls String[] @default([]) allowed_routes String[] @default([]) + key_type String? policies String[] @default([]) access_group_ids String[] @default([]) model_spend Json @default("{}") @@ -515,6 +534,7 @@ model LiteLLM_DeletedVerificationToken { budget_reset_at DateTime? allowed_cache_controls String[] @default([]) allowed_routes String[] @default([]) + key_type String? policies String[] @default([]) access_group_ids String[] @default([]) model_spend Json @default("{}") @@ -725,6 +745,9 @@ model LiteLLM_DailyUserSpend { completion_tokens BigInt @default(0) cache_read_input_tokens BigInt @default(0) cache_creation_input_tokens BigInt @default(0) + compression_saved_tokens BigInt @default(0) + compression_savings_spend Float @default(0.0) + prompt_caching_savings_spend Float @default(0.0) spend Float @default(0.0) api_requests BigInt @default(0) successful_requests BigInt @default(0) @@ -756,6 +779,9 @@ model LiteLLM_DailyOrganizationSpend { completion_tokens BigInt @default(0) cache_read_input_tokens BigInt @default(0) cache_creation_input_tokens BigInt @default(0) + compression_saved_tokens BigInt @default(0) + compression_savings_spend Float @default(0.0) + prompt_caching_savings_spend Float @default(0.0) spend Float @default(0.0) api_requests BigInt @default(0) successful_requests BigInt @default(0) @@ -787,6 +813,9 @@ model LiteLLM_DailyEndUserSpend { completion_tokens BigInt @default(0) cache_read_input_tokens BigInt @default(0) cache_creation_input_tokens BigInt @default(0) + compression_saved_tokens BigInt @default(0) + compression_savings_spend Float @default(0.0) + prompt_caching_savings_spend Float @default(0.0) spend Float @default(0.0) api_requests BigInt @default(0) successful_requests BigInt @default(0) @@ -817,6 +846,9 @@ model LiteLLM_DailyAgentSpend { completion_tokens BigInt @default(0) cache_read_input_tokens BigInt @default(0) cache_creation_input_tokens BigInt @default(0) + compression_saved_tokens BigInt @default(0) + compression_savings_spend Float @default(0.0) + prompt_caching_savings_spend Float @default(0.0) spend Float @default(0.0) api_requests BigInt @default(0) successful_requests BigInt @default(0) @@ -847,6 +879,9 @@ model LiteLLM_DailyTeamSpend { completion_tokens BigInt @default(0) cache_read_input_tokens BigInt @default(0) cache_creation_input_tokens BigInt @default(0) + compression_saved_tokens BigInt @default(0) + compression_savings_spend Float @default(0.0) + prompt_caching_savings_spend Float @default(0.0) spend Float @default(0.0) api_requests BigInt @default(0) successful_requests BigInt @default(0) @@ -879,6 +914,9 @@ model LiteLLM_DailyTagSpend { completion_tokens BigInt @default(0) cache_read_input_tokens BigInt @default(0) cache_creation_input_tokens BigInt @default(0) + compression_saved_tokens BigInt @default(0) + compression_savings_spend Float @default(0.0) + prompt_caching_savings_spend Float @default(0.0) spend Float @default(0.0) api_requests BigInt @default(0) successful_requests BigInt @default(0) @@ -1056,6 +1094,20 @@ model LiteLLM_SpendLogToolIndex { @@id([request_id, tool_name]) @@index([tool_name, start_time]) + @@index([start_time]) +} + +// Daily tool spend rollup (one row per tool per day) – the Cost Optimization card reads this, never SpendLogs +model LiteLLM_DailyToolSpend { + date String + tool_name String + spend Float @default(0.0) + total_tokens BigInt @default(0) + request_count BigInt @default(0) + created_at DateTime @default(now()) + updated_at DateTime @updatedAt + + @@id([date, tool_name]) } // Prompt table for storing prompt configurations diff --git a/litellm-proxy-extras/pyproject.toml b/litellm-proxy-extras/pyproject.toml index 4d237622da2..79984dcab68 100644 --- a/litellm-proxy-extras/pyproject.toml +++ b/litellm-proxy-extras/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "litellm-proxy-extras" -version = "0.4.75" +version = "0.4.81" description = "Additional files for the LiteLLM Proxy. Reduces the size of the main litellm package." readme = "README.md" requires-python = ">=3.9" @@ -26,7 +26,7 @@ required-version = ">=0.10.9" module-root = "" [tool.commitizen] -version = "0.4.75" +version = "0.4.81" version_files = [ "pyproject.toml:^version", "../pyproject.toml:litellm-proxy-extras==", diff --git a/litellm-rust/ADDING_A_PROVIDER.md b/litellm-rust/ADDING_A_PROVIDER.md index 2fa81798605..857a744e014 100644 --- a/litellm-rust/ADDING_A_PROVIDER.md +++ b/litellm-rust/ADDING_A_PROVIDER.md @@ -1,9 +1,29 @@ # Adding a provider / route to litellm-rust -Three layers, same for every route (see `ocr` and `realtime` as references): +Everything for a route lives in `crates/core/src//`; `crates/core/src/messages` is the reference. A host (the axum gateway, the Python bridge) only calls the route's entrypoint. -1. **Transform contract (pure)** — `crates/core/src//transformation.rs`: a `…ProviderConfig` trait (URL build + request/response transforms) + types in `types.rs`. No network, env, or auth. -2. **Provider config (pure)** — `crates/providers/src///transformation.rs`: implement that trait as a `const __CONFIG`, mirroring the Python provider tree. Add parity unit tests. -3. **HTTP / transport (the host)** — `crates/providers/src/.rs` (e.g. `ocr.rs`, `realtime.rs`): the callable fn (`run_ocr`, `realtime`). It resolves the key, builds the auth header, builds URL + transforms via the config, then does the network call. This is the only layer allowed to do I/O. +1. **Entrypoint** — `mod.rs`: `pub async fn (request) -> CoreResult`, the Rust equivalent of `litellm.()`, plus a `_stream` variant when the route streams. It is the only thing a host touches. +2. **Transform contract** — `transformation.rs`: a `…ProviderConfig` trait (URL build + request/response transforms) with types in `types.rs`. +3. **Provider config** — `crates/core/src/providers///transformation.rs`: implement that trait as a `const __CONFIG`, mirroring the Python provider tree. Add parity unit tests. +4. **Prepare + handler** — `prepare.rs` resolves provider/model, credentials, auth headers, and URL, then transforms the request; `handler.rs` performs the provider call through the shared client in `client.rs` and transforms the response. -**Calling:** the host invokes the route fn — the Python bridge calls `run_ocr`; the `ai-gateway` server calls `realtime`. Register new modules in `lib.rs` / `mod.rs`, then run `cargo fmt && cargo clippy --workspace -- -D warnings && cargo test --workspace`. +## Coding standards + +Before writing new logic, look for an existing base to extend. When a change is +“the same behavior for one more provider/endpoint/integration”, the codebase +almost always already has a shared abstraction for it (for example, provider +`BaseConfig` transformation classes in `litellm/llms/base_llm/`, shared +helpers in `litellm_core_utils/`, typed request/response models, or factory +functions). Find it first with a search, then add the new variant by inheriting +from or composing that base, overriding only what genuinely differs (model +name, parameter mapping, or auth). + +Never copy an existing implementation and edit it in place, and never hand-roll +a parallel version of logic a base already provides. If you catch yourself +writing a second copy of a pattern that exists twice already, stop and extract a +base instead: put the shared shape in one place and make both call sites thin +variants of it. The test for a good abstraction is that adding the next provider +is a few declarative lines, not a new file of duplicated flow. Only diverge from +the base when behavior is genuinely different, and say so explicitly in the PR. + +**Calling:** hosts invoke the core entrypoint — the Python bridge and the `ai-gateway` route service both call `litellm_core::messages::messages`. Never add a provider handler to `ai-gateway`. Register new modules in `lib.rs` / `mod.rs`, then run `cargo fmt && cargo clippy --workspace -- -D warnings && cargo test --workspace`. diff --git a/litellm-rust/AGENTS.md b/litellm-rust/AGENTS.md index 86dd2c92744..36a5ad5a8f4 100644 --- a/litellm-rust/AGENTS.md +++ b/litellm-rust/AGENTS.md @@ -4,14 +4,39 @@ litellm-rust has exactly THREE crates. A crate is a LAYER, not a route. Routes ( ## Crates -| Crate | Role | Pure / I/O | -|-------|------|------------| -| litellm-core | Translation layer — types, route contracts (traits), provider transforms (modules under providers/), and the router. Builds requests/responses; no network. | Pure | -| litellm-ai-gateway | Routes + host — the only crate that touches the network. HTTP/WebSocket I/O (modules under io/) plus the axum server binary (behind the `server` feature). | I/O | -| litellm-python-bridge | PyO3 cdylib exposing Rust to the litellm Python SDK — a thin adapter over litellm-ai-gateway's I/O. | Binding | +| Crate | Role | +|-------|------| +| litellm-core | The LiteLLM SDK in Rust. One public entrypoint per top-level call (`messages::messages()`), owning types, transforms, provider resolution, auth, and the provider HTTP call. Call it, get a typed response. | +| litellm-ai-gateway | The axum server (behind the `server` feature) plus the WebSocket hosts. Translates HTTP/WS to core entrypoints; owns no provider logic and no handlers. | +| litellm-python-bridge | PyO3 cdylib exposing Rust to the litellm Python SDK — marshals Python objects and calls core entrypoints. | Dependency direction (acyclic): litellm-core ← litellm-ai-gateway ← litellm-python-bridge. +## Where a route lives + +A top-level LiteLLM call is a module under `crates/core/src//`, shaped like `messages`: + +``` +core/src/messages/ + mod.rs # pub async fn messages(..) -> CoreResult<..> (+ messages_stream for SSE) + types.rs # request/response types, MessagesRequest + transformation.rs # the provider template trait + prepare.rs # provider resolution, auth headers, URL + handler.rs # the provider call + client.rs # the shared reqwest client +``` + +Handlers never live in `ai-gateway`. `ocr`, `audio_transcription`, and `realtime` are still hosted there from before this rule; they move to `core` as they are touched. + Adding a crate: default to a MODULE. New crate ONLY on a real trigger — separate artifact (binary/cdylib), proc-macro, shared foundation, or publishable standalone. A new provider or route is none of these. Adding a crate fails crates/core/tests/workspace_crate_allowlist.rs until you update its allowlist and this file — intentional. + +## Style + +All Rust in `litellm-rust/` follows the official Rust Style Guide: +https://doc.rust-lang.org/style-guide/ + +`rustfmt` implements its formatting by default, so run `cargo fmt` before committing; CI gates every PR on `cargo fmt --check`. Do not hand-format against rustfmt or add a `rustfmt.toml` that diverges from the default style. + +Beyond formatting, follow the guide's naming and idiom conventions rustfmt cannot auto-apply: `snake_case` items/functions/modules, `UpperCamelCase` types/traits/variants, `SCREAMING_SNAKE_CASE` constants/statics (acronyms as one word, e.g. `HttpClient`), and the import grouping and item ordering it prescribes. See CLAUDE.md for the detailed version. diff --git a/litellm-rust/CLAUDE.md b/litellm-rust/CLAUDE.md index 7c723e570ef..fe6ceedbb86 100644 --- a/litellm-rust/CLAUDE.md +++ b/litellm-rust/CLAUDE.md @@ -2,42 +2,96 @@ This file defines the rules for Rust work in LiteLLM. +## Provider Coding Standards + +Before writing new logic, look for an existing base to extend. When a change is +“the same behavior for one more provider/endpoint/integration”, the codebase +almost always already has a shared abstraction for it (for example, provider +`BaseConfig` transformation classes in `litellm/llms/base_llm/`, shared +helpers in `litellm_core_utils/`, typed request/response models, or factory +functions). Find it first with a search, then add the new variant by inheriting +from or composing that base, overriding only what genuinely differs (model +name, parameter mapping, or auth). + +Never copy an existing implementation and edit it in place, and never hand-roll +a parallel version of logic a base already provides. If you catch yourself +writing a second copy of a pattern that exists twice already, stop and extract a +base instead: put the shared shape in one place and make both call sites thin +variants of it. The test for a good abstraction is that adding the next provider +is a few declarative lines, not a new file of duplicated flow. Only diverge from +the base when behavior is genuinely different, and say so explicitly in the PR. + ## Crates (exactly three — see AGENTS.md) -`litellm-core` describes work; `litellm-ai-gateway` executes it; `litellm-python-bridge` -exposes it to the Python SDK. A crate is a **layer**, not a route — add modules, not crates. +`litellm-core` **is** the LiteLLM SDK in Rust: it makes the LLM call. +`litellm-ai-gateway` is an HTTP/WebSocket server in front of it, and +`litellm-python-bridge` exposes it to the Python SDK. A crate is a **layer**, not +a route — add modules, not crates. ## Core Boundary -`litellm-core` is the pure translation layer; the `litellm-ai-gateway` host executes work. +`litellm-core` owns the whole call. The Rust equivalent of `litellm.messages()` +is `litellm_core::messages::messages(request).await`: you call it, it does the +provider call, and you get a typed non-streaming response back. Route-level Rust structure mirrors LiteLLM's Python responsibilities: -- `core/src//` owns the route contract, shared types, and provider - template traits. For OCR, this means `core/src/ocr`. +- `core/src//` owns the route end to end: the public entrypoint fn named + after the route in `mod.rs`, the request/response types (`types.rs`), the + provider template trait (`transformation.rs`), the provider/auth/URL + resolution (`prepare.rs`), the HTTP client (`client.rs`), and the handler that + performs the call (`handler.rs`). `core/src/messages` is the reference. - `core/src/providers///transformation.rs` owns the - provider-specific transform. For Mistral OCR, this means - `core/src/providers/mistral/ocr/transformation.rs`. -- Network execution lives in the host crate `ai-gateway` (`ai-gateway/src/io/`), - never inside `core`. + provider-specific transform. For Anthropic Messages, this means + `core/src/providers/anthropic/messages/transformation.rs`. +- Handlers live in `core`, never in a host. `ai-gateway` must not contain a + route handler that talks to a provider; its axum route reads the HTTP request, + picks a deployment, and calls the `core` entrypoint. `python-bridge` marshals + Python objects and calls the same entrypoint. + +Streaming keeps the same shape: the route entrypoint has a `_stream` +variant in `core` that returns the upstream response so a host can splice it to +its own caller; the host still owns no provider logic. + +Call-hook and lifecycle instrumentation, including phase timing, usage +accumulation, and callback payload construction, always lives in `core`. +Hosts feed observed events into core and dispatch the completed payloads through +their I/O logger; hosts must not own callback orchestration. Allowed in `core`: -- Pure request transforms -- Pure response transforms -- Pure stream chunk normalization +- The public entrypoint for a top-level LiteLLM call +- Request/response transforms and stream chunk normalization +- Provider resolution, auth header construction, and URL building +- The provider HTTP call itself, through a shared reused client with connect and + request timeouts - Shared data types and validation errors - Deterministic token/cost helper logic Not allowed in `core`: -- Network calls -- Environment variable or secret reads +- Serving HTTP: axum routes, extractors, and transport concerns stay in the host - Filesystem access -- Database or cache access -- Provider SDK signing or auth flows +- Database access +- Config file reading and rollout state - Logging callbacks, spend writes, or custom callbacks - Global mutable runtime state +Env reads in `core` are limited to credential fallback inside a route's +`prepare.rs` (the `env_lookup` closure), mirroring what the Python SDK does when +no key is passed. Everything else config-shaped is resolved by the host and +passed in. + +Routes still hosted in `ai-gateway` (`ocr`, `audio_transcription`, `realtime`) +predate this rule and are being moved into `core` route modules; do not add new +ones there, and prefer moving one when you touch it. + Python owns rollout state and fallback while Rust is being introduced. Rust paths must be off by default until parity tests prove equivalence with Python. +A new provider/route may instead be implemented rust-only with no Python +reference; then the Python interface is a thin dispatch that calls Rust with no +fallback, and you state the rust-only choice explicitly in the PR. Either way +the Python side stays minimal (it only marshals inputs and calls the Rust +interface), never add a per-route feature flag, and never push provider +dispatch into `litellm/main.py`; put it in a thin dispatch class under +`litellm/llms///`. ## Production Bar @@ -62,10 +116,10 @@ the first PR: - Preserve Python output shape intentionally. If a field is always serialized as `null` for Python parity, leave a short comment explaining that parity choice. -## Host I/O Rules +## Network I/O Rules -These rules apply when adding future crates or modules that execute network I/O, -such as `ai-gateway`, router hosts, or standalone servers: +These rules apply to every module that executes network I/O, whether it is a +`core` route handler or a host such as `ai-gateway`: - Set connect and full-request timeouts. No unbounded waits. - Reuse HTTP clients; do not construct clients per request. @@ -77,6 +131,26 @@ such as `ai-gateway`, router hosts, or standalone servers: - Avoid `expect`/`unwrap` in server startup and request paths unless the panic is impossible by construction and documented. +## Rust Style Guide + +All Rust in `litellm-rust/` follows the official Rust Style Guide: +https://doc.rust-lang.org/style-guide/ + +`rustfmt` implements the guide's formatting rules by default, so the mechanical +side is enforced for you: run `cargo fmt` before committing and CI gates every +PR on `cargo fmt --check` (see Checks). Do not hand-format against rustfmt or add +a `rustfmt.toml` that diverges from the default style; the default style *is* the +guide. + +The guide also covers conventions rustfmt cannot auto-apply; follow these too: +- Naming: `snake_case` for items, functions, and modules; `UpperCamelCase` for + types, traits, and enum variants; `SCREAMING_SNAKE_CASE` for constants and + statics; acronyms count as one word (`HttpClient`, not `HTTPClient`). +- Ordering and grouping the guide prescribes: imports grouped std / external / + crate-local, derives before other attributes, and consistent item order. +- Idioms the guide recommends over the formatter fighting you (e.g. prefer + restructuring an over-long expression rather than forcing an awkward wrap). + ## Constants Magic numbers and fixed strings go in a crate-level `constants.rs`, never diff --git a/litellm-rust/Cargo.lock b/litellm-rust/Cargo.lock index 9bffe9f9ec6..ce28f737334 100644 --- a/litellm-rust/Cargo.lock +++ b/litellm-rust/Cargo.lock @@ -3,14 +3,23 @@ version = 4 [[package]] -name = "async-trait" -version = "0.1.89" +name = "arc-swap" +version = "1.9.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb" +checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b" +dependencies = [ + "rustversion", +] + +[[package]] +name = "async-trait" +version = "0.1.91" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 3.0.0", ] [[package]] @@ -25,6 +34,352 @@ version = "1.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" +[[package]] +name = "aws-config" +version = "1.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "47712fde1909402600ccfbb26e47d482d2e58bb9e9e603d9f17e67cc435a6319" +dependencies = [ + "aws-credential-types", + "aws-runtime", + "aws-sdk-sts", + "aws-smithy-async", + "aws-smithy-http", + "aws-smithy-json", + "aws-smithy-runtime", + "aws-smithy-runtime-api", + "aws-smithy-schema", + "aws-smithy-types", + "aws-types", + "bytes", + "fastrand", + "http 1.4.2", + "time", + "tokio", + "tracing", + "url", +] + +[[package]] +name = "aws-credential-types" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e93964ffdaf57857f544be3666a5f57570bb699e934700f11b49708f61bb556e" +dependencies = [ + "aws-smithy-async", + "aws-smithy-runtime-api", + "aws-smithy-types", + "zeroize", +] + +[[package]] +name = "aws-lc-rs" +version = "1.17.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "00bdb5da18dac48ca2cc7cd4a98e533e8635a58e2361d13a1a4ee3888e0d72f1" +dependencies = [ + "aws-lc-sys", + "zeroize", +] + +[[package]] +name = "aws-lc-sys" +version = "0.43.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "43103168cc76fe62678a375e722fc9cb3a0146159ac5828bc4f0dfd755c2224c" +dependencies = [ + "cc", + "cmake", + "dunce", + "fs_extra", + "pkg-config", +] + +[[package]] +name = "aws-runtime" +version = "1.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7816e98ee912159f45d307e5ee6bfea4a335a55aee15f7f3e32f81a6f3000f1d" +dependencies = [ + "aws-credential-types", + "aws-sigv4", + "aws-smithy-async", + "aws-smithy-http", + "aws-smithy-runtime", + "aws-smithy-runtime-api", + "aws-smithy-types", + "aws-types", + "bytes", + "bytes-utils", + "fastrand", + "http 1.4.2", + "http-body 1.1.0", + "percent-encoding", + "pin-project-lite", + "tracing", + "uuid", +] + +[[package]] +name = "aws-sdk-sts" +version = "1.108.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3c72b08911d8128dd360fe1b22a9fec0fa8b552dde8ec828dcf20ef5ec974e9f" +dependencies = [ + "arc-swap", + "aws-credential-types", + "aws-runtime", + "aws-smithy-async", + "aws-smithy-http", + "aws-smithy-json", + "aws-smithy-observability", + "aws-smithy-query", + "aws-smithy-runtime", + "aws-smithy-runtime-api", + "aws-smithy-schema", + "aws-smithy-types", + "aws-smithy-xml", + "aws-types", + "fastrand", + "http 0.2.12", + "http 1.4.2", + "regex-lite", + "tracing", +] + +[[package]] +name = "aws-sigv4" +version = "1.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "723c2234ad7511ceef63eab016b7ba6ff7c55590fefb96fa8467af014a07309f" +dependencies = [ + "aws-credential-types", + "aws-smithy-http", + "aws-smithy-runtime-api", + "aws-smithy-types", + "bytes", + "form_urlencoded", + "hex", + "hmac", + "http 0.2.12", + "http 1.4.2", + "percent-encoding", + "sha2 0.11.0", + "time", + "tracing", +] + +[[package]] +name = "aws-smithy-async" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f02e407fb3b54891734224b9ffac8a71fdd35f542500fa1af95754a6b2beb316" +dependencies = [ + "futures-util", + "pin-project-lite", + "tokio", +] + +[[package]] +name = "aws-smithy-http" +version = "0.64.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "37843d9add67c3aff5856f409c6dc315d3cdff60f9c0cb5b670dab1e9920306d" +dependencies = [ + "aws-smithy-runtime-api", + "aws-smithy-types", + "bytes", + "bytes-utils", + "futures-core", + "futures-util", + "http 1.4.2", + "http-body 1.1.0", + "http-body-util", + "percent-encoding", + "pin-project-lite", + "pin-utils", + "tracing", +] + +[[package]] +name = "aws-smithy-http-client" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "635d23afda0a6ab48d666c4d447c4873e8d1e83518a2be2093122397e50b838e" +dependencies = [ + "aws-smithy-async", + "aws-smithy-runtime-api", + "aws-smithy-types", + "h2 0.3.27", + "h2 0.4.15", + "http 0.2.12", + "http 1.4.2", + "http-body 0.4.6", + "hyper 0.14.32", + "hyper 1.10.1", + "hyper-rustls 0.24.2", + "hyper-rustls 0.27.9", + "hyper-util", + "pin-project-lite", + "rustls 0.21.12", + "rustls 0.23.42", + "rustls-native-certs", + "rustls-pki-types", + "tokio", + "tokio-rustls 0.26.4", + "tower", + "tracing", +] + +[[package]] +name = "aws-smithy-json" +version = "0.63.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3dc65a121adb4b33729919fcfa14fa36fb33c1555a8f06bb0e2188dbfdc1d9ef" +dependencies = [ + "aws-smithy-runtime-api", + "aws-smithy-schema", + "aws-smithy-types", +] + +[[package]] +name = "aws-smithy-observability" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e86338c869539a581bf161247762a6e87f92c5c075060057b5ed6d06632ed0c" +dependencies = [ + "aws-smithy-runtime-api", +] + +[[package]] +name = "aws-smithy-query" +version = "0.61.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dd22a6ba36e3f113cb8d5b3d1fe0ed31c76ee608ef63322d753bb8d2c9479e77" +dependencies = [ + "aws-smithy-types", + "urlencoding", +] + +[[package]] +name = "aws-smithy-runtime" +version = "1.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bea94a9ff8464016338c851e24b472d7131c388c88898a502e781815b2ee6045" +dependencies = [ + "aws-smithy-async", + "aws-smithy-http", + "aws-smithy-http-client", + "aws-smithy-observability", + "aws-smithy-runtime-api", + "aws-smithy-schema", + "aws-smithy-types", + "bytes", + "fastrand", + "http 0.2.12", + "http 1.4.2", + "http-body 0.4.6", + "http-body 1.1.0", + "http-body-util", + "pin-project-lite", + "pin-utils", + "tokio", + "tracing", +] + +[[package]] +name = "aws-smithy-runtime-api" +version = "1.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "22ed1ebe6e0a95ea84570225f5a8208dec4b8f77e61a9b0d6f51773fcb4612f0" +dependencies = [ + "aws-smithy-async", + "aws-smithy-runtime-api-macros", + "aws-smithy-types", + "bytes", + "http 0.2.12", + "http 1.4.2", + "pin-project-lite", + "tokio", + "tracing", + "zeroize", +] + +[[package]] +name = "aws-smithy-runtime-api-macros" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "221eaa237ddf1ca79b60d1372aad77e47f9c0ea5b3ce5099da8c61d027dc77b3" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.119", +] + +[[package]] +name = "aws-smithy-schema" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d56e0a4e53127a632224e43633b0fe045fa9e1e3cfc68b9830f1115e103f910" +dependencies = [ + "aws-smithy-runtime-api", + "aws-smithy-types", + "http 1.4.2", +] + +[[package]] +name = "aws-smithy-types" +version = "1.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d6dc683efb34b9e755675b37fedbe0103141e5b6df7bdc9eb6967756a8c167d8" +dependencies = [ + "base64-simd", + "bytes", + "bytes-utils", + "futures-core", + "http 0.2.12", + "http 1.4.2", + "http-body 0.4.6", + "http-body 1.1.0", + "http-body-util", + "itoa", + "num-integer", + "pin-project-lite", + "pin-utils", + "ryu", + "serde", + "time", + "tokio", + "tokio-util", +] + +[[package]] +name = "aws-smithy-xml" +version = "0.61.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ea3f68eec3607f02acd24067969ce2abc6ba16aa7d5ce59ca450ed2fb5f78957" +dependencies = [ + "aws-smithy-runtime-api", + "aws-smithy-schema", + "aws-smithy-types", + "xmlparser", +] + +[[package]] +name = "aws-types" +version = "1.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e957a6c6dbce82b7a91f44231c09273159703769f447cbe85e854dfe9cf67f86" +dependencies = [ + "aws-credential-types", + "aws-smithy-async", + "aws-smithy-runtime-api", + "aws-smithy-schema", + "aws-smithy-types", + "rustc_version", + "tracing", +] + [[package]] name = "axum" version = "0.7.9" @@ -36,10 +391,10 @@ dependencies = [ "base64", "bytes", "futures-util", - "http", - "http-body", + "http 1.4.2", + "http-body 1.1.0", "http-body-util", - "hyper", + "hyper 1.10.1", "hyper-util", "itoa", "matchit", @@ -71,8 +426,8 @@ dependencies = [ "async-trait", "bytes", "futures-util", - "http", - "http-body", + "http 1.4.2", + "http-body 1.1.0", "http-body-util", "mime", "pin-project-lite", @@ -90,10 +445,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" [[package]] -name = "bitflags" -version = "2.13.0" +name = "base64-simd" +version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8" +checksum = "339abbe78e73178762e23bea9dfd08e697eb3f3301cd4be981c0f78ba5859195" +dependencies = [ + "outref", + "vsimd", +] + +[[package]] +name = "bitflags" +version = "2.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da" [[package]] name = "block-buffer" @@ -104,6 +469,15 @@ dependencies = [ "generic-array", ] +[[package]] +name = "block-buffer" +version = "0.12.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa" +dependencies = [ + "hybrid-array", +] + [[package]] name = "bumpalo" version = "3.20.3" @@ -118,17 +492,29 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b" [[package]] name = "bytes" -version = "1.12.0" +version = "1.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593" +checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04" + +[[package]] +name = "bytes-utils" +version = "0.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7dafe3a8757b027e2be6e4e5601ed563c55989fcf1546e933c66c8eb3a058d35" +dependencies = [ + "bytes", + "either", +] [[package]] name = "cc" -version = "1.2.65" +version = "1.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96" +checksum = "c89588d05638b5b4594a3348a2d6c20277e43a7f5c5202b05cc56888475a47b8" dependencies = [ "find-msvc-tools", + "jobserver", + "libc", "shlex", ] @@ -140,9 +526,41 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "cfg_aliases" -version = "0.2.1" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" +checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527" + +[[package]] +name = "chacha20" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "rand_core 0.10.1", +] + +[[package]] +name = "cmake" +version = "0.1.58" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678" +dependencies = [ + "cc", +] + +[[package]] +name = "cmov" +version = "0.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a" + +[[package]] +name = "const-oid" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c" [[package]] name = "core-foundation" @@ -169,6 +587,15 @@ dependencies = [ "libc", ] +[[package]] +name = "cpufeatures" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201" +dependencies = [ + "libc", +] + [[package]] name = "crypto-common" version = "0.1.7" @@ -179,20 +606,56 @@ dependencies = [ "typenum", ] +[[package]] +name = "crypto-common" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" +dependencies = [ + "hybrid-array", +] + +[[package]] +name = "ctutils" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +dependencies = [ + "cmov", +] + [[package]] name = "data-encoding" version = "2.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8" +[[package]] +name = "deranged" +version = "0.5.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c" + [[package]] name = "digest" version = "0.10.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" dependencies = [ - "block-buffer", - "crypto-common", + "block-buffer 0.10.4", + "crypto-common 0.1.7", +] + +[[package]] +name = "digest" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" +dependencies = [ + "block-buffer 0.12.1", + "const-oid", + "crypto-common 0.2.2", + "ctutils", ] [[package]] @@ -203,15 +666,33 @@ checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.119", ] +[[package]] +name = "dunce" +version = "1.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813" + +[[package]] +name = "either" +version = "1.16.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e" + [[package]] name = "equivalent" version = "1.0.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f" +[[package]] +name = "fastrand" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223" + [[package]] name = "find-msvc-tools" version = "0.1.9" @@ -234,25 +715,16 @@ dependencies = [ ] [[package]] -name = "futures" -version = "0.3.32" +name = "fs_extra" +version = "1.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d" -dependencies = [ - "futures-channel", - "futures-core", - "futures-executor", - "futures-io", - "futures-sink", - "futures-task", - "futures-util", -] +checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" [[package]] name = "futures-channel" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d" +checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae" dependencies = [ "futures-core", "futures-sink", @@ -260,57 +732,45 @@ dependencies = [ [[package]] name = "futures-core" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d" - -[[package]] -name = "futures-executor" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d" -dependencies = [ - "futures-core", - "futures-task", - "futures-util", -] +checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7" [[package]] name = "futures-io" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718" +checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a" [[package]] name = "futures-macro" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b" +checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.119", ] [[package]] name = "futures-sink" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893" +checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307" [[package]] name = "futures-task" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393" +checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109" [[package]] name = "futures-util" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6" +checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa" dependencies = [ - "futures-channel", "futures-core", "futures-io", "futures-macro", @@ -346,18 +806,37 @@ dependencies = [ [[package]] name = "getrandom" -version = "0.3.4" +version = "0.4.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" +checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" dependencies = [ "cfg-if", "js-sys", "libc", "r-efi", - "wasip2", + "rand_core 0.10.1", "wasm-bindgen", ] +[[package]] +name = "h2" +version = "0.3.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d" +dependencies = [ + "bytes", + "fnv", + "futures-core", + "futures-sink", + "futures-util", + "http 0.2.12", + "indexmap", + "slab", + "tokio", + "tokio-util", + "tracing", +] + [[package]] name = "h2" version = "0.4.15" @@ -369,7 +848,7 @@ dependencies = [ "fnv", "futures-core", "futures-sink", - "http", + "http 1.4.2", "indexmap", "slab", "tokio", @@ -389,6 +868,32 @@ version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" +[[package]] +name = "hex" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" + +[[package]] +name = "hmac" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f" +dependencies = [ + "digest 0.11.3", +] + +[[package]] +name = "http" +version = "0.2.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1" +dependencies = [ + "bytes", + "fnv", + "itoa", +] + [[package]] name = "http" version = "1.4.2" @@ -401,24 +906,35 @@ dependencies = [ [[package]] name = "http-body" -version = "1.0.1" +version = "0.4.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184" +checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2" dependencies = [ "bytes", - "http", + "http 0.2.12", + "pin-project-lite", +] + +[[package]] +name = "http-body" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c" +dependencies = [ + "bytes", + "http 1.4.2", ] [[package]] name = "http-body-util" -version = "0.1.3" +version = "0.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a" +checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2" dependencies = [ "bytes", "futures-core", - "http", - "http-body", + "http 1.4.2", + "http-body 1.1.0", "pin-project-lite", ] @@ -434,6 +950,39 @@ version = "1.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9" +[[package]] +name = "hybrid-array" +version = "0.4.13" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c" +dependencies = [ + "typenum", +] + +[[package]] +name = "hyper" +version = "0.14.32" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7" +dependencies = [ + "bytes", + "futures-channel", + "futures-core", + "futures-util", + "h2 0.3.27", + "http 0.2.12", + "http-body 0.4.6", + "httparse", + "httpdate", + "itoa", + "pin-project-lite", + "socket2 0.5.10", + "tokio", + "tower-service", + "tracing", + "want", +] + [[package]] name = "hyper" version = "1.10.1" @@ -444,9 +993,9 @@ dependencies = [ "bytes", "futures-channel", "futures-core", - "h2", - "http", - "http-body", + "h2 0.4.15", + "http 1.4.2", + "http-body 1.1.0", "httparse", "httpdate", "itoa", @@ -456,18 +1005,34 @@ dependencies = [ "want", ] +[[package]] +name = "hyper-rustls" +version = "0.24.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590" +dependencies = [ + "futures-util", + "http 0.2.12", + "hyper 0.14.32", + "log", + "rustls 0.21.12", + "tokio", + "tokio-rustls 0.24.1", +] + [[package]] name = "hyper-rustls" version = "0.27.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f" dependencies = [ - "http", - "hyper", + "http 1.4.2", + "hyper 1.10.1", "hyper-util", - "rustls", + "rustls 0.23.42", + "rustls-native-certs", "tokio", - "tokio-rustls", + "tokio-rustls 0.26.4", "tower-service", "webpki-roots", ] @@ -482,14 +1047,14 @@ dependencies = [ "bytes", "futures-channel", "futures-util", - "http", - "http-body", - "hyper", + "http 1.4.2", + "http-body 1.1.0", + "hyper 1.10.1", "ipnet", "libc", "percent-encoding", "pin-project-lite", - "socket2", + "socket2 0.6.5", "tokio", "tower-service", "tracing", @@ -608,15 +1173,6 @@ dependencies = [ "hashbrown", ] -[[package]] -name = "indoc" -version = "2.0.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706" -dependencies = [ - "rustversion", -] - [[package]] name = "ipnet" version = "2.12.0" @@ -629,6 +1185,16 @@ version = "1.0.18" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682" +[[package]] +name = "jobserver" +version = "0.1.35" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3" +dependencies = [ + "getrandom 0.4.3", + "libc", +] + [[package]] name = "js-sys" version = "0.3.103" @@ -659,20 +1225,29 @@ dependencies = [ "reqwest", "serde", "serde_json", - "sha2", + "sha2 0.10.9", "subtle", "tokio", "tokio-tungstenite", + "tower", ] [[package]] name = "litellm-core" version = "0.1.0" dependencies = [ - "rand 0.8.6", + "aws-config", + "aws-credential-types", + "aws-sdk-sts", + "aws-sigv4", + "aws-smithy-runtime-api", + "aws-types", + "rand 0.8.7", + "reqwest", "serde", "serde_json", - "thiserror 2.0.18", + "sha2 0.10.9", + "thiserror 2.0.19", "tokio", ] @@ -714,18 +1289,9 @@ checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94" [[package]] name = "memchr" -version = "2.8.2" +version = "2.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4" - -[[package]] -name = "memoffset" -version = "0.9.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a" -dependencies = [ - "autocfg", -] +checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98" [[package]] name = "mime" @@ -735,15 +1301,39 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a" [[package]] name = "mio" -version = "1.2.1" +version = "1.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda" +checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427" dependencies = [ "libc", "wasi", "windows-sys 0.61.2", ] +[[package]] +name = "num-conv" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441" + +[[package]] +name = "num-integer" +version = "0.1.46" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f" +dependencies = [ + "num-traits", +] + +[[package]] +name = "num-traits" +version = "0.2.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" +dependencies = [ + "autocfg", +] + [[package]] name = "once_cell" version = "1.21.4" @@ -756,6 +1346,12 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe" +[[package]] +name = "outref" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e" + [[package]] name = "percent-encoding" version = "2.3.2" @@ -769,10 +1365,22 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" [[package]] -name = "portable-atomic" -version = "1.13.1" +name = "pin-utils" +version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49" +checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" + +[[package]] +name = "pkg-config" +version = "0.3.33" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e" + +[[package]] +name = "portable-atomic" +version = "1.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3" [[package]] name = "potential_utf" @@ -783,6 +1391,12 @@ dependencies = [ "zerovec", ] +[[package]] +name = "powerfmt" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" + [[package]] name = "ppv-lite86" version = "0.2.21" @@ -794,38 +1408,35 @@ dependencies = [ [[package]] name = "proc-macro2" -version = "1.0.106" +version = "1.0.107" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" +checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9" dependencies = [ "unicode-ident", ] [[package]] name = "pyo3" -version = "0.23.5" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7778bffd85cf38175ac1f545509665d0b9b92a198ca7941f131f85f7a4f9a872" +checksum = "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c" dependencies = [ - "cfg-if", - "indoc", "libc", - "memoffset", "once_cell", "portable-atomic", "pyo3-build-config", "pyo3-ffi", "pyo3-macros", - "unindent", ] [[package]] name = "pyo3-async-runtimes" -version = "0.23.0" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "977dc837525cfd22919ba6a831413854beb7c99a256c03bf8624ad707e45810e" +checksum = "b3ef68daa7316a3fac65e5e18b2203f010346de1c1c53456811a2624673ab046" dependencies = [ - "futures", + "futures-channel", + "futures-util", "once_cell", "pin-project-lite", "pyo3", @@ -834,19 +1445,18 @@ dependencies = [ [[package]] name = "pyo3-build-config" -version = "0.23.5" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "94f6cbe86ef3bf18998d9df6e0f3fc1050a8c5efa409bf712e661a4366e010fb" +checksum = "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078" dependencies = [ - "once_cell", "target-lexicon", ] [[package]] name = "pyo3-ffi" -version = "0.23.5" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e9f1b4c431c0bb1c8fb0a338709859eed0d030ff6daa34368d3b152a63dfdd8d" +checksum = "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b" dependencies = [ "libc", "pyo3-build-config", @@ -854,27 +1464,26 @@ dependencies = [ [[package]] name = "pyo3-macros" -version = "0.23.5" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fbc2201328f63c4710f68abdf653c89d8dbc2858b88c5d88b0ff38a75288a9da" +checksum = "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771" dependencies = [ "proc-macro2", "pyo3-macros-backend", "quote", - "syn", + "syn 2.0.119", ] [[package]] name = "pyo3-macros-backend" -version = "0.23.5" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fca6726ad0f3da9c9de093d6f116a93c1a38e417ed73bf138472cf4064f72028" +checksum = "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362" dependencies = [ "heck", "proc-macro2", - "pyo3-build-config", "quote", - "syn", + "syn 2.0.119", ] [[package]] @@ -889,9 +1498,9 @@ dependencies = [ "quinn-proto", "quinn-udp", "rustc-hash", - "rustls", - "socket2", - "thiserror 2.0.18", + "rustls 0.23.42", + "socket2 0.6.5", + "thiserror 2.0.19", "tokio", "tracing", "web-time", @@ -899,20 +1508,21 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.15" +version = "0.11.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e" +checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" dependencies = [ "bytes", - "getrandom 0.3.4", + "getrandom 0.4.3", "lru-slab", - "rand 0.9.4", + "rand 0.10.2", + "rand_pcg", "ring", "rustc-hash", - "rustls", + "rustls 0.23.42", "rustls-pki-types", "slab", - "thiserror 2.0.18", + "thiserror 2.0.19", "tinyvec", "tracing", "web-time", @@ -920,52 +1530,53 @@ dependencies = [ [[package]] name = "quinn-udp" -version = "0.5.14" +version = "0.5.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd" +checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694" dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2", + "socket2 0.6.5", "tracing", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] name = "quote" -version = "1.0.46" +version = "1.0.47" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368" +checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001" dependencies = [ "proc-macro2", ] [[package]] name = "r-efi" -version = "5.3.0" +version = "6.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" +checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "rand" -version = "0.8.6" +version = "0.8.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a" +checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a" dependencies = [ "libc", - "rand_chacha 0.3.1", + "rand_chacha", "rand_core 0.6.4", ] [[package]] name = "rand" -version = "0.9.4" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea" +checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" dependencies = [ - "rand_chacha 0.9.0", - "rand_core 0.9.5", + "chacha20", + "getrandom 0.4.3", + "rand_core 0.10.1", ] [[package]] @@ -978,16 +1589,6 @@ dependencies = [ "rand_core 0.6.4", ] -[[package]] -name = "rand_chacha" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb" -dependencies = [ - "ppv-lite86", - "rand_core 0.9.5", -] - [[package]] name = "rand_core" version = "0.6.4" @@ -999,13 +1600,25 @@ dependencies = [ [[package]] name = "rand_core" -version = "0.9.5" +version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c" +checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" + +[[package]] +name = "rand_pcg" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a" dependencies = [ - "getrandom 0.3.4", + "rand_core 0.10.1", ] +[[package]] +name = "regex-lite" +version = "0.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973" + [[package]] name = "reqwest" version = "0.12.28" @@ -1017,26 +1630,26 @@ dependencies = [ "futures-channel", "futures-core", "futures-util", - "h2", - "http", - "http-body", + "h2 0.4.15", + "http 1.4.2", + "http-body 1.1.0", "http-body-util", - "hyper", - "hyper-rustls", + "hyper 1.10.1", + "hyper-rustls 0.27.9", "hyper-util", "js-sys", "log", "percent-encoding", "pin-project-lite", "quinn", - "rustls", + "rustls 0.23.42", "rustls-pki-types", "serde", "serde_json", "serde_urlencoded", "sync_wrapper", "tokio", - "tokio-rustls", + "tokio-rustls 0.26.4", "tokio-util", "tower", "tower-http", @@ -1065,20 +1678,42 @@ dependencies = [ [[package]] name = "rustc-hash" -version = "2.1.2" +version = "2.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe" +checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d" + +[[package]] +name = "rustc_version" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92" +dependencies = [ + "semver", +] [[package]] name = "rustls" -version = "0.23.41" +version = "0.21.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f" +checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e" dependencies = [ + "log", + "ring", + "rustls-webpki 0.101.7", + "sct", +] + +[[package]] +name = "rustls" +version = "0.23.42" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138" +dependencies = [ + "aws-lc-rs", "once_cell", "ring", "rustls-pki-types", - "rustls-webpki", + "rustls-webpki 0.103.13", "subtle", "zeroize", ] @@ -1097,20 +1732,31 @@ dependencies = [ [[package]] name = "rustls-pki-types" -version = "1.14.1" +version = "1.15.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9" +checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046" dependencies = [ "web-time", "zeroize", ] +[[package]] +name = "rustls-webpki" +version = "0.101.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765" +dependencies = [ + "ring", + "untrusted", +] + [[package]] name = "rustls-webpki" version = "0.103.13" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" dependencies = [ + "aws-lc-rs", "ring", "rustls-pki-types", "untrusted", @@ -1118,9 +1764,9 @@ dependencies = [ [[package]] name = "rustversion" -version = "1.0.22" +version = "1.0.23" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" +checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f" [[package]] name = "ryu" @@ -1137,6 +1783,16 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "sct" +version = "0.7.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414" +dependencies = [ + "ring", + "untrusted", +] + [[package]] name = "security-framework" version = "3.7.0" @@ -1161,10 +1817,16 @@ dependencies = [ ] [[package]] -name = "serde" -version = "1.0.228" +name = "semver" +version = "1.0.28" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e" +checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd" + +[[package]] +name = "serde" +version = "1.0.229" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba" dependencies = [ "serde_core", "serde_derive", @@ -1172,22 +1834,22 @@ dependencies = [ [[package]] name = "serde_core" -version = "1.0.228" +version = "1.0.229" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad" +checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48" dependencies = [ "serde_derive", ] [[package]] name = "serde_derive" -version = "1.0.228" +version = "1.0.229" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" +checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 3.0.0", ] [[package]] @@ -1228,13 +1890,13 @@ dependencies = [ [[package]] name = "sha1" -version = "0.10.6" +version = "0.10.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" +checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8" dependencies = [ "cfg-if", - "cpufeatures", - "digest", + "cpufeatures 0.2.17", + "digest 0.10.7", ] [[package]] @@ -1244,8 +1906,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" dependencies = [ "cfg-if", - "cpufeatures", - "digest", + "cpufeatures 0.2.17", + "digest 0.10.7", +] + +[[package]] +name = "sha2" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "digest 0.11.3", ] [[package]] @@ -1268,9 +1941,19 @@ checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90" [[package]] name = "socket2" -version = "0.6.4" +version = "0.5.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51" +checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678" +dependencies = [ + "libc", + "windows-sys 0.52.0", +] + +[[package]] +name = "socket2" +version = "0.6.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4" dependencies = [ "libc", "windows-sys 0.61.2", @@ -1290,9 +1973,20 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" [[package]] name = "syn" -version = "2.0.118" +version = "2.0.119" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422" +checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "syn" +version = "3.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f2fac314a64dc9a36e61a9eb4261a5e9bbfbc922b27e518af97bc32b926cf967" dependencies = [ "proc-macro2", "quote", @@ -1316,14 +2010,14 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.119", ] [[package]] name = "target-lexicon" -version = "0.12.16" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1" +checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca" [[package]] name = "thiserror" @@ -1336,11 +2030,11 @@ dependencies = [ [[package]] name = "thiserror" -version = "2.0.18" +version = "2.0.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4" +checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9" dependencies = [ - "thiserror-impl 2.0.18", + "thiserror-impl 2.0.19", ] [[package]] @@ -1351,18 +2045,48 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.119", ] [[package]] name = "thiserror-impl" -version = "2.0.18" +version = "2.0.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5" +checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 3.0.0", +] + +[[package]] +name = "time" +version = "0.3.53" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "18dfaaeddcb932337b5e7866ee7d0ce9b76d2fd092997146f187ec09b4558a50" +dependencies = [ + "deranged", + "num-conv", + "powerfmt", + "serde_core", + "time-core", + "time-macros", +] + +[[package]] +name = "time-core" +version = "0.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109" + +[[package]] +name = "time-macros" +version = "0.2.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c431b87111666e491a90baa837f914fb45cd5dc3c268591b0220ff5057f2085f" +dependencies = [ + "num-conv", + "time-core", ] [[package]] @@ -1377,9 +2101,9 @@ dependencies = [ [[package]] name = "tinyvec" -version = "1.11.0" +version = "1.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3" +checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f" dependencies = [ "tinyvec_macros", ] @@ -1392,28 +2116,38 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.52.3" +version = "1.53.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe" +checksum = "d988bcd52dbe076d3d46903332f58c912b87a2c49b1428419a5845154762ffee" dependencies = [ "bytes", "libc", "mio", "pin-project-lite", - "socket2", + "socket2 0.6.5", "tokio-macros", "windows-sys 0.61.2", ] [[package]] name = "tokio-macros" -version = "2.7.0" +version = "2.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496" +checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.119", +] + +[[package]] +name = "tokio-rustls" +version = "0.24.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081" +dependencies = [ + "rustls 0.21.12", + "tokio", ] [[package]] @@ -1422,7 +2156,7 @@ version = "0.26.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61" dependencies = [ - "rustls", + "rustls 0.23.42", "tokio", ] @@ -1434,11 +2168,11 @@ checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9" dependencies = [ "futures-util", "log", - "rustls", + "rustls 0.23.42", "rustls-native-certs", "rustls-pki-types", "tokio", - "tokio-rustls", + "tokio-rustls 0.26.4", "tungstenite", ] @@ -1480,8 +2214,8 @@ dependencies = [ "bitflags", "bytes", "futures-util", - "http", - "http-body", + "http 1.4.2", + "http-body 1.1.0", "pin-project-lite", "tower", "tower-layer", @@ -1509,9 +2243,21 @@ checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100" dependencies = [ "log", "pin-project-lite", + "tracing-attributes", "tracing-core", ] +[[package]] +name = "tracing-attributes" +version = "0.1.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.119", +] + [[package]] name = "tracing-core" version = "0.1.36" @@ -1536,11 +2282,11 @@ dependencies = [ "byteorder", "bytes", "data-encoding", - "http", + "http 1.4.2", "httparse", "log", - "rand 0.8.6", - "rustls", + "rand 0.8.7", + "rustls 0.23.42", "rustls-pki-types", "sha1", "thiserror 1.0.69", @@ -1559,12 +2305,6 @@ version = "1.0.24" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" -[[package]] -name = "unindent" -version = "0.2.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3" - [[package]] name = "untrusted" version = "0.9.0" @@ -1583,6 +2323,12 @@ dependencies = [ "serde", ] +[[package]] +name = "urlencoding" +version = "2.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da" + [[package]] name = "utf-8" version = "0.7.6" @@ -1595,12 +2341,28 @@ version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be" +[[package]] +name = "uuid" +version = "1.24.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "version_check" version = "0.9.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" +[[package]] +name = "vsimd" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64" + [[package]] name = "want" version = "0.3.1" @@ -1616,15 +2378,6 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" -[[package]] -name = "wasip2" -version = "1.0.4+wasi-0.2.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487" -dependencies = [ - "wit-bindgen", -] - [[package]] name = "wasm-bindgen" version = "0.2.126" @@ -1667,7 +2420,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn", + "syn 2.0.119", "wasm-bindgen-shared", ] @@ -1715,9 +2468,9 @@ dependencies = [ [[package]] name = "webpki-roots" -version = "1.0.8" +version = "1.0.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf" +checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" dependencies = [ "rustls-pki-types", ] @@ -1734,16 +2487,7 @@ version = "0.52.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d" dependencies = [ - "windows-targets 0.52.6", -] - -[[package]] -name = "windows-sys" -version = "0.60.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb" -dependencies = [ - "windows-targets 0.53.5", + "windows-targets", ] [[package]] @@ -1761,31 +2505,14 @@ version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" dependencies = [ - "windows_aarch64_gnullvm 0.52.6", - "windows_aarch64_msvc 0.52.6", - "windows_i686_gnu 0.52.6", - "windows_i686_gnullvm 0.52.6", - "windows_i686_msvc 0.52.6", - "windows_x86_64_gnu 0.52.6", - "windows_x86_64_gnullvm 0.52.6", - "windows_x86_64_msvc 0.52.6", -] - -[[package]] -name = "windows-targets" -version = "0.53.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3" -dependencies = [ - "windows-link", - "windows_aarch64_gnullvm 0.53.1", - "windows_aarch64_msvc 0.53.1", - "windows_i686_gnu 0.53.1", - "windows_i686_gnullvm 0.53.1", - "windows_i686_msvc 0.53.1", - "windows_x86_64_gnu 0.53.1", - "windows_x86_64_gnullvm 0.53.1", - "windows_x86_64_msvc 0.53.1", + "windows_aarch64_gnullvm", + "windows_aarch64_msvc", + "windows_i686_gnu", + "windows_i686_gnullvm", + "windows_i686_msvc", + "windows_x86_64_gnu", + "windows_x86_64_gnullvm", + "windows_x86_64_msvc", ] [[package]] @@ -1794,108 +2521,60 @@ version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" -[[package]] -name = "windows_aarch64_gnullvm" -version = "0.53.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53" - [[package]] name = "windows_aarch64_msvc" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" -[[package]] -name = "windows_aarch64_msvc" -version = "0.53.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006" - [[package]] name = "windows_i686_gnu" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" -[[package]] -name = "windows_i686_gnu" -version = "0.53.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3" - [[package]] name = "windows_i686_gnullvm" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" -[[package]] -name = "windows_i686_gnullvm" -version = "0.53.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c" - [[package]] name = "windows_i686_msvc" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" -[[package]] -name = "windows_i686_msvc" -version = "0.53.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2" - [[package]] name = "windows_x86_64_gnu" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" -[[package]] -name = "windows_x86_64_gnu" -version = "0.53.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499" - [[package]] name = "windows_x86_64_gnullvm" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" -[[package]] -name = "windows_x86_64_gnullvm" -version = "0.53.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1" - [[package]] name = "windows_x86_64_msvc" version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" -[[package]] -name = "windows_x86_64_msvc" -version = "0.53.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650" - -[[package]] -name = "wit-bindgen" -version = "0.57.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e" - [[package]] name = "writeable" version = "0.6.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4" +[[package]] +name = "xmlparser" +version = "0.13.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4" + [[package]] name = "yoke" version = "0.8.3" @@ -1915,28 +2594,28 @@ checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.119", "synstructure", ] [[package]] name = "zerocopy" -version = "0.8.52" +version = "0.8.54" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f" +checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19" dependencies = [ "zerocopy-derive", ] [[package]] name = "zerocopy-derive" -version = "0.8.52" +version = "0.8.54" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930" +checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.119", ] [[package]] @@ -1956,7 +2635,7 @@ checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.119", "synstructure", ] @@ -1996,11 +2675,11 @@ checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.119", ] [[package]] name = "zmij" -version = "1.0.21" +version = "1.0.23" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa" +checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b" diff --git a/litellm-rust/Cargo.toml b/litellm-rust/Cargo.toml index 5842ed5ba9b..6d63be05d00 100644 --- a/litellm-rust/Cargo.toml +++ b/litellm-rust/Cargo.toml @@ -7,7 +7,8 @@ members = [ resolver = "2" [workspace.package] -edition = "2021" +edition = "2024" +rust-version = "1.88" license = "MIT" repository = "https://github.com/BerriAI/litellm" @@ -15,8 +16,8 @@ repository = "https://github.com/BerriAI/litellm" litellm-core = { path = "crates/core" } litellm-ai-gateway = { path = "crates/ai-gateway", default-features = false } axum = "0.7" -pyo3 = "0.23.5" -pyo3-async-runtimes = { version = "0.23.0", features = ["tokio-runtime"] } +pyo3 = "0.29.0" +pyo3-async-runtimes = { version = "0.29.0", features = ["tokio-runtime"] } rand = "0.8" reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls", "http2", "stream"] } serde = { version = "1.0", features = ["derive"] } diff --git a/litellm-rust/README.md b/litellm-rust/README.md index 1646c90ad76..bcccf93300b 100644 --- a/litellm-rust/README.md +++ b/litellm-rust/README.md @@ -2,18 +2,31 @@ This workspace contains the staged Rust implementation for LiteLLM. -Rust starts as a pure transform core used by the existing Python host. Python -continues to own auth, configuration, network I/O, retries, routing, logging, +`litellm-core` is the LiteLLM SDK in Rust: one entrypoint per top-level call +that makes the LLM call and hands back a typed response, the same shape as +`litellm.messages()` in Python. + +```rust +let response = litellm_core::messages::messages(MessagesRequest { + model: "claude-sonnet-4-5", + body, + api_key: Some(key), + .. +}) +.await?; +``` + +Python continues to own configuration, retries, routing policy, logging, callbacks, spend tracking, and customer plugins until each Rust path has parity coverage and production evidence. ## Crates -| Crate | Role | Pure / I/O | -|-------|------|------------| -| litellm-core | Translation layer — types, route contracts (traits), provider transforms (modules under providers/), and the router. Builds requests/responses; no network. | Pure | -| litellm-ai-gateway | Routes + host — the only crate that touches the network. HTTP/WebSocket I/O (modules under io/) plus the axum server binary (behind the `server` feature). | I/O | -| litellm-python-bridge | PyO3 cdylib exposing Rust to the litellm Python SDK — a thin adapter over litellm-ai-gateway's I/O. | Binding | +| Crate | Role | +|-------|------| +| litellm-core | The SDK. Per-route entrypoints (`messages::messages()`), types, provider transforms (modules under `providers/`), provider resolution, auth, the provider HTTP call, and the router. | +| litellm-ai-gateway | The axum server (behind the `server` feature) and WebSocket hosts. Translates HTTP/WS to core entrypoints; no provider handlers. | +| litellm-python-bridge | PyO3 cdylib exposing Rust to the litellm Python SDK — marshals Python objects and calls core entrypoints. | Dependency direction (acyclic): litellm-core ← litellm-ai-gateway ← litellm-python-bridge. @@ -21,16 +34,16 @@ Dependency direction (acyclic): litellm-core ← litellm-ai-gateway ← litellm- ```text crates/ - core/ Route contracts, shared pure types, errors, and templates. - src/ocr/ - providers/ Provider-specific pure transforms. - src/mistral/ocr/transformation.rs + core/ The SDK: route modules + provider transforms. + src/messages/ mod.rs (entrypoint), types, transformation, prepare, handler, client + src/providers/anthropic/messages/transformation.rs + ai-gateway/ Axum server + WebSocket hosts; calls core entrypoints. python-bridge/ PyO3 bridge for Python LiteLLM. ``` -The folder shape should follow the Python provider tree: -`providers/src///transformation.rs`. The bridge should expose -one function per top-level route, starting with `ocr(payload)`. +The folder shape follows the Python provider tree: +`core/src/providers///transformation.rs`. The bridge exposes one +function per top-level route, mirroring the core entrypoints. ## Checks diff --git a/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md b/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md new file mode 100644 index 00000000000..a1860d8a9c9 --- /dev/null +++ b/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md @@ -0,0 +1,59 @@ +# Provider coding standards (litellm-rust) + +Rules for adding or changing an LLM provider/route in `litellm-rust`. `messages` (`core/src/messages`, `ANTHROPIC_MESSAGES_CONFIG`) is the reference: a route is a `core` module with a public entrypoint that makes the call and returns a typed response. + +## Provider resolution + +1. Always resolve the provider/model first with `get_custom_llm_provider` (`core/src/routing_utils/provider.rs`). Nothing downstream may branch on a raw model string. +2. Model/provider is resolved once, in `prepare.rs`, and passed down as typed fields. Don't re-resolve or re-parse it in transforms or handlers. + +## Transforms and the base config + +3. Every route defines a base config trait with `transform_request` + `transform_response` (+ `complete_url`, `supported_params`), living in `core/src//transformation.rs` (e.g. `AnthropicMessagesProviderConfig`, mirroring `OcrProviderConfig`). +4. Each provider implements that trait as a `const __CONFIG` in `core/src/providers///transformation.rs`, mirroring the Python provider tree. +5. Individual configs implement only the request/response transforms. Shared behavior (param filtering, defaults) stays as trait default methods so future providers inherit existing logic instead of reimplementing it. +6. Prefer composition: a provider that extends another reuses the base trait's defaults or wraps another config; don't copy transform bodies between providers. + +## Boundaries + +7. Layers never cross: `core` = the call itself (entrypoint, types, transforms, provider resolution, auth headers, provider HTTP, lifecycle hooks); `ai-gateway` = serving HTTP/WS (routing, extractors, auth of *our* callers, streaming to the client); `python-bridge` = thin PyO3 adapter. Hosts call the core entrypoint; they never build a provider request. +8. Generic/route files contain zero provider-specific branches. A provider is one module under `core/src/providers///`; a route is a module, never a new crate. +9. Route entry point stays thin: `core::::()` -> `prepare_*` -> handler (or `CallLifecycle::run_request`, which owns the pre_call -> during_call -> provider call -> success/failure order and phase timing). Axum handlers validate and delegate to a service that calls the entrypoint; no business logic in them. +10. Constants (URLs, env-var names, API versions, error messages) live in a crate `constants.rs`, never inline. Config-shaped env reads happen at the host/config layer with the `DEFAULT_*` fallback defined in `constants.rs`; the only env read in `core` is the credential fallback in a route's `prepare.rs`. + +## Types and errors + +11. Typed contracts only: no bare `serde_json::Value` / `String` / `Vec` as a transform input or output. Parse wire bytes into typed structs/enums at the host edge; a `type` discriminator is a typed field, not a raw string. +12. Model failures as values: return typed `CoreError`, don't panic. No `unwrap`/`expect`/`panic!` on user or provider input. +13. No mutation: build values in one shot (comprehensions/iterators, `collect`), prefer immutable bindings and owned typed structs over seeding-and-mutating. +14. Early returns over deep nesting; small focused files over god modules. +15. Preserve Python output shape intentionally. If a field is always serialized as `null` for parity, keep it and pin it with a test. + +## Safety and data minimization + +16. Never log request/response bodies, base64 payloads, document contents, or secrets. Truncate and bound any upstream body before it crosses a host boundary. +17. Treat empty/whitespace credentials, URLs, and config values as absent at the host resolution layer. +18. Network I/O sets connect + request timeouts (no unbounded waits), reuses a shared HTTP client, and prefers rustls TLS. + +## Tests and rollout + +19. Every provider transform ships tests for: supported-param filtering, request body shape, response normalization, missing/null fields, bad input, and `*_match_python` fixture parity. +20. Lifecycle/hook tests cover hook order, success + failure callback payloads, pre-call guardrail blocking before any provider I/O, during-call body mutation, and provider-error mapping. +21. When a route has a Python reference implementation, the Rust path stays off by default and behind Python parity tests (disabled / enabled-equals-Python / bridge-unavailable fallback) until parity is proven. A new provider/route may instead be implemented rust-only with no Python reference; then the Python interface is a thin dispatch to Rust with no fallback, and tests cover the rust-backed path plus the unavailable-bridge error. State the rust-only choice explicitly in the PR. + +## Python bridge (SDK side) + +22. A Python -> Rust bridge keeps the Python side minimal: the Python interface only marshals inputs and calls the Rust interface, with no transform, handler, or business logic. Aim for well under 100 lines of interface code per route; if the Python grows past that, the logic belongs in Rust. +23. Do not bloat `litellm/main.py`. A route's provider dispatch lives in a thin dispatch class under `litellm/llms///` that calls the Rust bridge; `main.py` only instantiates it and calls its sync/async method. +24. Do not add new feature flags unless explicitly requested. Reuse the existing litellm rust rollout mechanism (`use_litellm_rust`); never introduce a per-route env flag such as `LITELLM_USE_RUST_`. + +## Checks before push + +25. Run, and keep green: + ```bash + cd litellm-rust + cargo fmt --check + cargo clippy -p litellm-ai-gateway --all-targets --features server -- -D warnings + cargo clippy -p litellm-core -p litellm-python-bridge --all-targets -- -D warnings + cargo test --workspace + ``` diff --git a/litellm-rust/crates/ai-gateway/AGENTS.md b/litellm-rust/crates/ai-gateway/AGENTS.md index d9e6e1adde5..92567091cd3 100644 --- a/litellm-rust/crates/ai-gateway/AGENTS.md +++ b/litellm-rust/crates/ai-gateway/AGENTS.md @@ -1,7 +1,9 @@ # ai-gateway — folder architecture The Axum server that fronts the Rust gateway. It owns transport + config + auth -only; deployment selection lives in `core::router`, transforms in `core`/`providers`. +only; deployment selection lives in `core::router`, and the LLM call itself +(transforms, auth headers, provider HTTP) lives behind a `core` route entrypoint +such as `litellm_core::messages::messages`. No provider handler lives here. ``` src/ @@ -32,6 +34,11 @@ src/ args; it runs during extraction. Never re-implement the check per route. - **Handlers are thin.** A handler validates and delegates to its `service`. No business logic, no provider calls, no transforms in handlers. +- **Services call `core`, they don't reimplement it.** A `service` picks the + deployment and calls the `core` route entrypoint. Provider resolution, auth + headers, URL building, and the HTTP call are `core`'s job; a service that + builds a provider request itself is a bug (`routes/messages/service.rs` is + the reference). - **State is shared and cheap to clone.** Long-lived handles live behind `Arc` in `state.rs`; read env/config only in `main.rs` when building state. diff --git a/litellm-rust/crates/ai-gateway/Cargo.toml b/litellm-rust/crates/ai-gateway/Cargo.toml index 4055be36785..541beabe170 100644 --- a/litellm-rust/crates/ai-gateway/Cargo.toml +++ b/litellm-rust/crates/ai-gateway/Cargo.toml @@ -14,7 +14,7 @@ path = "src/main.rs" required-features = ["server"] [dependencies] -litellm-core.workspace = true +litellm-core = { workspace = true, features = ["bedrock-auth"] } # reqwest (rustls + json) is used by io/ocr and ships realtime logs to the # Python proxy callbacks API. reqwest.workspace = true @@ -41,3 +41,4 @@ python-config = ["dep:pyo3"] [dev-dependencies] futures-channel = "0.3" +tower = { version = "0.5.3", features = ["util"] } diff --git a/litellm-rust/crates/ai-gateway/README.md b/litellm-rust/crates/ai-gateway/README.md index f913beff6d5..7a6c620ee84 100644 --- a/litellm-rust/crates/ai-gateway/README.md +++ b/litellm-rust/crates/ai-gateway/README.md @@ -8,11 +8,11 @@ dials OpenAI upstream, and splices the two sockets frame-by-frame. `litellm-rust` is exactly three crates (a crate is a **layer**, not a route): -| Crate | Role | Pure / I/O | -|-------|------|------------| -| litellm-core | Translation layer — types, route contracts (traits), provider transforms (modules under `providers/`), and the router. Builds requests/responses; no network. | Pure | -| litellm-ai-gateway | Routes + host — the only crate that touches the network. HTTP/WebSocket I/O (modules under `io/`) plus the Axum server binary (behind the `server` feature). | I/O | -| litellm-python-bridge | PyO3 cdylib exposing Rust to the litellm Python SDK — a thin adapter over litellm-ai-gateway's I/O. | Binding | +| Crate | Role | +|-------|------| +| litellm-core | The LiteLLM SDK in Rust — per-route entrypoints (`messages::messages()`) that resolve the provider, transform, and make the call; plus types, provider transforms, and the router. | +| litellm-ai-gateway | The Axum server (behind the `server` feature) and WebSocket hosts. Translates HTTP/WS to core entrypoints; no provider handlers. | +| litellm-python-bridge | PyO3 cdylib exposing Rust to the litellm Python SDK — marshals Python objects and calls core entrypoints. | Dependency direction (acyclic): litellm-core ← litellm-ai-gateway ← litellm-python-bridge. diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/common_utils.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/common_utils.rs new file mode 100644 index 00000000000..270d5c2d97a --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/common_utils.rs @@ -0,0 +1,48 @@ +use std::collections::BTreeMap; + +use litellm_core::CoreResult; +use litellm_core::audio_transcription::transformation::AudioTranscriptionProviderConfig; +use litellm_core::error::CoreError; +use litellm_core::providers::bedrock::audio_transcription::BEDROCK_AUDIO_TRANSCRIPTION_CONFIG; +use serde_json::{Map, Value}; + +pub(super) fn audio_transcription_provider_config( + provider: &str, +) -> Option<&'static dyn AudioTranscriptionProviderConfig> { + match provider { + "bedrock" => Some(&BEDROCK_AUDIO_TRANSCRIPTION_CONFIG), + _ => None, + } +} + +pub(super) fn string_headers( + headers: Option>, +) -> CoreResult> { + headers + .unwrap_or_default() + .into_iter() + .map(|(key, value)| { + value + .as_str() + .map(|value| (key.clone(), value.to_string())) + .ok_or_else(|| { + CoreError::InvalidRequest(format!( + "audio transcription extra_headers.{key} must be a string" + )) + }) + }) + .collect() +} + +pub(super) fn has_header(headers: &BTreeMap, name: &str) -> bool { + headers.keys().any(|key| key.eq_ignore_ascii_case(name)) +} + +pub(super) fn truncate_error_body(body: &str) -> String { + let truncated: String = body.chars().take(256).collect(); + if truncated.chars().count() == body.chars().count() { + truncated + } else { + format!("{truncated}... (truncated)") + } +} diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/handler.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/handler.rs new file mode 100644 index 00000000000..33c13550f58 --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/handler.rs @@ -0,0 +1,89 @@ +use std::time::SystemTime; + +use litellm_core::CoreResult; +use litellm_core::audio_transcription::transformation::AudioTranscriptionAuth; +use litellm_core::error::CoreError; +use litellm_core::providers::bedrock::audio_transcription::aws_auth_config; +use litellm_core::providers::bedrock::aws_base::{resolve_credentials, sign_bedrock_post}; +use serde_json::Value; + +use super::common_utils::truncate_error_body; +use super::types::ProviderAudioTranscriptionRequest; +use crate::client::http_client; + +pub(crate) async fn execute_audio_transcription_provider_call( + request: ProviderAudioTranscriptionRequest, +) -> CoreResult { + let body = serde_json::to_vec(&request.body).map_err(|error| { + CoreError::InvalidRequest(format!("invalid audio request body: {error}")) + })?; + let mut request_builder = http_client().post(&request.url).body(body.clone()); + for (key, value) in &request.upstream_headers { + request_builder = request_builder.header(key, value); + } + if let Some(duration) = request.timeout { + request_builder = request_builder.timeout(duration); + } + let response = request_builder + .send() + .await + .map_err(|error| CoreError::Network(error.to_string()))?; + let status = response.status(); + let text = response + .text() + .await + .map_err(|error| CoreError::Network(error.to_string()))?; + if !status.is_success() { + return Err(CoreError::Http { + status: status.as_u16(), + body: truncate_error_body(&text), + }); + } + let response_json: Value = serde_json::from_str(&text).map_err(|error| { + CoreError::InvalidResponse(format!("invalid audio response JSON: {error}")) + })?; + Ok(request + .config + .transform_transcription_response(&request.model, response_json)? + .into_json()) +} + +pub(crate) async fn sign_request( + request: &ProviderAudioTranscriptionRequest, + optional_params: &serde_json::Map, +) -> CoreResult { + let env_lookup = environment_lookup; + let auth = request + .config + .auth_strategy(&request.model, optional_params, &env_lookup)?; + let body = serde_json::to_vec(&request.body).map_err(|error| { + CoreError::InvalidRequest(format!("invalid audio request body: {error}")) + })?; + let mut headers = super::common_utils::string_headers(None)?; + headers.insert("Content-Type".to_string(), "application/json".to_string()); + headers.extend(request.upstream_headers.iter().cloned()); + match auth { + AudioTranscriptionAuth::Bearer => {} + AudioTranscriptionAuth::AwsSigV4 { region, .. } => { + let credentials = + resolve_credentials(aws_auth_config(optional_params, &env_lookup), &env_lookup) + .await?; + headers.extend(sign_bedrock_post( + &request.url, + &body, + &headers, + ®ion, + &credentials, + SystemTime::now(), + )?); + } + } + Ok(ProviderAudioTranscriptionRequest { + upstream_headers: headers.into_iter().collect(), + ..request.clone() + }) +} + +pub(super) fn environment_lookup(key: &str) -> Option { + std::env::var(key).ok() +} diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/hooks.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/hooks.rs new file mode 100644 index 00000000000..8b6896f3846 --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/hooks.rs @@ -0,0 +1,300 @@ +use std::future::Future; +use std::pin::Pin; + +use litellm_core::CoreResult; +use litellm_core::audio_transcription::transformation::AudioTranscriptionAuth; +use litellm_core::call_lifecycle::{CallLifecycleContext, CallLifecycleHooks, CallLifecycleTiming}; +use litellm_core::error::CoreError; +use serde_json::{Map, Value, json}; + +use super::common_utils::{audio_transcription_provider_config, has_header, string_headers}; +use super::handler::sign_request; +use super::types::{PreparedAudioTranscriptionRequest, ProviderAudioTranscriptionRequest}; +use crate::integrations::custom_guardrail::{ + CustomGuardrailRunner, GuardrailContext, GuardrailError, GuardrailRequest, +}; +use crate::integrations::custom_logger::{ + CallType, CallbackTiming, CallbackValue, CustomLoggerRunner, LoggingError, ModelCallDetails, +}; +use crate::integrations::types::{ + RequestMetadata, StandardLoggingMetadata, StandardLoggingPayload, +}; + +pub(crate) struct AudioTranscriptionLifecycleHooks { + logger_runner: CustomLoggerRunner, + guardrail_runner: CustomGuardrailRunner, + request_metadata: RequestMetadata, +} + +type AudioFuture<'a, T> = Pin> + Send + 'a>>; +type AudioLogFuture<'a> = Pin + Send + 'a>>; + +impl AudioTranscriptionLifecycleHooks { + pub(crate) fn new( + logger_runner: CustomLoggerRunner, + guardrail_runner: CustomGuardrailRunner, + request_metadata: RequestMetadata, + ) -> Self { + Self { + logger_runner, + guardrail_runner, + request_metadata, + } + } + + async fn run_pre_call_guardrails( + &self, + request: PreparedAudioTranscriptionRequest, + ) -> CoreResult { + if self.guardrail_runner.is_empty() { + return Ok(request); + } + let (guardrail_request, _) = self + .guardrail_runner + .run_pre_call( + &guardrail_context(&self.request_metadata), + GuardrailRequest::new(json!({ + "model": request.model, + "custom_llm_provider": request.custom_llm_provider, + "audio": request.audio, + "optional_params": request.optional_params, + })), + ) + .await + .map_err(guardrail_error_to_core_error)?; + let Value::Object(mut data) = guardrail_request.data else { + return Err(CoreError::InvalidRequest( + "audio transcription pre_call guardrail must return an object".to_string(), + )); + }; + let audio = data.remove("audio").ok_or_else(|| { + CoreError::InvalidRequest("audio transcription guardrail removed audio".to_string()) + })?; + let optional_params = match data.remove("optional_params") { + Some(Value::Object(value)) => value, + Some(_) => { + return Err(CoreError::InvalidRequest( + "audio transcription optional_params must be an object".to_string(), + )); + } + None => Map::new(), + }; + Ok(PreparedAudioTranscriptionRequest { + audio, + optional_params, + ..request + }) + } + + async fn prepare_provider_request( + &self, + request: PreparedAudioTranscriptionRequest, + ) -> CoreResult { + let config = audio_transcription_provider_config(&request.custom_llm_provider) + .ok_or_else(|| CoreError::InvalidProvider(request.custom_llm_provider.clone()))?; + let env_lookup = super::handler::environment_lookup; + let headers = string_headers(request.extra_headers)?; + let url = config.complete_url( + request.api_base.as_deref(), + &request.model, + &request.optional_params, + &env_lookup, + )?; + let filtered_params = config.map_transcription_params(&request.optional_params); + let body = config.transform_transcription_request( + &request.model, + request.audio, + filtered_params, + )?; + let auth = config.auth_strategy(&request.model, &request.optional_params, &env_lookup)?; + let mut upstream_headers = headers.into_iter().collect::>(); + if matches!(auth, AudioTranscriptionAuth::Bearer) + && !has_header( + &upstream_headers + .iter() + .cloned() + .collect::>(), + "authorization", + ) + && let Some(api_key) = request.api_key.as_deref() + { + upstream_headers.push(("Authorization".to_string(), format!("Bearer {api_key}"))); + } + let provider_request = ProviderAudioTranscriptionRequest { + model: request.model, + config, + url, + body: body.body, + upstream_headers, + timeout: request.timeout, + }; + let provider_request = self.run_during_call_guardrails(provider_request).await?; + sign_request(&provider_request, &request.optional_params).await + } + + async fn run_during_call_guardrails( + &self, + request: ProviderAudioTranscriptionRequest, + ) -> CoreResult { + if self.guardrail_runner.is_empty() { + return Ok(request); + } + let (guardrail_request, _) = self + .guardrail_runner + .run_during_call( + &guardrail_context(&self.request_metadata), + GuardrailRequest::new(json!({ + "model": request.model, + "custom_llm_provider": "bedrock", + "url": request.url, + "body": request.body, + })), + ) + .await + .map_err(guardrail_error_to_core_error)?; + let Value::Object(mut data) = guardrail_request.data else { + return Err(CoreError::InvalidRequest( + "audio transcription during_call guardrail must return an object".to_string(), + )); + }; + let body = data.remove("body").ok_or_else(|| { + CoreError::InvalidRequest("audio transcription guardrail removed body".to_string()) + })?; + Ok(ProviderAudioTranscriptionRequest { body, ..request }) + } + + fn logging_payload( + &self, + context: &CallLifecycleContext, + timing: &CallLifecycleTiming, + ) -> StandardLoggingPayload { + StandardLoggingPayload { + id: context.litellm_call_id.clone(), + litellm_call_id: context.litellm_call_id.clone(), + call_type: context.call_type.clone(), + model: context.model.clone(), + custom_llm_provider: context.custom_llm_provider.clone(), + response_cost: 0.0, + prompt_tokens: 0, + completion_tokens: 0, + total_tokens: 0, + start_time: timing.start_time, + end_time: timing.end_time, + stream: false, + metadata: StandardLoggingMetadata { + user_api_key_hash: self.request_metadata.user_api_key_hash.clone(), + user_api_key_user_id: self.request_metadata.user_api_key_user_id.clone(), + user_api_key_team_id: self.request_metadata.user_api_key_team_id.clone(), + ..Default::default() + }, + messages: None, + } + } +} + +impl CallLifecycleHooks + for AudioTranscriptionLifecycleHooks +{ + type PreCallFuture<'a> = AudioFuture<'a, PreparedAudioTranscriptionRequest>; + type DuringCallFuture<'a> = AudioFuture<'a, ProviderAudioTranscriptionRequest>; + type SuccessFuture<'a> = AudioLogFuture<'a>; + type FailureFuture<'a> = AudioLogFuture<'a>; + + fn async_pre_call_hook<'a>( + &'a self, + _context: &'a CallLifecycleContext, + request: PreparedAudioTranscriptionRequest, + ) -> Self::PreCallFuture<'a> { + Box::pin(async move { self.run_pre_call_guardrails(request).await }) + } + + fn async_during_call_hook<'a>( + &'a self, + _context: &'a CallLifecycleContext, + request: PreparedAudioTranscriptionRequest, + ) -> Self::DuringCallFuture<'a> { + Box::pin(async move { self.prepare_provider_request(request).await }) + } + + fn async_log_success_event<'a>( + &'a self, + context: &'a CallLifecycleContext, + response: &'a Value, + timing: &'a CallLifecycleTiming, + ) -> Self::SuccessFuture<'a> { + Box::pin(async move { + if self.logger_runner.is_empty() { + return; + } + self.logger_runner + .async_log_success_event( + &ModelCallDetails::from_standard_logging_payload( + self.logging_payload(context, timing), + ), + &CallbackValue::new("audio_transcription", response.clone()), + CallbackTiming::new(timing.start_time, timing.end_time), + ) + .await; + }) + } + + fn async_log_failure_event<'a>( + &'a self, + context: &'a CallLifecycleContext, + error: &'a CoreError, + timing: &'a CallLifecycleTiming, + ) -> Self::FailureFuture<'a> { + Box::pin(async move { + if self.logger_runner.is_empty() { + return; + } + let logging_error = LoggingError { + message: error.to_string(), + kind: core_error_kind(error).to_string(), + }; + self.logger_runner + .async_log_failure_event( + &ModelCallDetails::from_standard_logging_payload( + self.logging_payload(context, timing), + ) + .with_failure_error(logging_error.clone()), + Some(&CallbackValue::new( + "error", + json!({"message": logging_error.message, "kind": logging_error.kind}), + )), + CallbackTiming::new(timing.start_time, timing.end_time), + ) + .await; + }) + } +} + +fn guardrail_context(metadata: &RequestMetadata) -> GuardrailContext { + GuardrailContext { + call_type: CallType::Other("audio_transcription".to_string()), + selected_guardrails: Vec::new(), + metadata: std::collections::HashMap::new(), + user_api_key_hash: metadata.user_api_key_hash.clone(), + user_api_key_user_id: metadata.user_api_key_user_id.clone(), + user_api_key_team_id: metadata.user_api_key_team_id.clone(), + trace_parent: None, + } +} + +fn guardrail_error_to_core_error(error: GuardrailError) -> CoreError { + CoreError::InvalidRequest(format!("{}: {}", error.kind, error.message)) +} + +fn core_error_kind(error: &CoreError) -> &'static str { + match error { + CoreError::Auth(_) => "AuthError", + CoreError::InvalidProvider(_) => "InvalidProvider", + CoreError::InvalidRequest(_) => "InvalidRequest", + CoreError::InvalidType { .. } => "InvalidType", + CoreError::MissingField(_) => "MissingField", + CoreError::Http { .. } => "HttpError", + CoreError::InvalidResponse(_) => "InvalidResponse", + CoreError::Network(_) => "NetworkError", + CoreError::Routing(_) => "RoutingError", + } +} diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/mod.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/mod.rs new file mode 100644 index 00000000000..5d33d912c40 --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/mod.rs @@ -0,0 +1,25 @@ +use litellm_core::CoreResult; +use litellm_core::call_lifecycle::CallLifecycle; +use serde_json::Value; + +mod common_utils; +mod handler; +mod hooks; +mod prepare; +mod types; + +pub use types::AudioTranscriptionRequest; + +use handler::execute_audio_transcription_provider_call; +use prepare::{PreparedAudioTranscriptionCall, prepare_audio_transcription_call}; + +pub async fn audio_transcription(request: AudioTranscriptionRequest<'_>) -> CoreResult { + let PreparedAudioTranscriptionCall { request, hooks } = + prepare_audio_transcription_call(request); + CallLifecycle::default() + .run_request(request, &hooks, execute_audio_transcription_provider_call) + .await +} + +#[cfg(test)] +mod tests; diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/prepare.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/prepare.rs new file mode 100644 index 00000000000..a475d58635f --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/prepare.rs @@ -0,0 +1,55 @@ +use std::sync::atomic::{AtomicU64, Ordering}; +use std::time::{SystemTime, UNIX_EPOCH}; + +use litellm_core::routing_utils::provider::{CustomLlmProvider, get_custom_llm_provider}; + +use super::hooks::AudioTranscriptionLifecycleHooks; +use super::types::{AudioTranscriptionRequest, PreparedAudioTranscriptionRequest}; +use crate::integrations::custom_guardrail::CustomGuardrailRunner; +use crate::integrations::custom_logger::CustomLoggerRunner; + +pub(crate) struct PreparedAudioTranscriptionCall { + pub(crate) request: PreparedAudioTranscriptionRequest, + pub(crate) hooks: AudioTranscriptionLifecycleHooks, +} + +pub(crate) fn prepare_audio_transcription_call( + request: AudioTranscriptionRequest<'_>, +) -> PreparedAudioTranscriptionCall { + let call_id = request + .litellm_call_id + .map(str::to_string) + .unwrap_or_else(new_audio_transcription_call_id); + let provider_info = get_custom_llm_provider(request.model, request.custom_llm_provider) + .unwrap_or(CustomLlmProvider { + model: request.model, + custom_llm_provider: "bedrock", + }); + PreparedAudioTranscriptionCall { + request: PreparedAudioTranscriptionRequest { + model: provider_info.model.to_string(), + custom_llm_provider: provider_info.custom_llm_provider.to_string(), + litellm_call_id: call_id, + audio: request.audio, + api_key: request.api_key.map(str::to_string), + api_base: request.api_base.map(str::to_string), + extra_headers: request.extra_headers, + optional_params: request.optional_params, + timeout: request.timeout, + }, + hooks: AudioTranscriptionLifecycleHooks::new( + CustomLoggerRunner::new(request.callbacks), + CustomGuardrailRunner::new(request.guardrails), + request.request_metadata, + ), + } +} + +fn new_audio_transcription_call_id() -> String { + static COUNTER: AtomicU64 = AtomicU64::new(1); + let sequence = COUNTER.fetch_add(1, Ordering::Relaxed); + let timestamp = SystemTime::now() + .duration_since(UNIX_EPOCH) + .map_or(0, |duration| duration.as_nanos()); + format!("audio-transcription-{timestamp}-{sequence}") +} diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/tests.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/tests.rs new file mode 100644 index 00000000000..5df04708b7d --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/tests.rs @@ -0,0 +1,53 @@ +use std::io::{Read, Write}; +use std::net::TcpListener; +use std::thread; + +use serde_json::{Map, json}; + +use super::{AudioTranscriptionRequest, audio_transcription}; + +#[tokio::test] +async fn bedrock_request_is_signed_and_contains_audio() { + let listener = TcpListener::bind("127.0.0.1:0").expect("listener"); + let address = listener.local_addr().expect("address"); + let server = thread::spawn(move || { + let (mut stream, _) = listener.accept().expect("connection"); + let mut request = Vec::new(); + let mut buffer = [0_u8; 16_384]; + let count = stream.read(&mut buffer).expect("request"); + request.extend_from_slice(&buffer[..count]); + let request = String::from_utf8_lossy(&request); + assert!(request.contains("POST /model/mistral.voxtral-mini-3b-2507/converse")); + assert!(request.contains("authorization: AWS4-HMAC-SHA256")); + assert!(request.contains("x-amz-date:")); + assert!(request.contains("\"bytes\":\"AQI=\"")); + assert!(request.contains("Transcribe the audio. Respond with only the transcript.")); + let response = b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 53\r\nConnection: close\r\n\r\n{\"output\":{\"message\":{\"content\":[{\"text\":\"hello\"}]}}}"; + stream.write_all(response).expect("response"); + }); + + let optional_params = Map::from_iter([ + ("aws_access_key_id".to_string(), json!("access-key")), + ("aws_secret_access_key".to_string(), json!("secret-key")), + ("aws_region_name".to_string(), json!("us-east-1")), + ]); + let api_base = format!("http://{address}"); + let response = audio_transcription(AudioTranscriptionRequest { + model: "mistral.voxtral-mini-3b-2507", + audio: json!({"data": "AQI=", "format": "wav", "filename": "audio.wav"}), + api_key: None, + api_base: Some(&api_base), + custom_llm_provider: Some("bedrock"), + extra_headers: None, + optional_params, + timeout: None, + callbacks: Vec::new(), + guardrails: Vec::new(), + request_metadata: Default::default(), + litellm_call_id: None, + }) + .await + .expect("transcription"); + assert_eq!(response, json!({"text": "hello"})); + server.join().expect("server"); +} diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/types.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/types.rs new file mode 100644 index 00000000000..9697aa98b0a --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/types.rs @@ -0,0 +1,58 @@ +use std::sync::Arc; +use std::time::Duration; + +use litellm_core::audio_transcription::transformation::AudioTranscriptionProviderConfig; +use litellm_core::call_lifecycle::{CallLifecycleContext, CallLifecycleRequest}; +use serde_json::{Map, Value}; + +use crate::integrations::custom_guardrail::CustomGuardrail; +use crate::integrations::custom_logger::CustomLogger; +use crate::integrations::types::RequestMetadata; + +pub struct AudioTranscriptionRequest<'a> { + pub model: &'a str, + pub audio: Value, + pub api_key: Option<&'a str>, + pub api_base: Option<&'a str>, + pub custom_llm_provider: Option<&'a str>, + pub extra_headers: Option>, + pub optional_params: Map, + pub timeout: Option, + pub callbacks: Vec>, + pub guardrails: Vec>, + pub request_metadata: RequestMetadata, + pub litellm_call_id: Option<&'a str>, +} + +pub(crate) struct PreparedAudioTranscriptionRequest { + pub(crate) model: String, + pub(crate) custom_llm_provider: String, + pub(crate) litellm_call_id: String, + pub(crate) audio: Value, + pub(crate) api_key: Option, + pub(crate) api_base: Option, + pub(crate) extra_headers: Option>, + pub(crate) optional_params: Map, + pub(crate) timeout: Option, +} + +impl CallLifecycleRequest for PreparedAudioTranscriptionRequest { + fn lifecycle_context(&self) -> CallLifecycleContext { + CallLifecycleContext::new( + "audio_transcription", + self.model.clone(), + self.custom_llm_provider.clone(), + self.litellm_call_id.clone(), + ) + } +} + +#[derive(Clone)] +pub(crate) struct ProviderAudioTranscriptionRequest { + pub(crate) model: String, + pub(crate) config: &'static dyn AudioTranscriptionProviderConfig, + pub(crate) url: String, + pub(crate) body: Value, + pub(crate) upstream_headers: Vec<(String, String)>, + pub(crate) timeout: Option, +} diff --git a/litellm-rust/crates/ai-gateway/src/auth/mod.rs b/litellm-rust/crates/ai-gateway/src/auth/mod.rs index 438a0513057..b09d8285c3a 100644 --- a/litellm-rust/crates/ai-gateway/src/auth/mod.rs +++ b/litellm-rust/crates/ai-gateway/src/auth/mod.rs @@ -9,9 +9,9 @@ //! runs during extraction, before the handler body. Routes never re-implement it. use axum::extract::FromRequestParts; +use axum::http::StatusCode; use axum::http::header::AUTHORIZATION; use axum::http::request::Parts; -use axum::http::StatusCode; use sha2::{Digest, Sha256}; use subtle::ConstantTimeEq; diff --git a/litellm-rust/crates/ai-gateway/src/ocr/client.rs b/litellm-rust/crates/ai-gateway/src/client.rs similarity index 60% rename from litellm-rust/crates/ai-gateway/src/ocr/client.rs rename to litellm-rust/crates/ai-gateway/src/client.rs index 79cc7816227..ff2606f0229 100644 --- a/litellm-rust/crates/ai-gateway/src/ocr/client.rs +++ b/litellm-rust/crates/ai-gateway/src/client.rs @@ -1,13 +1,13 @@ use std::sync::OnceLock; use std::time::Duration; -const OCR_TIMEOUT_SECS: u64 = 600; +const HTTP_CLIENT_TIMEOUT_SECS: u64 = 600; -pub(super) fn http_client() -> &'static reqwest::Client { +pub(crate) fn http_client() -> &'static reqwest::Client { static CLIENT: OnceLock = OnceLock::new(); CLIENT.get_or_init(|| { reqwest::Client::builder() - .timeout(Duration::from_secs(OCR_TIMEOUT_SECS)) + .timeout(Duration::from_secs(HTTP_CLIENT_TIMEOUT_SECS)) .build() .expect("failed to build reqwest client") }) diff --git a/litellm-rust/crates/ai-gateway/src/constants.rs b/litellm-rust/crates/ai-gateway/src/constants.rs index 109b648f5db..78af374bf70 100644 --- a/litellm-rust/crates/ai-gateway/src/constants.rs +++ b/litellm-rust/crates/ai-gateway/src/constants.rs @@ -28,3 +28,15 @@ pub(crate) const DEFAULT_FLUSH_INTERVAL_MS: u64 = 500; /// Provider attributed to realtime sessions in the logging payload. #[cfg(feature = "server")] pub(crate) const DEFAULT_PROVIDER: &str = "openai"; + +pub(crate) const DEFAULT_RESPONSES_WS_CONNECT_TIMEOUT_SECS: u64 = 10; +pub(crate) const DEFAULT_RESPONSES_WS_IDLE_TIMEOUT_SECS: u64 = 300; + +/// HTTP path for the non-streaming Anthropic Messages route. +#[cfg(feature = "server")] +pub(crate) const MESSAGES_ROUTE_PATH: &str = "/v1/messages"; + +/// Request headers owned by the gateway and never forwarded upstream. +#[cfg(feature = "server")] +pub(crate) const MESSAGES_HEADERS_NOT_FORWARDED: &[&str] = + &["authorization", "connection", "content-length", "host"]; diff --git a/litellm-rust/crates/ai-gateway/src/io/audio_transcription.rs b/litellm-rust/crates/ai-gateway/src/io/audio_transcription.rs new file mode 100644 index 00000000000..80d9e401a5f --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/io/audio_transcription.rs @@ -0,0 +1 @@ +pub use crate::audio_transcription::{AudioTranscriptionRequest, audio_transcription}; diff --git a/litellm-rust/crates/ai-gateway/src/io/mod.rs b/litellm-rust/crates/ai-gateway/src/io/mod.rs index 3b566027646..cce56dd2121 100644 --- a/litellm-rust/crates/ai-gateway/src/io/mod.rs +++ b/litellm-rust/crates/ai-gateway/src/io/mod.rs @@ -1,3 +1,5 @@ +pub mod audio_transcription; pub mod ocr; pub mod realtime; pub mod realtime_pool; +pub mod responses_ws; diff --git a/litellm-rust/crates/ai-gateway/src/io/ocr.rs b/litellm-rust/crates/ai-gateway/src/io/ocr.rs index 55e02839c4e..2fc82f0b61f 100644 --- a/litellm-rust/crates/ai-gateway/src/io/ocr.rs +++ b/litellm-rust/crates/ai-gateway/src/io/ocr.rs @@ -1 +1 @@ -pub use crate::ocr::{ocr, OcrRequest}; +pub use crate::ocr::{OcrRequest, ocr}; diff --git a/litellm-rust/crates/ai-gateway/src/io/realtime.rs b/litellm-rust/crates/ai-gateway/src/io/realtime.rs index 40a38c1579a..845e7bf9527 100644 --- a/litellm-rust/crates/ai-gateway/src/io/realtime.rs +++ b/litellm-rust/crates/ai-gateway/src/io/realtime.rs @@ -15,16 +15,16 @@ use std::time::Duration; use futures_util::stream::{SplitSink, SplitStream}; use futures_util::{Sink, SinkExt, Stream, StreamExt}; +use litellm_core::CoreResult; use litellm_core::error::CoreError; use litellm_core::realtime::transformation::RealtimeProviderConfig; use litellm_core::realtime::types::RealtimeEvent; -use litellm_core::CoreResult; use tokio::net::TcpStream; -use tokio_tungstenite::tungstenite::client::IntoClientRequest; -use tokio_tungstenite::tungstenite::http::header::AUTHORIZATION; -use tokio_tungstenite::tungstenite::http::HeaderValue; use tokio_tungstenite::tungstenite::Message; -use tokio_tungstenite::{connect_async, MaybeTlsStream, WebSocketStream}; +use tokio_tungstenite::tungstenite::client::IntoClientRequest; +use tokio_tungstenite::tungstenite::http::HeaderValue; +use tokio_tungstenite::tungstenite::http::header::AUTHORIZATION; +use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async}; use litellm_core::providers::openai::realtime::transformation::OPENAI_REALTIME_CONFIG; @@ -113,7 +113,7 @@ pub(crate) async fn read_event(upstream_rx: &mut UpstreamRx) -> CoreResult { return Err(CoreError::Network( "upstream closed before first event".to_string(), - )) + )); } _ => continue, } diff --git a/litellm-rust/crates/ai-gateway/src/io/realtime_pool.rs b/litellm-rust/crates/ai-gateway/src/io/realtime_pool.rs index bf8041f31d7..4a1a3cd1166 100644 --- a/litellm-rust/crates/ai-gateway/src/io/realtime_pool.rs +++ b/litellm-rust/crates/ai-gateway/src/io/realtime_pool.rs @@ -28,11 +28,11 @@ use std::sync::{Arc, Mutex}; use std::time::{Duration, Instant}; use futures_util::StreamExt; -use litellm_core::realtime::types::RealtimeEvent; use litellm_core::CoreResult; +use litellm_core::realtime::types::RealtimeEvent; use crate::io::realtime::{ - dial_upstream, read_event, resolve_api_key, UpstreamRx, UpstreamTx, UpstreamWs, + UpstreamRx, UpstreamTx, UpstreamWs, dial_upstream, read_event, resolve_api_key, }; /// Default target warm sockets per key when pooling is enabled. @@ -473,8 +473,8 @@ pub fn upstream_key( /// unhealthy — we'd rather discard and fresh-dial than hand over a socket in an /// unexpected state. `Pending` (the healthy case) returns `false`. fn is_dead(rx: &mut UpstreamRx) -> bool { - use futures_util::task::noop_waker_ref; use futures_util::Stream; + use futures_util::task::noop_waker_ref; use std::pin::Pin; use std::task::{Context, Poll}; @@ -523,15 +523,15 @@ mod tests { )) .await; while let Some(Ok(msg)) = ws.next().await { - if let Message::Text(text) = msg { - if text.contains("response.create") { - for frame in [ - r#"{"type":"response.created"}"#, - r#"{"type":"response.output_audio.delta","delta":"AAAA"}"#, - r#"{"type":"response.done"}"#, - ] { - let _ = ws.send(Message::Text(frame.to_string())).await; - } + if let Message::Text(text) = msg + && text.contains("response.create") + { + for frame in [ + r#"{"type":"response.created"}"#, + r#"{"type":"response.output_audio.delta","delta":"AAAA"}"#, + r#"{"type":"response.done"}"#, + ] { + let _ = ws.send(Message::Text(frame.to_string())).await; } } } diff --git a/litellm-rust/crates/ai-gateway/src/io/responses_ws.rs b/litellm-rust/crates/ai-gateway/src/io/responses_ws.rs new file mode 100644 index 00000000000..9b51019f4bc --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/io/responses_ws.rs @@ -0,0 +1,549 @@ +use std::collections::HashMap; +use std::sync::Arc; +use std::time::Duration; + +use futures_util::stream::{SplitSink, SplitStream}; +use futures_util::{Sink, SinkExt, Stream, StreamExt}; +use litellm_core::providers::openai::responses::transformation::OPENAI_RESPONSES_WS_CONFIG; +use litellm_core::responses::types::ResponsesWsEvent; +use litellm_core::responses::websocket::ResponsesWebSocketProviderConfig; +use litellm_core::{CoreError, CoreResult}; +use tokio::net::TcpStream; +use tokio::sync::Mutex; +use tokio_tungstenite::tungstenite::Message; +use tokio_tungstenite::tungstenite::client::IntoClientRequest; +use tokio_tungstenite::tungstenite::http::HeaderValue; +use tokio_tungstenite::tungstenite::http::header::{AUTHORIZATION, HeaderName}; +use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async}; + +use crate::constants::{ + DEFAULT_RESPONSES_WS_CONNECT_TIMEOUT_SECS, DEFAULT_RESPONSES_WS_IDLE_TIMEOUT_SECS, +}; + +const OPENAI_API_KEY_ENV: &str = "OPENAI_API_KEY"; +const MISSING_KEY_MESSAGE: &str = "Missing OpenAI API Key - a Responses WebSocket call is being made but no key was passed via params or the OPENAI_API_KEY environment variable"; + +pub type ResponsesUpstreamWs = WebSocketStream>; +type UpstreamTx = SplitSink; +type UpstreamRx = SplitStream; + +#[derive(Clone)] +pub struct ResponsesWebSocketConnection { + socket: Arc>>, +} + +impl ResponsesWebSocketConnection { + pub async fn connect_url( + url: &str, + headers: &HashMap, + timeout: Option, + ) -> CoreResult { + let mut request = url + .into_client_request() + .map_err(|error| CoreError::Network(error.to_string()))?; + for (name, value) in headers { + let header_name = name + .parse::() + .map_err(|error| CoreError::InvalidRequest(error.to_string()))?; + let header_value = HeaderValue::from_str(value) + .map_err(|error| CoreError::InvalidRequest(error.to_string()))?; + request.headers_mut().insert(header_name, header_value); + } + let connect = connect_async(request); + let result = match timeout { + Some(timeout) => tokio::time::timeout(timeout, connect).await.map_err(|_| { + CoreError::Network("Responses WebSocket connection timed out".to_string()) + })?, + None => connect.await, + }; + let (socket, _) = result.map_err(|error| match error { + tokio_tungstenite::tungstenite::Error::Http(response) => CoreError::Http { + status: response.status().as_u16(), + body: String::new(), + }, + other => CoreError::Network(other.to_string()), + })?; + Ok(Self { + socket: Arc::new(Mutex::new(Some(socket))), + }) + } + + pub async fn send_text(&self, text: String) -> CoreResult<()> { + let mut socket = self.socket.lock().await; + let Some(socket) = socket.as_mut() else { + return Err(CoreError::Network( + "Responses WebSocket is closed".to_string(), + )); + }; + socket + .send(Message::Text(text)) + .await + .map_err(|error| CoreError::Network(error.to_string())) + } + + pub async fn recv_text(&self) -> CoreResult> { + let mut socket_guard = self.socket.lock().await; + let Some(socket) = socket_guard.as_mut() else { + return Ok(None); + }; + match socket.next().await { + Some(Ok(Message::Text(text))) => Ok(Some(text)), + Some(Ok(Message::Binary(bytes))) => String::from_utf8(bytes.to_vec()) + .map(Some) + .map_err(|error| CoreError::InvalidResponse(error.to_string())), + Some(Ok(Message::Close(_))) | None => Ok(None), + Some(Ok(_)) => Ok(None), + Some(Err(error)) => Err(CoreError::Network(error.to_string())), + } + } + + pub async fn close(&self) -> CoreResult<()> { + let mut socket = self.socket.lock().await; + if let Some(socket) = socket.as_mut() { + socket + .close(None) + .await + .map_err(|error| CoreError::Network(error.to_string()))?; + } + *socket = None; + Ok(()) + } +} + +pub(crate) fn resolve_api_key(api_key: Option<&str>) -> CoreResult { + api_key + .map(str::trim) + .filter(|value| !value.is_empty()) + .map(str::to_string) + .or_else(|| { + std::env::var(OPENAI_API_KEY_ENV) + .ok() + .filter(|value| !value.trim().is_empty()) + }) + .ok_or_else(|| CoreError::Auth(MISSING_KEY_MESSAGE.to_string())) +} + +async fn dial_upstream( + model: &str, + api_key: &str, + api_base: Option<&str>, +) -> CoreResult { + let url = OPENAI_RESPONSES_WS_CONFIG.complete_websocket_url(api_base, model); + let mut request = url + .as_str() + .into_client_request() + .map_err(|error| CoreError::Network(error.to_string()))?; + request.headers_mut().insert( + AUTHORIZATION, + HeaderValue::from_str(&format!("Bearer {api_key}")) + .map_err(|error| CoreError::Auth(error.to_string()))?, + ); + let result = tokio::time::timeout( + Duration::from_secs(DEFAULT_RESPONSES_WS_CONNECT_TIMEOUT_SECS), + connect_async(request), + ) + .await + .map_err(|_| CoreError::Network("Responses WebSocket connection timed out".to_string()))?; + result + .map(|(socket, _)| socket) + .map_err(|error| match error { + tokio_tungstenite::tungstenite::Error::Http(response) => CoreError::Http { + status: response.status().as_u16(), + body: String::new(), + }, + other => CoreError::Network(other.to_string()), + }) +} + +pub struct ResponsesWebSocketStreaming; + +impl ResponsesWebSocketStreaming { + pub async fn bidirectional_forward( + model: &str, + upstream_tx: UpstreamTx, + upstream_rx: UpstreamRx, + idle_timeout: Option, + observe: impl FnMut(&ResponsesWsEvent) + Send, + client_in: In, + client_out: Out, + ) -> CoreResult<()> + where + In: Stream + Unpin + Send, + Out: Sink + Unpin + Send, + Out::Error: std::fmt::Display, + { + splice( + model, + upstream_tx, + upstream_rx, + idle_timeout, + observe, + client_in, + client_out, + ) + .await + } +} + +pub(crate) async fn splice( + model: &str, + mut upstream_tx: UpstreamTx, + mut upstream_rx: UpstreamRx, + idle_timeout: Option, + mut observe: impl FnMut(&ResponsesWsEvent) + Send, + mut client_in: In, + mut client_out: Out, +) -> CoreResult<()> +where + In: Stream + Unpin + Send, + Out: Sink + Unpin + Send, + Out::Error: std::fmt::Display, +{ + let idle = + idle_timeout.unwrap_or_else(|| Duration::from_secs(DEFAULT_RESPONSES_WS_IDLE_TIMEOUT_SECS)); + loop { + tokio::select! { + event = client_in.next() => { + let Some(event) = event else { break }; + for outbound in OPENAI_RESPONSES_WS_CONFIG + .transform_ws_request(&event, model)? + .events + { + let payload = serde_json::to_string(&outbound) + .map_err(|error| CoreError::InvalidResponse(error.to_string()))?; + upstream_tx.send(Message::Text(payload)) + .await + .map_err(|error| CoreError::Network(error.to_string()))?; + } + } + message = upstream_rx.next() => { + let Some(message) = message else { break }; + match message.map_err(|error| CoreError::Network(error.to_string()))? { + Message::Text(text) => { + let event = serde_json::from_str::(&text) + .map_err(|error| CoreError::InvalidResponse(error.to_string()))?; + observe(&event); + for outbound in OPENAI_RESPONSES_WS_CONFIG + .transform_ws_response(&event, model)? + .events + { + client_out.send(outbound) + .await + .map_err(|error| CoreError::Network(error.to_string()))?; + } + } + Message::Close(_) => break, + _ => {} + } + } + _ = tokio::time::sleep(idle) => break, + } + } + Ok(()) +} + +#[allow(clippy::too_many_arguments)] +pub async fn async_responses_websocket( + model: &str, + api_key: Option<&str>, + api_base: Option<&str>, + first_frame: Option, + idle_timeout: Option, + mut observe: impl FnMut(&ResponsesWsEvent) + Send, + client_in: In, + client_out: Out, +) -> CoreResult<()> +where + In: Stream + Unpin + Send, + Out: Sink + Unpin + Send, + Out::Error: std::fmt::Display, +{ + let key = resolve_api_key(api_key)?; + let upstream = dial_upstream(model, &key, api_base).await?; + let (mut upstream_tx, upstream_rx) = upstream.split(); + if let Some(first_frame) = first_frame { + for outbound in OPENAI_RESPONSES_WS_CONFIG + .transform_ws_request(&first_frame, model)? + .events + { + let payload = serde_json::to_string(&outbound) + .map_err(|error| CoreError::InvalidResponse(error.to_string()))?; + upstream_tx + .send(Message::Text(payload)) + .await + .map_err(|error| CoreError::Network(error.to_string()))?; + } + } + ResponsesWebSocketStreaming::bidirectional_forward( + model, + upstream_tx, + upstream_rx, + idle_timeout, + &mut observe, + client_in, + client_out, + ) + .await +} + +#[allow(clippy::too_many_arguments)] +pub async fn responses_ws( + model: &str, + api_key: Option<&str>, + api_base: Option<&str>, + first_frame: Option, + idle_timeout: Option, + observe: impl FnMut(&ResponsesWsEvent) + Send, + client_in: In, + client_out: Out, +) -> CoreResult<()> +where + In: Stream + Unpin + Send, + Out: Sink + Unpin + Send, + Out::Error: std::fmt::Display, +{ + async_responses_websocket( + model, + api_key, + api_base, + first_frame, + idle_timeout, + observe, + client_in, + client_out, + ) + .await +} + +#[cfg(test)] +mod tests { + use super::*; + use futures_channel::mpsc; + use futures_util::{SinkExt, StreamExt}; + use litellm_core::responses::types::ResponsesWsEventType; + use serde_json::json; + use tokio::io::AsyncWriteExt; + use tokio::net::TcpListener; + use tokio_tungstenite::accept_async; + + async fn websocket_base() -> (String, tokio::task::JoinHandle<()>) { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind"); + let address = listener.local_addr().expect("local address"); + let task = tokio::spawn(async move { + let (stream, _) = listener.accept().await.expect("accept"); + let mut socket = accept_async(stream).await.expect("websocket handshake"); + while let Some(Ok(Message::Text(text))) = socket.next().await { + let request: serde_json::Value = serde_json::from_str(&text).expect("request json"); + let model = request + .get("model") + .and_then(serde_json::Value::as_str) + .or_else(|| { + request + .get("response") + .and_then(serde_json::Value::as_object) + .and_then(|response| { + response.get("model").and_then(serde_json::Value::as_str) + }) + }) + .expect("enforced model"); + socket + .send(Message::Text( + json!({ + "type": "response.created", + "response": { + "id": format!("resp-{model}"), + "model": model, + "extra": "preserved" + } + }) + .to_string(), + )) + .await + .expect("created event"); + socket + .send(Message::Text( + json!({ + "type": "response.completed", + "response": { + "id": format!("resp-{model}"), + "model": model, + "usage": { + "input_tokens": 1, + "output_tokens": 2, + "total_tokens": 3 + } + } + }) + .to_string(), + )) + .await + .expect("completed event"); + } + }); + (format!("http://{address}"), task) + } + + fn event(value: serde_json::Value) -> ResponsesWsEvent { + serde_json::from_value(value).expect("event") + } + + #[test] + fn explicit_nonblank_key_wins() { + assert_eq!( + resolve_api_key(Some(" explicit ")).expect("key"), + "explicit" + ); + } + + #[test] + fn blank_key_is_not_accepted_without_environment_key() { + if std::env::var(OPENAI_API_KEY_ENV).is_err() { + assert!(resolve_api_key(Some(" ")).is_err()); + } + } + + #[tokio::test] + async fn forwards_events_sequentially_and_enforces_model() { + let (api_base, server) = websocket_base().await; + let (client_tx, client_rx) = mpsc::unbounded(); + let (output_tx, mut output_rx) = mpsc::unbounded(); + let (observed_tx, observed_rx) = mpsc::unbounded(); + client_tx + .unbounded_send(event(json!({ + "type": "response.create", + "model": "wrong" + }))) + .expect("first request"); + client_tx + .unbounded_send(event(json!({ + "type": "response.create", + "response": {"model": "also-wrong"} + }))) + .expect("second request"); + + let task = tokio::spawn(async move { + responses_ws( + "authorized-model", + Some("test-key"), + Some(&api_base), + None, + Some(Duration::from_secs(1)), + move |event| { + observed_tx + .unbounded_send(event.clone()) + .expect("observe event"); + }, + client_rx, + output_tx, + ) + .await + }); + + let first = output_rx.next().await.expect("first output"); + let second = output_rx.next().await.expect("second output"); + let third = output_rx.next().await.expect("third output"); + let fourth = output_rx.next().await.expect("fourth output"); + drop(client_tx); + task.await.expect("splice task").expect("successful splice"); + server.await.expect("server task"); + + assert_eq!(first.event_type, ResponsesWsEventType::ResponseCreated); + assert_eq!(first.model(), Some("authorized-model")); + assert_eq!(first.data["response"]["extra"], "preserved"); + assert_eq!(second.event_type, ResponsesWsEventType::ResponseCompleted); + assert_eq!(third.event_type, ResponsesWsEventType::ResponseCreated); + assert_eq!(fourth.event_type, ResponsesWsEventType::ResponseCompleted); + let observed: Vec<_> = observed_rx.collect().await; + assert_eq!(observed.len(), 4); + assert!( + observed + .iter() + .all(|event| event.event_type != ResponsesWsEventType::ResponseCreate) + ); + } + + #[tokio::test] + async fn idle_timeout_ends_without_upstream_events() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind"); + let address = listener.local_addr().expect("address"); + let server = tokio::spawn(async move { + let (stream, _) = listener.accept().await.expect("accept"); + let _socket = accept_async(stream).await.expect("handshake"); + tokio::time::sleep(Duration::from_secs(1)).await; + }); + let (_client_tx, client_rx) = mpsc::unbounded::(); + let (output_tx, mut output_rx) = mpsc::unbounded(); + let result = responses_ws( + "model", + Some("key"), + Some(&format!("http://{address}")), + None, + Some(Duration::from_millis(20)), + |_| {}, + client_rx, + output_tx, + ) + .await; + assert!(result.is_ok()); + assert!(output_rx.next().await.is_none()); + server.abort(); + } + + #[tokio::test] + async fn dial_http_status_is_preserved() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind"); + let address = listener.local_addr().expect("address"); + let server = tokio::spawn(async move { + let (mut stream, _) = listener.accept().await.expect("accept"); + stream + .write_all(b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\n\r\n") + .await + .expect("response"); + }); + let (_client_tx, client_rx) = mpsc::unbounded::(); + let (output_tx, _output_rx) = mpsc::unbounded(); + let error = responses_ws( + "model", + Some("key"), + Some(&format!("http://{address}")), + None, + Some(Duration::from_millis(20)), + |_| {}, + client_rx, + output_tx, + ) + .await + .expect_err("status error"); + assert!(matches!(error, CoreError::Http { status: 401, .. })); + server.await.expect("server task"); + } + + #[tokio::test] + async fn dial_http_500_status_is_preserved() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind"); + let address = listener.local_addr().expect("address"); + let server = tokio::spawn(async move { + let (mut stream, _) = listener.accept().await.expect("accept"); + stream + .write_all(b"HTTP/1.1 500 Internal Server Error\r\nContent-Length: 0\r\n\r\n") + .await + .expect("response"); + }); + let (_client_tx, client_rx) = mpsc::unbounded::(); + let (output_tx, _output_rx) = mpsc::unbounded(); + let error = responses_ws( + "model", + Some("key"), + Some(&format!("http://{address}")), + None, + Some(Duration::from_millis(20)), + |_| {}, + client_rx, + output_tx, + ) + .await + .expect_err("status error"); + assert!(matches!(error, CoreError::Http { status: 500, .. })); + server.await.expect("server task"); + } +} diff --git a/litellm-rust/crates/ai-gateway/src/lib.rs b/litellm-rust/crates/ai-gateway/src/lib.rs index d8ef7bb5ba1..057db6457c4 100644 --- a/litellm-rust/crates/ai-gateway/src/lib.rs +++ b/litellm-rust/crates/ai-gateway/src/lib.rs @@ -4,13 +4,17 @@ //! without pulling in the HTTP server: //! //! - Call-type modules such as [`ocr`]: provider transforms, lifecycle hooks, -//! and provider I/O. Always available — no feature required. +//! and provider I/O. Always available — no feature required. These predate the +//! rule that a route's entrypoint and handler live in `litellm-core` (see +//! `litellm_core::messages`) and move there as they are touched. //! - [`io`]: compatibility exports and realtime WebSocket splice helpers. //! - The server modules ([`auth`], [`routes`], [`state`]) and anything pulling //! `axum` are gated behind the `server` feature, which the `litellm-ai-gateway` //! binary turns on. The `python-config` feature additionally pulls in [`python`] //! for the load-time config reader. +pub mod audio_transcription; +mod client; pub mod io; pub mod ocr; @@ -25,9 +29,6 @@ pub mod routes; #[cfg(feature = "server")] pub mod state; -// Realtime request logging. Only the server serves realtime, so these are -// `server`-gated; `io::realtime` exposes the generic `observe` hook while the -// collector and callback fan-out live here. mod constants; pub mod integrations; #[cfg(feature = "server")] diff --git a/litellm-rust/crates/ai-gateway/src/main.rs b/litellm-rust/crates/ai-gateway/src/main.rs index f9ce97801d3..da3a486d4ee 100644 --- a/litellm-rust/crates/ai-gateway/src/main.rs +++ b/litellm-rust/crates/ai-gateway/src/main.rs @@ -11,7 +11,7 @@ use std::sync::Arc; -use litellm_ai_gateway::io::realtime_pool::{upstream_key, PoolConfig, RealtimePool}; +use litellm_ai_gateway::io::realtime_pool::{PoolConfig, RealtimePool, upstream_key}; use litellm_ai_gateway::routes; use litellm_ai_gateway::state::AppState; use litellm_core::router::{Deployment, LiteLLMParams, Router}; diff --git a/litellm-rust/crates/ai-gateway/src/ocr/common_utils.rs b/litellm-rust/crates/ai-gateway/src/ocr/common_utils.rs index d4b4d9338e7..9bc2818b6e7 100644 --- a/litellm-rust/crates/ai-gateway/src/ocr/common_utils.rs +++ b/litellm-rust/crates/ai-gateway/src/ocr/common_utils.rs @@ -1,11 +1,11 @@ use std::net::IpAddr; use std::time::{Duration, Instant}; -use base64::engine::general_purpose::STANDARD as BASE64_STANDARD; use base64::Engine; +use base64::engine::general_purpose::STANDARD as BASE64_STANDARD; +use litellm_core::CoreResult; use litellm_core::error::CoreError; use litellm_core::ocr::transformation::OcrProviderConfig; -use litellm_core::CoreResult; use reqwest::Url; use serde_json::{Map, Value}; @@ -18,7 +18,7 @@ use litellm_core::providers::vertex_ai::ocr::transformation::{ VERTEX_AI_DEEPSEEK_OCR_CONFIG, VERTEX_AI_OCR_CONFIG, }; -use super::client::http_client; +use crate::client::http_client; const ERROR_BODY_MAX_CHARS: usize = 256; const AZURE_DOCUMENT_INTELLIGENCE_POLL_TIMEOUT_SECS: u64 = 120; diff --git a/litellm-rust/crates/ai-gateway/src/ocr/handler.rs b/litellm-rust/crates/ai-gateway/src/ocr/handler.rs index 4d93c2a25db..1de34eb400e 100644 --- a/litellm-rust/crates/ai-gateway/src/ocr/handler.rs +++ b/litellm-rust/crates/ai-gateway/src/ocr/handler.rs @@ -1,11 +1,11 @@ +use litellm_core::CoreResult; use litellm_core::error::CoreError; use litellm_core::ocr::transformation::OcrResponseHandling; -use litellm_core::CoreResult; use serde_json::Value; -use super::client::http_client; use super::common_utils::{poll_document_intelligence, truncate_error_body}; use super::types::ProviderOcrRequest; +use crate::client::http_client; pub(crate) async fn execute_ocr_provider_call(request: ProviderOcrRequest) -> CoreResult { let mut request_builder = http_client().post(&request.url).json(&request.body); diff --git a/litellm-rust/crates/ai-gateway/src/ocr/hooks.rs b/litellm-rust/crates/ai-gateway/src/ocr/hooks.rs index 6be74ed2714..ffe2e0122c0 100644 --- a/litellm-rust/crates/ai-gateway/src/ocr/hooks.rs +++ b/litellm-rust/crates/ai-gateway/src/ocr/hooks.rs @@ -1,11 +1,11 @@ use std::future::Future; use std::pin::Pin; +use litellm_core::CoreResult; use litellm_core::call_lifecycle::{CallLifecycleContext, CallLifecycleHooks, CallLifecycleTiming}; use litellm_core::error::CoreError; use litellm_core::ocr::transformation::OcrAuthStrategy; -use litellm_core::CoreResult; -use serde_json::{json, Map, Value}; +use serde_json::{Map, Value, json}; use super::common_utils::{ convert_document_url_to_data_uri, has_header, ocr_provider_config, string_headers, @@ -292,7 +292,7 @@ fn parse_ocr_pre_call_guardrail_request( Some(_) => { return Err(CoreError::InvalidRequest( "OCR pre_call guardrail optional_params must be an object".to_string(), - )) + )); } None => Map::new(), }; diff --git a/litellm-rust/crates/ai-gateway/src/ocr/mod.rs b/litellm-rust/crates/ai-gateway/src/ocr/mod.rs index b54ee39b21d..c4c13e2300c 100644 --- a/litellm-rust/crates/ai-gateway/src/ocr/mod.rs +++ b/litellm-rust/crates/ai-gateway/src/ocr/mod.rs @@ -1,8 +1,7 @@ -use litellm_core::call_lifecycle::CallLifecycle; use litellm_core::CoreResult; +use litellm_core::call_lifecycle::CallLifecycle; use serde_json::Value; -mod client; mod common_utils; mod handler; mod hooks; @@ -12,7 +11,7 @@ mod types; pub use types::OcrRequest; use handler::execute_ocr_provider_call; -use prepare::{prepare_ocr_call, PreparedOcrCall}; +use prepare::{PreparedOcrCall, prepare_ocr_call}; pub async fn ocr(request: OcrRequest<'_>) -> CoreResult { let PreparedOcrCall { request, hooks } = prepare_ocr_call(request); diff --git a/litellm-rust/crates/ai-gateway/src/ocr/prepare.rs b/litellm-rust/crates/ai-gateway/src/ocr/prepare.rs index 5a4b350a4c4..6231393c889 100644 --- a/litellm-rust/crates/ai-gateway/src/ocr/prepare.rs +++ b/litellm-rust/crates/ai-gateway/src/ocr/prepare.rs @@ -1,7 +1,7 @@ use std::sync::atomic::{AtomicU64, Ordering}; use std::time::{SystemTime, UNIX_EPOCH}; -use litellm_core::routing_utils::provider::{get_custom_llm_provider, CustomLlmProvider}; +use litellm_core::routing_utils::provider::{CustomLlmProvider, get_custom_llm_provider}; use super::hooks::OcrLifecycleHooks; use super::types::{OcrRequest, PreparedOcrRequest}; diff --git a/litellm-rust/crates/ai-gateway/src/ocr/tests.rs b/litellm-rust/crates/ai-gateway/src/ocr/tests.rs index 35747dc6985..bb2a6b06501 100644 --- a/litellm-rust/crates/ai-gateway/src/ocr/tests.rs +++ b/litellm-rust/crates/ai-gateway/src/ocr/tests.rs @@ -3,12 +3,12 @@ use std::time::Duration; use litellm_core::error::CoreError; use litellm_core::ocr::transformation::OcrResponseHandling; -use serde_json::{json, Map, Value}; +use serde_json::{Map, Value, json}; use tokio::io::{AsyncReadExt, AsyncWriteExt}; use tokio::net::{TcpListener, TcpStream}; use super::common_utils::{has_header, ocr_provider_config, string_headers, truncate_error_body}; -use super::{ocr, OcrRequest}; +use super::{OcrRequest, ocr}; use crate::integrations::custom_guardrail::{ CustomGuardrail, GuardrailContext, GuardrailDecision, GuardrailError, GuardrailEventHook, GuardrailFuture, GuardrailRequest, @@ -228,19 +228,23 @@ fn truncate_error_body_does_not_split_multibyte_chars() { #[test] fn ocr_dispatch_supports_migrated_providers() { assert!(ocr_provider_config("mistral", "mistral-ocr-latest").is_some()); - assert!(ocr_provider_config("azure_ai", "pixtral-12b-2409") - .expect("azure ai config resolves") - .requires_data_uri_document()); + assert!( + ocr_provider_config("azure_ai", "pixtral-12b-2409") + .expect("azure ai config resolves") + .requires_data_uri_document() + ); assert_eq!( ocr_provider_config("azure_ai", "doc-intelligence/prebuilt-read") .expect("document intelligence config resolves") .response_handling(), OcrResponseHandling::AzureDocumentIntelligencePoll ); - assert!(ocr_provider_config("vertex_ai", "deepseek-ocr-maas") - .expect("vertex deepseek config resolves") - .supported_ocr_params() - .contains(&"temperature")); + assert!( + ocr_provider_config("vertex_ai", "deepseek-ocr-maas") + .expect("vertex deepseek config resolves") + .supported_ocr_params() + .contains(&"temperature") + ); assert!(ocr_provider_config("openai", "gpt-4o").is_none()); } diff --git a/litellm-rust/crates/ai-gateway/src/python/config.rs b/litellm-rust/crates/ai-gateway/src/python/config.rs index 6ec9595469d..c028d3d6b51 100644 --- a/litellm-rust/crates/ai-gateway/src/python/config.rs +++ b/litellm-rust/crates/ai-gateway/src/python/config.rs @@ -7,9 +7,9 @@ //! //! Compiled only under the `python-config` feature. +use litellm_core::CoreResult; use litellm_core::error::CoreError; use litellm_core::router::{Deployment, Router}; -use litellm_core::CoreResult; use pyo3::prelude::*; use crate::gil; @@ -17,7 +17,7 @@ use crate::gil; /// Load the router's `model_list` from `config_path` via the Python reader. pub fn load_router_from_config(config_path: &str) -> CoreResult { gil::record_acquisition(); - Python::with_gil(|py| { + Python::attach(|py| { let model_list = py .import("litellm.proxy.read_model_list") .and_then(|module| module.getattr("read_model_list")) diff --git a/litellm-rust/crates/ai-gateway/src/routes/AGENTS.md b/litellm-rust/crates/ai-gateway/src/routes/AGENTS.md index 02c5f18c4f3..3eee43e7a2f 100644 --- a/litellm-rust/crates/ai-gateway/src/routes/AGENTS.md +++ b/litellm-rust/crates/ai-gateway/src/routes/AGENTS.md @@ -19,7 +19,10 @@ async fn handle(...) -> impl IntoResponse { ... } When a route has business logic worth testing without axum, put it in a sibling `service` (a file, or a folder if the route grows). The route file stays the **axum surface** (router + handler + any socket/SSE adapter); `service` is plain -Rust with **no axum types**. `realtime/` is the example: +Rust with **no axum types**, and its job is to pick the deployment and call the +`core` route entrypoint (see `messages/service.rs` calling +`litellm_core::messages::messages`). Never build a provider request, resolve a +key, or perform the provider call here. `realtime/` is the older example: ``` realtime/ mod.rs # axum surface: router() + handler + the WS<->events adapter @@ -33,6 +36,8 @@ genuinely gets hard to read. `crate::auth::RequireMasterKey` to its arguments; it runs during extraction. Never re-implement the check per route. - **Handlers contain no business logic; `service` contains no axum types.** +- **No provider handlers in this crate.** Transforms, auth headers, and the + provider HTTP call live in `core/src//`. - A route owns its paths in its own `router()`; `mod.rs` only merges. - Cross-cutting concerns (logging, CORS, timeouts) → Tower layers in `mod.rs`, not duplicated in handlers. diff --git a/litellm-rust/crates/ai-gateway/src/routes/health.rs b/litellm-rust/crates/ai-gateway/src/routes/health.rs index 15c67fea325..c64ca3a7199 100644 --- a/litellm-rust/crates/ai-gateway/src/routes/health.rs +++ b/litellm-rust/crates/ai-gateway/src/routes/health.rs @@ -1,8 +1,8 @@ //! Health probes. Simple-route template: a `router()` plus its handlers, in one file. +use axum::Router; use axum::http::StatusCode; use axum::routing::get; -use axum::Router; use crate::state::AppState; diff --git a/litellm-rust/crates/ai-gateway/src/routes/messages/mod.rs b/litellm-rust/crates/ai-gateway/src/routes/messages/mod.rs new file mode 100644 index 00000000000..a34b2edd7b8 --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/routes/messages/mod.rs @@ -0,0 +1,513 @@ +//! `POST /v1/messages`, the Anthropic Messages HTTP surface. + +mod service; + +use axum::Router; +use axum::body::Body; +use axum::extract::{Json, State}; +use axum::http::StatusCode; +use axum::http::header::{CACHE_CONTROL, CONTENT_TYPE, HeaderMap, HeaderValue}; +use axum::response::{IntoResponse, Response}; +use axum::routing::post; +use litellm_core::CoreError; +use serde_json::{Map, Value}; + +use crate::auth::RequireMasterKey; +use crate::constants::{MESSAGES_HEADERS_NOT_FORWARDED, MESSAGES_ROUTE_PATH}; +use crate::state::AppState; + +/// This route's contribution to the app router. +pub fn router() -> Router { + Router::new().route(MESSAGES_ROUTE_PATH, post(handle)) +} + +async fn handle( + _auth: RequireMasterKey, + State(state): State, + headers: HeaderMap, + Json(body): Json, +) -> Result { + let extra_headers = forwarded_headers(&headers)?; + match service::run(&state.router, body, extra_headers) + .await + .map_err(MessagesRouteError::from)? + { + service::MessagesResponse::Json(body) => Ok(Json(body).into_response()), + service::MessagesResponse::Stream(upstream) => stream_response(upstream), + } +} + +fn stream_response(upstream: reqwest::Response) -> Result { + let content_type = upstream + .headers() + .get(CONTENT_TYPE) + .cloned() + .unwrap_or_else(|| HeaderValue::from_static("text/event-stream")); + let mut response = Response::builder() + .status( + StatusCode::from_u16(upstream.status().as_u16()).map_err(|error| { + MessagesRouteError(CoreError::InvalidResponse(format!( + "invalid upstream response status: {error}" + ))) + })?, + ) + .header(CONTENT_TYPE, content_type); + if let Some(value) = upstream.headers().get(CACHE_CONTROL) { + response = response.header(CACHE_CONTROL, value); + } + response + .body(Body::from_stream(upstream.bytes_stream())) + .map_err(|error| { + MessagesRouteError(CoreError::InvalidResponse(format!( + "failed to build streaming response: {error}" + ))) + }) +} + +fn forwarded_headers(headers: &HeaderMap) -> Result>, CoreError> { + let forwarded = headers + .iter() + .filter(|(name, _)| { + !MESSAGES_HEADERS_NOT_FORWARDED + .iter() + .any(|excluded| name.as_str().eq_ignore_ascii_case(excluded)) + }) + .map(|(name, value)| { + let value = value.to_str().map_err(|_| { + CoreError::InvalidRequest(format!("invalid value for header {}", name.as_str())) + })?; + Ok((name.to_string(), Value::String(value.to_string()))) + }) + .collect::, CoreError>>()?; + Ok((!forwarded.is_empty()).then_some(forwarded)) +} + +#[derive(Debug)] +struct MessagesRouteError(CoreError); + +impl From for MessagesRouteError { + fn from(error: CoreError) -> Self { + Self(error) + } +} + +impl IntoResponse for MessagesRouteError { + fn into_response(self) -> Response { + let (status, message) = match self.0 { + CoreError::InvalidRequest(message) => (StatusCode::BAD_REQUEST, message), + CoreError::InvalidProvider(_) | CoreError::Routing(_) => ( + StatusCode::NOT_FOUND, + "no messages deployment is configured for this model".to_string(), + ), + CoreError::Auth(_) => ( + StatusCode::BAD_GATEWAY, + "messages provider authentication failed".to_string(), + ), + CoreError::Http { .. } + | CoreError::Network(_) + | CoreError::InvalidResponse(_) + | CoreError::InvalidType { .. } + | CoreError::MissingField(_) => ( + StatusCode::BAD_GATEWAY, + "messages provider request failed".to_string(), + ), + }; + ( + status, + Json(serde_json::json!({"error": {"message": message}})), + ) + .into_response() + } +} + +#[cfg(test)] +mod tests { + use std::sync::Arc; + + use axum::body::Body; + use axum::http::Request; + use axum::http::StatusCode; + use axum::http::header::{CACHE_CONTROL, CONTENT_TYPE}; + use litellm_core::router::{Deployment, LiteLLMParams, Router as ModelRouter}; + use serde_json::json; + use tokio::io::{AsyncReadExt, AsyncWriteExt}; + use tokio::net::TcpListener; + use tower::ServiceExt; + + use super::super::app; + use crate::io::realtime_pool::RealtimePool; + use crate::state::AppState; + + fn state(model: &str, api_base: String, master_key: Option<&str>) -> AppState { + state_with_provider(model, model, api_base, master_key) + } + + fn state_with_provider( + model_alias: &str, + provider_model: &str, + api_base: String, + master_key: Option<&str>, + ) -> AppState { + AppState { + router: Arc::new(ModelRouter::new(vec![Deployment { + model_name: model_alias.to_string(), + litellm_params: LiteLLMParams { + model: format!("anthropic/{provider_model}"), + api_key: Some("upstream-key".to_string()), + api_base: Some(api_base), + }, + }])), + master_key: master_key.map(Arc::from), + loggers: Arc::new(Vec::new()), + realtime_pool: RealtimePool::disabled(), + } + } + + async fn upstream(listener: TcpListener) -> (String, tokio::task::JoinHandle) { + let address = listener.local_addr().expect("listener has address"); + let server = tokio::spawn(async move { + let (mut socket, _) = listener.accept().await.expect("accepts request"); + let mut request = Vec::new(); + let mut buffer = [0_u8; 4096]; + loop { + let read = socket.read(&mut buffer).await.expect("reads request"); + request.extend_from_slice(&buffer[..read]); + if request.windows(4).any(|window| window == b"\r\n\r\n") { + break; + } + } + let request = String::from_utf8(request).expect("request is utf8"); + let content_length = request + .lines() + .find_map(|line| { + let (name, value) = line.split_once(':')?; + name.eq_ignore_ascii_case("content-length") + .then(|| value.trim().parse::().ok()) + .flatten() + }) + .unwrap_or(0); + let header_end = request.find("\r\n\r\n").expect("request has headers") + 4; + let mut full_request = request.into_bytes(); + while full_request.len().saturating_sub(header_end) < content_length { + let read = socket.read(&mut buffer).await.expect("reads body"); + full_request.extend_from_slice(&buffer[..read]); + } + let request = String::from_utf8(full_request).expect("request is utf8"); + let body = r#"{"id":"msg_1","type":"message","role":"assistant","content":[],"model":"claude-test"}"#; + let response = format!( + "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{}", + body.len(), + body + ); + socket + .write_all(response.as_bytes()) + .await + .expect("writes response"); + request + }); + (format!("http://{address}"), server) + } + + async fn streaming_upstream( + listener: TcpListener, + status: u16, + content_type: &'static str, + body: &'static str, + ) -> (String, tokio::task::JoinHandle) { + let address = listener.local_addr().expect("listener has address"); + let server = tokio::spawn(async move { + let (mut socket, _) = listener.accept().await.expect("accepts request"); + let mut request = Vec::new(); + let mut buffer = [0_u8; 4096]; + loop { + let read = socket.read(&mut buffer).await.expect("reads request"); + request.extend_from_slice(&buffer[..read]); + if request.windows(4).any(|window| window == b"\r\n\r\n") { + break; + } + } + let request_text = String::from_utf8(request).expect("request is utf8"); + let content_length = request_text + .lines() + .find_map(|line| { + let (name, value) = line.split_once(':')?; + name.eq_ignore_ascii_case("content-length") + .then(|| value.trim().parse::().ok()) + .flatten() + }) + .unwrap_or(0); + let header_end = request_text.find("\r\n\r\n").expect("request has headers") + 4; + let mut full_request = request_text.into_bytes(); + while full_request.len().saturating_sub(header_end) < content_length { + let read = socket.read(&mut buffer).await.expect("reads body"); + full_request.extend_from_slice(&buffer[..read]); + } + let response = format!( + "HTTP/1.1 {status} OK\r\ncontent-type: {content_type}\r\ncache-control: no-cache\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{body}", + body.len() + ); + socket + .write_all(response.as_bytes()) + .await + .expect("writes response"); + String::from_utf8(full_request).expect("request is utf8") + }); + (format!("http://{address}"), server) + } + + #[tokio::test] + async fn route_constructs_anthropic_upstream_request() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds"); + let (api_base, server) = upstream(listener).await; + let app = app(state("claude-test", api_base, Some("master-key"))); + let response = app + .oneshot( + Request::builder() + .method("POST") + .uri("/v1/messages") + .header("authorization", "Bearer master-key") + .header("x-api-key", "request-upstream-key") + .header("anthropic-beta", "beta-feature") + .header("content-type", "application/json") + .body(Body::from( + json!({ + "model": "claude-test", + "max_tokens": 16, + "messages": [{"role": "user", "content": "hello"}] + }) + .to_string(), + )) + .expect("request builds"), + ) + .await + .expect("route responds"); + assert_eq!(response.status(), StatusCode::OK); + let body = axum::body::to_bytes(response.into_body(), usize::MAX) + .await + .expect("response body reads"); + assert_eq!( + serde_json::from_slice::(&body).expect("json")["id"], + "msg_1" + ); + let upstream_request = server.await.expect("upstream task completes"); + let (head, body) = upstream_request + .split_once("\r\n\r\n") + .expect("upstream request has body"); + let head = head.to_ascii_lowercase(); + assert!(head.contains("x-api-key: request-upstream-key")); + assert!(head.contains("anthropic-beta: beta-feature")); + assert!(!head.contains("authorization: bearer master-key")); + let body: serde_json::Value = serde_json::from_str(body).expect("upstream body is json"); + assert_eq!(body["model"], "claude-test"); + assert_eq!(body["messages"][0]["content"], "hello"); + } + + #[tokio::test] + async fn route_substitutes_model_alias_with_provider_model_upstream() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds"); + let (api_base, server) = upstream(listener).await; + let app = app(state_with_provider( + "production", + "claude-sonnet-4-5", + api_base, + Some("master-key"), + )); + let response = app + .oneshot( + Request::builder() + .method("POST") + .uri("/v1/messages") + .header("authorization", "Bearer master-key") + .header("content-type", "application/json") + .body(Body::from( + json!({ + "model": "production", + "max_tokens": 16, + "messages": [{"role": "user", "content": "hello"}] + }) + .to_string(), + )) + .expect("request builds"), + ) + .await + .expect("route responds"); + assert_eq!(response.status(), StatusCode::OK); + let upstream_request = server.await.expect("upstream task completes"); + let (_, upstream_body) = upstream_request + .split_once("\r\n\r\n") + .expect("upstream request has body"); + let upstream_body: serde_json::Value = + serde_json::from_str(upstream_body).expect("upstream body is json"); + assert_eq!(upstream_body["model"], "claude-sonnet-4-5"); + assert_ne!(upstream_body["model"], "production"); + } + + #[tokio::test] + async fn route_streams_anthropic_events_without_buffering_or_reordering() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds"); + let events = "event: message_start\ndata: {\"type\":\"message_start\"}\n\nevent: content_block_delta\ndata: {\"type\":\"content_block_delta\"}\n\nevent: message_stop\ndata: {\"type\":\"message_stop\"}\n\n"; + let (api_base, server) = + streaming_upstream(listener, 200, "text/event-stream", events).await; + let app = app(state("claude-test", api_base, Some("master-key"))); + let response = app + .oneshot( + Request::builder() + .method("POST") + .uri("/v1/messages") + .header("authorization", "Bearer master-key") + .header("content-type", "application/json") + .body(Body::from( + json!({ + "model": "claude-test", + "max_tokens": 16, + "stream": true, + "messages": [{"role": "user", "content": "hello"}] + }) + .to_string(), + )) + .expect("request builds"), + ) + .await + .expect("route responds"); + assert_eq!(response.status(), StatusCode::OK); + assert_eq!( + response + .headers() + .get(CONTENT_TYPE) + .unwrap() + .to_str() + .unwrap(), + "text/event-stream" + ); + assert_eq!( + response + .headers() + .get(CACHE_CONTROL) + .unwrap() + .to_str() + .unwrap(), + "no-cache" + ); + let response_body = axum::body::to_bytes(response.into_body(), usize::MAX) + .await + .expect("response body reads"); + assert_eq!(response_body, events.as_bytes()); + let upstream_request = server.await.expect("upstream task completes"); + let (_, upstream_body) = upstream_request + .split_once("\r\n\r\n") + .expect("upstream request has body"); + assert_eq!( + serde_json::from_str::(upstream_body) + .expect("upstream body is json")["stream"], + true + ); + } + + #[tokio::test] + async fn route_maps_streaming_upstream_errors_before_starting_response() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds"); + let (api_base, server) = streaming_upstream( + listener, + 429, + "application/json", + r#"{"error":"rate limited"}"#, + ) + .await; + let app = app(state("claude-test", api_base, Some("master-key"))); + let response = app + .oneshot( + Request::builder() + .method("POST") + .uri("/v1/messages") + .header("authorization", "Bearer master-key") + .header("content-type", "application/json") + .body(Body::from( + json!({ + "model": "claude-test", + "max_tokens": 16, + "stream": true, + "messages": [{"role": "user", "content": "hello"}] + }) + .to_string(), + )) + .expect("request builds"), + ) + .await + .expect("route responds"); + assert_eq!(response.status(), StatusCode::BAD_GATEWAY); + let response_body = axum::body::to_bytes(response.into_body(), usize::MAX) + .await + .expect("response body reads"); + assert_eq!( + serde_json::from_slice::(&response_body).expect("error is json")["error"] + ["message"], + "messages provider request failed" + ); + server.await.expect("upstream task completes"); + } + + #[tokio::test] + async fn route_rejects_missing_master_key() { + let app = app(state( + "claude-test", + "http://127.0.0.1:1".to_string(), + Some("master-key"), + )); + let response = app + .oneshot( + Request::builder() + .method("POST") + .uri("/v1/messages") + .header("content-type", "application/json") + .body(Body::from("{}")) + .expect("request builds"), + ) + .await + .expect("route responds"); + assert_eq!(response.status(), StatusCode::UNAUTHORIZED); + } + + #[tokio::test] + async fn route_rejects_invalid_master_key() { + let app = app(state( + "claude-test", + "http://127.0.0.1:1".to_string(), + Some("master-key"), + )); + let response = app + .oneshot( + Request::builder() + .method("POST") + .uri("/v1/messages") + .header("authorization", "Bearer wrong-key") + .header("content-type", "application/json") + .body(Body::from("{}")) + .expect("request builds"), + ) + .await + .expect("route responds"); + assert_eq!(response.status(), StatusCode::UNAUTHORIZED); + } + + #[tokio::test] + async fn route_rejects_malformed_json_without_panicking() { + let app = app(state( + "claude-test", + "http://127.0.0.1:1".to_string(), + Some("master-key"), + )); + let response = app + .oneshot( + Request::builder() + .method("POST") + .uri("/v1/messages") + .header("authorization", "Bearer master-key") + .header("content-type", "application/json") + .body(Body::from("{not-json")) + .expect("request builds"), + ) + .await + .expect("route responds"); + assert_eq!(response.status(), StatusCode::BAD_REQUEST); + } +} diff --git a/litellm-rust/crates/ai-gateway/src/routes/messages/service.rs b/litellm-rust/crates/ai-gateway/src/routes/messages/service.rs new file mode 100644 index 00000000000..5f4c5fe8de4 --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/routes/messages/service.rs @@ -0,0 +1,65 @@ +use std::sync::Arc; + +use litellm_core::constants::ANTHROPIC_MESSAGES_PROVIDER; +use litellm_core::messages::types::MessagesRequest; +use litellm_core::messages::{messages, messages_stream}; +use litellm_core::router::Router; +use litellm_core::{CoreError, CoreResult}; +use serde_json::{Map, Value}; + +pub(crate) enum MessagesResponse { + Json(Value), + Stream(reqwest::Response), +} + +pub async fn run( + router: &Arc, + body: Value, + extra_headers: Option>, +) -> CoreResult { + let model = body + .get("model") + .and_then(Value::as_str) + .map(str::trim) + .filter(|model| !model.is_empty()) + .ok_or_else(|| CoreError::InvalidRequest("messages body requires a model".to_string()))?; + let deployment = router.get_available_deployment(model).ok_or_else(|| { + CoreError::Routing(format!("no deployment available for model '{model}'")) + })?; + let provider_model = deployment.litellm_params.model.as_str(); + let upstream_model = provider_model + .split_once('/') + .map_or(provider_model, |(_, model)| model); + let custom_llm_provider = if provider_model.contains('/') { + None + } else { + Some(ANTHROPIC_MESSAGES_PROVIDER) + }; + let mut body = body; + body.as_object_mut() + .ok_or_else(|| CoreError::InvalidRequest("messages body must be an object".to_string()))? + .insert( + "model".to_string(), + Value::String(upstream_model.to_string()), + ); + + let request = MessagesRequest { + model: provider_model, + body, + api_key: deployment.litellm_params.api_key.as_deref(), + api_base: deployment.litellm_params.api_base.as_deref(), + custom_llm_provider, + extra_headers, + timeout: None, + }; + if request.body.get("stream").and_then(Value::as_bool) == Some(true) { + return messages_stream(request).await.map(MessagesResponse::Stream); + } + + let response = messages(request).await?; + serde_json::to_value(response) + .map(MessagesResponse::Json) + .map_err(|err| { + CoreError::InvalidResponse(format!("failed to serialize messages response: {err}")) + }) +} diff --git a/litellm-rust/crates/ai-gateway/src/routes/mod.rs b/litellm-rust/crates/ai-gateway/src/routes/mod.rs index c6b9573781a..c26be8ffee3 100644 --- a/litellm-rust/crates/ai-gateway/src/routes/mod.rs +++ b/litellm-rust/crates/ai-gateway/src/routes/mod.rs @@ -7,7 +7,9 @@ pub mod gil; pub mod health; +pub mod messages; pub mod realtime; +pub mod responses; use axum::Router; @@ -18,6 +20,8 @@ pub fn app(state: AppState) -> Router { Router::new() .merge(health::router()) .merge(gil::router()) + .merge(messages::router()) .merge(realtime::router()) + .merge(responses::router()) .with_state(state) } diff --git a/litellm-rust/crates/ai-gateway/src/routes/realtime/mod.rs b/litellm-rust/crates/ai-gateway/src/routes/realtime/mod.rs index c3f929f5f0b..f9144ad1fdb 100644 --- a/litellm-rust/crates/ai-gateway/src/routes/realtime/mod.rs +++ b/litellm-rust/crates/ai-gateway/src/routes/realtime/mod.rs @@ -6,17 +6,17 @@ mod service; -use std::sync::atomic::{AtomicU64, Ordering}; use std::sync::Arc; +use std::sync::atomic::{AtomicU64, Ordering}; use std::time::{SystemTime, UNIX_EPOCH}; use crate::io::realtime_pool::RealtimePool; +use axum::Router; use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade}; use axum::extract::{Query, State}; use axum::http::StatusCode; use axum::response::Response; use axum::routing::get; -use axum::Router; use futures_util::{SinkExt, StreamExt}; use litellm_core::realtime::types::RealtimeEvent; use litellm_core::router::Router as ModelRouter; diff --git a/litellm-rust/crates/ai-gateway/src/routes/realtime/service.rs b/litellm-rust/crates/ai-gateway/src/routes/realtime/service.rs index d6c31edd454..4ae8cfe7379 100644 --- a/litellm-rust/crates/ai-gateway/src/routes/realtime/service.rs +++ b/litellm-rust/crates/ai-gateway/src/routes/realtime/service.rs @@ -9,12 +9,12 @@ use std::time::Duration; -use crate::io::realtime_pool::{upstream_key, RealtimePool}; +use crate::io::realtime_pool::{RealtimePool, upstream_key}; use futures_util::{Sink, Stream}; +use litellm_core::CoreResult; use litellm_core::error::CoreError; use litellm_core::realtime::types::RealtimeEvent; use litellm_core::router::Router; -use litellm_core::CoreResult; /// Select a deployment for `model` and splice the client stream to the provider. /// diff --git a/litellm-rust/crates/ai-gateway/src/routes/responses/mod.rs b/litellm-rust/crates/ai-gateway/src/routes/responses/mod.rs new file mode 100644 index 00000000000..a94853e106d --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/routes/responses/mod.rs @@ -0,0 +1,348 @@ +mod service; + +use std::sync::Arc; +use std::sync::atomic::{AtomicU64, Ordering}; +use std::time::{SystemTime, UNIX_EPOCH}; + +use axum::Router; +use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade}; +use axum::extract::{Query, State}; +use axum::http::StatusCode; +use axum::response::Response; +use axum::routing::get; +use futures_util::{Sink, SinkExt, StreamExt}; +use litellm_core::responses::types::{ResponsesErrorFrame, ResponsesWsEvent, ResponsesWsEventType}; +use litellm_core::router::Router as ModelRouter; +use serde::Deserialize; + +use crate::auth::RequireMasterKey; +use crate::integrations::custom_logger::CustomLogger; +use crate::integrations::types::RequestMetadata; +use crate::state::AppState; + +static CALL_SEQ: AtomicU64 = AtomicU64::new(0); + +fn new_call_id() -> String { + let nanos = SystemTime::now() + .duration_since(UNIX_EPOCH) + .map(|duration| duration.as_nanos()) + .unwrap_or(0); + let sequence = CALL_SEQ.fetch_add(1, Ordering::Relaxed); + format!("respws-{nanos:x}-{sequence:x}") +} + +pub fn router() -> Router { + Router::new() + .route("/v1/responses", get(handle)) + .route("/responses", get(handle)) +} + +#[derive(Debug, Deserialize)] +struct ResponsesQuery { + model: Option, +} + +async fn handle( + _auth: RequireMasterKey, + ws: WebSocketUpgrade, + State(state): State, + Query(query): Query, +) -> Result { + if let Some(model) = query.model.as_deref() { + validate_model(&state.router, model)?; + } + let router = state.router.clone(); + let loggers = state.loggers.clone(); + let master_key = state.master_key.clone(); + Ok(ws.on_upgrade(move |socket| bridge(socket, router, loggers, master_key, query.model))) +} + +fn validate_model(router: &ModelRouter, model: &str) -> Result<(), (StatusCode, String)> { + if model.trim().is_empty() { + return Err(( + StatusCode::BAD_REQUEST, + "missing 'model' query param".to_string(), + )); + } + let Some(deployment) = router.get_available_deployment(model) else { + return Err(( + StatusCode::NOT_FOUND, + format!("no deployment for model '{model}'"), + )); + }; + if deployment.litellm_params.model.contains('/') + && !deployment.litellm_params.model.starts_with("openai/") + { + return Err(( + StatusCode::BAD_REQUEST, + "Responses WebSocket route supports OpenAI deployments only".to_string(), + )); + } + Ok(()) +} + +async fn send_error_and_close(sink: &mut S, message: String) +where + S: futures_util::Sink + Unpin, + S::Error: std::fmt::Display, +{ + if let Ok(payload) = serde_json::to_string(&ResponsesErrorFrame::invalid_request(message)) { + let _ = sink.send(Message::Text(payload)).await; + } + let _ = sink + .send(Message::Close(Some(axum::extract::ws::CloseFrame { + code: 1008, + reason: "Pre-call error".into(), + }))) + .await; + let _ = sink.close().await; +} + +struct ResponseClientSink { + sink: futures_util::stream::SplitSink, +} + +impl Sink for ResponseClientSink { + type Error = axum::Error; + + fn poll_ready( + mut self: std::pin::Pin<&mut Self>, + context: &mut std::task::Context<'_>, + ) -> std::task::Poll> { + std::pin::Pin::new(&mut self.sink).poll_ready(context) + } + + fn start_send( + mut self: std::pin::Pin<&mut Self>, + item: ResponsesWsEvent, + ) -> Result<(), Self::Error> { + let payload = serde_json::to_string(&item).map_err(axum::Error::new)?; + std::pin::Pin::new(&mut self.sink).start_send(Message::Text(payload)) + } + + fn poll_flush( + mut self: std::pin::Pin<&mut Self>, + context: &mut std::task::Context<'_>, + ) -> std::task::Poll> { + std::pin::Pin::new(&mut self.sink).poll_flush(context) + } + + fn poll_close( + mut self: std::pin::Pin<&mut Self>, + context: &mut std::task::Context<'_>, + ) -> std::task::Poll> { + std::pin::Pin::new(&mut self.sink).poll_close(context) + } +} + +impl ResponseClientSink { + async fn close_with_code(&mut self, code: u16, reason: &'static str) { + let _ = self + .sink + .send(Message::Close(Some(axum::extract::ws::CloseFrame { + code, + reason: reason.into(), + }))) + .await; + let _ = self.sink.close().await; + } +} + +async fn bridge( + socket: WebSocket, + router: Arc, + loggers: Arc>>, + master_key: Option>, + requested_model: Option, +) { + let (mut ws_sink, ws_stream) = socket.split(); + let (model, first_frame, stream) = if let Some(model) = requested_model { + (model, None, ws_stream) + } else { + let mut stream = ws_stream; + let first = match stream.next().await { + Some(Ok(Message::Text(text))) => { + match serde_json::from_str::(&text) { + Ok(event) => event, + Err(_) => { + send_error_and_close( + &mut ws_sink, + "Invalid JSON in response.create event".to_string(), + ) + .await; + return; + } + } + } + _ => { + send_error_and_close(&mut ws_sink, "Missing response.create event".to_string()) + .await; + return; + } + }; + let Some(model) = first.model().filter(|value| !value.trim().is_empty()) else { + send_error_and_close( + &mut ws_sink, + "Missing model in response.create event".to_string(), + ) + .await; + return; + }; + if first.event_type != ResponsesWsEventType::ResponseCreate { + send_error_and_close( + &mut ws_sink, + "First frame must be a response.create event".to_string(), + ) + .await; + return; + } + (model.to_string(), Some(first), stream) + }; + if let Err((status, message)) = validate_model(&router, &model) { + let _ = status; + let _ = message; + send_error_and_close(&mut ws_sink, "Unknown model deployment".to_string()).await; + return; + } + + let call_id = new_call_id(); + let metadata = RequestMetadata { + user_api_key_hash: master_key.as_deref().map(crate::auth::hash_token), + ..RequestMetadata::default() + }; + let client_in = Box::pin(stream.filter_map(|message| async move { + match message { + Ok(Message::Text(text)) => serde_json::from_str::(&text).ok(), + _ => None, + } + })); + let mut client_out = ResponseClientSink { sink: ws_sink }; + let result = service::run( + &router, + &model, + first_frame, + None, + loggers, + call_id, + metadata, + client_in, + &mut client_out, + ) + .await; + if result.is_err() { + client_out + .close_with_code(1011, "Internal server error") + .await; + } +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::io::realtime_pool::RealtimePool; + use crate::state::AppState; + use axum::body::Body; + use axum::http::Request; + use litellm_core::router::Router as ModelRouter; + use serde_json::json; + use std::pin::Pin; + use std::sync::Arc; + use std::task::{Context, Poll}; + use tower::ServiceExt; + + struct RecordingSink { + messages: Vec, + } + + impl Sink for RecordingSink { + type Error = std::convert::Infallible; + + fn poll_ready( + self: Pin<&mut Self>, + _context: &mut Context<'_>, + ) -> Poll> { + Poll::Ready(Ok(())) + } + + fn start_send(mut self: Pin<&mut Self>, item: Message) -> Result<(), Self::Error> { + self.messages.push(item); + Ok(()) + } + + fn poll_flush( + self: Pin<&mut Self>, + _context: &mut Context<'_>, + ) -> Poll> { + Poll::Ready(Ok(())) + } + + fn poll_close( + self: Pin<&mut Self>, + _context: &mut Context<'_>, + ) -> Poll> { + Poll::Ready(Ok(())) + } + } + + #[tokio::test] + async fn pre_call_error_matches_python_frame_and_close() { + let mut sink = RecordingSink { + messages: Vec::new(), + }; + send_error_and_close(&mut sink, "missing model".to_string()).await; + let Message::Text(payload) = &sink.messages[0] else { + panic!("expected error text frame"); + }; + assert_eq!( + serde_json::from_str::(payload).expect("error json"), + json!({ + "type": "error", + "error": { + "type": "invalid_request_error", + "message": "missing model" + } + }) + ); + assert_eq!( + sink.messages[1], + Message::Close(Some(axum::extract::ws::CloseFrame { + code: 1008, + reason: "Pre-call error".into(), + })) + ); + } + + fn state() -> AppState { + AppState { + router: Arc::new(ModelRouter::default()), + master_key: Some(Arc::from("master-key")), + loggers: Arc::new(Vec::new()), + realtime_pool: RealtimePool::disabled(), + } + } + + #[tokio::test] + async fn auth_rejects_responses_upgrade_before_handler() { + let request = Request::builder() + .uri("/responses?model=known") + .body(Body::empty()) + .expect("request"); + let response = router() + .with_state(state()) + .oneshot(request) + .await + .expect("response"); + assert_eq!(response.status(), StatusCode::UNAUTHORIZED); + } + + #[test] + fn unknown_query_model_is_rejected_before_upgrade() { + assert_eq!( + validate_model(&ModelRouter::default(), "unknown").expect_err("unknown model"), + ( + StatusCode::NOT_FOUND, + "no deployment for model 'unknown'".to_string() + ) + ); + } +} diff --git a/litellm-rust/crates/ai-gateway/src/routes/responses/service.rs b/litellm-rust/crates/ai-gateway/src/routes/responses/service.rs new file mode 100644 index 00000000000..165c95695d3 --- /dev/null +++ b/litellm-rust/crates/ai-gateway/src/routes/responses/service.rs @@ -0,0 +1,156 @@ +use std::sync::Arc; +use std::time::Duration; + +use futures_util::{Sink, Stream}; +use litellm_core::call_lifecycle::{CallLifecycle, CallLifecycleContext}; +use litellm_core::responses::instrumentation::{ + ResponsesWsCallbackPayload, ResponsesWsInstrumentation, ResponsesWsLogOutcome, + ResponsesWsMetadata, +}; +use litellm_core::responses::types::ResponsesWsEvent; +use litellm_core::{CoreError, CoreResult}; + +use crate::integrations::custom_logger::{ + CallbackTiming, CallbackValue, CustomLogger, CustomLoggerRunner, LoggingError, ModelCallDetails, +}; +use crate::integrations::types::RequestMetadata; + +#[allow(clippy::too_many_arguments)] +pub async fn run( + router: &litellm_core::router::Router, + model: &str, + first_frame: Option, + idle_timeout: Option, + loggers: Arc>>, + call_id: String, + metadata: RequestMetadata, + client_in: In, + client_out: Out, +) -> CoreResult<()> +where + In: Stream + Unpin + Send, + Out: Sink + Unpin + Send, + Out::Error: std::fmt::Display, +{ + let deployment = router.get_available_deployment(model).ok_or_else(|| { + CoreError::Routing(format!("no deployment available for model '{model}'")) + })?; + let params = &deployment.litellm_params; + let provider_model = params + .model + .strip_prefix("openai/") + .unwrap_or(¶ms.model); + if params.model.contains('/') && !params.model.starts_with("openai/") { + return Err(CoreError::InvalidProvider( + "Responses WebSocket route supports OpenAI deployments only".to_string(), + )); + } + let instrumentation = Arc::new(ResponsesWsInstrumentation::new( + call_id.clone(), + model, + ResponsesWsMetadata { + user_api_key_hash: metadata.user_api_key_hash, + user_api_key_user_id: metadata.user_api_key_user_id, + user_api_key_team_id: metadata.user_api_key_team_id, + }, + )); + let observer_instrumentation = Arc::clone(&instrumentation); + let context = CallLifecycleContext::new("responses_websocket", model, "openai", call_id); + let result = CallLifecycle::default() + .run(context, (), instrumentation.as_ref(), |_| async move { + crate::io::responses_ws::async_responses_websocket( + provider_model, + params.api_key.as_deref(), + params.api_base.as_deref(), + first_frame, + idle_timeout, + move |event| { + observer_instrumentation.observe(event); + }, + client_in, + client_out, + ) + .await + }) + .await; + let outcome = instrumentation.take_or_build_outcome(result.is_ok()); + dispatch_outcome(loggers, outcome).await; + result +} + +async fn dispatch_outcome( + loggers: Arc>>, + outcome: ResponsesWsLogOutcome, +) { + let runner = CustomLoggerRunner::new(loggers.as_ref().clone()); + match outcome { + ResponsesWsLogOutcome::Success { payload, callback } => { + let (details, response, start_time, end_time) = logging_values(payload, callback, None); + let _ = runner + .async_log_success_event( + &details, + &response, + CallbackTiming::new(start_time, end_time), + ) + .await; + } + ResponsesWsLogOutcome::Failure { + payload, + callback, + error_message, + error_kind, + } => { + let error = LoggingError { + message: error_message, + kind: error_kind, + }; + let (details, response, start_time, end_time) = + logging_values(payload, callback, Some(error)); + let _ = runner + .async_log_failure_event( + &details, + Some(&response), + CallbackTiming::new(start_time, end_time), + ) + .await; + } + } +} + +fn logging_values( + payload: litellm_core::responses::instrumentation::ResponsesWsLogPayload, + callback: ResponsesWsCallbackPayload, + error: Option, +) -> (ModelCallDetails, CallbackValue, f64, f64) { + let start_time = payload.start_time; + let end_time = payload.end_time; + let callback = CallbackValue::new(callback.object, callback.value); + let details = ModelCallDetails::from_standard_logging_payload( + crate::integrations::types::StandardLoggingPayload { + id: payload.id, + litellm_call_id: payload.litellm_call_id, + call_type: payload.call_type, + model: payload.model, + custom_llm_provider: payload.custom_llm_provider, + response_cost: payload.response_cost, + prompt_tokens: payload.usage.prompt_tokens, + completion_tokens: payload.usage.completion_tokens, + total_tokens: payload.usage.total_tokens, + start_time: payload.start_time, + end_time: payload.end_time, + stream: payload.stream, + metadata: crate::integrations::types::StandardLoggingMetadata { + user_api_key_hash: payload.metadata.user_api_key_hash, + user_api_key_user_id: payload.metadata.user_api_key_user_id, + user_api_key_team_id: payload.metadata.user_api_key_team_id, + ..Default::default() + }, + messages: None, + }, + ); + let details = match error { + Some(error) => details.with_failure_error(error), + None => details, + }; + (details, callback, start_time, end_time) +} diff --git a/litellm-rust/crates/core/AGENTS.md b/litellm-rust/crates/core/AGENTS.md index 8740dccaf01..aee8b4937ef 100644 --- a/litellm-rust/crates/core/AGENTS.md +++ b/litellm-rust/crates/core/AGENTS.md @@ -1,3 +1,7 @@ -litellm-core is the PURE translation layer — types, route contracts (traits), provider transforms (modules under `providers/`), and the router. No network, no I/O, no env reads. +litellm-core is the LiteLLM SDK in Rust — it makes the LLM call. Each top-level call is a module under `src//` exposing a public entrypoint named after the route (`messages::messages()`, the Rust equivalent of `litellm.messages()`): you call it and get a typed non-streaming response back. -Routes (ocr, realtime) and providers (mistral, openai) are modules, not crates. +A route module owns everything the call needs: types, the provider template trait, provider transforms (under `providers/`), provider/auth/URL resolution, and the handler that performs the HTTP call. Handlers belong here, never in a host crate. + +Not here: serving HTTP (axum routes, extractors), config file reading, rollout state, databases, or callback dispatch. Env reads are limited to credential fallback in a route's `prepare.rs`. + +Routes (messages, ocr, realtime) and providers (anthropic, mistral, openai) are modules, not crates. diff --git a/litellm-rust/crates/core/CLAUDE.md b/litellm-rust/crates/core/CLAUDE.md index 20873878967..5d36305ded5 100644 --- a/litellm-rust/crates/core/CLAUDE.md +++ b/litellm-rust/crates/core/CLAUDE.md @@ -4,20 +4,28 @@ Rules for `litellm-rust/crates/core`. ## Responsibility -`core` owns shared data types, typed errors, and deterministic helper contracts. -It must stay pure and host-independent. +`core` is the LiteLLM SDK in Rust: it makes the LLM call. Every top-level +LiteLLM call has a public entrypoint here, named after the route +(`messages::messages()` is the Rust equivalent of `litellm.messages()`), and +calling it returns a typed non-streaming response. Allowed: +- The public entrypoint for a route, plus its `_stream` variant when the + route supports streaming. +- Provider resolution, auth header construction, URL building, and the provider + HTTP call (shared reused client, connect + request timeouts). - Shared request/response structs. - Typed errors with stable, non-sensitive messages. - Deterministic validation helpers. - Serialization helpers that intentionally mirror Python output shape. - Route templates that match Python base config responsibilities, such as - `ocr::transformation::OcrProviderConfig`. + `messages::transformation::AnthropicMessagesProviderConfig`. Not allowed: -- Network, filesystem, database, cache, or environment access. -- Secret reads or auth/header construction. +- Serving HTTP: axum routers, extractors, and other transport concerns. +- Filesystem, database, or cache access. +- Config file reading or rollout state; the host resolves those and passes them + in. Env reads are limited to credential fallback in a route's `prepare.rs`. - Logging callbacks, tracing spans, spend writes, or customer callbacks. - Provider-specific branching that belongs in `providers`. - Panics for user/provider-controlled input. @@ -33,10 +41,21 @@ typed field on a struct, not a raw string threaded through the API. ## Structure -Use route names directly under `src/`: `ocr`, future `messages`, +Use route names directly under `src/`: `messages`, `ocr`, future `chat_completions`, `embeddings`, and similar top-level LiteLLM calls. Do not invent broad names like `engine` for route contracts. +`src/messages` is the reference shape for a route module: + +``` +mod.rs pub async fn messages(..) (+ messages_stream) +types.rs request/response types +transformation.rs the provider template trait +prepare.rs provider resolution, auth headers, URL +handler.rs the provider call +client.rs the shared reqwest client +``` + ## Parity Rules - Every shared type used by a provider transform needs unit tests for diff --git a/litellm-rust/crates/core/Cargo.toml b/litellm-rust/crates/core/Cargo.toml index 9bd4634cc2a..ab8050734f2 100644 --- a/litellm-rust/crates/core/Cargo.toml +++ b/litellm-rust/crates/core/Cargo.toml @@ -7,9 +7,28 @@ repository.workspace = true [dependencies] rand.workspace = true +reqwest.workspace = true serde.workspace = true serde_json.workspace = true thiserror.workspace = true +sha2.workspace = true +aws-config = { version = "1.9.0", default-features = false, features = ["rustls", "rt-tokio"], optional = true } +aws-credential-types = { version = "1.3.0", features = ["hardcoded-credentials"], optional = true } +aws-sdk-sts = { version = "1.108.0", default-features = false, features = ["rustls", "rt-tokio"], optional = true } +aws-sigv4 = { version = "1.5.1", optional = true } +aws-types = { version = "1.4.0", optional = true } +aws-smithy-runtime-api = { version = "1.13.0", optional = true } + +[features] +default = [] +bedrock-auth = [ + "dep:aws-config", + "dep:aws-credential-types", + "dep:aws-sdk-sts", + "dep:aws-sigv4", + "dep:aws-types", + "dep:aws-smithy-runtime-api", +] [dev-dependencies] tokio = { workspace = true, features = ["macros", "rt-multi-thread"] } diff --git a/litellm-rust/crates/core/src/audio_transcription/mod.rs b/litellm-rust/crates/core/src/audio_transcription/mod.rs new file mode 100644 index 00000000000..ec2fbb969a6 --- /dev/null +++ b/litellm-rust/crates/core/src/audio_transcription/mod.rs @@ -0,0 +1,2 @@ +pub mod transformation; +pub mod types; diff --git a/litellm-rust/crates/core/src/audio_transcription/transformation.rs b/litellm-rust/crates/core/src/audio_transcription/transformation.rs new file mode 100644 index 00000000000..eab34c13843 --- /dev/null +++ b/litellm-rust/crates/core/src/audio_transcription/transformation.rs @@ -0,0 +1,57 @@ +use serde_json::{Map, Value}; + +use crate::CoreResult; + +use super::types::{AudioTranscriptionRequestData, AudioTranscriptionResponseData}; + +#[derive(Clone, Debug, PartialEq, Eq)] +pub enum AudioTranscriptionAuth { + Bearer, + AwsSigV4 { + region: String, + service: &'static str, + }, +} + +pub trait AudioTranscriptionProviderConfig: Sync { + fn supported_transcription_params(&self) -> &'static [&'static str]; + + fn map_transcription_params(&self, params: &Map) -> Map { + params + .iter() + .filter(|(key, _)| { + self.supported_transcription_params() + .contains(&key.as_str()) + }) + .map(|(key, value)| (key.clone(), value.clone())) + .collect() + } + + fn transform_transcription_request( + &self, + model: &str, + audio: Value, + optional_params: Map, + ) -> CoreResult; + + fn transform_transcription_response( + &self, + model: &str, + response_json: Value, + ) -> CoreResult; + + fn complete_url( + &self, + api_base: Option<&str>, + model: &str, + optional_params: &Map, + env_lookup: &dyn Fn(&str) -> Option, + ) -> CoreResult; + + fn auth_strategy( + &self, + model: &str, + optional_params: &Map, + env_lookup: &dyn Fn(&str) -> Option, + ) -> CoreResult; +} diff --git a/litellm-rust/crates/core/src/audio_transcription/types.rs b/litellm-rust/crates/core/src/audio_transcription/types.rs new file mode 100644 index 00000000000..3a9e1ecd88c --- /dev/null +++ b/litellm-rust/crates/core/src/audio_transcription/types.rs @@ -0,0 +1,20 @@ +use serde::{Deserialize, Serialize}; +use serde_json::Value; + +#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)] +pub struct AudioTranscriptionRequestData { + pub body: Value, +} + +#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)] +pub struct AudioTranscriptionResponseData { + pub text: String, +} + +impl AudioTranscriptionResponseData { + pub fn into_json(self) -> Value { + serde_json::json!({ + "text": self.text, + }) + } +} diff --git a/litellm-rust/crates/core/src/caching/in_memory_cache.rs b/litellm-rust/crates/core/src/caching/in_memory_cache.rs new file mode 100644 index 00000000000..45d4bd69b79 --- /dev/null +++ b/litellm-rust/crates/core/src/caching/in_memory_cache.rs @@ -0,0 +1,258 @@ +use std::cmp::Reverse; +use std::collections::{BinaryHeap, HashMap}; +use std::time::{Duration, SystemTime, UNIX_EPOCH}; + +const DEFAULT_MAX_SIZE_IN_MEMORY: usize = 200; +const DEFAULT_TTL: Duration = Duration::from_secs(600); + +pub struct InMemoryCache { + pub cache_dict: HashMap, + pub ttl_dict: HashMap, + pub expiration_heap: BinaryHeap>, + pub max_size_in_memory: usize, + pub default_ttl: Duration, + now: Box Duration + Send + Sync>, +} + +impl Default for InMemoryCache { + fn default() -> Self { + Self::new(None, None) + } +} + +impl InMemoryCache { + pub fn new(max_size_in_memory: Option, default_ttl: Option) -> Self { + Self::with_clock(max_size_in_memory, default_ttl, || { + SystemTime::now() + .duration_since(UNIX_EPOCH) + .unwrap_or_default() + }) + } + + pub fn with_clock( + max_size_in_memory: Option, + default_ttl: Option, + now: impl Fn() -> Duration + Send + Sync + 'static, + ) -> Self { + Self { + cache_dict: HashMap::new(), + ttl_dict: HashMap::new(), + expiration_heap: BinaryHeap::new(), + max_size_in_memory: max_size_in_memory.unwrap_or(DEFAULT_MAX_SIZE_IN_MEMORY), + default_ttl: default_ttl.unwrap_or(DEFAULT_TTL), + now: Box::new(now), + } + } + + pub fn evict_cache(&mut self) { + if self.max_size_in_memory == 0 { + return; + } + + let current_time = (self.now)(); + while let Some(Reverse((expiration_time, key))) = self.expiration_heap.peek().cloned() { + if self.ttl_dict.get(&key).copied() != Some(expiration_time) { + self.expiration_heap.pop(); + } else if expiration_time <= current_time { + self.expiration_heap.pop(); + self.remove_key(&key); + } else { + break; + } + } + + while self.cache_dict.len() >= self.max_size_in_memory { + let Some(Reverse((expiration_time, key))) = self.expiration_heap.pop() else { + break; + }; + if self.ttl_dict.get(&key).copied() == Some(expiration_time) { + self.remove_key(&key); + } + } + } + + pub fn allow_ttl_override(&self, key: &str) -> bool { + match self.ttl_dict.get(key).copied() { + None => true, + Some(expiration_time) => expiration_time < (self.now)(), + } + } + + pub fn set_cache(&mut self, key: impl Into, value: V, ttl: Option) { + if self.max_size_in_memory == 0 { + return; + } + + self.evict_cache(); + let key = key.into(); + self.cache_dict.insert(key.clone(), value); + if self.allow_ttl_override(&key) { + let expiration_time = (self.now)() + ttl.unwrap_or(self.default_ttl); + self.ttl_dict.insert(key.clone(), expiration_time); + self.expiration_heap.push(Reverse((expiration_time, key))); + } + } + + // Generic values intentionally omit Python's per-item size check. + pub fn get_cache(&mut self, key: &str) -> Option { + if self.cache_dict.contains_key(key) { + if self.is_key_expired(key) { + self.remove_key(key); + return None; + } + return self.cache_dict.get(key).cloned(); + } + None + } + + pub fn get_ttl(&self, key: &str) -> Option { + self.ttl_dict.get(key).copied() + } + + pub fn delete_cache(&mut self, key: &str) { + self.remove_key(key); + } + + pub fn flush_cache(&mut self) { + self.cache_dict.clear(); + self.ttl_dict.clear(); + self.expiration_heap.clear(); + } + + fn is_key_expired(&self, key: &str) -> bool { + self.ttl_dict + .get(key) + .is_some_and(|expiration_time| *expiration_time < (self.now)()) + } + + fn remove_key(&mut self, key: &str) { + self.cache_dict.remove(key); + self.ttl_dict.remove(key); + } +} + +#[cfg(test)] +mod tests { + use std::sync::{ + Arc, + atomic::{AtomicU64, Ordering}, + }; + + use super::InMemoryCache; + use std::time::Duration; + + fn cache(now: Arc, max_size: usize, default_ttl: Duration) -> InMemoryCache { + InMemoryCache::with_clock(Some(max_size), Some(default_ttl), move || { + Duration::from_secs(now.load(Ordering::Relaxed)) + }) + } + + #[test] + fn ttl_expiry_is_deterministic() { + let now = Arc::new(AtomicU64::new(100)); + let mut cache = cache(now.clone(), 10, Duration::from_secs(60)); + cache.set_cache("key", "value".to_string(), None); + assert_eq!(cache.get_cache("key"), Some("value".to_string())); + now.store(161, Ordering::Relaxed); + assert_eq!(cache.get_cache("key"), None); + assert_eq!(cache.get_ttl("key"), None); + } + + #[test] + fn default_and_per_set_ttl_are_applied() { + let now = Arc::new(AtomicU64::new(100)); + let mut cache = cache(now.clone(), 10, Duration::from_secs(60)); + cache.set_cache("default", "value".to_string(), None); + cache.set_cache("custom", "value".to_string(), Some(Duration::from_secs(20))); + assert_eq!(cache.get_ttl("default"), Some(Duration::from_secs(160))); + assert_eq!(cache.get_ttl("custom"), Some(Duration::from_secs(120))); + } + + #[test] + fn unexpired_entries_do_not_allow_ttl_override() { + let now = Arc::new(AtomicU64::new(100)); + let mut cache = cache(now.clone(), 10, Duration::from_secs(60)); + cache.set_cache("key", "first".to_string(), Some(Duration::from_secs(20))); + cache.set_cache("key", "second".to_string(), Some(Duration::from_secs(80))); + assert_eq!(cache.get_cache("key"), Some("second".to_string())); + assert_eq!(cache.get_ttl("key"), Some(Duration::from_secs(120))); + now.store(121, Ordering::Relaxed); + cache.set_cache("key", "third".to_string(), Some(Duration::from_secs(80))); + assert_eq!(cache.get_ttl("key"), Some(Duration::from_secs(201))); + } + + #[test] + fn max_size_evicts_earliest_expiration() { + let now = Arc::new(AtomicU64::new(100)); + let mut cache = cache(now, 2, Duration::from_secs(60)); + cache.set_cache("early", "value".to_string(), Some(Duration::from_secs(10))); + cache.set_cache("late", "value".to_string(), Some(Duration::from_secs(20))); + cache.set_cache("new", "value".to_string(), Some(Duration::from_secs(30))); + assert_eq!(cache.get_cache("early"), None); + assert!(cache.get_cache("late").is_some()); + assert!(cache.get_cache("new").is_some()); + } + + #[test] + fn expired_entries_are_evicted_before_live_entries() { + let now = Arc::new(AtomicU64::new(100)); + let mut cache = cache(now.clone(), 3, Duration::from_secs(60)); + cache.set_cache( + "expired-one", + "value".to_string(), + Some(Duration::from_secs(10)), + ); + cache.set_cache( + "expired-two", + "value".to_string(), + Some(Duration::from_secs(20)), + ); + cache.set_cache("live", "value".to_string(), Some(Duration::from_secs(100))); + now.store(121, Ordering::Relaxed); + cache.set_cache("new", "value".to_string(), Some(Duration::from_secs(100))); + assert_eq!(cache.get_cache("expired-one"), None); + assert_eq!(cache.get_cache("expired-two"), None); + assert!(cache.get_cache("live").is_some()); + assert!(cache.get_cache("new").is_some()); + } + + #[test] + fn stale_heap_entries_are_skipped() { + let now = Arc::new(AtomicU64::new(100)); + let mut cache = cache(now, 1, Duration::from_secs(60)); + cache.set_cache( + "removed", + "value".to_string(), + Some(Duration::from_secs(10)), + ); + cache.delete_cache("removed"); + cache.set_cache("kept", "value".to_string(), Some(Duration::from_secs(20))); + cache.set_cache("new", "value".to_string(), Some(Duration::from_secs(30))); + assert_eq!(cache.get_cache("removed"), None); + assert_eq!(cache.get_cache("kept"), None); + assert!(cache.get_cache("new").is_some()); + } + + #[test] + fn delete_and_flush_remove_values_and_ttls() { + let now = Arc::new(AtomicU64::new(100)); + let mut cache = cache(now, 10, Duration::from_secs(60)); + cache.set_cache("one", "value".to_string(), None); + cache.set_cache("two", "value".to_string(), None); + cache.delete_cache("one"); + assert_eq!(cache.get_cache("one"), None); + cache.flush_cache(); + assert!(cache.cache_dict.is_empty()); + assert!(cache.ttl_dict.is_empty()); + assert!(cache.expiration_heap.is_empty()); + } + + #[test] + fn zero_max_size_does_not_cache() { + let now = Arc::new(AtomicU64::new(100)); + let mut cache = cache(now, 0, Duration::from_secs(60)); + cache.set_cache("key", "value".to_string(), None); + assert_eq!(cache.get_cache("key"), None); + assert!(cache.cache_dict.is_empty()); + } +} diff --git a/litellm-rust/crates/core/src/caching/mod.rs b/litellm-rust/crates/core/src/caching/mod.rs new file mode 100644 index 00000000000..5fb8a0e5174 --- /dev/null +++ b/litellm-rust/crates/core/src/caching/mod.rs @@ -0,0 +1 @@ +pub mod in_memory_cache; diff --git a/litellm-rust/crates/core/src/constants.rs b/litellm-rust/crates/core/src/constants.rs new file mode 100644 index 00000000000..caada1d98b0 --- /dev/null +++ b/litellm-rust/crates/core/src/constants.rs @@ -0,0 +1,19 @@ +pub const OPENAI_DEFAULT_API_BASE: &str = "https://api.openai.com"; +pub const OPENAI_RESPONSES_DEFAULT_API_BASE: &str = "https://api.openai.com/v1"; +pub const OPENAI_RESPONSES_PATH: &str = "/responses"; + +/// Full-request timeout ceiling for Anthropic Messages provider calls, in +/// seconds. Mirrors the Python Anthropic Messages default. The per-request +/// timeout from the caller still overrides this on the request builder. +pub(crate) const MESSAGES_TIMEOUT_SECS: u64 = 600; + +/// Connect timeout for Anthropic Messages provider calls, in seconds. +pub(crate) const MESSAGES_CONNECT_TIMEOUT_SECS: u64 = 10; + +/// Max characters of an upstream error body echoed across the call boundary +/// before truncation, so provider bodies are bounded and data-minimized. +pub(crate) const MESSAGES_ERROR_BODY_MAX_CHARS: usize = 256; + +/// Provider name used for Anthropic Messages when a deployment's provider model +/// does not carry an explicit provider prefix. +pub const ANTHROPIC_MESSAGES_PROVIDER: &str = "anthropic"; diff --git a/litellm-rust/crates/core/src/error.rs b/litellm-rust/crates/core/src/error.rs index b3e0519b772..c2b08eee0c0 100644 --- a/litellm-rust/crates/core/src/error.rs +++ b/litellm-rust/crates/core/src/error.rs @@ -19,9 +19,9 @@ pub enum CoreError { InvalidRequest(String), #[error("{0}")] Auth(String), - #[error("OCR request failed with status {status}: {body}")] + #[error("upstream request failed with status {status}: {body}")] Http { status: u16, body: String }, - #[error("OCR network error: {0}")] + #[error("upstream network error: {0}")] Network(String), #[error("routing error: {0}")] Routing(String), diff --git a/litellm-rust/crates/core/src/lib.rs b/litellm-rust/crates/core/src/lib.rs index 555a04ce853..51ea19750ea 100644 --- a/litellm-rust/crates/core/src/lib.rs +++ b/litellm-rust/crates/core/src/lib.rs @@ -1,8 +1,13 @@ +pub mod audio_transcription; +pub mod caching; pub mod call_lifecycle; +pub mod constants; pub mod error; +pub mod messages; pub mod ocr; pub mod providers; pub mod realtime; +pub mod responses; pub mod router; pub mod routing_utils; diff --git a/litellm-rust/crates/core/src/messages/client.rs b/litellm-rust/crates/core/src/messages/client.rs new file mode 100644 index 00000000000..6281270b964 --- /dev/null +++ b/litellm-rust/crates/core/src/messages/client.rs @@ -0,0 +1,15 @@ +use std::sync::OnceLock; +use std::time::Duration; + +use crate::constants::{MESSAGES_CONNECT_TIMEOUT_SECS, MESSAGES_TIMEOUT_SECS}; + +pub(super) fn http_client() -> &'static reqwest::Client { + static CLIENT: OnceLock = OnceLock::new(); + CLIENT.get_or_init(|| { + reqwest::Client::builder() + .timeout(Duration::from_secs(MESSAGES_TIMEOUT_SECS)) + .connect_timeout(Duration::from_secs(MESSAGES_CONNECT_TIMEOUT_SECS)) + .build() + .unwrap_or_else(|_| reqwest::Client::new()) + }) +} diff --git a/litellm-rust/crates/core/src/messages/common_utils.rs b/litellm-rust/crates/core/src/messages/common_utils.rs new file mode 100644 index 00000000000..9dcfcaa71e3 --- /dev/null +++ b/litellm-rust/crates/core/src/messages/common_utils.rs @@ -0,0 +1,64 @@ +use serde_json::{Map, Value}; + +use crate::constants::MESSAGES_ERROR_BODY_MAX_CHARS; +use crate::error::{CoreError, CoreResult, json_type_name}; +use crate::providers::anthropic::messages::transformation::ANTHROPIC_MESSAGES_CONFIG; +use crate::providers::azure_ai::messages::transformation::AZURE_ANTHROPIC_MESSAGES_CONFIG; + +use super::transformation::AnthropicMessagesProviderConfig; + +pub(super) fn truncate_error_body(body: &str) -> String { + if body.chars().count() <= MESSAGES_ERROR_BODY_MAX_CHARS { + return body.to_string(); + } + let truncated: String = body.chars().take(MESSAGES_ERROR_BODY_MAX_CHARS).collect(); + format!("{truncated}... (truncated)") +} + +pub(super) fn messages_provider_config( + provider: &str, +) -> Option<&'static dyn AnthropicMessagesProviderConfig> { + match provider { + "anthropic" => Some(&ANTHROPIC_MESSAGES_CONFIG), + "azure_ai" => Some(&AZURE_ANTHROPIC_MESSAGES_CONFIG), + _ => None, + } +} + +pub(super) fn string_headers( + extra_headers: Option>, +) -> CoreResult> { + extra_headers + .unwrap_or_default() + .into_iter() + .map(|(key, value)| { + value + .as_str() + .map(|value| (key.clone(), value.to_string())) + .ok_or_else(|| { + CoreError::InvalidRequest(format!( + "messages extra_headers.{key} must be a string, got {}", + json_type_name(&value) + )) + }) + }) + .collect() +} + +pub(super) fn has_header(headers: &[(String, String)], name: &str) -> bool { + headers + .iter() + .any(|(key, _)| key.eq_ignore_ascii_case(name)) +} + +pub(super) fn has_bearer_auth(headers: &[(String, String)]) -> bool { + headers.iter().any(|(name, value)| { + if !name.eq_ignore_ascii_case("authorization") { + return false; + } + let value = value.trim(); + value.len() > 7 + && value[..7].eq_ignore_ascii_case("bearer ") + && !value[7..].trim().is_empty() + }) +} diff --git a/litellm-rust/crates/core/src/messages/handler.rs b/litellm-rust/crates/core/src/messages/handler.rs new file mode 100644 index 00000000000..1c895f66eba --- /dev/null +++ b/litellm-rust/crates/core/src/messages/handler.rs @@ -0,0 +1,76 @@ +use crate::constants::ANTHROPIC_MESSAGES_PROVIDER; +use crate::error::{CoreError, CoreResult}; + +use super::client::http_client; +use super::common_utils::truncate_error_body; +use super::types::{AnthropicMessagesResponse, ProviderMessagesRequest}; + +pub(super) async fn execute_messages_provider_call( + request: ProviderMessagesRequest, +) -> CoreResult { + let mut request_builder = http_client().post(&request.url).json(&request.body); + for (key, value) in &request.upstream_headers { + request_builder = request_builder.header(key, value); + } + if let Some(duration) = request.timeout { + request_builder = request_builder.timeout(duration); + } + + let response = request_builder + .send() + .await + .map_err(|err| CoreError::Network(err.to_string()))?; + + let status = response.status(); + let text = response + .text() + .await + .map_err(|err| CoreError::Network(err.to_string()))?; + + if !status.is_success() { + return Err(CoreError::Http { + status: status.as_u16(), + body: truncate_error_body(&text), + }); + } + + let response = serde_json::from_str(&text).map_err(|err| { + CoreError::InvalidResponse(format!("invalid messages response JSON: {err}")) + })?; + request.config.transform_response(&request.model, response) +} + +pub(super) async fn execute_messages_provider_stream( + request: ProviderMessagesRequest, +) -> CoreResult { + if request.provider != ANTHROPIC_MESSAGES_PROVIDER { + return Err(CoreError::InvalidRequest( + "streaming messages is not supported for this provider".to_string(), + )); + } + + let mut request_builder = http_client().post(&request.url).json(&request.body); + for (key, value) in &request.upstream_headers { + request_builder = request_builder.header(key, value); + } + if let Some(duration) = request.timeout { + request_builder = request_builder.timeout(duration); + } + + let response = request_builder + .send() + .await + .map_err(|err| CoreError::Network(err.to_string()))?; + let status = response.status(); + if !status.is_success() { + let text = response + .text() + .await + .map_err(|err| CoreError::Network(err.to_string()))?; + return Err(CoreError::Http { + status: status.as_u16(), + body: truncate_error_body(&text), + }); + } + Ok(response) +} diff --git a/litellm-rust/crates/core/src/messages/mod.rs b/litellm-rust/crates/core/src/messages/mod.rs new file mode 100644 index 00000000000..acb36d89daf --- /dev/null +++ b/litellm-rust/crates/core/src/messages/mod.rs @@ -0,0 +1,32 @@ +//! The Anthropic Messages call, the Rust equivalent of Python's +//! `litellm.messages()`. +//! +//! [`messages`] is the top-level entrypoint: give it a model, a body, and +//! credentials, and it resolves the provider, transforms the request, calls the +//! provider, and returns a typed non-streaming response. [`messages_stream`] +//! is the streaming variant; it hands the raw upstream response back so a host +//! can splice the event stream to its own caller. + +mod client; +mod common_utils; +mod handler; +mod prepare; +pub mod transformation; +pub mod types; + +use crate::error::CoreResult; + +use handler::{execute_messages_provider_call, execute_messages_provider_stream}; +use prepare::prepare_messages_call; +use types::{AnthropicMessagesResponse, MessagesRequest}; + +pub async fn messages(request: MessagesRequest<'_>) -> CoreResult { + execute_messages_provider_call(prepare_messages_call(request)?).await +} + +pub async fn messages_stream(request: MessagesRequest<'_>) -> CoreResult { + execute_messages_provider_stream(prepare_messages_call(request)?).await +} + +#[cfg(test)] +mod tests; diff --git a/litellm-rust/crates/core/src/messages/prepare.rs b/litellm-rust/crates/core/src/messages/prepare.rs new file mode 100644 index 00000000000..94b5b1eaed7 --- /dev/null +++ b/litellm-rust/crates/core/src/messages/prepare.rs @@ -0,0 +1,74 @@ +use crate::error::{CoreError, CoreResult}; +use crate::routing_utils::provider::{CustomLlmProvider, get_custom_llm_provider}; + +use super::common_utils::{has_bearer_auth, has_header, messages_provider_config, string_headers}; +use super::transformation::MessagesAuthStrategy; +use super::types::{MessagesRequest, ProviderMessagesRequest}; + +pub(super) fn prepare_messages_call( + request: MessagesRequest<'_>, +) -> CoreResult { + let provider_info = get_custom_llm_provider(request.model, request.custom_llm_provider) + .or_else(|| { + request + .custom_llm_provider + .map(|provider| CustomLlmProvider { + model: request.model, + custom_llm_provider: provider, + }) + }) + .ok_or_else(|| { + CoreError::InvalidProvider( + "unable to resolve custom_llm_provider for messages request".to_string(), + ) + })?; + let model = provider_info.model.to_string(); + let provider = provider_info.custom_llm_provider; + + let config = messages_provider_config(provider) + .ok_or_else(|| CoreError::InvalidProvider(provider.to_string()))?; + let env_lookup = |key: &str| std::env::var(key).ok(); + + let mut headers = string_headers(request.extra_headers)?; + + let auth_strategy = config.auth_strategy(); + let already_authorized = has_header(&headers, auth_strategy.header_name()) + || (config.accepts_bearer_auth() && has_bearer_auth(&headers)); + if !already_authorized { + let api_key = config.resolve_api_key(request.api_key, &env_lookup)?; + let auth_header = match auth_strategy { + MessagesAuthStrategy::Bearer => { + ("authorization".to_string(), format!("Bearer {api_key}")) + } + MessagesAuthStrategy::Header(name) => (name.to_string(), api_key), + }; + headers.push(auth_header); + } + + for (name, value) in config.default_headers() { + if !has_header(&headers, name) { + headers.push((name.to_string(), value.to_string())); + } + } + + let url = config.complete_url(request.api_base, &model, &env_lookup)?; + let typed_request = serde_json::from_value(request.body).map_err(|err| { + CoreError::InvalidRequest(format!("invalid Anthropic messages request: {err}")) + })?; + let transformed = config.transform_request(typed_request)?; + let body = serde_json::to_value(transformed).map_err(|err| { + CoreError::InvalidRequest(format!( + "failed to serialize Anthropic messages request: {err}" + )) + })?; + + Ok(ProviderMessagesRequest { + provider: provider.to_string(), + model, + config, + url, + body, + upstream_headers: headers, + timeout: request.timeout, + }) +} diff --git a/litellm-rust/crates/core/src/messages/tests.rs b/litellm-rust/crates/core/src/messages/tests.rs new file mode 100644 index 00000000000..9fc1763683b --- /dev/null +++ b/litellm-rust/crates/core/src/messages/tests.rs @@ -0,0 +1,441 @@ +use std::time::Duration; + +use serde_json::{Map, Value, json}; +use tokio::io::{AsyncReadExt, AsyncWriteExt}; +use tokio::net::{TcpListener, TcpStream}; + +use crate::error::CoreError; + +use super::common_utils::{ + has_bearer_auth, has_header, messages_provider_config, string_headers, truncate_error_body, +}; +use super::messages; +use super::types::MessagesRequest; + +async fn read_http_request(socket: &mut TcpStream) -> String { + let mut request = Vec::new(); + let mut buffer = [0_u8; 1024]; + let header_end = loop { + let n = socket.read(&mut buffer).await.expect("reads request"); + if n == 0 { + break request.len(); + } + request.extend_from_slice(&buffer[..n]); + if let Some(position) = request.windows(4).position(|window| window == b"\r\n\r\n") { + break position + 4; + } + }; + let headers = String::from_utf8_lossy(&request[..header_end]); + let content_length = headers + .lines() + .find_map(|line| { + let (name, value) = line.split_once(':')?; + name.eq_ignore_ascii_case("content-length") + .then(|| value.trim().parse::().ok()) + .flatten() + }) + .unwrap_or(0); + while request.len().saturating_sub(header_end) < content_length { + let n = socket.read(&mut buffer).await.expect("reads body"); + if n == 0 { + break; + } + request.extend_from_slice(&buffer[..n]); + } + String::from_utf8(request).expect("request is utf8") +} + +fn write_response(body: &str) -> String { + format!( + "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{}", + body.len(), + body + ) +} + +#[test] +fn provider_config_resolves_anthropic_and_azure_ai() { + assert!(messages_provider_config("anthropic").is_some()); + assert!(messages_provider_config("azure_ai").is_some()); + assert!(messages_provider_config("openai").is_none()); +} + +#[test] +fn truncate_error_body_caps_long_payloads() { + let body = "x".repeat(400); + let truncated = truncate_error_body(&body); + assert!(truncated.ends_with("... (truncated)")); + let prefix_chars = truncated + .strip_suffix("... (truncated)") + .expect("truncated marker present") + .chars() + .count(); + assert_eq!(prefix_chars, 256); +} + +#[test] +fn string_headers_rejects_non_string_values() { + let headers = json!({"x-count": 3}).as_object().unwrap().clone(); + let err = string_headers(Some(headers)).expect_err("non-string header rejected"); + assert!(matches!(err, CoreError::InvalidRequest(_))); +} + +#[test] +fn has_header_is_case_insensitive() { + let headers = vec![("X-Api-Key".to_string(), "secret".to_string())]; + assert!(has_header(&headers, "x-api-key")); + assert!(!has_header(&headers, "authorization")); +} + +#[test] +fn has_bearer_auth_requires_a_nonempty_bearer_token() { + assert!(has_bearer_auth(&[( + "Authorization".to_string(), + "Bearer tok".to_string() + )])); + assert!(has_bearer_auth(&[( + "authorization".to_string(), + "bearer tok".to_string() + )])); + assert!(!has_bearer_auth(&[( + "authorization".to_string(), + "Bearer ".to_string() + )])); + assert!(!has_bearer_auth(&[( + "authorization".to_string(), + String::new() + )])); + assert!(!has_bearer_auth(&[( + "authorization".to_string(), + "Basic abc".to_string() + )])); + assert!(!has_bearer_auth(&[( + "x-api-key".to_string(), + "sk".to_string() + )])); +} + +#[tokio::test] +async fn messages_round_trip_builds_azure_request_and_passes_response_through() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds"); + let addr = listener.local_addr().expect("addr"); + + let server = tokio::spawn(async move { + let (mut socket, _) = listener.accept().await.expect("accepts request"); + let request = read_http_request(&mut socket).await; + let response_body = r#"{"id":"msg_1","type":"message","role":"assistant","content":[{"type":"text","text":"hi"}],"model":"claude-sonnet-4-5","stop_reason":"end_turn","usage":{"input_tokens":1,"output_tokens":2}}"#; + socket + .write_all(write_response(response_body).as_bytes()) + .await + .expect("writes response"); + request + }); + + let response = messages(MessagesRequest { + model: "claude-sonnet-4-5", + body: json!({ + "model": "claude-sonnet-4-5", + "max_tokens": 1024, + "messages": [{ + "role": "user", + "content": [{ + "type": "text", + "text": "hi", + "cache_control": {"type": "ephemeral", "scope": "global"} + }] + }] + }), + api_key: Some("sk-azure"), + api_base: Some(&format!("http://{addr}")), + custom_llm_provider: Some("azure_ai"), + extra_headers: None, + timeout: Some(Duration::from_secs(5)), + }) + .await + .expect("messages request succeeds"); + + assert_eq!(response.content[0]["text"], "hi"); + assert_eq!(response.stop_reason.as_deref(), Some("end_turn")); + + let request = server.await.expect("server task completes"); + let (head, body) = request.split_once("\r\n\r\n").expect("has body"); + assert!(head.starts_with("POST /anthropic/v1/messages "), "{head}"); + let head_lower = head.to_ascii_lowercase(); + assert!(head_lower.contains("x-api-key: sk-azure"), "{head}"); + assert!( + head_lower.contains("anthropic-version: 2023-06-01"), + "{head}" + ); + assert!( + head_lower.contains("content-type: application/json"), + "{head}" + ); + + let sent_body: Value = serde_json::from_str(body).expect("body is json"); + assert_eq!( + sent_body["messages"][0]["content"][0]["cache_control"], + json!({"type": "ephemeral"}) + ); +} + +#[tokio::test] +async fn messages_round_trip_builds_native_anthropic_request() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds"); + let addr = listener.local_addr().expect("addr"); + + let server = tokio::spawn(async move { + let (mut socket, _) = listener.accept().await.expect("accepts request"); + let request = read_http_request(&mut socket).await; + let response_body = r#"{"id":"msg_1","type":"message","role":"assistant","content":[{"type":"text","text":"hi"}],"model":"claude-sonnet-4-5","stop_reason":"end_turn","usage":{"input_tokens":1,"output_tokens":2}}"#; + socket + .write_all(write_response(response_body).as_bytes()) + .await + .expect("writes response"); + request + }); + + let response = messages(MessagesRequest { + model: "claude-sonnet-4-5", + body: json!({ + "model": "claude-sonnet-4-5", + "max_tokens": 1024, + "messages": [{"role": "user", "content": "hi"}] + }), + api_key: Some("sk-ant"), + api_base: Some(&format!("http://{addr}")), + custom_llm_provider: Some("anthropic"), + extra_headers: None, + timeout: Some(Duration::from_secs(5)), + }) + .await + .expect("messages request succeeds"); + + assert_eq!(response.content[0]["text"], "hi"); + assert_eq!(response.stop_reason.as_deref(), Some("end_turn")); + + let request = server.await.expect("server task completes"); + let (head, _) = request.split_once("\r\n\r\n").expect("has body"); + assert!(head.starts_with("POST /v1/messages "), "{head}"); + let head_lower = head.to_ascii_lowercase(); + assert!(head_lower.contains("x-api-key: sk-ant"), "{head}"); + assert!( + head_lower.contains("anthropic-version: 2023-06-01"), + "{head}" + ); +} + +#[tokio::test] +async fn messages_does_not_duplicate_auth_when_x_api_key_supplied() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds"); + let addr = listener.local_addr().expect("addr"); + + let server = tokio::spawn(async move { + let (mut socket, _) = listener.accept().await.expect("accepts request"); + let request = read_http_request(&mut socket).await; + let response_body = + r#"{"id":"msg_2","type":"message","role":"assistant","content":[],"model":"m"}"#; + socket + .write_all(write_response(response_body).as_bytes()) + .await + .expect("writes response"); + request + }); + + let mut headers = Map::new(); + headers.insert( + "x-api-key".to_string(), + Value::String("from-python".to_string()), + ); + headers.insert( + "anthropic-beta".to_string(), + Value::String("token-efficient-tools-2025-02-19".to_string()), + ); + + messages(MessagesRequest { + model: "claude-sonnet-4-5", + body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}), + api_key: Some("rust-fallback-key"), + api_base: Some(&format!("http://{addr}")), + custom_llm_provider: Some("azure_ai"), + extra_headers: Some(headers), + timeout: Some(Duration::from_secs(5)), + }) + .await + .expect("messages request succeeds"); + + let request = server.await.expect("server task completes"); + let head = request + .split_once("\r\n\r\n") + .expect("has body") + .0 + .to_ascii_lowercase(); + let api_key_count = head + .lines() + .filter(|line| line.starts_with("x-api-key:")) + .count(); + assert_eq!(api_key_count, 1, "{head}"); + assert!(head.contains("x-api-key: from-python"), "{head}"); + assert!( + head.contains("anthropic-beta: token-efficient-tools-2025-02-19"), + "{head}" + ); + assert!(!head.contains("rust-fallback-key"), "{head}"); +} + +#[tokio::test] +async fn messages_forwards_entra_id_bearer_without_requiring_api_key() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds"); + let addr = listener.local_addr().expect("addr"); + + let server = tokio::spawn(async move { + let (mut socket, _) = listener.accept().await.expect("accepts request"); + let request = read_http_request(&mut socket).await; + let response_body = + r#"{"id":"msg_3","type":"message","role":"assistant","content":[],"model":"m"}"#; + socket + .write_all(write_response(response_body).as_bytes()) + .await + .expect("writes response"); + request + }); + + let mut headers = Map::new(); + headers.insert( + "Authorization".to_string(), + Value::String("Bearer entra-token".to_string()), + ); + + messages(MessagesRequest { + model: "claude-sonnet-4-5", + body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}), + api_key: None, + api_base: Some(&format!("http://{addr}")), + custom_llm_provider: Some("azure_ai"), + extra_headers: Some(headers), + timeout: Some(Duration::from_secs(5)), + }) + .await + .expect("entra id request succeeds without api key"); + + let request = server.await.expect("server task completes"); + let head = request + .split_once("\r\n\r\n") + .expect("has body") + .0 + .to_ascii_lowercase(); + assert!(head.contains("authorization: bearer entra-token"), "{head}"); + assert!(!head.contains("x-api-key"), "{head}"); +} + +#[tokio::test] +async fn messages_requires_auth_when_no_key_and_no_header() { + let err = messages(MessagesRequest { + model: "claude-sonnet-4-5", + body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}), + api_key: None, + api_base: Some("http://127.0.0.1:1"), + custom_llm_provider: Some("azure_ai"), + extra_headers: None, + timeout: Some(Duration::from_millis(50)), + }) + .await + .expect_err("missing auth errors"); + + assert!(matches!(err, CoreError::Auth(_))); +} + +#[tokio::test] +async fn messages_ignores_malformed_authorization_and_uses_api_key() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds"); + let addr = listener.local_addr().expect("addr"); + + let server = tokio::spawn(async move { + let (mut socket, _) = listener.accept().await.expect("accepts request"); + let request = read_http_request(&mut socket).await; + let response_body = + r#"{"id":"msg_4","type":"message","role":"assistant","content":[],"model":"m"}"#; + socket + .write_all(write_response(response_body).as_bytes()) + .await + .expect("writes response"); + request + }); + + let mut headers = Map::new(); + headers.insert( + "Authorization".to_string(), + Value::String("Bearer ".to_string()), + ); + + messages(MessagesRequest { + model: "claude-sonnet-4-5", + body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}), + api_key: Some("sk-azure"), + api_base: Some(&format!("http://{addr}")), + custom_llm_provider: Some("azure_ai"), + extra_headers: Some(headers), + timeout: Some(Duration::from_secs(5)), + }) + .await + .expect("falls back to api key"); + + let request = server.await.expect("server task completes"); + let head = request + .split_once("\r\n\r\n") + .expect("has body") + .0 + .to_ascii_lowercase(); + assert!(head.contains("x-api-key: sk-azure"), "{head}"); +} + +#[tokio::test] +async fn messages_maps_provider_error_status_to_http_error() { + let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds"); + let addr = listener.local_addr().expect("addr"); + + tokio::spawn(async move { + let (mut socket, _) = listener.accept().await.expect("accepts request"); + let _ = read_http_request(&mut socket).await; + let body = "unauthorized"; + let response = format!( + "HTTP/1.1 401 Unauthorized\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{}", + body.len(), + body + ); + socket + .write_all(response.as_bytes()) + .await + .expect("writes response"); + }); + + let err = messages(MessagesRequest { + model: "claude-sonnet-4-5", + body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}), + api_key: Some("sk-azure"), + api_base: Some(&format!("http://{addr}")), + custom_llm_provider: Some("azure_ai"), + extra_headers: None, + timeout: Some(Duration::from_secs(5)), + }) + .await + .expect_err("provider error propagates"); + + assert!(matches!(err, CoreError::Http { status: 401, .. })); +} + +#[tokio::test] +async fn messages_rejects_unsupported_provider() { + let err = messages(MessagesRequest { + model: "claude-3-5-sonnet", + body: json!({"model": "claude-3-5-sonnet", "max_tokens": 8, "messages": []}), + api_key: Some("sk"), + api_base: Some("http://127.0.0.1:1"), + custom_llm_provider: Some("openai"), + extra_headers: None, + timeout: Some(Duration::from_millis(50)), + }) + .await + .expect_err("unsupported provider errors"); + + assert!(matches!(err, CoreError::InvalidProvider(provider) if provider == "openai")); +} diff --git a/litellm-rust/crates/core/src/messages/transformation.rs b/litellm-rust/crates/core/src/messages/transformation.rs new file mode 100644 index 00000000000..b478e20d24b --- /dev/null +++ b/litellm-rust/crates/core/src/messages/transformation.rs @@ -0,0 +1,63 @@ +use crate::error::CoreResult; + +use super::types::{AnthropicMessagesRequest, AnthropicMessagesResponse}; + +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +pub enum MessagesAuthStrategy { + Bearer, + Header(&'static str), +} + +impl MessagesAuthStrategy { + pub fn header_name(self) -> &'static str { + match self { + Self::Bearer => "authorization", + Self::Header(header_name) => header_name, + } + } +} + +pub trait AnthropicMessagesProviderConfig: Sync { + fn complete_url( + &self, + api_base: Option<&str>, + model: &str, + env_lookup: &dyn Fn(&str) -> Option, + ) -> CoreResult; + + fn resolve_api_key( + &self, + api_key: Option<&str>, + env_lookup: &dyn Fn(&str) -> Option, + ) -> CoreResult; + + fn auth_strategy(&self) -> MessagesAuthStrategy { + MessagesAuthStrategy::Header("x-api-key") + } + + fn accepts_bearer_auth(&self) -> bool { + false + } + + fn default_headers(&self) -> &'static [(&'static str, &'static str)] { + &[ + ("anthropic-version", "2023-06-01"), + ("content-type", "application/json"), + ] + } + + fn transform_request( + &self, + request: AnthropicMessagesRequest, + ) -> CoreResult { + Ok(request) + } + + fn transform_response( + &self, + _model: &str, + response: AnthropicMessagesResponse, + ) -> CoreResult { + Ok(response) + } +} diff --git a/litellm-rust/crates/core/src/messages/types.rs b/litellm-rust/crates/core/src/messages/types.rs new file mode 100644 index 00000000000..b9f807c29fd --- /dev/null +++ b/litellm-rust/crates/core/src/messages/types.rs @@ -0,0 +1,134 @@ +use std::time::Duration; + +use serde::{Deserialize, Serialize}; +use serde_json::{Map, Value}; + +use super::transformation::AnthropicMessagesProviderConfig; + +pub struct MessagesRequest<'a> { + pub model: &'a str, + pub body: Value, + pub api_key: Option<&'a str>, + pub api_base: Option<&'a str>, + pub custom_llm_provider: Option<&'a str>, + pub extra_headers: Option>, + pub timeout: Option, +} + +pub(super) struct ProviderMessagesRequest { + pub(super) provider: String, + pub(super) model: String, + pub(super) config: &'static dyn AnthropicMessagesProviderConfig, + pub(super) url: String, + pub(super) body: Value, + pub(super) upstream_headers: Vec<(String, String)>, + pub(super) timeout: Option, +} + +#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)] +#[serde(untagged)] +pub enum SystemPrompt { + Text(String), + Blocks(Vec), +} + +#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)] +#[serde(untagged)] +pub enum MessageContent { + Text(String), + Blocks(Vec), +} + +#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)] +pub struct ContentBlock { + #[serde(skip_serializing_if = "Option::is_none")] + pub cache_control: Option, + #[serde(flatten)] + pub extra: Map, +} + +#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)] +pub struct CacheControl { + #[serde(rename = "type", skip_serializing_if = "Option::is_none")] + pub cache_type: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub ttl: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub scope: Option, + #[serde(flatten)] + pub extra: Map, +} + +#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)] +pub struct AnthropicMessage { + pub role: String, + pub content: MessageContent, + #[serde(flatten)] + pub extra: Map, +} + +#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)] +pub struct AnthropicMessagesRequest { + pub model: String, + pub messages: Vec, + #[serde(skip_serializing_if = "Option::is_none")] + pub max_tokens: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub system: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub metadata: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub stop_sequences: Option>, + #[serde(skip_serializing_if = "Option::is_none")] + pub stream: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub temperature: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub top_p: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub top_k: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub tools: Option>, + #[serde(skip_serializing_if = "Option::is_none")] + pub tool_choice: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub thinking: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub service_tier: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub container: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub mcp_servers: Option>, + #[serde(skip_serializing_if = "Option::is_none")] + pub context_management: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub output_format: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub output_config: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub speed: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub inference_geo: Option, + #[serde(flatten)] + pub extra: Map, +} + +#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)] +pub struct AnthropicMessagesResponse { + pub id: String, + #[serde(rename = "type")] + pub message_type: String, + pub role: String, + pub model: String, + pub content: Vec, + // Anthropic always includes stop_reason / stop_sequence, null until the turn + // ends; serialize them even when None so callers see the same shape as Python. + pub stop_reason: Option, + pub stop_sequence: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub usage: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub container: Option, + #[serde(flatten)] + pub extra: Map, +} diff --git a/litellm-rust/crates/core/src/providers/anthropic/messages/mod.rs b/litellm-rust/crates/core/src/providers/anthropic/messages/mod.rs new file mode 100644 index 00000000000..f239b6921fa --- /dev/null +++ b/litellm-rust/crates/core/src/providers/anthropic/messages/mod.rs @@ -0,0 +1 @@ +pub mod transformation; diff --git a/litellm-rust/crates/core/src/providers/anthropic/messages/transformation.rs b/litellm-rust/crates/core/src/providers/anthropic/messages/transformation.rs new file mode 100644 index 00000000000..829f2260d3c --- /dev/null +++ b/litellm-rust/crates/core/src/providers/anthropic/messages/transformation.rs @@ -0,0 +1,142 @@ +use crate::error::{CoreError, CoreResult}; +use crate::messages::transformation::{AnthropicMessagesProviderConfig, MessagesAuthStrategy}; + +const ANTHROPIC_API_KEY_ENV: &str = "ANTHROPIC_API_KEY"; +const ANTHROPIC_API_BASE_ENV: &str = "ANTHROPIC_API_BASE"; +const DEFAULT_ANTHROPIC_API_BASE: &str = "https://api.anthropic.com"; +const MESSAGES_PATH_SUFFIX: &str = "/v1/messages"; + +pub struct AnthropicMessagesConfig; + +pub const ANTHROPIC_MESSAGES_CONFIG: AnthropicMessagesConfig = AnthropicMessagesConfig; + +pub fn non_empty(value: Option<&str>) -> Option<&str> { + value.map(str::trim).filter(|value| !value.is_empty()) +} + +pub fn resolve_anthropic_api_key( + api_key: Option<&str>, + env_lookup: &dyn Fn(&str) -> Option, +) -> CoreResult { + non_empty(api_key) + .map(str::to_string) + .or_else(|| env_lookup(ANTHROPIC_API_KEY_ENV).filter(|value| !value.trim().is_empty())) + .ok_or_else(|| { + CoreError::Auth( + "Missing Anthropic API Key - Set `api_key` or the ANTHROPIC_API_KEY \ + environment variable" + .to_string(), + ) + }) +} + +pub fn complete_anthropic_url( + api_base: Option<&str>, + env_lookup: &dyn Fn(&str) -> Option, +) -> String { + let api_base = non_empty(api_base) + .map(str::to_string) + .or_else(|| env_lookup(ANTHROPIC_API_BASE_ENV).filter(|value| !value.trim().is_empty())) + .unwrap_or_else(|| DEFAULT_ANTHROPIC_API_BASE.to_string()); + + let api_base = api_base.trim_end_matches('/'); + if api_base.ends_with(MESSAGES_PATH_SUFFIX) { + return api_base.to_string(); + } + format!("{api_base}{MESSAGES_PATH_SUFFIX}") +} + +impl AnthropicMessagesProviderConfig for AnthropicMessagesConfig { + fn complete_url( + &self, + api_base: Option<&str>, + _model: &str, + env_lookup: &dyn Fn(&str) -> Option, + ) -> CoreResult { + Ok(complete_anthropic_url(api_base, env_lookup)) + } + + fn resolve_api_key( + &self, + api_key: Option<&str>, + env_lookup: &dyn Fn(&str) -> Option, + ) -> CoreResult { + resolve_anthropic_api_key(api_key, env_lookup) + } + + fn auth_strategy(&self) -> MessagesAuthStrategy { + MessagesAuthStrategy::Header("x-api-key") + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn url_defaults_to_public_anthropic_endpoint() { + assert_eq!( + complete_anthropic_url(None, &|_| None), + "https://api.anthropic.com/v1/messages" + ); + } + + #[test] + fn url_appends_messages_suffix_to_custom_base() { + assert_eq!( + complete_anthropic_url(Some("https://proxy.internal"), &|_| None), + "https://proxy.internal/v1/messages" + ); + } + + #[test] + fn url_leaves_complete_messages_endpoint_untouched() { + assert_eq!( + complete_anthropic_url(Some("https://proxy.internal/v1/messages"), &|_| None), + "https://proxy.internal/v1/messages" + ); + } + + #[test] + fn url_falls_back_to_env_base() { + let with_env = |key: &str| { + (key == ANTHROPIC_API_BASE_ENV).then(|| "https://env.anthropic".to_string()) + }; + assert_eq!( + complete_anthropic_url(Some(" "), &with_env), + "https://env.anthropic/v1/messages" + ); + } + + #[test] + fn api_key_prefers_param_then_env_then_errors() { + assert_eq!( + resolve_anthropic_api_key(Some("sk-param"), &|_| None).unwrap(), + "sk-param" + ); + let with_env = |key: &str| (key == ANTHROPIC_API_KEY_ENV).then(|| "sk-env".to_string()); + assert_eq!( + resolve_anthropic_api_key(Some(" "), &with_env).unwrap(), + "sk-env" + ); + assert!(matches!( + resolve_anthropic_api_key(None, &|_| None).expect_err("missing key"), + CoreError::Auth(_) + )); + } + + #[test] + fn auth_strategy_and_default_headers_match_anthropic() { + assert_eq!( + ANTHROPIC_MESSAGES_CONFIG.auth_strategy().header_name(), + "x-api-key" + ); + assert_eq!( + ANTHROPIC_MESSAGES_CONFIG.default_headers(), + &[ + ("anthropic-version", "2023-06-01"), + ("content-type", "application/json"), + ] + ); + } +} diff --git a/litellm-rust/crates/core/src/providers/anthropic/mod.rs b/litellm-rust/crates/core/src/providers/anthropic/mod.rs new file mode 100644 index 00000000000..ba63992f3cb --- /dev/null +++ b/litellm-rust/crates/core/src/providers/anthropic/mod.rs @@ -0,0 +1 @@ +pub mod messages; diff --git a/litellm-rust/crates/core/src/providers/azure_ai/messages/mod.rs b/litellm-rust/crates/core/src/providers/azure_ai/messages/mod.rs new file mode 100644 index 00000000000..f239b6921fa --- /dev/null +++ b/litellm-rust/crates/core/src/providers/azure_ai/messages/mod.rs @@ -0,0 +1 @@ +pub mod transformation; diff --git a/litellm-rust/crates/core/src/providers/azure_ai/messages/transformation.rs b/litellm-rust/crates/core/src/providers/azure_ai/messages/transformation.rs new file mode 100644 index 00000000000..7b958c77ba3 --- /dev/null +++ b/litellm-rust/crates/core/src/providers/azure_ai/messages/transformation.rs @@ -0,0 +1,521 @@ +use crate::error::{CoreError, CoreResult}; +use crate::messages::transformation::{AnthropicMessagesProviderConfig, MessagesAuthStrategy}; +use crate::messages::types::{ + AnthropicMessage, AnthropicMessagesRequest, AnthropicMessagesResponse, ContentBlock, + MessageContent, SystemPrompt, +}; +use crate::providers::anthropic::messages::transformation::{ + ANTHROPIC_MESSAGES_CONFIG, AnthropicMessagesConfig, non_empty, +}; +use serde_json::{Map, Value}; + +const AZURE_API_KEY_ENV: &str = "AZURE_API_KEY"; +const AZURE_API_BASE_ENV: &str = "AZURE_API_BASE"; +const ANTHROPIC_PATH_SEGMENT: &str = "/anthropic"; +const MESSAGES_PATH_SUFFIX: &str = "/v1/messages"; +const SYSTEM_ROLE: &str = "system"; +const TEXT_BLOCK_TYPE: &str = "text"; + +pub struct AzureAnthropicMessagesConfig { + anthropic: AnthropicMessagesConfig, +} + +pub const AZURE_ANTHROPIC_MESSAGES_CONFIG: AzureAnthropicMessagesConfig = + AzureAnthropicMessagesConfig { + anthropic: ANTHROPIC_MESSAGES_CONFIG, + }; + +pub fn resolve_azure_api_key( + api_key: Option<&str>, + env_lookup: &dyn Fn(&str) -> Option, +) -> CoreResult { + non_empty(api_key) + .map(str::to_string) + .or_else(|| env_lookup(AZURE_API_KEY_ENV).filter(|value| !value.trim().is_empty())) + .ok_or_else(|| { + CoreError::Auth( + "Missing Azure API Key - Set `api_key` or the AZURE_API_KEY environment variable" + .to_string(), + ) + }) +} + +pub fn complete_azure_anthropic_url( + api_base: Option<&str>, + env_lookup: &dyn Fn(&str) -> Option, +) -> CoreResult { + let api_base = non_empty(api_base) + .map(str::to_string) + .or_else(|| env_lookup(AZURE_API_BASE_ENV).filter(|value| !value.trim().is_empty())) + .ok_or_else(|| { + CoreError::Auth( + "Missing Azure API Base - Set `api_base` or the AZURE_API_BASE environment variable. \ + Expected format: https://.services.ai.azure.com/anthropic" + .to_string(), + ) + })?; + + let api_base = api_base.trim_end_matches('/'); + + if api_base.ends_with(MESSAGES_PATH_SUFFIX) { + return Ok(api_base.to_string()); + } + + let with_anthropic = match api_base.split_once(ANTHROPIC_PATH_SEGMENT) { + Some((prefix, _)) => format!("{prefix}{ANTHROPIC_PATH_SEGMENT}"), + None => format!("{api_base}{ANTHROPIC_PATH_SEGMENT}"), + }; + Ok(format!("{with_anthropic}{MESSAGES_PATH_SUFFIX}")) +} + +fn strip_scope_from_block(block: &mut ContentBlock) { + if let Some(cache_control) = block.cache_control.as_mut() { + cache_control.scope = None; + } +} + +fn strip_scope_from_system(system: &mut SystemPrompt) { + if let SystemPrompt::Blocks(blocks) = system { + blocks.iter_mut().for_each(strip_scope_from_block); + } +} + +fn strip_scope_from_message(message: &mut AnthropicMessage) { + if let MessageContent::Blocks(blocks) = &mut message.content { + blocks.iter_mut().for_each(strip_scope_from_block); + } +} + +fn text_content_block(text: String) -> ContentBlock { + let extra = Map::from_iter([ + ( + "type".to_string(), + Value::String(TEXT_BLOCK_TYPE.to_string()), + ), + ("text".to_string(), Value::String(text)), + ]); + ContentBlock { + cache_control: None, + extra, + } +} + +fn content_into_blocks(content: MessageContent) -> Vec { + match content { + MessageContent::Text(text) => vec![text_content_block(text)], + MessageContent::Blocks(blocks) => blocks, + } +} + +fn system_into_blocks(system: Option) -> Vec { + match system { + None => Vec::new(), + Some(SystemPrompt::Text(text)) => vec![text_content_block(text)], + Some(SystemPrompt::Blocks(blocks)) => blocks, + } +} + +fn fold_system_role_messages(request: AnthropicMessagesRequest) -> AnthropicMessagesRequest { + if !request.messages.iter().any(|msg| msg.role == SYSTEM_ROLE) { + return request; + } + + let (system_messages, chat_messages): (Vec, Vec) = request + .messages + .into_iter() + .partition(|msg| msg.role == SYSTEM_ROLE); + + let folded_system: Vec = system_into_blocks(request.system) + .into_iter() + .chain( + system_messages + .into_iter() + .flat_map(|msg| content_into_blocks(msg.content)), + ) + .collect(); + + AnthropicMessagesRequest { + messages: chat_messages, + system: (!folded_system.is_empty()).then_some(SystemPrompt::Blocks(folded_system)), + ..request + } +} + +impl AnthropicMessagesProviderConfig for AzureAnthropicMessagesConfig { + fn complete_url( + &self, + api_base: Option<&str>, + _model: &str, + env_lookup: &dyn Fn(&str) -> Option, + ) -> CoreResult { + complete_azure_anthropic_url(api_base, env_lookup) + } + + fn resolve_api_key( + &self, + api_key: Option<&str>, + env_lookup: &dyn Fn(&str) -> Option, + ) -> CoreResult { + resolve_azure_api_key(api_key, env_lookup) + } + + fn auth_strategy(&self) -> MessagesAuthStrategy { + self.anthropic.auth_strategy() + } + + fn accepts_bearer_auth(&self) -> bool { + true + } + + fn default_headers(&self) -> &'static [(&'static str, &'static str)] { + self.anthropic.default_headers() + } + + fn transform_request( + &self, + request: AnthropicMessagesRequest, + ) -> CoreResult { + let mut request = fold_system_role_messages(request); + if let Some(system) = request.system.as_mut() { + strip_scope_from_system(system); + } + request + .messages + .iter_mut() + .for_each(strip_scope_from_message); + self.anthropic.transform_request(request) + } + + fn transform_response( + &self, + model: &str, + response: AnthropicMessagesResponse, + ) -> CoreResult { + self.anthropic.transform_response(model, response) + } +} + +#[cfg(test)] +mod tests { + use super::*; + use serde_json::json; + + fn request_from(value: serde_json::Value) -> AnthropicMessagesRequest { + serde_json::from_value(value).expect("valid request") + } + + fn to_value(request: AnthropicMessagesRequest) -> serde_json::Value { + serde_json::to_value(request).expect("serializable request") + } + + #[test] + fn url_appends_anthropic_and_messages_suffix() { + let url = + complete_azure_anthropic_url(Some("https://resource.services.ai.azure.com"), &|_| None) + .expect("url builds"); + assert_eq!( + url, + "https://resource.services.ai.azure.com/anthropic/v1/messages" + ); + } + + #[test] + fn url_keeps_existing_anthropic_segment() { + let url = complete_azure_anthropic_url( + Some("https://resource.services.ai.azure.com/anthropic"), + &|_| None, + ) + .expect("url builds"); + assert_eq!( + url, + "https://resource.services.ai.azure.com/anthropic/v1/messages" + ); + } + + #[test] + fn url_leaves_complete_messages_endpoint_untouched() { + for base in [ + "https://resource.services.ai.azure.com/anthropic/v1/messages", + "https://resource.services.ai.azure.com/v1/messages", + ] { + assert_eq!( + complete_azure_anthropic_url(Some(base), &|_| None).expect("url builds"), + base + ); + } + } + + #[test] + fn url_trims_trailing_slash_and_truncates_after_anthropic() { + let url = complete_azure_anthropic_url( + Some("https://resource.services.ai.azure.com/anthropic/extra/"), + &|_| None, + ) + .expect("url builds"); + assert_eq!( + url, + "https://resource.services.ai.azure.com/anthropic/v1/messages" + ); + } + + #[test] + fn url_falls_back_to_env_then_errors_when_absent() { + let with_env = |key: &str| { + (key == AZURE_API_BASE_ENV).then(|| "https://env.services.ai.azure.com".to_string()) + }; + assert_eq!( + complete_azure_anthropic_url(None, &with_env).expect("url builds"), + "https://env.services.ai.azure.com/anthropic/v1/messages" + ); + let err = complete_azure_anthropic_url(Some(" "), &|_| None).expect_err("missing base"); + assert!(matches!(err, CoreError::Auth(_))); + } + + #[test] + fn resolve_api_key_prefers_param_then_env() { + assert_eq!( + resolve_azure_api_key(Some("sk-param"), &|_| None).unwrap(), + "sk-param" + ); + let with_env = |key: &str| (key == AZURE_API_KEY_ENV).then(|| "sk-env".to_string()); + assert_eq!( + resolve_azure_api_key(Some(" "), &with_env).unwrap(), + "sk-env" + ); + assert!(matches!( + resolve_azure_api_key(None, &|_| None).expect_err("missing key"), + CoreError::Auth(_) + )); + } + + #[test] + fn auth_strategy_is_x_api_key() { + assert_eq!( + AZURE_ANTHROPIC_MESSAGES_CONFIG + .auth_strategy() + .header_name(), + "x-api-key" + ); + } + + #[test] + fn accepts_bearer_auth_for_entra_id() { + assert!(AZURE_ANTHROPIC_MESSAGES_CONFIG.accepts_bearer_auth()); + } + + #[test] + fn default_headers_match_python() { + assert_eq!( + AZURE_ANTHROPIC_MESSAGES_CONFIG.default_headers(), + &[ + ("anthropic-version", "2023-06-01"), + ("content-type", "application/json"), + ] + ); + } + + #[test] + fn transform_request_strips_scope_from_system_and_messages() { + let request = request_from(json!({ + "model": "claude-sonnet-4-5", + "max_tokens": 1024, + "system": [ + { + "type": "text", + "text": "sys", + "cache_control": {"type": "ephemeral", "ttl": "1h", "scope": "global"} + } + ], + "messages": [ + { + "role": "user", + "content": [ + { + "type": "text", + "text": "hi", + "cache_control": {"type": "ephemeral", "scope": "global"} + }, + {"type": "text", "text": "no cache control"} + ] + } + ] + })); + + let transformed = to_value( + AZURE_ANTHROPIC_MESSAGES_CONFIG + .transform_request(request) + .expect("request transforms"), + ); + + assert_eq!( + transformed["system"][0]["cache_control"], + json!({"type": "ephemeral", "ttl": "1h"}) + ); + assert_eq!( + transformed["messages"][0]["content"][0]["cache_control"], + json!({"type": "ephemeral"}) + ); + assert_eq!( + transformed["messages"][0]["content"][1], + json!({"type": "text", "text": "no cache control"}) + ); + } + + #[test] + fn transform_request_is_idempotent_and_preserves_string_system() { + let request = request_from(json!({ + "model": "claude-sonnet-4-5", + "max_tokens": 16, + "system": "plain string system", + "messages": [{"role": "user", "content": "hi"}] + })); + let once = AZURE_ANTHROPIC_MESSAGES_CONFIG + .transform_request(request) + .expect("request transforms"); + let twice = AZURE_ANTHROPIC_MESSAGES_CONFIG + .transform_request(once.clone()) + .expect("request transforms"); + assert_eq!(once, twice); + assert_eq!(to_value(once)["system"], json!("plain string system")); + } + + #[test] + fn transform_request_preserves_all_supported_params() { + let body = json!({ + "model": "claude-sonnet-4-5", + "max_tokens": 256, + "messages": [{"role": "user", "content": "hi"}], + "system": "be terse", + "metadata": {"user_id": "u1"}, + "stop_sequences": ["STOP"], + "stream": false, + "temperature": 0.4, + "top_p": 0.9, + "top_k": 40, + "tools": [{"name": "get_weather", "input_schema": {"type": "object"}}], + "tool_choice": {"type": "auto"}, + "thinking": {"type": "enabled", "budget_tokens": 1024}, + "service_tier": "auto", + "container": {"id": "c1"}, + "mcp_servers": [{"type": "url", "url": "https://mcp.example", "name": "x"}], + "context_management": {"edits": []}, + "output_format": {"type": "json_schema"}, + "output_config": {"effort": "high"}, + "speed": "fast", + "inference_geo": "us", + "litellm_metadata": {"trace": "abc"} + }); + let transformed = to_value( + AZURE_ANTHROPIC_MESSAGES_CONFIG + .transform_request(request_from(body.clone())) + .expect("request transforms"), + ); + assert_eq!(transformed, body); + } + + #[test] + fn transform_request_folds_system_role_message_into_top_level_system() { + let request = request_from(json!({ + "model": "claude-sonnet-4-5", + "max_tokens": 256, + "system": [{"type": "text", "text": "base system"}], + "messages": [ + {"role": "user", "content": "fix the bug"}, + {"role": "system", "content": "Available agent types: claude"} + ] + })); + + let transformed = to_value( + AZURE_ANTHROPIC_MESSAGES_CONFIG + .transform_request(request) + .expect("request transforms"), + ); + + assert_eq!( + transformed["messages"], + json!([{"role": "user", "content": "fix the bug"}]) + ); + assert_eq!( + transformed["system"], + json!([ + {"type": "text", "text": "base system"}, + {"type": "text", "text": "Available agent types: claude"} + ]) + ); + } + + #[test] + fn transform_request_folds_system_role_when_no_top_level_system() { + let request = request_from(json!({ + "model": "claude-sonnet-4-5", + "max_tokens": 256, + "messages": [ + {"role": "user", "content": [{"type": "text", "text": "hi"}]}, + {"role": "system", "content": [{"type": "text", "text": "sys block"}]} + ] + })); + + let transformed = to_value( + AZURE_ANTHROPIC_MESSAGES_CONFIG + .transform_request(request) + .expect("request transforms"), + ); + + assert_eq!( + transformed["messages"], + json!([{"role": "user", "content": [{"type": "text", "text": "hi"}]}]) + ); + assert_eq!( + transformed["system"], + json!([{"type": "text", "text": "sys block"}]) + ); + } + + #[test] + fn transform_request_leaves_requests_without_system_role_untouched() { + let body = json!({ + "model": "claude-sonnet-4-5", + "max_tokens": 256, + "system": "be terse", + "messages": [ + {"role": "user", "content": "hi"}, + {"role": "assistant", "content": "hello"} + ] + }); + let transformed = to_value( + AZURE_ANTHROPIC_MESSAGES_CONFIG + .transform_request(request_from(body.clone())) + .expect("request transforms"), + ); + assert_eq!(transformed, body); + } + + #[test] + fn transform_request_rejects_non_object_body() { + let err = serde_json::from_value::(json!("bad")) + .expect_err("non-object body should error"); + assert!(err.is_data()); + } + + #[test] + fn transform_response_passes_through() { + let response: AnthropicMessagesResponse = serde_json::from_value(json!({ + "id": "msg_1", + "type": "message", + "role": "assistant", + "content": [{"type": "text", "text": "hello"}], + "model": "claude-sonnet-4-5", + "stop_reason": "end_turn", + "stop_sequence": null, + "usage": {"input_tokens": 1, "output_tokens": 2} + })) + .expect("valid response"); + let transformed = AZURE_ANTHROPIC_MESSAGES_CONFIG + .transform_response("claude-sonnet-4-5", response) + .expect("response transforms"); + let value = serde_json::to_value(transformed).expect("serializable"); + assert_eq!(value["stop_reason"], json!("end_turn")); + assert_eq!(value["stop_sequence"], json!(null)); + assert_eq!(value["content"][0]["text"], json!("hello")); + } +} diff --git a/litellm-rust/crates/core/src/providers/azure_ai/mod.rs b/litellm-rust/crates/core/src/providers/azure_ai/mod.rs index 3621ff6a2fd..5d13fa93e00 100644 --- a/litellm-rust/crates/core/src/providers/azure_ai/mod.rs +++ b/litellm-rust/crates/core/src/providers/azure_ai/mod.rs @@ -1 +1,2 @@ +pub mod messages; pub mod ocr; diff --git a/litellm-rust/crates/core/src/providers/azure_ai/ocr/transformation.rs b/litellm-rust/crates/core/src/providers/azure_ai/ocr/transformation.rs index 060073acd47..eabd15677cc 100644 --- a/litellm-rust/crates/core/src/providers/azure_ai/ocr/transformation.rs +++ b/litellm-rust/crates/core/src/providers/azure_ai/ocr/transformation.rs @@ -1,9 +1,9 @@ use std::collections::BTreeSet; -use crate::error::{json_type_name, CoreError, CoreResult}; +use crate::error::{CoreError, CoreResult, json_type_name}; use crate::ocr::transformation::{OcrAuthStrategy, OcrProviderConfig, OcrResponseHandling}; use crate::ocr::types::{OcrRequestData, OcrResponseData}; -use serde_json::{json, Map, Value}; +use serde_json::{Map, Value, json}; use crate::providers::mistral::ocr::transformation::MISTRAL_OCR_CONFIG; @@ -206,11 +206,11 @@ pub fn complete_document_intelligence_url( AZURE_DOCUMENT_INTELLIGENCE_API_VERSION ); - if let Some(pages) = optional_params.get("pages") { - if let Some(normalized) = normalize_pages_param(pages)? { - url.push_str("&pages="); - url.push_str(&normalized); - } + if let Some(pages) = optional_params.get("pages") + && let Some(normalized) = normalize_pages_param(pages)? + { + url.push_str("&pages="); + url.push_str(&normalized); } Ok(url) @@ -231,7 +231,7 @@ fn document_url_from_mistral_document(document: &Value) -> CoreResult<&str> { other => { return Err(CoreError::InvalidRequest(format!( "Invalid document type: {other}. Must be 'document_url' or 'image_url'" - ))) + ))); } }; object diff --git a/litellm-rust/crates/core/src/providers/bedrock/audio_transcription.rs b/litellm-rust/crates/core/src/providers/bedrock/audio_transcription.rs new file mode 100644 index 00000000000..86eb589e2c0 --- /dev/null +++ b/litellm-rust/crates/core/src/providers/bedrock/audio_transcription.rs @@ -0,0 +1,310 @@ +use serde_json::{Map, Value, json}; + +use crate::audio_transcription::transformation::{ + AudioTranscriptionAuth, AudioTranscriptionProviderConfig, +}; +use crate::audio_transcription::types::{ + AudioTranscriptionRequestData, AudioTranscriptionResponseData, +}; +use crate::error::{CoreError, CoreResult, json_type_name}; + +use super::aws_base::AwsAuthConfig; +use super::constants::{ + AWS_REGION, AWS_REGION_NAME, BEDROCK_RUNTIME_ENDPOINT_TEMPLATE, BEDROCK_SERVICE, + DEFAULT_BEDROCK_REGION, +}; + +const SUPPORTED_PARAMS: &[&str] = &["language", "prompt", "temperature", "response_format"]; + +pub static BEDROCK_AUDIO_TRANSCRIPTION_CONFIG: BedrockAudioTranscriptionConfig = + BedrockAudioTranscriptionConfig; + +pub struct BedrockAudioTranscriptionConfig; + +pub fn bedrock_model_id_and_region(model: &str) -> (String, Option) { + let mut stripped = model; + for prefix in ["bedrock/converse/", "bedrock/", "converse/"] { + if let Some(value) = stripped.strip_prefix(prefix) { + stripped = value; + break; + } + } + let mut region = None; + if let Some((candidate, remainder)) = stripped.split_once('/') + && is_bedrock_region(candidate) + { + region = Some(candidate.to_string()); + stripped = remainder; + } + for prefix in ["nova-2/", "nova/"] { + if let Some(value) = stripped.strip_prefix(prefix) { + stripped = value; + break; + } + } + if region.is_none() { + region = stripped + .strip_prefix("arn:") + .and_then(|value| value.split(':').nth(3)) + .filter(|value| !value.is_empty()) + .map(str::to_string); + } + (stripped.to_string(), region) +} + +fn is_bedrock_region(value: &str) -> bool { + value.len() > 3 + && value.contains('-') + && value + .chars() + .all(|char| char.is_ascii_alphanumeric() || char == '-') +} + +pub fn resolve_bedrock_region( + model_region: Option<&str>, + optional_params: &Map, + env_lookup: &dyn Fn(&str) -> Option, +) -> String { + if let Some(region) = optional_params + .get("aws_region_name") + .and_then(Value::as_str) + { + return region.to_string(); + } + if let Some(region) = model_region { + return region.to_string(); + } + env_lookup(AWS_REGION_NAME) + .or_else(|| env_lookup(AWS_REGION)) + .unwrap_or_else(|| DEFAULT_BEDROCK_REGION.to_string()) +} + +fn audio_fields(audio: Value) -> CoreResult<(String, String)> { + let object = audio.as_object().ok_or_else(|| CoreError::InvalidType { + expected: "object", + actual: json_type_name(&audio), + })?; + let data = object + .get("data") + .and_then(Value::as_str) + .filter(|value| !value.is_empty()) + .ok_or(CoreError::MissingField("audio.data"))?; + let format = object + .get("format") + .and_then(Value::as_str) + .filter(|value| matches!(*value, "wav" | "mp3" | "flac" | "ogg")) + .ok_or_else(|| { + CoreError::InvalidRequest("audio.format must be wav, mp3, flac, or ogg".to_string()) + })?; + Ok((data.to_string(), format.to_string())) +} + +fn optional_string<'a>(params: &'a Map, key: &str) -> Option<&'a str> { + params + .get(key) + .and_then(Value::as_str) + .filter(|value| !value.is_empty()) +} + +impl AudioTranscriptionProviderConfig for BedrockAudioTranscriptionConfig { + fn supported_transcription_params(&self) -> &'static [&'static str] { + SUPPORTED_PARAMS + } + + fn transform_transcription_request( + &self, + _model: &str, + audio: Value, + optional_params: Map, + ) -> CoreResult { + let (data, format) = audio_fields(audio)?; + let mut instruction = "Transcribe the audio. Respond with only the transcript.".to_string(); + if let Some(language) = optional_string(&optional_params, "language") { + instruction.push_str(&format!(" The audio language is {language}.")); + } + if let Some(prompt) = optional_string(&optional_params, "prompt") { + instruction.push_str(&format!(" Additional context: {prompt}")); + } + let mut inference_config = Map::from_iter([("maxTokens".to_string(), json!(4096))]); + if let Some(temperature) = optional_params.get("temperature") { + inference_config.insert("temperature".to_string(), temperature.clone()); + } + Ok(AudioTranscriptionRequestData { + body: json!({ + "messages": [{ + "role": "user", + "content": [ + {"audio": {"format": format, "source": {"bytes": data}}}, + {"text": instruction} + ] + }], + "system": [{"text": "You are a transcription assistant."}], + "inferenceConfig": inference_config, + }), + }) + } + + fn transform_transcription_response( + &self, + _model: &str, + response_json: Value, + ) -> CoreResult { + let content = response_json + .get("output") + .and_then(|value| value.get("message")) + .and_then(|value| value.get("content")) + .and_then(Value::as_array) + .ok_or_else(|| { + CoreError::InvalidResponse("Bedrock response has no output content".to_string()) + })?; + let mut text = String::new(); + for block in content { + if let Some(value) = block.get("text").and_then(Value::as_str) { + text.push_str(value); + } + } + Ok(AudioTranscriptionResponseData { text }) + } + + fn complete_url( + &self, + api_base: Option<&str>, + model: &str, + optional_params: &Map, + env_lookup: &dyn Fn(&str) -> Option, + ) -> CoreResult { + let (model_id, model_region) = bedrock_model_id_and_region(model); + let region = resolve_bedrock_region(model_region.as_deref(), optional_params, env_lookup); + let endpoint = optional_params + .get("aws_bedrock_runtime_endpoint") + .and_then(Value::as_str) + .or(api_base) + .map(str::trim) + .filter(|value| !value.is_empty()) + .map(str::to_string) + .unwrap_or_else(|| BEDROCK_RUNTIME_ENDPOINT_TEMPLATE.replace("{region}", ®ion)); + Ok(format!( + "{}/model/{model_id}/converse", + endpoint.trim_end_matches('/') + )) + } + + fn auth_strategy( + &self, + model: &str, + optional_params: &Map, + env_lookup: &dyn Fn(&str) -> Option, + ) -> CoreResult { + let (_, model_region) = bedrock_model_id_and_region(model); + Ok(AudioTranscriptionAuth::AwsSigV4 { + region: resolve_bedrock_region(model_region.as_deref(), optional_params, env_lookup), + service: BEDROCK_SERVICE, + }) + } +} + +pub fn aws_auth_config( + optional_params: &Map, + env_lookup: &dyn Fn(&str) -> Option, +) -> AwsAuthConfig { + let value = |key: &str| { + optional_params + .get(key) + .and_then(Value::as_str) + .map(str::to_string) + }; + let env = |key: &str| env_lookup(key); + AwsAuthConfig { + access_key_id: value("aws_access_key_id").or_else(|| env("AWS_ACCESS_KEY_ID")), + secret_access_key: value("aws_secret_access_key").or_else(|| env("AWS_SECRET_ACCESS_KEY")), + session_token: value("aws_session_token").or_else(|| env("AWS_SESSION_TOKEN")), + region_name: value("aws_region_name").or_else(|| env(AWS_REGION_NAME)), + session_name: value("aws_session_name").or_else(|| env("AWS_SESSION_NAME")), + profile_name: value("aws_profile_name").or_else(|| env("AWS_PROFILE_NAME")), + role_name: value("aws_role_name").or_else(|| env("AWS_ROLE_NAME")), + web_identity_token: value("aws_web_identity_token") + .or_else(|| env("AWS_WEB_IDENTITY_TOKEN")), + sts_endpoint: value("aws_sts_endpoint").or_else(|| env("AWS_STS_ENDPOINT")), + external_id: value("aws_external_id").or_else(|| env("AWS_EXTERNAL_ID")), + } +} + +#[cfg(test)] +mod tests { + use super::*; + + fn no_env(_: &str) -> Option { + None + } + + #[test] + fn request_matches_python_shape() { + let params = Map::from_iter([ + ("language".to_string(), json!("en")), + ("prompt".to_string(), json!("Speaker names")), + ("temperature".to_string(), json!(0)), + ("timestamp_granularities".to_string(), json!(["word"])), + ]); + let params = BEDROCK_AUDIO_TRANSCRIPTION_CONFIG.map_transcription_params(¶ms); + let result = BEDROCK_AUDIO_TRANSCRIPTION_CONFIG + .transform_transcription_request( + "mistral.voxtral-mini-3b-2507", + json!({"data": "AQI=", "format": "wav", "filename": "sample.wav"}), + params, + ) + .expect("request"); + assert_eq!( + result.body, + json!({ + "messages": [{ + "role": "user", + "content": [ + {"audio": {"format": "wav", "source": {"bytes": "AQI="}}}, + {"text": "Transcribe the audio. Respond with only the transcript. The audio language is en. Additional context: Speaker names"} + ] + }], + "system": [{"text": "You are a transcription assistant."}], + "inferenceConfig": {"maxTokens": 4096, "temperature": 0} + }) + ); + } + + #[test] + fn response_concatenates_content_blocks() { + let result = BEDROCK_AUDIO_TRANSCRIPTION_CONFIG + .transform_transcription_response( + "model", + json!({"output": {"message": {"content": [{"text": "hello "}, {"text": "world"}]}}}), + ) + .expect("response"); + assert_eq!(result.text, "hello world"); + assert_eq!(result.into_json(), json!({"text": "hello world"})); + } + + #[test] + fn invalid_audio_is_rejected() { + let result = BEDROCK_AUDIO_TRANSCRIPTION_CONFIG.transform_transcription_request( + "model", + json!({"data": "AQI="}), + Map::new(), + ); + assert!(result.is_err()); + } + + #[test] + fn region_and_url_precedence_match_python() { + let params = Map::from_iter([("aws_region_name".to_string(), json!("eu-west-1"))]); + let url = BEDROCK_AUDIO_TRANSCRIPTION_CONFIG + .complete_url( + None, + "bedrock/us-east-1/mistral.voxtral-mini-3b-2507", + ¶ms, + &no_env, + ) + .expect("url"); + assert_eq!( + url, + "https://bedrock-runtime.eu-west-1.amazonaws.com/model/mistral.voxtral-mini-3b-2507/converse" + ); + } +} diff --git a/litellm-rust/crates/core/src/providers/bedrock/aws_base.rs b/litellm-rust/crates/core/src/providers/bedrock/aws_base.rs new file mode 100644 index 00000000000..dc036a3cf21 --- /dev/null +++ b/litellm-rust/crates/core/src/providers/bedrock/aws_base.rs @@ -0,0 +1,726 @@ +use std::collections::BTreeMap; +use std::sync::{Mutex, OnceLock}; +use std::time::Duration; +use std::time::{SystemTime, UNIX_EPOCH}; + +use crate::caching::in_memory_cache::InMemoryCache; +use crate::error::{CoreError, CoreResult}; +use aws_credential_types::Credentials; +use aws_credential_types::provider::ProvideCredentials; +use aws_sigv4::http_request::{ + SignableBody, SignableRequest, SigningParams, SigningSettings, sign, +}; +use aws_sigv4::sign::v4; +use aws_smithy_runtime_api::client::identity::Identity; +use sha2::{Digest, Sha256}; + +use super::constants::{ + AWS_ACCESS_KEY_ID, AWS_EXTERNAL_ID, AWS_PROFILE_NAME, AWS_REGION_NAME, AWS_ROLE_ARN, + AWS_ROLE_NAME, AWS_SECRET_ACCESS_KEY, AWS_SESSION_NAME, AWS_SESSION_TOKEN, AWS_STS_ENDPOINT, + AWS_WEB_IDENTITY_TOKEN, AWS_WEB_IDENTITY_TOKEN_FILE, BEDROCK_SERVICE, + DEFAULT_SESSION_NAME_PREFIX, +}; + +const STATIC_CREDENTIALS_TTL: Duration = Duration::from_secs(3600 - 60); +const AMBIENT_CREDENTIALS_TTL: Duration = Duration::from_secs(600); + +static IAM_CREDENTIALS_CACHE: OnceLock>> = OnceLock::new(); + +fn credential_cache_ttl(flow: &AwsAuthFlow) -> Option { + match flow { + AwsAuthFlow::StaticKeys { .. } => Some(STATIC_CREDENTIALS_TTL), + AwsAuthFlow::DefaultChain => Some(AMBIENT_CREDENTIALS_TTL), + AwsAuthFlow::WebIdentity { .. } + | AwsAuthFlow::AssumeRole { .. } + | AwsAuthFlow::Profile { .. } + | AwsAuthFlow::SessionToken { .. } => None, + } +} + +#[derive(Clone, Debug, Default, PartialEq, Eq)] +pub struct AwsAuthConfig { + pub access_key_id: Option, + pub secret_access_key: Option, + pub session_token: Option, + pub region_name: Option, + pub session_name: Option, + pub profile_name: Option, + pub role_name: Option, + pub web_identity_token: Option, + pub sts_endpoint: Option, + pub external_id: Option, +} + +impl AwsAuthConfig { + fn with_environment(self, env_lookup: &(dyn Fn(&str) -> Option + Sync)) -> Self { + Self { + access_key_id: self.access_key_id.or_else(|| env_lookup(AWS_ACCESS_KEY_ID)), + secret_access_key: self + .secret_access_key + .or_else(|| env_lookup(AWS_SECRET_ACCESS_KEY)), + session_token: self.session_token.or_else(|| env_lookup(AWS_SESSION_TOKEN)), + region_name: self.region_name.or_else(|| env_lookup(AWS_REGION_NAME)), + session_name: self.session_name.or_else(|| env_lookup(AWS_SESSION_NAME)), + profile_name: self.profile_name.or_else(|| env_lookup(AWS_PROFILE_NAME)), + role_name: self.role_name.or_else(|| env_lookup(AWS_ROLE_NAME)), + web_identity_token: self + .web_identity_token + .or_else(|| env_lookup(AWS_WEB_IDENTITY_TOKEN)), + sts_endpoint: self.sts_endpoint.or_else(|| env_lookup(AWS_STS_ENDPOINT)), + external_id: self.external_id.or_else(|| env_lookup(AWS_EXTERNAL_ID)), + } + } +} + +#[derive(Clone, Debug, PartialEq, Eq)] +pub enum AwsAuthFlow { + WebIdentity { + token: String, + role: String, + session_name: String, + }, + AssumeRole { + role: String, + session_name: Option, + }, + Profile { + name: String, + }, + SessionToken { + access_key_id: String, + secret_access_key: String, + session_token: String, + }, + StaticKeys { + access_key_id: String, + secret_access_key: String, + region_name: String, + }, + DefaultChain, +} + +fn cache_key(config: &AwsAuthConfig, flow: &AwsAuthFlow) -> String { + let mut hasher = Sha256::new(); + hasher.update(format!("{config:?}:{flow:?}")); + format!("{:x}", hasher.finalize()) +} + +fn get_cached_credentials(key: &str) -> Option { + let cache = IAM_CREDENTIALS_CACHE.get_or_init(|| Mutex::new(InMemoryCache::default())); + let mut entries = cache.lock().ok()?; + entries.get_cache(key) +} + +fn set_cached_credentials(key: String, credentials: Credentials, ttl: Duration) { + let cache = IAM_CREDENTIALS_CACHE.get_or_init(|| Mutex::new(InMemoryCache::default())); + if let Ok(mut entries) = cache.lock() { + entries.set_cache(key, credentials, Some(ttl)); + } +} + +fn role_identity(arn: &str) -> Option<(&str, &str, &str)> { + let mut parts = arn.splitn(6, ':'); + let ("arn", partition, _, _, account, resource) = ( + parts.next()?, + parts.next()?, + parts.next()?, + parts.next()?, + parts.next()?, + parts.next()?, + ) else { + return None; + }; + let role = if let Some(role) = resource.strip_prefix("role/") { + role.rsplit('/').next()? + } else { + resource.strip_prefix("assumed-role/")?.split('/').next()? + }; + Some((partition, account, role)) +} + +fn same_role_arns(target: &str, caller: &str) -> bool { + role_identity(target) == role_identity(caller) +} + +pub fn classify_auth( + config: AwsAuthConfig, + env_lookup: &(dyn Fn(&str) -> Option + Sync), +) -> AwsAuthFlow { + let config = config.with_environment(env_lookup); + if let (Some(token), Some(role), Some(session_name)) = ( + config.web_identity_token.clone(), + config.role_name.clone(), + config.session_name.clone(), + ) { + return AwsAuthFlow::WebIdentity { + token, + role, + session_name, + }; + } + if let Some(role) = config.role_name.clone() { + return AwsAuthFlow::AssumeRole { + role, + session_name: config.session_name.clone(), + }; + } + if let Some(name) = config.profile_name { + return AwsAuthFlow::Profile { name }; + } + if let (Some(access_key_id), Some(secret_access_key), Some(session_token)) = ( + config.access_key_id.clone(), + config.secret_access_key.clone(), + config.session_token, + ) { + return AwsAuthFlow::SessionToken { + access_key_id, + secret_access_key, + session_token, + }; + } + if let (Some(access_key_id), Some(secret_access_key), Some(region_name)) = ( + config.access_key_id, + config.secret_access_key, + config.region_name, + ) { + return AwsAuthFlow::StaticKeys { + access_key_id, + secret_access_key, + region_name, + }; + } + AwsAuthFlow::DefaultChain +} + +pub async fn resolve_credentials( + config: AwsAuthConfig, + env_lookup: &(dyn Fn(&str) -> Option + Sync), +) -> CoreResult { + let resolved = config.clone().with_environment(env_lookup); + let flow = classify_auth(config, env_lookup); + match flow { + AwsAuthFlow::SessionToken { + access_key_id, + secret_access_key, + session_token, + } => Ok(Credentials::new( + access_key_id, + secret_access_key, + Some(session_token), + None, + "litellm-static-session", + )), + AwsAuthFlow::StaticKeys { + access_key_id, + secret_access_key, + region_name, + } => { + let flow = AwsAuthFlow::StaticKeys { + access_key_id: access_key_id.clone(), + secret_access_key: secret_access_key.clone(), + region_name, + }; + let key = cache_key(&resolved, &flow); + if let Some(credentials) = get_cached_credentials(&key) { + return Ok(credentials); + } + let credentials = Credentials::new( + access_key_id, + secret_access_key, + None, + None, + "litellm-static", + ); + set_cached_credentials( + key, + credentials.clone(), + credential_cache_ttl(&flow).unwrap_or(STATIC_CREDENTIALS_TTL), + ); + Ok(credentials) + } + AwsAuthFlow::Profile { name } => { + let provider = aws_config::profile::ProfileFileCredentialsProvider::builder() + .profile_name(name) + .build(); + provider.provide_credentials().await.map_err(|error| { + CoreError::Auth(format!("AWS profile credentials failed: {error}")) + }) + } + AwsAuthFlow::AssumeRole { role, session_name } => { + if is_already_running_as_role(&role, &resolved).await? { + let ambient_flow = AwsAuthFlow::DefaultChain; + let key = cache_key(&resolved, &ambient_flow); + if let Some(credentials) = get_cached_credentials(&key) { + return Ok(credentials); + } + let provider = + aws_config::default_provider::credentials::DefaultCredentialsChain::builder() + .build() + .await; + let credentials = provider.provide_credentials().await.map_err(|error| { + CoreError::Auth(format!("AWS default credentials failed: {error}")) + })?; + set_cached_credentials( + key, + credentials.clone(), + credential_cache_ttl(&ambient_flow).unwrap_or(AMBIENT_CREDENTIALS_TTL), + ); + return Ok(credentials); + } + let mut loader = aws_config::defaults(aws_config::BehaviorVersion::latest()); + if let Some(region) = resolved.region_name.clone() { + loader = loader.region(aws_types::region::Region::new(region)); + } + if let Some(endpoint) = resolved.sts_endpoint.clone() { + loader = loader.endpoint_url(endpoint); + } + if let (Some(access_key_id), Some(secret_access_key)) = + (resolved.access_key_id, resolved.secret_access_key) + { + loader = loader.credentials_provider(Credentials::new( + access_key_id, + secret_access_key, + resolved.session_token, + None, + "litellm-role-source", + )); + } + let sdk_config = loader.load().await; + let builder = aws_config::sts::AssumeRoleProvider::builder(role); + let builder = match session_name { + Some(name) => builder.session_name(name), + None => builder.session_name(default_session_name()), + }; + let builder = match resolved.external_id { + Some(id) => builder.external_id(id), + None => builder, + }; + let provider = builder.configure(&sdk_config).build().await; + provider + .provide_credentials() + .await + .map_err(|error| CoreError::Auth(format!("AWS role credentials failed: {error}"))) + } + AwsAuthFlow::WebIdentity { + token, + role, + session_name, + } => { + let mut loader = aws_config::defaults(aws_config::BehaviorVersion::latest()); + if let Some(region) = resolved.region_name { + loader = loader.region(aws_types::region::Region::new(region)); + } + if let Some(endpoint) = resolved.sts_endpoint { + loader = loader.endpoint_url(endpoint); + } + let sdk_config = loader.load().await; + let client = aws_sdk_sts::Client::new(&sdk_config); + let response = client + .assume_role_with_web_identity() + .role_arn(role) + .role_session_name(session_name) + .web_identity_token(token) + .send() + .await + .map_err(|error| { + CoreError::Auth(format!("AWS web identity credentials failed: {error}")) + })?; + let credentials = response.credentials().ok_or_else(|| { + CoreError::Auth("AWS web identity response had no credentials".to_string()) + })?; + let expiration = SystemTime::try_from(*credentials.expiration()).map_err(|error| { + CoreError::Auth(format!("AWS web identity expiration was invalid: {error}")) + })?; + Ok(Credentials::new( + credentials.access_key_id(), + credentials.secret_access_key(), + Some(credentials.session_token().to_string()), + Some(expiration), + "litellm-web-identity", + )) + } + AwsAuthFlow::DefaultChain => { + let key = cache_key(&resolved, &AwsAuthFlow::DefaultChain); + if let Some(credentials) = get_cached_credentials(&key) { + return Ok(credentials); + } + let provider = + aws_config::default_provider::credentials::DefaultCredentialsChain::builder() + .build() + .await; + let credentials = provider.provide_credentials().await.map_err(|error| { + CoreError::Auth(format!("AWS default credentials failed: {error}")) + })?; + set_cached_credentials( + key, + credentials.clone(), + credential_cache_ttl(&AwsAuthFlow::DefaultChain).unwrap_or(AMBIENT_CREDENTIALS_TTL), + ); + Ok(credentials) + } + } +} + +async fn is_already_running_as_role(role: &str, config: &AwsAuthConfig) -> CoreResult { + if role_identity(role).is_none() { + return Ok(false); + } + if let (Ok(current_role), Ok(token_file)) = ( + std::env::var(AWS_ROLE_ARN), + std::env::var(AWS_WEB_IDENTITY_TOKEN_FILE), + ) && !token_file.is_empty() + { + return Ok(same_role_arns(role, ¤t_role)); + } + + let mut loader = aws_config::defaults(aws_config::BehaviorVersion::latest()); + if let Some(region) = config.region_name.clone() { + loader = loader.region(aws_types::region::Region::new(region)); + } + if let Some(endpoint) = config.sts_endpoint.clone() { + loader = loader.endpoint_url(endpoint); + } + let sdk_config = loader.load().await; + let response = match aws_sdk_sts::Client::new(&sdk_config) + .get_caller_identity() + .send() + .await + { + Ok(response) => response, + Err(_) => return Ok(false), + }; + Ok(response + .arn() + .is_some_and(|caller| same_role_arns(role, caller))) +} + +fn default_session_name() -> String { + let seconds = SystemTime::now() + .duration_since(UNIX_EPOCH) + .map_or(0, |duration| duration.as_secs()); + format!("{DEFAULT_SESSION_NAME_PREFIX}-{seconds}") +} + +pub fn sign_bedrock_post( + url: &str, + body: &[u8], + headers: &BTreeMap, + region: &str, + credentials: &Credentials, + signing_time: SystemTime, +) -> CoreResult> { + let identity: Identity = credentials.clone().into(); + let params = v4::SigningParams::builder() + .identity(&identity) + .region(region) + .name(BEDROCK_SERVICE) + .time(signing_time) + .settings(SigningSettings::default()) + .build() + .map(SigningParams::from) + .map_err(|error| CoreError::Auth(format!("AWS signing parameters failed: {error}")))?; + let header_refs = headers + .iter() + .map(|(name, value)| (name.as_str(), value.as_str())); + let request = SignableRequest::new("POST", url, header_refs, SignableBody::Bytes(body)) + .map_err(|error| CoreError::Auth(format!("AWS signable request failed: {error}")))?; + let (instructions, _) = sign(request, ¶ms) + .map_err(|error| CoreError::Auth(format!("AWS request signing failed: {error}")))? + .into_parts(); + Ok(instructions + .headers() + .map(|(name, value)| { + let normalized_name = match name { + "authorization" => "Authorization", + "x-amz-date" => "X-Amz-Date", + "x-amz-security-token" => "X-Amz-Security-Token", + _ => name, + }; + (normalized_name.to_string(), value.to_string()) + }) + .collect()) +} + +#[cfg(test)] +mod tests { + use super::*; + + fn no_env(_: &str) -> Option { + None + } + + fn parity_inputs() -> (String, Vec, BTreeMap) { + ( + "https://bedrock-runtime.us-east-1.amazonaws.com/model/amazon.titan-text-express-v1/invoke" + .to_string(), + br#"{"input":"hello"}"#.to_vec(), + BTreeMap::from([("Content-Type".to_string(), "application/json".to_string())]), + ) + } + + #[test] + fn classification_preserves_python_precedence() { + let config = AwsAuthConfig { + access_key_id: Some("ak".into()), + secret_access_key: Some("sk".into()), + session_token: Some("token".into()), + region_name: Some("us-east-1".into()), + session_name: Some("session".into()), + profile_name: Some("profile".into()), + role_name: Some("role".into()), + web_identity_token: Some("oidc".into()), + ..Default::default() + }; + assert!(matches!( + classify_auth(config, &no_env), + AwsAuthFlow::WebIdentity { .. } + )); + } + + #[test] + fn classification_covers_fallthroughs() { + let env = |key: &str| match key { + AWS_PROFILE_NAME => Some("profile".into()), + _ => None, + }; + assert!(matches!( + classify_auth(AwsAuthConfig::default(), &env), + AwsAuthFlow::Profile { .. } + )); + assert!(matches!( + classify_auth( + AwsAuthConfig { + access_key_id: Some("ak".into()), + secret_access_key: Some("sk".into()), + session_token: Some("token".into()), + ..Default::default() + }, + &no_env + ), + AwsAuthFlow::SessionToken { .. } + )); + assert!(matches!( + classify_auth( + AwsAuthConfig { + access_key_id: Some("ak".into()), + secret_access_key: Some("sk".into()), + region_name: Some("us-east-1".into()), + ..Default::default() + }, + &no_env + ), + AwsAuthFlow::StaticKeys { .. } + )); + assert_eq!( + classify_auth(AwsAuthConfig::default(), &no_env), + AwsAuthFlow::DefaultChain + ); + } + + #[tokio::test] + async fn static_credentials_do_not_use_network() { + let credentials = resolve_credentials( + AwsAuthConfig { + access_key_id: Some("ak".into()), + secret_access_key: Some("sk".into()), + region_name: Some("us-east-1".into()), + ..Default::default() + }, + &no_env, + ) + .await + .expect("static credentials"); + assert_eq!(credentials.access_key_id(), "ak"); + assert_eq!(credentials.session_token(), None); + } + + #[test] + fn cache_policy_matches_python_flows() { + assert_eq!( + credential_cache_ttl(&AwsAuthFlow::StaticKeys { + access_key_id: "ak".into(), + secret_access_key: "sk".into(), + region_name: "us-east-1".into(), + }), + Some(STATIC_CREDENTIALS_TTL) + ); + assert_eq!( + credential_cache_ttl(&AwsAuthFlow::DefaultChain), + Some(AMBIENT_CREDENTIALS_TTL) + ); + assert_eq!( + credential_cache_ttl(&AwsAuthFlow::SessionToken { + access_key_id: "ak".into(), + secret_access_key: "sk".into(), + session_token: "token".into(), + }), + None + ); + assert_eq!( + credential_cache_ttl(&AwsAuthFlow::Profile { + name: "profile".into() + }), + None + ); + assert_eq!( + credential_cache_ttl(&AwsAuthFlow::AssumeRole { + role: "arn:aws:iam::123456789012:role/demo".into(), + session_name: None, + }), + None + ); + assert_eq!( + credential_cache_ttl(&AwsAuthFlow::WebIdentity { + token: "token".into(), + role: "arn:aws:iam::123456789012:role/demo".into(), + session_name: "session".into(), + }), + None + ); + } + + #[test] + fn cache_round_trip_preserves_credentials() { + let key = format!("cache-test-{}", std::process::id()); + let credentials = Credentials::new("cache-ak", "cache-sk", None, None, "test"); + set_cached_credentials(key.clone(), credentials.clone(), STATIC_CREDENTIALS_TTL); + assert_eq!( + get_cached_credentials(&key).map(|value| value.access_key_id().to_string()), + Some("cache-ak".to_string()) + ); + } + + #[test] + fn same_role_comparison_matches_partition_account_and_role() { + assert!(same_role_arns( + "arn:aws:iam::123456789012:role/path/demo", + "arn:aws:sts::123456789012:assumed-role/demo/session" + )); + assert!(!same_role_arns( + "arn:aws:iam::123456789012:role/demo", + "arn:aws:iam::999999999999:role/demo" + )); + assert!(!same_role_arns( + "arn:aws:iam::123456789012:role/demo", + "arn:aws-cn:iam::123456789012:role/demo" + )); + assert!(!same_role_arns( + "arn:aws:iam::123456789012:user/demo", + "arn:aws:iam::123456789012:role/demo" + )); + } + + #[test] + fn signing_matches_botocore_golden_vector() { + let (url, body, headers) = parity_inputs(); + let credentials = Credentials::new( + "AKIDEXAMPLE", + "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", + Some("session-token".to_string()), + None, + "test", + ); + let signed = sign_bedrock_post( + &url, + &body, + &headers, + "us-east-1", + &credentials, + UNIX_EPOCH + std::time::Duration::from_secs(1_704_164_645), + ) + .expect("golden signature"); + assert_eq!( + signed.get("X-Amz-Date").map(String::as_str), + Some("20240102T030405Z") + ); + assert_eq!( + signed.get("X-Amz-Security-Token").map(String::as_str), + Some("session-token") + ); + assert_eq!( + signed.get("Authorization").map(String::as_str), + Some( + "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20240102/us-east-1/bedrock/aws4_request, SignedHeaders=content-type;host;x-amz-date;x-amz-security-token, Signature=55c027ef47527d3ad63f1735f9d099efdbc99f296ff914bd94e727e24ec0e464" + ) + ); + } + + #[test] + fn signing_without_session_token_omits_security_header() { + let (url, body, headers) = parity_inputs(); + let credentials = Credentials::new( + "AKIDEXAMPLE", + "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", + None, + None, + "test", + ); + let signed = sign_bedrock_post( + &url, + &body, + &headers, + "us-east-1", + &credentials, + UNIX_EPOCH + std::time::Duration::from_secs(1_704_164_645), + ) + .expect("signature"); + assert!(!signed.contains_key("X-Amz-Security-Token")); + } + + #[ignore] + #[tokio::test] + async fn live_bedrock_invoke_model_returns_200() -> Result<(), Box> { + let access_key_id = std::env::var("AWS_BEDROCK_TEST_ACCESS_KEY_ID")?; + let secret_access_key = std::env::var("AWS_BEDROCK_TEST_SECRET_ACCESS_KEY")?; + let body = br#"{"anthropic_version":"bedrock-2023-05-31","max_tokens":1,"messages":[{"role":"user","content":[{"type":"text","text":"ping"}]}]}"#.to_vec(); + let headers = + BTreeMap::from([("Content-Type".to_string(), "application/json".to_string())]); + let credentials = resolve_credentials( + AwsAuthConfig { + access_key_id: Some(access_key_id), + secret_access_key: Some(secret_access_key), + region_name: Some("us-west-2".to_string()), + ..Default::default() + }, + &no_env, + ) + .await?; + let client = reqwest::Client::new(); + let mut failures = Vec::new(); + + for region in ["us-west-2", "us-east-1"] { + let url = format!( + "https://bedrock-runtime.{region}.amazonaws.com/model/us.anthropic.claude-opus-4-8/invoke" + ); + let signed_headers = sign_bedrock_post( + &url, + &body, + &headers, + region, + &credentials, + SystemTime::now(), + )?; + let mut request = client.post(&url).body(body.clone()); + for (name, value) in &headers { + request = request.header(name, value); + } + for (name, value) in signed_headers { + request = request.header(name, value); + } + let response = request.send().await?; + let status = response.status(); + let response_body = response.text().await?; + let snippet: String = response_body.chars().take(240).collect(); + println!("region={region} status={status} response={snippet}"); + if status == reqwest::StatusCode::OK { + return Ok(()); + } + failures.push(format!("{region}: {status} {snippet}")); + } + + panic!( + "no Bedrock region returned HTTP 200: {}", + failures.join("; ") + ); + } +} diff --git a/litellm-rust/crates/core/src/providers/bedrock/constants.rs b/litellm-rust/crates/core/src/providers/bedrock/constants.rs new file mode 100644 index 00000000000..785295207e7 --- /dev/null +++ b/litellm-rust/crates/core/src/providers/bedrock/constants.rs @@ -0,0 +1,18 @@ +pub const AWS_ACCESS_KEY_ID: &str = "AWS_ACCESS_KEY_ID"; +pub const AWS_SECRET_ACCESS_KEY: &str = "AWS_SECRET_ACCESS_KEY"; +pub const AWS_SESSION_TOKEN: &str = "AWS_SESSION_TOKEN"; +pub const AWS_REGION_NAME: &str = "AWS_REGION_NAME"; +pub const AWS_REGION: &str = "AWS_REGION"; +pub const AWS_SESSION_NAME: &str = "AWS_SESSION_NAME"; +pub const AWS_PROFILE_NAME: &str = "AWS_PROFILE_NAME"; +pub const AWS_ROLE_NAME: &str = "AWS_ROLE_NAME"; +pub const AWS_WEB_IDENTITY_TOKEN: &str = "AWS_WEB_IDENTITY_TOKEN"; +pub const AWS_ROLE_ARN: &str = "AWS_ROLE_ARN"; +pub const AWS_WEB_IDENTITY_TOKEN_FILE: &str = "AWS_WEB_IDENTITY_TOKEN_FILE"; +pub const AWS_STS_ENDPOINT: &str = "AWS_STS_ENDPOINT"; +pub const AWS_EXTERNAL_ID: &str = "AWS_EXTERNAL_ID"; +pub const BEDROCK_SERVICE: &str = "bedrock"; +pub const DEFAULT_SESSION_NAME_PREFIX: &str = "litellm-session"; +pub const DEFAULT_BEDROCK_REGION: &str = "us-west-2"; +pub const BEDROCK_RUNTIME_ENDPOINT_TEMPLATE: &str = + "https://bedrock-runtime.{region}.amazonaws.com"; diff --git a/litellm-rust/crates/core/src/providers/bedrock/mod.rs b/litellm-rust/crates/core/src/providers/bedrock/mod.rs new file mode 100644 index 00000000000..b09675ad7dd --- /dev/null +++ b/litellm-rust/crates/core/src/providers/bedrock/mod.rs @@ -0,0 +1,8 @@ +//! User-directed exception: this base provider owns AWS auth I/O for parity +//! with Python's `BaseAWSLLM`; the broader core purity guidance is reconciled +//! separately. + +#[cfg(feature = "bedrock-auth")] +pub mod audio_transcription; +pub mod aws_base; +mod constants; diff --git a/litellm-rust/crates/core/src/providers/mistral/ocr/transformation.rs b/litellm-rust/crates/core/src/providers/mistral/ocr/transformation.rs index 1a33bc1e951..dc720cc4244 100644 --- a/litellm-rust/crates/core/src/providers/mistral/ocr/transformation.rs +++ b/litellm-rust/crates/core/src/providers/mistral/ocr/transformation.rs @@ -1,4 +1,4 @@ -use crate::error::{json_type_name, CoreError, CoreResult}; +use crate::error::{CoreError, CoreResult, json_type_name}; use crate::ocr::transformation::OcrProviderConfig; use crate::ocr::types::{OcrRequestData, OcrResponseData}; use serde_json::{Map, Value}; diff --git a/litellm-rust/crates/core/src/providers/mod.rs b/litellm-rust/crates/core/src/providers/mod.rs index d75e750a0ba..805600d6dbe 100644 --- a/litellm-rust/crates/core/src/providers/mod.rs +++ b/litellm-rust/crates/core/src/providers/mod.rs @@ -1,4 +1,7 @@ +pub mod anthropic; pub mod azure_ai; +#[cfg(feature = "bedrock-auth")] +pub mod bedrock; pub mod mistral; pub mod openai; pub mod vertex_ai; diff --git a/litellm-rust/crates/core/src/providers/openai/mod.rs b/litellm-rust/crates/core/src/providers/openai/mod.rs index 403e32975cf..62fcc50f2ac 100644 --- a/litellm-rust/crates/core/src/providers/openai/mod.rs +++ b/litellm-rust/crates/core/src/providers/openai/mod.rs @@ -1 +1,2 @@ pub mod realtime; +pub mod responses; diff --git a/litellm-rust/crates/core/src/providers/openai/realtime/transformation.rs b/litellm-rust/crates/core/src/providers/openai/realtime/transformation.rs index 626e4014ff9..b3f6b03b28a 100644 --- a/litellm-rust/crates/core/src/providers/openai/realtime/transformation.rs +++ b/litellm-rust/crates/core/src/providers/openai/realtime/transformation.rs @@ -1,6 +1,6 @@ +use crate::CoreResult; use crate::realtime::transformation::RealtimeProviderConfig; use crate::realtime::types::{RealtimeEvent, RealtimeTransformResult}; -use crate::CoreResult; /// Default OpenAI API base, used when the caller does not override `api_base`. pub const OPENAI_REALTIME_DEFAULT_API_BASE: &str = "https://api.openai.com"; diff --git a/litellm-rust/crates/core/src/providers/openai/responses/mod.rs b/litellm-rust/crates/core/src/providers/openai/responses/mod.rs new file mode 100644 index 00000000000..f239b6921fa --- /dev/null +++ b/litellm-rust/crates/core/src/providers/openai/responses/mod.rs @@ -0,0 +1 @@ +pub mod transformation; diff --git a/litellm-rust/crates/core/src/providers/openai/responses/transformation.rs b/litellm-rust/crates/core/src/providers/openai/responses/transformation.rs new file mode 100644 index 00000000000..e15197c468c --- /dev/null +++ b/litellm-rust/crates/core/src/providers/openai/responses/transformation.rs @@ -0,0 +1,48 @@ +use crate::CoreResult; +use crate::responses::types::{ResponsesWsEvent, ResponsesWsTransformResult}; +use crate::responses::websocket::{ResponsesWebSocketProviderConfig, enforce_model}; + +pub struct OpenAIResponsesWsConfig; + +pub const OPENAI_RESPONSES_WS_CONFIG: OpenAIResponsesWsConfig = OpenAIResponsesWsConfig; + +impl ResponsesWebSocketProviderConfig for OpenAIResponsesWsConfig { + fn supports_native_websocket(&self) -> bool { + true + } + + fn transform_ws_request( + &self, + event: &ResponsesWsEvent, + model: &str, + ) -> CoreResult { + Ok(ResponsesWsTransformResult::passthrough(enforce_model( + event, model, + ))) + } + + fn transform_ws_response( + &self, + event: &ResponsesWsEvent, + _model: &str, + ) -> CoreResult { + Ok(ResponsesWsTransformResult::passthrough(event.clone())) + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn openai_config_is_native_and_enforces_model() { + let event: ResponsesWsEvent = + serde_json::from_value(serde_json::json!({"type":"response.create"})) + .expect("valid event"); + let result = OPENAI_RESPONSES_WS_CONFIG + .transform_ws_request(&event, "gpt-5") + .expect("valid transform"); + assert_eq!(result.events[0].model(), Some("gpt-5")); + assert!(OPENAI_RESPONSES_WS_CONFIG.supports_native_websocket()); + } +} diff --git a/litellm-rust/crates/core/src/providers/vertex_ai/ocr/transformation.rs b/litellm-rust/crates/core/src/providers/vertex_ai/ocr/transformation.rs index 8639926c435..6300149c237 100644 --- a/litellm-rust/crates/core/src/providers/vertex_ai/ocr/transformation.rs +++ b/litellm-rust/crates/core/src/providers/vertex_ai/ocr/transformation.rs @@ -1,7 +1,7 @@ -use crate::error::{json_type_name, CoreError, CoreResult}; +use crate::error::{CoreError, CoreResult, json_type_name}; use crate::ocr::transformation::OcrProviderConfig; use crate::ocr::types::{OcrRequestData, OcrResponseData}; -use serde_json::{json, Map, Value}; +use serde_json::{Map, Value, json}; use crate::providers::mistral::ocr::transformation::MISTRAL_OCR_CONFIG; @@ -140,7 +140,7 @@ fn document_content_item(document: &Value) -> CoreResult { other => { return Err(CoreError::InvalidRequest(format!( "Unsupported document type: {other}. Expected 'image_url' or 'document_url'" - ))) + ))); } }; let url = object diff --git a/litellm-rust/crates/core/src/realtime/transformation.rs b/litellm-rust/crates/core/src/realtime/transformation.rs index a4baa27a6c2..69b88687000 100644 --- a/litellm-rust/crates/core/src/realtime/transformation.rs +++ b/litellm-rust/crates/core/src/realtime/transformation.rs @@ -1,5 +1,5 @@ -use crate::realtime::types::{RealtimeEvent, RealtimeTransformResult}; use crate::CoreResult; +use crate::realtime::types::{RealtimeEvent, RealtimeTransformResult}; pub trait RealtimeProviderConfig { /// Build the upstream WebSocket URL (e.g. `wss://api.openai.com/v1/realtime?model=…`). diff --git a/litellm-rust/crates/core/src/responses/instrumentation.rs b/litellm-rust/crates/core/src/responses/instrumentation.rs new file mode 100644 index 00000000000..ec04571da14 --- /dev/null +++ b/litellm-rust/crates/core/src/responses/instrumentation.rs @@ -0,0 +1,365 @@ +use std::future::Future; +use std::pin::Pin; +use std::sync::Mutex; +use std::time::{SystemTime, UNIX_EPOCH}; + +use serde_json::Value; + +use crate::call_lifecycle::{CallLifecycleContext, CallLifecycleHooks, CallLifecycleTiming}; +use crate::responses::types::{ResponsesWsEvent, ResponsesWsEventType}; +use crate::{CoreError, CoreResult}; + +#[derive(Clone, Debug, Default, PartialEq, Eq)] +pub struct ResponsesWsUsage { + pub prompt_tokens: u64, + pub completion_tokens: u64, + pub total_tokens: u64, +} + +#[derive(Clone, Debug, Default, PartialEq, Eq)] +pub struct ResponsesWsMetadata { + pub user_api_key_hash: Option, + pub user_api_key_user_id: Option, + pub user_api_key_team_id: Option, +} + +#[derive(Clone, Debug, PartialEq)] +pub struct ResponsesWsLogPayload { + pub id: String, + pub litellm_call_id: String, + pub call_type: String, + pub model: String, + pub custom_llm_provider: String, + pub response_cost: f64, + pub usage: ResponsesWsUsage, + pub start_time: f64, + pub end_time: f64, + pub stream: bool, + pub metadata: ResponsesWsMetadata, +} + +#[derive(Clone, Debug, PartialEq)] +pub enum ResponsesWsLogOutcome { + Success { + payload: ResponsesWsLogPayload, + callback: ResponsesWsCallbackPayload, + }, + Failure { + payload: ResponsesWsLogPayload, + callback: ResponsesWsCallbackPayload, + error_message: String, + error_kind: String, + }, +} + +#[derive(Clone, Debug, PartialEq)] +pub struct ResponsesWsCallbackPayload { + pub object: String, + pub value: Value, +} + +struct InstrumentationState { + litellm_call_id: String, + id: String, + model: String, + usage: ResponsesWsUsage, + start_time: f64, + end_time: f64, + metadata: ResponsesWsMetadata, + outcome: Option, +} + +pub struct ResponsesWsInstrumentation { + state: Mutex, +} + +impl ResponsesWsInstrumentation { + pub fn new( + litellm_call_id: impl Into, + model: impl Into, + metadata: ResponsesWsMetadata, + ) -> Self { + let litellm_call_id = litellm_call_id.into(); + let now = epoch_seconds(); + Self { + state: Mutex::new(InstrumentationState { + id: litellm_call_id.clone(), + litellm_call_id, + model: model.into(), + usage: ResponsesWsUsage::default(), + start_time: now, + end_time: now, + metadata, + outcome: None, + }), + } + } + + pub fn observe(&self, event: &ResponsesWsEvent) { + if !matches!( + event.event_type, + ResponsesWsEventType::ResponseCreated + | ResponsesWsEventType::ResponseCompleted + | ResponsesWsEventType::ResponseFailed + | ResponsesWsEventType::ResponseIncomplete + | ResponsesWsEventType::Error + ) { + return; + } + let Ok(mut state) = self.state.lock() else { + return; + }; + let Some(response) = event.data.get("response").and_then(Value::as_object) else { + return; + }; + if let Some(id) = response + .get("id") + .and_then(Value::as_str) + .filter(|value| !value.is_empty()) + { + state.id = id.to_string(); + state.litellm_call_id = id.to_string(); + } + if let Some(model) = response + .get("model") + .and_then(Value::as_str) + .filter(|value| !value.is_empty()) + { + state.model = model.to_string(); + } + let Some(usage) = response.get("usage").and_then(Value::as_object) else { + return; + }; + if let Some(input) = usage.get("input_tokens").and_then(Value::as_u64) { + state.usage.prompt_tokens += input; + } + if let Some(output) = usage.get("output_tokens").and_then(Value::as_u64) { + state.usage.completion_tokens += output; + } + state.usage.total_tokens += usage + .get("total_tokens") + .and_then(Value::as_u64) + .unwrap_or_else(|| { + usage + .get("input_tokens") + .and_then(Value::as_u64) + .unwrap_or(0) + + usage + .get("output_tokens") + .and_then(Value::as_u64) + .unwrap_or(0) + }); + } + + pub fn success_outcome(&self) -> ResponsesWsLogOutcome { + let mut state = self + .state + .lock() + .unwrap_or_else(|poisoned| poisoned.into_inner()); + state.end_time = epoch_seconds(); + ResponsesWsLogOutcome::Success { + payload: build_payload(&state), + callback: ResponsesWsCallbackPayload { + object: "responses_websocket".to_string(), + value: Value::Null, + }, + } + } + + pub fn failure_outcome(&self) -> ResponsesWsLogOutcome { + let mut state = self + .state + .lock() + .unwrap_or_else(|poisoned| poisoned.into_inner()); + state.end_time = epoch_seconds(); + ResponsesWsLogOutcome::Failure { + payload: build_payload(&state), + callback: ResponsesWsCallbackPayload { + object: "error".to_string(), + value: serde_json::json!({ + "message": "Responses WebSocket session ended in failure", + "kind": "ResponsesWebSocketError", + }), + }, + error_message: "Responses WebSocket session ended in failure".to_string(), + error_kind: "ResponsesWebSocketError".to_string(), + } + } + + pub fn take_outcome(&self) -> Option { + self.state + .lock() + .unwrap_or_else(|poisoned| poisoned.into_inner()) + .outcome + .take() + } + + pub fn take_or_build_outcome(&self, success: bool) -> ResponsesWsLogOutcome { + self.take_outcome().unwrap_or_else(|| { + if success { + self.success_outcome() + } else { + self.failure_outcome() + } + }) + } +} + +type LifecycleFuture<'a, T> = Pin> + Send + 'a>>; + +impl CallLifecycleHooks<(), (), ()> for ResponsesWsInstrumentation { + type PreCallFuture<'a> = LifecycleFuture<'a, ()>; + type DuringCallFuture<'a> = LifecycleFuture<'a, ()>; + type SuccessFuture<'a> = Pin + Send + 'a>>; + type FailureFuture<'a> = Pin + Send + 'a>>; + + fn async_pre_call_hook<'a>( + &'a self, + _context: &'a CallLifecycleContext, + request: (), + ) -> Self::PreCallFuture<'a> { + Box::pin(async move { Ok(request) }) + } + + fn async_during_call_hook<'a>( + &'a self, + _context: &'a CallLifecycleContext, + request: (), + ) -> Self::DuringCallFuture<'a> { + Box::pin(async move { Ok(request) }) + } + + fn async_log_success_event<'a>( + &'a self, + _context: &'a CallLifecycleContext, + _response: &'a (), + _timing: &'a CallLifecycleTiming, + ) -> Self::SuccessFuture<'a> { + Box::pin(async move { + let outcome = self.success_outcome(); + if let Ok(mut state) = self.state.lock() { + state.outcome = Some(outcome); + } + }) + } + + fn async_log_failure_event<'a>( + &'a self, + _context: &'a CallLifecycleContext, + _error: &'a CoreError, + _timing: &'a CallLifecycleTiming, + ) -> Self::FailureFuture<'a> { + Box::pin(async move { + let outcome = self.failure_outcome(); + if let Ok(mut state) = self.state.lock() { + state.outcome = Some(outcome); + } + }) + } +} + +fn build_payload(state: &InstrumentationState) -> ResponsesWsLogPayload { + ResponsesWsLogPayload { + id: state.id.clone(), + litellm_call_id: state.litellm_call_id.clone(), + call_type: "responses_websocket".to_string(), + model: state.model.clone(), + custom_llm_provider: "openai".to_string(), + response_cost: 0.0, + usage: state.usage.clone(), + start_time: state.start_time, + end_time: state.end_time, + stream: true, + metadata: state.metadata.clone(), + } +} + +fn epoch_seconds() -> f64 { + SystemTime::now() + .duration_since(UNIX_EPOCH) + .map(|duration| duration.as_secs_f64()) + .unwrap_or(0.0) +} + +#[cfg(test)] +mod tests { + use super::*; + + fn event(value: Value) -> ResponsesWsEvent { + serde_json::from_value(value).expect("valid Responses WebSocket event") + } + + #[test] + fn accumulates_upstream_usage_and_identity() { + let instrumentation = + ResponsesWsInstrumentation::new("call-1", "gpt-5", ResponsesWsMetadata::default()); + instrumentation.observe(&event(serde_json::json!({ + "type": "response.completed", + "response": { + "id": "resp-1", + "model": "gpt-5-mini", + "usage": { + "input_tokens": 3, + "output_tokens": 5, + "total_tokens": 8 + } + } + }))); + + let ResponsesWsLogOutcome::Success { payload, .. } = instrumentation.success_outcome() + else { + panic!("expected success outcome"); + }; + assert_eq!(payload.id, "resp-1"); + assert_eq!(payload.model, "gpt-5-mini"); + assert_eq!(payload.usage.prompt_tokens, 3); + assert_eq!(payload.usage.completion_tokens, 5); + assert_eq!(payload.usage.total_tokens, 8); + assert!(payload.end_time >= payload.start_time); + } + + #[test] + fn builds_failure_payload_without_dispatching_callbacks() { + let instrumentation = + ResponsesWsInstrumentation::new("call-1", "gpt-5", ResponsesWsMetadata::default()); + assert!(matches!( + instrumentation.failure_outcome(), + ResponsesWsLogOutcome::Failure { .. } + )); + } + + #[tokio::test] + async fn lifecycle_records_success_outcome_for_provider_completion() { + let instrumentation = + ResponsesWsInstrumentation::new("call-1", "gpt-5", ResponsesWsMetadata::default()); + let result = crate::call_lifecycle::CallLifecycle::default() + .run( + crate::call_lifecycle::CallLifecycleContext::new( + "responses_websocket", + "gpt-5", + "openai", + "call-1", + ), + (), + &instrumentation, + |_| async { Ok::<(), CoreError>(()) }, + ) + .await; + + assert!(result.is_ok()); + assert!(matches!( + instrumentation.take_outcome(), + Some(ResponsesWsLogOutcome::Success { .. }) + )); + } + + #[test] + fn builds_outcome_when_lifecycle_did_not_record_one() { + let instrumentation = + ResponsesWsInstrumentation::new("call-1", "gpt-5", ResponsesWsMetadata::default()); + assert!(matches!( + instrumentation.take_or_build_outcome(true), + ResponsesWsLogOutcome::Success { .. } + )); + } +} diff --git a/litellm-rust/crates/core/src/responses/mod.rs b/litellm-rust/crates/core/src/responses/mod.rs new file mode 100644 index 00000000000..5ec5a2caef8 --- /dev/null +++ b/litellm-rust/crates/core/src/responses/mod.rs @@ -0,0 +1,3 @@ +pub mod instrumentation; +pub mod types; +pub mod websocket; diff --git a/litellm-rust/crates/core/src/responses/types.rs b/litellm-rust/crates/core/src/responses/types.rs new file mode 100644 index 00000000000..4942309992e --- /dev/null +++ b/litellm-rust/crates/core/src/responses/types.rs @@ -0,0 +1,166 @@ +use serde::{Deserialize, Deserializer, Serialize, Serializer}; +use serde_json::{Map, Value}; + +#[derive(Clone, Debug, PartialEq, Eq)] +pub enum ResponsesWsEventType { + ResponseCreate, + ResponseCreated, + ResponseCompleted, + ResponseFailed, + ResponseIncomplete, + Error, + Other(String), +} + +impl ResponsesWsEventType { + pub fn as_str(&self) -> &str { + match self { + Self::ResponseCreate => "response.create", + Self::ResponseCreated => "response.created", + Self::ResponseCompleted => "response.completed", + Self::ResponseFailed => "response.failed", + Self::ResponseIncomplete => "response.incomplete", + Self::Error => "error", + Self::Other(value) => value, + } + } +} + +impl Serialize for ResponsesWsEventType { + fn serialize(&self, serializer: S) -> Result + where + S: Serializer, + { + serializer.serialize_str(self.as_str()) + } +} + +impl<'de> Deserialize<'de> for ResponsesWsEventType { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + let value = String::deserialize(deserializer)?; + Ok(match value.as_str() { + "response.create" => Self::ResponseCreate, + "response.created" => Self::ResponseCreated, + "response.completed" => Self::ResponseCompleted, + "response.failed" => Self::ResponseFailed, + "response.incomplete" => Self::ResponseIncomplete, + "error" => Self::Error, + _ => Self::Other(value), + }) + } +} + +#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)] +pub struct ResponsesWsEvent { + #[serde(rename = "type")] + pub event_type: ResponsesWsEventType, + #[serde(flatten)] + pub data: Map, +} + +impl ResponsesWsEvent { + pub fn model(&self) -> Option<&str> { + let model = self.data.get("model").and_then(Value::as_str); + if model.is_some() { + return model; + } + self.data + .get("response") + .and_then(Value::as_object) + .and_then(|response| response.get("model")) + .and_then(Value::as_str) + } + + pub fn is_response_create(&self) -> bool { + self.event_type == ResponsesWsEventType::ResponseCreate + } +} + +#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)] +pub struct ResponsesWsTransformResult { + pub events: Vec, +} + +impl ResponsesWsTransformResult { + pub fn passthrough(event: ResponsesWsEvent) -> Self { + Self { + events: vec![event], + } + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +pub struct ResponsesErrorFrame { + #[serde(rename = "type")] + pub frame_type: &'static str, + pub error: ResponsesErrorBody, +} + +impl ResponsesErrorFrame { + pub fn invalid_request(message: impl Into) -> Self { + Self { + frame_type: "error", + error: ResponsesErrorBody { + error_type: "invalid_request_error", + message: message.into(), + }, + } + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +pub struct ResponsesErrorBody { + #[serde(rename = "type")] + pub error_type: &'static str, + pub message: String, +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn event_type_round_trips_known_and_unknown_values() { + let known: ResponsesWsEventType = + serde_json::from_str("\"response.completed\"").expect("valid event type"); + assert_eq!(known, ResponsesWsEventType::ResponseCompleted); + let unknown: ResponsesWsEventType = + serde_json::from_str("\"response.output_text.delta\"").expect("valid event type"); + assert_eq!( + unknown, + ResponsesWsEventType::Other("response.output_text.delta".to_string()) + ); + } + + #[test] + fn error_frame_matches_proxy_shape() { + let frame = ResponsesErrorFrame::invalid_request("missing model"); + assert_eq!( + serde_json::to_value(frame).expect("serializable"), + serde_json::json!({ + "type": "error", + "error": { + "type": "invalid_request_error", + "message": "missing model" + } + }) + ); + } + + #[test] + fn model_reads_flat_and_nested_create_shapes() { + let flat: ResponsesWsEvent = + serde_json::from_value(serde_json::json!({"type":"response.create","model":"gpt-5"})) + .expect("valid event"); + let nested: ResponsesWsEvent = serde_json::from_value(serde_json::json!({ + "type":"response.create", + "response":{"model":"gpt-5-mini"} + })) + .expect("valid event"); + assert_eq!(flat.model(), Some("gpt-5")); + assert_eq!(nested.model(), Some("gpt-5-mini")); + } +} diff --git a/litellm-rust/crates/core/src/responses/websocket.rs b/litellm-rust/crates/core/src/responses/websocket.rs new file mode 100644 index 00000000000..92dc19627a0 --- /dev/null +++ b/litellm-rust/crates/core/src/responses/websocket.rs @@ -0,0 +1,188 @@ +use crate::CoreResult; +use crate::constants::{OPENAI_RESPONSES_DEFAULT_API_BASE, OPENAI_RESPONSES_PATH}; +use crate::responses::types::{ResponsesWsEvent, ResponsesWsEventType, ResponsesWsTransformResult}; + +pub trait ResponsesWebSocketProviderConfig: Sync { + fn supports_native_websocket(&self) -> bool { + false + } + + fn model_in_websocket_url(&self) -> bool { + true + } + + fn complete_websocket_url(&self, api_base: Option<&str>, model: &str) -> String { + complete_websocket_url(api_base, model, self.model_in_websocket_url()) + } + + fn transform_ws_request( + &self, + event: &ResponsesWsEvent, + model: &str, + ) -> CoreResult; + + fn transform_ws_response( + &self, + event: &ResponsesWsEvent, + model: &str, + ) -> CoreResult; +} + +pub fn complete_websocket_url( + api_base: Option<&str>, + model: &str, + model_in_websocket_url: bool, +) -> String { + let base = api_base + .map(str::trim) + .filter(|value| !value.is_empty()) + .unwrap_or(OPENAI_RESPONSES_DEFAULT_API_BASE); + let (base_without_query, query) = base + .split_once('?') + .map_or((base, None), |(value, query)| (value, Some(query))); + let response_url = format!( + "{}{}", + base_without_query.trim_end_matches('/'), + OPENAI_RESPONSES_PATH + ); + let scheme_flipped = if let Some(rest) = response_url.strip_prefix("https://") { + format!("wss://{rest}") + } else if let Some(rest) = response_url.strip_prefix("http://") { + format!("ws://{rest}") + } else { + response_url + }; + let url = query.map_or(scheme_flipped.clone(), |value| { + format!("{scheme_flipped}?{value}") + }); + if !model_in_websocket_url + || query.is_some_and(|value| { + value + .split('&') + .any(|part| part.split('=').next() == Some("model")) + }) + { + return url; + } + format!( + "{url}{}model={}", + if query.is_some() { "&" } else { "?" }, + percent_encode(model) + ) +} + +fn percent_encode(value: &str) -> String { + value + .bytes() + .map(|byte| { + if byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_' | b'~') { + format!("{}", byte as char) + } else { + format!("%{byte:02X}") + } + }) + .collect() +} + +pub fn enforce_model(event: &ResponsesWsEvent, model: &str) -> ResponsesWsEvent { + if !event.is_response_create() { + return event.clone(); + } + let mut enforced = event.clone(); + let has_flat_model = enforced.data.contains_key("model"); + if let Some(response) = enforced + .data + .get_mut("response") + .and_then(serde_json::Value::as_object_mut) + { + response.insert( + "model".to_string(), + serde_json::Value::String(model.to_string()), + ); + if has_flat_model { + enforced.data.insert( + "model".to_string(), + serde_json::Value::String(model.to_string()), + ); + } + } else { + enforced.data.insert( + "model".to_string(), + serde_json::Value::String(model.to_string()), + ); + } + enforced +} + +pub fn is_terminal_event(event_type: &ResponsesWsEventType) -> bool { + matches!( + event_type, + ResponsesWsEventType::ResponseCreated + | ResponsesWsEventType::ResponseCompleted + | ResponsesWsEventType::ResponseFailed + | ResponsesWsEventType::ResponseIncomplete + | ResponsesWsEventType::Error + ) +} + +#[cfg(test)] +mod tests { + use super::*; + + fn event(value: serde_json::Value) -> ResponsesWsEvent { + serde_json::from_value(value).expect("valid event") + } + + #[test] + fn url_construction_matches_python_defaults_and_query_behavior() { + assert_eq!( + complete_websocket_url(None, "gpt-5", true), + "wss://api.openai.com/v1/responses?model=gpt-5" + ); + assert_eq!( + complete_websocket_url(Some("http://localhost:8080/"), "gpt 5", true), + "ws://localhost:8080/responses?model=gpt%205" + ); + assert_eq!( + complete_websocket_url(Some("https://example.test/v1?foo=bar"), "gpt-5", true), + "wss://example.test/v1/responses?foo=bar&model=gpt-5" + ); + assert_eq!( + complete_websocket_url(Some("https://example.test?model=existing"), "gpt-5", true), + "wss://example.test/responses?model=existing" + ); + } + + #[test] + fn enforce_model_overrides_flat_and_nested_values() { + let flat = enforce_model( + &event(serde_json::json!({"type":"response.create","model":"wrong"})), + "gpt-5", + ); + assert_eq!(flat.model(), Some("gpt-5")); + let nested = enforce_model( + &event(serde_json::json!({ + "type":"response.create", + "model":"wrong", + "response":{"model":"also-wrong"} + })), + "gpt-5", + ); + assert_eq!(nested.model(), Some("gpt-5")); + assert_eq!( + nested + .data + .get("response") + .and_then(|value| value.get("model")), + Some(&serde_json::json!("gpt-5")) + ); + let nested_without_flat = enforce_model( + &event(serde_json::json!({ + "type":"response.create", + "response":{"model":"also-wrong"} + })), + "gpt-5", + ); + assert!(!nested_without_flat.data.contains_key("model")); + } +} diff --git a/litellm-rust/crates/core/tests/workspace_crate_allowlist.rs b/litellm-rust/crates/core/tests/workspace_crate_allowlist.rs index a56d19b8242..656ba033b62 100644 --- a/litellm-rust/crates/core/tests/workspace_crate_allowlist.rs +++ b/litellm-rust/crates/core/tests/workspace_crate_allowlist.rs @@ -62,12 +62,17 @@ fn parse_members(manifest: &str) -> BTreeSet { members } -/// The immediate subdirectory names under `crates/`. +/// The crate subdirectory names under `crates/`. +/// +/// A directory counts as a crate only when it holds a `Cargo.toml`; non-crate +/// directories (e.g. docs like `CODING_STANDARDS/`) are ignored so they can live +/// under `crates/` without tripping the crate-proliferation guard. fn crate_dirs(root: &Path) -> BTreeSet { fs::read_dir(root.join("crates")) .expect("crates/ directory should exist") .filter_map(Result::ok) .filter(|entry| entry.file_type().map(|ty| ty.is_dir()).unwrap_or(false)) + .filter(|entry| entry.path().join("Cargo.toml").is_file()) .map(|entry| entry.file_name().to_string_lossy().into_owned()) .collect() } diff --git a/litellm-rust/crates/python-bridge/AGENTS.md b/litellm-rust/crates/python-bridge/AGENTS.md index d6d3d90e6ab..ad3cddfa5fd 100644 --- a/litellm-rust/crates/python-bridge/AGENTS.md +++ b/litellm-rust/crates/python-bridge/AGENTS.md @@ -1,3 +1,3 @@ -litellm-python-bridge is the PyO3 cdylib that exposes Rust to the litellm Python SDK — a thin adapter (Python objects → Rust calls → Python results) over litellm-ai-gateway. +litellm-python-bridge is the PyO3 cdylib that exposes Rust to the litellm Python SDK — a thin adapter (Python objects → Rust calls → Python results) over the litellm-core route entrypoints (e.g. `litellm_core::messages::messages`). -Keep it thin: no business logic, no transforms, no I/O orchestration — just marshal in/out and call into litellm-ai-gateway. +Keep it thin: no business logic, no transforms, no I/O orchestration — just marshal in/out and call the core entrypoint. diff --git a/litellm-rust/crates/python-bridge/CLAUDE.md b/litellm-rust/crates/python-bridge/CLAUDE.md index efa1a554c9c..3ce8b8c639a 100644 --- a/litellm-rust/crates/python-bridge/CLAUDE.md +++ b/litellm-rust/crates/python-bridge/CLAUDE.md @@ -11,13 +11,19 @@ Python-compatible dictionaries. ## Bridge Shape - Prefer one stable method per top-level LiteLLM route, for example - `ocr(payload)`. + `messages(...)`, calling the matching `litellm-core` entrypoint. - Do not add one exported PyO3 function per provider helper unless there is a measured reason. -- Provider dispatch belongs in Rust route modules such as - `litellm_providers::ocr`, not in this PyO3 crate. +- Provider dispatch belongs in the `litellm-core` route module (e.g. + `litellm_core::messages`), not in this PyO3 crate. - Python owns rollout state and fallback. Rust should return errors; Python - decides whether to raise or fall back. + decides whether to raise or fall back. For a rust-only provider/route (no + Python reference), the Python side is a thin dispatch that calls Rust and + raises when the bridge is unavailable, with no fallback. +- Keep the Python interface minimal (well under 100 lines per route): it only + marshals inputs and calls Rust. Do not add per-route feature flags, and do + not put provider dispatch in `litellm/main.py`; it lives in a thin dispatch + class under `litellm/llms///`. ## Data Handling diff --git a/litellm-rust/crates/python-bridge/Cargo.toml b/litellm-rust/crates/python-bridge/Cargo.toml index 83e163c38f1..20a9ba789ce 100644 --- a/litellm-rust/crates/python-bridge/Cargo.toml +++ b/litellm-rust/crates/python-bridge/Cargo.toml @@ -10,7 +10,7 @@ name = "_native" crate-type = ["cdylib"] [dependencies] -litellm-core.workspace = true +litellm-core = { workspace = true, features = ["bedrock-auth"] } litellm-ai-gateway = { workspace = true, default-features = false } pyo3 = { workspace = true, features = ["extension-module"] } pyo3-async-runtimes.workspace = true diff --git a/litellm-rust/crates/python-bridge/src/gil.rs b/litellm-rust/crates/python-bridge/src/gil.rs index dc1b591735c..e887c8ec1e3 100644 --- a/litellm-rust/crates/python-bridge/src/gil.rs +++ b/litellm-rust/crates/python-bridge/src/gil.rs @@ -2,7 +2,7 @@ //! //! A single chokepoint for releasing the GIL around blocking work. Every //! blocking call in the bridge goes through [`release_gil`] instead of calling -//! `Python::allow_threads` directly, so the release count stays accurate and we +//! `Python::detach` directly, so the release count stays accurate and we //! have one place to extend later (timing histograms, per-call labels, etc.). use std::sync::atomic::{AtomicU64, Ordering}; @@ -23,7 +23,7 @@ where T: Send, { GIL_RELEASES.fetch_add(1, Ordering::Relaxed); - py.allow_threads(f) + py.detach(f) } /// Total GIL releases performed by the bridge so far. diff --git a/litellm-rust/crates/python-bridge/src/lib.rs b/litellm-rust/crates/python-bridge/src/lib.rs index 946a99f990c..f0cc26a0cca 100644 --- a/litellm-rust/crates/python-bridge/src/lib.rs +++ b/litellm-rust/crates/python-bridge/src/lib.rs @@ -1,7 +1,14 @@ +use std::collections::HashMap; use std::time::Duration; -use litellm_ai_gateway::io::ocr::{ocr as run_ocr, OcrRequest}; +use litellm_ai_gateway::io::audio_transcription::{ + AudioTranscriptionRequest, audio_transcription as run_audio_transcription, +}; +use litellm_ai_gateway::io::ocr::{OcrRequest, ocr as run_ocr}; +use litellm_ai_gateway::io::responses_ws::ResponsesWebSocketConnection as RustResponsesWebSocketConnection; use litellm_core::error::CoreError; +use litellm_core::messages::messages as run_messages; +use litellm_core::messages::types::{AnthropicMessagesResponse, MessagesRequest}; use pyo3::exceptions::{PyRuntimeError, PyValueError}; use pyo3::prelude::*; use pyo3::types::{PyAny, PyDict}; @@ -29,6 +36,15 @@ fn json_to_py(py: Python<'_>, value: Value) -> PyResult> { Ok(json.call_method1("loads", (encoded,))?.unbind()) } +fn messages_response_to_py( + py: Python<'_>, + response: AnthropicMessagesResponse, +) -> PyResult> { + let value = + serde_json::to_value(response).map_err(|err| PyValueError::new_err(err.to_string()))?; + json_to_py(py, value) +} + fn core_error_to_pyerr(err: CoreError) -> PyErr { match err { CoreError::Auth(message) => PyValueError::new_err(message), @@ -64,6 +80,76 @@ fn optional_timeout(timeout_seconds: Option) -> Option { }) } +fn marshal_headers( + py: Python<'_>, + headers: Option>, +) -> PyResult> { + let value = match headers { + Some(headers) => py_to_json(py, headers.bind(py))?, + None => Value::Object(Map::new()), + }; + let Value::Object(headers) = value else { + return Err(PyValueError::new_err("headers must be a dict")); + }; + headers + .into_iter() + .map(|(name, value)| { + value + .as_str() + .map(|value| (name, value.to_string())) + .ok_or_else(|| PyValueError::new_err("header values must be strings")) + }) + .collect() +} + +#[pyclass] +struct ResponsesWebSocketConnection { + inner: RustResponsesWebSocketConnection, +} + +#[pymethods] +impl ResponsesWebSocketConnection { + #[classmethod] + #[pyo3(signature = (url, headers=None, timeout_seconds=None))] + fn connect<'py>( + _cls: &Bound<'py, pyo3::types::PyType>, + py: Python<'py>, + url: String, + headers: Option>, + timeout_seconds: Option, + ) -> PyResult> { + let headers = marshal_headers(py, headers)?; + let timeout = optional_timeout(timeout_seconds); + pyo3_async_runtimes::tokio::future_into_py(py, async move { + let inner = RustResponsesWebSocketConnection::connect_url(&url, &headers, timeout) + .await + .map_err(core_error_to_pyerr)?; + Python::attach(|py| Py::new(py, ResponsesWebSocketConnection { inner })) + }) + } + + fn send_text<'py>(&self, py: Python<'py>, text: String) -> PyResult> { + let inner = self.inner.clone(); + pyo3_async_runtimes::tokio::future_into_py(py, async move { + inner.send_text(text).await.map_err(core_error_to_pyerr) + }) + } + + fn recv_text<'py>(&self, py: Python<'py>) -> PyResult> { + let inner = self.inner.clone(); + pyo3_async_runtimes::tokio::future_into_py(py, async move { + inner.recv_text().await.map_err(core_error_to_pyerr) + }) + } + + fn close<'py>(&self, py: Python<'py>) -> PyResult> { + let inner = self.inner.clone(); + pyo3_async_runtimes::tokio::future_into_py(py, async move { + inner.close().await.map_err(core_error_to_pyerr) + }) + } +} + fn marshal_inputs( py: Python<'_>, document: Py, @@ -167,7 +253,180 @@ fn aocr( .await .map_err(core_error_to_pyerr)?; - Python::with_gil(|py| json_to_py(py, value)) + Python::attach(|py| json_to_py(py, value)) + }) +} + +#[pyfunction] +#[pyo3(signature = (model, audio, api_key=None, api_base=None, custom_llm_provider=None, extra_headers=None, optional_params=None, timeout_seconds=None))] +#[allow(clippy::too_many_arguments)] +fn transcription( + py: Python<'_>, + model: String, + audio: Py, + api_key: Option, + api_base: Option, + custom_llm_provider: Option, + extra_headers: Option>, + optional_params: Option>, + timeout_seconds: Option, +) -> PyResult> { + let audio = py_to_json(py, audio.bind(py))?; + let extra_headers = match extra_headers { + Some(headers) => Some(optional_object_to_map(py, "extra_headers", Some(headers))?), + None => None, + }; + let optional_params = optional_object_to_map(py, "optional_params", optional_params)?; + let timeout = optional_timeout(timeout_seconds); + let result = gil::release_gil(py, || { + pyo3_async_runtimes::tokio::get_runtime().block_on(run_audio_transcription( + AudioTranscriptionRequest { + model: &model, + audio, + api_key: api_key.as_deref(), + api_base: api_base.as_deref(), + custom_llm_provider: custom_llm_provider.as_deref(), + extra_headers, + optional_params, + timeout, + callbacks: Vec::new(), + guardrails: Vec::new(), + request_metadata: Default::default(), + litellm_call_id: None, + }, + )) + }); + match result { + Ok(value) => json_to_py(py, value), + Err(err) => Err(core_error_to_pyerr(err)), + } +} + +#[pyfunction] +#[pyo3(signature = (model, audio, api_key=None, api_base=None, custom_llm_provider=None, extra_headers=None, optional_params=None, timeout_seconds=None))] +#[allow(clippy::too_many_arguments)] +fn atranscription( + py: Python<'_>, + model: String, + audio: Py, + api_key: Option, + api_base: Option, + custom_llm_provider: Option, + extra_headers: Option>, + optional_params: Option>, + timeout_seconds: Option, +) -> PyResult> { + let audio = py_to_json(py, audio.bind(py))?; + let extra_headers = match extra_headers { + Some(headers) => Some(optional_object_to_map(py, "extra_headers", Some(headers))?), + None => None, + }; + let optional_params = optional_object_to_map(py, "optional_params", optional_params)?; + let timeout = optional_timeout(timeout_seconds); + pyo3_async_runtimes::tokio::future_into_py(py, async move { + let value = run_audio_transcription(AudioTranscriptionRequest { + model: &model, + audio, + api_key: api_key.as_deref(), + api_base: api_base.as_deref(), + custom_llm_provider: custom_llm_provider.as_deref(), + extra_headers, + optional_params, + timeout, + callbacks: Vec::new(), + guardrails: Vec::new(), + request_metadata: Default::default(), + litellm_call_id: None, + }) + .await + .map_err(core_error_to_pyerr)?; + Python::attach(|py| json_to_py(py, value)) + }) +} + +type MarshaledMessagesInputs = (Value, Option>, Option); + +fn marshal_messages_inputs( + py: Python<'_>, + body: Py, + extra_headers: Option>, + timeout_seconds: Option, +) -> PyResult { + let body = py_to_json(py, body.bind(py))?; + if !body.is_object() { + return Err(PyValueError::new_err("body must be a dict")); + } + let extra_headers = match extra_headers { + Some(headers) => Some(optional_object_to_map(py, "extra_headers", Some(headers))?), + None => None, + }; + Ok((body, extra_headers, optional_timeout(timeout_seconds))) +} + +#[pyfunction] +#[pyo3(signature = (model, body, api_key=None, api_base=None, custom_llm_provider=None, extra_headers=None, timeout_seconds=None))] +#[allow(clippy::too_many_arguments)] +fn messages( + py: Python<'_>, + model: String, + body: Py, + api_key: Option, + api_base: Option, + custom_llm_provider: Option, + extra_headers: Option>, + timeout_seconds: Option, +) -> PyResult> { + let (body, extra_headers, timeout) = + marshal_messages_inputs(py, body, extra_headers, timeout_seconds)?; + + let result = gil::release_gil(py, || { + pyo3_async_runtimes::tokio::get_runtime().block_on(run_messages(MessagesRequest { + model: &model, + body, + api_key: api_key.as_deref(), + api_base: api_base.as_deref(), + custom_llm_provider: custom_llm_provider.as_deref(), + extra_headers, + timeout, + })) + }); + + match result { + Ok(response) => messages_response_to_py(py, response), + Err(err) => Err(core_error_to_pyerr(err)), + } +} + +#[pyfunction] +#[pyo3(signature = (model, body, api_key=None, api_base=None, custom_llm_provider=None, extra_headers=None, timeout_seconds=None))] +#[allow(clippy::too_many_arguments)] +fn amessages( + py: Python<'_>, + model: String, + body: Py, + api_key: Option, + api_base: Option, + custom_llm_provider: Option, + extra_headers: Option>, + timeout_seconds: Option, +) -> PyResult> { + let (body, extra_headers, timeout) = + marshal_messages_inputs(py, body, extra_headers, timeout_seconds)?; + + pyo3_async_runtimes::tokio::future_into_py(py, async move { + let response = run_messages(MessagesRequest { + model: &model, + body, + api_key: api_key.as_deref(), + api_base: api_base.as_deref(), + custom_llm_provider: custom_llm_provider.as_deref(), + extra_headers, + timeout, + }) + .await + .map_err(core_error_to_pyerr)?; + + Python::attach(|py| messages_response_to_py(py, response)) }) } @@ -182,6 +441,11 @@ fn gil_stats(py: Python<'_>) -> PyResult> { fn _native(module: &Bound<'_, PyModule>) -> PyResult<()> { module.add_function(wrap_pyfunction!(ocr, module)?)?; module.add_function(wrap_pyfunction!(aocr, module)?)?; + module.add_function(wrap_pyfunction!(transcription, module)?)?; + module.add_function(wrap_pyfunction!(atranscription, module)?)?; + module.add_function(wrap_pyfunction!(messages, module)?)?; + module.add_function(wrap_pyfunction!(amessages, module)?)?; + module.add_class::()?; module.add_function(wrap_pyfunction!(gil_stats, module)?)?; Ok(()) } diff --git a/litellm/__init__.py b/litellm/__init__.py index 6e2a03b7c7c..3f8c742c5a2 100644 --- a/litellm/__init__.py +++ b/litellm/__init__.py @@ -211,6 +211,9 @@ filter_invalid_headers: Optional[bool] = False add_user_information_to_llm_headers: Optional[bool] = ( None # adds user_id, team_id, token hash (params from StandardLoggingMetadata) to request headers ) +overwrite_user_with_key_hash: bool = ( + False # force the outgoing `user` param to the hashed api key, so providers see a stable, tamper-proof id +) store_audit_logs = False # Enterprise feature, allow users to see audit logs skip_system_message_in_guardrail: bool = False skip_tool_message_in_guardrail: bool = False @@ -315,6 +318,11 @@ disable_token_counter: bool = False disable_add_transform_inline_image_block: bool = False disable_add_user_agent_to_request_tags: bool = False disable_anthropic_gemini_context_caching_transform: bool = False +enable_anthropic_prompt_caching: bool = os.getenv("LITELLM_ENABLE_ANTHROPIC_PROMPT_CACHING", "false").lower() == "true" +_anthropic_prompt_caching_ttl_env: Optional[str] = os.getenv("LITELLM_ANTHROPIC_PROMPT_CACHING_TTL") +anthropic_prompt_caching_ttl: Optional[Literal["5m", "1h"]] = ( + "1h" if _anthropic_prompt_caching_ttl_env == "1h" else "5m" if _anthropic_prompt_caching_ttl_env == "5m" else None +) disable_vertex_batch_output_transformation: bool = False extra_spend_tag_headers: Optional[List[str]] = None in_memory_llm_clients_cache: "LLMClientCache" @@ -422,7 +430,9 @@ default_team_settings: Optional[List] = None max_user_budget: Optional[float] = None default_max_internal_user_budget: Optional[float] = None max_internal_user_budget: Optional[float] = None -max_ui_session_budget: Optional[float] = 0.25 # $0.25 USD budgets for UI Chat sessions +max_ui_session_budget: Optional[float] = ( + 1.0 # USD budget for each dashboard login session (playground, test connection) +) internal_user_budget_duration: Optional[str] = None tag_budget_config: Optional[Dict[str, "BudgetConfig"]] = None max_end_user_budget: Optional[float] = None diff --git a/litellm/_redis.py b/litellm/_redis.py index bb3a0974241..fe5c5cdabe9 100644 --- a/litellm/_redis.py +++ b/litellm/_redis.py @@ -325,8 +325,19 @@ def _get_redis_client_logic(**env_overrides): value = get_secret(v) # type: ignore env_overrides[k] = value + environment_kwargs = _redis_kwargs_from_environment() + + # An explicitly configured connection target outranks REDIS_URL from the + # environment. Without this, the url branch below strips the caller's + # host/port/password and silently connects to whatever REDIS_URL names. + caller_named_a_target = any( + env_overrides.get(key) is not None for key in ("host", "startup_nodes", "sentinel_nodes") + ) + if caller_named_a_target and env_overrides.get("url") is None: + environment_kwargs.pop("url", None) + redis_kwargs = { - **_redis_kwargs_from_environment(), + **environment_kwargs, **env_overrides, } @@ -677,11 +688,8 @@ def get_redis_connection_pool( elif redis_connect_func and hasattr(redis_connect_func, "_gcp_service_account"): redis_kwargs["credential_provider"] = GCPIAMCredentialProvider(redis_connect_func._gcp_service_account) - connection_class = async_redis.Connection - if "ssl" in redis_kwargs: - connection_class = async_redis.SSLConnection - redis_kwargs.pop("ssl", None) - redis_kwargs["connection_class"] = connection_class + if redis_kwargs.pop("ssl", None): + redis_kwargs["connection_class"] = async_redis.SSLConnection return async_redis.BlockingConnectionPool(timeout=REDIS_CONNECTION_POOL_TIMEOUT, **redis_kwargs) diff --git a/litellm/anthropic_beta_headers_config.json b/litellm/anthropic_beta_headers_config.json index 11fdb26e42d..3f6817f6e35 100644 --- a/litellm/anthropic_beta_headers_config.json +++ b/litellm/anthropic_beta_headers_config.json @@ -102,7 +102,7 @@ "computer-use-2025-01-24": "computer-use-2025-01-24", "computer-use-2025-11-24": "computer-use-2025-11-24", "context-1m-2025-08-07": "context-1m-2025-08-07", - "context-management-2025-06-27": null, + "context-management-2025-06-27": "context-management-2025-06-27", "effort-2025-11-24": "effort-2025-11-24", "fast-mode-2026-02-01": null, "files-api-2025-04-14": null, diff --git a/litellm/batches/batch_utils.py b/litellm/batches/batch_utils.py index 11b07d39981..2fcb8455e90 100644 --- a/litellm/batches/batch_utils.py +++ b/litellm/batches/batch_utils.py @@ -118,6 +118,7 @@ def _batch_cost_calculator( total_cost = _get_batch_job_cost_from_file_content( file_content_dictionary=file_content_dictionary, custom_llm_provider=custom_llm_provider, + model_name=model_name, model_info=model_info, ) verbose_logger.debug("total_cost=%s", total_cost) @@ -363,6 +364,7 @@ def _count_entry_tokens( def _get_batch_job_cost_from_file_content( file_content_dictionary: List[dict], custom_llm_provider: Literal["openai", "azure", "vertex_ai", "hosted_vllm", "anthropic"] = "openai", + model_name: Optional[str] = None, model_info: Optional[ModelInfo] = None, ) -> float: """ @@ -377,9 +379,15 @@ def _get_batch_job_cost_from_file_content( for _item in file_content_dictionary: if _batch_response_was_successful(_item, custom_llm_provider): _response_body = _get_response_from_batch_job_output_file(_item, custom_llm_provider) - if model_info is not None or custom_llm_provider == "anthropic": + if model_info is not None or custom_llm_provider in ("anthropic", "bedrock"): usage = _get_batch_job_usage_from_response_body(_response_body, custom_llm_provider) - model = _response_body.get("model", "") + # Bedrock batch output lines report a short internal model id + # (e.g. "claude-sonnet-4-6") that is not in the cost map; use the + # deployment model name for pricing when available. + if custom_llm_provider == "bedrock" and model_name: + model = model_name + else: + model = _response_body.get("model") or model_name or "" prompt_cost, completion_cost = batch_cost_calculator( usage=usage, model=model, @@ -485,7 +493,7 @@ def _get_batch_job_usage_from_response_body(response_body: dict, custom_llm_prov """ Get the tokens of a batch job from the response body """ - if custom_llm_provider == "anthropic": + if custom_llm_provider in ("anthropic", "bedrock"): from litellm.llms.anthropic.chat.transformation import AnthropicConfig return AnthropicConfig().calculate_usage( @@ -513,6 +521,8 @@ def _get_response_from_batch_job_output_file(batch_job_output_file: dict, custom """ if custom_llm_provider == "anthropic": return _get_anthropic_result_from_batch_results_line(batch_job_output_file).get("message", None) or {} + if custom_llm_provider == "bedrock": + return batch_job_output_file.get("modelOutput", None) or {} _response: dict = batch_job_output_file.get("response", None) or {} _response_body = _response.get("body", None) or {} return _response_body @@ -523,9 +533,12 @@ def _batch_response_was_successful(batch_job_output_file: dict, custom_llm_provi Check if the batch job response was successful OpenAI-shaped output rows report ``response.status_code == 200``; Anthropic - message batch results lines report ``result.type == "succeeded"``. + message batch results lines report ``result.type == "succeeded"``; Bedrock + batch output lines report ``modelOutput`` (and no ``error``). """ if custom_llm_provider == "anthropic": return _get_anthropic_result_from_batch_results_line(batch_job_output_file).get("type") == "succeeded" + if custom_llm_provider == "bedrock": + return batch_job_output_file.get("modelOutput") is not None and batch_job_output_file.get("error") is None _response: dict = batch_job_output_file.get("response", None) or {} return _response.get("status_code", None) == 200 diff --git a/litellm/caching/caching_handler.py b/litellm/caching/caching_handler.py index c860f8e540d..b17e055c7ea 100644 --- a/litellm/caching/caching_handler.py +++ b/litellm/caching/caching_handler.py @@ -85,6 +85,22 @@ class CachingHandlerResponse(BaseModel): in_memory_cache_obj = InMemoryCache() +def _drop_logging_obj_from_kwargs(request_kwargs: dict[str, object]) -> dict[str, object]: + """ + The caching handler is stored on the Logging object + (``logging_obj._llm_caching_handler``), so keeping ``litellm_logging_obj`` + inside ``request_kwargs`` closes a reference cycle + (Logging -> LLMCachingHandler -> kwargs -> Logging) that keeps the full + request payload (messages included) alive until a generational GC pass + instead of being freed by refcount when the request ends. Nothing in the + caching layer reads the logging object from these kwargs; cache-key + generation ignores litellm-internal params. + """ + if "litellm_logging_obj" not in request_kwargs: + return request_kwargs + return {k: v for k, v in request_kwargs.items() if k != "litellm_logging_obj"} + + def _is_chat_completion_cached_dict(cached_result: dict) -> bool: cached_id = cached_result.get("id") if isinstance(cached_id, str) and cached_id.startswith("chatcmpl"): @@ -118,7 +134,7 @@ class LLMCachingHandler: self.async_streaming_chunks: List[ModelResponse] = [] self.sync_streaming_chunks: List[ModelResponse] = [] - self.request_kwargs = request_kwargs + self.request_kwargs = _drop_logging_obj_from_kwargs(request_kwargs) self.preset_cache_key: Optional[str] = None self.original_function = original_function self.start_time = start_time @@ -297,7 +313,7 @@ class LLMCachingHandler: new_kwargs.pop("metadata", None) if new_kwargs.get("stream") is True and "cache_key" not in new_kwargs: new_kwargs["cache_key"] = litellm.cache.get_cache_key(**new_kwargs) - self.request_kwargs = new_kwargs + self.request_kwargs = _drop_logging_obj_from_kwargs(new_kwargs) print_verbose("Checking Sync Cache") cached_result = litellm.cache.get_cache(**new_kwargs) if cached_result is not None: @@ -693,7 +709,7 @@ class LLMCachingHandler: new_kwargs.pop("metadata", None) if new_kwargs.get("stream") is True and "cache_key" not in new_kwargs: new_kwargs["cache_key"] = litellm.cache.get_cache_key(**new_kwargs) - self.request_kwargs = new_kwargs + self.request_kwargs = _drop_logging_obj_from_kwargs(new_kwargs) cached_result: Optional[Any] = None if call_type == CallTypes.aembedding.value: if isinstance(new_kwargs["input"], str): diff --git a/litellm/caching/disk_cache.py b/litellm/caching/disk_cache.py index d9f65ce949e..af8eb92849f 100644 --- a/litellm/caching/disk_cache.py +++ b/litellm/caching/disk_cache.py @@ -58,12 +58,12 @@ class DiskCache(BaseCache): return return_val def increment_cache(self, key, value: int, **kwargs) -> int: - # get the value - cached_value = self.get_cache(key=key) - init_value = cached_value if isinstance(cached_value, int) else 0 - value = init_value + value - self.set_cache(key, value, **kwargs) - return value + with self.disk_cache.transact(): + cached_value = self.get_cache(key=key) + init_value = cached_value if isinstance(cached_value, int) else 0 + new_value = init_value + value + self.set_cache(key, new_value, **kwargs) + return new_value async def async_get_cache(self, key, **kwargs): return self.get_cache(key=key, **kwargs) @@ -76,12 +76,7 @@ class DiskCache(BaseCache): return return_val async def async_increment(self, key, value: int, **kwargs) -> int: - # get the value - cached_value = await self.async_get_cache(key=key) - init_value = cached_value if isinstance(cached_value, int) else 0 - value = init_value + value - await self.async_set_cache(key, value, **kwargs) - return value + return self.increment_cache(key=key, value=value, **kwargs) def flush_cache(self): self.disk_cache.clear() diff --git a/litellm/caching/dual_cache.py b/litellm/caching/dual_cache.py index be618815a53..0e3c93946fd 100644 --- a/litellm/caching/dual_cache.py +++ b/litellm/caching/dual_cache.py @@ -103,6 +103,18 @@ class DualCache(BaseCache): if default_redis_ttl is not None: self.default_redis_ttl = default_redis_ttl + def _backfill_kwargs(self, kwargs: "dict[str, object]") -> "dict[str, object]": + """ + Kwargs for writing a Redis read result into the in-memory tier. + + Applies ``default_in_memory_ttl`` exactly like the write paths do; + without it, backfilled entries fall to ``InMemoryCache``'s own default + TTL and can outlive the TTL this cache was configured with. + """ + if "ttl" not in kwargs and self.default_in_memory_ttl is not None: + return {**kwargs, "ttl": self.default_in_memory_ttl} + return kwargs + def set_cache(self, key, value, local_only: bool = False, **kwargs): # Update both Redis and in-memory cache try: @@ -160,7 +172,7 @@ class DualCache(BaseCache): if redis_result is not None: # Update in-memory cache with the value from Redis - self.in_memory_cache.set_cache(key, redis_result, **kwargs) + self.in_memory_cache.set_cache(key, redis_result, **self._backfill_kwargs(kwargs)) result = redis_result @@ -226,7 +238,7 @@ class DualCache(BaseCache): if redis_result is not None: # Update in-memory cache with the value from Redis - await self.in_memory_cache.async_set_cache(key, redis_result, **kwargs) + await self.in_memory_cache.async_set_cache(key, redis_result, **self._backfill_kwargs(kwargs)) result = redis_result @@ -318,7 +330,7 @@ class DualCache(BaseCache): result[key_to_index[key]] = value if value is not None and self.in_memory_cache is not None: - await self.in_memory_cache.async_set_cache(key, value, **kwargs) + await self.in_memory_cache.async_set_cache(key, value, **self._backfill_kwargs(kwargs)) return result except Exception: diff --git a/litellm/caching/in_memory_cache.py b/litellm/caching/in_memory_cache.py index 2ad3f3f11b7..36b477f7a8b 100644 --- a/litellm/caching/in_memory_cache.py +++ b/litellm/caching/in_memory_cache.py @@ -12,6 +12,7 @@ import json import sys import time import heapq +import threading from typing import TYPE_CHECKING, Any, List, Optional if TYPE_CHECKING: @@ -46,6 +47,7 @@ class InMemoryCache(BaseCache): self.cache_dict: dict = {} self.ttl_dict: dict = {} self.expiration_heap: list[tuple[float, str]] = [] + self._increment_lock = threading.Lock() def check_value_size(self, value: Any): """ @@ -223,12 +225,13 @@ class InMemoryCache(BaseCache): return_val.append(val) return return_val - def increment_cache(self, key, value: int, **kwargs) -> int: - # get the value - init_value = self.get_cache(key=key) or 0 - value = init_value + value - self.set_cache(key, value, **kwargs) - return value + def increment_cache(self, key, value: float, **kwargs) -> float: + with self._increment_lock: + # keep read-modify-write atomic + init_value = self.get_cache(key=key) or 0 + value = init_value + value + self.set_cache(key, value, **kwargs) + return value async def async_get_cache(self, key, **kwargs): return self.get_cache(key=key, **kwargs) @@ -241,11 +244,7 @@ class InMemoryCache(BaseCache): return return_val async def async_increment(self, key, value: float, **kwargs) -> float: - # get the value - init_value = await self.async_get_cache(key=key) or 0 - value = init_value + value - await self.async_set_cache(key, value, **kwargs) - return value + return self.increment_cache(key=key, value=value, **kwargs) async def async_increment_pipeline( self, increment_list: List["RedisPipelineIncrementOperation"], **kwargs diff --git a/litellm/completion_extras/litellm_responses_transformation/handler.py b/litellm/completion_extras/litellm_responses_transformation/handler.py index 8f12d855880..15f5b28e30e 100644 --- a/litellm/completion_extras/litellm_responses_transformation/handler.py +++ b/litellm/completion_extras/litellm_responses_transformation/handler.py @@ -209,7 +209,15 @@ class ResponsesToCompletionBridgeHandler: json_mode=kwargs.get("json_mode"), ) elif isinstance(result, ModelResponse): - return result + if not stream: + return result + return self._completed_response_as_stream( + response=result, + model=model, + custom_llm_provider=custom_llm_provider, + logging_obj=logging_obj, + json_mode=kwargs.get("json_mode"), + ) elif not stream: responses_api_response = self._collect_response_from_stream(result) return self.transformation_handler.transform_response( @@ -299,7 +307,15 @@ class ResponsesToCompletionBridgeHandler: json_mode=kwargs.get("json_mode"), ) elif isinstance(result, ModelResponse): - return result + if not stream: + return result + return self._completed_response_as_stream( + response=result, + model=model, + custom_llm_provider=custom_llm_provider, + logging_obj=logging_obj, + json_mode=kwargs.get("json_mode"), + ) elif not stream: responses_api_response = await self._collect_response_from_stream_async(result) return self.transformation_handler.transform_response( @@ -331,6 +347,25 @@ class ResponsesToCompletionBridgeHandler: ) return self._apply_post_stream_processing(streamwrapper, model, custom_llm_provider) + def _completed_response_as_stream( + self, + response: "ModelResponse", + model: str, + custom_llm_provider: str, + logging_obj: "LiteLLMLoggingObj", + json_mode: bool | None, + ) -> "CustomStreamWrapper": + from litellm.litellm_core_utils.streaming_handler import CustomStreamWrapper + from litellm.llms.base_llm.base_model_iterator import MockResponseIterator + + streamwrapper = CustomStreamWrapper( + completion_stream=MockResponseIterator(model_response=response, json_mode=json_mode), + model=model, + custom_llm_provider=custom_llm_provider, + logging_obj=logging_obj, + ) + return self._apply_post_stream_processing(streamwrapper, model, custom_llm_provider) + @staticmethod def _apply_post_stream_processing( stream: "CustomStreamWrapper", diff --git a/litellm/completion_extras/litellm_responses_transformation/transformation.py b/litellm/completion_extras/litellm_responses_transformation/transformation.py index aecb2552b53..89a44fcdeef 100644 --- a/litellm/completion_extras/litellm_responses_transformation/transformation.py +++ b/litellm/completion_extras/litellm_responses_transformation/transformation.py @@ -35,6 +35,7 @@ from litellm.responses.sse_output_recovery import ( record_output_item_chunk, record_output_text_chunk, ) +from litellm.responses.utils import normalize_responses_api_stream_options from litellm.types.llms.openai import ( ChatCompletionAnnotation, ChatCompletionReasoningItem, @@ -320,6 +321,10 @@ class LiteLLMResponsesTransformationHandler(CompletionTransformationBridge): responses_api_request["tool_choice"] = ( # type: ignore[assignment] self._normalize_tool_choice_for_responses_api(value) ) + elif key == "stream_options": + stream_options = normalize_responses_api_stream_options(value) + if stream_options is not None: + responses_api_request["stream_options"] = stream_options elif key in ResponsesAPIOptionalRequestParams.__annotations__.keys(): responses_api_request[key] = value # type: ignore elif key == "previous_response_id": @@ -360,8 +365,6 @@ class LiteLLMResponsesTransformationHandler(CompletionTransformationBridge): continue if key == "instructions" and instructions: request_data["instructions"] = instructions - elif key == "stream_options" and isinstance(value, dict): - request_data["stream_options"] = value.get("include_obfuscation") elif key == "user" and isinstance(value, str): # OpenAI API requires user param to be max 64 chars - truncate if longer if len(value) <= 64: @@ -1074,6 +1077,7 @@ class LiteLLMResponsesTransformationHandler(CompletionTransformationBridge): class OpenAiResponsesToChatCompletionStreamIterator(BaseModelResponseIterator): def __init__(self, streaming_response, sync_stream: bool, json_mode: Optional[bool] = False): super().__init__(streaming_response, sync_stream, json_mode) + self._chat_completion_id: str | None = None def _handle_string_chunk( self, str_line: Union[str, "BaseModel"] @@ -1381,4 +1385,13 @@ class OpenAiResponsesToChatCompletionStreamIterator(BaseModelResponseIterator): ModelResponseStream: OpenAI-formatted streaming chunk """ verbose_logger.debug(f"Chat provider: transform_streaming_response called with chunk: {chunk}") - return OpenAiResponsesToChatCompletionStreamIterator.translate_responses_chunk_to_openai_stream(chunk) + return self._with_stream_scoped_id( + OpenAiResponsesToChatCompletionStreamIterator.translate_responses_chunk_to_openai_stream(chunk) + ) + + def _with_stream_scoped_id(self, chunk: "ModelResponseStream") -> "ModelResponseStream": + if self._chat_completion_id is None: + self._chat_completion_id = chunk.id + else: + chunk.id = self._chat_completion_id + return chunk diff --git a/litellm/constants.py b/litellm/constants.py index 7423d9b2211..1014b472c61 100644 --- a/litellm/constants.py +++ b/litellm/constants.py @@ -2,7 +2,7 @@ import os import sys from typing import List, Literal, Optional -from litellm.litellm_core_utils.env_utils import get_env_int +from litellm.litellm_core_utils.env_utils import get_env_int, get_env_int_or_none DEFAULT_HEALTH_CHECK_PROMPT = str(os.getenv("DEFAULT_HEALTH_CHECK_PROMPT", "test from litellm")) AZURE_DEFAULT_RESPONSES_API_VERSION = str(os.getenv("AZURE_DEFAULT_RESPONSES_API_VERSION", "preview")) @@ -264,14 +264,26 @@ MAX_REDIS_BUFFER_DEQUEUE_COUNT = int(os.getenv("MAX_REDIS_BUFFER_DEQUEUE_COUNT", # Bounds asyncio.Queue() instances (log queues, spend update queues, etc.) to prevent unbounded memory growth LITELLM_ASYNCIO_QUEUE_MAXSIZE = int(os.getenv("LITELLM_ASYNCIO_QUEUE_MAXSIZE", 1000)) TOOL_POLICY_CACHE_TTL_SECONDS = int(os.getenv("TOOL_POLICY_CACHE_TTL_SECONDS", 60)) +GUARDRAIL_SCANNED_MESSAGES_CACHE_TTL_SECONDS = int( + os.getenv("GUARDRAIL_SCANNED_MESSAGES_CACHE_TTL_SECONDS", 24 * 60 * 60) +) # Aggregation threshold: default to 80% of the asyncio queue maxsize so the check can always trigger. # Must be < LITELLM_ASYNCIO_QUEUE_MAXSIZE; if set higher the aggregation logic will never fire. MAX_SIZE_IN_MEMORY_QUEUE = int(os.getenv("MAX_SIZE_IN_MEMORY_QUEUE", int(LITELLM_ASYNCIO_QUEUE_MAXSIZE * 0.8))) MAX_IN_MEMORY_QUEUE_FLUSH_COUNT = int(os.getenv("MAX_IN_MEMORY_QUEUE_FLUSH_COUNT", 1000)) ############################################################################################### -MINIMUM_PROMPT_CACHE_TOKEN_COUNT = int( - os.getenv("MINIMUM_PROMPT_CACHE_TOKEN_COUNT", 1024) -) # minimum number of tokens to cache a prompt by Anthropic +# Providers will not cache a prefix below a minimum size. That minimum is per-model, not global: +# Anthropic's ranges from 512 to 4096 depending on the model, and can differ per platform for the +# same model. The real minimum is resolved from `prompt_cache_min_tokens` in the model cost map; +# this value is only the fallback for models the cost map has no entry for, and doubles as a global +# escape hatch when `MINIMUM_PROMPT_CACHE_TOKEN_COUNT` is explicitly set. +MINIMUM_PROMPT_CACHE_TOKEN_COUNT_OVERRIDE: int | None = get_env_int_or_none("MINIMUM_PROMPT_CACHE_TOKEN_COUNT") +DEFAULT_MINIMUM_PROMPT_CACHE_TOKEN_COUNT = 1024 +MINIMUM_PROMPT_CACHE_TOKEN_COUNT = ( + MINIMUM_PROMPT_CACHE_TOKEN_COUNT_OVERRIDE + if MINIMUM_PROMPT_CACHE_TOKEN_COUNT_OVERRIDE is not None + else DEFAULT_MINIMUM_PROMPT_CACHE_TOKEN_COUNT +) DEFAULT_TRIM_RATIO = float( os.getenv("DEFAULT_TRIM_RATIO", 0.75) ) # default ratio of tokens to trim from the end of a prompt @@ -715,6 +727,7 @@ openai_compatible_endpoints: List = [ "https://api.clarifai.com/v2/ext/openai/v1", "https://api.libertai.io/v1", "https://pinstripes.io/v1", + "https://api.meta.ai/v1", ] @@ -781,6 +794,7 @@ openai_compatible_providers: List = [ "ragflow", "pinstripes", # Pinstripes - JSON-configured provider "darkbloom", + "meta", # Meta Model API (Muse Spark) - JSON-configured provider ] openai_text_completion_compatible_providers: List = [ # providers that support `/v1/completions` "together_ai", @@ -1131,6 +1145,7 @@ BEDROCK_CONVERSE_MODELS = [ "anthropic.claude-sonnet-4-5-20250929-v1:0", "anthropic.claude-fable-5", "anthropic.claude-sonnet-5", + "anthropic.claude-opus-5", "anthropic.claude-opus-4-8", "anthropic.claude-opus-4-7", "anthropic.claude-opus-4-6-v1:0", @@ -1281,6 +1296,7 @@ MAXIMUM_TRACEBACK_LINES_TO_LOG = int(os.getenv("MAXIMUM_TRACEBACK_LINES_TO_LOG", X_LITELLM_DISABLE_CALLBACKS = "x-litellm-disable-callbacks" LITELLM_METADATA_FIELD = "litellm_metadata" OLD_LITELLM_METADATA_FIELD = "metadata" +RETURN_RAW_MODEL_NAME_METADATA_KEY = "_complexity_router_return_raw_model_name" LITELLM_TRUNCATED_PAYLOAD_FIELD = "litellm_truncated" LITELLM_TRUNCATION_DB_SAFEGUARD_NOTE = ( "Truncation is a DB storage safeguard. " @@ -1402,6 +1418,8 @@ LITELLM_EXPIRED_UI_SESSION_KEY_CLEANUP_BATCH_SIZE = int( os.getenv("LITELLM_EXPIRED_UI_SESSION_KEY_CLEANUP_BATCH_SIZE", 1000) ) LITELLM_PROXY_ADMIN_NAME = "default_user_id" +LITELLM_PROXY_BUDGET_NAME = "litellm-proxy-budget" +GLOBAL_PROXY_SPEND_CACHE_KEY = f"{LITELLM_PROXY_ADMIN_NAME}:spend" ########################### CLI SSO AUTHENTICATION CONSTANTS ########################### LITELLM_CLI_SOURCE_IDENTIFIER = "litellm-cli" @@ -1439,6 +1457,7 @@ SPEND_LOG_CLEANUP_MAX_CONSECUTIVE_BATCH_FAILURES = int(os.getenv("SPEND_LOG_CLEA SPEND_LOG_CLEANUP_BATCH_FAILURE_BACKOFF_SECONDS = float( os.getenv("SPEND_LOG_CLEANUP_BATCH_FAILURE_BACKOFF_SECONDS", 0.5) ) +TOOL_SPEND_TOP_TOOLS = 100 SPEND_LOG_PARTITION_INTERVAL = os.getenv("SPEND_LOG_PARTITION_INTERVAL", "day") SPEND_LOG_PARTITION_PRECREATE_AHEAD = int(os.getenv("SPEND_LOG_PARTITION_PRECREATE_AHEAD", 7)) SPEND_LOG_QUEUE_SIZE_THRESHOLD = int(os.getenv("SPEND_LOG_QUEUE_SIZE_THRESHOLD", 100)) @@ -1457,6 +1476,7 @@ _batch_polling_env = os.getenv("PROXY_BATCH_POLLING_ENABLED", "true").lower() PROXY_BATCH_POLLING_ENABLED = _batch_polling_env == "true" PROXY_BUDGET_RESCHEDULER_MAX_TIME = int(os.getenv("PROXY_BUDGET_RESCHEDULER_MAX_TIME", 605)) PROXY_BATCH_WRITE_AT = int(os.getenv("PROXY_BATCH_WRITE_AT", 10)) # in seconds, increased from 10 +PROXY_CONFIG_RELOAD_INTERVAL_SECONDS = get_env_int("PROXY_CONFIG_RELOAD_INTERVAL_SECONDS", 30) # APScheduler Configuration - MEMORY LEAK FIX # These settings prevent memory leaks in APScheduler's normalize() and _apply_jitter() functions @@ -1494,6 +1514,7 @@ MAX_TEAM_LIST_LIMIT = int(os.getenv("MAX_TEAM_LIST_LIMIT", 20)) MAX_POLICY_ESTIMATE_IMPACT_ROWS = int(os.getenv("MAX_POLICY_ESTIMATE_IMPACT_ROWS", 1000)) DEFAULT_PROMPT_INJECTION_SIMILARITY_THRESHOLD = float(os.getenv("DEFAULT_PROMPT_INJECTION_SIMILARITY_THRESHOLD", 0.7)) LENGTH_OF_LITELLM_GENERATED_KEY = int(os.getenv("LENGTH_OF_LITELLM_GENERATED_KEY", 16)) +MINIMUM_CUSTOM_KEY_LENGTH = int(os.getenv("MINIMUM_CUSTOM_KEY_LENGTH", 16)) SECRET_MANAGER_REFRESH_INTERVAL = int(os.getenv("SECRET_MANAGER_REFRESH_INTERVAL", 86400)) LITELLM_SETTINGS_SAFE_DB_OVERRIDES = [ "default_internal_user_params", @@ -1505,6 +1526,13 @@ LITELLM_SETTINGS_SAFE_DB_OVERRIDES = [ "cost_discount_config", "cost_margin_config", "budget_exceeded_throttle_percentage", + # Every field editable from the Admin UI (proxy_server._GENERAL_SETTINGS_UI_LITELLM_FIELDS) + # must be listed here so a DB write from one worker overrides the live litellm attribute on + # the others when config reloads; otherwise peer workers stay on their startup value. + # test_general_settings_ui_fields_are_db_overridable enforces that pairing. + "enable_anthropic_prompt_caching", + "anthropic_prompt_caching_ttl", + "max_ui_session_budget", ] SPECIAL_LITELLM_AUTH_TOKEN = ["ui-token"] DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL = int(os.getenv("DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL", 60)) diff --git a/litellm/cost_calculator.py b/litellm/cost_calculator.py index 74dc0e19da3..96aed20529f 100644 --- a/litellm/cost_calculator.py +++ b/litellm/cost_calculator.py @@ -760,7 +760,11 @@ def _select_model_name_for_cost_calc( if custom_pricing is True: if router_model_id is not None and router_model_id in litellm.model_cost: entry = litellm.model_cost[router_model_id] - if entry.get("input_cost_per_token") is not None or entry.get("input_cost_per_second") is not None: + if ( + entry.get("input_cost_per_token") is not None + or entry.get("input_cost_per_second") is not None + or entry.get("tiered_pricing") is not None + ): return_model = router_model_id else: return_model = model @@ -2187,6 +2191,13 @@ def batch_cost_calculator( return total_prompt_cost, total_completion_cost +def _summable_prompt_token_fields(prompt_tokens_details: BaseModel) -> List[str]: + field_names = list(type(prompt_tokens_details).model_fields) + if getattr(prompt_tokens_details, "cache_write_tokens", None) is None: + return field_names + return [attr for attr in field_names if attr != "cache_creation_tokens"] + + class BaseTokenUsageProcessor: @staticmethod def combine_usage_objects(usage_objects: List[Usage]) -> Usage: @@ -2221,7 +2232,7 @@ class BaseTokenUsageProcessor: # Check what keys exist in the model's prompt_tokens_details # Access model_fields on the class, not the instance, to avoid Pydantic 2.11+ deprecation warnings - for attr in type(usage.prompt_tokens_details).model_fields: + for attr in _summable_prompt_token_fields(usage.prompt_tokens_details): if ( hasattr(usage.prompt_tokens_details, attr) and not attr.startswith("_") diff --git a/litellm/exceptions.py b/litellm/exceptions.py index adf7b3ef05a..fd0a2afb3e8 100644 --- a/litellm/exceptions.py +++ b/litellm/exceptions.py @@ -966,11 +966,15 @@ class BudgetExceededError(Exception): max_budget: float, message: Optional[str] = None, llm_provider: Optional[str] = None, + entity_type: Optional[str] = None, + entity_id: Optional[str] = None, ): self.current_cost = current_cost self.max_budget = max_budget self.status_code = 429 self.llm_provider = llm_provider or "" + self.entity_type = entity_type + self.entity_id = entity_id # Surface unified rate-limit fields without joining the RateLimitError # hierarchy so existing `except BudgetExceededError:` handlers keep # working; custom callbacks reading StandardLoggingPayload pick these @@ -1180,20 +1184,6 @@ class ModifyResponseException(Exception): super().__init__(message) -class GuardrailInterventionNormalStringError( - Exception -): # custom exception to raise when a guardrail intervenes, but we want to return a normal string to the user - def __init__(self, message: str): - self.message = message - super().__init__(self.message) - - def __str__(self): - return self.message - - def __repr__(self): - return self.__str__() - - class SensitiveDataRouteException(Exception): """ Exception raised when a guardrail detects sensitive data and wants to reroute the request. diff --git a/litellm/experimental_mcp_client/client.py b/litellm/experimental_mcp_client/client.py index c1c90233bee..da711463a44 100644 --- a/litellm/experimental_mcp_client/client.py +++ b/litellm/experimental_mcp_client/client.py @@ -382,15 +382,25 @@ class MCPClient: if root_cause is not None and isinstance(in_flight_error, asyncio.CancelledError): raise root_cause from in_flight_error - async def run_with_session(self, operation: Callable[[ClientSession], Awaitable[TSessionResult]]) -> TSessionResult: - """Open a session, run the provided coroutine, and clean up.""" + async def run_with_session( + self, + operation: Callable[[ClientSession], Awaitable[TSessionResult]], + *, + quiet_on_error: bool = False, + ) -> TSessionResult: + """Open a session, run the provided coroutine, and clean up. + + quiet_on_error demotes the failure line to debug for callers that own the exception + (call_tool / list_tools under raise_on_error), so an expected pass-through re-auth does + not emit a warning per call; every other caller keeps the operator-visible warning.""" http_client: Optional[httpx.AsyncClient] = None try: self._last_initialize_instructions = None transport_ctx, http_client = self._create_transport_context() return await self._execute_session_operation(transport_ctx, operation) except Exception: - verbose_logger.warning("MCP client run_with_session failed for %s", self.server_url or "stdio") + _log = verbose_logger.debug if quiet_on_error else verbose_logger.warning + _log("MCP client run_with_session failed for %s", self.server_url or "stdio") raise finally: if http_client is not None: @@ -491,7 +501,7 @@ class MCPClient: return await session.list_tools() try: - result = await self.run_with_session(_list_tools_operation) + result = await self.run_with_session(_list_tools_operation, quiet_on_error=raise_on_error) tool_count = len(result.tools) tool_names = [tool.name for tool in result.tools] verbose_logger.info(f"MCP client listed {tool_count} tools from {self.server_url or 'stdio'}: {tool_names}") @@ -501,7 +511,13 @@ class MCPClient: raise except Exception as e: error_type = type(e).__name__ - verbose_logger.exception( + # Mirror call_tool: when the caller opted into raise_on_error it owns the exception and + # logs it at the fitting level (an expected pass-through re-auth 401 is info, not an + # error), so log at debug here to avoid an error-level line + traceback that would trip + # error-rate alerts on that expected signal. The swallow path still logs the full + # exception because nothing downstream will surface the failure. + _log = verbose_logger.debug if raise_on_error else verbose_logger.exception + _log( f"MCP client list_tools failed - " f"Error Type: {error_type}, " f"Error: {str(e)}, " @@ -510,7 +526,8 @@ class MCPClient: ) # Check if it's a stream/connection error if "BrokenResourceError" in error_type or "Broken" in error_type: - verbose_logger.error( + _log_broken = verbose_logger.debug if raise_on_error else verbose_logger.error + _log_broken( "MCP client detected broken connection/stream during list_tools - " "the MCP server may have crashed, disconnected, or timed out" ) @@ -567,7 +584,7 @@ class MCPClient: ) try: - tool_result = await self.run_with_session(_call_tool_operation) + tool_result = await self.run_with_session(_call_tool_operation, quiet_on_error=raise_on_error) verbose_logger.info(f"MCP client tool call '{call_tool_request_params.name}' completed successfully") return tool_result except asyncio.CancelledError: @@ -580,7 +597,13 @@ class MCPClient: verbose_logger.debug(f"MCP client tool call traceback:\n{error_trace}") # Log detailed error information error_type = type(e).__name__ - verbose_logger.error( + # When the caller opted into raise_on_error it owns the exception and logs it at the + # level that fits (an expected pass-through re-auth 401 is info, not an operator-actionable + # error), so log at debug here to avoid an error-level line that would trip error-rate + # alerts on that expected signal. The swallow path (raise_on_error=False) still logs at + # error because nothing downstream will surface the failure. + _log = verbose_logger.debug if raise_on_error else verbose_logger.error + _log( f"MCP client call_tool failed - " f"Error Type: {error_type}, " f"Error: {str(e)}, " @@ -590,7 +613,7 @@ class MCPClient: ) # Check if it's a stream/connection error if "BrokenResourceError" in error_type or "Broken" in error_type: - verbose_logger.error( + _log( "MCP client detected broken connection/stream - " "the MCP server may have crashed, disconnected, or timed out." ) diff --git a/litellm/experimental_mcp_client/tools.py b/litellm/experimental_mcp_client/tools.py index c65b266bd02..500d226752b 100644 --- a/litellm/experimental_mcp_client/tools.py +++ b/litellm/experimental_mcp_client/tools.py @@ -9,6 +9,7 @@ from openai.types.chat import ChatCompletionToolParam from openai.types.responses.function_tool_param import FunctionToolParam from openai.types.shared_params.function_definition import FunctionDefinition +from litellm.types.llms.anthropic import AnthropicMessagesTool from litellm.types.utils import ChatCompletionMessageToolCall @@ -75,6 +76,20 @@ def transform_mcp_tool_to_openai_responses_api_tool( ) +def transform_mcp_tool_to_anthropic_tool(mcp_tool: MCPTool) -> AnthropicMessagesTool: + """Convert an MCP tool to an Anthropic Messages API tool.""" + from litellm.litellm_core_utils.prompt_templates.common_utils import ( + sanitize_input_schema_for_anthropic, + ) + + return AnthropicMessagesTool( + name=mcp_tool.name, + description=mcp_tool.description or "", + input_schema=sanitize_input_schema_for_anthropic(mcp_tool.inputSchema), + type="custom", + ) + + async def load_mcp_tools( session: ClientSession, format: Literal["mcp", "openai"] = "mcp" ) -> Union[List[MCPTool], List[ChatCompletionToolParam]]: diff --git a/litellm/google_genai/main.py b/litellm/google_genai/main.py index 8e77c562094..3b1e712342f 100644 --- a/litellm/google_genai/main.py +++ b/litellm/google_genai/main.py @@ -17,6 +17,7 @@ from litellm.llms.base_llm.google_genai.transformation import ( ) from litellm.llms.custom_httpx.llm_http_handler import BaseLLMHTTPHandler from litellm.types.router import GenericLiteLLMParams +from litellm.types.utils import CallTypes from litellm.utils import ProviderConfigManager, client if TYPE_CHECKING: @@ -39,6 +40,11 @@ base_llm_http_handler = BaseLLMHTTPHandler() ################################################# +def _mark_async_entrypoint(logging_obj: LiteLLMLoggingObj | None, marker: str, is_async: bool) -> None: + if logging_obj is not None: + logging_obj.model_call_details.setdefault("litellm_params", {})[marker] = is_async + + class GenerateContentSetupResult(BaseModel): """Internal Type - Result of setting up a generate content call""" @@ -315,6 +321,8 @@ def generate_content( try: _is_async = kwargs.pop("agenerate_content", False) + _mark_async_entrypoint(kwargs.get("litellm_logging_obj"), CallTypes.agenerate_content.value, _is_async) + # Handle generationConfig parameter from kwargs for backward compatibility if "generationConfig" in kwargs and config is None: config = kwargs.pop("generationConfig") @@ -403,6 +411,8 @@ async def agenerate_content_stream( try: kwargs["agenerate_content_stream"] = True + _mark_async_entrypoint(kwargs.get("litellm_logging_obj"), CallTypes.agenerate_content_stream.value, True) + # Handle generationConfig parameter from kwargs for backward compatibility if "generationConfig" in kwargs and config is None: config = kwargs.pop("generationConfig") @@ -497,6 +507,8 @@ def generate_content_stream( # Remove any async-related flags since this is the sync function _is_async = kwargs.pop("agenerate_content_stream", False) + _mark_async_entrypoint(kwargs.get("litellm_logging_obj"), CallTypes.agenerate_content_stream.value, _is_async) + # Handle generationConfig parameter from kwargs for backward compatibility if "generationConfig" in kwargs and config is None: config = kwargs.pop("generationConfig") diff --git a/litellm/integrations/anthropic_cache_control_hook.py b/litellm/integrations/anthropic_cache_control_hook.py index 608fdebc1d9..faedf8ae1a3 100644 --- a/litellm/integrations/anthropic_cache_control_hook.py +++ b/litellm/integrations/anthropic_cache_control_hook.py @@ -91,7 +91,9 @@ class AnthropicCacheControlHook(CustomPromptManagement): # Pass through non-message injection points for provider-specific handling if remaining_points: - non_default_params["cache_control_injection_points"] = remaining_points + non_default_params["cache_control_injection_points"] = AnthropicCacheControlHook._stamped_as_judged( + remaining_points + ) return model, processed_messages, non_default_params @@ -296,18 +298,204 @@ class AnthropicCacheControlHook(CustomPromptManagement): return processed_messages, processed_system, remaining_points + @staticmethod + def _default_control() -> ChatCompletionCachedContent: + """Build the cache_control block for auto-injected breakpoints. + + Defaults to Anthropic's 5-minute ephemeral cache; honors the optional + ``litellm.anthropic_prompt_caching_ttl`` override ("5m" or "1h"). + """ + import litellm + + ttl = litellm.anthropic_prompt_caching_ttl + if ttl == "5m" or ttl == "1h": + return ChatCompletionCachedContent(type="ephemeral", ttl=ttl) + return ChatCompletionCachedContent(type="ephemeral") + + @staticmethod + def _stamped_as_judged(points: list[CacheControlInjectionPoint]) -> list[dict[str, object]]: + """Mark written-back points as having passed the client cache_control judgment. + + Builds copies because config-owned point dicts are shared across + requests; mutating them would leak the stamp into future requests. + """ + return [{**point, "_litellm_judged": True} for point in points] + + @staticmethod + def _should_stand_down( + points: list[CacheControlInjectionPoint], + messages: list[AllMessageValues], + system: str | list | None, + tools: list | None, + ) -> bool: + """Whether configured injection points must yield to client-set cache_control. + + Points that a prior pass over this request already judged and wrote + back carry the internal judged stamp; any re-entry (acompletion + re-entering completion, the async-to-sync /v1/messages dispatch, + interceptor sub-calls reusing the request kwargs) must not re-judge + them, because by then the messages carry litellm's own injected marks + and the judgment would misread those as client breakpoints. + """ + if all(point.get("_litellm_judged") for point in points): + return False + return AnthropicCacheControlHook._request_has_cache_control(messages, system, tools) + + @staticmethod + def _request_has_cache_control( + messages: list[AllMessageValues], + system: str | list | None, + tools: list | None = None, + ) -> bool: + """Return True if the request already carries any client-supplied cache_control. + + When the client (e.g. Claude Code) already marks its own breakpoints we + stand down entirely rather than add more, per the auto-caching contract. + Tools count: they are a breakpoint the client can mark, they count toward + the provider's four-block limit, and caching only the tool definitions is + a common pattern, so injecting alongside them can exceed the cap. Tools + carry the mark either at the top level (Anthropic shape) or nested under + ``function`` (OpenAI shape); the Anthropic chat transform accepts both. + """ + if any(AnthropicCacheControlHook._count_cache_control_blocks(msg) for msg in messages): + return True + if isinstance(system, list): + if any(isinstance(block, dict) and block.get("cache_control") is not None for block in system): + return True + if tools is not None: + return any( + isinstance(tool, dict) + and ( + tool.get("cache_control") is not None + or (isinstance(tool.get("function"), dict) and tool["function"].get("cache_control") is not None) + ) + for tool in tools + ) + return False + + @staticmethod + def get_default_injection_points( + messages: list[AllMessageValues], + system: str | list | None, + model: str, + custom_llm_provider: str | None, + tools: list | None = None, + ) -> list[CacheControlInjectionPoint]: + """Default breakpoints when ``litellm.enable_anthropic_prompt_caching`` is on. + + Caches the system prompt and the trailing turn, so the stable prefix + (system + tools + history) is reused while the breakpoint advances with + the conversation. Returns [] (stand down) when the flag is off, the + provider does not consume cache_control breakpoints (only anthropic / + bedrock do), the model lacks prompt-caching support, or the request + already carries client-supplied cache_control. + """ + import litellm + + if litellm.enable_anthropic_prompt_caching is not True: + return [] + + provider = custom_llm_provider + if provider is None: + from litellm.litellm_core_utils.get_llm_provider_logic import ( + get_llm_provider, + ) + + try: + _, provider, _, _ = get_llm_provider(model=model) + except Exception: # noqa: BLE001 # unroutable model must never block the call, just skip auto-caching + return [] + + if provider not in ("anthropic", "bedrock"): + return [] + + from litellm.utils import supports_prompt_caching + + if not supports_prompt_caching(model=model, custom_llm_provider=provider): + return [] + + if AnthropicCacheControlHook._request_has_cache_control(messages, system, tools): + return [] + + control = AnthropicCacheControlHook._default_control() + points: list[CacheControlInjectionPoint] = [ + CacheControlMessageInjectionPoint(location="message", role="system", index=None, control=control), + CacheControlMessageInjectionPoint(location="message", role=None, index=-1, control=control), + ] + return points + + @staticmethod + def maybe_seed_default_injection_points( + non_default_params: dict[str, Any], + messages: list[AllMessageValues], + model: str, + custom_llm_provider: str | None, + tools: list | None = None, + ) -> None: + """For /chat/completions: resolve the injection points the request should carry. + + Configured injection points win over the automatic defaults, but stand + down entirely when the client already marked its own cache_control + breakpoints (messages or tools): injecting alongside them clashes with + the client's caching strategy and can exceed the provider's four-block + limit. The judgment happens once per request; points a prior pass + wrote back carry the judged stamp and are never re-judged (see + ``_should_stand_down``). Seeding the param lets the existing + prompt-management gate and the AnthropicCacheControlHook run + unchanged. + """ + if non_default_params.get("cache_control_injection_points"): + if AnthropicCacheControlHook._should_stand_down( + non_default_params["cache_control_injection_points"], messages, None, tools + ): + non_default_params.pop("cache_control_injection_points") + return + points = AnthropicCacheControlHook.get_default_injection_points( + messages=messages, + system=None, + model=model, + custom_llm_provider=custom_llm_provider, + tools=tools, + ) + if points: + non_default_params["cache_control_injection_points"] = points + @staticmethod def maybe_inject_cache_control( messages: List[Dict], system: str | list | None, kwargs: Dict[str, Any], + model: str | None = None, + custom_llm_provider: str | None = None, + tools: list[dict] | None = None, ) -> Tuple[List[Dict], str | list | None]: """Extract cache_control_injection_points from kwargs and apply if present. - Pops the key from kwargs; if remaining (non-message) points exist they - are written back so downstream transforms can handle them. + Configured points stand down entirely when the client already marked + its own cache_control breakpoints anywhere in the request. The + judgment happens once per request; points a prior pass wrote back + carry the judged stamp and are never re-judged (see + ``_should_stand_down``). When none are configured but + ``litellm.enable_anthropic_prompt_caching`` is on, synthesize default + breakpoints for the native /v1/messages path. Pops the key from kwargs; + if remaining (non-message) points exist they are written back so + downstream transforms can handle them. """ - injection_points = kwargs.pop("cache_control_injection_points", None) + typed_messages = cast(list[AllMessageValues], messages) # cast-ok: Anthropic-shaped dicts from v1/messages + configured = cast( # cast-ok: kwargs is untyped; this key only holds the documented injection-point list + list[CacheControlInjectionPoint] | None, kwargs.pop("cache_control_injection_points", None) + ) + if configured and AnthropicCacheControlHook._should_stand_down(configured, typed_messages, system, tools): + return messages, system + injection_points: list[CacheControlInjectionPoint] = configured or [] + if not injection_points and model is not None: + injection_points = AnthropicCacheControlHook.get_default_injection_points( + messages=typed_messages, + system=system, + tools=tools, + model=model, + custom_llm_provider=custom_llm_provider, + ) if not injection_points: return messages, system @@ -317,7 +505,7 @@ class AnthropicCacheControlHook(CustomPromptManagement): injection_points=injection_points, ) if remaining: - kwargs["cache_control_injection_points"] = remaining + kwargs["cache_control_injection_points"] = AnthropicCacheControlHook._stamped_as_judged(remaining) return messages, system @property diff --git a/litellm/integrations/compression_interception/handler.py b/litellm/integrations/compression_interception/handler.py index c82f9ff477f..f0a696aa1e1 100644 --- a/litellm/integrations/compression_interception/handler.py +++ b/litellm/integrations/compression_interception/handler.py @@ -14,6 +14,7 @@ from litellm.compression import compress from litellm.integrations.custom_logger import CustomLogger from litellm.types.integrations.compression_interception import ( CompressionInterceptionConfig, + CompressionSavingsMetadata, ) from litellm.types.integrations.custom_logger import ( AgenticLoopPlan, @@ -25,6 +26,41 @@ LITELLM_CONTENT_RETRIEVE_TOOL_NAME = "litellm_content_retrieve" _CACHE_TTL_SECONDS = 15 * 60 +def _compression_savings_from_counts( + original_tokens: object, compressed_tokens: object +) -> CompressionSavingsMetadata | None: + if isinstance(original_tokens, bool) or not isinstance(original_tokens, int): + return None + if isinstance(compressed_tokens, bool) or not isinstance(compressed_tokens, int): + return None + if compressed_tokens < 0 or original_tokens < compressed_tokens: + return None + return CompressionSavingsMetadata( + tokens_before=original_tokens, + tokens_after=compressed_tokens, + tokens_saved=original_tokens - compressed_tokens, + source="compression_interception", + ) + + +def _record_compression_savings(kwargs: dict[str, object], savings: CompressionSavingsMetadata) -> None: + """ + Attach savings to the request's litellm metadata so they land in the + SpendLog row's metadata JSON under ``compression_savings``. + + ``/v1/messages`` requests carry proxy metadata under ``litellm_metadata`` + (the ``metadata`` key is Anthropic's own API field). The existing dict is + updated in place because the proxy and the logging object hold references + to the same object; replacing it would orphan writes made through those + references. + """ + existing = kwargs.get("litellm_metadata") + if isinstance(existing, dict): + existing["compression_savings"] = savings + return + kwargs["litellm_metadata"] = {"compression_savings": savings} + + class CompressionInterceptionLogger(CustomLogger): """ CustomLogger that implements transparent prompt compression + retrieval loops. @@ -130,6 +166,12 @@ class CompressionInterceptionLogger(CustomLogger): call_id = str(uuid.uuid4()) kwargs["litellm_call_id"] = call_id self._compression_cache_by_call_id[call_id] = (cache, time.time()) + savings = _compression_savings_from_counts( + original_tokens=compressed.get("original_tokens"), + compressed_tokens=compressed.get("compressed_tokens"), + ) + if savings is not None: + _record_compression_savings(kwargs=kwargs, savings=savings) verbose_logger.debug( "CompressionInterception: compressed request [call_id=%s original=%d compressed=%d cached_keys=%d]", call_id, diff --git a/litellm/integrations/custom_guardrail.py b/litellm/integrations/custom_guardrail.py index 59d37639098..9c7bbbd3b4c 100644 --- a/litellm/integrations/custom_guardrail.py +++ b/litellm/integrations/custom_guardrail.py @@ -1,3 +1,6 @@ +import contextvars +import hashlib +import os import secrets from datetime import datetime from typing import ( @@ -14,9 +17,14 @@ from typing import ( ) from litellm._logging import verbose_logger -from litellm.litellm_core_utils.core_helpers import redact_nested_match_and_regex_keys +from litellm.litellm_core_utils.core_helpers import ( + get_metadata_variable_name_from_kwargs, + get_or_create_metadata_bucket, + redact_nested_match_and_regex_keys, +) from litellm.caching import DualCache from litellm.integrations.custom_logger import CustomLogger +from litellm.secret_managers.main import str_to_bool from litellm.types.guardrails import ( DynamicGuardrailParams, GuardrailEventHooks, @@ -44,7 +52,10 @@ if TYPE_CHECKING: dc = DualCache() -from litellm.constants import PRE_CALL_EXECUTED_GUARDRAILS_KEY +from litellm.constants import ( + GUARDRAIL_SCANNED_MESSAGES_CACHE_TTL_SECONDS, + PRE_CALL_EXECUTED_GUARDRAILS_KEY, +) from litellm.exceptions import ( BlockedPiiEntityError, GuardrailRaisedException, @@ -58,6 +69,26 @@ from litellm.exceptions import ( # proxy's metadata sanitizer. _PRE_CALL_EXECUTED_TOKEN = secrets.token_hex(16) +_GUARDRAIL_BLOCK_STATUS_CODES = frozenset({400, 403, 422}) + +_guardrail_self_recorded: contextvars.ContextVar[bool] = contextvars.ContextVar( + "litellm_guardrail_self_recorded", default=False +) + + +def _strict_guardrail_modes_enabled() -> bool: + """Whether guardrail-mode validation raises (default) or logs a warning. + + Set `LITELLM_STRICT_GUARDRAIL_MODES=false` to keep the pre-LIT-4226 behavior + for guardrails whose supported_event_hooks list newly includes their + configured mode: log the mismatch and continue instead of raising at boot. + """ + raw = os.environ.get("LITELLM_STRICT_GUARDRAIL_MODES") + if raw is None: + return True + parsed = str_to_bool(raw) + return True if parsed is None else parsed + def get_session_id_from_request_data(request_data: Dict[str, Any]) -> Optional[str]: """Extract session_id from request data (litellm_session_id or metadata).""" @@ -82,6 +113,8 @@ class CustomGuardrail(CustomLogger): # If True, during_call runs async_moderation_hook instead of the unified apply_guardrail path. use_native_during_call_hook: ClassVar[bool] = False + records_own_guardrail_information: ClassVar[bool] = False + def __init__( self, guardrail_name: Optional[str] = None, @@ -97,6 +130,8 @@ class CustomGuardrail(CustomLogger): on_sensitive_data: Optional[str] = None, sensitive_data_route_to_model: Optional[str] = None, sticky_session_routing: bool = True, + run_in_parallel: bool = False, + only_scan_new_messages: bool = False, **kwargs, ): """ @@ -115,6 +150,9 @@ class CustomGuardrail(CustomLogger): on_sensitive_data: Action when sensitive data is detected. 'block' (default) or 'route' sensitive_data_route_to_model: Model to route to when on_sensitive_data='route' sticky_session_routing: When True, all subsequent requests in the session use the same model + run_in_parallel: When True, this pre_call or post_call guardrail runs concurrently with + other opted-in guardrails of the same hook. Only safe for block-only guardrails that + do not mutate the request or response. """ self.guardrail_name = guardrail_name self.supported_event_hooks = supported_event_hooks @@ -129,10 +167,22 @@ class CustomGuardrail(CustomLogger): self.on_sensitive_data: Optional[str] = on_sensitive_data self.sensitive_data_route_to_model: Optional[str] = sensitive_data_route_to_model self.sticky_session_routing: bool = sticky_session_routing + self.run_in_parallel: bool = run_in_parallel + self.only_scan_new_messages: bool = only_scan_new_messages if supported_event_hooks: ## validate event_hook is in supported_event_hooks - self._validate_event_hook(event_hook, supported_event_hooks) + try: + self._validate_event_hook(event_hook, supported_event_hooks) + except ValueError as validation_error: + if _strict_guardrail_modes_enabled(): + raise + verbose_logger.warning( + "%s. LITELLM_STRICT_GUARDRAIL_MODES=false; continuing " + "with unsupported event_hook. Set the env var to true " + "(default) to enforce validation and fail at startup.", + validation_error, + ) super().__init__(**kwargs) def render_violation_message(self, default: str, context: Optional[Dict[str, Any]] = None) -> str: @@ -243,6 +293,100 @@ class CustomGuardrail(CustomLogger): """Extract session_id from request data.""" return get_session_id_from_request_data(request_data) + @staticmethod + def _scanned_text_hash(text: str) -> str: + """Stable content hash for a single scannable text segment. + + Hashing the exact text the provider would receive means an edited earlier + segment produces a different hash and gets re-scanned, while an unchanged + segment repeated on a later turn is skipped. + """ + return hashlib.sha256(text.encode("utf-8")).hexdigest() + + def _scanned_texts_cache_key(self, session_id: str) -> str: + return f"guardrail_scanned_texts:{self.guardrail_name}:{session_id}" + + async def filter_new_texts_for_session( + self, + texts: list[str] | None, + request_data: dict[str, object], + cache: DualCache, + ) -> list[str] | None: + """Return only the text segments not already scanned earlier in this session. + + Returns ``None`` when incremental scanning is inactive (feature off, no + session id, masking enabled, or the cache read failed). ``None`` signals + the caller to fall back to a full scan; a returned list (possibly empty) + signals the caller to scan only that subset and skip masking write-back. + """ + if not self.only_scan_new_messages or not texts: + return None + + if self.mask_request_content or self.mask_response_content: + verbose_logger.warning( + "Guardrail %s: only_scan_new_messages is not supported with masking; scanning full context.", + self.guardrail_name, + ) + return None + + session_id = get_session_id_from_request_data(request_data) + if not session_id: + verbose_logger.debug( + "Guardrail %s: only_scan_new_messages enabled but request has no session id; scanning full context.", + self.guardrail_name, + ) + return None + + try: + cached: object = await cache.async_get_cache(key=self._scanned_texts_cache_key(session_id)) + except Exception as e: # noqa: BLE001 # cache is best-effort; any failure must fall back to a full scan + verbose_logger.warning( + "Guardrail %s: failed to read scanned-message cache (%s); scanning full context.", + self.guardrail_name, + e, + ) + return None + + seen: set[str] = {str(h) for h in cached} if isinstance(cached, list) else set() + return [text for text in texts if self._scanned_text_hash(text) not in seen] + + async def mark_texts_scanned( + self, + texts: list[str] | None, + request_data: dict[str, object], + cache: DualCache, + ) -> None: + """Record the hashes of all text segments present on a successful (non-blocked) scan. + + Called only after the guardrail allows the request, so a blocked segment is + never marked scanned and will be re-checked if the client retries. + """ + if not self.only_scan_new_messages or not texts: + return + if self.mask_request_content or self.mask_response_content: + return + session_id = get_session_id_from_request_data(request_data) + if not session_id: + return + + cache_key = self._scanned_texts_cache_key(session_id) + current_hashes = [self._scanned_text_hash(text) for text in texts] + try: + existing: object = await cache.async_get_cache(key=cache_key) + existing_hashes: list[str] = [str(h) for h in existing] if isinstance(existing, list) else [] + merged: list[str] = list(dict.fromkeys(existing_hashes + current_hashes)) + await cache.async_set_cache( + key=cache_key, + value=merged, + ttl=GUARDRAIL_SCANNED_MESSAGES_CACHE_TTL_SECONDS, + ) + except Exception as e: # noqa: BLE001 # cache is best-effort; any failure must not block the request + verbose_logger.warning( + "Guardrail %s: failed to persist scanned-message cache (%s); next call will re-scan.", + self.guardrail_name, + e, + ) + def should_route_on_sensitive_data(self) -> bool: """ Returns True if this guardrail is configured to route requests @@ -303,6 +447,18 @@ class CustomGuardrail(CustomLogger): """ return None + @classmethod + def get_supported_event_hooks(cls) -> Optional[List[GuardrailEventHooks]]: + """ + Returns the event hooks this guardrail supports, for the UI to render. + + Subclasses should override to return their supported hooks list. When a + subclass returns None, the endpoint omits it from the per-provider map + and the UI is expected to fall back to the global `supported_modes` + list client-side. + """ + return None + def _validate_event_hook( self, event_hook: Optional[Union[GuardrailEventHooks, List[GuardrailEventHooks], Mode]], @@ -477,6 +633,22 @@ class CustomGuardrail(CustomLogger): return True return False + def uses_apply_guardrail_interface(self) -> bool: + return type(self).apply_guardrail is not CustomGuardrail.apply_guardrail + + def _deployment_pre_call_target(self) -> "CustomLogger": + if not self.uses_apply_guardrail_interface(): + return self + try: + from litellm.proxy.utils import unified_guardrail + except ImportError as e: + raise ImportError( + f"Guardrail {self.guardrail_name or type(self).__name__} implements apply_guardrail, which needs " + "the litellm proxy dependencies to run at the deployment level. " + "Install them with: pip install 'litellm[proxy]'" + ) from e + return unified_guardrail + async def async_pre_call_deployment_hook( self, kwargs: Dict[str, Any], call_type: Optional[CallTypes] ) -> Optional[dict]: @@ -495,7 +667,10 @@ class CustomGuardrail(CustomLogger): # CHECK IF GUARDRAIL REJECTS THE REQUEST if call_type == CallTypes.completion or call_type == CallTypes.acompletion: - result = await self.async_pre_call_hook( + target = self._deployment_pre_call_target() + if target is not self: + kwargs["guardrail_to_apply"] = self + result = await target.async_pre_call_hook( user_api_key_dict=UserAPIKeyAuth( user_id=kwargs.get("user_api_key_user_id"), team_id=kwargs.get("user_api_key_team_id"), @@ -505,7 +680,7 @@ class CustomGuardrail(CustomLogger): ), cache=dc, data=kwargs, - call_type=call_type.value or "acompletion", # type: ignore + call_type="completion" if call_type == CallTypes.completion else "acompletion", ) if result is not None and isinstance(result, dict): @@ -757,6 +932,12 @@ class CustomGuardrail(CustomLogger): # raw provider JSON so redaction is not duplicated upstream). clean_guardrail_response = redact_nested_match_and_regex_keys(clean_guardrail_response) + from litellm.litellm_core_utils.sensitive_data_masker import ( + mask_credentials_in_payload, + ) + + clean_guardrail_response = mask_credentials_in_payload(clean_guardrail_response) + slg = StandardLoggingGuardrailInformation( guardrail_name=self.guardrail_name, guardrail_provider=guardrail_provider, @@ -781,17 +962,10 @@ class CustomGuardrail(CustomLogger): # should not happen container[key] = [existing, slg] - if "metadata" in request_data: - if request_data["metadata"] is None: - request_data["metadata"] = {} - _append_guardrail_info(request_data["metadata"]) - elif "litellm_metadata" in request_data: - _append_guardrail_info(request_data["litellm_metadata"]) - else: - # Ensure guardrail info is always logged (e.g. proxy may not have set - # metadata yet). Attach to "metadata" so spend log / standard logging see it. - request_data["metadata"] = {} - _append_guardrail_info(request_data["metadata"]) + _, metadata_bucket = get_or_create_metadata_bucket(request_data) + _append_guardrail_info(metadata_bucket) + + _guardrail_self_recorded.set(True) # Emit the otel guardrail span here, where every guardrail execution lands, # rather than relying on a post-call hook that does not fire on every path @@ -883,8 +1057,15 @@ class CustomGuardrail(CustomLogger): - GuardrailRaisedException (generic guardrail API, tool permission) - BlockedPiiEntityError (Presidio PII detection) - SensitiveDataRouteException (sensitive-data reroute to on-premise model) - - HTTPException with status 400 (content policy violation) + - HTTPException with a block-signalling status (400, 403, 422) - ModifyResponseException (passthrough mode violation) + + Only the statuses guardrails use in-tree to signal a deliberate rejection + count as an intervention: 400 (content policy), 403 (e.g. akto) and 422 + (e.g. llm_as_a_judge). Other 4xx codes are commonly propagated from an + upstream guardrail provider response (401 bad key, 408 timeout, 429 rate + limit, or a raw upstream status), which are technical failures, not + blocks, so they stay guardrail_failed_to_respond. """ if isinstance(e, ModifyResponseException): return True @@ -897,7 +1078,11 @@ class CustomGuardrail(CustomLogger): ), ): return True - if HTTPException is not None and isinstance(e, HTTPException) and e.status_code == 400: + if ( + HTTPException is not None + and isinstance(e, HTTPException) + and e.status_code in _GUARDRAIL_BLOCK_STATUS_CODES + ): return True return False @@ -1048,7 +1233,7 @@ def _sync_guardrail_info_to_logging_obj(request_data: dict, logging_obj: object) """ if logging_obj is None: return - meta_src = request_data.get("metadata") or request_data.get("litellm_metadata") or {} + meta_src = request_data.get(get_metadata_variable_name_from_kwargs(request_data)) or {} slg_info = meta_src.get("standard_logging_guardrail_information") if not slg_info: return @@ -1075,8 +1260,20 @@ def log_guardrail_information(func): (structured detections, tracing detail) than this decorator's "allow"/"mask"/raw-response default. To avoid double-recording in that case (which would emit two spans, two Datadog records, two spend-log - entries, etc.), snapshot the entry count before invocation: if the - wrapped function already appended its own entry, skip the auto-record. + entries, etc.), a context-local flag records whether the wrapped function + appended its own entry; if so, the auto-record is skipped. The flag is a + ``ContextVar`` rather than a count of entries in the shared ``request_data`` + so it stays correct when guardrails run concurrently (asyncio copies the + context into each gathered task): counting shared entries would let one + guardrail's append hide another guardrail's missing record. + + A guardrail that only records an entry when it actually runs (e.g. + ``HeadroomGuardrail``, which returns the inputs untouched on an endpoint + whose payload it cannot act on) sets ``records_own_guardrail_information = + True`` so the auto-record is skipped even on the return paths where it + recorded nothing; otherwise a no-op early return would be logged as an + "allow"/"success" run even though the guardrail did nothing. The exception + branch below still records so a genuine failure is not lost. """ import functools import inspect @@ -1096,16 +1293,6 @@ def log_guardrail_information(func): return GuardrailEventHooks.post_call return None - def _count_recorded_guardrail_entries(request_data: dict) -> int: - total = 0 - for container_key in ("metadata", "litellm_metadata"): - container = request_data.get(container_key) - if isinstance(container, dict): - entries = container.get("standard_logging_guardrail_information") - if isinstance(entries, list): - total += len(entries) - return total - @functools.wraps(func) async def async_wrapper(*args, **kwargs): start_time = datetime.now() # Move start_time inside the wrapper @@ -1119,10 +1306,10 @@ def log_guardrail_information(func): original_inputs = kwargs.get("inputs") logging_obj = kwargs.get("logging_obj") - entries_before = _count_recorded_guardrail_entries(request_data) + self_recorded_token = _guardrail_self_recorded.set(False) try: response = await func(*args, **kwargs) - if _count_recorded_guardrail_entries(request_data) > entries_before: + if self.records_own_guardrail_information or _guardrail_self_recorded.get(): return response return self._process_response( response=response, @@ -1134,7 +1321,7 @@ def log_guardrail_information(func): original_inputs=original_inputs, ) except Exception as e: - if _count_recorded_guardrail_entries(request_data) > entries_before: + if _guardrail_self_recorded.get(): raise return self._process_error( e=e, @@ -1145,6 +1332,7 @@ def log_guardrail_information(func): event_type=event_type, ) finally: + _guardrail_self_recorded.reset(self_recorded_token) _sync_guardrail_info_to_logging_obj(request_data, logging_obj) @functools.wraps(func) @@ -1160,10 +1348,10 @@ def log_guardrail_information(func): original_inputs = kwargs.get("inputs") logging_obj = kwargs.get("logging_obj") - entries_before = _count_recorded_guardrail_entries(request_data) + self_recorded_token = _guardrail_self_recorded.set(False) try: response = func(*args, **kwargs) - if _count_recorded_guardrail_entries(request_data) > entries_before: + if self.records_own_guardrail_information or _guardrail_self_recorded.get(): return response return self._process_response( response=response, @@ -1173,7 +1361,7 @@ def log_guardrail_information(func): original_inputs=original_inputs, ) except Exception as e: - if _count_recorded_guardrail_entries(request_data) > entries_before: + if _guardrail_self_recorded.get(): raise return self._process_error( e=e, @@ -1182,6 +1370,7 @@ def log_guardrail_information(func): event_type=event_type, ) finally: + _guardrail_self_recorded.reset(self_recorded_token) _sync_guardrail_info_to_logging_obj(request_data, logging_obj) @functools.wraps(func) diff --git a/litellm/integrations/datadog/datadog.py b/litellm/integrations/datadog/datadog.py index bd62d1e303a..20239d831cc 100644 --- a/litellm/integrations/datadog/datadog.py +++ b/litellm/integrations/datadog/datadog.py @@ -19,7 +19,7 @@ import os import time import traceback from datetime import datetime as datetimeObj -from typing import Any, Dict, List, Optional, Union +from typing import Any, Dict, List, Optional, Sequence, Union import httpx from httpx import Response @@ -50,6 +50,7 @@ from litellm.types.integrations.base_health_check import IntegrationHealthCheckS from litellm.types.integrations.datadog import ( DD_ERRORS, DD_MAX_BATCH_SIZE, + DD_MAX_PAYLOAD_SIZE_BYTES, DataDogStatus, DatadogInitParams, DatadogPayload, @@ -384,8 +385,10 @@ class DataDogLogger( async def _send_with_413_split(self, batch: List) -> List: """ - Send a batch, halving any sub-batch that 413s (payload too large) and retrying the - halves, since Datadog enforces a 5MB uncompressed limit per request. + Send a batch, halving any sub-batch that exceeds Datadog's intake limits before + sending, and halving again on a 413 (payload too large) response, since Datadog + enforces a 5MB uncompressed limit per request. The proactive split avoids paying + a serialize + gzip + round trip for a payload the intake is guaranteed to reject. A 413 surfaces as a raised MaskedHTTPStatusError (httpx raise_for_status), not a returned response, so both paths are handled. A lone event that still 413s is @@ -398,6 +401,11 @@ class DataDogLogger( chunk = pending.pop() if not chunk: continue + if len(chunk) > 1 and self._exceeds_intake_limits(chunk): + mid = len(chunk) // 2 + pending.append(chunk[mid:]) + pending.append(chunk[:mid]) + continue try: response = await self.async_send_compressed_data(chunk) except Exception as e: @@ -436,6 +444,21 @@ class DataDogLogger( def _undelivered(chunk: List, pending: List[List]) -> List: return chunk + [event for remaining in reversed(pending) for event in remaining] + @staticmethod + def _exceeds_intake_limits(chunk: Sequence[DatadogPayload]) -> bool: + """ + True when a chunk would breach Datadog's log intake limits: more than + DD_MAX_BATCH_SIZE events per payload, or a serialized size above + DD_MAX_PAYLOAD_SIZE_BYTES (held under Datadog's 5MB uncompressed cap so + the batch is split before the intake rejects it with a 413). + """ + from litellm.litellm_core_utils.safe_json_dumps import safe_dumps + + if len(chunk) > DD_MAX_BATCH_SIZE: + return True + payload_size_bytes = len(safe_dumps(chunk).encode("utf-8")) + return payload_size_bytes > DD_MAX_PAYLOAD_SIZE_BYTES + async def flush_queue(self): if self.flush_lock is None: return diff --git a/litellm/integrations/langfuse/langfuse_otel.py b/litellm/integrations/langfuse/langfuse_otel.py index fc7c1b211c0..d464d55453d 100644 --- a/litellm/integrations/langfuse/langfuse_otel.py +++ b/litellm/integrations/langfuse/langfuse_otel.py @@ -1,8 +1,8 @@ import base64 -import json # <--- NEW +import json import os from datetime import datetime -from typing import TYPE_CHECKING, Any, Optional, Union +from typing import TYPE_CHECKING, Any, Dict, Optional, Union from litellm._logging import verbose_logger from litellm.integrations.arize import _utils @@ -25,6 +25,8 @@ else: LANGFUSE_CLOUD_EU_ENDPOINT = "https://cloud.langfuse.com/api/public/otel" LANGFUSE_CLOUD_US_ENDPOINT = "https://us.cloud.langfuse.com/api/public/otel" +LANGFUSE_INGESTION_VERSION_HEADER = "x-langfuse-ingestion-version" +LANGFUSE_INGESTION_VERSION = "4" class LangfuseOtelLogger(OpenTelemetry): @@ -267,29 +269,10 @@ class LangfuseOtelLogger(OpenTelemetry): # If no keys, return default from env (likely logging to console or something else) return OpenTelemetryConfig.from_env() - # Determine endpoint - default to US cloud - langfuse_host = LangfuseOtelLogger._get_langfuse_otel_host() - - if langfuse_host: - # If LANGFUSE_HOST is provided, construct OTEL endpoint from it - if not langfuse_host.startswith("http"): - langfuse_host = "https://" + langfuse_host - endpoint = f"{langfuse_host.rstrip('/')}/api/public/otel" - verbose_logger.debug(f"Using Langfuse OTEL endpoint from host: {endpoint}") - else: - # Default to US cloud endpoint - endpoint = LANGFUSE_CLOUD_US_ENDPOINT - verbose_logger.debug(f"Using Langfuse US cloud endpoint: {endpoint}") - - auth_header = LangfuseOtelLogger._get_langfuse_authorization_header( - public_key=public_key, secret_key=secret_key - ) - otlp_auth_headers = f"Authorization={auth_header}" - - return OpenTelemetryConfig( - exporter="otlp_http", - endpoint=endpoint, - headers=otlp_auth_headers, + return LangfuseOtelLogger._build_langfuse_otel_config( + public_key=public_key, + secret_key=secret_key, + langfuse_host=LangfuseOtelLogger._get_langfuse_otel_host(), ) @staticmethod @@ -316,33 +299,38 @@ class LangfuseOtelLogger(OpenTelemetry): "LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY must be set for Langfuse OpenTelemetry integration." ) - # Determine endpoint - default to US cloud - langfuse_host = LangfuseOtelLogger._get_langfuse_otel_host() + return LangfuseOtelLogger._build_langfuse_otel_config( + public_key=public_key, + secret_key=secret_key, + langfuse_host=LangfuseOtelLogger._get_langfuse_otel_host(), + ) + @staticmethod + def _build_langfuse_otel_config( + public_key: str, secret_key: str, langfuse_host: Optional[str] + ) -> "OpenTelemetryConfig": + """ + Builds an OTLP HTTP config pointing at the Langfuse OTEL endpoint for the + given host (US cloud when no host is provided), authorized with the given keys. + """ if langfuse_host: - # If LANGFUSE_HOST is provided, construct OTEL endpoint from it - if not langfuse_host.startswith("http"): - langfuse_host = "https://" + langfuse_host - endpoint = f"{langfuse_host.rstrip('/')}/api/public/otel" + normalized_host = langfuse_host if langfuse_host.startswith("http") else f"https://{langfuse_host}" + endpoint = f"{normalized_host.rstrip('/')}/api/public/otel" verbose_logger.debug(f"Using Langfuse OTEL endpoint from host: {endpoint}") else: - # Default to US cloud endpoint endpoint = LANGFUSE_CLOUD_US_ENDPOINT verbose_logger.debug(f"Using Langfuse US cloud endpoint: {endpoint}") auth_header = LangfuseOtelLogger._get_langfuse_authorization_header( public_key=public_key, secret_key=secret_key ) - otlp_auth_headers = f"Authorization={auth_header}" - - # Prevent modification of global env vars which causes leakage - # os.environ["OTEL_EXPORTER_OTLP_ENDPOINT"] = endpoint - # os.environ["OTEL_EXPORTER_OTLP_HEADERS"] = otlp_auth_headers return OpenTelemetryConfig( exporter="otlp_http", endpoint=endpoint, - headers=otlp_auth_headers, + headers=LangfuseOtelLogger._format_otel_headers( + LangfuseOtelLogger._build_langfuse_otel_headers(auth_header) + ), ) @staticmethod @@ -354,6 +342,26 @@ class LangfuseOtelLogger(OpenTelemetry): auth_header = base64.b64encode(auth_string.encode()).decode() return f"Basic {auth_header}" + @staticmethod + def _build_langfuse_otel_headers(auth_header: str) -> Dict[str, str]: + """ + Build the OTLP header set Langfuse expects. + + `x-langfuse-ingestion-version: 4` selects Langfuse's v4 ingestion path; + without it spans fall back to the older transformation path. + """ + return { + "Authorization": auth_header, + LANGFUSE_INGESTION_VERSION_HEADER: LANGFUSE_INGESTION_VERSION, + } + + @staticmethod + def _format_otel_headers(headers: Dict[str, str]) -> str: + """ + Serialize a header mapping into the comma-separated OTLP header string + """ + return ",".join(f"{key}={value}" for key, value in headers.items()) + def construct_dynamic_otel_headers( self, standard_callback_dynamic_params: StandardCallbackDynamicParams ) -> Optional[dict]: @@ -374,10 +382,33 @@ class LangfuseOtelLogger(OpenTelemetry): public_key=dynamic_langfuse_public_key, secret_key=dynamic_langfuse_secret_key, ) - dynamic_headers["Authorization"] = auth_header + dynamic_headers.update(LangfuseOtelLogger._build_langfuse_otel_headers(auth_header)) return dynamic_headers + def construct_dynamic_otel_config( + self, standard_callback_dynamic_params: StandardCallbackDynamicParams + ) -> Optional["OpenTelemetryConfig"]: + """ + Build a full per-request OTLP config from team/key dynamic Langfuse credentials. + + Key-scoped credentials must define the export target, not just the auth + headers: without this, a proxy with no global LANGFUSE_* env vars keeps its + init-time fallback exporter (console), so key-level langfuse_otel silently + never reaches Langfuse. + """ + public_key = standard_callback_dynamic_params.get("langfuse_public_key") + secret_key = standard_callback_dynamic_params.get("langfuse_secret_key") + if not public_key or not secret_key: + return None + + langfuse_host = standard_callback_dynamic_params.get("langfuse_host") or self._get_langfuse_otel_host() + return LangfuseOtelLogger._build_langfuse_otel_config( + public_key=public_key, + secret_key=secret_key, + langfuse_host=langfuse_host, + ) + def create_litellm_proxy_request_started_span( self, start_time: datetime, diff --git a/litellm/integrations/langsmith.py b/litellm/integrations/langsmith.py index 18c4baccd51..565ea833768 100644 --- a/litellm/integrations/langsmith.py +++ b/litellm/integrations/langsmith.py @@ -133,6 +133,15 @@ class LangsmithLogger(CustomBatchLogger): "dotted_order": metadata.get("dotted_order", None), } + def _redact_metadata(self, metadata: dict) -> dict: + # helper is shallow; also scrub nested requester_metadata since + # LangSmith forwards the whole dict into the run + redacted = redact_user_api_key_info(metadata=dict(metadata)) + nested = redacted.get("requester_metadata") + if isinstance(nested, dict): + redacted["requester_metadata"] = redact_user_api_key_info(metadata=nested) + return redacted + def _build_extra_metadata(self, metadata: Dict): extra_metadata = dict(metadata) requester_metadata = extra_metadata.get("requester_metadata") @@ -141,13 +150,7 @@ class LangsmithLogger(CustomBatchLogger): if key in requester_metadata and key not in extra_metadata: extra_metadata[key] = requester_metadata[key] - # helper is shallow; also scrub nested requester_metadata since - # LangSmith forwards the whole dict into `extra` - extra_metadata = redact_user_api_key_info(metadata=extra_metadata) - nested = extra_metadata.get("requester_metadata") - if isinstance(nested, dict): - extra_metadata["requester_metadata"] = redact_user_api_key_info(metadata=nested) - return extra_metadata + return self._redact_metadata(extra_metadata) def _build_outputs_with_usage(self, payload: StandardLoggingPayload) -> Dict[str, Any]: response = payload["response"] @@ -200,12 +203,13 @@ class LangsmithLogger(CustomBatchLogger): metadata = payload["metadata"] extra_metadata = self._build_extra_metadata(dict(metadata)) + inputs = {**payload, "metadata": self._redact_metadata(dict(metadata))} outputs = self._build_outputs_with_usage(payload) data = { "name": fields["run_name"], "run_type": "llm", - "inputs": payload, + "inputs": inputs, "outputs": outputs, "session_name": fields["project_name"], "start_time": payload["startTime"], diff --git a/litellm/integrations/opentelemetry.py b/litellm/integrations/opentelemetry.py index de543fa042b..11e7ab062b6 100644 --- a/litellm/integrations/opentelemetry.py +++ b/litellm/integrations/opentelemetry.py @@ -27,7 +27,9 @@ from litellm.integrations.opentelemetry_utils.gen_ai_semconv import ( OTELSemconvCategory, parse_semconv_opt_in, ) +from litellm.integrations.otel.model.semconv import Metric from litellm.litellm_core_utils.safe_json_dumps import safe_dumps +from litellm.litellm_core_utils.secret_redaction import redact_string from litellm.secret_managers.main import get_secret_bool, str_to_bool from litellm.types.services import ServiceLoggerPayload from litellm.types.utils import ( @@ -596,32 +598,32 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): meter = meter_provider.get_meter(__name__) self._operation_duration_histogram = meter.create_histogram( - name="gen_ai.client.operation.duration", # Replace with semconv constant in otel 1.38 + name=Metric.OPERATION_DURATION, description="GenAI operation duration", unit="s", ) self._token_usage_histogram = meter.create_histogram( - name="gen_ai.client.token.usage", # Replace with semconv constant in otel 1.38 + name=Metric.TOKEN_USAGE, description="GenAI token usage", unit="{token}", ) self._cost_histogram = meter.create_histogram( - name="gen_ai.client.token.cost", + name=Metric.TOKEN_COST, description="GenAI request cost", unit="USD", ) self._time_to_first_token_histogram = meter.create_histogram( - name="gen_ai.client.response.time_to_first_token", + name=Metric.TIME_TO_FIRST_TOKEN, description="Time to first token for streaming requests", unit="s", ) self._time_per_output_token_histogram = meter.create_histogram( - name="gen_ai.client.response.time_per_output_token", + name=Metric.TIME_PER_OUTPUT_TOKEN, description="Average time per output token (generation time / completion tokens)", unit="s", ) self._response_duration_histogram = meter.create_histogram( - name="gen_ai.client.response.duration", + name=Metric.RESPONSE_DURATION, description="Total LLM API generation time (excludes LiteLLM overhead)", unit="s", ) @@ -882,8 +884,8 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): request_data: dict, parent_span: Optional[Any], ) -> None: - """Emit ``guardrail`` spans from ``request_data["metadata"] - ["standard_logging_guardrail_information"]``. + """Emit ``guardrail`` spans from the request's proxy-internal metadata bucket + (``standard_logging_guardrail_information``). Routed through ``_create_guardrail_span`` so the dedupe state in ``_otel_internal`` is honoured — if ``_handle_failure`` already @@ -891,7 +893,12 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): """ from opentelemetry import trace as _trace - metadata = (request_data or {}).get("metadata") or {} + from litellm.litellm_core_utils.core_helpers import ( + get_metadata_variable_name_from_kwargs, + ) + + request_data = request_data or {} + metadata = request_data.get(get_metadata_variable_name_from_kwargs(request_data)) or {} guardrail_information = metadata.get("standard_logging_guardrail_information") if not guardrail_information: return @@ -948,12 +955,22 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): Returns: Tracer: The tracer to use for this request """ + dynamic_config = self._get_dynamic_otel_config_from_kwargs(kwargs) + if dynamic_config is not None: + verbose_logger.debug( + "[OTEL DEBUG] Using DYNAMIC config tracer with endpoint: %s", + dynamic_config.endpoint, + ) + return self._get_tracer_with_dynamic_config(dynamic_config) + dynamic_headers = self._get_dynamic_otel_headers_from_kwargs(kwargs) if dynamic_headers is not None: # Create spans using a temporary tracer with dynamic headers tracer_to_use = self._get_tracer_with_dynamic_headers(dynamic_headers) - verbose_logger.debug("[OTEL DEBUG] Using DYNAMIC tracer with headers: %s", dynamic_headers) + verbose_logger.debug( + "[OTEL DEBUG] Using DYNAMIC tracer with headers: %s", redact_string(str(dynamic_headers)) + ) else: # For langfuse_otel without dynamic headers, create a provider with env var credentials if hasattr(self, "callback_name") and self.callback_name == "langfuse_otel": @@ -989,6 +1006,32 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): return dynamic_headers if dynamic_headers else None + def _get_dynamic_otel_config_from_kwargs(self, kwargs: dict) -> Optional[OpenTelemetryConfig]: + """Extract a full dynamic exporter config from kwargs if available.""" + standard_callback_dynamic_params: Optional[StandardCallbackDynamicParams] = kwargs.get( + "standard_callback_dynamic_params" + ) + + if not standard_callback_dynamic_params: + return None + + return self.construct_dynamic_otel_config(standard_callback_dynamic_params=standard_callback_dynamic_params) + + def _get_tracer_with_dynamic_config(self, dynamic_config: OpenTelemetryConfig): + """Create (or reuse) a tracer whose exporter target comes from a per-request config.""" + from opentelemetry.sdk.trace import TracerProvider + + cache_key = f"dynamic_config:{dynamic_config.exporter}:{dynamic_config.endpoint}:{dynamic_config.headers}" + if cache_key in self._tracer_provider_cache: + return self._tracer_provider_cache[cache_key].get_tracer(LITELLM_TRACER_NAME) + + temp_provider = TracerProvider(resource=self._get_litellm_resource(self.config)) + temp_provider.add_span_processor(self._get_span_processor(config_override=dynamic_config)) + + self._tracer_provider_cache[cache_key] = temp_provider + + return temp_provider.get_tracer(LITELLM_TRACER_NAME) + def _get_tracer_with_dynamic_headers(self, dynamic_headers: dict): """Create a temporary tracer with dynamic headers for this request only.""" from opentelemetry.sdk.trace import TracerProvider @@ -1020,6 +1063,19 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): """ return None + def construct_dynamic_otel_config( + self, standard_callback_dynamic_params: StandardCallbackDynamicParams + ) -> Optional[OpenTelemetryConfig]: + """ + Construct a full exporter config from standard callback dynamic params. + + Override this when team/key dynamic params must control the export + target (exporter kind + endpoint), not just the request headers. When + this returns a config, it takes precedence over + construct_dynamic_otel_headers for the request. + """ + return None + ######################################################### # End of Team/Key Based Logging Control Flow ######################################################### @@ -2747,7 +2803,11 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): verbose_logger.debug("OpenTelemetry: No parent context found, creating root span") return None, None - def _get_span_processor(self, dynamic_headers: Optional[dict] = None): + def _get_span_processor( + self, + dynamic_headers: Optional[dict] = None, + config_override: Optional[OpenTelemetryConfig] = None, + ): from opentelemetry.sdk.trace.export import ( BatchSpanProcessor, ConsoleSpanExporter, @@ -2755,40 +2815,45 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): SpanExporter, ) + otel_exporter = config_override.exporter if config_override else self.OTEL_EXPORTER + otel_endpoint = config_override.endpoint if config_override else self.OTEL_ENDPOINT + otel_headers = config_override.headers if config_override else self.OTEL_HEADERS + verbose_logger.debug( - "OpenTelemetry Logger, initializing span processor \nself.OTEL_EXPORTER: %s\nself.OTEL_ENDPOINT: %s\nself.OTEL_HEADERS: %s", - self.OTEL_EXPORTER, - self.OTEL_ENDPOINT, - self.OTEL_HEADERS, + "OpenTelemetry Logger, initializing span processor \nexporter: %s\nendpoint: %s\nheaders: %s", + otel_exporter, + otel_endpoint, + redact_string(str(otel_headers)), ) - _split_otel_headers = OpenTelemetry._get_headers_dictionary(headers=dynamic_headers or self.OTEL_HEADERS) + _split_otel_headers = OpenTelemetry._get_headers_dictionary(headers=dynamic_headers or otel_headers) if dynamic_headers: verbose_logger.debug( "[OTEL DEBUG] Creating span processor with DYNAMIC headers: %s", - {k: v[:20] + "..." if len(str(v)) > 20 else v for k, v in _split_otel_headers.items()}, + redact_string(str(_split_otel_headers)), + ) + elif config_override: + verbose_logger.debug( + "[OTEL DEBUG] Creating span processor with DYNAMIC config, endpoint: %s", + otel_endpoint, ) else: verbose_logger.debug("[OTEL DEBUG] Creating span processor with GLOBAL headers") - if hasattr(self.OTEL_EXPORTER, "export"): # Check if it has the export method that SpanExporter requires + if hasattr(otel_exporter, "export"): # Check if it has the export method that SpanExporter requires verbose_logger.debug( "OpenTelemetry: intiializing SpanExporter. Value of OTEL_EXPORTER: %s", - self.OTEL_EXPORTER, + otel_exporter, ) - return SimpleSpanProcessor(cast(SpanExporter, self.OTEL_EXPORTER)) + return SimpleSpanProcessor(cast(SpanExporter, otel_exporter)) - if self.OTEL_EXPORTER == "console": + if otel_exporter == "console": verbose_logger.debug( "OpenTelemetry: intiializing console exporter. Value of OTEL_EXPORTER: %s", - self.OTEL_EXPORTER, + otel_exporter, ) return BatchSpanProcessor(ConsoleSpanExporter()) - elif ( - self.OTEL_EXPORTER == "otlp_http" - or self.OTEL_EXPORTER == "http/protobuf" - or self.OTEL_EXPORTER == "http/json" - ): + elif otel_exporter == "otlp_http" or otel_exporter == "http/protobuf" or otel_exporter == "http/json": try: from opentelemetry.exporter.otlp.proto.http.trace_exporter import ( OTLPSpanExporter as OTLPSpanExporterHTTP, @@ -2801,13 +2866,13 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): verbose_logger.debug( "OpenTelemetry: intiializing http exporter. Value of OTEL_EXPORTER: %s", - self.OTEL_EXPORTER, + otel_exporter, ) - normalized_endpoint = self._normalize_otel_endpoint(self.OTEL_ENDPOINT, "traces") + normalized_endpoint = self._normalize_otel_endpoint(otel_endpoint, "traces") return BatchSpanProcessor( OTLPSpanExporterHTTP(endpoint=normalized_endpoint, headers=_split_otel_headers), ) - elif self.OTEL_EXPORTER == "otlp_grpc" or self.OTEL_EXPORTER == "grpc": + elif otel_exporter == "otlp_grpc" or otel_exporter == "grpc": try: from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import ( OTLPSpanExporter as OTLPSpanExporterGRPC, @@ -2820,16 +2885,16 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): verbose_logger.debug( "OpenTelemetry: intiializing grpc exporter. Value of OTEL_EXPORTER: %s", - self.OTEL_EXPORTER, + otel_exporter, ) - normalized_endpoint = self._normalize_otel_endpoint(self.OTEL_ENDPOINT, "traces") + normalized_endpoint = self._normalize_otel_endpoint(otel_endpoint, "traces") return BatchSpanProcessor( OTLPSpanExporterGRPC(endpoint=normalized_endpoint, headers=_split_otel_headers), ) else: verbose_logger.debug( "OpenTelemetry: intiializing console exporter. Value of OTEL_EXPORTER: %s", - self.OTEL_EXPORTER, + otel_exporter, ) return BatchSpanProcessor(ConsoleSpanExporter()) @@ -2841,7 +2906,7 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): "OpenTelemetry Logger, initializing log exporter \nself.OTEL_EXPORTER: %s\nself.OTEL_ENDPOINT: %s\nself.OTEL_HEADERS: %s", self.OTEL_EXPORTER, self.OTEL_ENDPOINT, - self.OTEL_HEADERS, + redact_string(str(self.OTEL_HEADERS)), ) _split_otel_headers = OpenTelemetry._get_headers_dictionary(self.OTEL_HEADERS) @@ -2916,10 +2981,12 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): def _get_metric_reader(self): """ Get the appropriate metric reader based on the configuration. + + Histograms keep the SDK's default cumulative temporality: Prometheus-backed + OTLP receivers reject delta histograms and drop the whole batch, while + backends that prefer delta still accept cumulative. """ - from opentelemetry.sdk.metrics import Histogram from opentelemetry.sdk.metrics.export import ( - AggregationTemporality, ConsoleMetricExporter, PeriodicExportingMetricReader, ) @@ -2928,7 +2995,7 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): "OpenTelemetry Logger, initializing metric reader\nself.OTEL_EXPORTER: %s\nself.OTEL_ENDPOINT: %s\nself.OTEL_HEADERS: %s", self.OTEL_EXPORTER, self.OTEL_ENDPOINT, - self.OTEL_HEADERS, + redact_string(str(self.OTEL_HEADERS)), ) _split_otel_headers = OpenTelemetry._get_headers_dictionary(self.OTEL_HEADERS) @@ -2950,7 +3017,6 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): exporter = OTLPMetricExporter( endpoint=normalized_endpoint, headers=_split_otel_headers, - preferred_temporality={Histogram: AggregationTemporality.DELTA}, ) return PeriodicExportingMetricReader(exporter, export_interval_millis=5000) @@ -2968,7 +3034,6 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): exporter = OTLPMetricExporter( endpoint=normalized_endpoint, headers=_split_otel_headers, - preferred_temporality={Histogram: AggregationTemporality.DELTA}, ) return PeriodicExportingMetricReader(exporter, export_interval_millis=5000) diff --git a/litellm/integrations/opik/utils.py b/litellm/integrations/opik/utils.py index 7222c9d0502..d4850d50778 100644 --- a/litellm/integrations/opik/utils.py +++ b/litellm/integrations/opik/utils.py @@ -1,40 +1,38 @@ import configparser import os import time +import uuid from typing import Any, Dict, Final, List, Optional, Tuple CONFIG_FILE_PATH_DEFAULT: Final[str] = "~/.opik.config" -def create_uuid7(): - ns = time.time_ns() - last = [0, 0, 0, 0] +def create_uuid7() -> str: + """Generate an RFC 9562 conformant UUIDv7 string. - # Simple uuid7 implementation - sixteen_secs = 16_000_000_000 - t1, rest1 = divmod(ns, sixteen_secs) - t2, rest2 = divmod(rest1 << 16, sixteen_secs) - t3, _ = divmod(rest2 << 12, sixteen_secs) - t3 |= 7 << 12 # Put uuid version in top 4 bits, which are 0 in t3 + The top 48 bits encode the Unix timestamp in milliseconds. Opik's backend + validates this embedded timestamp on ingestion (it must fall within a window + around "now"), so the encoding has to be correct or trace/span batches are + rejected with HTTP 400. Implemented with the standard library only, so no + extra dependency is added to litellm. See ``opik.id_helpers`` for the + reference implementation. + """ + unix_ts_ms = int(time.time() * 1000) - # The next two bytes are an int (t4) with two bits for - # the variant 2 and a 14 bit sequence counter which increments - # if the time is unchanged. - if t1 == last[0] and t2 == last[1] and t3 == last[2]: - # Stop the seq counter wrapping past 0x3FFF. - # This won't happen in practice, but if it does, - # uuids after the 16383rd with that same timestamp - # will not longer be correctly ordered but - # are still unique due to the 6 random bytes. - if last[3] < 0x3FFF: - last[3] += 1 - else: - last[:] = (t1, t2, t3, 0) - t4 = (2 << 14) | last[3] # Put variant 0b10 in top two bits + # Fill the 16-byte buffer with random data, then overwrite the structured + # parts (timestamp, version, variant) defined by the UUIDv7 layout. + uuid_bytes = bytearray(os.urandom(16)) - # Six random bytes for the lower part of the uuid - rand = os.urandom(6) - return f"{t1:>08x}-{t2:>04x}-{t3:>04x}-{t4:>04x}-{rand.hex()}" + # First 48 bits (6 bytes): Unix timestamp in milliseconds. + uuid_bytes[0:6] = unix_ts_ms.to_bytes(6, byteorder="big") + + # Version 7 in the top 4 bits of byte 6. + uuid_bytes[6] = 0x70 | (uuid_bytes[6] & 0x0F) + + # Variant 0b10 in the top 2 bits of byte 8. + uuid_bytes[8] = 0x80 | (uuid_bytes[8] & 0x3F) + + return str(uuid.UUID(bytes=bytes(uuid_bytes))) def _read_opik_config_file() -> Dict[str, str]: diff --git a/litellm/integrations/otel/README.md b/litellm/integrations/otel/README.md index 17011bb8db7..3038bdb90b2 100644 --- a/litellm/integrations/otel/README.md +++ b/litellm/integrations/otel/README.md @@ -223,6 +223,15 @@ lives in [`plumbing/`](./plumbing): readers/exporters receive them alongside the server metrics, and one is built and registered as the global only when none is set (mirroring how V2 owns trace export). +- [`events.py`](./plumbing/events.py) — GenAI client events. Gated on + `enable_events` (`LITELLM_OTEL_INTEGRATION_ENABLE_EVENTS`), a failed LLM call + records the semconv `gen_ai.client.operation.exception` log event at severity + WARN, carrying `exception.type` / `exception.message` / `exception.stacktrace` + and correlated to the failed span through the trace and span ids. The + `LoggerProvider` is resolved like the meter provider, except that an explicit + `NoOpLoggerProvider` global is an operator opt-out that builds no recorder at + all. The deprecated `error.*` span attributes and the `exception` span event + are still stamped by the emitter for backwards compatibility. ### Adapter diff --git a/litellm/integrations/otel/emitter.py b/litellm/integrations/otel/emitter.py index 46aa166a8bb..8651cf586cd 100644 --- a/litellm/integrations/otel/emitter.py +++ b/litellm/integrations/otel/emitter.py @@ -18,6 +18,7 @@ from litellm.integrations.otel.model.payloads import ( ServiceSpanData, SpanError, ) +from litellm.integrations.otel.plumbing.events import GenAIEventRecorder from litellm.integrations.otel.plumbing.providers import to_otel_span_kind from litellm.integrations.otel.model.semconv import Error, ExceptionEvent, LiteLLMError from litellm.integrations.otel.model.spans import ( @@ -71,15 +72,53 @@ def _stamp_litellm_error_attributes(span: Span, error: SpanError) -> None: span.set_attribute(LiteLLMError.LLM_PROVIDER, error.llm_provider) +def stamp_error( + span: Span, + error: SpanError, + *, + record_event: bool = True, + set_status: bool = True, +) -> tuple[str, str] | None: + """Stamp the full v2 error attribute set on ``span`` and return the resolved + ``(error_type, message)`` pair, or ``None`` when the error carries neither a + type nor a message. + + Shared by the LLM-call span (``finish_span``) and the proxy-level failure + spans (the FastAPI SERVER span and the ``auth`` phase span) so every v2 error + span carries identical keys. The semconv ``exception`` event rides alongside + the attributes so backends that map unknown string attrs to a truncated + ``keyword`` (e.g. Elasticsearch's 1024-char ``ignore_above``) still see the + full untruncated message on the recognized event field. ``record_event`` and + ``set_status`` are opt-outs for callers whose span lifecycle (``use_span``) or + owner (the FastAPI instrumentor) already records the event or the status. + """ + if not (error.error_type or error.message): + return None + error_type = error.error_type or "error" + message = error.message or error.error_type or "error" + _stamp_otel_error_attributes(span, error_type, message) + _stamp_litellm_error_attributes(span, error) + if set_status: + span.set_status(Status(StatusCode.ERROR, message)) + if record_event: + span.add_event( + ExceptionEvent.NAME, + {ExceptionEvent.TYPE: error_type, ExceptionEvent.MESSAGE: message}, + ) + return error_type, message + + class SpanEmitter: def __init__( self, tracer: Tracer, config: OpenTelemetryV2Config, mappers: Sequence[AttributeMapper] | None = None, + event_recorder: GenAIEventRecorder | None = None, ) -> None: self._tracer = tracer self._config = config + self._event_recorder = event_recorder # The mapper chain is the sole source of span attributes. When not # passed in, resolve it from the config so there's one source of truth. self._mappers: list[AttributeMapper] = ( @@ -209,20 +248,17 @@ class SpanEmitter: ) else None ) - if error and (error.error_type or error.message): - error_type = error.error_type or "error" - message = error.message or error.error_type or "error" - _stamp_otel_error_attributes(span, error_type, message) - _stamp_litellm_error_attributes(span, error) - span.set_status(Status(StatusCode.ERROR, message)) - # Also emit the semconv ``exception`` event so backends that - # dynamic-map unknown string span attrs to ``keyword`` (e.g. - # Elasticsearch with a 1024-char ``ignore_above``) still see the - # full untruncated message on the recognized event field. - span.add_event( - ExceptionEvent.NAME, - {ExceptionEvent.TYPE: error_type, ExceptionEvent.MESSAGE: message}, - ) + if error: + stamped = stamp_error(span, error) + if stamped is not None and self._event_recorder is not None and role is SpanRole.LLM_CALL: + error_type, message = stamped + self._event_recorder.record_operation_exception( + span_context=span.get_span_context(), + error_type=error_type, + message=message, + stack_trace=error.stack_trace, + timestamp_ns=end_time_ns, + ) # On success leave the status UNSET (the semconv default) rather than # forcing OK — that matches the FastAPI server span and avoids implying a # span-level health signal litellm doesn't actually evaluate. Only a diff --git a/litellm/integrations/otel/logger.py b/litellm/integrations/otel/logger.py index e258b239d93..b33973f0676 100644 --- a/litellm/integrations/otel/logger.py +++ b/litellm/integrations/otel/logger.py @@ -6,6 +6,7 @@ from datetime import datetime from typing import TYPE_CHECKING, Any, Callable, Iterator, Mapping, Sequence, cast from opentelemetry.context import Context, attach, get_current +from opentelemetry.sdk._logs import LoggerProvider from opentelemetry.sdk.trace import TracerProvider from opentelemetry.trace import Span, Tracer, get_current_span, use_span @@ -16,6 +17,7 @@ from litellm.integrations.otel.model.baggage import promoted_baggage from litellm.integrations.otel.model.config import OpenTelemetryV2Config from litellm.integrations.otel.plumbing.context import ( is_recordable_span, + mcp_message_transport_span, request_root_span, resolve_mcp_span_context, resolve_parent_context, @@ -23,7 +25,7 @@ from litellm.integrations.otel.plumbing.context import ( set_request_baggage, set_request_root_span, ) -from litellm.integrations.otel.emitter import SpanEmitter +from litellm.integrations.otel.emitter import SpanEmitter, stamp_error from litellm.integrations.otel.mappers import resolve_mappers from litellm.integrations.otel.model.metadata import ( LLMCallEvent, @@ -40,14 +42,17 @@ from litellm.integrations.otel.model.payloads import ( is_mcp_list_tools, is_mcp_tool_call, ) +from litellm.integrations.otel.plumbing.events import GenAIEventRecorder from litellm.integrations.otel.plumbing.metrics import ( GenAIMetricRecorder, create_genai_metrics, ) from litellm.integrations.otel.plumbing.providers import ( build_tracer_provider, + get_event_logger, get_meter, get_tracer, + resolve_logger_provider, resolve_meter_provider, ) from litellm.integrations.otel.plumbing.routing import TenantTracerCache @@ -55,6 +60,7 @@ from litellm.integrations.otel.model.spans import SpanRole, span_role_for_servic from litellm.integrations.otel.model.utils import to_ns if TYPE_CHECKING: + from litellm.proxy._types import UserAPIKeyAuth from litellm.types.utils import ( StandardLoggingGuardrailInformation, StandardLoggingPayload, @@ -62,6 +68,33 @@ if TYPE_CHECKING: LITELLM_TRACER_NAME = "litellm" + +def _span_error_from_exception( + exception: "Exception | None", + *, + status_code: int | None = None, + traceback_str: str | None = None, +) -> SpanError: + """A ``SpanError`` for a proxy-level failure that never produced a + ``StandardLoggingPayload`` (auth / validation / malformed-body rejections), + mirroring ``_parse_error``'s field mapping so it stamps the same v2 keys a + failed LLM call does. ``status_code`` pins ``error.code`` to the real response + status, matching v1's SERVER-span behavior.""" + from litellm.litellm_core_utils.litellm_logging import StandardLoggingPayloadSetup + + info = StandardLoggingPayloadSetup.get_error_information( + original_exception=exception, + traceback_str=traceback_str, + ) + return SpanError( + error_type=info.get("error_class") or info.get("error_code") or None, + message=info.get("error_message") or None, + code=str(status_code) if status_code is not None else (info.get("error_code") or None), + stack_trace=info.get("traceback") or None, + llm_provider=info.get("llm_provider") or None, + ) + + # Any callback whose class belongs to one of these modules is "the OTel # callback" for proxy-global-registration purposes. _OTEL_MODULES = ( @@ -104,7 +137,7 @@ class OpenTelemetryV2(CustomLogger): config: OpenTelemetryV2Config | None = None, callback_name: str | None = None, tracer_provider: TracerProvider | None = None, - logger_provider: Any | None = None, # reserved for OTel logs + logger_provider: LoggerProvider | None = None, meter_provider: Any | None = None, **kwargs: Any, ) -> None: @@ -117,7 +150,12 @@ class OpenTelemetryV2(CustomLogger): self.tracer: Tracer = get_tracer(self._tracer_provider, LITELLM_TRACER_NAME) self._metrics_recorder = self._init_metrics(meter_provider) self._metric_filter_error_logged = False - self._emitter = SpanEmitter(self.tracer, self.config, mappers=resolve_mappers(self.config.mapper_names)) + self._emitter = SpanEmitter( + self.tracer, + self.config, + mappers=resolve_mappers(self.config.mapper_names), + event_recorder=self._init_events(logger_provider), + ) self._tenant_tracers = TenantTracerCache(self.config, callback_name, LITELLM_TRACER_NAME) self._open_llm_calls: "OrderedDict[str, _LLMCallSpan]" = OrderedDict() self._init_otel_logger_on_litellm_proxy() @@ -136,6 +174,22 @@ class OpenTelemetryV2(CustomLogger): meter = get_meter(provider, LITELLM_TRACER_NAME) return GenAIMetricRecorder(create_genai_metrics(meter), self.callback_name) + def _init_events(self, logger_provider: LoggerProvider | None) -> "GenAIEventRecorder | None": + """Create the GenAI event recorder when events are enabled, else ``None``. + + ``logger_provider`` is an explicit override (tests inject one); otherwise the + provider is resolved from the OTel global so an operator-configured logs + pipeline receives the events, building and registering one only when no + global provider is set. A ``None`` resolution means the operator opted out + of the logs signal, so no recorder is built. + """ + if not self.config.enable_events: + return None + provider = resolve_logger_provider(self.config, logger_provider) + if provider is None: + return None + return GenAIEventRecorder(get_event_logger(provider, LITELLM_TRACER_NAME)) + # ====================================================================== # # Proxy global registration # ====================================================================== # @@ -533,7 +587,12 @@ class OpenTelemetryV2(CustomLogger): def start_phase_span(self, name: str) -> "Iterator[Span]": span = self._emitter.start_span(SpanRole.SERVICE, name) with use_span(span, end_on_exit=True): - yield span + try: + yield span + except Exception as exc: + if is_recordable_span(span): + stamp_error(span, _span_error_from_exception(exc), record_event=False, set_status=False) + raise async def async_pre_call_hook( self, @@ -548,6 +607,54 @@ class OpenTelemetryV2(CustomLogger): ) return data + def record_error_attributes_on_span( + self, + span: "Span | None", + exception: "Exception | None", + status_code: int, + ) -> None: + """Stamp the v2 error.* attributes on the FastAPI-owned SERVER span for a + failure that dies before any LLM-call span exists (malformed body, auth / + validation rejection). Called from the proxy's global exception handler via + ``_close_dangling_otel_server_span``. The instrumentor still owns the span's + status and lifecycle, so this only decorates it — never sets status, never + ends it — and emits no exception event, matching v1's SERVER-span behavior + and avoiding a duplicate of the event ``async_post_call_failure_hook`` or + the ``auth`` phase span already records.""" + if span is None or not is_recordable_span(span): + return + stamp_error( + span, + _span_error_from_exception(exception, status_code=status_code), + record_event=False, + set_status=False, + ) + + async def async_post_call_failure_hook( + self, + request_data: dict, + original_exception: Exception, + user_api_key_dict: "UserAPIKeyAuth", + traceback_str: "str | None" = None, + ) -> None: + """Stamp error.* on the request's root SERVER span for a proxy-level + failure that never reached an LLM call (empty body rejected in the + endpoint, auth failure), so the failed request carries the same error keys + a failed LLM call does. v1's ``OpenTelemetry`` implemented this same hook; + v2 lost it when it stopped subclassing ``OpenTelemetry``, which is the + LIT-4179 regression for pre-call failures. + + An MCP message is handled on the session's task, where the request-root + anchor is whatever request opened the session, so prefer the transport the + gateway published for this specific message. Without that, a failed tool + call aimed its error at the ``initialize`` request's finished span and the + SDK dropped it, leaving the POST that actually failed unmarked.""" + span = mcp_message_transport_span() or request_root_span() or user_api_key_dict.parent_otel_span + if span is None or not is_recordable_span(span): + return None + stamp_error(span, _span_error_from_exception(original_exception, traceback_str=traceback_str)) + return None + def emit_guardrail_span(self, entry: "StandardLoggingGuardrailInformation") -> None: # Emitted by the guardrail-recording code the moment a guardrail finishes, # not from a post-call hook — that hook does not fire on every path (a diff --git a/litellm/integrations/otel/model/semconv.py b/litellm/integrations/otel/model/semconv.py index aab80c7e5c4..1abe8ca33fa 100644 --- a/litellm/integrations/otel/model/semconv.py +++ b/litellm/integrations/otel/model/semconv.py @@ -177,6 +177,19 @@ class ExceptionEvent: NAME: Final = "exception" TYPE: Final = "exception.type" MESSAGE: Final = "exception.message" + STACKTRACE: Final = "exception.stacktrace" + + +class GenAIEvent: + """GenAI semconv event names, from the GenAI registry's *events* section. + + ``gen_ai.client.operation.exception`` is defined as a log-based event + (severity WARN) carrying the ``exception.*`` trio, correlated to the failed + span via the trace/span ids — the semconv-compliant home for GenAI failure + details, unlike the deprecated ``error.message`` span attribute. + """ + + OPERATION_EXCEPTION: Final = "gen_ai.client.operation.exception" class Server: @@ -244,13 +257,27 @@ class LiteLLM: class Metric: - """GenAI metric instrument names.""" + """GenAI metric instrument names. + + Every name here that a convention or a backend defines uses that name, so a + consumer charting GenAI telemetry finds litellm's series where it looks for + them. ``TOKEN_USAGE``, ``OPERATION_DURATION``, ``TIME_TO_FIRST_TOKEN`` and + ``TIME_PER_OUTPUT_TOKEN`` are semconv instruments, defined in the GenAI + conventions; the ``gen_ai.client.response.*`` spellings litellm used for the + latter two are not conventions at all, so nothing downstream could chart + them. Cost has no semconv instrument, so it takes ``gen_ai.usage.cost``, the + name backends already query for spend. + + ``RESPONSE_DURATION`` keeps its vendor spelling deliberately: the closest + convention, ``gen_ai.server.request.duration``, would collide in meaning with + ``OPERATION_DURATION``, which litellm already emits for the whole operation. + """ TOKEN_USAGE: Final = "gen_ai.client.token.usage" OPERATION_DURATION: Final = "gen_ai.client.operation.duration" - TOKEN_COST: Final = "gen_ai.client.token.cost" - TIME_TO_FIRST_TOKEN: Final = "gen_ai.client.response.time_to_first_token" - TIME_PER_OUTPUT_TOKEN: Final = "gen_ai.client.response.time_per_output_token" + TOKEN_COST: Final = "gen_ai.usage.cost" + TIME_TO_FIRST_TOKEN: Final = "gen_ai.server.time_to_first_token" + TIME_PER_OUTPUT_TOKEN: Final = "gen_ai.server.time_per_output_token" RESPONSE_DURATION: Final = "gen_ai.client.response.duration" diff --git a/litellm/integrations/otel/model/spans.py b/litellm/integrations/otel/model/spans.py index c93f95ec97d..fa41070a8de 100644 --- a/litellm/integrations/otel/model/spans.py +++ b/litellm/integrations/otel/model/spans.py @@ -18,12 +18,14 @@ before the LLM call even starts), so a guardrail is a sibling of the LLM call, not a child of it. The emitter parents every span to the ambient OTel context (the active server span), which matches this. -MCP spans (``MCP_TOOL_CALL``, ``MCP_LIST_TOOLS``) are intentionally NOT in this -tree. Per the OTel GenAI MCP semconv, MCP and the HTTP transport are independent -contexts, so an MCP span parents to the trace context the client propagated in -``params._meta`` (or starts its own root when none is propagated) and records the -``PROXY_REQUEST`` transport span as a span *link*, never a parent. The registry -encodes this as ``parent=None, links=PROXY_REQUEST``. +MCP spans (``MCP_TOOL_CALL``, ``MCP_LIST_TOOLS``) have two shapes, chosen at emit +time by :func:`resolve_mcp_span_context`. When the client propagates trace context +in ``params._meta`` MCP and the HTTP transport are independent contexts per the +OTel GenAI MCP semconv, so the span parents to that propagated context and records +the ``PROXY_REQUEST`` transport span as a span *link*, never a parent — the shape +this registry's ``parent=None, links=PROXY_REQUEST`` entry encodes. When nothing is +propagated (the common case) the span nests under the transport span of the request +carrying that message, so the tool call stays in one trace. Not every service call becomes a span — :func:`span_role_for_service` decides: @@ -89,12 +91,13 @@ class SpanSpec: SPAN_REGISTRY: dict[SpanRole, SpanSpec] = { SpanRole.PROXY_REQUEST: SpanSpec(SpanRole.PROXY_REQUEST, LiteLLMSpanKind.SERVER, parent=None), SpanRole.LLM_CALL: SpanSpec(SpanRole.LLM_CALL, LiteLLMSpanKind.CLIENT, parent=SpanRole.PROXY_REQUEST), - # MCP and the HTTP transport are independent contexts (OTel GenAI MCP semconv), - # so an MCP span does not nest under the transport span. The proxy is an MCP - # client to the upstream server, so it's a CLIENT span; it parents to the trace - # context the client propagated in ``params._meta`` (or starts its own root when - # none is propagated) and records the PROXY_REQUEST transport span as a span - # *link*, never a parent — hence ``parent=None, links=PROXY_REQUEST``. + # The proxy is an MCP client to the upstream server, so MCP spans are CLIENT + # spans. With trace context propagated in ``params._meta``, MCP and the HTTP + # transport are independent contexts (OTel GenAI MCP semconv): the span parents + # to the propagated context and records the PROXY_REQUEST transport span as a + # span *link*, never a parent — the shape ``parent=None, links=PROXY_REQUEST`` + # encodes. With nothing propagated, ``resolve_mcp_span_context`` nests the span + # under that message's transport span instead, keeping the call in one trace. SpanRole.MCP_TOOL_CALL: SpanSpec( SpanRole.MCP_TOOL_CALL, LiteLLMSpanKind.CLIENT, parent=None, links=SpanRole.PROXY_REQUEST ), diff --git a/litellm/integrations/otel/model/utils.py b/litellm/integrations/otel/model/utils.py index f37afc97879..ab54a558a9a 100644 --- a/litellm/integrations/otel/model/utils.py +++ b/litellm/integrations/otel/model/utils.py @@ -1,9 +1,11 @@ """Shared, OpenTelemetry-free helpers for the otel integration. -Generic value coercion (for reading heterogeneous logging-payload dicts), time -conversion, and header parsing — pulled out of the individual modules so they -live in one place. Deliberately free of any ``opentelemetry`` import so the -OTel-free sources of truth (payloads, semconv, spans, config) can use it too. +Generic value coercion (for reading heterogeneous logging-payload dicts) and +time conversion — pulled out of the individual modules so they live in one +place. Deliberately free of any ``opentelemetry`` import so the OTel-free +sources of truth (payloads, semconv, spans, config) can use it too. OTLP header +parsing lives in :mod:`litellm.integrations.otel.plumbing.providers` instead, +because it delegates to the OTel SDK's own W3C Baggage parser. """ from datetime import datetime @@ -89,15 +91,3 @@ def to_seconds(value: datetime | float | int | str | None) -> float | None: except ValueError: continue return None - - -def parse_headers(raw: str | None) -> dict[str, str]: - """Parse an OTLP ``"k=v,k=v"`` header string into a dict.""" - headers: dict[str, str] = {} - if not raw: - return headers - for pair in raw.split(","): - if "=" in pair: - key, _, value = pair.partition("=") - headers[key.strip()] = value.strip() - return headers diff --git a/litellm/integrations/otel/plumbing/context.py b/litellm/integrations/otel/plumbing/context.py index 8acac112c3d..c03ef8d6d63 100644 --- a/litellm/integrations/otel/plumbing/context.py +++ b/litellm/integrations/otel/plumbing/context.py @@ -5,7 +5,14 @@ from typing import Mapping from opentelemetry import baggage from opentelemetry.context import Context, get_current -from opentelemetry.trace import Link, Span, get_current_span, set_span_in_context +from opentelemetry.trace import ( + Link, + NonRecordingSpan, + Span, + SpanContext, + get_current_span, + set_span_in_context, +) from opentelemetry.trace.propagation.tracecontext import ( TraceContextTextMapPropagator, ) @@ -72,6 +79,86 @@ def reset_mcp_message_trace_carrier(token: "Token[Mapping[str, str] | None]") -> _mcp_message_trace_carrier.reset(token) +# The transport span of the HTTP request carrying the CURRENT MCP message. +# +# ``_request_root_span`` above cannot be used for MCP: a *stateful* streamable-HTTP +# session runs every message on the single task spawned by that session's +# ``initialize`` POST, so the ContextVar the ASGI request task writes at auth time +# is frozen at ``initialize`` there and never sees the later ``tools/call`` POSTs. +# Reading it from the message handler parents every tool call in the session to the +# first request's server span and aims that call's ``error.*`` at it — a span that +# ended long ago, so the SDK drops the write and the failure reaches no request at +# all. The gateway instead resolves the current message's transport span on the +# request task and hands it over the same way it hands over per-request auth, and +# the handler publishes it here for the span emitter and the failure hook. +_mcp_message_transport_span: "ContextVar[Span | None]" = ContextVar( + "litellm_otel_mcp_message_transport_span", default=None +) + + +def set_mcp_message_transport_span(span: object) -> "Token[Span | None]": + """Publish the transport span of the request carrying the current MCP message. + + Also re-anchors the request root, so everything else the message emits or stamps + — the identity attributes seeded onto the server span, a guardrail span, a + proxy-level failure — lands on this request instead of on the one that opened + the session. The MCP SDK dispatches each message on its own task, so the anchor + is scoped to this message; the handler re-publishes it for the next one either + way. Only a transport still open for writes is anchored: replacing the anchor + with a request that already answered would just move the dropped writes from one + finished span to another. + + Takes ``object`` because the gateway reads it back out of the ASGI scope, whose + values are untyped; anything that is not a usable span is stored as ``None`` + rather than trusted. + + Returns the reset token; the caller must reset it once the message is handled + so the transport never leaks to the next message on the same session task. + """ + transport = span if isinstance(span, Span) and is_recordable_span(span) else None + if transport is not None and transport.is_recording(): + set_request_root_span(transport) + return _mcp_message_transport_span.set(transport) + + +def reset_mcp_message_transport_span(token: "Token[Span | None]") -> None: + _mcp_message_transport_span.reset(token) + + +def mcp_message_transport_span() -> "Span | None": + """The published transport span, only while it is still open for writes. + + Recording — not merely valid — is the bar here because this span is the target + of ``error.*`` stamping from another task, and the publisher's validity check + cannot speak for a span that has since ended. A finished span keeps a valid + context forever, so it would otherwise be handed back for a write the SDK then + refuses. The POST carrying a ``tools/call`` stays open until the result is + written, so it is recording for the life of the call; a notification POST can + answer first, and this returns ``None`` for it rather than writing into the void. + """ + span = _mcp_message_transport_span.get() + if span is None or not span.is_recording(): + return None + return span + + +def _mcp_transport_span_context() -> "SpanContext | None": + """The transport span an MCP message span should attach to. + + Prefers the transport the gateway published for this specific message; falls + back to the ambient request anchor for paths that emit an MCP span on the + request task itself (the REST MCP endpoints, the SDK). Parenting and linking + only need the immutable context, and unlike ``mcp_message_transport_span`` they + stay correct against a transport that has already finished, so this does not + require the span to still be recording. + """ + published = _mcp_message_transport_span.get() + if published is not None: + return published.get_span_context() + span = request_root_span() + return span.get_span_context() if span is not None else None + + def set_request_baggage(values: Mapping[str, str], context: Context | None = None) -> Context: """Return a context with ``values`` written into Baggage.""" ctx = context @@ -132,33 +219,44 @@ def resolve_request_span_context() -> Context: def resolve_mcp_span_context( carrier: "Mapping[str, str] | None" = None, ) -> "tuple[Context, tuple[Link, ...]]": - """Parent context + links for an MCP message span, per the OTel GenAI MCP semconv. + """Parent context + links for an MCP message span. - MCP and the underlying transport (HTTP) are independent lifecycles — one - streamable-HTTP session multiplexes many messages, so nesting the message span - under the HTTP/session span is wrong (it renders the message at the session's - start, skewed by however long the session has been open). Instead: + When the client propagates W3C trace context in the request's ``params._meta`` + (SEP-414), MCP and the underlying transport are independent lifecycles — one + streamable-HTTP session multiplexes many messages, and the client's own span is + the truthful parent. So, per the OTel GenAI MCP semconv: - * parent to the trace context the client propagated in the request's - ``params._meta`` (a *remote* parent), and - * record the transport/session span as a *link*, never the parent. + * parent to the trace context the client propagated (a *remote* parent), and + * record the transport span as a *link*, never the parent. + + Almost no client implements SEP-414 yet, so in practice nothing is propagated. + Rooting the span there splits a single tool call into two disconnected traces + joined only by a link, which is how it surfaces in APM: the ``POST`` transaction + and the ``tools/call`` span share no trace. With no remote parent to honor, + parent to the transport span of the request carrying this message instead, so + the call stays in one trace; no link is added since the transport is now the + real parent. The transport comes from :func:`_mcp_transport_span_context`, which + is the *current message's* POST rather than whatever request happened to open + the session, so a long-lived session does not glue every message under its + first request. With neither a remote parent nor a transport the returned context + carries no span and the span legitimately starts its own root trace. Only trace context (``traceparent``/``tracestate``) is extracted, never the client's W3C Baggage: ``params._meta`` is caller-controlled, and the otel baggage processor stamps allowlisted baggage keys (``litellm.team.id``, ``litellm.metadata.*``, ...) onto the span as attributes, so honoring remote - baggage would let a client spoof a span's identity attribution. - - With no propagated context the returned context carries no span, so the span - starts its own root trace (still linked to the transport). The base context is - explicitly empty so an absent ``traceparent`` can never fall through to the - ambient (stale session) span. + baggage would let a client spoof a span's identity attribution. The base context + for extraction is explicitly empty so an absent or malformed ``traceparent`` can + never fall through to the ambient (stale session) span. """ source = carrier if carrier is not None else _mcp_message_trace_carrier.get() parent = _PROPAGATOR.extract(dict(source or {}), context=Context()) - transport = request_root_span() - links = (Link(transport.get_span_context()),) if transport is not None else () - return parent, links + transport = _mcp_transport_span_context() + if is_recordable_span(get_current_span(parent)): + return parent, (Link(transport),) if transport is not None else () + if transport is not None: + return context_from_span(NonRecordingSpan(transport)), () + return parent, () def is_recordable_span(obj: object) -> bool: diff --git a/litellm/integrations/otel/plumbing/events.py b/litellm/integrations/otel/plumbing/events.py new file mode 100644 index 00000000000..f674526d04f --- /dev/null +++ b/litellm/integrations/otel/plumbing/events.py @@ -0,0 +1,52 @@ +"""GenAI client events: the ``gen_ai.client.operation.exception`` log event. + +The GenAI semantic conventions define exception recording for client +operations as a log-based event (severity WARN) carrying the ``exception.*`` +attribute trio, correlated to the failed span through the trace/span ids — +not as a span attribute or span event. This module owns building and +emitting that event; the exporter pipeline it rides is built in +:mod:`litellm.integrations.otel.plumbing.providers`. +""" + +from dataclasses import dataclass + +from opentelemetry._events import Event, EventLogger +from opentelemetry._logs.severity import SeverityNumber +from opentelemetry.trace import SpanContext + +from litellm.integrations.otel.model.semconv import ExceptionEvent, GenAIEvent + + +@dataclass(frozen=True, slots=True) +class GenAIEventRecorder: + event_logger: EventLogger + + def record_operation_exception( + self, + span_context: SpanContext, + error_type: str, + message: str, + stack_trace: str | None, + timestamp_ns: int | None, + ) -> None: + # ``exception.type`` and ``exception.message`` are the semconv-required + # pair and always ride the event; only the recommended stacktrace is + # conditional on the payload carrying one. + stacktrace = ((ExceptionEvent.STACKTRACE, stack_trace),) if stack_trace else () + self.event_logger.emit( + Event( + name=GenAIEvent.OPERATION_EXCEPTION, + timestamp=timestamp_ns, + trace_id=span_context.trace_id, + span_id=span_context.span_id, + trace_flags=span_context.trace_flags, + severity_number=SeverityNumber.WARN, + attributes=dict( + ( + (ExceptionEvent.TYPE, error_type), + (ExceptionEvent.MESSAGE, message), + *stacktrace, + ) + ), + ) + ) diff --git a/litellm/integrations/otel/plumbing/providers.py b/litellm/integrations/otel/plumbing/providers.py index ac971c6daa8..ede9acc6d8f 100644 --- a/litellm/integrations/otel/plumbing/providers.py +++ b/litellm/integrations/otel/plumbing/providers.py @@ -2,9 +2,20 @@ from typing import TYPE_CHECKING, Any, Callable, Iterable -from opentelemetry import baggage, metrics +from opentelemetry import _logs, baggage, metrics +from opentelemetry._events import EventLogger +from opentelemetry._logs import LoggerProvider, NoOpLoggerProvider from opentelemetry.context import Context from opentelemetry.metrics import MeterProvider, NoOpMeterProvider +from opentelemetry.sdk._events import EventLoggerProvider +from opentelemetry.sdk._logs import LoggerProvider as SDKLoggerProvider +from opentelemetry.sdk._logs.export import ( + BatchLogRecordProcessor, + ConsoleLogExporter, + InMemoryLogExporter, + LogExporter, + SimpleLogRecordProcessor, +) from opentelemetry.sdk.metrics import MeterProvider as SDKMeterProvider from opentelemetry.sdk.resources import Resource from opentelemetry.sdk.trace import ReadableSpan, SpanProcessor, TracerProvider @@ -18,15 +29,13 @@ from opentelemetry.sdk.trace.export.in_memory_span_exporter import ( InMemorySpanExporter, ) from opentelemetry.trace import Span, SpanKind, Tracer +from opentelemetry.util.re import parse_env_headers from litellm._version import version as litellm_version from litellm.integrations.otel.model.config import ExporterSpec, OpenTelemetryV2Config from litellm.integrations.otel.model.semconv import LiteLLM from litellm.integrations.otel.model.spans import LiteLLMSpanKind -# Re-exported so ``providers.parse_headers`` remains a stable entry point. -from litellm.integrations.otel.model.utils import parse_headers as parse_headers - if TYPE_CHECKING: from opentelemetry.metrics import Meter from opentelemetry.sdk.metrics.export import MetricReader @@ -108,6 +117,23 @@ def _otlp_traces_endpoint(endpoint: str | None) -> str | None: return endpoint + "/v1/traces" +def parse_headers(raw: str | None) -> dict[str, str]: + """Parse an OTLP ``"k=v,k=v"`` header string into a dict. + + ``OTEL_EXPORTER_OTLP_HEADERS`` is W3C Baggage encoded per the OTLP spec, so + values are percent-decoded: a vendor that documents + ``Authorization=Basic%20`` (Grafana Cloud does, because a bare space + is not representable there) has to reach the exporter as ``Basic ``, + not with a literal ``%20`` that the backend rejects as malformed. The SDK's + own parser is used so litellm decodes exactly what the OTLP exporters do + when they read the env var themselves; ``liberal`` keeps values that are not + percent-encoded (``Authorization=Bearer ``) working unchanged. + """ + if not raw: + return {} + return dict(parse_env_headers(raw, liberal=True)) + + def _exporter_from_spec(spec: ExporterSpec) -> SpanExporter: kind = (spec.kind or "console").lower() factory = _EXPORTER_FACTORIES.get(kind) @@ -180,6 +206,13 @@ def build_metric_reader(config: OpenTelemetryV2Config) -> "MetricReader": ``console`` (and any unrecognized kind) exports to the console; ``otlp_http`` and ``otlp_grpc`` export over OTLP with the configured endpoint/headers. The reader exports on a 5s period, matching v1. + + Histograms keep the SDK's default cumulative temporality. Prometheus-backed + OTLP receivers (Grafana Cloud / Mimir, and the Prometheus OTLP endpoint) + reject delta histograms outright with ``invalid temporality and type + combination``, which drops the whole metric batch, while backends that + prefer delta still accept cumulative. The enterprise billing exporter + already relies on the same default. """ from opentelemetry.sdk.metrics.export import ( ConsoleMetricExporter, @@ -191,18 +224,12 @@ def build_metric_reader(config: OpenTelemetryV2Config) -> "MetricReader": from opentelemetry.exporter.otlp.proto.http.metric_exporter import ( OTLPMetricExporter as HTTPMetricExporter, ) - from opentelemetry.sdk.metrics import Histogram - from opentelemetry.sdk.metrics.export import AggregationTemporality exporter: Any = HTTPMetricExporter( endpoint=_otlp_metrics_endpoint(config.endpoint), headers=parse_headers(config.headers), - preferred_temporality={Histogram: AggregationTemporality.DELTA}, ) elif kind in ("otlp_grpc", "grpc"): - from opentelemetry.sdk.metrics import Histogram - from opentelemetry.sdk.metrics.export import AggregationTemporality - try: from opentelemetry.exporter.otlp.proto.grpc.metric_exporter import ( OTLPMetricExporter as GRPCMetricExporter, @@ -216,7 +243,6 @@ def build_metric_reader(config: OpenTelemetryV2Config) -> "MetricReader": exporter = GRPCMetricExporter( endpoint=config.endpoint, headers=parse_headers(config.headers), - preferred_temporality={Histogram: AggregationTemporality.DELTA}, ) else: exporter = ConsoleMetricExporter() @@ -224,6 +250,112 @@ def build_metric_reader(config: OpenTelemetryV2Config) -> "MetricReader": return PeriodicExportingMetricReader(exporter, export_interval_millis=5000) +def _otlp_logs_endpoint(endpoint: str | None) -> str | None: + """Point an OTLP/HTTP base endpoint at the ``/v1/logs`` signal path. + + The OTLP/HTTP exporter only appends ``/v1/logs`` when it reads + ``OTEL_EXPORTER_OTLP_ENDPOINT`` itself; an explicitly passed endpoint is used + verbatim, so a base URL would POST to the root. Mirror ``_otlp_traces_endpoint`` + for the logs signal (rewriting a sibling signal path when present). + """ + if not endpoint: + return endpoint + endpoint = endpoint.rstrip("/") + if endpoint.endswith("/v1/logs"): + return endpoint + for other_signal in ("/v1/traces", "/v1/metrics"): + if endpoint.endswith(other_signal): + return endpoint[: -len(other_signal)] + "/v1/logs" + return endpoint + "/v1/logs" + + +def build_log_exporter(config: OpenTelemetryV2Config) -> LogExporter: + """Build a log exporter mirroring the exporter selection of the other signals. + + ``console`` (and any unrecognized kind) exports to the console; ``otlp_http`` + and ``otlp_grpc`` export over OTLP with the configured endpoint/headers; + ``in_memory`` buffers for tests. Like GenAI metrics, events ride the + single-destination shorthand fields, not the multi-exporter ``exporters`` list. + """ + kind = (config.exporter or "console").lower() + if kind in ("in_memory", "inmemory", "memory"): + return InMemoryLogExporter() + if kind in ("otlp_http", "http", "http/protobuf", "http/json"): + from opentelemetry.exporter.otlp.proto.http._log_exporter import ( + OTLPLogExporter as HTTPLogExporter, + ) + + return HTTPLogExporter( + endpoint=_otlp_logs_endpoint(config.endpoint), + headers=parse_headers(config.headers), + ) + if kind in ("otlp_grpc", "grpc"): + try: + from opentelemetry.exporter.otlp.proto.grpc._log_exporter import ( + OTLPLogExporter as GRPCLogExporter, + ) + except ImportError as exc: + raise ImportError( + "OpenTelemetry OTLP gRPC log exporter is not available. Install " + "`opentelemetry-exporter-otlp` and `grpcio` (or `litellm[grpc]`)." + ) from exc + + return GRPCLogExporter(endpoint=config.endpoint, headers=parse_headers(config.headers)) + return ConsoleLogExporter() + + +def build_logger_provider( + config: OpenTelemetryV2Config, + log_exporter: LogExporter | None = None, +) -> SDKLoggerProvider: + """Build the :class:`LoggerProvider` GenAI events export through. + + ``log_exporter`` is an explicit override (tests inject an + ``InMemoryLogExporter``); otherwise the exporter is selected from the config's + exporter kind via :func:`build_log_exporter`. Console and in-memory exporters + get a Simple processor (synchronous export, which tests rely on), everything + else a Batch processor — the same split as span processing. + """ + exporter = log_exporter if log_exporter is not None else build_log_exporter(config) + provider = SDKLoggerProvider(resource=build_resource(config)) + use_simple = isinstance(exporter, (ConsoleLogExporter, InMemoryLogExporter)) + provider.add_log_record_processor( + SimpleLogRecordProcessor(exporter) if use_simple else BatchLogRecordProcessor(exporter) + ) + return provider + + +def resolve_logger_provider( + config: OpenTelemetryV2Config, + logger_provider: SDKLoggerProvider | None = None, +) -> SDKLoggerProvider | None: + """Resolve the :class:`LoggerProvider` GenAI events record through, or ``None`` + when the operator has opted out of the logs signal. + + Same resolution order as :func:`resolve_meter_provider`: an injected provider + wins (DI/tests); an operator-configured SDK global is reused so events ride + their pipeline; an explicit ``NoOpLoggerProvider`` global is an opt-out and + yields ``None``, so no event is ever built. Only the default placeholder + global makes V2 build a provider from the config and publish it as the global. + """ + if logger_provider is not None: + return logger_provider + + existing: LoggerProvider = _logs.get_logger_provider() + if isinstance(existing, SDKLoggerProvider): + return existing + if isinstance(existing, NoOpLoggerProvider): + return None + + provider = build_logger_provider(config) + _logs.set_logger_provider(provider) + return provider + + +def get_event_logger(provider: SDKLoggerProvider, name: str = "litellm") -> EventLogger: + return EventLoggerProvider(logger_provider=provider).get_event_logger(name, litellm_version) + + def build_meter_provider( config: OpenTelemetryV2Config, metric_reader: "MetricReader | None" = None, diff --git a/litellm/integrations/prometheus.py b/litellm/integrations/prometheus.py index 60fc021a6a8..41a4d026fe1 100644 --- a/litellm/integrations/prometheus.py +++ b/litellm/integrations/prometheus.py @@ -16,6 +16,7 @@ from typing import ( Dict, List, Literal, + Mapping, Optional, Sequence, Tuple, @@ -68,6 +69,15 @@ else: _DEFAULT_BUDGET_METRICS_PER_REQUEST_TIMEOUT = 5.0 +# Tiers a caller may name in a request, across the providers that accept the +# parameter: OpenAI ("auto", "default", "flex", "priority", "scale"), Bedrock and +# Groq (subsets of those), Anthropic ("auto", "standard_only") and Vertex, which +# maps "default" to "standard". Used to bound the caller-controlled fallback in +# ``get_service_tier_from_standard_logging_payload``. +KNOWN_REQUEST_SERVICE_TIERS = frozenset( + {"auto", "batch", "default", "flex", "priority", "scale", "standard", "standard_only"} +) + def _get_budget_metrics_per_request_timeout() -> float: raw = os.getenv("PROMETHEUS_BUDGET_METRICS_PER_REQUEST_TIMEOUT") @@ -239,6 +249,18 @@ class PrometheusLogger(CustomLogger): labelnames=self.get_labels_for_metric("litellm_output_audio_tokens_metric"), ) + self.litellm_video_duration_seconds_metric = self._counter_factory( + "litellm_video_duration_seconds_metric", + "Seconds of video generated, from usage.duration_seconds on video generation calls", + labelnames=self.get_labels_for_metric("litellm_video_duration_seconds_metric"), + ) + + self.litellm_images_generated_metric = self._counter_factory( + "litellm_images_generated_metric", + "Number of images generated, from the image generation response", + labelnames=self.get_labels_for_metric("litellm_images_generated_metric"), + ) + # Remaining Budget for Team self.litellm_remaining_team_budget_metric = self._gauge_factory( "litellm_remaining_team_budget_metric", @@ -1232,6 +1254,7 @@ class PrometheusLogger(CustomLogger): client_ip=standard_logging_payload["metadata"].get("requester_ip_address"), user_agent=standard_logging_payload["metadata"].get("user_agent"), stream=(str(standard_logging_payload.get("stream")) if litellm.prometheus_emit_stream_label else None), + service_tier=get_service_tier_from_standard_logging_payload(standard_logging_payload), ) if user_api_key is not None and isinstance(user_api_key, str) and user_api_key.startswith("sk-"): @@ -1336,6 +1359,12 @@ class PrometheusLogger(CustomLogger): label_context=label_context, ) + self._increment_media_generation_metrics( + standard_logging_payload=standard_logging_payload, + enum_values=enum_values, + label_context=label_context, + ) + # MCP tool call metrics self._increment_mcp_tool_call_metrics( standard_logging_payload=standard_logging_payload, @@ -1431,6 +1460,8 @@ class PrometheusLogger(CustomLogger): prompt_details = usage_object.get("prompt_tokens_details") or {} completion_details = usage_object.get("completion_tokens_details") or {} + cache_creation_detail_tokens = PrometheusLogger._resolve_cache_write_tokens(prompt_details) + detail_metrics: List[Tuple[Any, DEFINED_PROMETHEUS_METRICS, Any]] = [ ( self.litellm_input_cached_tokens_metric, @@ -1440,7 +1471,7 @@ class PrometheusLogger(CustomLogger): ( self.litellm_input_cache_creation_tokens_metric, "litellm_input_cache_creation_tokens_metric", - (prompt_details.get("cache_creation_tokens") if isinstance(prompt_details, dict) else None), + cache_creation_detail_tokens, ), ( self.litellm_input_audio_tokens_metric, @@ -1459,8 +1490,65 @@ class PrometheusLogger(CustomLogger): ), ] - for counter, metric_name, value in detail_metrics: - if not isinstance(value, (int, float)) or value <= 0: + PrometheusLogger._inc_sparse_usage_counters( + self, + detail_metrics, + enum_values=enum_values, + label_context=label_context, + ) + + def _increment_media_generation_metrics( + self, + standard_logging_payload: StandardLoggingPayload, + enum_values: UserAPIKeyLabelValues, + label_context: PrometheusLabelFactoryContext | None = None, + ) -> None: + """ + Increment video-seconds and images-generated counters from + ``standard_logging_payload["metadata"]["usage_object"]``. Video + providers report ``duration_seconds`` there; image generation calls + report ``output_image_count``. Both are sparse: only emitted when the + value is present and > 0, so token-only call types are unaffected. + """ + metadata = standard_logging_payload.get("metadata") or {} + usage_object = metadata.get("usage_object") if isinstance(metadata, dict) else None + if not isinstance(usage_object, dict): + return + + media_metrics: list[tuple[Any, DEFINED_PROMETHEUS_METRICS, Any]] = [ + ( + self.litellm_video_duration_seconds_metric, + "litellm_video_duration_seconds_metric", + usage_object.get("duration_seconds"), + ), + ( + self.litellm_images_generated_metric, + "litellm_images_generated_metric", + usage_object.get("output_image_count"), + ), + ] + + PrometheusLogger._inc_sparse_usage_counters( + self, + media_metrics, + enum_values=enum_values, + label_context=label_context, + ) + + def _inc_sparse_usage_counters( + self, + counters_with_values: list[tuple[Any, DEFINED_PROMETHEUS_METRICS, Any]], + enum_values: UserAPIKeyLabelValues, + label_context: PrometheusLabelFactoryContext | None = None, + ) -> None: + """ + Increment each ``(counter, metric_name, value)`` entry whose value is + a positive number. Non-numeric values (including booleans from + malformed provider usage dicts) and values <= 0 are skipped, keeping + scrape output sparse. + """ + for counter, metric_name, value in counters_with_values: + if isinstance(value, bool) or not isinstance(value, (int, float)) or value <= 0: continue PrometheusLogger._inc_labeled_counter( self, @@ -1522,27 +1610,12 @@ class PrometheusLogger(CustomLogger): ) # Provider prompt caching metrics are independent of LiteLLM cache_hit. - provider_cache_read_tokens = 0 - provider_cache_creation_tokens = 0 usage_obj = (standard_logging_payload.get("metadata", {}) or {}).get("usage_object") if isinstance(usage_obj, dict): - # Prefer explicit provider cache fields when available. - _read = usage_obj.get("cache_read_input_tokens") - _write = usage_obj.get("cache_creation_input_tokens") - - if isinstance(_read, int): - provider_cache_read_tokens = _read - if isinstance(_write, int): - provider_cache_creation_tokens = _write - - # Fallback to prompt_tokens_details.cached_tokens (common normalization point). - # Only fallback when the explicit field is genuinely absent (None). - if _read is None: - prompt_details = usage_obj.get("prompt_tokens_details") - if isinstance(prompt_details, dict): - cached_tokens = prompt_details.get("cached_tokens") - if isinstance(cached_tokens, int): - provider_cache_read_tokens = cached_tokens + ( + provider_cache_read_tokens, + provider_cache_creation_tokens, + ) = PrometheusLogger._resolve_provider_cache_tokens(usage_obj) if provider_cache_read_tokens > 0: PrometheusLogger._inc_labeled_counter( @@ -1564,6 +1637,40 @@ class PrometheusLogger(CustomLogger): amount=float(provider_cache_creation_tokens), ) + @staticmethod + def _resolve_provider_cache_tokens(usage_obj: Mapping[str, object]) -> tuple[int, int]: + # Prefer explicit provider cache fields when available. + _read = usage_obj.get("cache_read_input_tokens") + _write = usage_obj.get("cache_creation_input_tokens") + + provider_cache_read_tokens = _read if isinstance(_read, int) else 0 + provider_cache_creation_tokens = _write if isinstance(_write, int) else 0 + + # Fallback to prompt_tokens_details (common normalization point). + # Only fallback when the explicit field is genuinely absent (None). + prompt_details = usage_obj.get("prompt_tokens_details") + if _read is None and isinstance(prompt_details, dict): + cached_tokens = prompt_details.get("cached_tokens") + if isinstance(cached_tokens, int): + provider_cache_read_tokens = cached_tokens + + if _write is None: + write_tokens = PrometheusLogger._resolve_cache_write_tokens(prompt_details) + if write_tokens is not None: + provider_cache_creation_tokens = write_tokens + + return provider_cache_read_tokens, provider_cache_creation_tokens + + @staticmethod + def _resolve_cache_write_tokens(prompt_details: object) -> int | None: + if not isinstance(prompt_details, dict): + return None + for key in ("cache_write_tokens", "cache_creation_tokens"): + value = prompt_details.get(key) + if isinstance(value, int) and not isinstance(value, bool): + return value + return None + def _increment_mcp_tool_call_metrics( self, standard_logging_payload: StandardLoggingPayload, @@ -1618,6 +1725,14 @@ class PrometheusLogger(CustomLogger): user_id: Optional[str] = None, user_api_key_org_id: Optional[str] = None, ): + if ( + isinstance(self.litellm_remaining_team_budget_metric, NoOpMetric) + and isinstance(self.litellm_remaining_api_key_budget_metric, NoOpMetric) + and isinstance(self.litellm_remaining_user_budget_metric, NoOpMetric) + and isinstance(self.litellm_remaining_org_budget_metric, NoOpMetric) + ): + return + _metadata = litellm_params.get("metadata") or {} _team_spend = _metadata.get("user_api_key_team_spend", None) _team_max_budget = _metadata.get("user_api_key_team_max_budget", None) @@ -1708,6 +1823,35 @@ class PrometheusLogger(CustomLogger): amount=float(response_cost), ) + @staticmethod + def _get_remaining_from_v3_rate_limit_headers( + standard_logging_payload: StandardLoggingPayload | None, + rate_limit_type: Literal["requests", "tokens"], + ) -> int | None: + """ + Read the per-(key, model) remaining value emitted by the v3 rate + limiter (``parallel_request_limiter_v3.py``), which writes + ``x-ratelimit-model_per_key-remaining-{requests,tokens}`` into + ``standard_logging_object.hidden_params.additional_headers`` instead + of the ``litellm-key-remaining-*`` metadata keys the legacy limiter + sets. The header carries no model group; it always refers to this + request's model group, which is what the gauges are labeled with. + Values are written in-process as plain ints (never HTTP-serialized + strings), so anything else is rejected rather than coerced. + """ + if standard_logging_payload is None: + return None + hidden_params = standard_logging_payload.get("hidden_params") + if hidden_params is None: + return None + additional_headers = hidden_params.get("additional_headers") + if additional_headers is None: + return None + value = dict(additional_headers).get(f"x-ratelimit-model_per_key-remaining-{rate_limit_type}") + if isinstance(value, bool) or not isinstance(value, int): + return None + return value + def _set_virtual_key_rate_limit_metrics( self, user_api_key: Optional[str], @@ -1725,11 +1869,20 @@ class PrometheusLogger(CustomLogger): model_group = get_model_group_from_litellm_kwargs(kwargs) remaining_requests_variable_name = f"litellm-key-remaining-requests-{model_group}" remaining_tokens_variable_name = f"litellm-key-remaining-tokens-{model_group}" + standard_logging_payload: StandardLoggingPayload | None = kwargs.get("standard_logging_object") remaining_requests = metadata.get(remaining_requests_variable_name) + if remaining_requests is None: + remaining_requests = self._get_remaining_from_v3_rate_limit_headers( + standard_logging_payload=standard_logging_payload, rate_limit_type="requests" + ) if remaining_requests is None: remaining_requests = sys.maxsize remaining_tokens = metadata.get(remaining_tokens_variable_name) + if remaining_tokens is None: + remaining_tokens = self._get_remaining_from_v3_rate_limit_headers( + standard_logging_payload=standard_logging_payload, rate_limit_type="tokens" + ) if remaining_tokens is None: remaining_tokens = sys.maxsize @@ -3332,6 +3485,9 @@ class PrometheusLogger(CustomLogger): - looks up team info from db if not available in metadata - Set team budget metrics """ + if isinstance(self.litellm_remaining_team_budget_metric, NoOpMetric): + return + if user_api_team: team_object = await self._assemble_team_object( team_id=user_api_team, @@ -3453,6 +3609,9 @@ class PrometheusLogger(CustomLogger): - Fetches org info via cache (get_org_object) - Sets org budget metrics """ + if isinstance(self.litellm_remaining_org_budget_metric, NoOpMetric): + return + if not org_id: return @@ -3582,6 +3741,9 @@ class PrometheusLogger(CustomLogger): key_max_budget: Optional[float], key_spend: Optional[float], ): + if isinstance(self.litellm_remaining_api_key_budget_metric, NoOpMetric): + return + if user_api_key: user_api_key_dict = await self._assemble_key_object( user_api_key=user_api_key, @@ -3642,6 +3804,9 @@ class PrometheusLogger(CustomLogger): - looks up user info from db if not available in metadata - Set user budget metrics """ + if isinstance(self.litellm_remaining_user_budget_metric, NoOpMetric): + return + if user_id: user_object = await self._assemble_user_object( user_id=user_id, @@ -3943,6 +4108,44 @@ def get_custom_labels_from_metadata(metadata: dict) -> Dict[str, str]: return result +def get_service_tier_from_standard_logging_payload( + standard_logging_payload: StandardLoggingPayload, +) -> str | None: + """ + Resolve the service tier a request ran on, for the ``service_tier`` label. + + The tier the provider actually served wins over the tier the caller asked for, + so latency and spend stay segmentable when the request said ``auto`` and the + provider picked the concrete tier. Providers report the served tier either at + the top level of the response (OpenAI, Bedrock, Groq) or on the usage object + (Anthropic). + + Streaming responses carry no served tier, so the requested tier is the + fallback. That value is caller-controlled and survives param mapping even + where the provider then ignores it (Bedrock and Groq accept the request and + drop an unrecognized tier), so it is only labelled when it names a known + tier; otherwise one caller could mint a Prometheus series per string. Values + the provider itself reports are not caller-controlled and stay unrestricted, + so a tier a provider adds later is still labelled correctly. + """ + response = standard_logging_payload.get("response") + usage_object = standard_logging_payload.get("metadata", {}).get("usage_object") + + served_candidates: tuple[object, ...] = ( + response.get("service_tier") if isinstance(response, dict) else None, + usage_object.get("service_tier") if isinstance(usage_object, dict) else None, + ) + served_tier = next((tier for tier in served_candidates if isinstance(tier, str) and tier), None) + if served_tier is not None: + return served_tier + + model_parameters = standard_logging_payload.get("model_parameters") + requested_tier = model_parameters.get("service_tier") if isinstance(model_parameters, dict) else None + if isinstance(requested_tier, str) and requested_tier in KNOWN_REQUEST_SERVICE_TIERS: + return requested_tier + return None + + def _get_combined_custom_metadata_from_standard_logging_payload( standard_logging_payload: Optional[dict], ) -> Dict[str, Any]: diff --git a/litellm/integrations/rubrik.py b/litellm/integrations/rubrik.py index 2b54a411ec7..11809ee6361 100644 --- a/litellm/integrations/rubrik.py +++ b/litellm/integrations/rubrik.py @@ -7,7 +7,7 @@ import time import urllib.parse import uuid from collections import Counter -from typing import TYPE_CHECKING, Any, Literal, Optional +from typing import TYPE_CHECKING, Any, List, Literal, Optional import httpx from litellm._logging import verbose_logger @@ -52,6 +52,10 @@ class _MalformedToolBlockingResponseError(Exception): class RubrikLogger(CustomGuardrail, CustomBatchLogger): + @classmethod + def get_supported_event_hooks(cls) -> List[GuardrailEventHooks]: + return [GuardrailEventHooks.pre_call, GuardrailEventHooks.post_call] + def __init__( self, api_key: str | None = None, @@ -69,6 +73,7 @@ class RubrikLogger(CustomGuardrail, CustomBatchLogger): kwargs["event_hook"] = kwargs.get("event_hook") or GuardrailEventHooks.post_call if kwargs.get("default_on") is None: kwargs["default_on"] = True + kwargs.setdefault("supported_event_hooks", list(self.get_supported_event_hooks())) super().__init__( flush_lock=self.flush_lock, **kwargs, diff --git a/litellm/integrations/s3.py b/litellm/integrations/s3.py index 53a982cd2c4..e8252d87572 100644 --- a/litellm/integrations/s3.py +++ b/litellm/integrations/s3.py @@ -161,8 +161,13 @@ def get_s3_object_key( start_time: datetime, s3_file_name: str, ) -> str: + sanitized_s3_file_name = s3_file_name.replace("/", "_") s3_object_key = ( - (s3_path.rstrip("/") + "/" if s3_path else "") + prefix + start_time.strftime("%Y-%m-%d") + "/" + s3_file_name + (s3_path.rstrip("/") + "/" if s3_path else "") + + prefix + + start_time.strftime("%Y-%m-%d") + + "/" + + sanitized_s3_file_name ) # we need the s3 key to include the time, so we log cache hits too s3_object_key += ".json" return s3_object_key diff --git a/litellm/integrations/websearch_interception/handler.py b/litellm/integrations/websearch_interception/handler.py index 00c67e9f0fb..21d990e8e60 100644 --- a/litellm/integrations/websearch_interception/handler.py +++ b/litellm/integrations/websearch_interception/handler.py @@ -19,9 +19,11 @@ from litellm.integrations.custom_logger import CustomLogger from litellm.integrations.websearch_interception.tools import ( get_litellm_web_search_tool, get_litellm_web_search_tool_openai, + get_litellm_web_search_tool_responses, is_anthropic_native_web_search_tool, is_web_search_tool, is_web_search_tool_chat_completion, + is_web_search_tool_responses, ) from litellm.integrations.websearch_interception.transformation import ( WebSearchTransformation, @@ -32,11 +34,12 @@ from litellm.types.integrations.websearch_interception import ( ) from litellm.types.integrations.custom_logger import ( CHAT_COMPLETION_AGENTIC_SURFACE, + RESPONSES_AGENTIC_SURFACE, AgenticLoopPlan, AgenticLoopRequestPatch, ) from litellm.types.llms.openai import AllMessageValues -from litellm.types.utils import LlmProviders +from litellm.types.utils import CallTypes, LlmProviders from litellm.utils import ProviderConfigManager # Key used to flag, on per-request kwargs, that the originating client sent @@ -251,6 +254,9 @@ class WebSearchInterceptionLogger(CustomLogger): if not tools: return None + if call_type in (CallTypes.responses, CallTypes.aresponses): + return self._convert_responses_tools(kwargs=kwargs, tools=tools) + # Check if any tool is a web search tool (native or already LiteLLM standard) has_websearch = any(is_web_search_tool(t) for t in tools) @@ -291,6 +297,26 @@ class WebSearchInterceptionLogger(CustomLogger): return kwargs + def _convert_responses_tools(self, kwargs: dict[str, Any], tools: list[dict[str, Any]]) -> dict | None: + """Convert Responses API web search tools to the LiteLLM standard function tool.""" + if not any(is_web_search_tool_responses(tool) for tool in tools): + return None + + verbose_logger.debug("WebSearchInterception: Converting Responses web_search tools to LiteLLM standard") + + converted_tools = [ + get_litellm_web_search_tool_responses() if is_web_search_tool_responses(tool) else tool for tool in tools + ] + + converted_kwargs = {**kwargs, "tools": converted_tools} + + if kwargs.get("stream"): + verbose_logger.debug("WebSearchInterception: deployment hook converting stream=True to stream=False") + converted_kwargs["stream"] = False + converted_kwargs["_websearch_interception_converted_stream"] = True + + return converted_kwargs + @classmethod def from_config_yaml(cls, config: WebSearchInterceptionConfig) -> "WebSearchInterceptionLogger": """ @@ -461,6 +487,17 @@ class WebSearchInterceptionLogger(CustomLogger): kwargs=kwargs, ) + if kwargs.get("_agentic_loop_api_surface") == RESPONSES_AGENTIC_SURFACE: + return await self.async_should_run_responses_agentic_loop( + response=response, + model=model, + messages=messages, + tools=tools, + stream=stream, + custom_llm_provider=custom_llm_provider, + kwargs=kwargs, + ) + verbose_logger.debug(f"WebSearchInterception: Hook called! provider={custom_llm_provider}, stream={stream}") verbose_logger.debug(f"WebSearchInterception: Response type: {type(response)}") @@ -597,6 +634,54 @@ class WebSearchInterceptionLogger(CustomLogger): } return True, tools_dict + async def async_should_run_responses_agentic_loop( + self, + response: Any, + model: str, + messages: list[dict], + tools: list[dict] | None, + stream: bool, + custom_llm_provider: str, + kwargs: dict, + ) -> tuple[bool, dict]: + """Check if WebSearch interception is needed for the Responses API.""" + verbose_logger.debug( + f"WebSearchInterception: Responses hook called! provider={custom_llm_provider}, stream={stream}" + ) + + if self.enabled_providers is not None and custom_llm_provider not in self.enabled_providers: + verbose_logger.debug( + f"WebSearchInterception: Skipping provider {custom_llm_provider} (not in enabled list: {self.enabled_providers})" + ) + return False, {} + + has_websearch_tool = any(is_web_search_tool_responses(t) for t in (tools or [])) + if not has_websearch_tool: + verbose_logger.debug("WebSearchInterception: No litellm_web_search tool in responses request") + return False, {} + + should_intercept, tool_calls = WebSearchTransformation.transform_request( + response=response, + stream=stream, + response_format="responses", + ) + + if not should_intercept: + verbose_logger.debug("WebSearchInterception: No WebSearch function_call detected in responses output") + return False, {} + + verbose_logger.debug( + f"WebSearchInterception: Detected {len(tool_calls)} WebSearch function_call(s), executing agentic loop" + ) + + tools_dict = { + "tool_calls": tool_calls, + "tool_type": "websearch", + "provider": custom_llm_provider, + "response_format": "responses", + } + return True, tools_dict + async def async_run_agentic_loop( self, tools: Dict, @@ -655,6 +740,18 @@ class WebSearchInterceptionLogger(CustomLogger): kwargs=kwargs, ) + if kwargs.get("_agentic_loop_api_surface") == RESPONSES_AGENTIC_SURFACE: + return await self.async_build_responses_agentic_loop_plan( + tools=tools, + model=model, + messages=messages, + response=response, + optional_params=anthropic_messages_optional_request_params, + logging_obj=logging_obj, + stream=stream, + kwargs=kwargs, + ) + tool_calls = tools["tool_calls"] thinking_blocks = tools.get("thinking_blocks", []) request_patch, structured_results = await self._build_anthropic_request_patch( @@ -809,6 +906,133 @@ class WebSearchInterceptionLogger(CustomLogger): metadata={"tool_type": "websearch", "response_format": response_format}, ) + async def async_build_responses_agentic_loop_plan( + self, + tools: dict, + model: str, + messages: list[dict], + response: Any, + optional_params: dict, + logging_obj: Any, + stream: bool, + kwargs: dict, + ) -> AgenticLoopPlan: + tool_calls = tools["tool_calls"] + request_patch = await self._build_responses_request_patch( + model=model, + messages=messages, + tool_calls=tool_calls, + optional_params=optional_params, + kwargs=kwargs, + ) + return AgenticLoopPlan( + run_agentic_loop=True, + request_patch=request_patch, + metadata={"tool_type": "websearch", "response_format": "responses"}, + ) + + async def _build_responses_request_patch( + self, + model: str, + messages: Union[str, list[dict]], + tool_calls: list[dict], + optional_params: dict, + kwargs: dict, + ) -> AgenticLoopRequestPatch: + """Execute litellm.asearch() and build a Responses API rerun patch.""" + search_tasks = [ + ( + self._execute_search(tool_call["input"]["query"], kwargs=kwargs) + if isinstance(tool_call.get("input"), dict) and tool_call["input"].get("query") + else self._create_empty_search_result() + ) + for tool_call in tool_calls + ] + + verbose_logger.debug(f"WebSearchInterception: Executing {len(search_tasks)} responses search(es) in parallel") + search_results = await asyncio.gather(*search_tasks, return_exceptions=True) + + search_texts = [self._extract_search_text(result) for result in search_results] + + followup_items = [ + item + for tool_call, search_text in zip(tool_calls, search_texts) + for item in ( + { + "type": "function_call", + "call_id": tool_call.get("call_id"), + "name": LITELLM_WEB_SEARCH_TOOL_NAME, + "arguments": tool_call.get("arguments", ""), + }, + { + "type": "function_call_output", + "call_id": tool_call.get("call_id"), + "output": search_text, + }, + ) + ] + + input_list = self._normalize_responses_input(messages) + followup_items + + tools_param = optional_params.get("tools") + optional_params_clean = { + k: v + for k, v in optional_params.items() + if k not in {"tools", "tool_choice", "stream", "model_alias_map", "stream_response", "custom_prompt_dict"} + } + + kwargs_for_followup = { + k: v + for k, v in kwargs.items() + if not k.startswith("_websearch_interception") + and k + not in { + "_agentic_loop_api_surface", + "litellm_logging_obj", + "acompletion", + "custom_llm_provider", + "model_alias_map", + } + } + + full_model_name = model + if "/" not in model and isinstance(kwargs.get("custom_llm_provider"), str): + full_model_name = f"{kwargs['custom_llm_provider']}/{model}" + + verbose_logger.debug( + "WebSearchInterception: Built responses request patch model=%s input_items=%d searches=%d", + full_model_name, + len(input_list), + len(search_texts), + ) + + return AgenticLoopRequestPatch( + model=full_model_name, + messages=input_list, + tools=tools_param if isinstance(tools_param, list) else None, + optional_params=optional_params_clean, + kwargs=kwargs_for_followup, + ) + + @staticmethod + def _normalize_responses_input(messages: Union[str, list[dict]]) -> list[dict]: + if isinstance(messages, str): + return [{"role": "user", "content": messages}] + if isinstance(messages, list): + return list(messages) + return [] + + @staticmethod + def _extract_search_text(result: Any) -> str: + if isinstance(result, Exception): + verbose_logger.error(f"WebSearchInterception: Responses search failed with error: {str(result)}") + return f"Search failed: {str(result)}" + if isinstance(result, tuple) and len(result) == 2: + text_value, _ = result + return text_value if isinstance(text_value, str) else str(text_value) + verbose_logger.debug(f"WebSearchInterception: Unexpected search result type {type(result)}") + return str(result) + @staticmethod def _resolve_max_tokens( optional_params: Dict, diff --git a/litellm/integrations/websearch_interception/tools.py b/litellm/integrations/websearch_interception/tools.py index b29372af9ed..14c8aea0908 100644 --- a/litellm/integrations/websearch_interception/tools.py +++ b/litellm/integrations/websearch_interception/tools.py @@ -82,6 +82,75 @@ def get_litellm_web_search_tool_openai() -> Dict[str, Any]: } +def get_litellm_web_search_tool_responses() -> dict[str, Any]: + """ + Get the standard LiteLLM web search tool definition in Responses API format. + + Used by async_pre_call_deployment_hook on the Responses API path, where a + function tool is a flat object (``type: "function"`` with a top-level + ``name`` and ``parameters``) rather than the nested ``function`` wrapper + used by Chat Completions. + + Returns: + Dict containing the Responses-style function tool definition. + """ + return { + "type": "function", + "name": LITELLM_WEB_SEARCH_TOOL_NAME, + "description": ( + "Search the web for information. Use this when you need current " + "information or answers to questions that require up-to-date data." + ), + "parameters": { + "type": "object", + "properties": { + "query": { + "type": "string", + "description": "The search query to execute", + } + }, + "required": ["query"], + }, + } + + +def is_web_search_tool_responses(tool: dict[str, Any]) -> bool: + """ + Check if a tool is a web search tool for the Responses API. + + Detects: + - OpenAI native Responses web search tools, whose ``type`` is one of + ``web_search``, ``web_search_2025_08_26``, ``web_search_preview``, + ``web_search_preview_2025_03_11`` (matched by the ``web_search`` prefix) + - The LiteLLM standard function tool in Responses shape: + ``{"type": "function", "name": "litellm_web_search"}`` + + Args: + tool: Tool dictionary to check + + Returns: + True if tool is a Responses-API web search tool + + Example: + >>> is_web_search_tool_responses({"type": "web_search"}) + True + >>> is_web_search_tool_responses({"type": "web_search_preview"}) + True + >>> is_web_search_tool_responses({"type": "function", "name": "litellm_web_search"}) + True + >>> is_web_search_tool_responses({"type": "function", "name": "get_weather"}) + False + """ + tool_type = tool.get("type", "") + if not isinstance(tool_type, str): + return False + + if tool_type == "function": + return tool.get("name") == LITELLM_WEB_SEARCH_TOOL_NAME + + return tool_type == "web_search" or tool_type.startswith("web_search_") + + def is_web_search_tool_chat_completion(tool: Dict[str, Any]) -> bool: """ Check if a tool is a web search tool for Chat Completions API (strict check). diff --git a/litellm/integrations/websearch_interception/transformation.py b/litellm/integrations/websearch_interception/transformation.py index 7bbcd7ebff6..282d75d3d4d 100644 --- a/litellm/integrations/websearch_interception/transformation.py +++ b/litellm/integrations/websearch_interception/transformation.py @@ -59,9 +59,73 @@ class WebSearchTransformation: # Parse non-streaming response based on format if response_format == "openai": return WebSearchTransformation._detect_from_openai_response(response) + elif response_format == "responses": + return WebSearchTransformation._detect_from_responses_response(response) else: return WebSearchTransformation._detect_from_non_streaming_response(response) + @staticmethod + def _detect_from_responses_response( + response: Any, + ) -> tuple[bool, list[dict]]: + """Parse a Responses API response for ``litellm_web_search`` function calls. + + After pre-request conversion the native web search tool is replaced by a + ``litellm_web_search`` function tool, so the model emits ``function_call`` + items in ``response.output`` instead of a native ``web_search_call``. + """ + if isinstance(response, dict): + output = response.get("output", []) + else: + output = getattr(response, "output", None) or [] + + if not isinstance(output, list): + return False, [] + + tool_calls: list[dict] = [] + for item in output: + if isinstance(item, dict): + item_type = item.get("type") + item_name = item.get("name") + call_id = item.get("call_id") + arguments = item.get("arguments", "") + else: + item_type = getattr(item, "type", None) + item_name = getattr(item, "name", None) + call_id = getattr(item, "call_id", None) + arguments = getattr(item, "arguments", "") + + if item_type != "function_call" or item_name != LITELLM_WEB_SEARCH_TOOL_NAME: + continue + + if isinstance(arguments, str): + try: + parsed_input = json.loads(arguments) if arguments else {} + except json.JSONDecodeError: + verbose_logger.warning( + f"WebSearchInterception: Failed to parse function_call arguments: {arguments}" + ) + parsed_input = {} + elif isinstance(arguments, dict): + parsed_input = arguments + else: + parsed_input = {} + + arguments_str = arguments if isinstance(arguments, str) else json.dumps(parsed_input) + tool_calls.append( + { + "id": call_id, + "call_id": call_id, + "type": "function_call", + "name": item_name, + "arguments": arguments_str, + "input": parsed_input, + } + ) + verbose_logger.debug(f"WebSearchInterception: Found {item_name} function_call with call_id={call_id}") + + return len(tool_calls) > 0, tool_calls + @staticmethod def _detect_from_non_streaming_response( response: Any, diff --git a/litellm/litellm_core_utils/cli_token_utils.py b/litellm/litellm_core_utils/cli_token_utils.py index eb01359cdc0..e730f60bc3b 100644 --- a/litellm/litellm_core_utils/cli_token_utils.py +++ b/litellm/litellm_core_utils/cli_token_utils.py @@ -7,6 +7,7 @@ This module has no dependencies on proxy code and can be safely imported at the import json import os +import time from pathlib import Path from typing import Optional @@ -68,3 +69,17 @@ def get_litellm_gateway_api_key( if stored_url != expected_base_url.rstrip("/"): return None return token_data["key"] + + +def is_cli_token_fresh(token_data: dict, buffer_hours: float = 0.1) -> bool: + """Check whether a cached CLI token (as stored in token.json) is still + within its expiration window. Used by `lite auth print-token` to fail + fast, without a network round trip, once the cached token is past + `LITELLM_CLI_JWT_EXPIRATION_HOURS`.""" + from litellm.constants import CLI_JWT_EXPIRATION_HOURS + + timestamp = token_data.get("timestamp") + if not isinstance(timestamp, (int, float)): + return False + age_hours = (time.time() - timestamp) / 3600 + return age_hours < (CLI_JWT_EXPIRATION_HOURS - buffer_hours) diff --git a/litellm/litellm_core_utils/core_helpers.py b/litellm/litellm_core_utils/core_helpers.py index 002a46771e3..cecc35ee1c1 100644 --- a/litellm/litellm_core_utils/core_helpers.py +++ b/litellm/litellm_core_utils/core_helpers.py @@ -57,6 +57,35 @@ def safe_divide( return numerator / denominator +def coerce_token_limit(value: object) -> int | None: + """ + Coerce a max_input_tokens / max_output_tokens value to an int, treating a + malformed value as absent. + + A deployment's model_info is registered into litellm.model_cost verbatim, so a + config value like "128,000" or "" reaches the /v1/models listing uncoerced from + both the router index and the cost map. Returning None omits that one limit + instead of failing the whole listing. + + Args: + value: The raw configured or cost-map value + + Returns: + The value as an int, or None if it is missing or not a usable number. + Bools are rejected because True/False is never a meaningful token limit. + """ + if isinstance(value, bool): + return None + if isinstance(value, int): + return value + if isinstance(value, (str, float)): + try: + return int(value) + except (TypeError, ValueError, OverflowError): + return None + return None + + _FINISH_REASON_MAP: dict[str, OpenAIChatCompletionFinishReason] = { # Anthropic "stop_sequence": "stop", @@ -166,6 +195,25 @@ def get_metadata_variable_name_from_kwargs( return "litellm_metadata" if "litellm_metadata" in kwargs else "metadata" +def get_or_create_metadata_bucket( + request_data: dict, +) -> tuple[Literal["metadata", "litellm_metadata"], dict]: + """ + Return the proxy-internal metadata bucket for this request, creating it if absent. + + Batch/file routes store proxy state in ``litellm_metadata`` so the OpenAI + ``metadata`` field can remain provider-safe (string values only). Every writer and + reader of proxy-internal metadata resolves the bucket through here, so a caller that + supplies its own ``metadata`` field cannot split them across two dicts. + """ + metadata_key = get_metadata_variable_name_from_kwargs(request_data) + metadata_bucket = request_data.get(metadata_key) + if not isinstance(metadata_bucket, dict): + metadata_bucket = {} + request_data[metadata_key] = metadata_bucket + return metadata_key, metadata_bucket + + def get_litellm_metadata_from_kwargs(kwargs: dict): """ Helper to get litellm metadata from all litellm request kwargs diff --git a/litellm/litellm_core_utils/dd_tracing.py b/litellm/litellm_core_utils/dd_tracing.py index ae4f46c38bd..3a1bd72e1a5 100644 --- a/litellm/litellm_core_utils/dd_tracing.py +++ b/litellm/litellm_core_utils/dd_tracing.py @@ -10,7 +10,7 @@ from typing import TYPE_CHECKING, Any, Optional, Union from litellm.secret_managers.main import get_secret_bool if TYPE_CHECKING: - from ddtrace.tracer import Tracer as DD_TRACER + from ddtrace.trace import Tracer as DD_TRACER else: DD_TRACER = Any diff --git a/litellm/litellm_core_utils/duration_parser.py b/litellm/litellm_core_utils/duration_parser.py index 438ff5600ba..b78a314dc45 100644 --- a/litellm/litellm_core_utils/duration_parser.py +++ b/litellm/litellm_core_utils/duration_parser.py @@ -7,11 +7,24 @@ duration_in_seconds is used in diff parts of the code base, example """ import re -import time -from datetime import datetime, timedelta, timezone, tzinfo -from typing import Optional, Tuple +import time as time_module +from datetime import datetime, time, timedelta, timezone, tzinfo +from typing import Final, Optional, Tuple from zoneinfo import ZoneInfo +from litellm._logging import verbose_logger + +_BUDGET_DURATION_WORD_ALIASES: Final[dict[str, str]] = { + "hourly": "1h", + "daily": "24h", + "weekly": "7d", + "monthly": "30d", +} + + +def _normalize_duration(duration: str) -> str: + return _BUDGET_DURATION_WORD_ALIASES.get(duration.strip().lower(), duration) + def _extract_from_regex(duration: str) -> Tuple[int, str]: match = re.match(r"(\d+)(mo|[smhdw]?)", duration) @@ -48,7 +61,7 @@ def duration_in_seconds(duration: str) -> int: Returns time in seconds till when budget needs to be reset """ - value, unit = _extract_from_regex(duration=duration) + value, unit = _extract_from_regex(duration=_normalize_duration(duration)) if unit == "s": return value @@ -61,7 +74,7 @@ def duration_in_seconds(duration: str) -> int: elif unit == "w": return value * 604800 elif unit == "mo": - now = time.time() + now = time_module.time() current_time = datetime.fromtimestamp(now) # Calculate target month and year, handling overflow past December @@ -94,12 +107,17 @@ def duration_in_seconds(duration: str) -> int: raise ValueError(f"Unsupported duration unit, passed duration: {duration}") -def get_next_standardized_reset_time(duration: str, current_time: datetime, timezone_str: str = "UTC") -> datetime: +def get_next_standardized_reset_time( + duration: str, + current_time: datetime, + timezone_str: str = "UTC", + reset_time_of_day: time = time(0, 0), +) -> datetime: """ Get the next standardized reset time based on the duration. All durations will reset at predictable intervals, aligned from the current time: - - Nd: If N=1, reset at next midnight; if N>1, reset every N days from now + - Nd: If N=1, reset at the next `reset_time_of_day`; if N>1, reset every N days from now - Nh: Every N hours, aligned to hour boundaries (e.g., 1:00, 2:00) - Nm: Every N minutes, aligned to minute boundaries (e.g., 1:05, 1:10) - Ns: Every N seconds, aligned to second boundaries @@ -108,17 +126,24 @@ def get_next_standardized_reset_time(duration: str, current_time: datetime, time - duration: Duration string (e.g. "30s", "30m", "30h", "30d") - current_time: Current datetime - timezone_str: Timezone string (e.g. "UTC", "US/Eastern", "Asia/Kolkata") + - reset_time_of_day: Wall-clock time the reset lands on for day/week/month + durations (defaults to midnight). Ignored for sub-day durations, where a + time-of-day is meaningless. Returns: - Next reset time at a standardized interval in the specified timezone """ # Set up timezone and normalize current time - current_time, tz = _setup_timezone(current_time, timezone_str) + current_time, _ = _setup_timezone(current_time, timezone_str) # Parse duration - value, unit = _parse_duration(duration) + value, unit = _parse_duration(_normalize_duration(duration)) if value is None: - # Fall back to default if format is invalid + verbose_logger.warning( + "Unrecognized budget_duration %r; falling back to a next-midnight reset. " + "Use the format (e.g. '1h', '7d', '30d', '1mo').", + duration, + ) return current_time.replace(hour=0, minute=0, second=0, microsecond=0) + timedelta(days=1) # Midnight of the current day in the specified timezone @@ -126,9 +151,9 @@ def get_next_standardized_reset_time(duration: str, current_time: datetime, time # Handle different time units if unit == "d": - return _handle_day_reset(current_time, base_midnight, value, tz) + return _handle_day_reset(current_time, base_midnight, value, reset_time_of_day) elif unit == "w": - return _handle_day_reset(current_time, base_midnight, value * 7, tz) + return _handle_day_reset(current_time, base_midnight, value * 7, reset_time_of_day) elif unit == "h": return _handle_hour_reset(current_time, base_midnight, value) elif unit == "m": @@ -136,7 +161,7 @@ def get_next_standardized_reset_time(duration: str, current_time: datetime, time elif unit == "s": return _handle_second_reset(current_time, base_midnight, value) elif unit == "mo": - return _handle_month_reset(current_time, base_midnight, value) + return _handle_month_reset(current_time, base_midnight, value, reset_time_of_day) else: # Unrecognized unit, default to next midnight return base_midnight + timedelta(days=1) @@ -175,46 +200,58 @@ def _parse_duration(duration: str) -> Tuple[Optional[int], Optional[str]]: return int(value), unit -def _handle_day_reset(current_time: datetime, base_midnight: datetime, value: int, tz: tzinfo) -> datetime: +def _apply_time_of_day(dt: datetime, reset_time_of_day: time) -> datetime: + """Set the wall-clock time of `dt` to `reset_time_of_day`, keeping its date and tzinfo.""" + return dt.replace( + hour=reset_time_of_day.hour, + minute=reset_time_of_day.minute, + second=reset_time_of_day.second, + microsecond=reset_time_of_day.microsecond, + ) + + +def _next_occurrence( + boundary_midnight: datetime, + reset_time_of_day: time, + current_time: datetime, + period: timedelta, +) -> datetime: + """Place the reset at `reset_time_of_day` on the boundary day, rolling forward one + `period` if that instant has already passed (or is exactly now).""" + candidate = _apply_time_of_day(boundary_midnight, reset_time_of_day) + if candidate <= current_time: + return candidate + period + return candidate + + +def _first_of_next_month(first_of_month: datetime) -> datetime: + """Given the 1st of some month, return the 1st of the following month.""" + if first_of_month.month == 12: + return first_of_month.replace(year=first_of_month.year + 1, month=1) + return first_of_month.replace(month=first_of_month.month + 1) + + +def _handle_day_reset( + current_time: datetime, + base_midnight: datetime, + value: int, + reset_time_of_day: time, +) -> datetime: """Handle day-based reset times.""" # Handle zero value - immediate expiration if value == 0: return current_time - if value == 1: # Daily reset at midnight - return base_midnight + timedelta(days=1) - elif value == 7: # Weekly reset on Monday at midnight + if value == 1: # Daily reset at the configured time of day + return _next_occurrence(base_midnight, reset_time_of_day, current_time, timedelta(days=1)) + elif value == 7: # Weekly reset on Monday at the configured time of day days_until_monday = (7 - current_time.weekday()) % 7 - if days_until_monday == 0: # If today is Monday - days_until_monday = 7 - return base_midnight + timedelta(days=days_until_monday) - elif value == 30: # Monthly reset on 1st at midnight - # Get 1st of next month at midnight - if current_time.month == 12: - next_reset = datetime( - year=current_time.year + 1, - month=1, - day=1, - hour=0, - minute=0, - second=0, - microsecond=0, - tzinfo=tz, - ) - else: - next_reset = datetime( - year=current_time.year, - month=current_time.month + 1, - day=1, - hour=0, - minute=0, - second=0, - microsecond=0, - tzinfo=tz, - ) - return next_reset - else: # Custom day value - next interval is value days from current - return current_time.replace(hour=0, minute=0, second=0, microsecond=0) + timedelta(days=value) + upcoming_monday = base_midnight + timedelta(days=days_until_monday) + return _next_occurrence(upcoming_monday, reset_time_of_day, current_time, timedelta(days=7)) + elif value == 30: # Monthly reset on 1st at the configured time of day + return _handle_month_reset(current_time, base_midnight, 1, reset_time_of_day) + else: # Custom day value - next interval is value days from the start of today + return _apply_time_of_day(base_midnight + timedelta(days=value), reset_time_of_day) def _handle_hour_reset(current_time: datetime, base_midnight: datetime, value: int) -> datetime: @@ -316,36 +353,30 @@ def _handle_second_reset(current_time: datetime, base_midnight: datetime, value: return current_time.replace(hour=next_hour, minute=next_minute, second=next_second, microsecond=0) -def _handle_month_reset(current_time: datetime, base_midnight: datetime, value: int) -> datetime: +def _handle_month_reset( + current_time: datetime, + base_midnight: datetime, + value: int, + reset_time_of_day: time, +) -> datetime: """ - Handle monthly reset times. For monthly resets, we always reset at the start of the next month. + Handle monthly reset times. Resets land on the 1st at `reset_time_of_day`; if the + 1st of the current month at that time has already passed, roll to the 1st of next month. Args: current_time: Current datetime base_midnight: Midnight of current day value: Number of months (currently only supports 1 month resets) + reset_time_of_day: Wall-clock time the reset lands on Returns: - datetime: First day of next month at midnight + datetime: First day of the next reset month at `reset_time_of_day` """ if value != 1: raise ValueError("Monthly resets currently only support 1 month intervals") - # Get the first day of next month - if current_time.month == 12: - next_month = 1 - next_year = current_time.year + 1 - else: - next_month = current_time.month + 1 - next_year = current_time.year - - return datetime( - year=next_year, - month=next_month, - day=1, - hour=0, - minute=0, - second=0, - microsecond=0, - tzinfo=current_time.tzinfo, - ) + first_of_this_month = base_midnight.replace(day=1) + candidate = _apply_time_of_day(first_of_this_month, reset_time_of_day) + if candidate <= current_time: + return _apply_time_of_day(_first_of_next_month(first_of_this_month), reset_time_of_day) + return candidate diff --git a/litellm/litellm_core_utils/env_utils.py b/litellm/litellm_core_utils/env_utils.py index 34c65275331..3a64f44fb25 100644 --- a/litellm/litellm_core_utils/env_utils.py +++ b/litellm/litellm_core_utils/env_utils.py @@ -19,3 +19,19 @@ def get_env_int(env_var: str, default: int) -> int: return int(raw) except (ValueError, TypeError): return default + + +def get_env_int_or_none(env_var: str) -> int | None: + """Parse an environment variable as an integer, returning None when it is unset or unusable. + + Use this instead of `get_env_int` when callers must distinguish "explicitly configured" + from "left at the default", for example when an override should take precedence over a + value resolved from somewhere else. + """ + raw = os.getenv(env_var) + if raw is None: + return None + try: + return int(raw.strip()) + except (ValueError, TypeError): + return None diff --git a/litellm/litellm_core_utils/exception_mapping_utils.py b/litellm/litellm_core_utils/exception_mapping_utils.py index 9dc202c4717..fdab3d5b9d4 100644 --- a/litellm/litellm_core_utils/exception_mapping_utils.py +++ b/litellm/litellm_core_utils/exception_mapping_utils.py @@ -95,6 +95,9 @@ class ExceptionCheckers: if "current length is" in _error_str_lowercase and "while limit is" in _error_str_lowercase: return True + if "maximum input length is" in _error_str_lowercase and "tokens" in _error_str_lowercase: + return True + return False @staticmethod diff --git a/litellm/litellm_core_utils/fallback_generalizations.py b/litellm/litellm_core_utils/fallback_generalizations.py index abc171f900a..410bb9623fe 100644 --- a/litellm/litellm_core_utils/fallback_generalizations.py +++ b/litellm/litellm_core_utils/fallback_generalizations.py @@ -3,52 +3,69 @@ Declarative fallback generalizations for unknown / newly-released models. The ``fallback_generalizations`` block in ``model_prices_and_context_window.json`` holds an ordered list of rules. Each rule pairs a single case-insensitive regex -with the metadata to apply when a model name has no exact entry in the cost map. -The metadata is a partial cost-map entry: ``litellm_provider`` drives provider -routing, and the remaining fields (``mode``, ``supports_*``, context window, -pricing, ...) drive ``get_model_info`` / ``supports_*``. +with a ``model_info`` dict, and the structure of ``model_info`` decides which of +two kinds the rule is. -Precedence: rules are evaluated in file order and the first match wins. They are -consulted only after exact and case-insensitive lookups miss, so an exact entry -always takes precedence over a rule. +A ROUTING rule carries exactly one ``model_info`` key, ``litellm_provider``. It is +consumed only by ``get_llm_provider`` bare-id inference: the first routing rule +whose regex matches decides the provider. Routing rules never contribute to model +info. + +A CAPABILITY rule carries any ``model_info`` keys except ``litellm_provider`` +(``mode``, ``supports_*``, context window, pricing, ...). It is consumed by +``get_model_info`` fallback resolution: the ``model_info`` of ALL capability rules +whose regex matches is unioned in file order, with later rules overriding earlier +ones on key conflicts, and the caller backfills ``litellm_provider`` with the +provider it requested. If no capability rule matches, model-info resolution misses +as if no rules existed. + +LEGACY-SCHEMA SHIM (temporary, until the new-schema JSON reaches main): released +proxies fetch this JSON remotely from main, whose block still ships the old schema +where a rule mixes ``litellm_provider`` with capability keys and may inherit a +parent's ``model_info`` via ``extends``. Such a legacy rule is tolerated rather +than skipped: ``extends`` is resolved once at install time (single level, against +raw parents), and the resolved rule acts as BOTH kinds, a routing rule (its +``litellm_provider`` participates in first-hit inference) and a capability rule +(its full ``model_info``, provider included, participates in the union). New-schema +rules never mix the two and never use ``extends``. A rule whose +``litellm_provider`` is not a string is invalid and is warned about and skipped +(a warning rather than a crash, for the same remote-fetch reason). + +Rules are only consulted after exact and case-insensitive lookups miss, so an +exact cost-map entry always takes precedence over any rule. Patterns are matched case-insensitively with ``re.search`` and are not implicitly -anchored: a rule must include ``^`` and ``$`` (as the shipped rules do) to bind to -the whole model name, otherwise it matches as a substring. Keeping anchoring in the -regex makes the rule the single, self-contained source of truth for what it matches. - -A rule may set ``extends`` to the ``name`` of another rule to inherit that rule's -``model_info``; the rule's own ``model_info`` overrides the inherited keys, so a -narrow rule (for example a version-gated capability flag) carries only its delta -instead of duplicating the parent's pricing block. Inheritance is resolved once, -at install time, against each rule's raw (unresolved) ``model_info``; it is a -single level (a parent that itself extends is not chained). +anchored: a rule must include ``^`` and ``$`` to bind to the whole model name, +otherwise it matches as a substring. Keeping anchoring in the regex makes the rule +the single, self-contained source of truth for what it matches. Any other keys on a rule (for example a free-text ``description`` documenting what the regex matches) are ignored by the engine and exist only for the reader. -The compiled-regex list is built once and cached. ``match_fallback_generalization`` -is O(number of rules); callers must only invoke it on a cache miss. +Rules are compiled and classified once, at install time. The match functions are +O(number of rules); callers must only invoke them on a cache miss. """ import re -from typing import Optional +from dataclasses import dataclass +from typing import Optional, Union from litellm._logging import verbose_logger NAME_FIELD = "name" PATTERN_FIELD = "pattern" MODEL_INFO_FIELD = "model_info" -EXTENDS_FIELD = "extends" +PROVIDER_KEY = "litellm_provider" +LEGACY_EXTENDS_FIELD = "extends" -def _resolve_extends(rules: list) -> list: - """Expand ``extends`` inheritance so each rule's ``model_info`` is self-contained. +def _resolve_legacy_extends(rules: list) -> list: + """Expand legacy ``extends`` inheritance so each rule's ``model_info`` is self-contained. - A rule with ``extends: `` is rewritten with ``model_info`` set to the parent's - ``model_info`` overlaid by its own. Resolution is single-level and uses each rule's - raw ``model_info`` as the parent source. Non-dict rules and dangling parents are - passed through unchanged. + Compatibility shim for the old remote schema: single level, resolved against each + parent's raw ``model_info``, with the child's own keys winning on conflict. Non-dict + rules and dangling parents pass through unchanged; new-schema rules carry no + ``extends`` and are untouched. """ base_by_name = { rule[NAME_FIELD]: rule[MODEL_INFO_FIELD] @@ -58,84 +75,138 @@ def _resolve_extends(rules: list) -> list: and isinstance(rule.get(MODEL_INFO_FIELD), dict) } - def resolved(rule: dict) -> dict: - parent_name = rule.get(EXTENDS_FIELD) + def resolved(rule: object) -> object: + if not isinstance(rule, dict): + return rule + parent_name = rule.get(LEGACY_EXTENDS_FIELD) own_info = rule.get(MODEL_INFO_FIELD) parent_info = base_by_name.get(parent_name) if isinstance(parent_name, str) else None if parent_info is None or not isinstance(own_info, dict): return rule return {**rule, MODEL_INFO_FIELD: {**parent_info, **own_info}} - return [resolved(rule) if isinstance(rule, dict) else rule for rule in rules] + return [resolved(rule) for rule in rules] + + +@dataclass(frozen=True, slots=True) +class _RoutingRule: + pattern: re.Pattern + provider: str + + +@dataclass(frozen=True, slots=True) +class _CapabilityRule: + pattern: re.Pattern + model_info: dict + + +_CompiledRule = Union[_RoutingRule, _CapabilityRule] + + +def _compile_rule(rule: object) -> tuple[_CompiledRule, ...]: + if not isinstance(rule, dict): + return () + pattern = rule.get(PATTERN_FIELD) + model_info = rule.get(MODEL_INFO_FIELD) + if not isinstance(pattern, str) or not isinstance(model_info, dict): + verbose_logger.warning( + "LiteLLM: skipping malformed fallback generalization rule %s (needs string '%s' and dict '%s').", + rule.get(NAME_FIELD, pattern), + PATTERN_FIELD, + MODEL_INFO_FIELD, + ) + return () + try: + compiled = re.compile(pattern, re.IGNORECASE) + except re.error as e: + verbose_logger.warning( + "LiteLLM: skipping fallback generalization rule with invalid regex %r: %s", + pattern, + e, + ) + return () + if PROVIDER_KEY not in model_info: + return (_CapabilityRule(pattern=compiled, model_info=model_info),) + provider = model_info[PROVIDER_KEY] + if not isinstance(provider, str): + verbose_logger.warning( + "LiteLLM: skipping invalid fallback generalization rule %s: '%s' in '%s' must be a string.", + rule.get(NAME_FIELD, pattern), + PROVIDER_KEY, + MODEL_INFO_FIELD, + ) + return () + if len(model_info) == 1: + return (_RoutingRule(pattern=compiled, provider=provider),) + return ( + _RoutingRule(pattern=compiled, provider=provider), + _CapabilityRule(pattern=compiled, model_info=model_info), + ) class _FallbackGeneralizations: - """Holds the active rule list and its lazily-compiled regex cache.""" + """Holds the raw rule list and its install-time-compiled routing and capability rules.""" def __init__(self) -> None: - self.rules: list[dict] = [] - self._compiled: Optional[list[tuple[re.Pattern, dict]]] = None + self.rules: list = [] + self.routing_rules: tuple = () + self.capability_rules: tuple = () - def set_rules(self, rules: Optional[list[dict]]) -> None: - self.rules = rules if isinstance(rules, list) else [] - self._compiled = None + def set_rules(self, rules: Optional[list]) -> None: + installed = rules if isinstance(rules, list) else [] + compiled = tuple(kind for rule in _resolve_legacy_extends(installed) for kind in _compile_rule(rule)) + self.rules = installed + self.routing_rules = tuple(rule for rule in compiled if isinstance(rule, _RoutingRule)) + self.capability_rules = tuple(rule for rule in compiled if isinstance(rule, _CapabilityRule)) - def _compile(self) -> list[tuple[re.Pattern, dict]]: - compiled: list[tuple[re.Pattern, dict]] = [] - for rule in self.rules: - if not isinstance(rule, dict): - continue - pattern = rule.get(PATTERN_FIELD) - model_info = rule.get(MODEL_INFO_FIELD) - if not isinstance(pattern, str) or not isinstance(model_info, dict): - verbose_logger.warning( - "LiteLLM: skipping malformed fallback generalization rule %s (needs string '%s' and dict '%s').", - rule.get("name", pattern), - PATTERN_FIELD, - MODEL_INFO_FIELD, - ) - continue - try: - compiled.append((re.compile(pattern, re.IGNORECASE), model_info)) - except re.error as e: - verbose_logger.warning( - "LiteLLM: skipping fallback generalization rule with invalid regex %r: %s", - pattern, - e, - ) - return compiled - - def match(self, model: str) -> Optional[dict]: + def match_routing(self, model: str) -> Optional[str]: if not model: return None - if self._compiled is None: - self._compiled = self._compile() - for pattern, model_info in self._compiled: - if pattern.search(model) is not None: - return dict(model_info) - return None + return next( + (rule.provider for rule in self.routing_rules if rule.pattern.search(model) is not None), + None, + ) + + def match_capabilities(self, model: str) -> Optional[dict]: + if not model: + return None + matched = tuple(rule.model_info for rule in self.capability_rules if rule.pattern.search(model) is not None) + if not matched: + return None + return {key: value for model_info in matched for key, value in model_info.items()} _registry = _FallbackGeneralizations() -def set_fallback_generalizations(rules: Optional[list[dict]]) -> None: - """Install the active rule list and invalidate the compiled-regex cache. +def set_fallback_generalizations(rules: Optional[list]) -> None: + """Install the active rule list, compiling and classifying each rule. - ``extends`` inheritance is resolved here, once, before the rules are stored. - Called once when the model cost map is loaded (and again on any reload). + Legacy ``extends`` inheritance is resolved here, once, before classification; + a legacy rule mixing ``litellm_provider`` with capability keys installs as both + kinds. Malformed and invalid-regex rules are warned about and skipped. Called + once when the model cost map is loaded (and again on any reload). """ - _registry.set_rules(_resolve_extends(rules) if isinstance(rules, list) else rules) + _registry.set_rules(rules) -def get_fallback_generalization_rules() -> list[dict]: +def get_fallback_generalization_rules() -> list: """Return the raw rule list (read-only view for callers/tests).""" return _registry.rules -def match_fallback_generalization(model: str) -> Optional[dict]: - """Return the ``model_info`` of the first rule whose regex matches ``model``. +def match_routing_generalization(model: str) -> Optional[str]: + """Return the provider of the first routing rule whose regex matches ``model``. O(number of rules). Only call this once exact lookups have missed. """ - return _registry.match(model) + return _registry.match_routing(model) + + +def match_capability_generalizations(model: str) -> Optional[dict]: + """Return the union of the ``model_info`` of every capability rule matching ``model``. + + Later rules override earlier ones on key conflicts. Returns ``None`` when no + capability rule matches. O(number of rules); only call once exact lookups have missed. + """ + return _registry.match_capabilities(model) diff --git a/litellm/litellm_core_utils/get_litellm_params.py b/litellm/litellm_core_utils/get_litellm_params.py index 352e55e9c23..b8ef9d8cca7 100644 --- a/litellm/litellm_core_utils/get_litellm_params.py +++ b/litellm/litellm_core_utils/get_litellm_params.py @@ -2,26 +2,8 @@ from typing import Optional from litellm.llms.openai.data_residency import infer_openai_data_residency -# Pre-define optional kwargs keys as frozenset for O(1) lookups -# These are extracted from kwargs only if present, avoiding unnecessary .get() calls -OPTIONAL_KWARGS_KEYS = frozenset( +AWS_CREDENTIAL_KWARGS_KEYS = frozenset( { - "azure_ad_token", - "tenant_id", - "client_id", - "client_secret", - "azure_username", - "azure_password", - "azure_scope", - "timeout", - "gcs_bucket_name", - "bucket_name", - "vertex_credentials", - "vertex_project", - "vertex_location", - "vertex_ai_project", - "vertex_ai_location", - "vertex_ai_credentials", "aws_region_name", "aws_access_key_id", "aws_secret_access_key", @@ -34,14 +16,40 @@ OPTIONAL_KWARGS_KEYS = frozenset( "aws_external_id", "aws_bedrock_runtime_endpoint", "aws_bedrock_project_id", - "tpm", - "rpm", - "itpm", - "otpm", - "use_xai_oauth", } ) +# Pre-define optional kwargs keys as frozenset for O(1) lookups +# These are extracted from kwargs only if present, avoiding unnecessary .get() calls +OPTIONAL_KWARGS_KEYS = ( + frozenset( + { + "azure_ad_token", + "tenant_id", + "client_id", + "client_secret", + "azure_username", + "azure_password", + "azure_scope", + "timeout", + "gcs_bucket_name", + "bucket_name", + "vertex_credentials", + "vertex_project", + "vertex_location", + "vertex_ai_project", + "vertex_ai_location", + "vertex_ai_credentials", + "tpm", + "rpm", + "itpm", + "otpm", + "use_xai_oauth", + } + ) + | AWS_CREDENTIAL_KWARGS_KEYS +) + # Backward-compatible alias for existing imports/tests. _OPTIONAL_KWARGS_KEYS = OPTIONAL_KWARGS_KEYS diff --git a/litellm/litellm_core_utils/get_llm_provider_logic.py b/litellm/litellm_core_utils/get_llm_provider_logic.py index 61a73201c43..487a7b7e25f 100644 --- a/litellm/litellm_core_utils/get_llm_provider_logic.py +++ b/litellm/litellm_core_utils/get_llm_provider_logic.py @@ -4,7 +4,7 @@ from urllib.parse import urlparse import litellm from litellm.constants import REPLICATE_MODEL_NAME_WITH_ID_LENGTH from litellm.litellm_core_utils.fallback_generalizations import ( - match_fallback_generalization, + match_routing_generalization, ) from litellm.llms.openai_like.json_loader import JSONProviderRegistry from litellm.secret_managers.main import get_secret, get_secret_str @@ -346,6 +346,9 @@ def get_llm_provider( elif endpoint == "https://pinstripes.io/v1": custom_llm_provider = "pinstripes" dynamic_api_key = get_secret_str("PINSTRIPES_API_KEY") + elif endpoint == "https://api.meta.ai/v1": + custom_llm_provider = "meta" + dynamic_api_key = get_secret_str("META_API_KEY") if api_base is not None and not isinstance(api_base, str): raise Exception("api base needs to be a string. api_base={}".format(api_base)) @@ -471,12 +474,10 @@ def get_llm_provider( custom_llm_provider = "sap" # Last resort for an otherwise-unknown model: a declarative - # fallback-generalization rule (e.g. routes future claude-* to anthropic). + # fallback-generalization routing rule (e.g. routes future claude-* to anthropic). # Exact provider matches above always win; this only runs on a miss. if not custom_llm_provider: - generalization = match_fallback_generalization(model) - if generalization is not None: - custom_llm_provider = generalization.get("litellm_provider") or None + custom_llm_provider = match_routing_generalization(model) if not custom_llm_provider: if litellm.suppress_debug_info is False: diff --git a/litellm/litellm_core_utils/litellm_logging.py b/litellm/litellm_core_utils/litellm_logging.py index 936d79b22d6..83d6fcc0bee 100644 --- a/litellm/litellm_core_utils/litellm_logging.py +++ b/litellm/litellm_core_utils/litellm_logging.py @@ -38,6 +38,7 @@ from litellm import ( ) from litellm._logging import _is_debugging_on, _redact_string, verbose_logger from litellm.exceptions import ( + BudgetExceededError, validate_rate_limit_category, validate_rate_limit_type, ) @@ -73,6 +74,7 @@ from litellm.litellm_core_utils.model_param_helper import ModelParamHelper from litellm.litellm_core_utils.redact_messages import ( redact_message_input_output_from_custom_logger, redact_message_input_output_from_logging, + redact_streaming_responses_for_custom_logger, ) from litellm.llms.base_llm.ocr.transformation import OCRResponse from litellm.llms.base_llm.search.transformation import SearchResponse @@ -924,7 +926,6 @@ class Logging(LiteLLMLoggingBaseClass): def pre_call(self, input, api_key, model=None, additional_args={}): # Log the exact input to the LLM API - litellm.error_logs["PRE_CALL"] = locals() try: self._pre_call( input=input, @@ -1134,7 +1135,6 @@ class Logging(LiteLLMLoggingBaseClass): def post_call(self, original_response, input=None, api_key=None, additional_args={}): # Log the exact result from the LLM API, for streaming - log the type of response received - litellm.error_logs["POST_CALL"] = locals() if isinstance(original_response, dict): original_response = json.dumps(original_response, default=str) try: @@ -1453,6 +1453,9 @@ class Logging(LiteLLMLoggingBaseClass): response_cost = litellm.response_cost_calculator(**response_cost_calculator_kwargs) verbose_logger.debug(f"response_cost: {response_cost}") + additional_response_cost: object = self.model_call_details.get("additional_response_cost") + if isinstance(additional_response_cost, (int, float)) and additional_response_cost > 0: + return (response_cost or 0.0) + additional_response_cost return response_cost except Exception as e: # error calculating cost debug_info = StandardLoggingModelCostFailureDebugInformation( @@ -1531,6 +1534,9 @@ class Logging(LiteLLMLoggingBaseClass): and litellm_params.get(CallTypes.aimage_generation.value, False) is not True and litellm_params.get(CallTypes.atranscription.value, False) is not True and litellm_params.get(CallTypes.allm_passthrough_route.value, False) is not True + and litellm_params.get(CallTypes.aanthropic_messages.value, False) is not True + and litellm_params.get(CallTypes.agenerate_content.value, False) is not True + and litellm_params.get(CallTypes.agenerate_content_stream.value, False) is not True ) def _is_assembled_stream_success(self, result=None) -> bool: @@ -1606,6 +1612,35 @@ class Logging(LiteLLMLoggingBaseClass): **kwargs, ) + async def dispatch_failure_handlers( + self, + exception: Exception, + traceback_exception: str, + prefer_async_handlers: bool = False, + ) -> None: + """Route failure logging to async and/or sync handlers for this request. + + Mirrors ``dispatch_success_handlers``: the sync ``failure_handler`` never runs + concurrently with ``async_failure_handler`` on the shared logging object, so the + two paths cannot mutate it at the same time. ``prefer_async_handlers`` only + bypasses the sync-SDK-only shortcut (e.g. ``async for`` on a stream from + ``completion()``); legacy string callbacks still run via + ``executor.submit(failure_handler)`` when configured. + """ + litellm_params = self.model_call_details.get("litellm_params", {}) or {} + sync_sdk = self._is_sync_litellm_request(litellm_params) + passthrough = self.call_type == CallTypes.pass_through.value + if sync_sdk and not prefer_async_handlers and not passthrough: + self.failure_handler(exception, traceback_exception) + return + + await self.async_failure_handler(exception, traceback_exception) + + if not self._should_run_sync_failure_callbacks_for_async_calls(): + return + + executor.submit(self.failure_handler, exception, traceback_exception) + def should_run_logging( self, event_type: Literal["async_success", "sync_success", "async_failure", "sync_failure"], @@ -1843,7 +1878,14 @@ class Logging(LiteLLMLoggingBaseClass): elif standard_logging_object is not None: self.model_call_details["standard_logging_object"] = standard_logging_object else: - self.model_call_details["response_cost"] = None + # Streaming reaches here before its cost is known, so the cost + # is seeded to None, but only when nothing has already + # established one. A stream that assembles into a response + # object recomputes the cost right after this; a pass-through + # stream cannot (its body is opaque) and carries the cost its + # upstream reported in the response headers, which an + # unconditional reset would discard. + self.model_call_details.setdefault("response_cost", None) result = self._transform_usage_objects(result=result) @@ -2576,6 +2618,9 @@ class Logging(LiteLLMLoggingBaseClass): model_call_details = callback.redact_standard_logging_payload_from_model_call_details( model_call_details=model_call_details ) + model_call_details = redact_streaming_responses_for_custom_logger( + model_call_details=model_call_details, custom_logger=callback + ) ################################## if self.stream is True: if "async_complete_streaming_response" in model_call_details: @@ -3067,10 +3112,28 @@ class Logging(LiteLLMLoggingBaseClass): _filtered_success_callbacks = self._remove_internal_litellm_callbacks(_filtered_success_callbacks) return len(_filtered_success_callbacks) > 0 + def _should_run_sync_failure_callbacks_for_async_calls(self) -> bool: + """ + Returns: + - bool: True if sync failure callbacks should be run for async calls. eg. `langfuse`, `s3` + + Mirrors ``_should_run_sync_callbacks_for_async_calls`` but reads the failure + callback lists. Gating the legacy sync ``failure_handler`` on the success lists + would drop sync failure callbacks for any caller that configures only failure + callbacks, so streaming errors would be logged nowhere. + """ + _combined_sync_callbacks = self.get_combined_callback_list( + dynamic_success_callbacks=self.dynamic_failure_callbacks, + global_callbacks=litellm.failure_callback, + ) + _filtered_failure_callbacks = self._remove_internal_custom_logger_callbacks(_combined_sync_callbacks) + _filtered_failure_callbacks = self._remove_internal_litellm_callbacks(_filtered_failure_callbacks) + return len(_filtered_failure_callbacks) > 0 + def get_combined_callback_list(self, dynamic_success_callbacks: Optional[List], global_callbacks: List) -> List: if dynamic_success_callbacks is None: return list(global_callbacks) - return list(set(dynamic_success_callbacks + global_callbacks)) + return list(dict.fromkeys(dynamic_success_callbacks + global_callbacks)) def _remove_internal_litellm_callbacks(self, callbacks: List) -> List: """ @@ -4595,6 +4658,10 @@ class StandardLoggingPayloadSetup: user_api_key_spend=None, user_api_key_max_budget=None, user_api_key_budget_reset_at=None, + user_api_key_user_spend=None, + user_api_key_user_max_budget=None, + user_api_key_team_spend=None, + user_api_key_team_max_budget=None, user_api_key_team_id=None, user_api_key_org_id=None, user_api_key_org_alias=None, @@ -4941,6 +5008,7 @@ class StandardLoggingPayloadSetup: rate_limit_category = validate_rate_limit_category(getattr(original_exception, "category", None)) rate_limit_type = validate_rate_limit_type(getattr(original_exception, "rate_limit_type", None)) + budget_error = original_exception if isinstance(original_exception, BudgetExceededError) else None return StandardLoggingPayloadErrorInformation( error_code=error_status, @@ -4950,6 +5018,10 @@ class StandardLoggingPayloadSetup: error_message=error_message, error_rate_limit_category=rate_limit_category, error_rate_limit_type=rate_limit_type, + error_budget_entity_type=budget_error.entity_type if budget_error else None, + error_budget_entity_id=budget_error.entity_id if budget_error else None, + error_budget_limit=budget_error.max_budget if budget_error else None, + error_budget_spend=budget_error.current_cost if budget_error else None, ) @staticmethod @@ -5208,10 +5280,15 @@ def get_standard_logging_object_payload( call_type = kwargs.get("call_type") cache_hit = kwargs.get("cache_hit", False) # Extract usage as a plain dict, avoiding Pydantic round-trip - usage_dict = StandardLoggingPayloadSetup.get_usage_as_dict( + raw_usage_dict = StandardLoggingPayloadSetup.get_usage_as_dict( response_obj=response_obj, combined_usage_object=cast(Optional[Usage], kwargs.get("combined_usage_object")), ) + usage_dict = ( + {**raw_usage_dict, "output_image_count": len(init_response_obj.data)} + if isinstance(init_response_obj, ImageResponse) and init_response_obj.data + else raw_usage_dict + ) id = response_obj.get("id", kwargs.get("litellm_call_id")) @@ -5421,6 +5498,10 @@ def get_standard_logging_metadata( user_api_key_spend=None, user_api_key_max_budget=None, user_api_key_budget_reset_at=None, + user_api_key_user_spend=None, + user_api_key_user_max_budget=None, + user_api_key_team_spend=None, + user_api_key_team_max_budget=None, user_api_key_team_id=None, user_api_key_org_id=None, user_api_key_org_alias=None, @@ -5473,18 +5554,6 @@ def scrub_sensitive_keys_in_metadata(litellm_params: Optional[dict]): litellm_params["_langfuse_masking_function"] = masking_fn litellm_params["metadata"] = metadata - ## check user_api_key_metadata for sensitive logging keys - cleaned_user_api_key_metadata = {} - if "user_api_key_metadata" in metadata and isinstance(metadata["user_api_key_metadata"], dict): - for k, v in metadata["user_api_key_metadata"].items(): - if k == "logging": # prevent logging user logging keys - cleaned_user_api_key_metadata[k] = "scrubbed_by_litellm_for_sensitive_keys" - else: - cleaned_user_api_key_metadata[k] = v - - metadata["user_api_key_metadata"] = cleaned_user_api_key_metadata - litellm_params["metadata"] = metadata - return litellm_params @@ -5520,6 +5589,10 @@ def create_dummy_standard_logging_payload() -> StandardLoggingPayload: user_api_key_team_id=str("test_team"), user_api_key_user_id=str("test_user"), user_api_key_team_alias=str("test_team_alias"), + user_api_key_user_spend=None, + user_api_key_user_max_budget=None, + user_api_key_team_spend=None, + user_api_key_team_max_budget=None, user_api_key_org_id=None, spend_logs_metadata=None, requester_ip_address=str("127.0.0.1"), diff --git a/litellm/litellm_core_utils/llm_cost_calc/tiered_pricing.py b/litellm/litellm_core_utils/llm_cost_calc/tiered_pricing.py new file mode 100644 index 00000000000..836b02f2049 --- /dev/null +++ b/litellm/litellm_core_utils/llm_cost_calc/tiered_pricing.py @@ -0,0 +1,139 @@ +""" +Provider-neutral graduated tiered pricing calculation. + +Shared by provider cost calculators (e.g. Dashscope) and the proxy budget +reservation logic so neither has to depend on the other. +""" + +from typing import List, Optional, Union + + +def _coerce_cost_per_token(value: Union[float, int, str, None]) -> float: + """ + Coerce a per-token cost into a float. + + Model cost values loaded from YAML config may arrive as strings (e.g. + scientific notation like "4e-07"), which would break arithmetic. + """ + if value is None: + return 0.0 + if isinstance(value, str): + try: + return float(value) + except ValueError: + return 0.0 + return float(value) + + +def calculate_tiered_cost( + tokens: int, + tiered_pricing: List[dict], + cost_key: str, + fallback_cost_key: Optional[str] = None, +) -> float: + """ + Calculate cost for a given number of tokens based on a true tiered pricing structure. + + This function iterates through sorted pricing tiers, calculates the cost for the + number of tokens that fall into each tier's range, and sums them up to get the total cost. + + Args: + tokens (int): The total number of tokens to calculate the cost for. + tiered_pricing (List[dict]): A list of dictionaries, where each dictionary + represents a pricing tier. + cost_key (str): The key in the tier dictionary that holds the per-token cost + (e.g., 'input_cost_per_token'). + fallback_cost_key (Optional[str], optional): A fallback key to use if the + primary `cost_key` is not found in a tier. Defaults to None. + + Returns: + float: The total calculated cost for the given tokens. + + Example: + >>> tiered_pricing = [ + ... {"range": [0, 100000], "input_cost_per_token": 0.0001}, + ... {"range": [100000, 500000], "input_cost_per_token": 0.00005}, + ... ] + + Calculating cost for 150,000 tokens: + (100,000 * 0.0001) + (50,000 * 0.00005) = $12.5 + """ + if not tiered_pricing or tokens <= 0: + return 0.0 + + total_cost = 0.0 + tokens_processed = 0 + + sorted_tiers = sorted(tiered_pricing, key=lambda x: x.get("range", [0, 0])[0]) + + for tier in sorted_tiers: + if tokens_processed >= tokens: + break + + tier_range = tier.get("range", []) + if len(tier_range) != 2: + continue + + range_start, range_end = tier_range + + if tokens <= range_start: + continue + + tier_start = max(range_start, tokens_processed) + tier_end = min(range_end, tokens) + + if tier_end > tier_start: + tokens_in_tier = tier_end - tier_start + cost_per_token = tier.get(cost_key) or tier.get(fallback_cost_key, 0) + total_cost += tokens_in_tier * _coerce_cost_per_token(cost_per_token) + tokens_processed = tier_end + + # After loop, check if any tokens remain (i.e., tokens > highest tier's end range) + # and charge them at the last tier's rate. + if tokens_processed < tokens and sorted_tiers: + last_tier = sorted_tiers[-1] + remaining_tokens = tokens - tokens_processed + cost_per_token = last_tier.get(cost_key) or last_tier.get(fallback_cost_key, 0) + total_cost += remaining_tokens * _coerce_cost_per_token(cost_per_token) + + return total_cost + + +def select_tier_for_input( + tiered_pricing: List[dict], + input_tokens: int, +) -> Optional[dict]: + """ + Select the pricing tier for a request based on its total input token count. + + Alibaba Model Studio (Dashscope) tiered pricing is all-or-nothing: the tier is + chosen by the total input tokens of a single request and every token in the + request (input and output) is billed at that one tier's rate, rather than + graduated income-tax-style slicing. A tier matches when + ``range_start < input_tokens <= range_end`` (so a request of exactly + ``range_end`` tokens stays in the lower tier, matching the official + ``0 < Token <= 32K`` phrasing). Requests above the highest declared range fall + back to the last (most expensive) tier. + """ + if not tiered_pricing or input_tokens <= 0: + return None + + sorted_tiers = sorted(tiered_pricing, key=lambda t: t.get("range", [0, 0])[0]) + valid_tiers = [tier for tier in sorted_tiers if len(tier.get("range", [])) == 2] + if not valid_tiers: + return None + + matching = [tier for tier in valid_tiers if tier["range"][0] < input_tokens <= tier["range"][1]] + if matching: + return matching[0] + return valid_tiers[-1] + + +def tier_rate( + tier: dict, + cost_key: str, + fallback_cost_key: Optional[str] = None, +) -> float: + """Read a per-token rate from a tier, coercing YAML string costs to float.""" + raw = tier.get(cost_key) or tier.get(fallback_cost_key, 0) + return _coerce_cost_per_token(raw) diff --git a/litellm/litellm_core_utils/llm_cost_calc/utils.py b/litellm/litellm_core_utils/llm_cost_calc/utils.py index c039f0f43ee..85ed0665ebf 100644 --- a/litellm/litellm_core_utils/llm_cost_calc/utils.py +++ b/litellm/litellm_core_utils/llm_cost_calc/utils.py @@ -445,6 +445,7 @@ class PromptTokensDetailsResult(TypedDict): text_tokens: int audio_tokens: int image_tokens: int + video_tokens: int character_count: int image_count: int video_length_seconds: float @@ -456,7 +457,8 @@ def _parse_prompt_tokens_details(usage: Usage) -> PromptTokensDetailsResult: cache_creation_tokens = ( cast( Optional[int], - getattr(usage.prompt_tokens_details, "cache_creation_tokens", 0), + getattr(usage.prompt_tokens_details, "cache_write_tokens", 0) + or getattr(usage.prompt_tokens_details, "cache_creation_tokens", 0), ) or 0 ) @@ -473,6 +475,7 @@ def _parse_prompt_tokens_details(usage: Usage) -> PromptTokensDetailsResult: ) audio_tokens = cast(Optional[int], getattr(usage.prompt_tokens_details, "audio_tokens", 0)) or 0 image_tokens = cast(Optional[int], getattr(usage.prompt_tokens_details, "image_tokens", 0)) or 0 + video_tokens = _coerce_token_count(getattr(usage.prompt_tokens_details, "video_tokens", 0)) character_count = ( cast( Optional[int], @@ -503,6 +506,7 @@ def _parse_prompt_tokens_details(usage: Usage) -> PromptTokensDetailsResult: text_tokens=text_tokens, audio_tokens=audio_tokens, image_tokens=image_tokens, + video_tokens=video_tokens, character_count=character_count, image_count=image_count, video_length_seconds=float(video_length_seconds), @@ -515,6 +519,7 @@ class CompletionTokensDetailsResult(TypedDict): text_tokens: int reasoning_tokens: int image_tokens: int + video_tokens: int def _parse_completion_tokens_details(usage: Usage) -> CompletionTokensDetailsResult: @@ -546,12 +551,14 @@ def _parse_completion_tokens_details(usage: Usage) -> CompletionTokensDetailsRes ) or 0 ) + video_tokens = _coerce_token_count(getattr(usage.completion_tokens_details, "video_tokens", 0)) return CompletionTokensDetailsResult( audio_tokens=audio_tokens, text_tokens=text_tokens, reasoning_tokens=reasoning_tokens, image_tokens=image_tokens, + video_tokens=video_tokens, ) @@ -586,6 +593,13 @@ def _calculate_input_cost( image_token_cost_key = "input_cost_per_token" prompt_cost += calculate_cost_component(model_info, image_token_cost_key, prompt_tokens_details["image_tokens"]) + ### VIDEO TOKEN COST + if prompt_tokens_details["video_tokens"]: + video_token_cost_key = "input_cost_per_video_token" + if model_info.get(video_token_cost_key) is None: + video_token_cost_key = "input_cost_per_token" + prompt_cost += calculate_cost_component(model_info, video_token_cost_key, prompt_tokens_details["video_tokens"]) + ### CACHE WRITING COST - Now uses tiered pricing if ( prompt_tokens_details["cache_creation_tokens"] @@ -698,6 +712,7 @@ def generic_cost_per_token( text_tokens=usage.prompt_tokens, audio_tokens=0, image_tokens=0, + video_tokens=0, character_count=0, image_count=0, video_length_seconds=0.0, @@ -716,13 +731,14 @@ def generic_cost_per_token( audio_tokens = prompt_tokens_details["audio_tokens"] cache_creation = prompt_tokens_details["cache_creation_tokens"] image_tokens = prompt_tokens_details["image_tokens"] + video_tokens = prompt_tokens_details["video_tokens"] # Check for double-counting: sum of details > prompt_tokens means overlap - total_details = text_tokens + cache_hit + audio_tokens + cache_creation + image_tokens + total_details = text_tokens + cache_hit + audio_tokens + cache_creation + image_tokens + video_tokens has_double_counting = cache_hit > 0 and total_details > usage.prompt_tokens if (text_tokens == 0 and prompt_tokens_details["image_count"] == 0) or has_double_counting: - text_tokens = usage.prompt_tokens - cache_hit - audio_tokens - cache_creation - image_tokens + text_tokens = usage.prompt_tokens - cache_hit - audio_tokens - cache_creation - image_tokens - video_tokens # Clamp to zero: inconsistent streaming usage if text_tokens < 0: text_tokens = 0 @@ -751,6 +767,7 @@ def generic_cost_per_token( audio_tokens = 0 reasoning_tokens = 0 image_tokens = 0 + video_tokens = 0 is_text_tokens_total = False if usage.completion_tokens_details is not None: completion_tokens_details = _parse_completion_tokens_details(usage) @@ -758,19 +775,20 @@ def generic_cost_per_token( text_tokens = completion_tokens_details["text_tokens"] reasoning_tokens = completion_tokens_details["reasoning_tokens"] image_tokens = completion_tokens_details["image_tokens"] + video_tokens = completion_tokens_details["video_tokens"] # Handle text_tokens calculation: # 1. If text_tokens is explicitly provided and > 0, use it - # 2. If there's a breakdown (reasoning/audio/image tokens), calculate text_tokens as the remainder + # 2. If there's a breakdown (reasoning/audio/image/video tokens), calculate text_tokens as the remainder # 3. If no breakdown at all, assume all completion_tokens are text_tokens - has_token_breakdown = image_tokens > 0 or audio_tokens > 0 or reasoning_tokens > 0 + has_token_breakdown = image_tokens > 0 or audio_tokens > 0 or reasoning_tokens > 0 or video_tokens > 0 if text_tokens == 0: if has_token_breakdown: # Calculate text tokens as remainder when we have a breakdown # This handles cases like OpenAI's reasoning models where text_tokens isn't provided text_tokens = max( 0, - usage.completion_tokens - reasoning_tokens - audio_tokens - image_tokens, + usage.completion_tokens - reasoning_tokens - audio_tokens - image_tokens - video_tokens, ) else: # No breakdown at all, all tokens are text tokens @@ -803,6 +821,14 @@ def generic_cost_per_token( ) completion_cost += float(image_tokens) * _output_cost_per_image_token + ## VIDEO COST + if not is_text_tokens_total and video_tokens and video_tokens > 0: + _output_cost_per_video_token = _get_cost_per_unit(model_info, "output_cost_per_video_token", None) + _output_cost_per_video_token = ( + _output_cost_per_video_token if _output_cost_per_video_token is not None else completion_base_cost + ) + completion_cost += float(video_tokens) * _output_cost_per_video_token + ## REGIONAL DATA-RESIDENCY UPLIFT # Applied as a flat multiplier across all token costs for the request # when the upstream is a regionalized OpenAI host (eu./us.api.openai.com). @@ -881,10 +907,6 @@ def get_token_type_cost_breakdown( cache_read_tokens = prompt_tokens_details["cache_hit_tokens"] cache_creation_tokens = prompt_tokens_details["cache_creation_tokens"] cache_creation_token_details = prompt_tokens_details["cache_creation_token_details"] - # Some OpenAI-compatible providers (e.g. kimi-k2) report cache-write tokens - # under `cache_write_tokens`; mirror the total-cost normalization path. - if not cache_creation_tokens: - cache_creation_tokens = _coerce_token_count(getattr(usage.prompt_tokens_details, "cache_write_tokens", 0)) # Fall back to the private top-level counters the Usage constructor mirrors cache # tokens onto, so providers/callers that bypass prompt_tokens_details are covered. if not cache_read_tokens: diff --git a/litellm/litellm_core_utils/prompt_templates/common_utils.py b/litellm/litellm_core_utils/prompt_templates/common_utils.py index 538d5f650ef..c43089950ee 100644 --- a/litellm/litellm_core_utils/prompt_templates/common_utils.py +++ b/litellm/litellm_core_utils/prompt_templates/common_utils.py @@ -42,6 +42,7 @@ from litellm.types.utils import ( ) if TYPE_CHECKING: # newer pattern to avoid importing pydantic objects on __init__.py + from litellm.types.llms.anthropic import AnthropicInputSchema from litellm.types.llms.openai import ChatCompletionImageObject DEFAULT_USER_CONTINUE_MESSAGE = ChatCompletionUserMessage(content="Please continue.", role="user") @@ -1046,6 +1047,31 @@ def unpack_legacy_defs( return schema +def sanitize_input_schema_for_anthropic(input_schema: dict) -> "AnthropicInputSchema": + """Coerce an arbitrary tool input_schema into the shape Anthropic accepts. + + Anthropic requires ``type == "object"``, only recognises ``$defs`` (legacy + ``definitions`` / OpenAPI ``components.schemas`` refs must be inlined first), + and rejects keys outside ``AnthropicInputSchema``. Both the chat + (``AnthropicConfig._map_tool_helper``) and Anthropic Messages MCP paths run + a schema through here so an external MCP schema cannot succeed on one route + and 400 on the other. + """ + from litellm.types.llms.anthropic import AnthropicInputSchema + + normalized = dict(input_schema) if input_schema else {} + if normalized.get("type") != "object": + normalized["type"] = "object" + if "properties" not in normalized: + normalized["properties"] = {} + + normalized = unpack_legacy_defs(normalized, copy=True) + + allowed_keys = set(AnthropicInputSchema.__annotations__.keys()) + filtered = {key: value for key, value in normalized.items() if key in allowed_keys} + return AnthropicInputSchema(**filtered) + + def _get_image_mime_type_from_url(url: str) -> Optional[str]: """ Get mime type for common image URLs diff --git a/litellm/litellm_core_utils/prompt_templates/factory.py b/litellm/litellm_core_utils/prompt_templates/factory.py index 8bb0e12905e..d8ce48f05de 100644 --- a/litellm/litellm_core_utils/prompt_templates/factory.py +++ b/litellm/litellm_core_utils/prompt_templates/factory.py @@ -6,6 +6,7 @@ import mimetypes import re import xml.etree.ElementTree as ET from enum import Enum +from collections.abc import Mapping from typing import Any, Dict, List, Optional, Set, Tuple, TypedDict, Union, cast, overload from jinja2.sandbox import ImmutableSandboxedEnvironment @@ -1266,7 +1267,7 @@ def _get_dummy_thought_signature() -> str: def convert_to_gemini_tool_call_invoke( message: ChatCompletionAssistantMessage, model: Optional[str] = None, - custom_llm_provider: Optional[str] = None, + forward_function_call_id: bool = False, ) -> List[VertexPartType]: """ OpenAI tool invokes: @@ -1316,16 +1317,12 @@ def convert_to_gemini_tool_call_invoke( VertexGeminiConfig, ) - forward_tool_call_id = bool( - model and VertexGeminiConfig._forward_gemini_function_call_id(model, custom_llm_provider) - ) - if tool_calls is not None: for idx, tool in enumerate(tool_calls): if "function" in tool: gemini_function_call: Optional[VertexFunctionCall] = _gemini_tool_call_invoke_helper( function_call_params=tool["function"], - tool_call_id=(tool.get("id") if forward_tool_call_id else None), + tool_call_id=(tool.get("id") if forward_function_call_id else None), ) if gemini_function_call is not None: part_dict: VertexPartType = {"function_call": gemini_function_call} @@ -1377,8 +1374,7 @@ def convert_to_gemini_tool_call_invoke( def convert_to_gemini_tool_call_result( message: Union[ChatCompletionToolMessage, ChatCompletionFunctionMessage], last_message_with_tool_calls: Optional[dict], - model: Optional[str] = None, - custom_llm_provider: Optional[str] = None, + forward_function_call_id: bool = False, ) -> Union[VertexPartType, List[VertexPartType]]: """ OpenAI message with a tool result looks like: @@ -1500,14 +1496,8 @@ def convert_to_gemini_tool_call_result( name = tool.get("function", {}).get("name", "") # Echo the OpenAI tool_call_id on functionResponse (strip thought-signature suffix). - # Only Google AI Studio Gemini 3+ accepts `id` on function_response parts. - # Vertex AI and older Gemini models reject the field with HTTP 400. - from litellm.llms.vertex_ai.gemini.vertex_and_google_ai_studio_gemini import ( - VertexGeminiConfig, - ) - gemini_call_id: Optional[str] = None - if model and VertexGeminiConfig._forward_gemini_function_call_id(model, custom_llm_provider): + if forward_function_call_id: raw_tool_call_id = message.get("tool_call_id") if raw_tool_call_id and isinstance(raw_tool_call_id, str): stripped_id = raw_tool_call_id.split(THOUGHT_SIGNATURE_SEPARATOR, 1)[0] @@ -5350,7 +5340,9 @@ def prompt_factory( def get_attribute_or_key(tool_or_function, attribute, default=None): if hasattr(tool_or_function, attribute): return getattr(tool_or_function, attribute) - return tool_or_function.get(attribute, default) + if isinstance(tool_or_function, Mapping): + return tool_or_function.get(attribute, default) + return default class NormalizedToolCall(TypedDict): @@ -5379,14 +5371,18 @@ def _parse_tool_call_arguments(raw: Any, tool_name: Optional[str], context: str) return parsed if isinstance(parsed, dict) else {} -def _tool_calls_from_chat_completion_response(response: Any) -> list[NormalizedToolCall]: +def _tool_calls_from_chat_completion_response( + response: Any, include_all_choices: bool = False +) -> list[NormalizedToolCall]: choices = get_attribute_or_key(response, "choices", None) if not (isinstance(choices, list) and choices): return [] - message = get_attribute_or_key(choices[0], "message", None) - tool_calls = get_attribute_or_key(message, "tool_calls", None) if message else None - if not isinstance(tool_calls, list): - return [] + tool_calls: list[Any] = [] + for choice in choices if include_all_choices else choices[:1]: + message = get_attribute_or_key(choice, "message", None) + choice_tool_calls = get_attribute_or_key(message, "tool_calls", None) if message else None + if isinstance(choice_tool_calls, list): + tool_calls.extend(choice_tool_calls) result: list[NormalizedToolCall] = [] for tc in tool_calls: fn = get_attribute_or_key(tc, "function", None) @@ -5449,7 +5445,7 @@ def _tool_calls_from_anthropic_messages_response(response: Any) -> list[Normaliz return result -def get_tool_calls_from_response(response: Any) -> list[NormalizedToolCall]: +def get_tool_calls_from_response(response: Any, include_all_choices: bool = False) -> list[NormalizedToolCall]: """ Extract tool/function calls from a response object into a normalized ``{"id", "name", "arguments"}`` shape, regardless of which API surface @@ -5457,11 +5453,20 @@ def get_tool_calls_from_response(response: Any) -> list[NormalizedToolCall]: the Responses API (``output`` items of type ``function_call``), or the Anthropic Messages API (``content`` blocks of type ``tool_use``). + ``include_all_choices`` decides the chat-completions scope: the default + reads only ``choices[0]``, which is what consumers that act on THE reply + (e.g. guardrails rebuilding the primary assistant message) want; usage + accounting passes True because every choice of an ``n>1`` request costs + money and its tool calls really ran. The other surfaces have a single + output, so the flag has no effect on them. + Callers that only care about a specific tool should filter the result by ``name`` themselves -- this returns every tool call found. """ + chat_tool_calls = _tool_calls_from_chat_completion_response(response, include_all_choices=include_all_choices) + if chat_tool_calls: + return chat_tool_calls for extractor in ( - _tool_calls_from_chat_completion_response, _tool_calls_from_responses_api_response, _tool_calls_from_anthropic_messages_response, ): @@ -5494,3 +5499,56 @@ def has_tool_with_name(tools: Any, tool_name: str) -> bool: elif tool.get("name") == tool_name: return True return False + + +def resolve_structured_messages( + messages: list[dict[str, Any]] | None, + request_kwargs: dict[str, Any], +) -> list[dict[str, Any]] | None: + """ + Normalize a request's messages to OpenAI-spec chat-completions shape, + regardless of which API surface produced them (chat completions, + Anthropic /v1/messages, Responses API ``input``, etc). + + Returns ``messages`` unchanged if already present. Otherwise dispatches + through the guardrail translation handlers (the same per-surface + conversion logic guardrails use) to convert e.g. Responses API ``input`` + into a message list. Returns ``None`` if no messages could be resolved. + """ + if messages: + return messages + + from litellm.litellm_core_utils.api_route_to_call_types import ( + get_call_types_for_route, + ) + from litellm.llms import load_guardrail_translation_mappings + from litellm.types.utils import CallTypes + + mappings = load_guardrail_translation_mappings() + call_type: CallTypes | None = None + + # 1. Try route-based inference from proxy metadata + route = request_kwargs.get("litellm_metadata", {}).get("user_api_key_request_route") + if route: + call_types_list = get_call_types_for_route(route) + if call_types_list: + for ct in call_types_list: + if ct in mappings: + call_type = ct + break + + # 2. Fallback: try each mapped handler until one produces messages + handlers_to_try: list[Any] = [] + if call_type is not None and call_type in mappings: + handlers_to_try.append(mappings[call_type]()) + else: + handlers_to_try.extend(handler_cls() for handler_cls in mappings.values()) + + for handler in handlers_to_try: + structured = handler.get_structured_messages(request_kwargs) + if structured: + return [ + msg if isinstance(msg, dict) else msg.model_dump() # type: ignore + for msg in structured + ] + return None diff --git a/litellm/litellm_core_utils/redact_messages.py b/litellm/litellm_core_utils/redact_messages.py index cc9264e93f8..43181e7f5ff 100644 --- a/litellm/litellm_core_utils/redact_messages.py +++ b/litellm/litellm_core_utils/redact_messages.py @@ -38,10 +38,61 @@ def redact_message_input_output_from_custom_logger( litellm_logging_obj: LiteLLMLoggingObject, result, custom_logger: CustomLogger ): if hasattr(custom_logger, "message_logging") and custom_logger.message_logging is not True: - return perform_redaction(litellm_logging_obj.model_call_details, result) + return perform_redaction(litellm_logging_obj.model_call_details, result, redact_streaming_responses=False) return result +def redact_streaming_responses_for_custom_logger(model_call_details: dict, custom_logger: CustomLogger) -> dict: + """ + Returns a copy of model_call_details whose streaming response entries are redacted deepcopies + when the custom logger has opted out of message logging. The shared model_call_details is left + untouched so other callbacks still receive the unredacted response. + """ + if not (hasattr(custom_logger, "message_logging") and custom_logger.message_logging is not True): + return model_call_details + redacted_entries = { + streaming_key: _redacted_streaming_response_copy(model_call_details[streaming_key]) + for streaming_key in ("complete_streaming_response", "async_complete_streaming_response") + if model_call_details.get(streaming_key) is not None + } + if not redacted_entries: + return model_call_details + return {**model_call_details, **redacted_entries} + + +def _redacted_streaming_response_copy(streaming_response): + redacted_response = copy.deepcopy(streaming_response) + _redact_streaming_response(redacted_response) + return redacted_response + + +def _redact_streaming_response(streaming_response): + if hasattr(streaming_response, "choices"): + for choice in streaming_response.choices: + _redact_choice_content(choice) + redact_vertex_ai_metadata_from_logged_object(streaming_response) + elif hasattr(streaming_response, "output"): + _redact_responses_api_output(streaming_response.output) + if hasattr(streaming_response, "reasoning") and streaming_response.reasoning is not None: + streaming_response.reasoning = None + + +def _redact_tool_calls(tool_calls) -> None: + """Redact tool call arguments (assistant tool calls carry prompt-derived data).""" + if not tool_calls: + return + for tool_call in tool_calls: + function = getattr(tool_call, "function", None) + if function is not None and hasattr(function, "arguments"): + function.arguments = "redacted-by-litellm" + + +def _redact_function_call(function_call) -> None: + """Redact legacy assistant function_call arguments.""" + if function_call is not None and hasattr(function_call, "arguments"): + function_call.arguments = "redacted-by-litellm" + + def _redact_choice_content(choice): """Helper to redact content in a choice (message or delta).""" if isinstance(choice, litellm.Choices): @@ -50,12 +101,16 @@ def _redact_choice_content(choice): choice.message.reasoning_content = "redacted-by-litellm" if hasattr(choice.message, "thinking_blocks"): choice.message.thinking_blocks = None + _redact_tool_calls(getattr(choice.message, "tool_calls", None)) + _redact_function_call(getattr(choice.message, "function_call", None)) elif isinstance(choice, litellm.utils.StreamingChoices): choice.delta.content = "redacted-by-litellm" if hasattr(choice.delta, "reasoning_content"): choice.delta.reasoning_content = "redacted-by-litellm" if hasattr(choice.delta, "thinking_blocks"): choice.delta.thinking_blocks = None + _redact_tool_calls(getattr(choice.delta, "tool_calls", None)) + _redact_function_call(getattr(choice.delta, "function_call", None)) def _redact_responses_api_output(output_items): @@ -76,6 +131,9 @@ def _redact_responses_api_output(output_items): if hasattr(summary_item, "text"): summary_item.text = "redacted-by-litellm" + if hasattr(output_item, "type") and output_item.type == "function_call" and hasattr(output_item, "arguments"): + output_item.arguments = "redacted-by-litellm" + def _redact_responses_api_output_dict(output_items, redacted_str: str): """Helper to redact ResponsesAPIResponse output items in dict form.""" @@ -96,6 +154,9 @@ def _redact_responses_api_output_dict(output_items, redacted_str: str): if isinstance(summary_item, dict) and "text" in summary_item: summary_item["text"] = redacted_str + if output_item.get("type") == "function_call" and "arguments" in output_item: + output_item["arguments"] = redacted_str + def _redact_standard_logging_object(model_call_details: dict): """Redact messages and response inside standard_logging_object if present.""" @@ -127,6 +188,19 @@ def _redact_standard_logging_object(model_call_details: dict): standard_logging_object["response"] = {"text": redacted_str} +def _redact_tool_calls_dict(message: dict, redacted_str: str) -> None: + """Redact tool call / function_call arguments in a dict-form message or delta.""" + tool_calls = message.get("tool_calls") + if isinstance(tool_calls, list): + for tool_call in tool_calls: + if isinstance(tool_call, dict) and isinstance(tool_call.get("function"), dict): + tool_call["function"]["arguments"] = redacted_str + + function_call = message.get("function_call") + if isinstance(function_call, dict) and "arguments" in function_call: + function_call["arguments"] = redacted_str + + def _redact_model_response_dict_choices(choices, redacted_str: str): for choice in choices: if isinstance(choice, dict): @@ -138,6 +212,7 @@ def _redact_model_response_dict_choices(choices, redacted_str: str): choice["message"]["thinking_blocks"] = None if "audio" in choice["message"]: choice["message"]["audio"] = None + _redact_tool_calls_dict(choice["message"], redacted_str) elif "delta" in choice and isinstance(choice["delta"], dict): choice["delta"]["content"] = redacted_str if "reasoning_content" in choice["delta"]: @@ -146,13 +221,18 @@ def _redact_model_response_dict_choices(choices, redacted_str: str): choice["delta"]["thinking_blocks"] = None if "audio" in choice["delta"]: choice["delta"]["audio"] = None + _redact_tool_calls_dict(choice["delta"], redacted_str) else: _redact_choice_content(choice) -def perform_redaction(model_call_details: dict, result): +def perform_redaction(model_call_details: dict, result, redact_streaming_responses: bool = True): """ Performs the actual redaction on the logging object and result. + + redact_streaming_responses=False skips the in-place redaction of the shared streaming + response entries; per-callback redaction hands each opted-out callback its own redacted + copy via redact_streaming_responses_for_custom_logger instead. """ # Redact model_call_details model_call_details["messages"] = [{"role": "user", "content": "redacted-by-litellm"}] @@ -162,17 +242,9 @@ def perform_redaction(model_call_details: dict, result): redact_vertex_ai_metadata_from_litellm_params(model_call_details) # Redact streaming response - if model_call_details.get("stream", False) is True and "complete_streaming_response" in model_call_details: - _streaming_response = model_call_details["complete_streaming_response"] - if hasattr(_streaming_response, "choices"): - for choice in _streaming_response.choices: - _redact_choice_content(choice) - redact_vertex_ai_metadata_from_logged_object(_streaming_response) - elif hasattr(_streaming_response, "output"): - _redact_responses_api_output(_streaming_response.output) - # Redact reasoning field in ResponsesAPIResponse - if hasattr(_streaming_response, "reasoning") and _streaming_response.reasoning is not None: - _streaming_response.reasoning = None + if redact_streaming_responses and model_call_details.get("stream", False) is True: + for _streaming_key in ("complete_streaming_response", "async_complete_streaming_response"): + _redact_streaming_response(model_call_details.get(_streaming_key)) # Redact result if result is not None: diff --git a/litellm/litellm_core_utils/secret_redaction.py b/litellm/litellm_core_utils/secret_redaction.py index b526068589d..455d0f00c35 100644 --- a/litellm/litellm_core_utils/secret_redaction.py +++ b/litellm/litellm_core_utils/secret_redaction.py @@ -9,6 +9,8 @@ secrets from strings without depending on the logging-configuration module. import re from typing import List +from litellm.constants import MINIMUM_CUSTOM_KEY_LENGTH + _REDACTED = "REDACTED" @@ -30,7 +32,7 @@ def _build_secret_patterns() -> "re.Pattern[str]": # Basic auth headers r"Basic\s+[A-Za-z0-9+/]{10,}={0,2}", # OpenAI / Anthropic sk- prefixed keys - r"sk-[A-Za-z0-9\-_]{20,}", + rf"sk-[A-Za-z0-9\-_]{{{MINIMUM_CUSTOM_KEY_LENGTH - len('sk-')},}}", # Generic api_key / api-key / apikey (handles 'key': 'value' dict repr) r"(?:api[_-]?key)['\"]?\s*[:=]\s*['\"]?[^\s,'\"})\]{}>]{8,}", # x-api-key / api-key header values (handles 'key': 'value' dict repr) diff --git a/litellm/litellm_core_utils/sensitive_data_masker.py b/litellm/litellm_core_utils/sensitive_data_masker.py index 1f3a6961f39..7861e13bae5 100644 --- a/litellm/litellm_core_utils/sensitive_data_masker.py +++ b/litellm/litellm_core_utils/sensitive_data_masker.py @@ -1,6 +1,8 @@ from collections.abc import Mapping from typing import Any, Dict, List, Optional, Set +from pydantic import BaseModel + from litellm.constants import DEFAULT_MAX_RECURSE_DEPTH_SENSITIVE_DATA_MASKER @@ -153,6 +155,39 @@ def mask_sensitive_structure(data: object) -> object: return _error_masker.mask(data) +def mask_credentials_in_payload(data: object) -> object: + """Return a copy of ``data`` where string values under sensitive-named keys + are masked but every other value (``None``, ``int``, ``float``, ``bool``, + ``bytes``, ``datetime``, tuples, sets, typed objects) is preserved by + identity, and dicts/lists are rebuilt structurally. + + Use this for logging payloads that carry response data through to + SpendLogs / OTel / Langfuse, where :meth:`SensitiveDataMasker.mask`'s + config-dump semantics (``None`` -> ``"None"``, tuples stringified, + objects flattened via ``__dict__``) would silently distort the record. + + Sensitive-key detection is delegated to the shared + :class:`SensitiveDataMasker` so pattern updates stay in one place. + """ + return _walk_payload(data, key_is_sensitive=False, depth=0) + + +def _walk_payload(node: object, key_is_sensitive: bool, depth: int) -> object: + if depth >= DEFAULT_MAX_RECURSE_DEPTH_SENSITIVE_DATA_MASKER: + return node + if isinstance(node, Mapping): + return {k: _walk_payload(v, _default_masker.is_sensitive_key(k), depth + 1) for k, v in node.items()} + if isinstance(node, list): + return [_walk_payload(item, key_is_sensitive, depth + 1) for item in node] + if isinstance(node, tuple): + return tuple(_walk_payload(item, key_is_sensitive, depth + 1) for item in node) + if isinstance(node, BaseModel): + return _walk_payload(node.model_dump(), key_is_sensitive, depth) + if key_is_sensitive and isinstance(node, str) and node: + return _default_masker._mask_value(node) + return node + + def mask_sensitive_keys(data: Dict[str, Any], sensitive_fields: Set[str]) -> Dict[str, Any]: """Return a new dict with values masked for keys listed in ``sensitive_fields``. diff --git a/litellm/litellm_core_utils/streaming_chunk_builder_utils.py b/litellm/litellm_core_utils/streaming_chunk_builder_utils.py index 38bc68f2f78..d52d9849310 100644 --- a/litellm/litellm_core_utils/streaming_chunk_builder_utils.py +++ b/litellm/litellm_core_utils/streaming_chunk_builder_utils.py @@ -467,6 +467,7 @@ class ChunkProcessor: cache_read_input_tokens: Optional[int] = None completion_tokens_details: Optional[CompletionTokensDetails] = None prompt_tokens_details: Optional[PromptTokensDetailsWrapper] = None + cost: Optional[float] = None if "prompt_tokens" in usage_chunk: prompt_tokens = usage_chunk.get("prompt_tokens", 0) or 0 @@ -476,6 +477,8 @@ class ChunkProcessor: cache_creation_input_tokens = usage_chunk.get("cache_creation_input_tokens") if "cache_read_input_tokens" in usage_chunk: cache_read_input_tokens = usage_chunk.get("cache_read_input_tokens") + if "cost" in usage_chunk: + cost = usage_chunk.get("cost") if hasattr(usage_chunk, "completion_tokens_details"): if isinstance(usage_chunk.completion_tokens_details, dict): completion_tokens_details = CompletionTokensDetails(**usage_chunk.completion_tokens_details) @@ -494,6 +497,7 @@ class ChunkProcessor: "cache_read_input_tokens": cache_read_input_tokens, "completion_tokens_details": completion_tokens_details, "prompt_tokens_details": prompt_tokens_details, + "cost": cost, } def count_reasoning_tokens(self, response: ModelResponse) -> Optional[int]: @@ -512,6 +516,22 @@ class ChunkProcessor: return reasoning_tokens + @staticmethod + def _extract_usage_chunk(chunk: dict[str, Any] | ModelResponse | ModelResponseStream) -> Usage | None: + usage_chunk: Usage | dict[str, Any] | None = None + if hasattr(chunk, "usage") and chunk.usage is not None: + usage_chunk = chunk.usage + elif "usage" in chunk: + usage_chunk = chunk["usage"] + elif (isinstance(chunk, ModelResponse) or isinstance(chunk, ModelResponseStream)) and hasattr( + chunk, "_hidden_params" + ): + usage_chunk = chunk._hidden_params.get("usage", None) + + if isinstance(usage_chunk, dict): + return Usage(**usage_chunk) + return usage_chunk + def _calculate_usage_per_chunk( self, chunks: List[Union[Dict[str, Any], ModelResponse]], @@ -548,18 +568,12 @@ class ChunkProcessor: # is last-wins, so without preserving this separately the 1h breakdown is # lost and 1h cache writes get billed at the 5m rate. cache_creation_token_details: Optional[CacheCreationTokenDetails] = None + cost: Optional[float] = None + for chunk in chunks: - usage_chunk: Optional[Usage] = None - if "usage" in chunk: - usage_chunk = chunk["usage"] - elif (isinstance(chunk, ModelResponse) or isinstance(chunk, ModelResponseStream)) and hasattr( - chunk, "_hidden_params" - ): - usage_chunk = chunk._hidden_params.get("usage", None) + usage_chunk = self._extract_usage_chunk(chunk) if usage_chunk is not None: - if isinstance(usage_chunk, dict): - usage_chunk = Usage(**usage_chunk) usage_chunk_dict = self._usage_chunk_calculation_helper(usage_chunk) if usage_chunk_dict["prompt_tokens"] is not None and usage_chunk_dict["prompt_tokens"] > 0: prompt_tokens = usage_chunk_dict["prompt_tokens"] @@ -610,6 +624,9 @@ class ChunkProcessor: prompt_tokens_details, cache_creation_token_details ) + if usage_chunk_dict["cost"] is not None: + cost = usage_chunk_dict["cost"] + prompt_tokens_details = self._attach_cache_creation_token_details( prompt_tokens_details, cache_creation_token_details ) @@ -629,6 +646,7 @@ class ChunkProcessor: web_search_requests=web_search_requests, completion_tokens_details=completion_tokens_details, prompt_tokens_details=prompt_tokens_details, + cost=cost, ) @staticmethod @@ -727,6 +745,7 @@ class ChunkProcessor: prompt_tokens_details: Optional[PromptTokensDetailsWrapper] = calculated_usage_per_chunk[ "prompt_tokens_details" ] + cost: Optional[float] = calculated_usage_per_chunk["cost"] try: returned_usage.prompt_tokens = prompt_tokens or token_counter(model=model, messages=messages) @@ -784,6 +803,9 @@ class ChunkProcessor: else: returned_usage.prompt_tokens_details.web_search_requests = web_search_requests + if cost is not None: + setattr(returned_usage, "cost", cost) + # Return a new usage object with the new values returned_usage = Usage(**returned_usage.model_dump()) diff --git a/litellm/litellm_core_utils/streaming_handler.py b/litellm/litellm_core_utils/streaming_handler.py index 128ba0bf3ab..60dbf7c644a 100644 --- a/litellm/litellm_core_utils/streaming_handler.py +++ b/litellm/litellm_core_utils/streaming_handler.py @@ -962,10 +962,11 @@ class CustomStreamWrapper: if self.custom_llm_provider == "bedrock" and "trace" in model_response: return model_response - # Default - return StopIteration - if hasattr(model_response, "usage"): - self.chunks.append(model_response) - raise StopIteration + # Don't raise StopIteration here - some providers (like OpenRouter) + # send usage/cost data in chunks after the finish_reason chunk + if hasattr(model_response, "usage") and model_response.usage is not None: + return model_response + return # flush any remaining holding chunk if len(self.holding_chunk) > 0: if model_response.choices[0].delta.content is None: @@ -1474,12 +1475,16 @@ class CustomStreamWrapper: self.tool_call = True + if hasattr(chunk, "usage") and chunk.usage is not None: + model_response.usage = chunk.usage + ## RETURN ARG - return self.return_processed_chunk_logic( + result = self.return_processed_chunk_logic( completion_obj=completion_obj, model_response=model_response, # type: ignore response_obj=response_obj, ) + return result except StopIteration: raise StopIteration @@ -1686,6 +1691,21 @@ class CustomStreamWrapper: model_response.choices[0].finish_reason = "tool_calls" return model_response + @staticmethod + def _propagate_usage_cost_to_hidden_params( + response: "ModelResponse", + ) -> None: + """ + If the assembled response carries a provider-reported cost on + usage.cost, copy it into _hidden_params so litellm's cost + calculator uses it instead of a token-based estimate. + """ + _usage = getattr(response, "usage", None) + if _usage is not None and hasattr(_usage, "cost") and _usage.cost is not None: + if "additional_headers" not in response._hidden_params: + response._hidden_params["additional_headers"] = {} + response._hidden_params["additional_headers"]["llm_provider-x-litellm-response-cost"] = float(_usage.cost) + def __next__(self) -> "ModelResponseStream": cache_hit = False if self.custom_llm_provider is not None and self.custom_llm_provider == "cached_response": @@ -1741,6 +1761,10 @@ class CustomStreamWrapper: # hasattr(response, "usage") is always True — must check # `is not None` to avoid running this path on every chunk. if getattr(response, "usage", None) is not None: + usage_to_preserve = response.usage + if usage_to_preserve: + response._hidden_params["usage"] = usage_to_preserve + obj_dict = response.model_dump() if "usage" in obj_dict: @@ -1789,6 +1813,8 @@ class CustomStreamWrapper: response = self.model_response_creator() if complete_streaming_response is not None: + self._propagate_usage_cost_to_hidden_params(complete_streaming_response) + setattr( response, "usage", @@ -1974,97 +2000,7 @@ class CustomStreamWrapper: self.chunks.append(processed_chunk) return processed_chunk except (StopAsyncIteration, StopIteration): - if self.sent_last_chunk is True: - # log the final chunk with accurate streaming values - try: - complete_streaming_response = litellm.stream_chunk_builder( - chunks=self.chunks, - messages=self.messages, - logging_obj=self.logging_obj, - ) - except Exception as e: - # see sync __next__: a raise from stream_chunk_builder inside this - # except handler escapes __anext__ and drops the request from SpendLogs. - # Recover best-effort usage from the raw chunks so cost is still tracked - verbose_logger.warning( - "stream_chunk_builder raised at end-of-stream (%s); logging best-effort usage from chunks.", - str(e), - ) - try: - complete_streaming_response = self.model_response_creator( - chunk={"usage": calculate_total_usage(chunks=self.chunks)} - ) - except Exception: - complete_streaming_response = None - - response = self.model_response_creator() - if complete_streaming_response is not None: - setattr( - response, - "usage", - getattr(complete_streaming_response, "usage"), - ) - try: - _copy = complete_streaming_response.model_copy(deep=True) - except RuntimeError: - _copy = complete_streaming_response.model_copy() - asyncio.create_task( - self.async_cache_streaming_response( - processed_chunk=_copy, - cache_hit=cache_hit, - ) - ) - # Update hidden_params with final usage from - # stream_chunk_builder (see sync __next__ for full comment). - if ( - self.stream_options is None - and complete_streaming_response is not None - and self._last_returned_hidden_params is not None - ): - final_usage = getattr(complete_streaming_response, "usage", None) - if final_usage is not None: - self._last_returned_hidden_params["usage"] = final_usage - - if self.sent_stream_usage is False and self.send_stream_usage is True: - self.sent_stream_usage = True - return response - - _deferred_cb = getattr( - self.logging_obj, - "_on_deferred_stream_complete", - None, - ) - if _deferred_cb is not None: - # Proxy has post-call guardrails. Store the assembled - # response so the outer streaming consumer - # (ProxyLogging.async_post_call_streaming_iterator_hook) - # can fire the deferred callback AFTER all guardrail - # end-of-stream blocks complete. Scheduling here via - # create_task would race with unified_guardrail's - # end-of-stream block for short-stream providers. - self.logging_obj._deferred_stream_complete_args = ( # type: ignore[attr-defined] - complete_streaming_response, - cache_hit, - ) - else: - # prefer_async_handlers routes CustomLogger to async_success_handler - # when consumers use ``async for`` on sync-SDK streams. Legacy string - # callbacks still run via executor.submit inside dispatch_success_handlers. - asyncio.create_task( - self.logging_obj.dispatch_success_handlers( - complete_streaming_response, - cache_hit=cache_hit, - start_time=None, - end_time=None, - prefer_async_handlers=True, - ) - ) - - raise StopAsyncIteration # Re-raise StopIteration - else: - self.sent_last_chunk = True - processed_chunk = self.finish_reason_handler() - return processed_chunk + return await self._finalize_completed_stream(cache_hit=cache_hit) except httpx.TimeoutException as e: # if httpx read timeout error occues traceback_exception = traceback.format_exc() ## ADD DEBUG INFORMATION - E.G. LITELLM REQUEST TIMEOUT @@ -2072,27 +2008,121 @@ class CustomStreamWrapper: if self.logging_obj is not None: self._record_partial_usage_for_failure() ## LOGGING - threading.Thread( - target=self.logging_obj.failure_handler, - args=(e, traceback_exception), - ).start() # log response - # Handle any exceptions that might occur during streaming - asyncio.create_task(self.logging_obj.async_failure_handler(e, traceback_exception)) - self._handle_stream_fallback_error(e) - except Exception as e: - traceback_exception = traceback.format_exc() - if self.logging_obj is not None: - self._record_partial_usage_for_failure() - ## LOGGING - threading.Thread( - target=self.logging_obj.failure_handler, - args=(e, traceback_exception), - ).start() # log response - # Handle any exceptions that might occur during streaming asyncio.create_task( - self.logging_obj.async_failure_handler(e, traceback_exception) # type: ignore + self.logging_obj.dispatch_failure_handlers(e, traceback_exception, prefer_async_handlers=True) ) self._handle_stream_fallback_error(e) + except (httpx.ReadError, httpx.RemoteProtocolError) as e: + if self.received_finish_reason is None: + self._log_stream_failure_and_raise(e) + return await self._finalize_completed_stream(cache_hit=cache_hit) + except Exception as e: + self._log_stream_failure_and_raise(e) + + async def _finalize_completed_stream(self, cache_hit: bool) -> "ModelResponseStream": + if self.sent_last_chunk is True: + # log the final chunk with accurate streaming values + try: + complete_streaming_response = litellm.stream_chunk_builder( + chunks=self.chunks, + messages=self.messages, + logging_obj=self.logging_obj, + ) + except Exception as e: + # see sync __next__: a raise from stream_chunk_builder inside this + # except handler escapes __anext__ and drops the request from SpendLogs. + # Recover best-effort usage from the raw chunks so cost is still tracked + verbose_logger.warning( + "stream_chunk_builder raised at end-of-stream (%s); logging best-effort usage from chunks.", + str(e), + ) + try: + complete_streaming_response = self.model_response_creator( + chunk={"usage": calculate_total_usage(chunks=self.chunks)} + ) + except Exception: + complete_streaming_response = None + + response = self.model_response_creator() + if complete_streaming_response is not None: + self._propagate_usage_cost_to_hidden_params(complete_streaming_response) + + setattr( + response, + "usage", + getattr(complete_streaming_response, "usage"), + ) + try: + _copy = complete_streaming_response.model_copy(deep=True) + except RuntimeError: + _copy = complete_streaming_response.model_copy() + asyncio.create_task( + self.async_cache_streaming_response( + processed_chunk=_copy, + cache_hit=cache_hit, + ) + ) + # Update hidden_params with final usage from + # stream_chunk_builder (see sync __next__ for full comment). + if ( + self.stream_options is None + and complete_streaming_response is not None + and self._last_returned_hidden_params is not None + ): + final_usage = getattr(complete_streaming_response, "usage", None) + if final_usage is not None: + self._last_returned_hidden_params["usage"] = final_usage + + if self.sent_stream_usage is False and self.send_stream_usage is True: + self.sent_stream_usage = True + return response + + _deferred_cb = getattr( + self.logging_obj, + "_on_deferred_stream_complete", + None, + ) + if _deferred_cb is not None: + # Proxy has post-call guardrails. Store the assembled + # response so the outer streaming consumer + # (ProxyLogging.async_post_call_streaming_iterator_hook) + # can fire the deferred callback AFTER all guardrail + # end-of-stream blocks complete. Scheduling here via + # create_task would race with unified_guardrail's + # end-of-stream block for short-stream providers. + self.logging_obj._deferred_stream_complete_args = ( # type: ignore[attr-defined] + complete_streaming_response, + cache_hit, + ) + else: + # prefer_async_handlers routes CustomLogger to async_success_handler + # when consumers use ``async for`` on sync-SDK streams. Legacy string + # callbacks still run via executor.submit inside dispatch_success_handlers. + asyncio.create_task( + self.logging_obj.dispatch_success_handlers( + complete_streaming_response, + cache_hit=cache_hit, + start_time=None, + end_time=None, + prefer_async_handlers=True, + ) + ) + + raise StopAsyncIteration # Re-raise StopIteration + else: + self.sent_last_chunk = True + processed_chunk = self.finish_reason_handler() + return processed_chunk + + def _log_stream_failure_and_raise(self, e: Exception) -> NoReturn: + traceback_exception = traceback.format_exc() + if self.logging_obj is not None: + self._record_partial_usage_for_failure() + ## LOGGING + asyncio.create_task( + self.logging_obj.dispatch_failure_handlers(e, traceback_exception, prefer_async_handlers=True) + ) + self._handle_stream_fallback_error(e) def _record_partial_usage_for_failure(self) -> None: """ @@ -2228,12 +2258,16 @@ def calculate_total_usage(chunks: List[ModelResponse]) -> Usage: """Assume most recent usage chunk has total usage uptil then.""" prompt_tokens: int = 0 completion_tokens: int = 0 + latest_usage_chunk = None + for chunk in chunks: if "usage" in chunk and chunk["usage"] is not None: - if "prompt_tokens" in chunk["usage"]: - prompt_tokens = chunk["usage"].get("prompt_tokens", 0) or 0 - if "completion_tokens" in chunk["usage"]: - completion_tokens = chunk["usage"].get("completion_tokens", 0) or 0 + usage = chunk["usage"] + latest_usage_chunk = usage + if "prompt_tokens" in usage: + prompt_tokens = usage.get("prompt_tokens", 0) or 0 + if "completion_tokens" in usage: + completion_tokens = usage.get("completion_tokens", 0) or 0 returned_usage_chunk = Usage( prompt_tokens=prompt_tokens, @@ -2241,6 +2275,15 @@ def calculate_total_usage(chunks: List[ModelResponse]) -> Usage: total_tokens=prompt_tokens + completion_tokens, ) + if latest_usage_chunk is not None: + latest_cost = ( + latest_usage_chunk.get("cost") + if isinstance(latest_usage_chunk, dict) + else getattr(latest_usage_chunk, "cost", None) + ) + if latest_cost is not None: + returned_usage_chunk.cost = latest_cost + return returned_usage_chunk diff --git a/litellm/litellm_core_utils/url_utils.py b/litellm/litellm_core_utils/url_utils.py index 1cbb1ce973f..a83cb3bc69e 100644 --- a/litellm/litellm_core_utils/url_utils.py +++ b/litellm/litellm_core_utils/url_utils.py @@ -148,6 +148,15 @@ def _parse_url_destination_allowlist_entry( return _normalize_host(parsed.hostname), scheme, port +def provider_url_destination_candidates(value: str) -> Tuple[str, ...]: + return tuple( + candidate + for part in value.split(",") + for candidate in (part.strip(), part.strip().split("/", 1)[1] if "/" in part.strip() else "") + if candidate + ) + + def is_url_destination_allowed_by_host(url: str, allowed_hosts: List[str]) -> bool: """Return True when a credential-bearing provider URL is admin-allowlisted. diff --git a/litellm/llms/anthropic/chat/guardrail_translation/handler.py b/litellm/llms/anthropic/chat/guardrail_translation/handler.py index 7000c20d9c4..90f735707bf 100644 --- a/litellm/llms/anthropic/chat/guardrail_translation/handler.py +++ b/litellm/llms/anthropic/chat/guardrail_translation/handler.py @@ -600,9 +600,15 @@ class AnthropicMessagesHandler(BaseTranslation): guardrail_inputs["tool_calls"] = tool_calls_list try: + prepared_request_data = self._prepare_request_data( + request_data, + model_response, + user_api_key_dict, + key="response", + ) _guardrailed_inputs = await guardrail_to_apply.apply_guardrail( inputs=guardrail_inputs, - request_data=request_data if request_data is not None else {}, + request_data=prepared_request_data, input_type="response", logging_obj=litellm_logging_obj, ) @@ -618,9 +624,15 @@ class AnthropicMessagesHandler(BaseTranslation): string_so_far = self.get_streaming_string_so_far(responses_so_far) try: + prepared_request_data = self._prepare_request_data( + request_data, + responses_so_far, + user_api_key_dict, + key="responses", + ) _guardrailed_inputs = await guardrail_to_apply.apply_guardrail( inputs={"texts": [string_so_far]}, - request_data=request_data if request_data is not None else {}, + request_data=prepared_request_data, input_type="response", logging_obj=litellm_logging_obj, ) diff --git a/litellm/llms/anthropic/chat/transformation.py b/litellm/llms/anthropic/chat/transformation.py index 9721b797584..e99f356f8f2 100644 --- a/litellm/llms/anthropic/chat/transformation.py +++ b/litellm/llms/anthropic/chat/transformation.py @@ -29,7 +29,9 @@ from litellm.constants import ( RESPONSE_FORMAT_TOOL_NAME, ) from litellm.litellm_core_utils.core_helpers import map_finish_reason -from litellm.litellm_core_utils.prompt_templates.common_utils import unpack_legacy_defs +from litellm.litellm_core_utils.prompt_templates.common_utils import ( + sanitize_input_schema_for_anthropic, +) from litellm.llms.base_llm.base_utils import type_to_response_format_param from litellm.llms.base_llm.chat.transformation import BaseConfig, BaseLLMException from litellm.types.llms.anthropic import ( @@ -227,6 +229,10 @@ DROP_UNSUPPORTED_OUTPUT_CONFIG_WARNING = ( "Sonnet 4.6+, and Mythos Preview." ) +DROP_UNSUPPORTED_ADAPTIVE_THINKING_WARNING = ( + "Dropping adaptive `thinking` for model=%s: max_tokens is too small to fit the minimum thinking budget." +) + DROP_UNSUPPORTED_SPEED_WARNING = ( "Dropping unsupported `speed` for model=%s (drop_params=True). Fast mode is only supported on select Opus models." ) @@ -266,6 +272,10 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): def custom_llm_provider(self) -> Optional[str]: return "anthropic" + @property + def _resolved_provider(self) -> str: + return self.custom_llm_provider or "anthropic" + @classmethod def get_config(cls, *, model: Optional[str] = None): config = super().get_config() @@ -335,23 +345,26 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): return any(v in model_lower for v in ("opus-4-7", "opus_4_7", "opus-4.7", "opus_4.7")) @staticmethod - def _supports_effort_level(model: str, level: str) -> bool: + def _supports_effort_level(model: str, level: str, custom_llm_provider: str) -> bool: """Check ``supports_{level}_reasoning_effort`` in the model map.""" - return AnthropicConfig._supports_model_capability(model, f"supports_{level}_reasoning_effort") + return AnthropicConfig._supports_model_capability( + model, f"supports_{level}_reasoning_effort", custom_llm_provider + ) @staticmethod - def _validate_effort_for_model(model: str, effort: Optional[str]) -> Optional[str]: + def _validate_effort_for_model(model: str, effort: Optional[str], custom_llm_provider: str) -> Optional[str]: """Return ``None`` if ``effort`` is allowed on ``model``, else an error message.""" if effort == "max" and not ( - AnthropicConfig._is_adaptive_thinking_model(model) or AnthropicConfig._supports_effort_level(model, "max") + AnthropicConfig._is_adaptive_thinking_model(model, custom_llm_provider) + or AnthropicConfig._supports_effort_level(model, "max", custom_llm_provider) ): return f"effort='max' is not supported by this model. Got model: {model}" - if effort == "xhigh" and not AnthropicConfig._supports_effort_level(model, "xhigh"): + if effort == "xhigh" and not AnthropicConfig._supports_effort_level(model, "xhigh", custom_llm_provider): return f"effort='xhigh' is not supported by this model. Got model: {model}" return None @staticmethod - def _model_supports_effort_param(model: str) -> bool: + def _model_supports_effort_param(model: str, custom_llm_provider: str) -> bool: """Whether the model accepts ``output_config.effort`` at all. A model qualifies if its map entry advertises ``supports_output_config`` @@ -359,10 +372,10 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): signals: e.g. Claude Opus 4.5 supports ``output_config`` without advertising a non-default (max/xhigh) effort level. """ - if AnthropicConfig._supports_model_capability(model, "supports_output_config"): + if AnthropicConfig._supports_model_capability(model, "supports_output_config", custom_llm_provider): return True return any( - AnthropicConfig._supports_effort_level(model, level) + AnthropicConfig._supports_effort_level(model, level, custom_llm_provider) for level in ("low", "minimal", "medium", "high", "xhigh", "max") ) @@ -451,7 +464,7 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): if ( "claude-3-7-sonnet" in model - or AnthropicConfig._is_adaptive_thinking_model(model) + or AnthropicConfig._is_adaptive_thinking_model(model, self._resolved_provider) or supports_reasoning( model=model, custom_llm_provider=self.custom_llm_provider, @@ -467,10 +480,21 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): """ Filter out unsupported fields from JSON schema for Anthropic's output_format API. - Anthropic's output_format doesn't support certain JSON schema properties: - - maxItems/minItems: Not supported for array types - - minimum/maximum: Not supported for numeric types - - minLength/maxLength: Not supported for string types + Anthropic's output_format doesn't support certain JSON schema properties. + These are constraints that cannot be enforced by the constrained-decoding + grammar Anthropic compiles the schema into, so the API rejects them with a + 400 ``invalid_request_error`` (e.g. "output_format.schema: For 'array' type, + property 'uniqueItems' is not supported"): + - maxItems/minItems/uniqueItems/contains/minContains/maxContains/prefixItems: array constraints + - minimum/maximum/exclusiveMinimum/exclusiveMaximum/multipleOf: numeric constraints + - minLength/maxLength: string constraints + - minProperties/maxProperties/patternProperties/propertyNames: object constraints + - dependentRequired/dependentSchemas/unevaluatedProperties: object constraints + - if/then/else/not: conditional and negation keywords + + ``oneOf`` is also rejected ("Schema type 'oneOf' is not supported") and is + rewritten to ``anyOf``, matching the Anthropic SDK. Unknown keywords are + ignored by the API, so anything not listed here passes through untouched. This mirrors the transformation done by the Anthropic Python SDK. See: https://platform.claude.com/docs/en/build-with-claude/structured-outputs#how-sdk-transformation-works @@ -491,33 +515,53 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): if not isinstance(schema, dict): return schema - # All numeric/string/array constraints not supported by Anthropic - unsupported_fields = { - "maxItems", - "minItems", # array constraints - "minimum", - "maximum", # numeric constraints - "exclusiveMinimum", - "exclusiveMaximum", # numeric constraints - "minLength", - "maxLength", # string constraints - } - - # Build description additions from removed constraints - constraint_descriptions: list = [] constraint_labels = { "minItems": "minimum number of items: {}", "maxItems": "maximum number of items: {}", + "uniqueItems": "all array items must be unique", + "contains": "array must contain an item matching: {}", + "minContains": "minimum number of matching items: {}", + "maxContains": "maximum number of matching items: {}", + "prefixItems": "leading items must match, in order: {}", "minimum": "minimum value: {}", "maximum": "maximum value: {}", "exclusiveMinimum": "exclusive minimum value: {}", "exclusiveMaximum": "exclusive maximum value: {}", + "multipleOf": "must be a multiple of {}", "minLength": "minimum length: {}", "maxLength": "maximum length: {}", + "minProperties": "minimum number of properties: {}", + "maxProperties": "maximum number of properties: {}", + "patternProperties": "properties whose names match each pattern must satisfy: {}", + "propertyNames": "property names must satisfy: {}", + "dependentRequired": "dependent required properties: {}", + "dependentSchemas": "dependent schemas: {}", + "unevaluatedProperties": "unevaluated properties must satisfy: {}", + "if": "conditional (if): {}", + "then": "conditional (then): {}", + "else": "conditional (else): {}", + "not": "must not match: {}", } - for field in unsupported_fields: - if field in schema: - constraint_descriptions.append(constraint_labels[field].format(schema[field])) + unsupported_fields = set(constraint_labels) + + # Build description additions from removed constraints. Iterating + # constraint_labels (not the set) keeps the note order deterministic across + # processes, so identical requests serialize identically regardless of + # PYTHONHASHSEED and stay cache-friendly. + constraint_descriptions: list = [] + for field, label in constraint_labels.items(): + if field not in schema: + continue + value = schema[field] + # A falsy boolean constraint (e.g. ``uniqueItems: false``) imposes no + # real requirement, so don't add a misleading advisory note for it. + if isinstance(value, bool) and not value: + continue + # Sub-schema constraints (e.g. ``contains``) are serialized as JSON so + # the advisory note preserves what the constraint actually required, + # instead of just noting that it existed. + note_value = json.dumps(value) if isinstance(value, (dict, list)) else value + constraint_descriptions.append(label.format(note_value)) result: Dict[str, Any] = {} @@ -544,11 +588,17 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): elif key == "$defs" and isinstance(value, dict): result[key] = {k: AnthropicConfig.filter_anthropic_output_schema(v) for k, v in value.items()} elif key == "anyOf" and isinstance(value, list): - result[key] = [AnthropicConfig.filter_anthropic_output_schema(item) for item in value] + result["anyOf"] = result.get("anyOf", []) + [ + AnthropicConfig.filter_anthropic_output_schema(item) for item in value + ] elif key == "allOf" and isinstance(value, list): result[key] = [AnthropicConfig.filter_anthropic_output_schema(item) for item in value] elif key == "oneOf" and isinstance(value, list): - result[key] = [AnthropicConfig.filter_anthropic_output_schema(item) for item in value] + # Anthropic rejects oneOf ("Schema type 'oneOf' is not supported"); + # the Anthropic SDK rewrites it to anyOf, so do the same. + result["anyOf"] = result.get("anyOf", []) + [ + AnthropicConfig.filter_anthropic_output_schema(item) for item in value + ] else: result[key] = value @@ -623,7 +673,7 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): mcp_server: Optional[AnthropicMcpServerTool] = None if tool["type"] == "function" or tool["type"] == "custom": - _input_schema: dict = tool["function"].get( + _input_schema = tool["function"].get( "parameters", { "type": "object", @@ -631,28 +681,7 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): }, ) - # Anthropic requires input_schema.type to be "object". Normalize - # schemas from external sources (MCP servers, OpenAI callers) that - # may omit the type field or use a non-object type. - if _input_schema.get("type") != "object": - litellm.verbose_logger.debug( - "_map_tool_helper: coercing input_schema type from %r to " - "'object' for Anthropic compatibility (tool: %s)", - _input_schema.get("type"), - tool["function"].get("name"), - ) - _input_schema = dict(_input_schema) # avoid mutating caller's dict - _input_schema["type"] = "object" - if "properties" not in _input_schema: - _input_schema["properties"] = {} - - # Inline legacy / OpenAPI $refs before the allow-list filter strips - # their backing def blocks (https://github.com/BerriAI/litellm/issues/26692). - _input_schema = unpack_legacy_defs(_input_schema, copy=True) - - _allowed_properties = set(AnthropicInputSchema.__annotations__.keys()) - input_schema_filtered = {k: v for k, v in _input_schema.items() if k in _allowed_properties} - input_anthropic_schema: AnthropicInputSchema = AnthropicInputSchema(**input_schema_filtered) + input_anthropic_schema = sanitize_input_schema_for_anthropic(_input_schema) _tool = AnthropicMessagesTool( name=tool["function"]["name"], @@ -1159,11 +1188,13 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): def _map_reasoning_effort( reasoning_effort: Optional[Union[REASONING_EFFORT, str]], model: str, + custom_llm_provider: str, llm_provider: str = "anthropic", ) -> Optional[AnthropicThinkingParam]: + """Capability probes read the cost map under ``custom_llm_provider``; ``llm_provider`` only tags raised exceptions.""" if reasoning_effort is None or reasoning_effort == "none": return None - if AnthropicConfig._is_adaptive_thinking_model(model): + if AnthropicConfig._is_adaptive_thinking_model(model, custom_llm_provider): return AnthropicThinkingParam( type="adaptive", ) @@ -1211,6 +1242,23 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): llm_provider=llm_provider, ) + @staticmethod + def _cap_thinking_budget_to_max_tokens( + thinking: AnthropicThinkingParam, max_tokens: Optional[int] + ) -> Optional[AnthropicThinkingParam]: + """Cap a legacy ``thinking.budget_tokens`` below ``max_tokens`` (Anthropic + requires ``max_tokens > budget_tokens``). Returns the (possibly capped) + thinking dict, or ``None`` when ``max_tokens`` is too small to fit even the + minimum thinking budget and thinking should be dropped.""" + budget = thinking.get("budget_tokens") + if max_tokens is None or not isinstance(budget, int): + return thinking + if max_tokens <= ANTHROPIC_MIN_THINKING_BUDGET_TOKENS: + return None + if budget < max_tokens: + return thinking + return AnthropicThinkingParam(type=thinking.get("type", "enabled"), budget_tokens=max_tokens - 1) + def _extract_json_schema_from_response_format(self, value: Optional[dict]) -> Optional[dict]: if value is None: return None @@ -1411,24 +1459,10 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): output_key=param, ) elif param == "response_format" and isinstance(value, dict): - if any( - substring in model - for substring in { - "sonnet-4.5", - "sonnet-4-5", - "opus-4.1", - "opus-4-1", - "opus-4.5", - "opus-4-5", - "opus-4.6", - "opus-4-6", - "opus-4.7", - "opus-4-7", - "sonnet-4.6", - "sonnet-4-6", - "sonnet_4.6", - "sonnet_4_6", - } + if AnthropicConfig._supports_model_capability( + model, + "supports_native_structured_output", + self._resolved_provider, ): _output_format = self.map_response_format_to_anthropic_output_format(value) if _output_format is not None: @@ -1454,7 +1488,38 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): ): optional_params["metadata"] = {"user_id": value} elif param == "thinking": - optional_params["thinking"] = value + if ( + isinstance(value, dict) + and value.get("type") == "adaptive" + and not AnthropicConfig._is_adaptive_thinking_model(model, self._resolved_provider) + ): + # Callers (e.g. Claude Code) send adaptive thinking + # unconditionally; translate it down to the legacy + # `thinking={type: enabled, budget_tokens}` interface a + # pre-4.6 model actually supports instead of forwarding a + # shape the model will reject. + max_tokens = non_default_params.get("max_completion_tokens") or non_default_params.get("max_tokens") + legacy_thinking = AnthropicConfig._map_reasoning_effort( + reasoning_effort="medium", + model=model, + custom_llm_provider=self._resolved_provider, + llm_provider=self._resolved_provider, + ) + capped_thinking = ( + AnthropicConfig._cap_thinking_budget_to_max_tokens(legacy_thinking, max_tokens) + if legacy_thinking is not None + else None + ) + if capped_thinking is not None: + optional_params["thinking"] = capped_thinking + else: + litellm.verbose_logger.warning( + DROP_UNSUPPORTED_ADAPTIVE_THINKING_WARNING, + model, + ) + optional_params.pop("thinking", None) + else: + optional_params["thinking"] = value elif param == "reasoning_effort": # Accept both string ("low") and dict ({"effort": "low", # "summary": "concise"}). The Responses->Chat parser keeps the @@ -1471,20 +1536,21 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): mapped_thinking = AnthropicConfig._map_reasoning_effort( reasoning_effort=effort_value, model=model, - llm_provider=self.custom_llm_provider or "anthropic", + custom_llm_provider=self._resolved_provider, + llm_provider=self._resolved_provider, ) if mapped_thinking is None: optional_params.pop("thinking", None) optional_params.pop("output_config", None) else: optional_params["thinking"] = mapped_thinking - if AnthropicConfig._is_adaptive_thinking_model(model): + if AnthropicConfig._is_adaptive_thinking_model(model, self._resolved_provider): mapped_effort = REASONING_EFFORT_TO_OUTPUT_CONFIG_EFFORT.get(effort_value) if mapped_effort is None: AnthropicConfig._raise_invalid_reasoning_effort( model=model, value=effort_value, - llm_provider=self.custom_llm_provider or "anthropic", + llm_provider=self._resolved_provider, ) optional_params["output_config"] = {"effort": mapped_effort} elif param == "web_search_options" and isinstance(value, dict): @@ -1813,7 +1879,7 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): anthropic_messages = anthropic_messages_pt( model=model, messages=messages, - llm_provider=self.custom_llm_provider or "anthropic", + llm_provider=self._resolved_provider, ) except Exception as e: raise AnthropicError( @@ -1902,7 +1968,7 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): output_config = optional_params.get("output_config") if not output_config or not isinstance(output_config, dict): return - if litellm.drop_params is True and not self._model_supports_effort_param(model): + if litellm.drop_params is True and not self._model_supports_effort_param(model, self._resolved_provider): litellm.verbose_logger.warning( DROP_UNSUPPORTED_OUTPUT_CONFIG_WARNING, model, @@ -1916,14 +1982,14 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): raise litellm.exceptions.BadRequestError( message=(f"Invalid effort value: {effort!r}. Must be one of: 'high', 'medium', 'low', 'xhigh', 'max'"), model=model, - llm_provider=self.custom_llm_provider or "anthropic", + llm_provider=self._resolved_provider, ) - gate_error = self._validate_effort_for_model(model, effort) + gate_error = self._validate_effort_for_model(model, effort, self._resolved_provider) if gate_error is not None: raise litellm.exceptions.BadRequestError( message=gate_error, model=model, - llm_provider=self.custom_llm_provider or "anthropic", + llm_provider=self._resolved_provider, ) data["output_config"] = output_config diff --git a/litellm/llms/anthropic/common_utils.py b/litellm/llms/anthropic/common_utils.py index db540e5441d..256fee6b166 100644 --- a/litellm/llms/anthropic/common_utils.py +++ b/litellm/llms/anthropic/common_utils.py @@ -289,6 +289,13 @@ class AnthropicModelInfo(BaseLLMModelInfo): status_code=400, ) + @staticmethod + def _strip_version_suffix(model: str) -> str: + at = model.rfind("@") + if at > 0: + return model[:at] + return model + @staticmethod def _model_map_lookup_candidates(model: str) -> List[str]: """Model-map keys to try for ``model``: the id itself, the same id with a @@ -324,6 +331,7 @@ class AnthropicModelInfo(BaseLLMModelInfo): _DATED_RELEASE_SUFFIX_RE.sub("", cand), _DOTTED_VERSION_RE.sub(r"\1-\2", cand), _strip_bedrock_id_suffixes(cand), + AnthropicModelInfo._strip_version_suffix(cand), ) ) return list(dict.fromkeys((*primary, *normalized))) @@ -332,11 +340,15 @@ class AnthropicModelInfo(BaseLLMModelInfo): def _get_model_capability(model: str, key: str) -> Optional[bool]: """Read boolean capability ``key`` from the model map, or None when no entry declares it.""" + from litellm.utils import _get_bundled_model_cost_map + try: - for cand in AnthropicModelInfo._model_map_lookup_candidates(model): - value = litellm.model_cost.get(cand, {}).get(key) - if isinstance(value, bool): - return value + candidates = AnthropicModelInfo._model_map_lookup_candidates(model) + for model_cost in (litellm.model_cost, _get_bundled_model_cost_map()): + for cand in candidates: + value = model_cost.get(cand, {}).get(key) + if isinstance(value, bool): + return value except Exception: pass return None @@ -352,18 +364,43 @@ class AnthropicModelInfo(BaseLLMModelInfo): return value if isinstance(value, bool) else None @staticmethod - def _supports_model_capability(model: str, key: str) -> bool: - """Check a boolean capability ``key`` in the model map. + def _get_provider_resolved_capability(model: str, key: str, custom_llm_provider: str) -> Optional[bool]: + """Resolve boolean capability ``key`` for ``model`` under the caller's provider. - Strips bedrock/vertex prefixes so a provider-routed Claude still - resolves to the Anthropic model-map entry. + Returns the flag when the provider-aware lookup resolves ``model`` to an + entry (or fallback rule) that sets it explicitly, and ``None`` when the + model does not resolve under that provider or the resolved entry has no + opinion on ``key``. + """ + from litellm.utils import _get_model_info_helper + + try: + resolved_model, resolved_provider, _, _ = litellm.get_llm_provider( + model=model, custom_llm_provider=custom_llm_provider + ) + value = _get_model_info_helper(model=resolved_model, custom_llm_provider=resolved_provider).get(key) + except Exception: # noqa: BLE001 # _get_model_info_helper raises bare Exception for unmapped models + return None + return value if isinstance(value, bool) else None + + @staticmethod + def _supports_model_capability(model: str, key: str, custom_llm_provider: str) -> bool: + """Check a boolean capability ``key`` in the model map under the caller's provider. + + The provider-aware lookup is authoritative when it resolves an explicit flag, + so ``key: false`` on the provider-namespaced entry wins over every fallback. + Otherwise ``_supports_factory``'s provider-level fallbacks and the raw + model-map walk remain as backstops for alias forms the lookup misses. """ from litellm.utils import _supports_factory + resolved = AnthropicModelInfo._get_provider_resolved_capability(model, key, custom_llm_provider) + if resolved is not None: + return resolved try: if _supports_factory( model=model, - custom_llm_provider="anthropic", + custom_llm_provider=custom_llm_provider, key=key, ): return True @@ -372,17 +409,24 @@ class AnthropicModelInfo(BaseLLMModelInfo): return AnthropicModelInfo._get_model_capability(model, key) is True @staticmethod - def _is_adaptive_thinking_model(model: str) -> bool: + def _is_adaptive_thinking_model(model: str, custom_llm_provider: str) -> bool: """Whether ``model`` uses adaptive thinking (``output_config.effort``). The model cost map is authoritative: an explicit ``supports_adaptive_thinking`` - entry, or a ``fallback_generalizations`` rule for unknown Claude models. The - version gate (>= 4.6, including provider-prefixed Bedrock/Vertex ids that map to - no exact entry) lives entirely in that declarative rule, not here. + entry resolved under ``custom_llm_provider``, or a ``fallback_generalizations`` + rule for unknown Claude models. The version gate (>= 4.6, including + provider-prefixed Bedrock/Vertex ids that map to no exact entry) lives entirely + in that declarative rule, not here. """ - return AnthropicModelInfo._supports_model_capability(model, "supports_adaptive_thinking") + return AnthropicModelInfo._supports_model_capability(model, "supports_adaptive_thinking", custom_llm_provider) - def is_effort_used(self, optional_params: Optional[dict], model: Optional[str] = None) -> bool: + def is_effort_used( + self, + optional_params: Optional[dict], + model: Optional[str] = None, + *, + custom_llm_provider: str, + ) -> bool: """ Check if effort parameter is being used and requires a beta header. @@ -394,7 +438,7 @@ class AnthropicModelInfo(BaseLLMModelInfo): return False # Claude 4.6+ models use output_config as a stable API feature — no beta header needed - if model and self._is_adaptive_thinking_model(model): + if model and self._is_adaptive_thinking_model(model, custom_llm_provider): return False # Check if reasoning_effort is provided for Claude Opus 4.5 @@ -475,6 +519,8 @@ class AnthropicModelInfo(BaseLLMModelInfo): prompt_caching_set: bool = False, file_id_used: bool = False, mcp_server_used: bool = False, + *, + custom_llm_provider: str, ) -> List[str]: """ Get list of common beta headers based on the features that are active. @@ -487,7 +533,7 @@ class AnthropicModelInfo(BaseLLMModelInfo): betas = [] # Detect features - effort_used = self.is_effort_used(optional_params, model) + effort_used = self.is_effort_used(optional_params, model, custom_llm_provider=custom_llm_provider) if effort_used: betas.append(ANTHROPIC_EFFORT_BETA_HEADER) # effort-2025-11-24 @@ -643,7 +689,7 @@ class AnthropicModelInfo(BaseLLMModelInfo): tool_search_used = self.is_tool_search_used(tools=tools) programmatic_tool_calling_used = self.is_programmatic_tool_calling_used(tools=tools) input_examples_used = self.is_input_examples_used(tools=tools) - effort_used = self.is_effort_used(optional_params=optional_params, model=model) + effort_used = self.is_effort_used(optional_params=optional_params, model=model, custom_llm_provider="anthropic") code_execution_tool_used = self.is_code_execution_tool_used(tools=tools) container_with_skills_used = self.is_container_with_skills_used(optional_params=optional_params) user_anthropic_beta_headers = self._get_user_anthropic_beta_headers( @@ -860,16 +906,17 @@ def strip_advisor_blocks_from_messages(messages: List[Any], replace_with_text: b def is_anthropic_invalid_thinking_signature_error(error_text: str) -> bool: """ - Detect Anthropic 400 when encrypted thinking signatures in history do not match - the current deployment (e.g. user rotated API key or switched model endpoint). + Detect Anthropic 400 errors caused by missing or invalid thinking signatures. - Example API message: + Known error formats: + {"message":"messages.2.content.0.thinking.signature.str: Input should be a valid string"} + messages.N.content.M.thinking.signature.str: Input should be a valid string messages.N.content.M: Invalid `signature` in `thinking` block """ if not error_text: return False lower = error_text.lower() - return "invalid" in lower and "signature" in lower and "thinking" in lower and "block" in lower + return "thinking" in lower and "signature" in lower and ("invalid" in lower or "valid string" in lower) def strip_thinking_blocks_from_anthropic_messages(messages: List[Any]) -> List[Any]: diff --git a/litellm/llms/anthropic/experimental_pass_through/adapters/streaming_iterator.py b/litellm/llms/anthropic/experimental_pass_through/adapters/streaming_iterator.py index 44c367ee805..853bea636af 100644 --- a/litellm/llms/anthropic/experimental_pass_through/adapters/streaming_iterator.py +++ b/litellm/llms/anthropic/experimental_pass_through/adapters/streaming_iterator.py @@ -13,14 +13,18 @@ from typing import ( List, Literal, Optional, + get_args, ) +from typing_extensions import assert_never + from litellm._logging import verbose_logger from litellm._uuid import uuid from litellm.types.llms.anthropic import ( AppliedEdit, CompactionBlock, ContextManagementResponse, + StreamingContentBlockDeltaType, UsageDelta, UsageIteration, ) @@ -30,6 +34,23 @@ if TYPE_CHECKING: from litellm.types.utils import ModelResponseStream +_STREAMING_DELTA_TYPES = frozenset(get_args(StreamingContentBlockDeltaType)) + + +def _delta_payload_field(delta_type: StreamingContentBlockDeltaType) -> str: + match delta_type: + case "text_delta": + return "text" + case "input_json_delta": + return "partial_json" + case "thinking_delta": + return "thinking" + case "signature_delta": + return "signature" + case _: + assert_never(delta_type) + + class _CombinedChunkSplitter: """ Splits a streaming chunk that carries BOTH response content and a @@ -372,24 +393,25 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper): if compaction_event is not None: return compaction_event - if self.sent_content_block_start is False: - self.sent_content_block_start = True - self.sent_content_block_finish = False - self.chunk_queue.append( - { - "type": "content_block_start", - "index": self.current_content_block_index, - "content_block": {"type": "text", "text": ""}, - } - ) - return self.chunk_queue.popleft() - for chunk in self.completion_stream: if chunk == "None" or chunk is None: raise Exception should_start_new_block = self._should_start_new_content_block(chunk) - if should_start_new_block: + is_opening_first_block = self.sent_content_block_start is False + if is_opening_first_block and self._is_blank_delta(chunk): + continue + if is_opening_first_block: + self.sent_content_block_start = True + self.sent_content_block_finish = False + self.chunk_queue.append( + { + "type": "content_block_start", + "index": self.current_content_block_index, + "content_block": self.current_content_block_start, + } + ) + elif should_start_new_block: self._increment_content_block_index() # applied_edits only needs to flow to the final message_delta @@ -426,7 +448,7 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper): # ``not self.queued_usage_chunk``. continue - if should_start_new_block and not self.sent_content_block_finish: + if should_start_new_block and not is_opening_first_block and not self.sent_content_block_finish: # Queue the sequence: content_block_stop -> content_block_start # -> (optionally) the trigger chunk's delta. # @@ -458,12 +480,15 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper): # 3. If the trigger chunk carries delta content, queue it # so the first delta of the new block is not silently dropped. - if self._trigger_delta_has_content(processed_chunk): + if self._delta_has_content(processed_chunk): self.chunk_queue.append(processed_chunk) self.sent_content_block_finish = False return self.chunk_queue.popleft() + if processed_chunk["type"] == "content_block_delta" and not self._delta_has_content(processed_chunk): + continue + if processed_chunk["type"] == "message_delta" and self.sent_content_block_finish is False: # Queue both the content_block_stop and the message_delta self.chunk_queue.append( @@ -591,25 +616,25 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper): if compaction_event is not None: return compaction_event - if self.sent_content_block_start is False: - self.sent_content_block_start = True - self.sent_content_block_finish = False - self.chunk_queue.append( - { - "type": "content_block_start", - "index": self.current_content_block_index, - "content_block": {"type": "text", "text": ""}, - } - ) - return self.chunk_queue.popleft() - async for chunk in self.completion_stream: if chunk == "None" or chunk is None: raise Exception - # Check if we need to start a new content block should_start_new_block = self._should_start_new_content_block(chunk) - if should_start_new_block: + is_opening_first_block = self.sent_content_block_start is False + if is_opening_first_block and self._is_blank_delta(chunk): + continue + if is_opening_first_block: + self.sent_content_block_start = True + self.sent_content_block_finish = False + self.chunk_queue.append( + { + "type": "content_block_start", + "index": self.current_content_block_index, + "content_block": self.current_content_block_start, + } + ) + elif should_start_new_block: self._increment_content_block_index() # applied_edits only needs to flow to the final message_delta @@ -640,7 +665,7 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper): # Check if this processed chunk has a stop_reason - hold it for next chunk if not self.queued_usage_chunk: - if should_start_new_block and not self.sent_content_block_finish: + if should_start_new_block and not is_opening_first_block and not self.sent_content_block_finish: # Queue the sequence: content_block_stop -> content_block_start # -> (optionally) the trigger chunk's delta. # @@ -670,13 +695,18 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper): # 3. If the trigger chunk carries delta content, queue it # so the first delta of the new block is not silently dropped. - if self._trigger_delta_has_content(processed_chunk): + if self._delta_has_content(processed_chunk): self.chunk_queue.append(processed_chunk) # Reset state for new block self.sent_content_block_finish = False return self.chunk_queue.popleft() + if processed_chunk["type"] == "content_block_delta" and not self._delta_has_content( + processed_chunk + ): + continue + if processed_chunk["type"] == "message_delta" and self.sent_content_block_finish is False: # Queue both the content_block_stop and the holding chunk self.chunk_queue.append( @@ -808,20 +838,33 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper): self.current_content_block_index += 1 @staticmethod - def _trigger_delta_has_content(processed_chunk: Dict[str, Any]) -> bool: - """Return True if a translated trigger chunk carries a non-empty - ``content_block_delta`` payload that must be re-emitted after a - block transition. + def _delta_has_content(processed_chunk: Dict[str, Any]) -> bool: + """Return True if a translated chunk carries a non-empty + ``content_block_delta`` payload. - When an upstream chunk both *triggers* a new content block (its type - differs from the active block) and *carries* delta content, that - content belongs to the new block. The synthesized - ``content_block_start`` only ever carries an empty body — see + Gates every ``content_block_delta`` emission. An empty delta carries + no information, and the translate fallback types empty deltas as + ``text_delta`` regardless of the active block's type — emitting one + into an open ``thinking`` block (e.g. Bedrock Converse sends an empty + reasoning delta mid-block) crashes strict Anthropic SDK clients with + "Content block is not a text block". + + Also gates re-emission after a block transition: when an upstream + chunk both *triggers* a new content block (its type differs from the + active block) and *carries* delta content, that content belongs to + the new block. The synthesized ``content_block_start`` only ever + carries an empty body — see ``_translate_streaming_openai_chunk_to_anthropic_content_block``, which returns an empty ``TextBlock``/``ToolUseBlock``/thinking block — so the trigger chunk's delta must be re-queued or the first token of the new block (the first non-empty text/thinking delta, or bundled tool arguments) is silently dropped. + + Delta types outside ``StreamingContentBlockDeltaType`` — the closed + set the translate layer can produce — are treated as empty. The + per-type payload lookup is exhaustively matched against that set in + ``_delta_payload_field``, so extending the translate layer with a new + delta type fails type-checking here until it is handled. """ if processed_chunk.get("type") != "content_block_delta": return False @@ -829,15 +872,25 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper): if not isinstance(delta, dict): return False delta_type = delta.get("type") - if delta_type == "text_delta": - return bool(delta.get("text")) - if delta_type == "input_json_delta": - return bool(delta.get("partial_json")) - if delta_type == "thinking_delta": - return bool(delta.get("thinking")) - if delta_type == "signature_delta": - return bool(delta.get("signature")) - return False + if delta_type not in _STREAMING_DELTA_TYPES: + return False + return bool(delta.get(_delta_payload_field(delta_type))) + + @staticmethod + def _is_blank_delta(chunk: "ModelResponseStream") -> bool: + choice = chunk.choices[0] + if choice.finish_reason is not None: + return False + delta = choice.delta + if getattr(delta, "tool_calls", None): + return False + if getattr(delta, "content", None): + return False + if getattr(delta, "reasoning_content", None): + return False + if getattr(delta, "thinking_blocks", None): + return False + return True def _should_start_new_content_block(self, chunk: "ModelResponseStream") -> bool: """ diff --git a/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py b/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py index 4c981dd36b3..86c9c1db481 100644 --- a/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py +++ b/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py @@ -104,6 +104,7 @@ from litellm.types.llms.anthropic import ( ContextManagementResponse, MessageBlockDelta, MessageDelta, + StreamingContentBlockDeltaType, UsageDelta, UsageIteration, ) @@ -330,6 +331,7 @@ class LiteLLMAnthropicMessagesAdapter: "thinking", "output_format", "output_config", + "stop_sequences", ] def _is_web_search_tool(self, tool: Dict[str, Any]) -> bool: @@ -614,7 +616,7 @@ class LiteLLMAnthropicMessagesAdapter: thinking_type = thinking.get("type", "disabled") if thinking_type == "disabled": - return None + return "none" elif thinking_type == "enabled": return reasoning_effort_from_thinking_budget(thinking.get("budget_tokens", 0)) elif thinking_type == "adaptive": @@ -682,25 +684,37 @@ class LiteLLMAnthropicMessagesAdapter: thinking ) if reasoning_effort: - summary = thinking.get("summary") if isinstance(thinking, dict) else None - auto_summary = is_reasoning_auto_summary_enabled() - if summary: - return { - "reasoning_effort": { - "effort": reasoning_effort, - "summary": summary, - } - } - elif auto_summary: - return { - "reasoning_effort": { - "effort": reasoning_effort, - "summary": "detailed", - } - } - return {"reasoning_effort": reasoning_effort} + return { + "reasoning_effort": LiteLLMAnthropicMessagesAdapter._apply_reasoning_summary_wrapping( + reasoning_effort, thinking + ) + } return {} + @staticmethod + def _apply_reasoning_summary_wrapping( + reasoning_effort: str, + thinking: Dict[str, Any], + ) -> Any: + """ + Apply the reasoning_effort/summary wrapping rules shared by every + thinking->reasoning_effort translation path. + + Disabled thinking always stays a plain string - there's no reasoning + trace to summarize, and non-Claude providers (e.g. Fireworks) expect + reasoning_effort as a plain string, not a summary dict. + """ + thinking_type = thinking.get("type") if isinstance(thinking, dict) else None + if thinking_type == "disabled": + return reasoning_effort + + summary = thinking.get("summary") if isinstance(thinking, dict) else None + if summary: + return {"effort": reasoning_effort, "summary": summary} + if is_reasoning_auto_summary_enabled(): + return {"effort": reasoning_effort, "summary": "detailed"} + return reasoning_effort + def translate_anthropic_tool_choice_to_openai( self, tool_choice: AnthropicMessagesToolChoice ) -> ChatCompletionToolChoiceValues: @@ -918,6 +932,18 @@ class LiteLLMAnthropicMessagesAdapter: tool_choice=cast(AnthropicMessagesToolChoice, tool_choice) ) + def _translate_stop_sequences_to_openai( + self, + anthropic_message_request: AnthropicMessagesRequest, + new_kwargs: ChatCompletionRequest, + ) -> None: + if "stop_sequences" not in anthropic_message_request: + return + stop_sequences = anthropic_message_request["stop_sequences"] + if not stop_sequences: + return + new_kwargs["stop"] = stop_sequences + def _translate_tools_to_openai( self, anthropic_message_request: AnthropicMessagesRequest, @@ -975,32 +1001,17 @@ class LiteLLMAnthropicMessagesAdapter: if not reasoning_effort: return + thinking_type = thinking.get("type") if isinstance(thinking, dict) else None + # For adaptive thinking, override with output_config.effort if available - if isinstance(thinking, dict) and thinking.get("type") == "adaptive": + if thinking_type == "adaptive": output_config = anthropic_message_request.get("output_config") if isinstance(output_config, dict) and output_config.get("effort"): reasoning_effort = output_config["effort"] - summary = thinking.get("summary") if isinstance(thinking, dict) else None - auto_summary = is_reasoning_auto_summary_enabled() - if summary: - new_kwargs["reasoning_effort"] = cast( - Any, - { - "effort": reasoning_effort, - "summary": summary, - }, - ) - elif auto_summary: - new_kwargs["reasoning_effort"] = cast( - Any, - { - "effort": reasoning_effort, - "summary": "detailed", - }, - ) - else: - new_kwargs["reasoning_effort"] = reasoning_effort + new_kwargs["reasoning_effort"] = self._apply_reasoning_summary_wrapping( + reasoning_effort, cast(Dict[str, Any], thinking) + ) def _translate_output_format_to_openai( self, @@ -1097,6 +1108,11 @@ class LiteLLMAnthropicMessagesAdapter: anthropic_message_request=anthropic_message_request, new_kwargs=new_kwargs, ) + ## CONVERT STOP_SEQUENCES + self._translate_stop_sequences_to_openai( + anthropic_message_request=anthropic_message_request, + new_kwargs=new_kwargs, + ) ## CONVERT OUTPUT_FORMAT to RESPONSE_FORMAT self._translate_output_format_to_openai( anthropic_message_request=anthropic_message_request, @@ -1402,11 +1418,6 @@ class LiteLLMAnthropicMessagesAdapter: assert isinstance(thinking, str) assert isinstance(signature, str) - if thinking and signature: - raise ValueError( - "Both `thinking` and `signature` in a single streaming chunk isn't supported." - ) - return "thinking", ChatCompletionThinkingBlock( type="thinking", thinking=thinking, signature=signature ) @@ -1423,7 +1434,7 @@ class LiteLLMAnthropicMessagesAdapter: def _translate_streaming_openai_chunk_to_anthropic( self, choices: List[Union[OpenAIStreamingChoice, StreamingChoices]] ) -> Tuple[ - Literal["text_delta", "input_json_delta", "thinking_delta", "signature_delta"], + StreamingContentBlockDeltaType, Union[ ContentTextBlockDelta, ContentJsonBlockDelta, @@ -1462,17 +1473,14 @@ class LiteLLMAnthropicMessagesAdapter: if choice.delta.reasoning_content is not None: reasoning_content += choice.delta.reasoning_content - if reasoning_content and reasoning_signature: - raise ValueError("Both `reasoning` and `signature` in a single streaming chunk isn't supported.") - if partial_json is not None: return "input_json_delta", ContentJsonBlockDelta(type="input_json_delta", partial_json=partial_json) - elif reasoning_content: - return "thinking_delta", ContentThinkingBlockDelta(type="thinking_delta", thinking=reasoning_content) elif reasoning_signature: return "signature_delta", ContentThinkingSignatureBlockDelta( type="signature_delta", signature=reasoning_signature ) + elif reasoning_content: + return "thinking_delta", ContentThinkingBlockDelta(type="thinking_delta", thinking=reasoning_content) else: return "text_delta", ContentTextBlockDelta(type="text_delta", text=text) diff --git a/litellm/llms/anthropic/experimental_pass_through/messages/handler.py b/litellm/llms/anthropic/experimental_pass_through/messages/handler.py index dd983f0c344..1a4144de39e 100644 --- a/litellm/llms/anthropic/experimental_pass_through/messages/handler.py +++ b/litellm/llms/anthropic/experimental_pass_through/messages/handler.py @@ -36,6 +36,7 @@ from litellm.types.llms.anthropic_messages.anthropic_response import ( AnthropicMessagesResponse, ) from litellm.types.router import GenericLiteLLMParams +from litellm.types.utils import CallTypes from litellm.utils import ProviderConfigManager, client from ..utils import is_reasoning_auto_summary_enabled @@ -236,7 +237,9 @@ async def anthropic_messages( AnthropicCacheControlHook, ) - messages, system = AnthropicCacheControlHook.maybe_inject_cache_control(messages, system, kwargs) + messages, system = AnthropicCacheControlHook.maybe_inject_cache_control( + messages, system, kwargs, model=model, custom_llm_provider=custom_llm_provider, tools=tools + ) original_stream = stream or kwargs.get("_websearch_interception_converted_stream", False) @@ -425,7 +428,9 @@ def anthropic_messages_handler( AnthropicCacheControlHook, ) - messages, system = AnthropicCacheControlHook.maybe_inject_cache_control(messages, system, kwargs) + messages, system = AnthropicCacheControlHook.maybe_inject_cache_control( + messages, system, kwargs, model=model, custom_llm_provider=custom_llm_provider, tools=tools + ) metadata = validate_anthropic_api_metadata(metadata) @@ -463,6 +468,9 @@ def anthropic_messages_handler( "model": original_model, "custom_llm_provider": custom_llm_provider, } + litellm_logging_obj.model_call_details.setdefault("litellm_params", {})[CallTypes.aanthropic_messages.value] = ( + is_async + ) # Check if stream was converted for WebSearch interception # This is set in the async wrapper above when stream=True is converted to stream=False @@ -477,6 +485,41 @@ def anthropic_messages_handler( mock_response=litellm_params.mock_response, ) + # Expand litellm_proxy MCP references through the MCP gateway before dispatch, so every + # downstream path (native passthrough and both bridges) gets real tools rather than a + # reference the provider cannot resolve. Popped from kwargs so it never reaches the provider. + skip_mcp_handler = kwargs.pop("_skip_mcp_handler", False) + if not skip_mcp_handler and tools: + from litellm.llms.anthropic.experimental_pass_through.messages.mcp_handler import ( + anthropic_messages_with_mcp, + ) + from litellm.responses.mcp.litellm_proxy_mcp_handler import ( + LiteLLM_Proxy_MCP_Handler, + ) + + if LiteLLM_Proxy_MCP_Handler._should_use_litellm_mcp_gateway(tools=tools): + return anthropic_messages_with_mcp( + max_tokens=max_tokens, + messages=messages, + model=model, + metadata=metadata, + stop_sequences=stop_sequences, + stream=stream, + system=system, + temperature=temperature, + thinking=thinking, + tool_choice=tool_choice, + tools=tools, + top_k=top_k, + top_p=top_p, + container=container, + api_key=api_key, + api_base=api_base, + client=client, + custom_llm_provider=custom_llm_provider, + **kwargs, + ) + anthropic_messages_provider_config: Optional[BaseAnthropicMessagesConfig] = None if custom_llm_provider is not None and custom_llm_provider in [provider.value for provider in LlmProviders]: diff --git a/litellm/llms/anthropic/experimental_pass_through/messages/interceptors/advisor.py b/litellm/llms/anthropic/experimental_pass_through/messages/interceptors/advisor.py index 79faa39c7a2..a36f825951a 100644 --- a/litellm/llms/anthropic/experimental_pass_through/messages/interceptors/advisor.py +++ b/litellm/llms/anthropic/experimental_pass_through/messages/interceptors/advisor.py @@ -21,6 +21,7 @@ import litellm import litellm.constants as _c from litellm.litellm_core_utils.url_utils import validate_url from litellm.llms.anthropic.common_utils import strip_advisor_blocks_from_messages +from litellm.router_utils.cooldown_handlers import mark_advisor_orchestration_failure from litellm.types.llms.anthropic_messages.anthropic_response import ( AnthropicMessagesResponse, ) @@ -124,30 +125,36 @@ class AdvisorOrchestrationHandler(MessagesInterceptor): iteration += 1 if iteration > max_uses: - raise AdvisorMaxIterationsError( + max_iterations_error = AdvisorMaxIterationsError( f"Advisor orchestration loop exceeded max_uses={max_uses}. " "Increase max_uses in the advisor tool definition or cap the request." ) + mark_advisor_orchestration_failure(max_iterations_error) + raise max_iterations_error # --- Build advisor context --- advisor_messages = _build_advisor_context(current_messages, executor_response, advisor_use_block) # --- Advisor sub-call (always non-streaming, no tools) --- - advisor_response: AnthropicMessagesResponse = await _call_messages_handler( - model=advisor_model, - messages=advisor_messages, - tools=None, - stream=False, - max_tokens=max_tokens, - custom_llm_provider=None, # let litellm resolve from model name - metadata={ - **metadata_base, - "advisor_sub_call": True, - "parent_request_id": parent_request_id, - }, - api_key=advisor_api_key, - api_base=advisor_api_base, - ) + try: + advisor_response: AnthropicMessagesResponse = await _call_messages_handler( + model=advisor_model, + messages=advisor_messages, + tools=None, + stream=False, + max_tokens=max_tokens, + custom_llm_provider=None, # let litellm resolve from model name + metadata={ + **metadata_base, + "advisor_sub_call": True, + "parent_request_id": parent_request_id, + }, + api_key=advisor_api_key, + api_base=advisor_api_base, + ) + except Exception as advisor_sub_call_exception: + mark_advisor_orchestration_failure(advisor_sub_call_exception) + raise advisor_text = _extract_response_text(advisor_response) diff --git a/litellm/llms/anthropic/experimental_pass_through/messages/mcp_handler.py b/litellm/llms/anthropic/experimental_pass_through/messages/mcp_handler.py new file mode 100644 index 00000000000..813d4a62089 --- /dev/null +++ b/litellm/llms/anthropic/experimental_pass_through/messages/mcp_handler.py @@ -0,0 +1,176 @@ +""" +MCP gateway support for the Anthropic `/v1/messages` API. + +Mirrors ``litellm.responses.mcp.chat_completions_handler`` but speaks the +Anthropic Messages shapes: tools carry an ``input_schema``, the model asks for a +tool through a ``tool_use`` content block, and results are fed back as +``tool_result`` blocks in a user message. +""" + +from typing import Any, AsyncIterator, Mapping, Sequence, Union + +from litellm._logging import verbose_logger +from litellm.responses.mcp.request_context import MCPRequestContext +from litellm.types.llms.anthropic import ( + AnthropicMessagesTool, + AnthropicMessagesToolResultParam, + AnthropicMessagesUserMessageParam, +) +from litellm.types.llms.anthropic_messages.anthropic_response import ( + AnthropicMessagesResponse, +) + +MAX_MCP_TOOL_USE_ITERATIONS = 10 + + +def _get_response_content(response: AnthropicMessagesResponse) -> Sequence[Mapping[str, Any]]: + content = response.get("content") + if not isinstance(content, list): + return () + return tuple(block for block in content if isinstance(block, dict)) + + +def _extract_tool_use_blocks(response: AnthropicMessagesResponse) -> Sequence[Mapping[str, Any]]: + """Return the ``tool_use`` content blocks the model emitted.""" + return tuple(block for block in _get_response_content(response) if block.get("type") == "tool_use") + + +def _get_stop_reason(response: AnthropicMessagesResponse) -> Union[str, None]: + stop_reason = response.get("stop_reason") + return stop_reason if isinstance(stop_reason, str) else None + + +def _build_tool_result_message(tool_results: Sequence[Mapping[str, Any]]) -> AnthropicMessagesUserMessageParam: + """Turn executed tool results into the user message Anthropic expects.""" + return AnthropicMessagesUserMessageParam( + role="user", + content=tuple( + AnthropicMessagesToolResultParam( + type="tool_result", + tool_use_id=str(result.get("tool_call_id") or ""), + content=str(result.get("result") or ""), + ) + for result in tool_results + ), + ) + + +async def anthropic_messages_with_mcp( + max_tokens: int, + messages: Sequence[Mapping[str, Any]], + model: str, + tools: Union[Sequence[Mapping[str, Any]], None] = None, + **kwargs: Any, # kwargs-ok: forwarded verbatim to litellm.anthropic_messages, which owns the param contract +) -> Union[AnthropicMessagesResponse, AsyncIterator[Any]]: + """ + Expand litellm_proxy MCP references for `/v1/messages` and run the tool loop. + + The MCP gateway owns the expansion so the reference resolves against the + caller's own credentials and access control, rather than being handed to the + upstream provider as a url it cannot reach. + """ + import litellm + from litellm.experimental_mcp_client.tools import ( + transform_mcp_tool_to_anthropic_tool, + ) + from litellm.responses.mcp.litellm_proxy_mcp_handler import ( + LiteLLM_Proxy_MCP_Handler, + ) + + mcp_references, other_tools = LiteLLM_Proxy_MCP_Handler._parse_mcp_tools(tools) + + if not mcp_references: + return await litellm.anthropic_messages( + max_tokens=max_tokens, + messages=list(messages), + model=model, + tools=list(tools) if tools else None, + _skip_mcp_handler=True, + **kwargs, + ) + + context = MCPRequestContext.resolve(kwargs=dict(kwargs), tools=tools) + + ( + deduplicated_mcp_tools, + tool_server_map, + ) = await LiteLLM_Proxy_MCP_Handler._process_mcp_tools_without_openai_transform( + context.user_api_key_auth, + mcp_references, + litellm_trace_id=context.litellm_trace_id, + mcp_auth_header=context.mcp_auth_header, + mcp_server_auth_headers=context.mcp_server_auth_headers, + request_tags=list(context.request_tags) if context.request_tags else None, + ) + + anthropic_tools: Sequence[AnthropicMessagesTool] = tuple( + transform_mcp_tool_to_anthropic_tool(mcp_tool) for mcp_tool in deduplicated_mcp_tools + ) + all_tools = [*anthropic_tools, *(other_tools or ())] + + should_auto_execute = LiteLLM_Proxy_MCP_Handler._should_auto_execute_tools( + mcp_tools_with_litellm_proxy=mcp_references + ) + stream = bool(kwargs.pop("stream", False)) + + base_call_args: Mapping[str, Any] = { + "max_tokens": max_tokens, + "model": model, + "tools": all_tools or None, + "_skip_mcp_handler": True, + **kwargs, + } + + if not should_auto_execute: + return await litellm.anthropic_messages(messages=list(messages), stream=stream, **base_call_args) + + working_messages: Sequence[Mapping[str, Any]] = tuple(messages) + response: AnthropicMessagesResponse = await litellm.anthropic_messages( + messages=list(working_messages), stream=False, **base_call_args + ) + + for _ in range(MAX_MCP_TOOL_USE_ITERATIONS): + if _get_stop_reason(response) != "tool_use": + break + + tool_use_blocks = _extract_tool_use_blocks(response) + if not tool_use_blocks: + break + + tool_results = await LiteLLM_Proxy_MCP_Handler._execute_tool_calls( + tool_server_map=tool_server_map, + tool_calls=list(tool_use_blocks), + user_api_key_auth=context.user_api_key_auth, + mcp_auth_header=context.mcp_auth_header, + mcp_server_auth_headers=context.mcp_server_auth_headers, + oauth2_headers=context.oauth2_headers, + raw_headers=context.raw_headers, + litellm_call_id=context.litellm_call_id, + litellm_trace_id=context.litellm_trace_id, + request_tags=list(context.request_tags) if context.request_tags else None, + ) + + # Every tool call was skipped, so there is nothing to feed back; a + # tool_result message with empty content is rejected by Anthropic. + if not tool_results: + break + + working_messages = ( + *working_messages, + {"role": "assistant", "content": list(_get_response_content(response))}, + _build_tool_result_message(tool_results), + ) + response = await litellm.anthropic_messages(messages=list(working_messages), stream=False, **base_call_args) + else: + verbose_logger.warning( + f"MCP tool loop hit its {MAX_MCP_TOOL_USE_ITERATIONS} iteration cap for model {model}; " + "returning the last response" + ) + + if stream: + from litellm.llms.anthropic.experimental_pass_through.messages.fake_stream_iterator import ( + FakeAnthropicMessagesStreamIterator, + ) + + return FakeAnthropicMessagesStreamIterator(response) + return response diff --git a/litellm/llms/anthropic/experimental_pass_through/messages/transformation.py b/litellm/llms/anthropic/experimental_pass_through/messages/transformation.py index e78802a1587..b2cef62cc50 100644 --- a/litellm/llms/anthropic/experimental_pass_through/messages/transformation.py +++ b/litellm/llms/anthropic/experimental_pass_through/messages/transformation.py @@ -32,8 +32,22 @@ from ...common_utils import ( DEFAULT_ANTHROPIC_API_VERSION = "2023-06-01" +DROP_UNSUPPORTED_ADAPTIVE_EFFORT_WARNING = ( + "Dropping adaptive `thinking`/`output_config.effort` for model=%s: the model " + "does not support extended thinking, or max_tokens is too small to fit the " + "minimum thinking budget." +) + class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): + @property + def custom_llm_provider(self) -> Optional[str]: + return "anthropic" + + @property + def _resolved_provider(self) -> str: + return self.custom_llm_provider or "anthropic" + def get_supported_anthropic_messages_params(self, model: str) -> list: return [ "messages", @@ -130,6 +144,76 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): else: return system_param + @staticmethod + def _as_system_content_blocks(value: Any) -> list: + if value is None: + return [] + if isinstance(value, list): + return list(value) + if isinstance(value, str): + return [{"type": "text", "text": value}] + return [value] + + @staticmethod + def _is_system_role_message(message: Any) -> bool: + return isinstance(message, dict) and message.get("role") == "system" + + def _normalize_system_role_messages(self, anthropic_messages_request: dict, model: str) -> None: + """Move ``role: "system"`` entries out of ``messages`` per the Anthropic + ``/v1/messages`` contract, which the first-party API, Bedrock Invoke, + Vertex, and Azure Foundry all enforce identically. + + A *leading* run of system entries is rejected on every model ("messages.0: + use the top-level 'system' parameter for the initial system prompt") and + must be hoisted into the top-level ``system`` field. Models flagged + ``supports_mid_conversation_system`` in the cost map (Claude 4.8+ and the + 5 family) accept a *mid-conversation* entry (e.g. Claude Code's + ``mid-conversation-system-2026-04-07`` reminders) in place, where it MUST + stay: hoisting one mutates the ``system`` prefix and invalidates the + prompt cache for the whole message history. Older Claude models reject the + role in every position ("role 'system' is not supported on this model"), + so without the flag every system entry is hoisted to keep the request from + 400-ing. Billing-header system blocks are stripped from the top-level + ``system`` field regardless of whether anything was hoisted. + + Subclasses whose upstream rejects the role opt in by calling this from + their ``transform_anthropic_messages_request``; the first-party Anthropic + path forwards ``messages`` untouched and never calls it.""" + from litellm.utils import _supports_factory + + messages = anthropic_messages_request.get("messages") + if not isinstance(messages, list): + return + if _supports_factory( + model=model, + custom_llm_provider=self.custom_llm_provider, + key="supports_mid_conversation_system", + ): + leading_count = next( + (i for i, m in enumerate(messages) if not self._is_system_role_message(m)), + len(messages), + ) + hoisted = messages[:leading_count] + remaining = messages[leading_count:] + else: + hoisted = [m for m in messages if self._is_system_role_message(m)] + remaining = [m for m in messages if not self._is_system_role_message(m)] + if hoisted: + anthropic_messages_request["messages"] = remaining + system_content = [ + block + for source in ( + anthropic_messages_request.get("system"), + *(m.get("content") for m in hoisted), + ) + for block in self._as_system_content_blocks(source) + ] + filtered_system = self._filter_billing_headers_from_system(system_content) + if filtered_system: + anthropic_messages_request["system"] = filtered_system + else: + anthropic_messages_request.pop("system", None) + def get_complete_url( self, api_base: Optional[str], @@ -174,7 +258,7 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): return headers, api_base @staticmethod - def _translate_reasoning_effort_to_anthropic(model: str, optional_params: Dict) -> None: + def _translate_reasoning_effort_to_anthropic(model: str, optional_params: Dict, custom_llm_provider: str) -> None: """Map OpenAI-style ``reasoning_effort`` to native Anthropic params. Caller-supplied ``thinking`` / ``output_config`` win over the alias. @@ -191,7 +275,11 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): return try: - mapped_thinking = AnthropicConfig._map_reasoning_effort(reasoning_effort=reasoning_effort, model=model) + mapped_thinking = AnthropicConfig._map_reasoning_effort( + reasoning_effort=reasoning_effort, + model=model, + custom_llm_provider=custom_llm_provider, + ) except _BadRequestError as e: raise AnthropicError(message=str(e.message), status_code=400) @@ -201,7 +289,7 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): return optional_params.setdefault("thinking", mapped_thinking) - if AnthropicModelInfo._is_adaptive_thinking_model(model): + if AnthropicModelInfo._is_adaptive_thinking_model(model, custom_llm_provider): mapped_effort = REASONING_EFFORT_TO_OUTPUT_CONFIG_EFFORT.get(reasoning_effort) if mapped_effort is None: raise AnthropicError( @@ -212,7 +300,7 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): ), status_code=400, ) - gate_error = AnthropicConfig._validate_effort_for_model(model, mapped_effort) + gate_error = AnthropicConfig._validate_effort_for_model(model, mapped_effort, custom_llm_provider) if gate_error is not None: raise AnthropicError(message=gate_error, status_code=400) existing_output_config = optional_params.get("output_config") @@ -222,13 +310,15 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): optional_params["output_config"] = existing_output_config @staticmethod - def _translate_legacy_thinking_for_adaptive_model(model: str, optional_params: Dict) -> None: + def _translate_legacy_thinking_for_adaptive_model( + model: str, optional_params: Dict, custom_llm_provider: str + ) -> None: """Translate legacy ``thinking.type=enabled`` to adaptive for 4.6/4.7. Caller-provided ``output_config.effort`` is never overridden. """ from litellm.llms.anthropic.chat.transformation import AnthropicConfig - if not AnthropicModelInfo._is_adaptive_thinking_model(model): + if not AnthropicModelInfo._is_adaptive_thinking_model(model, custom_llm_provider): return thinking = optional_params.get("thinking") if not isinstance(thinking, dict) or thinking.get("type") != "enabled": @@ -236,7 +326,7 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): budget = int(thinking.get("budget_tokens") or 0) if budget >= DEFAULT_REASONING_EFFORT_XHIGH_THINKING_BUDGET and ( - AnthropicConfig._supports_effort_level(model, "xhigh") + AnthropicConfig._supports_effort_level(model, "xhigh", custom_llm_provider) ): effort = "xhigh" elif budget >= DEFAULT_REASONING_EFFORT_HIGH_THINKING_BUDGET: @@ -253,6 +343,138 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): existing_output_config.setdefault("effort", effort) optional_params["output_config"] = existing_output_config + @staticmethod + def _translate_adaptive_effort_for_non_adaptive_model( + model: str, optional_params: Dict, max_tokens: Optional[int], custom_llm_provider: str + ) -> None: + """Translate the 4.6+ adaptive-thinking interface (``thinking.type=adaptive`` + and/or ``output_config.effort``) down to what an older Anthropic model + supports. Clients like Claude Code send this interface unconditionally, so + without translation it reaches a pre-4.6 model and Anthropic rejects it with + "This model does not support the effort parameter". + + The reshape is silent, matching how the messages path already strips + unsupported ``output_config`` for older models (bedrock invoke, issue + #22797): the goal is to keep the request working, not to fail it. + + ``thinking.type=adaptive`` and ``output_config.effort`` are independent + capabilities. Adaptive thinking needs ``supports_adaptive_thinking`` (4.6+); + ``output_config.effort`` needs ``supports_output_config``, which some + non-adaptive models (e.g. Claude Opus 4.5) advertise on its own. So the two + are handled separately: + + - Adaptive-thinking models (4.6+): both are native, left untouched. + - ``supports_output_config`` but non-adaptive (Opus 4.5): keep + ``output_config.effort`` (native), only drop the unsupported adaptive + ``thinking`` block. When adaptive thinking is being dropped and the + effort level itself isn't supported by the model (e.g. ``xhigh``/``max`` + on Opus 4.5, which only accepts low/medium/high, while ``xhigh`` is + Claude Code's default), fall through to the legacy translation below + instead of forwarding a level Anthropic would reject. Effort-only + requests are always left untouched: provider subclasses own their level + normalization (bedrock clamps ``xhigh`` to the model's ceiling after + this base transform runs). + - Thinking-capable but neither (``supports_reasoning``, e.g. Haiku/Sonnet + 4.5): map effort to legacy ``thinking={type: enabled, budget_tokens}`` via + ``AnthropicConfig._map_reasoning_effort``, capped below ``max_tokens`` + (Anthropic requires ``max_tokens > budget_tokens``) and dropped when + ``max_tokens`` can't fit even the minimum budget. + - No reasoning support: ``thinking`` is dropped. + + For the last two, only the consumed ``effort`` key is removed from + ``output_config``; any residual (e.g. ``format``) is left for provider + subclasses to handle. + """ + from litellm.exceptions import BadRequestError as _BadRequestError + from litellm.llms.anthropic.chat.transformation import AnthropicConfig + + if AnthropicConfig._is_adaptive_thinking_model(model, custom_llm_provider): + return + + output_config = optional_params.get("output_config") + thinking = optional_params.get("thinking") + effort = output_config.get("effort") if isinstance(output_config, dict) else None + adaptive_thinking = isinstance(thinking, dict) and thinking.get("type") == "adaptive" + if effort is None and not adaptive_thinking: + return + + # Models that natively accept `output_config.effort` but are not adaptive (Claude Opus 4.5). + # Keep the native effort and only drop the adaptive `thinking` block, which these models + # reject. Effort-only requests pass through so provider subclasses (bedrock/vertex) keep + # owning level clamping; an adaptive request only stays here when its effort level is one + # the model supports, otherwise it falls through to the legacy budget translation below. + if AnthropicConfig._model_supports_effort_param(model, custom_llm_provider) and ( + not adaptive_thinking + or AnthropicConfig._validate_effort_for_model(model, effort, custom_llm_provider) is None + ): + if adaptive_thinking: + optional_params.pop("thinking", None) + return + + supports_thinking = AnthropicModelInfo._supports_model_capability( + model, "supports_reasoning", custom_llm_provider + ) + try: + legacy_thinking = ( + AnthropicConfig._map_reasoning_effort( + reasoning_effort=effort or "medium", + model=model, + custom_llm_provider=custom_llm_provider, + ) + if supports_thinking + else None + ) + except _BadRequestError as e: + raise AnthropicError(message=str(e.message), status_code=400) + capped_thinking = ( + AnthropicConfig._cap_thinking_budget_to_max_tokens(legacy_thinking, max_tokens) + if legacy_thinking is not None + else None + ) + + if capped_thinking is not None: + optional_params["thinking"] = capped_thinking + else: + verbose_logger.warning(DROP_UNSUPPORTED_ADAPTIVE_EFFORT_WARNING, model) + optional_params.pop("thinking", None) + + if isinstance(output_config, dict) and "effort" in output_config: + residual = {k: v for k, v in output_config.items() if k != "effort"} + if residual: + optional_params["output_config"] = residual + else: + optional_params.pop("output_config", None) + + @staticmethod + def _drop_incompatible_temperature_for_thinking( + model: str, optional_params: dict, custom_llm_provider: str + ) -> None: + """Anthropic rejects any ``temperature`` other than 1 while extended thinking + is enabled ("temperature may only be set to 1 when thinking is enabled"). + + Clients like Claude Code send ``thinking``/``output_config.effort`` together + with a pinned ``temperature`` (e.g. the safety classifier uses ``temperature=0`` + for determinism). When the request lands on a non-adaptive model, the effort + interface is reshaped above into legacy ``thinking={type: enabled}`` (or kept + as ``output_config.effort`` on Opus 4.5), and the leftover ``temperature`` would + 400. Preserving the thinking the caller asked for wins over an unhonorable + sampling value (Anthropic forces ``temperature=1`` under thinking regardless), + so drop it and let the API default apply. + + Adaptive models (4.6+) own this natively and are left untouched. + """ + if AnthropicModelInfo._is_adaptive_thinking_model(model, custom_llm_provider): + return + temperature = optional_params.get("temperature") + if temperature is None or temperature == 1: + return + thinking = optional_params.get("thinking") + output_config = optional_params.get("output_config") + thinking_enabled = isinstance(thinking, dict) and thinking.get("type") == "enabled" + effort_enabled = isinstance(output_config, dict) and output_config.get("effort") is not None + if thinking_enabled or effort_enabled: + optional_params.pop("temperature", None) + def transform_anthropic_messages_request( self, model: str, @@ -277,11 +499,26 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): self._translate_reasoning_effort_to_anthropic( model=model, optional_params=anthropic_messages_optional_request_params, + custom_llm_provider=self._resolved_provider, ) self._translate_legacy_thinking_for_adaptive_model( model=model, optional_params=anthropic_messages_optional_request_params, + custom_llm_provider=self._resolved_provider, + ) + + self._translate_adaptive_effort_for_non_adaptive_model( + model=model, + optional_params=anthropic_messages_optional_request_params, + max_tokens=max_tokens, + custom_llm_provider=self._resolved_provider, + ) + + self._drop_incompatible_temperature_for_thinking( + model=model, + optional_params=anthropic_messages_optional_request_params, + custom_llm_provider=self._resolved_provider, ) system_param = anthropic_messages_optional_request_params.get("system") diff --git a/litellm/llms/anthropic/experimental_pass_through/responses_adapters/streaming_iterator.py b/litellm/llms/anthropic/experimental_pass_through/responses_adapters/streaming_iterator.py index 0d02b4fa969..4fd49a35417 100644 --- a/litellm/llms/anthropic/experimental_pass_through/responses_adapters/streaming_iterator.py +++ b/litellm/llms/anthropic/experimental_pass_through/responses_adapters/streaming_iterator.py @@ -75,8 +75,9 @@ class AnthropicResponsesStreamWrapper: # ---- message_start ---- if event_type == "response.created": - self._sent_message_start = True - self._chunk_queue.append(self._make_message_start()) + if not self._sent_message_start: + self._sent_message_start = True + self._chunk_queue.append(self._make_message_start()) return # ---- content_block_start for a new output message item ---- diff --git a/litellm/llms/anthropic/experimental_pass_through/responses_adapters/transformation.py b/litellm/llms/anthropic/experimental_pass_through/responses_adapters/transformation.py index 1a052f457c5..172e54de98e 100644 --- a/litellm/llms/anthropic/experimental_pass_through/responses_adapters/transformation.py +++ b/litellm/llms/anthropic/experimental_pass_through/responses_adapters/transformation.py @@ -198,14 +198,16 @@ class LiteLLMAnthropicToResponsesAPIAdapter: @staticmethod def translate_tool_choice_to_responses_api( tool_choice: AnthropicMessagesToolChoice, - ) -> Dict[str, Any]: + ) -> Union[str, dict[str, Any]]: """Convert Anthropic tool_choice to Responses API tool_choice.""" tc_type = tool_choice.get("type") if tc_type == "any": - return {"type": "required"} + return "required" elif tc_type == "tool": return {"type": "function", "name": tool_choice.get("name", "")} - return {"type": "auto"} + elif tc_type == "none": + return "none" + return "auto" @staticmethod def translate_context_management_to_responses_api( diff --git a/litellm/llms/azure/batches/handler.py b/litellm/llms/azure/batches/handler.py index 808fb3d9600..4a064756295 100644 --- a/litellm/llms/azure/batches/handler.py +++ b/litellm/llms/azure/batches/handler.py @@ -2,7 +2,8 @@ Azure Batches API Handler """ -from typing import Any, Coroutine, Optional, Union, cast +from collections.abc import Coroutine +from typing import cast import httpx from openai import AsyncOpenAI, OpenAI @@ -33,32 +34,30 @@ class AzureBatchesAPI(BaseAzureLLM): async def acreate_batch( self, create_batch_data: CreateBatchRequest, - azure_client: Union[AsyncAzureOpenAI, AsyncOpenAI], + azure_client: AsyncAzureOpenAI | AsyncOpenAI, ) -> LiteLLMBatch: response = await azure_client.batches.create(**create_batch_data) # type: ignore[arg-type] - return LiteLLMBatch(**response.model_dump()) + return LiteLLMBatch.model_validate(response.model_dump()) def create_batch( self, _is_async: bool, create_batch_data: CreateBatchRequest, - api_key: Optional[str], - api_base: Optional[str], - api_version: Optional[str], - timeout: Union[float, httpx.Timeout], - max_retries: Optional[int], - client: Optional[Union[AzureOpenAI, AsyncAzureOpenAI, OpenAI, AsyncOpenAI]] = None, - litellm_params: Optional[dict] = None, - ) -> Union[LiteLLMBatch, Coroutine[Any, Any, LiteLLMBatch]]: - azure_client: Optional[Union[AzureOpenAI, AsyncAzureOpenAI, OpenAI, AsyncOpenAI]] = ( - self.get_azure_openai_client( - api_key=api_key, - api_base=api_base, - api_version=api_version, - client=client, - _is_async=_is_async, - litellm_params=litellm_params or {}, - ) + api_key: str | None, + api_base: str | None, + api_version: str | None, + timeout: float | httpx.Timeout, + max_retries: int | None, + client: AzureOpenAI | AsyncAzureOpenAI | OpenAI | AsyncOpenAI | None = None, + litellm_params: dict | None = None, + ) -> LiteLLMBatch | Coroutine[object, object, LiteLLMBatch]: + azure_client: AzureOpenAI | AsyncAzureOpenAI | OpenAI | AsyncOpenAI | None = self.get_azure_openai_client( + api_key=api_key, + api_base=api_base, + api_version=api_version, + client=client, + _is_async=_is_async, + litellm_params=litellm_params or {}, ) if azure_client is None: raise ValueError( @@ -73,38 +72,36 @@ class AzureBatchesAPI(BaseAzureLLM): return self.acreate_batch( # type: ignore create_batch_data=create_batch_data, azure_client=azure_client ) - response = cast(Union[AzureOpenAI, OpenAI], azure_client).batches.create(**create_batch_data) # type: ignore[arg-type] - return LiteLLMBatch(**response.model_dump()) + response = cast(AzureOpenAI | OpenAI, azure_client).batches.create(**create_batch_data) # type: ignore[arg-type] + return LiteLLMBatch.model_validate(response.model_dump()) async def aretrieve_batch( self, retrieve_batch_data: RetrieveBatchRequest, - client: Union[AsyncAzureOpenAI, AsyncOpenAI], + client: AsyncAzureOpenAI | AsyncOpenAI, ) -> LiteLLMBatch: response = await client.batches.retrieve(**retrieve_batch_data) # type: ignore[arg-type] - return LiteLLMBatch(**response.model_dump()) + return LiteLLMBatch.model_validate(response.model_dump()) def retrieve_batch( self, _is_async: bool, retrieve_batch_data: RetrieveBatchRequest, - api_key: Optional[str], - api_base: Optional[str], - api_version: Optional[str], - timeout: Union[float, httpx.Timeout], - max_retries: Optional[int], - client: Optional[Union[AzureOpenAI, AsyncAzureOpenAI, OpenAI, AsyncOpenAI]] = None, - litellm_params: Optional[dict] = None, + api_key: str | None, + api_base: str | None, + api_version: str | None, + timeout: float | httpx.Timeout, + max_retries: int | None, + client: AzureOpenAI | AsyncAzureOpenAI | OpenAI | AsyncOpenAI | None = None, + litellm_params: dict | None = None, ): - azure_client: Optional[Union[AzureOpenAI, AsyncAzureOpenAI, OpenAI, AsyncOpenAI]] = ( - self.get_azure_openai_client( - api_key=api_key, - api_base=api_base, - api_version=api_version, - client=client, - _is_async=_is_async, - litellm_params=litellm_params or {}, - ) + azure_client: AzureOpenAI | AsyncAzureOpenAI | OpenAI | AsyncOpenAI | None = self.get_azure_openai_client( + api_key=api_key, + api_base=api_base, + api_version=api_version, + client=client, + _is_async=_is_async, + litellm_params=litellm_params or {}, ) if azure_client is None: raise ValueError( @@ -119,38 +116,36 @@ class AzureBatchesAPI(BaseAzureLLM): return self.aretrieve_batch( # type: ignore retrieve_batch_data=retrieve_batch_data, client=azure_client ) - response = cast(Union[AzureOpenAI, OpenAI], azure_client).batches.retrieve(**retrieve_batch_data) - return LiteLLMBatch(**response.model_dump()) + response = cast(AzureOpenAI | OpenAI, azure_client).batches.retrieve(**retrieve_batch_data) + return LiteLLMBatch.model_validate(response.model_dump()) async def acancel_batch( self, cancel_batch_data: CancelBatchRequest, - client: Union[AsyncAzureOpenAI, AsyncOpenAI], + client: AsyncAzureOpenAI | AsyncOpenAI, ) -> LiteLLMBatch: response = await client.batches.cancel(**cancel_batch_data) - return LiteLLMBatch(**response.model_dump()) + return LiteLLMBatch.model_validate(response.model_dump()) def cancel_batch( self, _is_async: bool, cancel_batch_data: CancelBatchRequest, - api_key: Optional[str], - api_base: Optional[str], - api_version: Optional[str], - timeout: Union[float, httpx.Timeout], - max_retries: Optional[int], - client: Optional[Union[AzureOpenAI, AsyncAzureOpenAI, OpenAI, AsyncOpenAI]] = None, - litellm_params: Optional[dict] = None, + api_key: str | None, + api_base: str | None, + api_version: str | None, + timeout: float | httpx.Timeout, + max_retries: int | None, + client: AzureOpenAI | AsyncAzureOpenAI | OpenAI | AsyncOpenAI | None = None, + litellm_params: dict | None = None, ): - azure_client: Optional[Union[AzureOpenAI, AsyncAzureOpenAI, OpenAI, AsyncOpenAI]] = ( - self.get_azure_openai_client( - api_key=api_key, - api_base=api_base, - api_version=api_version, - client=client, - _is_async=_is_async, - litellm_params=litellm_params or {}, - ) + azure_client: AzureOpenAI | AsyncAzureOpenAI | OpenAI | AsyncOpenAI | None = self.get_azure_openai_client( + api_key=api_key, + api_base=api_base, + api_version=api_version, + client=client, + _is_async=_is_async, + litellm_params=litellm_params or {}, ) if azure_client is None: raise ValueError( @@ -172,13 +167,13 @@ class AzureBatchesAPI(BaseAzureLLM): "Azure client is not an instance of AzureOpenAI or OpenAI. Make sure you passed a sync client." ) response = azure_client.batches.cancel(**cancel_batch_data) - return LiteLLMBatch(**response.model_dump()) + return LiteLLMBatch.model_validate(response.model_dump()) async def alist_batches( self, - client: Union[AsyncAzureOpenAI, AsyncOpenAI], - after: Optional[str] = None, - limit: Optional[int] = None, + client: AsyncAzureOpenAI | AsyncOpenAI, + after: str | None = None, + limit: int | None = None, ): response = await client.batches.list(after=after, limit=limit) # type: ignore return response @@ -186,25 +181,23 @@ class AzureBatchesAPI(BaseAzureLLM): def list_batches( self, _is_async: bool, - api_key: Optional[str], - api_base: Optional[str], - api_version: Optional[str], - timeout: Union[float, httpx.Timeout], - max_retries: Optional[int], - after: Optional[str] = None, - limit: Optional[int] = None, - client: Optional[Union[AzureOpenAI, AsyncAzureOpenAI, OpenAI, AsyncOpenAI]] = None, - litellm_params: Optional[dict] = None, + api_key: str | None, + api_base: str | None, + api_version: str | None, + timeout: float | httpx.Timeout, + max_retries: int | None, + after: str | None = None, + limit: int | None = None, + client: AzureOpenAI | AsyncAzureOpenAI | OpenAI | AsyncOpenAI | None = None, + litellm_params: dict | None = None, ): - azure_client: Optional[Union[AzureOpenAI, AsyncAzureOpenAI, OpenAI, AsyncOpenAI]] = ( - self.get_azure_openai_client( - api_key=api_key, - api_base=api_base, - api_version=api_version, - client=client, - _is_async=_is_async, - litellm_params=litellm_params or {}, - ) + azure_client: AzureOpenAI | AsyncAzureOpenAI | OpenAI | AsyncOpenAI | None = self.get_azure_openai_client( + api_key=api_key, + api_base=api_base, + api_version=api_version, + client=client, + _is_async=_is_async, + litellm_params=litellm_params or {}, ) if azure_client is None: raise ValueError( diff --git a/litellm/llms/azure_ai/anthropic/count_tokens/transformation.py b/litellm/llms/azure_ai/anthropic/count_tokens/transformation.py index 5e1fb69f40d..ba930f40059 100644 --- a/litellm/llms/azure_ai/anthropic/count_tokens/transformation.py +++ b/litellm/llms/azure_ai/anthropic/count_tokens/transformation.py @@ -4,8 +4,6 @@ Azure AI Anthropic CountTokens API transformation logic. Extends the base Anthropic CountTokens transformation with Azure authentication. """ -from typing import Any, Dict, Optional - from litellm.constants import ANTHROPIC_TOKEN_COUNTING_BETA_VERSION from litellm.llms.anthropic.count_tokens.transformation import ( AnthropicCountTokensConfig, @@ -25,8 +23,8 @@ class AzureAIAnthropicCountTokensConfig(AnthropicCountTokensConfig): def get_required_headers( self, api_key: str, - litellm_params: Optional[Dict[str, Any]] = None, - ) -> Dict[str, str]: + litellm_params: dict[str, object] | None = None, + ) -> dict[str, str]: """ Get the required headers for the Azure AI Anthropic CountTokens API. @@ -53,7 +51,7 @@ class AzureAIAnthropicCountTokensConfig(AnthropicCountTokensConfig): if "api_key" not in litellm_params: litellm_params["api_key"] = api_key - litellm_params_obj = GenericLiteLLMParams(**litellm_params) + litellm_params_obj = GenericLiteLLMParams.model_validate(litellm_params) # Get Azure auth headers (api-key or Authorization) azure_headers = BaseAzureLLM._base_validate_azure_environment(headers={}, litellm_params=litellm_params_obj) diff --git a/litellm/llms/azure_ai/anthropic/messages_transformation.py b/litellm/llms/azure_ai/anthropic/messages_transformation.py index 1de18701a2f..9b05e754b7f 100644 --- a/litellm/llms/azure_ai/anthropic/messages_transformation.py +++ b/litellm/llms/azure_ai/anthropic/messages_transformation.py @@ -21,6 +21,10 @@ class AzureAnthropicMessagesConfig(AnthropicMessagesConfig): and Azure endpoint format. """ + @property + def custom_llm_provider(self) -> Optional[str]: + return "azure_ai" + def should_strip_billing_metadata(self) -> bool: return True @@ -162,5 +166,6 @@ class AzureAnthropicMessagesConfig(AnthropicMessagesConfig): litellm_params=litellm_params, headers=headers, ) + self._normalize_system_role_messages(anthropic_messages_request, model=model) self._remove_scope_from_cache_control(anthropic_messages_request) return anthropic_messages_request diff --git a/litellm/llms/azure_ai/ocr/common_utils.py b/litellm/llms/azure_ai/ocr/common_utils.py index d1d5b80b78d..14b77338fd7 100644 --- a/litellm/llms/azure_ai/ocr/common_utils.py +++ b/litellm/llms/azure_ai/ocr/common_utils.py @@ -13,6 +13,17 @@ if TYPE_CHECKING: from litellm.llms.base_llm.ocr.transformation import BaseOCRConfig +def is_azure_document_intelligence_model(model: str) -> bool: + """Whether an azure_ai OCR model routes to Azure Document Intelligence. + + Azure AI exposes two OCR services on the same provider; the sub-route in the + model name (`azure_ai/doc-intelligence/`) selects Document Intelligence + over Mistral OCR. This is the single source of truth for that routing decision. + """ + lowered = model.lower() + return "doc-intelligence" in lowered or "documentintelligence" in lowered + + def get_azure_ai_ocr_config(model: str) -> Optional["BaseOCRConfig"]: """ Determine which Azure AI OCR configuration to use based on the model name. @@ -41,7 +52,7 @@ def get_azure_ai_ocr_config(model: str) -> Optional["BaseOCRConfig"]: from litellm.llms.azure_ai.ocr.transformation import AzureAIOCRConfig # Check for Azure Document Intelligence models - if "doc-intelligence" in model or "documentintelligence" in model: + if is_azure_document_intelligence_model(model): verbose_logger.debug(f"Routing {model} to Azure Document Intelligence OCR config") return AzureDocumentIntelligenceOCRConfig() diff --git a/litellm/llms/base_llm/guardrail_translation/base_translation.py b/litellm/llms/base_llm/guardrail_translation/base_translation.py index 6c41b46cfa0..bed06832386 100644 --- a/litellm/llms/base_llm/guardrail_translation/base_translation.py +++ b/litellm/llms/base_llm/guardrail_translation/base_translation.py @@ -1,4 +1,5 @@ from abc import ABC, abstractmethod +from dataclasses import dataclass, field from typing import TYPE_CHECKING, Any, Dict, List, Optional if TYPE_CHECKING: @@ -11,10 +12,30 @@ if TYPE_CHECKING: from litellm.types.llms.openai import AllMessageValues +@dataclass(slots=True) +class StreamTransformSink: + """Out-parameter used by ``process_output_streaming_response`` to hand the + guardrailed streaming state back to the caller. + + The streaming text-transform path must not mutate ``responses_so_far`` (it is + the raw accumulator the guardrail re-reads every round), so the guardrailed + accumulated text per choice (``mutated_text_per_choice``, keyed by + ``StreamingChoices.index``) and the per-choice trailing holdback the guardrail + requested (``holdback_per_choice``, from ``stream_holdback_chars``) are + reported here instead of in place. Only the OpenAI chat handler populates this + today; the hook passes a fresh sink per round and reads it afterwards. A + mutable dataclass is deliberate: it is a write-once output parameter for a + single call, not shared state. + """ + + mutated_text_per_choice: dict[int, str] = field(default_factory=dict) + holdback_per_choice: dict[int, int] = field(default_factory=dict) + + class BaseTranslation(ABC): @staticmethod def transform_user_api_key_dict_to_metadata( - user_api_key_dict: Optional[Any], + user_api_key_dict: Any | None, ) -> Dict[str, Any]: """ Transform user_api_key_dict to a metadata dict with prefixed keys. @@ -73,7 +94,7 @@ class BaseTranslation(ABC): guardrail_to_apply: "CustomGuardrail", litellm_logging_obj: Optional["LiteLLMLoggingObj"] = None, user_api_key_dict: Optional["UserAPIKeyAuth"] = None, - request_data: Optional[dict] = None, + request_data: dict | None = None, ) -> Any: """ Process output response with guardrails. @@ -92,12 +113,15 @@ class BaseTranslation(ABC): guardrail_to_apply: "CustomGuardrail", litellm_logging_obj: Optional["LiteLLMLoggingObj"] = None, user_api_key_dict: Optional["UserAPIKeyAuth"] = None, - request_data: Optional[dict] = None, + request_data: dict | None = None, + stream_transform_sink: StreamTransformSink | None = None, ) -> Any: """ Process output streaming response with guardrails. - Optional to override in subclasses. + Optional to override in subclasses. ``stream_transform_sink`` is the + out-parameter used by handlers that support streaming text + transformations (see ``StreamTransformSink``); base handlers ignore it. """ return responses_so_far @@ -105,8 +129,8 @@ class BaseTranslation(ABC): self, exc: "ModifyResponseException", stream_started: bool = False, - responses_so_far: Optional[list[Any]] = None, - ) -> Optional[list[bytes]]: + responses_so_far: list[Any] | None = None, + ) -> list[bytes] | None: """ Build the streaming chunks that deliver a guardrail block message and cleanly terminate the stream in this provider's wire format. @@ -125,7 +149,7 @@ class BaseTranslation(ABC): """ return None - def get_structured_messages(self, data: dict) -> Optional[List["AllMessageValues"]]: + def get_structured_messages(self, data: dict) -> List["AllMessageValues"] | None: """ Convert request data to OpenAI-spec structured messages. diff --git a/litellm/llms/bedrock/audio_transcription/__init__.py b/litellm/llms/bedrock/audio_transcription/__init__.py new file mode 100644 index 00000000000..f2e58df3015 --- /dev/null +++ b/litellm/llms/bedrock/audio_transcription/__init__.py @@ -0,0 +1,84 @@ +import base64 +from typing import Union + +import httpx + +from litellm.litellm_core_utils.audio_utils.utils import process_audio_file +from litellm.rust_bridge import transcription as rust_transcription_bridge +from litellm.types.utils import FileTypes, TranscriptionResponse + + +class BedrockAudioTranscriptionRustDispatch: + @staticmethod + def _audio_payload(audio_file: FileTypes) -> dict[str, object]: + processed_audio = process_audio_file(audio_file) + formats = { + "audio/flac": "flac", + "audio/mpeg": "mp3", + "audio/mp3": "mp3", + "audio/ogg": "ogg", + "audio/wav": "wav", + "audio/x-wav": "wav", + } + audio_format = formats.get(processed_audio.content_type) or ( + processed_audio.filename.rsplit(".", 1)[-1].lower() if "." in processed_audio.filename else "" + ) + if audio_format not in {"wav", "mp3", "flac", "ogg"}: + raise ValueError(f"Unsupported Bedrock audio format for file {processed_audio.filename!r}") + return { + "data": base64.b64encode(processed_audio.file_content).decode("ascii"), + "format": audio_format, + "filename": processed_audio.filename, + } + + def audio_transcriptions( + self, + *, + model: str, + audio_file: FileTypes, + api_key: str | None, + api_base: str | None, + custom_llm_provider: str, + extra_headers: dict[str, object] | None, + optional_params: dict[str, object], + timeout: Union[float, httpx.Timeout] | None, + ) -> TranscriptionResponse: + rust_response = rust_transcription_bridge.transcription( + model=model, + audio=self._audio_payload(audio_file), + api_key=api_key, + api_base=api_base, + custom_llm_provider=custom_llm_provider, + extra_headers=extra_headers, + optional_params=optional_params, + timeout=timeout, + ) + if rust_response is None: + raise RuntimeError("Rust audio transcription bridge is unavailable") + return TranscriptionResponse(**rust_response) + + async def async_audio_transcriptions( + self, + *, + model: str, + audio_file: FileTypes, + api_key: str | None, + api_base: str | None, + custom_llm_provider: str, + extra_headers: dict[str, object] | None, + optional_params: dict[str, object], + timeout: Union[float, httpx.Timeout] | None, + ) -> TranscriptionResponse: + rust_response = await rust_transcription_bridge.atranscription( + model=model, + audio=self._audio_payload(audio_file), + api_key=api_key, + api_base=api_base, + custom_llm_provider=custom_llm_provider, + extra_headers=extra_headers, + optional_params=optional_params, + timeout=timeout, + ) + if rust_response is None: + raise RuntimeError("Rust audio transcription bridge is unavailable") + return TranscriptionResponse(**rust_response) diff --git a/litellm/llms/bedrock/base_aws_llm.py b/litellm/llms/bedrock/base_aws_llm.py index f449851b76f..6b89fb69739 100644 --- a/litellm/llms/bedrock/base_aws_llm.py +++ b/litellm/llms/bedrock/base_aws_llm.py @@ -78,8 +78,10 @@ class BaseAWSLLM: # Storage is in-process memory only: default ``DualCache()`` has no Redis backend unless attached # elsewhere. Entry TTL: static access-key + secret + region use ``_get_default_ttl_for_boto3_credentials`` # (~59 minutes); ambient env (``_auth_with_env_vars`` returns ``ttl=None``) uses ``InMemoryCache``'s - # ``default_ttl`` (600 seconds / 10 minutes). AssumeRole, web identity, profiles, and explicit - # session-token tuples are not cached — see ``get_credentials`` and ``_get_or_set_cached_credentials``. + # ``default_ttl`` (600 seconds / 10 minutes); web identity STS credentials use + # ``_get_default_ttl_for_boto3_credentials`` (~59 minutes), keyed on all aws_* credential args + # plus ssl_verify. AssumeRole, profiles, and explicit session-token tuples are not cached — see + # ``get_credentials`` and ``_get_or_set_cached_credentials``. _shared_iam_cache: ClassVar[DualCache] = DualCache() def __init__(self) -> None: @@ -136,11 +138,12 @@ class BaseAWSLLM: which ``InMemoryCache.set_cache`` resolves to ``default_ttl`` (600 seconds / 10 minutes by default). - Used only for static access-key credentials and ambient credentials from + Used for static access-key credentials, ambient credentials from ``_auth_with_env_vars`` (including when skipping AssumeRole because the runtime identity - already matches ``aws_role_name``). + already matches ``aws_role_name``), and web identity STS credentials (plain + non-refreshable ``Credentials`` cached ~59 min, inside the 3600s STS session). - AssumeRole, web identity exchange, profiles, and explicit session-token tuples are not + AssumeRole, profiles, and explicit session-token tuples are not cached here — shared ``Credentials`` / refresh state must not span logical sessions. """ cache_key = self.get_cache_key(credential_args) @@ -266,23 +269,26 @@ class BaseAWSLLM: # Credentials - boto3.Credentials # cache ttl - Optional[int]. If None, the credentials are not cached. Some auth flows have no expiry time. # - # iam_cache: static keys and ambient env only (including skip-AssumeRole path). - # Do not cache AssumeRole / web identity / profile / explicit session-token paths here. + # iam_cache: static keys, ambient env (including skip-AssumeRole path), and web identity. + # Do not cache AssumeRole / profile / explicit session-token paths here. ######################################################### if self._is_auth_with_web_identity_token( aws_web_identity_token, aws_role_name, aws_session_name, ): - credentials, _cache_ttl = self._auth_with_web_identity_token( - aws_web_identity_token=cast(str, aws_web_identity_token), - aws_role_name=cast(str, aws_role_name), - aws_session_name=cast(str, aws_session_name), - aws_region_name=aws_region_name, - aws_sts_endpoint=aws_sts_endpoint, - aws_external_id=aws_external_id, + return self._get_or_set_cached_credentials( + args, + lambda: self._auth_with_web_identity_token( + aws_web_identity_token=cast(str, aws_web_identity_token), + aws_role_name=cast(str, aws_role_name), + aws_session_name=cast(str, aws_session_name), + aws_region_name=aws_region_name, + aws_sts_endpoint=aws_sts_endpoint, + aws_external_id=aws_external_id, + ssl_verify=ssl_verify, + ), ) - return credentials elif self._is_auth_with_aws_role(aws_role_name): # Same role (IRSA/ECS/EC2): ambient creds via _get_or_set_cached_credentials like the # default env branch; never pre-read cache (must run _is_already_running_as_role first). @@ -877,6 +883,15 @@ class BaseAWSLLM: "Resource": "*", "Condition": {"Bool": {"aws:SecureTransport": "true"}}, }, + { + "Sid": "BedrockMantleLiteLLM", + "Effect": "Allow", + "Action": [ + "bedrock-mantle:CreateInference", + ], + "Resource": "*", + "Condition": {"Bool": {"aws:SecureTransport": "true"}}, + }, ], } assume_role_params = { diff --git a/litellm/llms/bedrock/batches/transformation.py b/litellm/llms/bedrock/batches/transformation.py index b0e28b6ba90..a4ff1c78467 100644 --- a/litellm/llms/bedrock/batches/transformation.py +++ b/litellm/llms/bedrock/batches/transformation.py @@ -4,7 +4,11 @@ import time from typing import Any, Dict, List, Literal, Optional, Union, cast from httpx import Headers, Response +from pydantic import TypeAdapter, ValidationError +from litellm.litellm_core_utils.cloud_storage_security import ( + BEDROCK_MANAGED_S3_BATCH_PREFIX, +) from litellm.litellm_core_utils.safe_json_dumps import safe_dumps from litellm.llms.base_llm.batches.transformation import BaseBatchesConfig from litellm.llms.base_llm.chat.transformation import BaseLLMException @@ -16,6 +20,7 @@ from litellm.types.llms.bedrock import ( BedrockOutputDataConfig, BedrockS3InputDataConfig, BedrockS3OutputDataConfig, + BedrockTag, ) from litellm.types.llms.openai import ( AllMessageValues, @@ -26,6 +31,27 @@ from litellm.types.utils import LiteLLMBatch, LlmProviders from ..base_aws_llm import BaseAWSLLM from ..common_utils import CommonBatchFilesUtils +# Bedrock batch input files are uploaded as +# s3://bucket/litellm-bedrock-files-{model, ":" -> "-"}-{uuid4}.jsonl (see +# BedrockFilesTransformation._get_s3_object_name). A uuid4 is always 36 hex/dash +# characters, so it can be stripped off the end unambiguously even though the +# model name itself may contain dashes. +_S3_BATCH_FILE_UUID_SUFFIX_PATTERN = re.compile( + r"-[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\.jsonl$" +) + +_BEDROCK_TAGS_ADAPTER: TypeAdapter[list[BedrockTag]] = TypeAdapter(list[BedrockTag]) + + +def _validate_bedrock_tags(raw_tags: object) -> list[BedrockTag]: + try: + return _BEDROCK_TAGS_ADAPTER.validate_python(raw_tags, strict=True) + except ValidationError as e: + raise ValueError( + "Invalid 'bedrock_tags' value. Expected a list of {'key': , 'value': } dicts, " + f"e.g. [{{'key': 'team', 'value': 'genai'}}]. Got: {raw_tags!r}" + ) from e + class BedrockBatchesConfig(BaseAWSLLM, BaseBatchesConfig): """ @@ -40,6 +66,41 @@ class BedrockBatchesConfig(BaseAWSLLM, BaseBatchesConfig): def custom_llm_provider(self) -> LlmProviders: return LlmProviders.BEDROCK + @classmethod + def _get_bare_model_name_from_s3_key(cls, object_key: str) -> Optional[str]: + if not object_key.startswith(BEDROCK_MANAGED_S3_BATCH_PREFIX): + return None + model_part = object_key[len(BEDROCK_MANAGED_S3_BATCH_PREFIX) :] + match = _S3_BATCH_FILE_UUID_SUFFIX_PATTERN.search(model_part) + if not match or match.start() == 0: + return None + return model_part[: match.start()] + + @classmethod + def is_unmanaged_s3_batch_input_file_id(cls, input_file_id: Optional[str]) -> bool: + """ + Returns True if `input_file_id` is a raw s3:// Bedrock batch input file (i.e. not a + LiteLLM-managed unified file id) whose object key embeds the model name in the + `litellm-bedrock-files-{model}-{uuid}.jsonl` layout. + """ + if input_file_id is None or not input_file_id.startswith("s3://"): + return False + object_key = input_file_id.rsplit("/", 1)[-1] + return cls._get_bare_model_name_from_s3_key(object_key) is not None + + @classmethod + def get_bare_model_name_from_s3_file(cls, input_file_id: str) -> str: + """ + Extracts the bare model name (e.g. "us.anthropic.claude-sonnet-4-20250514-v1-0") from + an unmanaged batch's s3:// input file id. Note any ":" in the original model id was + replaced with "-" at upload time, so callers must fuzzy-match against configured + deployments rather than expect an exact string match. + """ + object_key = input_file_id.rsplit("/", 1)[-1] + bare_model_name = cls._get_bare_model_name_from_s3_key(object_key) + assert bare_model_name is not None # narrowed by is_unmanaged_s3_batch_input_file_id + return bare_model_name + def validate_environment( self, headers: dict, @@ -154,6 +215,11 @@ class BedrockBatchesConfig(BaseAWSLLM, BaseBatchesConfig): "roleArn": role_arn, } + config_bedrock_tags = litellm_params.get("bedrock_tags") + bedrock_tags = config_bedrock_tags if config_bedrock_tags is not None else optional_params.get("bedrock_tags") + if bedrock_tags is not None: + bedrock_request["tags"] = _validate_bedrock_tags(bedrock_tags) + # Add optional parameters if provided completion_window = create_batch_data.get("completion_window") if completion_window: diff --git a/litellm/llms/bedrock/chat/converse_transformation.py b/litellm/llms/bedrock/chat/converse_transformation.py index 5a8ada45651..8ce2b982955 100644 --- a/litellm/llms/bedrock/chat/converse_transformation.py +++ b/litellm/llms/bedrock/chat/converse_transformation.py @@ -33,6 +33,7 @@ from litellm.litellm_core_utils.prompt_templates.factory import ( make_valid_bedrock_tool_name, ) from litellm.llms.anthropic.chat.transformation import ( + DROP_UNSUPPORTED_ADAPTIVE_THINKING_WARNING, DROP_UNSUPPORTED_OUTPUT_CONFIG_WARNING, REASONING_EFFORT_TO_OUTPUT_CONFIG_EFFORT, AnthropicConfig, @@ -423,6 +424,7 @@ class AmazonConverseConfig(BaseConfig): mapped_thinking = AnthropicConfig._map_reasoning_effort( reasoning_effort=reasoning_effort, model=model, + custom_llm_provider="bedrock", llm_provider="bedrock_converse", ) if mapped_thinking is None: @@ -430,7 +432,7 @@ class AmazonConverseConfig(BaseConfig): optional_params.pop("output_config", None) else: optional_params["thinking"] = mapped_thinking - if AnthropicConfig._is_adaptive_thinking_model(model): + if AnthropicConfig._is_adaptive_thinking_model(model, "bedrock"): mapped_effort = REASONING_EFFORT_TO_OUTPUT_CONFIG_EFFORT.get(reasoning_effort) if mapped_effort is None: AnthropicConfig._raise_invalid_reasoning_effort( @@ -465,7 +467,7 @@ class AmazonConverseConfig(BaseConfig): model=model, llm_provider="bedrock_converse", ) - error = AnthropicConfig._validate_effort_for_model(model=model, effort=effort) + error = AnthropicConfig._validate_effort_for_model(model=model, effort=effort, custom_llm_provider="bedrock") if error is not None: raise litellm.exceptions.BadRequestError( message=error, @@ -893,12 +895,32 @@ class AmazonConverseConfig(BaseConfig): if _tool_choice_value is not None: optional_params["tool_choice"] = _tool_choice_value if param == "parallel_tool_calls": - disable_parallel = not value optional_params["_parallel_tool_use_config"] = { - "tool_choice": {"disable_parallel_tool_use": disable_parallel} + "tool_choice": {"type": "auto", "disable_parallel_tool_use": not value} } if param == "thinking": - optional_params["thinking"] = value + if ( + isinstance(value, dict) + and value.get("type") == "adaptive" + and not AnthropicConfig._is_adaptive_thinking_model(model, "bedrock") + ): + max_tokens = non_default_params.get("max_completion_tokens") or non_default_params.get("max_tokens") + legacy_thinking = AnthropicConfig._map_reasoning_effort( + reasoning_effort="medium", + model=model, + custom_llm_provider="bedrock", + ) + capped = ( + AnthropicConfig._cap_thinking_budget_to_max_tokens(legacy_thinking, max_tokens) + if legacy_thinking is not None + else None + ) + if capped is not None: + optional_params["thinking"] = capped + else: + litellm.verbose_logger.warning(DROP_UNSUPPORTED_ADAPTIVE_THINKING_WARNING, model) + else: + optional_params["thinking"] = value elif param == "reasoning_effort" and isinstance(value, str): self._handle_reasoning_effort_parameter( model=model, reasoning_effort=value, optional_params=optional_params @@ -1185,6 +1207,22 @@ class AmazonConverseConfig(BaseConfig): return {} + @staticmethod + def _merge_parallel_tool_use_config(additional_request_params: dict, parallel_tool_use_config: dict) -> dict: + merged_entries = { + key: ( + { + **value, + **additional_request_params[key], + **{k: v for k, v in value.items() if k != "type"}, + } + if isinstance(additional_request_params.get(key), dict) and isinstance(value, dict) + else value + ) + for key, value in parallel_tool_use_config.items() + } + return {**additional_request_params, **merged_entries} + def _prepare_request_params( self, optional_params: dict, model: str, drop_params: bool = False ) -> Tuple[dict, dict, dict, Optional[OutputConfigBlock]]: @@ -1253,15 +1291,9 @@ class AmazonConverseConfig(BaseConfig): # Handle parallel_tool_calls configuration parallel_tool_use_config = additional_request_params.pop("_parallel_tool_use_config", None) if parallel_tool_use_config is not None and bedrock_converse_supports_parallel_tool_use_config(model): - for key, value in parallel_tool_use_config.items(): - if ( - key in additional_request_params - and isinstance(additional_request_params[key], dict) - and isinstance(value, dict) - ): - additional_request_params[key].update(value) - else: - additional_request_params[key] = value + additional_request_params = self._merge_parallel_tool_use_config( + additional_request_params, parallel_tool_use_config + ) additional_request_params.pop("parallel_tool_calls", None) @@ -1279,7 +1311,7 @@ class AmazonConverseConfig(BaseConfig): if anthropic_output_config is not None and isinstance(anthropic_output_config, dict): if base_model.startswith("anthropic"): - if litellm.drop_params is True and not AnthropicConfig._model_supports_effort_param(model): + if litellm.drop_params is True and not AnthropicConfig._model_supports_effort_param(model, "bedrock"): litellm.verbose_logger.warning( DROP_UNSUPPORTED_OUTPUT_CONFIG_WARNING, model, @@ -1422,7 +1454,7 @@ class AmazonConverseConfig(BaseConfig): if ( isinstance(output_config, dict) and output_config.get("effort") is not None - and not AnthropicConfig._is_adaptive_thinking_model(model) + and not AnthropicConfig._is_adaptive_thinking_model(model, "bedrock") ): from litellm.types.llms.anthropic import ( ANTHROPIC_EFFORT_BETA_HEADER, diff --git a/litellm/llms/bedrock/chat/invoke_transformations/anthropic_claude3_transformation.py b/litellm/llms/bedrock/chat/invoke_transformations/anthropic_claude3_transformation.py index 60d532eb8c5..6b5cb304bec 100644 --- a/litellm/llms/bedrock/chat/invoke_transformations/anthropic_claude3_transformation.py +++ b/litellm/llms/bedrock/chat/invoke_transformations/anthropic_claude3_transformation.py @@ -115,7 +115,7 @@ class AmazonAnthropicClaudeConfig(AmazonInvokeConfig, AnthropicConfig): keeps working. Non-adaptive models and models without a ceiling are left untouched. """ - if not AnthropicConfig._is_adaptive_thinking_model(model): + if not AnthropicConfig._is_adaptive_thinking_model(model, "bedrock"): return effort = params.get("reasoning_effort") if not isinstance(effort, str): @@ -228,7 +228,7 @@ class AmazonAnthropicClaudeConfig(AmazonInvokeConfig, AnthropicConfig): custom_llm_provider="bedrock", key="supports_output_config", ) - or AnthropicConfig._model_supports_effort_param(model) + or AnthropicConfig._model_supports_effort_param(model, "bedrock") ): if anthropic_request.pop("output_config", None) is not None: verbose_logger.warning( @@ -269,6 +269,7 @@ class AmazonAnthropicClaudeConfig(AmazonInvokeConfig, AnthropicConfig): prompt_caching_set=False, file_id_used=self.is_file_id_used(messages), mcp_server_used=self.is_mcp_server_used(optional_params.get("mcp_servers")), + custom_llm_provider="bedrock", ) beta_set.update(auto_betas) diff --git a/litellm/llms/bedrock/claude_platform/transformation.py b/litellm/llms/bedrock/claude_platform/transformation.py index 0868d9bddfe..6f5ccececc7 100644 --- a/litellm/llms/bedrock/claude_platform/transformation.py +++ b/litellm/llms/bedrock/claude_platform/transformation.py @@ -54,7 +54,9 @@ class BedrockClaudePlatformConfig(BedrockClaudePlatformMixin, AnthropicConfig): tool_search_used=self.is_tool_search_used(tools=optional_params.get("tools")), programmatic_tool_calling_used=self.is_programmatic_tool_calling_used(tools=optional_params.get("tools")), input_examples_used=self.is_input_examples_used(tools=optional_params.get("tools")), - effort_used=self.is_effort_used(optional_params=optional_params, model=model), + effort_used=self.is_effort_used( + optional_params=optional_params, model=model, custom_llm_provider="anthropic" + ), user_anthropic_beta_headers=self._get_user_anthropic_beta_headers( anthropic_beta_header=headers.get("anthropic-beta") ), diff --git a/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py b/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py index f5309d521a9..08c13448d8c 100644 --- a/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py +++ b/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py @@ -77,51 +77,16 @@ class AmazonAnthropicClaudeMessagesConfig( DEFAULT_BEDROCK_ANTHROPIC_API_VERSION = "bedrock-2023-05-31" + @property + def custom_llm_provider(self) -> Optional[str]: + return "bedrock" + BEDROCK_INVOKE_ALLOWED_TOP_LEVEL_FIELDS = frozenset(BedrockInvokeAnthropicMessagesRequest.__annotations__.keys()) def __init__(self, **kwargs): BaseAnthropicMessagesConfig.__init__(self, **kwargs) AmazonInvokeConfig.__init__(self, **kwargs) - @staticmethod - def _as_system_content_blocks(value: Any) -> list[Any]: - if value is None: - return [] - if isinstance(value, list): - return list(value) - if isinstance(value, str): - return [{"type": "text", "text": value}] - return [value] - - def _normalize_system_role_messages_for_bedrock(self, anthropic_messages_request: dict) -> None: - """Bedrock Invoke rejects ``role: "system"`` entries inside ``messages`` on - some Claude aliases; Anthropic Messages carries that content in the - top-level ``system`` field. Move any such entries into ``system`` before - the Invoke request is built.""" - messages = anthropic_messages_request.get("messages") - if not isinstance(messages, list): - return - system_role_messages = [m for m in messages if isinstance(m, dict) and m.get("role") == "system"] - if not system_role_messages: - return - - anthropic_messages_request["messages"] = [ - m for m in messages if not (isinstance(m, dict) and m.get("role") == "system") - ] - system_content = [ - block - for source in ( - anthropic_messages_request.get("system"), - *(m.get("content") for m in system_role_messages), - ) - for block in self._as_system_content_blocks(source) - ] - filtered_system = self._filter_billing_headers_from_system(system_content) - if filtered_system: - anthropic_messages_request["system"] = filtered_system - else: - anthropic_messages_request.pop("system", None) - def validate_anthropic_messages_environment( self, headers: dict, @@ -247,7 +212,7 @@ class AmazonAnthropicClaudeMessagesConfig( Returns: True if the model supports extended thinking on Bedrock """ - if AnthropicModelInfo._is_adaptive_thinking_model(model): + if AnthropicModelInfo._is_adaptive_thinking_model(model, "bedrock"): return True model_lower = model.lower() @@ -297,7 +262,7 @@ class AmazonAnthropicClaudeMessagesConfig( if not self._supports_extended_thinking_on_bedrock(model): return False - is_adaptive_thinking_model = AnthropicModelInfo._is_adaptive_thinking_model(model) + is_adaptive_thinking_model = AnthropicModelInfo._is_adaptive_thinking_model(model, "bedrock") thinking = anthropic_messages_request.get("thinking") if isinstance(thinking, dict): @@ -489,24 +454,43 @@ class AmazonAnthropicClaudeMessagesConfig( if self._supports_tool_search_on_bedrock(model): beta_set.add("tool-search-tool-2025-10-19") + # Bedrock-InvokeModel-supported ``context_management.edits`` types and the + # ``anthropic-beta`` header that each one requires. ``clear_thinking_20251015`` + # is intentionally absent — it is LiteLLM-internal, consumed via + # ``_ensure_thinking_for_clear_thinking_context_management``, and forwarding + # the raw edit trips Bedrock's + # ``"context_management: Extra inputs are not permitted"`` 400. + # + # Bedrock InvokeModel DOES support ``clear_tool_uses_20250919`` under the + # ``context-management-2025-06-27`` beta. AWS docs: + # https://docs.aws.amazon.com/bedrock/latest/userguide/model-parameters-anthropic-claude-messages-tool-use.md + _BEDROCK_INVOKE_SUPPORTED_CONTEXT_MANAGEMENT_EDITS: Dict[str, str] = { + "compact_20260112": ANTHROPIC_BETA_HEADER_VALUES.COMPACT_2026_01_12.value, + "clear_tool_uses_20250919": ANTHROPIC_BETA_HEADER_VALUES.CONTEXT_MANAGEMENT_2025_06_27.value, + } + @staticmethod def _filter_context_management_for_bedrock_invoke( anthropic_messages_request: Dict, beta_set: set, ) -> None: """ - Bedrock InvokeModel accepts ``context_management`` only when it carries - ``compact_20260112`` edits paired with the ``compact-2026-01-12`` - anthropic-beta header. Other edit types (notably ``clear_thinking_20251015``, - which Claude Code sends on every request) are LiteLLM-internal and would - cause Bedrock to 400 with ``"context_management: Extra inputs are not - permitted"``. + Filter ``context_management.edits`` to the subset that Bedrock InvokeModel + accepts and add the matching ``anthropic-beta`` header for each surviving + edit type. - Filter the edits list to the supported subset, add the beta header when - compact edits remain, and drop ``context_management`` entirely when no - supported edits are left so the safety-net allowlist can pass it through. + - ``compact_20260112`` -> ``compact-2026-01-12`` + - ``clear_tool_uses_20250919`` -> ``context-management-2025-06-27`` - Ref: https://github.com/BerriAI/litellm/issues/27532 + Other edit types (notably ``clear_thinking_20251015``, which Claude Code + sends on every request) are LiteLLM-internal: thinking is injected + separately via ``_ensure_thinking_for_clear_thinking_context_management``, + and forwarding the raw edit would trip Bedrock's + ``"context_management: Extra inputs are not permitted"`` 400. + + Refs: + * https://github.com/BerriAI/litellm/issues/27532 + * https://docs.aws.amazon.com/bedrock/latest/userguide/model-parameters-anthropic-claude-messages-tool-use.md """ cm = anthropic_messages_request.get("context_management") if not isinstance(cm, dict): @@ -516,15 +500,17 @@ class AmazonAnthropicClaudeMessagesConfig( anthropic_messages_request.pop("context_management", None) return - compact_edits = [e for e in edits if isinstance(e, dict) and e.get("type") == "compact_20260112"] - if compact_edits: - beta_set.add(ANTHROPIC_BETA_HEADER_VALUES.COMPACT_2026_01_12.value) - anthropic_messages_request["context_management"] = { - **cm, - "edits": compact_edits, - } - else: + supported = AmazonAnthropicClaudeMessagesConfig._BEDROCK_INVOKE_SUPPORTED_CONTEXT_MANAGEMENT_EDITS + retained_edits = [e for e in edits if isinstance(e, dict) and e.get("type") in supported] + if not retained_edits: anthropic_messages_request.pop("context_management", None) + return + + beta_set.update(supported[e["type"]] for e in retained_edits) + anthropic_messages_request["context_management"] = { + **cm, + "edits": retained_edits, + } def _get_bedrock_invoke_anthropic_beta_headers( self, @@ -553,6 +539,7 @@ class AmazonAnthropicClaudeMessagesConfig( mcp_server_used=anthropic_model_info.is_mcp_server_used( anthropic_messages_optional_request_params.get("mcp_servers") ), + custom_llm_provider="bedrock", ) beta_set.update(auto_betas) @@ -619,7 +606,7 @@ class AmazonAnthropicClaudeMessagesConfig( path degrades ``xhigh`` -> ``max`` rather than 400-ing. Non-adaptive models and models without a ceiling are left untouched. """ - if not AnthropicModelInfo._is_adaptive_thinking_model(model): + if not AnthropicModelInfo._is_adaptive_thinking_model(model, "bedrock"): return effort = optional_params.get("reasoning_effort") if not isinstance(effort, str): @@ -648,7 +635,7 @@ class AmazonAnthropicClaudeMessagesConfig( litellm_params=litellm_params, headers=headers, ) - self._normalize_system_role_messages_for_bedrock(anthropic_messages_request) + self._normalize_system_role_messages(anthropic_messages_request, model=model) ######################################################### ############## BEDROCK Invoke SPECIFIC TRANSFORMATION ### ######################################################### @@ -707,7 +694,7 @@ class AmazonAnthropicClaudeMessagesConfig( custom_llm_provider="bedrock", key="supports_output_config", ) - or AnthropicConfig._model_supports_effort_param(model) + or AnthropicConfig._model_supports_effort_param(model, "bedrock") ): if anthropic_messages_request.pop("output_config", None) is not None: verbose_logger.warning( @@ -744,7 +731,7 @@ class AmazonAnthropicClaudeMessagesConfig( if ( litellm.drop_params is True and "output_config" in anthropic_messages_request - and not AnthropicConfig._model_supports_effort_param(model) + and not AnthropicConfig._model_supports_effort_param(model, "bedrock") ): verbose_logger.warning( DROP_UNSUPPORTED_OUTPUT_CONFIG_WARNING, diff --git a/litellm/llms/bedrock/messages/mantle_transformation.py b/litellm/llms/bedrock/messages/mantle_transformation.py index da7b8697a6b..65a2ab3b9a7 100644 --- a/litellm/llms/bedrock/messages/mantle_transformation.py +++ b/litellm/llms/bedrock/messages/mantle_transformation.py @@ -17,6 +17,10 @@ from litellm.llms.bedrock.common_utils import build_mantle_messages_url from litellm.llms.bedrock.messages.invoke_transformations.anthropic_claude3_transformation import ( AmazonAnthropicClaudeMessagesConfig, ) +from litellm.types.llms.anthropic_messages.anthropic_response import ( + AnthropicMessagesResponse, + AnthropicUsage, +) from litellm.types.router import GenericLiteLLMParams if TYPE_CHECKING: @@ -103,6 +107,25 @@ class AmazonMantleMessagesConfig(AmazonAnthropicClaudeMessagesConfig): ) return {**request, "model": model_id, **stream_fields} + def transform_anthropic_messages_response( + self, + model: str, + raw_response: httpx.Response, + logging_obj: LiteLLMLoggingObj, + ) -> AnthropicMessagesResponse: + response = super().transform_anthropic_messages_response( + model=model, + raw_response=raw_response, + logging_obj=logging_obj, + ) + existing_usage: AnthropicUsage = response.get("usage") or AnthropicUsage() + normalized_usage: AnthropicUsage = { + "input_tokens": 0, + "output_tokens": 0, + **existing_usage, + } + return {**response, "usage": normalized_usage} + def get_async_streaming_response_iterator( self, model: str, diff --git a/litellm/llms/bedrock/realtime/handler.py b/litellm/llms/bedrock/realtime/handler.py index b48c37791c4..b7237d288ec 100644 --- a/litellm/llms/bedrock/realtime/handler.py +++ b/litellm/llms/bedrock/realtime/handler.py @@ -9,6 +9,8 @@ import contextlib import json from typing import Any, Optional +from pydantic import TypeAdapter + from litellm._logging import _redact_string, verbose_proxy_logger from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLogging @@ -16,6 +18,8 @@ from ..base_aws_llm import BaseAWSLLM from ..common_utils import BedrockError from .transformation import BedrockRealtimeConfig +_CLIENT_MODALITIES_ADAPTER: TypeAdapter["list[str] | None"] = TypeAdapter(list[str] | None) + class BedrockRealtime(BaseAWSLLM): """Handler for Bedrock Nova Sonic realtime speech-to-speech API.""" @@ -124,6 +128,9 @@ class BedrockRealtime(BaseAWSLLM): verbose_proxy_logger.debug("Bedrock Realtime: Bidirectional stream established") + await websocket.send_text(json.dumps(transformation_config.session_created_event(model, logging_obj))) + verbose_proxy_logger.debug("Bedrock Realtime: sent session.created to client on connect") + # Track state for transformation session_state = { "current_output_item_id": None, @@ -143,6 +150,7 @@ class BedrockRealtime(BaseAWSLLM): transformation_config, model, session_state, + logging_obj, ) ) @@ -179,6 +187,7 @@ class BedrockRealtime(BaseAWSLLM): transformation_config: BedrockRealtimeConfig, model: str, session_state: dict, + logging_obj: LiteLLMLogging | None = None, ): """Forward messages from client WebSocket to Bedrock stream.""" from aws_sdk_bedrock_runtime.models import ( @@ -210,6 +219,23 @@ class BedrockRealtime(BaseAWSLLM): for bedrock_message in transformed_messages: await send_to_bedrock(bedrock_message) + if logging_obj is not None: + client_message_type: str | None = None + requested_modalities: list[str] | None = None + with contextlib.suppress(Exception): + parsed_client_message = json.loads(message) + client_message_type = parsed_client_message.get("type") + if client_message_type == "session.update": + requested_modalities = _CLIENT_MODALITIES_ADAPTER.validate_python( + parsed_client_message.get("session", {}).get("modalities") + ) + if client_message_type == "session.update": + await client_ws.send_text( + json.dumps( + transformation_config.session_updated_event(model, logging_obj, requested_modalities) + ) + ) + except Exception as e: verbose_proxy_logger.debug(f"Client to Bedrock forwarding ended: {e}", exc_info=True) for close_message in transformation_config.session_close_messages(): diff --git a/litellm/llms/bedrock/realtime/transformation.py b/litellm/llms/bedrock/realtime/transformation.py index fe5f0584e03..24a40ebea1b 100644 --- a/litellm/llms/bedrock/realtime/transformation.py +++ b/litellm/llms/bedrock/realtime/transformation.py @@ -623,35 +623,42 @@ class BedrockRealtimeConfig(BaseRealtimeConfig): verbose_logger.warning(f"Unknown message type: {message_type}") return [] - def transform_session_start_event( + def _session_object( self, - event: dict, model: str, logging_obj: LiteLLMLoggingObj, - ) -> OpenAIRealtimeStreamSessionEvents: - """ - Transform Bedrock sessionStart event to OpenAI session.created. - - Args: - event: Bedrock sessionStart event - model: Model ID - logging_obj: Logging object - - Returns: - OpenAI session.created event - """ - verbose_logger.debug("Handling sessionStart") - + modalities: list[str] | None = None, + ) -> OpenAIRealtimeStreamSession: session = OpenAIRealtimeStreamSession( id=logging_obj.litellm_trace_id, - modalities=["text", "audio"], + modalities=modalities if modalities is not None else ["text", "audio"], ) if model is not None and isinstance(model, str): session["model"] = model + return session + def session_created_event( + self, + model: str, + logging_obj: LiteLLMLoggingObj, + ) -> OpenAIRealtimeStreamSessionEvents: + """Build the OpenAI session.created event for this realtime session.""" return OpenAIRealtimeStreamSessionEvents( type="session.created", - session=session, + session=self._session_object(model, logging_obj), + event_id=str(uuid.uuid4()), + ) + + def session_updated_event( + self, + model: str, + logging_obj: LiteLLMLoggingObj, + modalities: list[str] | None = None, + ) -> OpenAIRealtimeStreamSessionEvents: + """Build the OpenAI session.updated ack reflecting the client's requested modalities.""" + return OpenAIRealtimeStreamSessionEvents( + type="session.updated", + session=self._session_object(model, logging_obj, modalities), event_id=str(uuid.uuid4()), ) @@ -1169,8 +1176,6 @@ class BedrockRealtimeConfig(BaseRealtimeConfig): # Route to appropriate transformation method if "sessionStart" in event: - session_created = self.transform_session_start_event(event, model, logging_obj) - returned_messages.append(session_created) session_configuration_request = json.dumps({"configured": True}) elif "contentStart" in event: diff --git a/litellm/llms/bedrock_mantle/responses/transformation.py b/litellm/llms/bedrock_mantle/responses/transformation.py index 31975444a31..08579b6bf0d 100644 --- a/litellm/llms/bedrock_mantle/responses/transformation.py +++ b/litellm/llms/bedrock_mantle/responses/transformation.py @@ -17,6 +17,7 @@ BaseAWSLLM._sign_request after the request body is finalized. from typing import Any, Dict, List, Optional +import litellm from litellm._logging import verbose_logger from litellm.llms.bedrock.base_aws_llm import BaseAWSLLM from litellm.llms.bedrock_mantle.common_utils import ( @@ -25,7 +26,10 @@ from litellm.llms.bedrock_mantle.common_utils import ( ) from litellm.llms.openai.responses.transformation import OpenAIResponsesAPIConfig from litellm.secret_managers.main import get_secret_str -from litellm.types.llms.openai import ResponsesAPIOptionalRequestParams +from litellm.types.llms.openai import ( + ResponseInputParam, + ResponsesAPIOptionalRequestParams, +) from litellm.types.router import GenericLiteLLMParams from litellm.types.utils import LlmProviders @@ -42,6 +46,10 @@ _BASE_SUFFIXES_TO_STRIP = ( # Per Bedrock Mantle Responses API validation errors. _BEDROCK_MANTLE_SUPPORTED_RESPONSE_TOOL_TYPES = frozenset({"function", "mcp", "custom", "namespace", "tool_search"}) +_BEDROCK_MANTLE_SUPPORTED_SERVICE_TIERS = frozenset({"auto", "default"}) + +_CODEX_ADDITIONAL_TOOLS_INPUT_ITEM_TYPE = "additional_tools" + class BedrockMantleResponsesAPIConfig(BedrockMantleAuthMixin, OpenAIResponsesAPIConfig): def __init__( @@ -116,15 +124,104 @@ class BedrockMantleResponsesAPIConfig(BedrockMantleAuthMixin, OpenAIResponsesAPI return kept + @staticmethod + def _handle_unsupported_service_tier(params: dict, drop_params: bool) -> dict: + service_tier = params.get("service_tier") + if service_tier is None or service_tier in _BEDROCK_MANTLE_SUPPORTED_SERVICE_TIERS: + return params + if not drop_params: + raise litellm.utils.UnsupportedParamsError( + status_code=400, + message=( + f"bedrock_mantle does not support service_tier={service_tier!r}; the Bedrock Mantle " + "Responses API only accepts 'auto' or 'default'. Set `drop_params: true` (litellm_settings " + "or this deployment's litellm_params) to have LiteLLM drop it, or remove service_tier from " + "the client (Codex CLI sends it when a speed tier is set in ~/.codex/config.toml)." + ), + ) + verbose_logger.warning( + "Bedrock Mantle Responses API: dropping unsupported service_tier %r (supported: %s).", + service_tier, + sorted(_BEDROCK_MANTLE_SUPPORTED_SERVICE_TIERS), + ) + return {key: value for key, value in params.items() if key != "service_tier"} + + def transform_responses_api_request( + self, + model: str, + input: "str | ResponseInputParam", + response_api_optional_request_params: dict, + litellm_params: GenericLiteLLMParams, + headers: dict, + ) -> dict: + remaining_input, hoisted_tools = self._hoist_codex_additional_tools(input) + request_params = ( + { + **response_api_optional_request_params, + "tools": [ + *(response_api_optional_request_params.get("tools") or []), + *hoisted_tools, + ], + } + if hoisted_tools + else response_api_optional_request_params + ) + return super().transform_responses_api_request( + model=model, + input=remaining_input, + response_api_optional_request_params=request_params, + litellm_params=litellm_params, + headers=headers, + ) + + @staticmethod + def _is_codex_additional_tools_item(item: Any) -> bool: + return isinstance(item, dict) and item.get("type") == _CODEX_ADDITIONAL_TOOLS_INPUT_ITEM_TYPE + + @staticmethod + def _tools_of_additional_tools_item(item: "dict[str, Any]") -> "list[Any]": + tools = item.get("tools") + return tools if isinstance(tools, list) else [] + + @classmethod + def _hoist_codex_additional_tools( + cls, + input: "str | ResponseInputParam", + ) -> "tuple[str | ResponseInputParam, list[Any]]": + """Codex's "responses lite" wire mode ships tool definitions inside + `input` as {"type": "additional_tools", "role": "developer", + "tools": [...]} items. api.openai.com accepts that item type; Mantle + rejects the whole request with 400 "Invalid 'input': value did not + match any expected variant" but accepts the same tools at the top + level, so move them there and strip the items from `input`. + """ + if not isinstance(input, list): + return input, [] + additional_tools_items = [item for item in input if cls._is_codex_additional_tools_item(item)] + if not additional_tools_items: + return input, [] + remaining_input = [item for item in input if not cls._is_codex_additional_tools_item(item)] + hoisted_tools = [tool for item in additional_tools_items for tool in cls._tools_of_additional_tools_item(item)] + verbose_logger.debug( + "Bedrock Mantle Responses API: hoisting %d tool(s) out of %d 'additional_tools' input item(s) " + "into the top-level tools param (Mantle rejects that input item type).", + len(hoisted_tools), + len(additional_tools_items), + ) + return remaining_input, cls._filter_unsupported_tools(hoisted_tools) + def map_openai_params( self, response_api_optional_params: ResponsesAPIOptionalRequestParams, model: str, drop_params: bool, ) -> Dict: - params = super().map_openai_params( - response_api_optional_params=response_api_optional_params, - model=model, + params = self._handle_unsupported_service_tier( + super().map_openai_params( + response_api_optional_params=response_api_optional_params, + model=model, + drop_params=drop_params, + ), drop_params=drop_params, ) diff --git a/litellm/llms/custom_httpx/aiohttp_transport.py b/litellm/llms/custom_httpx/aiohttp_transport.py index 3172d3667e1..df5b10b3bdc 100644 --- a/litellm/llms/custom_httpx/aiohttp_transport.py +++ b/litellm/llms/custom_httpx/aiohttp_transport.py @@ -85,29 +85,12 @@ class AiohttpResponseStream(httpx.AsyncByteStream): try: async for chunk in self._aiohttp_response.content.iter_chunked(self.CHUNK_SIZE): yield chunk - except ( - aiohttp.ClientPayloadError, - aiohttp.client_exceptions.ClientPayloadError, - ) as e: - # Handle incomplete transfers more gracefully - # Log the error but don't re-raise if we've already yielded some data - verbose_logger.debug(f"Transfer incomplete, but continuing: {e}") - # If the error is due to incomplete transfer encoding, we can still - # return what we've received so far, similar to how httpx handles it - return except RuntimeError as e: - # Some providers (e.g., SSE streams) may close the connection - # causing aiohttp StreamReader to raise a generic RuntimeError - # with message "Connection closed.". Treat this as a graceful - # end-of-stream so downstream consumers don't error. - if "Connection closed" in str(e): - verbose_logger.debug("Upstream closed streaming connection; ending iterator gracefully") - return - raise + if "Connection closed" not in str(e): + raise + raise httpx.ReadError(str(e)) from e except aiohttp.http_exceptions.TransferEncodingError as e: - # Handle transfer encoding errors gracefully - verbose_logger.debug(f"Transfer encoding error, but continuing: {e}") - return + raise httpx.ReadError(str(e)) from e except Exception: # For other exceptions, use the normal mapping with map_aiohttp_exceptions(): @@ -160,13 +143,26 @@ class LiteLLMAiohttpTransport(AiohttpTransport): client: Union[ClientSession, Callable[[], ClientSession]], ssl_verify: Optional[Union[bool, ssl.SSLContext]] = None, owns_session: bool = True, + session_factory: Callable[[], ClientSession] | None = None, ): self.client = client self._ssl_verify = ssl_verify # Store for per-request SSL override super().__init__(client=client, owns_session=owns_session) # Store the client factory for recreating sessions when needed - if callable(client): - self._client_factory = client + default_factory: Callable[[], ClientSession] = client if callable(client) else ClientSession + self._client_factory: Callable[[], ClientSession] = session_factory or default_factory + + def _rebuild_session(self) -> ClientSession: + """ + Build a replacement session from the configured factory. + + The replacement is reachable only from this transport, so the transport + owns it from here on even when it was originally handed a session it did + not own (the proxy's shared session). + """ + session = self._client_factory() + self._owns_session = True + return session def _get_valid_client_session(self) -> ClientSession: """ @@ -175,24 +171,16 @@ class LiteLLMAiohttpTransport(AiohttpTransport): This handles the case where the session was created in a different event loop that may have been closed (common in CI/CD environments). """ - from aiohttp.client import ClientSession - # If we don't have a client or it's not a ClientSession, create one if not isinstance(self.client, ClientSession): - if hasattr(self, "_client_factory") and callable(self._client_factory): - self.client = self._client_factory() - else: - self.client = ClientSession() + self.client = self._rebuild_session() # Don't return yet - check if the newly created session is valid # Check if the session itself is closed if self.client.closed: verbose_logger.debug("Session is closed, creating new session") # Create a new session - if hasattr(self, "_client_factory") and callable(self._client_factory): - self.client = self._client_factory() - else: - self.client = ClientSession() + self.client = self._rebuild_session() return self.client # Check if the existing session is still valid for the current event loop @@ -205,7 +193,7 @@ class LiteLLMAiohttpTransport(AiohttpTransport): # Close old session to prevent leaks old_session = self.client try: - if not old_session.closed: + if self._owns_session and not old_session.closed: try: asyncio.create_task(old_session.close()) except RuntimeError: @@ -215,17 +203,11 @@ class LiteLLMAiohttpTransport(AiohttpTransport): verbose_logger.debug(f"Error closing old session: {e}") # Create a new session in the current event loop - if hasattr(self, "_client_factory") and callable(self._client_factory): - self.client = self._client_factory() - else: - self.client = ClientSession() + self.client = self._rebuild_session() except (RuntimeError, AttributeError): # If we can't check the loop or session is invalid, recreate it - if hasattr(self, "_client_factory") and callable(self._client_factory): - self.client = self._client_factory() - else: - self.client = ClientSession() + self.client = self._rebuild_session() return self.client @@ -320,10 +302,7 @@ class LiteLLMAiohttpTransport(AiohttpTransport): if "Session is closed" in str(e): verbose_logger.debug(f"Session closed during request, retrying with new session: {e}") # Force creation of a new session - if hasattr(self, "_client_factory") and callable(self._client_factory): - self.client = self._client_factory() - else: - self.client = ClientSession() + self.client = self._rebuild_session() client_session = self.client # Retry the request with the new session diff --git a/litellm/llms/custom_httpx/http_handler.py b/litellm/llms/custom_httpx/http_handler.py index 5cec763bb5d..c92f8bcc937 100644 --- a/litellm/llms/custom_httpx/http_handler.py +++ b/litellm/llms/custom_httpx/http_handler.py @@ -1013,17 +1013,6 @@ class AsyncHTTPHandler: verbose_logger.debug("Creating AiohttpTransport...") - # Use shared session if provided and valid - if shared_session is not None and not shared_session.closed: - verbose_logger.debug(f"SHARED SESSION: Reusing existing ClientSession (ID: {id(shared_session)})") - return LiteLLMAiohttpTransport( - client=shared_session, - ssl_verify=ssl_for_transport, - owns_session=False, - ) - - # Create new session only if none provided or existing one is invalid - verbose_logger.debug("NEW SESSION: Creating new ClientSession (no shared session provided)") transport_connector_kwargs = { "keepalive_timeout": AIOHTTP_KEEPALIVE_TIMEOUT, "ttl_dns_cache": AIOHTTP_TTL_DNS_CACHE, @@ -1041,11 +1030,26 @@ class AsyncHTTPHandler: if socket_factory is not None: transport_connector_kwargs["socket_factory"] = socket_factory - return LiteLLMAiohttpTransport( - client=lambda: ClientSession( + def session_factory() -> ClientSession: + return ClientSession( connector=TCPConnector(**transport_connector_kwargs), trust_env=trust_env, - ), + ) + + # Use shared session if provided and valid + if shared_session is not None and not shared_session.closed: + verbose_logger.debug(f"SHARED SESSION: Reusing existing ClientSession (ID: {id(shared_session)})") + return LiteLLMAiohttpTransport( + client=shared_session, + ssl_verify=ssl_for_transport, + owns_session=False, + session_factory=session_factory, + ) + + # Create new session only if none provided or existing one is invalid + verbose_logger.debug("NEW SESSION: Creating new ClientSession (no shared session provided)") + return LiteLLMAiohttpTransport( + client=session_factory, ssl_verify=ssl_for_transport, ) diff --git a/litellm/llms/custom_httpx/llm_http_handler.py b/litellm/llms/custom_httpx/llm_http_handler.py index c426714a1bd..ec1301e5923 100644 --- a/litellm/llms/custom_httpx/llm_http_handler.py +++ b/litellm/llms/custom_httpx/llm_http_handler.py @@ -1,6 +1,8 @@ import asyncio import json +import os import ssl +from contextlib import asynccontextmanager from functools import lru_cache from typing import ( TYPE_CHECKING, @@ -147,12 +149,23 @@ from litellm.utils import ( async_pre_call_deployment_hook, ) + +def _rust_responses_websocket_enabled( + custom_llm_provider: str | None, + litellm_params: GenericLiteLLMParams, +) -> bool: + return custom_llm_provider == "openai" and litellm_params.get("rust") is True + + from .http_handler import get_shared_realtime_ssl_context if TYPE_CHECKING: from aiohttp import ClientSession from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj + from litellm.llms.anthropic.experimental_pass_through.messages.streaming_iterator import ( + AnthropicMessagesStreamingResponse, + ) from litellm.llms.base_llm.passthrough.transformation import BasePassthroughConfig from litellm.types.llms.openai_evals import ( CancelEvalResponse, @@ -1879,6 +1892,7 @@ class BaseLLMHTTPHandler: litellm_params: GenericLiteLLMParams, api_key: Optional[str], model: str, + timeout: Optional[Union[float, httpx.Timeout]] = None, ) -> httpx.Response: max_attempts = max(provider_config.max_retry_on_anthropic_messages_http_error, 1) litellm_params_dict = dict(litellm_params) @@ -1891,6 +1905,7 @@ class BaseLLMHTTPHandler: data=signed_json_body or json.dumps(request_body), stream=stream or False, logging_obj=logging_obj, + timeout=timeout, ) response.raise_for_status() return response @@ -1925,6 +1940,32 @@ class BaseLLMHTTPHandler: raise RuntimeError("unreachable: anthropic messages HTTP retry loop exited without return") + @staticmethod + def _resolve_anthropic_messages_timeout( + litellm_params: GenericLiteLLMParams, + stream: bool, + custom_llm_provider: str, + ) -> Optional[Union[float, httpx.Timeout]]: + from litellm.litellm_core_utils.completion_timeout import CompletionTimeout + from litellm.litellm_core_utils.request_timeout_resolver import ( + get_configured_request_timeout, + ) + from litellm.utils import supports_httpx_timeout + + stream_timeout = litellm_params.get("stream_timeout") if stream else None + model_timeout = stream_timeout if stream_timeout is not None else litellm_params.get("timeout") + request_timeout = litellm_params.get("request_timeout") + global_timeout = get_configured_request_timeout() + if model_timeout is None and request_timeout is None and global_timeout is None: + return None + return CompletionTimeout.resolve( + model_timeout, + {"request_timeout": request_timeout}, + custom_llm_provider, + global_timeout=global_timeout, + supports_httpx_timeout=supports_httpx_timeout, + ) + async def async_anthropic_messages_handler( self, model: str, @@ -2063,6 +2104,36 @@ class BaseLLMHTTPHandler: }, ) + rust_messages_response = await self._maybe_rust_anthropic_messages( + custom_llm_provider=custom_llm_provider, + litellm_params=litellm_params, + has_agentic_hook=self._has_agentic_completion_hook(logging_obj), + model=model, + api_key=api_key, + api_base=api_base, + headers=headers, + request_body=request_body, + timeout=self._resolve_anthropic_messages_timeout( + litellm_params=litellm_params, + stream=stream or False, + custom_llm_provider=custom_llm_provider, + ), + ) + if rust_messages_response is not None: + if stream: + return self._rust_anthropic_messages_fake_stream(rust_messages_response) + return await self._finalize_anthropic_messages_response( + initial_response=rust_messages_response, + model=model, + messages=messages, + anthropic_messages_provider_config=anthropic_messages_provider_config, + anthropic_messages_optional_request_params=anthropic_messages_optional_request_params, + logging_obj=logging_obj, + custom_llm_provider=custom_llm_provider, + api_key=api_key, + kwargs=kwargs, + ) + response = await self._async_post_anthropic_messages_with_http_error_retry( async_httpx_client=async_httpx_client, request_url=request_url, @@ -2075,6 +2146,11 @@ class BaseLLMHTTPHandler: litellm_params=litellm_params, api_key=api_key, model=model, + timeout=self._resolve_anthropic_messages_timeout( + litellm_params=litellm_params, + stream=stream or False, + custom_llm_provider=custom_llm_provider, + ), ) # used for logging + cost tracking @@ -2132,6 +2208,31 @@ class BaseLLMHTTPHandler: logging_obj=logging_obj, ) + return await self._finalize_anthropic_messages_response( + initial_response=initial_response, + model=model, + messages=messages, + anthropic_messages_provider_config=anthropic_messages_provider_config, + anthropic_messages_optional_request_params=anthropic_messages_optional_request_params, + logging_obj=logging_obj, + custom_llm_provider=custom_llm_provider, + api_key=api_key, + kwargs=kwargs, + ) + + async def _finalize_anthropic_messages_response( + self, + *, + initial_response: AnthropicMessagesResponse, + model: str, + messages: list[dict], + anthropic_messages_provider_config: BaseAnthropicMessagesConfig, + anthropic_messages_optional_request_params: dict, + logging_obj: LiteLLMLoggingObj, + custom_llm_provider: str, + api_key: str | None, + kwargs: dict, + ) -> AnthropicMessagesResponse | AsyncIterator: # Inject api_key into kwargs so follow-up calls in agentic hooks can # authenticate. api_key is a named param here (not in kwargs), so # _prepare_followup_kwargs would miss it otherwise. @@ -2155,6 +2256,75 @@ class BaseLLMHTTPHandler: "anthropic_messages", ) + @staticmethod + def _rust_env_enabled() -> bool: + return os.getenv("LITELLM_RUST", "").strip().lower() in {"1", "true", "yes", "on"} + + @staticmethod + async def _maybe_rust_anthropic_messages( + *, + custom_llm_provider: str, + litellm_params: GenericLiteLLMParams, + has_agentic_hook: bool, + model: str, + api_key: str | None, + api_base: str | None, + headers: dict, + request_body: dict, + timeout: float | httpx.Timeout | None, + ) -> AnthropicMessagesResponse | None: + if custom_llm_provider not in ("azure_ai", "anthropic"): + return None + if litellm_params.get("rust") is not True and not BaseLLMHTTPHandler._rust_env_enabled(): + return None + if has_agentic_hook: + return None + + from litellm.rust_bridge import messages as rust_messages_bridge + + upstream_body = {key: value for key, value in request_body.items() if key != "stream"} + try: + rust_response = await rust_messages_bridge.amessages( + model=model, + body=upstream_body, + api_key=api_key, + api_base=api_base, + custom_llm_provider=custom_llm_provider, + extra_headers=headers, + timeout=timeout, + ) + except Exception as rust_error: # noqa: BLE001 # rollout-safety fallback: any Rust bridge failure must fall back to the Python path + verbose_logger.debug( + "Rust Anthropic messages bridge raised %s; falling back to Python path", + type(rust_error).__name__, + ) + return None + if rust_response is None: + return None + + response_obj = cast(AnthropicMessagesResponse, dict(rust_response)) + response_obj["_hidden_params"] = {"additional_headers": {"x-litellm-rust": "true"}} + return response_obj + + @staticmethod + def _rust_anthropic_messages_fake_stream( + rust_response: AnthropicMessagesResponse, + ) -> "AnthropicMessagesStreamingResponse": + from litellm.llms.anthropic.experimental_pass_through.messages.fake_stream_iterator import ( + FakeAnthropicMessagesStreamIterator, + ) + from litellm.llms.anthropic.experimental_pass_through.messages.streaming_iterator import ( + AnthropicMessagesStreamHiddenParams, + AnthropicMessagesStreamingResponse, + ) + + completion_stream = cast(AsyncIterator[bytes], FakeAnthropicMessagesStreamIterator(response=rust_response)) + hidden_params = AnthropicMessagesStreamHiddenParams(additional_headers={"x-litellm-rust": "true"}) + return AnthropicMessagesStreamingResponse( + completion_stream=completion_stream, + hidden_params=hidden_params, + ) + def anthropic_messages_handler( self, model: str, @@ -2657,9 +2827,10 @@ class BaseLLMHTTPHandler: ) result = final_response if final_response is not None else initial_response - if litellm_params.get("_code_interpreter_interception_converted_stream") and not litellm_params.get( - "_agentic_loop_depth" - ): + interception_converted_stream = litellm_params.get( + "_code_interpreter_interception_converted_stream" + ) or litellm_params.get("_websearch_interception_converted_stream") + if interception_converted_stream and not litellm_params.get("_agentic_loop_depth"): return self._wrap_responses_response_as_fake_stream( result=result, model=model, @@ -5224,6 +5395,8 @@ class BaseLLMHTTPHandler: tools = anthropic_messages_optional_request_params.get("tools", []) depth, max_loops, fingerprints = self._get_agentic_loop_settings(kwargs=kwargs) + hook_kwargs = {**kwargs, "_agentic_loop_api_surface": api_surface} + for callback in callbacks: if not isinstance(callback, CustomLogger): continue @@ -5244,7 +5417,7 @@ class BaseLLMHTTPHandler: tools=tools, stream=stream, custom_llm_provider=custom_llm_provider, - kwargs=kwargs, + kwargs=hook_kwargs, ) except Exception as e: _call_id = getattr(logging_obj, "litellm_call_id", "unknown") @@ -5270,7 +5443,7 @@ class BaseLLMHTTPHandler: ) try: - kwargs_with_provider = kwargs.copy() if kwargs else {} + kwargs_with_provider = hook_kwargs.copy() kwargs_with_provider["custom_llm_provider"] = custom_llm_provider build_plan_overridden = ( callback.__class__.async_build_agentic_loop_plan is not CustomLogger.async_build_agentic_loop_plan @@ -6055,12 +6228,29 @@ class BaseLLMHTTPHandler: }, ) - async with websockets.connect( # type: ignore - ws_url, - additional_headers=headers, - max_size=REALTIME_WEBSOCKET_MAX_MESSAGE_SIZE_BYTES, - ssl=ssl_context, - ) as backend_ws: + @asynccontextmanager + async def _backend_connection(): + if _rust_responses_websocket_enabled(custom_llm_provider, litellm_params): + from litellm.rust_bridge import responses_websocket as rust_responses_websocket + + rust_backend = await rust_responses_websocket.connect( + url=ws_url, + headers={str(key): str(value) for key, value in headers.items()}, + timeout=timeout, + ) + if rust_backend is not None: + yield rust_backend + return + + async with websockets.connect( # type: ignore + ws_url, + additional_headers=headers, + max_size=REALTIME_WEBSOCKET_MAX_MESSAGE_SIZE_BYTES, + ssl=ssl_context, + ) as backend: + yield backend + + async with _backend_connection() as backend_ws: _request_data: Dict[str, Any] = {} if litellm_metadata: _request_data["litellm_metadata"] = litellm_metadata diff --git a/litellm/llms/dashscope/cost_calculator.py b/litellm/llms/dashscope/cost_calculator.py index 2f710d78126..2732b97cd35 100644 --- a/litellm/llms/dashscope/cost_calculator.py +++ b/litellm/llms/dashscope/cost_calculator.py @@ -7,6 +7,7 @@ Handles tiered pricing and prompt caching scenarios. from dataclasses import dataclass from typing import List, Optional, Tuple +from litellm.litellm_core_utils.llm_cost_calc.tiered_pricing import calculate_tiered_cost from litellm.types.utils import ModelInfo, Usage from litellm.utils import get_model_info @@ -42,80 +43,6 @@ def _extract_token_breakdown(usage: Usage) -> TokenBreakdown: return TokenBreakdown(text_tokens, cached_tokens, completion_tokens, reasoning_tokens) -def _calculate_tiered_cost( - tokens: int, - tiered_pricing: List[dict], - cost_key: str, - fallback_cost_key: Optional[str] = None, -) -> float: - """ - Calculate cost for a given number of tokens based on a true tiered pricing structure. - - This function iterates through sorted pricing tiers, calculates the cost for the - number of tokens that fall into each tier's range, and sums them up to get the total cost. - - Args: - tokens (int): The total number of tokens to calculate the cost for. - tiered_pricing (List[dict]): A list of dictionaries, where each dictionary - represents a pricing tier. - cost_key (str): The key in the tier dictionary that holds the per-token cost - (e.g., 'input_cost_per_token'). - fallback_cost_key (Optional[str], optional): A fallback key to use if the - primary `cost_key` is not found in a tier. Defaults to None. - - Returns: - float: The total calculated cost for the given tokens. - - Example: - >>> tiered_pricing = [ - ... {"range": [0, 100000], "input_cost_per_token": 0.0001}, - ... {"range": [100000, 500000], "input_cost_per_token": 0.00005}, - ... ] - - Calculating cost for 150,000 tokens: - (100,000 * 0.0001) + (50,000 * 0.00005) = $12.5 - """ - if not tiered_pricing or tokens <= 0: - return 0.0 - - total_cost = 0.0 - tokens_processed = 0 - - sorted_tiers = sorted(tiered_pricing, key=lambda x: x.get("range", [0, 0])[0]) - - for tier in sorted_tiers: - if tokens_processed >= tokens: - break - - tier_range = tier.get("range", []) - if len(tier_range) != 2: - continue - - range_start, range_end = tier_range - - if tokens <= range_start: - continue - - tier_start = max(range_start, tokens_processed) - tier_end = min(range_end, tokens) - - if tier_end > tier_start: - tokens_in_tier = tier_end - tier_start - cost_per_token = tier.get(cost_key) or tier.get(fallback_cost_key, 0) - total_cost += tokens_in_tier * cost_per_token - tokens_processed = tier_end - - # After loop, check if any tokens remain (i.e., tokens > highest tier's end range) - # and charge them at the last tier's rate. - if tokens_processed < tokens and sorted_tiers: - last_tier = sorted_tiers[-1] - remaining_tokens = tokens - tokens_processed - cost_per_token = last_tier.get(cost_key) or last_tier.get(fallback_cost_key, 0) - total_cost += remaining_tokens * cost_per_token - - return total_cost - - def _calculate_prompt_cost( breakdown: TokenBreakdown, model_info: ModelInfo, @@ -123,12 +50,12 @@ def _calculate_prompt_cost( ) -> float: """Calculate total prompt cost including cached tokens.""" if tiered_pricing: - text_cost = _calculate_tiered_cost( + text_cost = calculate_tiered_cost( tokens=breakdown.text_tokens, tiered_pricing=tiered_pricing, cost_key="input_cost_per_token", ) - cache_cost = _calculate_tiered_cost( + cache_cost = calculate_tiered_cost( tokens=breakdown.cached_tokens, tiered_pricing=tiered_pricing, cost_key="cache_read_input_token_cost", @@ -155,12 +82,12 @@ def _calculate_completion_cost( ) -> float: """Calculate total completion cost including reasoning tokens.""" if tiered_pricing: - completion_cost = _calculate_tiered_cost( + completion_cost = calculate_tiered_cost( tokens=breakdown.completion_tokens, tiered_pricing=tiered_pricing, cost_key="output_cost_per_token", ) - reasoning_cost = _calculate_tiered_cost( + reasoning_cost = calculate_tiered_cost( tokens=breakdown.reasoning_tokens, tiered_pricing=tiered_pricing, cost_key="output_cost_per_reasoning_token", diff --git a/litellm/llms/databricks/chat/transformation.py b/litellm/llms/databricks/chat/transformation.py index ba8c312ea51..9c05899c719 100644 --- a/litellm/llms/databricks/chat/transformation.py +++ b/litellm/llms/databricks/chat/transformation.py @@ -181,6 +181,10 @@ class DatabricksConfig(DatabricksBase, OpenAILikeChatConfig, AnthropicConfig): if key != "self" and value is not None: setattr(self.__class__, key, value) + @property + def custom_llm_provider(self) -> Optional[str]: + return "databricks" + @classmethod def get_config(cls): return super().get_config() @@ -372,6 +376,7 @@ class DatabricksConfig(DatabricksBase, OpenAILikeChatConfig, AnthropicConfig): mapped_thinking = AnthropicConfig._map_reasoning_effort( reasoning_effort=reasoning_effort_value, model=model, + custom_llm_provider="databricks", llm_provider="databricks", ) if mapped_thinking is None: @@ -379,7 +384,7 @@ class DatabricksConfig(DatabricksBase, OpenAILikeChatConfig, AnthropicConfig): optional_params.pop("output_config", None) else: optional_params["thinking"] = mapped_thinking - if AnthropicConfig._is_adaptive_thinking_model(model): + if AnthropicConfig._is_adaptive_thinking_model(model, "databricks"): mapped_effort: Optional[str] = None if isinstance(reasoning_effort_value, str): mapped_effort = REASONING_EFFORT_TO_OUTPUT_CONFIG_EFFORT.get(reasoning_effort_value) diff --git a/litellm/llms/deepseek/chat/transformation.py b/litellm/llms/deepseek/chat/transformation.py index 7a548136f2a..525de1476e2 100644 --- a/litellm/llms/deepseek/chat/transformation.py +++ b/litellm/llms/deepseek/chat/transformation.py @@ -35,7 +35,9 @@ class DeepSeekChatConfig(OpenAIGPTConfig): Map OpenAI params to DeepSeek params. Handles `thinking` and `reasoning_effort` parameters for DeepSeek reasoner models. - DeepSeek only supports `{"type": "enabled"}` - no budget_tokens like Anthropic. + DeepSeek supports `{"type": "enabled"}` and `{"type": "disabled"}` - no budget_tokens + like Anthropic. `reasoning_effort="none"` is the OpenAI-style way to ask for thinking + off, so it maps to `{"type": "disabled"}`; any other effort keeps thinking on. Reference: https://api-docs.deepseek.com/guides/thinking_mode """ @@ -47,15 +49,13 @@ class DeepSeekChatConfig(OpenAIGPTConfig): thinking_value = optional_params.pop("thinking", None) reasoning_effort = optional_params.pop("reasoning_effort", None) - # Handle thinking parameter - only accept {"type": "enabled"} - if thinking_value is not None: - if isinstance(thinking_value, dict) and thinking_value.get("type") == "enabled": - # DeepSeek only accepts {"type": "enabled"}, ignore budget_tokens - optional_params["thinking"] = {"type": "enabled"} + # Handle thinking parameter - accept both enabled and disabled, ignore budget_tokens + if isinstance(thinking_value, dict) and thinking_value.get("type") in ("enabled", "disabled"): + optional_params["thinking"] = {"type": thinking_value["type"]} - # Handle reasoning_effort - map to thinking enabled - elif reasoning_effort is not None and reasoning_effort != "none": - optional_params["thinking"] = {"type": "enabled"} + # Otherwise fall back to reasoning_effort: "none" disables, anything else enables + elif reasoning_effort is not None: + optional_params["thinking"] = {"type": "disabled" if reasoning_effort == "none" else "enabled"} return optional_params diff --git a/litellm/llms/fireworks_ai/chat/transformation.py b/litellm/llms/fireworks_ai/chat/transformation.py index d4258557fe7..eeae8c76888 100644 --- a/litellm/llms/fireworks_ai/chat/transformation.py +++ b/litellm/llms/fireworks_ai/chat/transformation.py @@ -48,7 +48,7 @@ from ...openai.chat.gpt_transformation import ( OpenAIChatCompletionStreamingHandler, OpenAIGPTConfig, ) -from ..common_utils import FireworksAIException +from ..common_utils import FireworksAIMixin, FireworksAIException def _extract_fireworks_hidden_params(payload: dict) -> dict: @@ -70,7 +70,7 @@ def _extract_fireworks_hidden_params(payload: dict) -> dict: return {**top_level, **per_choice} -class FireworksAIConfig(OpenAIGPTConfig): +class FireworksAIConfig(FireworksAIMixin, OpenAIGPTConfig): """ Reference: https://docs.fireworks.ai/api-reference/post-chatcompletions @@ -114,6 +114,16 @@ class FireworksAIConfig(OpenAIGPTConfig): prompt_truncate_len: Optional[int] = None, context_length_exceeded_behavior: Optional[Literal["error", "truncate"]] = None, ) -> None: + OpenAIGPTConfig.__init__( + self, + frequency_penalty=frequency_penalty, + max_tokens=max_tokens, + n=n, + stop=stop, + temperature=temperature, + top_p=top_p, + response_format=response_format, + ) locals_ = locals().copy() for key, value in locals_.items(): if key != "self" and value is not None: @@ -123,6 +133,32 @@ class FireworksAIConfig(OpenAIGPTConfig): def get_config(cls): return super().get_config() + def validate_environment( + self, + headers: dict, + model: str, + messages: List[AllMessageValues], + optional_params: dict, + litellm_params: dict, + api_key: str | None = None, + api_base: str | None = None, + ) -> dict: + api_key = self._get_api_key(api_key) + if api_key is None: + raise ValueError("FIREWORKS_API_KEY is not set") + + validated_headers = OpenAIGPTConfig.validate_environment( + self, + headers=headers, + model=model, + messages=messages, + optional_params=optional_params, + litellm_params=litellm_params, + api_key=api_key, + api_base=api_base, + ) + return self._add_session_affinity_header(validated_headers, litellm_params) + def get_supported_openai_params(self, model: str): # Base parameters supported by all models supported_params = [ diff --git a/litellm/llms/fireworks_ai/common_utils.py b/litellm/llms/fireworks_ai/common_utils.py index a1b6309d1e0..51ed8afbbd2 100644 --- a/litellm/llms/fireworks_ai/common_utils.py +++ b/litellm/llms/fireworks_ai/common_utils.py @@ -12,6 +12,23 @@ class FireworksAIException(BaseLLMException): pass +def get_fireworks_session_id(litellm_params: dict) -> str | None: + params = litellm_params + for key in ("litellm_session_id", "session_id"): + value = params.get(key) + if value: + return str(value) + metadata = params.get("metadata") + if isinstance(metadata, dict): + value = metadata.get("session_id") + if value: + return str(value) + value = params.get("litellm_trace_id") + if value: + return str(value) + return None + + class FireworksAIMixin: """ Common Base Config functions across Fireworks AI Endpoints @@ -47,4 +64,16 @@ class FireworksAIMixin: if api_key is None: raise ValueError("FIREWORKS_API_KEY is not set") - return {"Authorization": "Bearer {}".format(api_key), **headers} + auth_headers = {"Authorization": "Bearer {}".format(api_key), **headers} + content_type_header = ( + {} if any(key.lower() == "content-type" for key in auth_headers) else {"Content-Type": "application/json"} + ) + return self._add_session_affinity_header({**auth_headers, **content_type_header}, litellm_params) + + def _add_session_affinity_header(self, headers: dict, litellm_params: dict) -> dict: + if any(key.lower() == "x-session-affinity" for key in headers): + return headers + session_id = get_fireworks_session_id(litellm_params) + if not session_id: + return headers + return {**headers, "x-session-affinity": session_id} diff --git a/litellm/llms/fireworks_ai/cost_calculator.py b/litellm/llms/fireworks_ai/cost_calculator.py index ed936f6233a..682adf5a8ff 100644 --- a/litellm/llms/fireworks_ai/cost_calculator.py +++ b/litellm/llms/fireworks_ai/cost_calculator.py @@ -75,10 +75,23 @@ def cost_per_token(model: str, usage: Usage) -> Tuple[float, float]: model_info = get_model_info(model=base_model, custom_llm_provider="fireworks_ai") ## CALCULATE INPUT COST + prompt_tokens_details = usage.prompt_tokens_details + cached_tokens: int = ( + prompt_tokens_details.cached_tokens + if prompt_tokens_details is not None and prompt_tokens_details.cached_tokens is not None + else 0 + ) + input_cost_per_token: float = model_info["input_cost_per_token"] or 0.0 + cache_read_input_token_cost = model_info.get("cache_read_input_token_cost") + cache_read_cost_per_token: float = ( + cache_read_input_token_cost if cache_read_input_token_cost is not None else input_cost_per_token + ) + non_cached_prompt_tokens: int = max(usage.prompt_tokens - cached_tokens, 0) - prompt_cost: float = usage["prompt_tokens"] * model_info["input_cost_per_token"] + prompt_cost: float = non_cached_prompt_tokens * input_cost_per_token + cached_tokens * cache_read_cost_per_token ## CALCULATE OUTPUT COST - completion_cost = usage["completion_tokens"] * model_info["output_cost_per_token"] + output_cost_per_token: float = model_info["output_cost_per_token"] or 0.0 + completion_cost: float = usage.completion_tokens * output_cost_per_token return prompt_cost, completion_cost diff --git a/litellm/llms/github_copilot/messages/transformation.py b/litellm/llms/github_copilot/messages/transformation.py index fb3f0a4e159..4d7b003c48f 100644 --- a/litellm/llms/github_copilot/messages/transformation.py +++ b/litellm/llms/github_copilot/messages/transformation.py @@ -25,6 +25,10 @@ class GithubCopilotAnthropicMessagesConfig(AnthropicMessagesConfig): super().__init__() self.authenticator = Authenticator() + @property + def custom_llm_provider(self) -> Optional[str]: + return "github_copilot" + def handles_web_search_natively(self) -> bool: """ Copilot's /v1/messages endpoint does not execute ``web_search`` tools, so diff --git a/litellm/llms/huggingface/embedding/handler.py b/litellm/llms/huggingface/embedding/handler.py index 39eb430db74..f72a79e084d 100644 --- a/litellm/llms/huggingface/embedding/handler.py +++ b/litellm/llms/huggingface/embedding/handler.py @@ -322,7 +322,7 @@ class HuggingFaceEmbedding(BaseLLM): task = get_hf_task_embedding_for_model(model=model, task_type=task_type, api_base=HF_HUB_URL) # print_verbose(f"{model}, {task}") embed_url = "" - if "https" in model: + if model.startswith(("http://", "https://")): embed_url = model elif api_base: embed_url = api_base diff --git a/litellm/llms/huggingface/embedding/transformation.py b/litellm/llms/huggingface/embedding/transformation.py index 13e38ab5560..6f27e3115eb 100644 --- a/litellm/llms/huggingface/embedding/transformation.py +++ b/litellm/llms/huggingface/embedding/transformation.py @@ -316,25 +316,6 @@ class HuggingFaceEmbeddingConfig(BaseConfig): return data - def get_api_base(self, api_base: Optional[str], model: str) -> str: - """ - Get the API base for the Huggingface API. - - Do not add the chat/embedding/rerank extension here. Let the handler do this. - """ - if "https" in model: - completion_url = model - elif api_base is not None: - completion_url = api_base - elif "HF_API_BASE" in os.environ: - completion_url = os.getenv("HF_API_BASE", "") - elif "HUGGINGFACE_API_BASE" in os.environ: - completion_url = os.getenv("HUGGINGFACE_API_BASE", "") - else: - completion_url = f"https://api-inference.huggingface.co/models/{model}" - - return completion_url - def validate_environment( self, headers: Dict, diff --git a/litellm/llms/oobabooga/chat/oobabooga.py b/litellm/llms/oobabooga/chat/oobabooga.py index fe2bb9dc6d1..40d88e8e125 100644 --- a/litellm/llms/oobabooga/chat/oobabooga.py +++ b/litellm/llms/oobabooga/chat/oobabooga.py @@ -34,7 +34,7 @@ def completion( optional_params=optional_params, litellm_params=litellm_params, ) - if "https" in model: + if model.startswith(("http://", "https://")): completion_url = model elif api_base: completion_url = api_base @@ -96,7 +96,7 @@ def embedding( encoding=None, ): # Create completion URL - if "https" in model: + if model.startswith(("http://", "https://")): embeddings_url = model elif api_base: embeddings_url = f"{api_base}/v1/embeddings" diff --git a/litellm/llms/openai/chat/guardrail_translation/handler.py b/litellm/llms/openai/chat/guardrail_translation/handler.py index a6b6a6267c3..fd2c9339248 100644 --- a/litellm/llms/openai/chat/guardrail_translation/handler.py +++ b/litellm/llms/openai/chat/guardrail_translation/handler.py @@ -14,11 +14,14 @@ Pattern Overview: This pattern can be replicated for other message formats (e.g., Anthropic). """ -from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union, cast +from typing import TYPE_CHECKING, Any, Dict, List, Tuple, Union, cast import litellm from litellm._logging import verbose_proxy_logger -from litellm.llms.base_llm.guardrail_translation.base_translation import BaseTranslation +from litellm.llms.base_llm.guardrail_translation.base_translation import ( + BaseTranslation, + StreamTransformSink, +) from litellm.llms.base_llm.guardrail_translation.utils import ( effective_skip_system_message_for_guardrail, effective_skip_tool_message_for_guardrail, @@ -27,6 +30,9 @@ from litellm.llms.base_llm.guardrail_translation.utils import ( ) from litellm.main import stream_chunk_builder from litellm.types.llms.openai import AllMessageValues, ChatCompletionToolParam +from litellm.types.proxy.guardrails.guardrail_hooks.generic_guardrail_api import ( + coerce_stream_holdback_value, +) from litellm.types.utils import ( Choices, GenericGuardrailAPIInputs, @@ -50,7 +56,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): Methods can be overridden to customize behavior for different message formats. """ - def get_structured_messages(self, data: dict) -> Optional[List[AllMessageValues]]: + def get_structured_messages(self, data: dict) -> List[AllMessageValues] | None: """ Convert chat completions request data to OpenAI-spec structured messages. @@ -65,7 +71,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): self, data: dict, guardrail_to_apply: "CustomGuardrail", - litellm_logging_obj: Optional[Any] = None, + litellm_logging_obj: Any | None = None, ) -> Any: """ Process input messages by applying guardrails to text content. @@ -80,7 +86,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): texts_to_check: List[str] = [] images_to_check: List[str] = [] tool_calls_to_check: List[ChatCompletionToolParam] = [] - text_task_mappings: List[Tuple[int, Optional[int]]] = [] + text_task_mappings: List[Tuple[int, int | None]] = [] tool_call_task_mappings: List[Tuple[int, int]] = [] # Step 1: Extract all text content, images, and tool calls @@ -184,7 +190,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): texts_to_check: List[str], images_to_check: List[str], tool_calls_to_check: List[ChatCompletionToolParam], - text_task_mappings: List[Tuple[int, Optional[int]]], + text_task_mappings: List[Tuple[int, int | None]], tool_call_task_mappings: List[Tuple[int, int]], skip_system_message: bool = False, skip_tool_message: bool = False, @@ -239,7 +245,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): self, messages: List[Dict[str, Any]], responses: List[str], - task_mappings: List[Tuple[int, Optional[int]]], + task_mappings: List[Tuple[int, int | None]], ) -> None: """ Apply guardrail responses back to input message text content. @@ -249,7 +255,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): for task_idx, guardrail_response in enumerate(responses): mapping = task_mappings[task_idx] msg_idx = cast(int, mapping[0]) - content_idx_optional = cast(Optional[int], mapping[1]) + content_idx_optional = cast(int | None, mapping[1]) # Handle content content = messages[msg_idx].get("content", None) @@ -291,9 +297,9 @@ class OpenAIChatCompletionsHandler(BaseTranslation): self, response: "ModelResponse", guardrail_to_apply: "CustomGuardrail", - litellm_logging_obj: Optional[Any] = None, - user_api_key_dict: Optional[Any] = None, - request_data: Optional[dict] = None, + litellm_logging_obj: Any | None = None, + user_api_key_dict: Any | None = None, + request_data: dict | None = None, ) -> Any: """ Process output response by applying guardrails to text content. @@ -320,7 +326,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): texts_to_check: List[str] = [] images_to_check: List[str] = [] tool_calls_to_check: List[Dict[str, Any]] = [] - text_task_mappings: List[Tuple[int, Optional[int]]] = [] + text_task_mappings: List[Tuple[int, int | None]] = [] tool_call_task_mappings: List[Tuple[int, int]] = [] # text_task_mappings: Track (choice_index, content_index) for each text # content_index is None for string content, int for list content @@ -402,9 +408,10 @@ class OpenAIChatCompletionsHandler(BaseTranslation): self, responses_so_far: List["ModelResponseStream"], guardrail_to_apply: "CustomGuardrail", - litellm_logging_obj: Optional[Any] = None, - user_api_key_dict: Optional[Any] = None, - request_data: Optional[dict] = None, + litellm_logging_obj: Any | None = None, + user_api_key_dict: Any | None = None, + request_data: dict | None = None, + stream_transform_sink: StreamTransformSink | None = None, ) -> List["ModelResponseStream"]: """ Process output streaming responses by applying guardrails to text content. @@ -414,14 +421,50 @@ class OpenAIChatCompletionsHandler(BaseTranslation): guardrail_to_apply: The guardrail instance to apply litellm_logging_obj: Optional logging object user_api_key_dict: User API key metadata to pass to guardrails + stream_transform_sink: Optional out-parameter for the streaming text + transformation path. When provided, the guardrail runs over the raw + accumulated text (``responses_so_far`` is left untouched so it stays + a correct raw accumulator across rounds) and the guardrailed text + plus requested holdback are reported per choice on the sink. Returns: - Modified list of responses with guardrail applied to content + The (unmodified) list of responses. Response Format Support: - String content: choice.message.content = "text here" - List content: choice.message.content = [{"type": "text", "text": "text here"}, ...] """ + if stream_transform_sink is not None: + await self._process_streaming_transform( + responses_so_far=responses_so_far, + guardrail_to_apply=guardrail_to_apply, + litellm_logging_obj=litellm_logging_obj, + user_api_key_dict=user_api_key_dict, + request_data=request_data, + sink=stream_transform_sink, + ) + return responses_so_far + + return await self._process_streaming_block_only( + responses_so_far=responses_so_far, + guardrail_to_apply=guardrail_to_apply, + litellm_logging_obj=litellm_logging_obj, + user_api_key_dict=user_api_key_dict, + request_data=request_data, + ) + + async def _process_streaming_block_only( + self, + *, + responses_so_far: list["ModelResponseStream"], + guardrail_to_apply: "CustomGuardrail", + litellm_logging_obj: Any | None, + user_api_key_dict: Any | None, + request_data: dict | None, + ) -> list["ModelResponseStream"]: + """Block-only streaming path: run the guardrail so an in-flight BLOCK can + terminate the stream. Text rewrites are not propagated to the client here + (see ``_process_streaming_transform`` for the incremental_diff path).""" # check if the stream has ended has_stream_ended = False for chunk in responses_so_far: @@ -467,7 +510,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): # Step 2: Create lists for guardrail processing texts_to_check: List[str] = [] images_to_check: List[str] = [] - task_mappings: List[Tuple[int, Optional[int]]] = [] + task_mappings: List[Tuple[int, int | None]] = [] # Track (choice_index, content_index) for each combined text for (map_choice_idx, map_content_idx), combined_text in combined_texts.items(): @@ -520,9 +563,109 @@ class OpenAIChatCompletionsHandler(BaseTranslation): return responses_so_far + @staticmethod + def _accumulate_string_content_by_choice_index( + responses_so_far: list["ModelResponseStream"], + ) -> dict[int, str]: + """Accumulate raw string ``delta.content`` per choice, keyed by + ``StreamingChoices.index`` (not enumerate position, which collapses to 0 + when each chunk carries a single non-zero-indexed choice for ``n > 1``). + + Only string content participates; list-of-blocks content is out of scope + for the incremental transform path. Reads ``responses_so_far`` without + mutating it so it stays a correct raw accumulator across rounds. + """ + accumulated: dict[int, str] = {} + for response in responses_so_far: + for choice in response.choices: + if isinstance(choice, litellm.StreamingChoices): + content = choice.delta.content + elif isinstance(choice, litellm.Choices): + content = choice.message.content + else: + continue + if isinstance(content, str) and content: + idx = getattr(choice, "index", 0) or 0 + accumulated[idx] = accumulated.get(idx, "") + content + return accumulated + + async def _process_streaming_transform( + self, + *, + responses_so_far: list["ModelResponseStream"], + guardrail_to_apply: "CustomGuardrail", + litellm_logging_obj: Any | None, + user_api_key_dict: Any | None, + request_data: dict | None, + sink: StreamTransformSink, + ) -> None: + """Run the guardrail over the raw accumulated text and report the + guardrailed text plus requested holdback per choice on ``sink``. + + Unlike the block-only path this never mutates ``responses_so_far``: it + re-derives the raw accumulated text every round (so a rewrite guardrail + always sees consistent input) and hands the result back out of band. + """ + raw_by_index = self._accumulate_string_content_by_choice_index(responses_so_far) + if not raw_by_index: + sink.mutated_text_per_choice = {} + sink.holdback_per_choice = {} + return + + # Fix #2 — sort by StreamingChoices.index so an n>1 stream that emits + # choice 1 before choice 0 still hands the guardrail texts in a + # deterministic index order. Without this, the guardrail's returned + # texts (aligned to the input order it received) would map back to the + # wrong choice indices when we rebuild the sink dicts by + # ``enumerate(indices)``. + indices = sorted(raw_by_index.keys()) + texts_to_check = [raw_by_index[i] for i in indices] + + if request_data is None: + request_data = {"responses": responses_so_far} + elif "responses" not in request_data: + request_data["responses"] = responses_so_far + if "litellm_metadata" not in request_data: + user_metadata = self.transform_user_api_key_dict_to_metadata(user_api_key_dict) + if user_metadata: + request_data["litellm_metadata"] = user_metadata + + inputs = GenericGuardrailAPIInputs(texts=texts_to_check) + if responses_so_far and getattr(responses_so_far[0], "model", None): + inputs["model"] = responses_so_far[0].model + guardrailed_inputs = await guardrail_to_apply.apply_guardrail( + inputs=inputs, + request_data=request_data, + input_type="response", + logging_obj=litellm_logging_obj, + ) + + returned_texts = guardrailed_inputs.get("texts") + # No "texts" key means the guardrail made no change (action NONE): the raw + # accumulated text is the guardrailed text. A present-but-shorter list is a + # guardrail contract violation; those choices are omitted below (withheld, + # not emitted raw) so a malformed response fails closed instead of leaking. + if returned_texts is None: + returned_texts = texts_to_check + elif len(returned_texts) < len(texts_to_check): + verbose_proxy_logger.warning( + "OpenAI Chat Completions: guardrail returned %s transformed texts for %s inputs on the " + "streaming transform path; withholding the unmatched choices to fail closed.", + len(returned_texts), + len(texts_to_check), + ) + + holdback = guardrailed_inputs.get("stream_holdback_chars") or [] + sink.mutated_text_per_choice = { + idx: returned_texts[i] for i, idx in enumerate(indices) if i < len(returned_texts) + } + sink.holdback_per_choice = { + indices[i]: coerce_stream_holdback_value(holdback[i]) for i in range(len(indices)) if i < len(holdback) + } + def _combine_streaming_texts( self, responses_so_far: List["ModelResponseStream"] - ) -> Dict[Tuple[int, Optional[int]], str]: + ) -> Dict[Tuple[int, int | None], str]: """ Combine all streaming chunks into complete text per choice. @@ -534,7 +677,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): Returns: Dict mapping (choice_idx, content_idx) to combined text string """ - combined_texts: Dict[Tuple[int, Optional[int]], str] = {} + combined_texts: Dict[Tuple[int, int | None], str] = {} for response_idx, response in enumerate(responses_so_far): for choice_idx, choice in enumerate(response.choices): @@ -550,7 +693,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): if isinstance(content, str): # String content - accumulate for this choice - str_key: Tuple[int, Optional[int]] = (choice_idx, None) + str_key: Tuple[int, int | None] = (choice_idx, None) if str_key not in combined_texts: combined_texts[str_key] = "" combined_texts[str_key] += content @@ -560,7 +703,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): for content_idx, content_item in enumerate(content): text_str = content_item.get("text") if text_str: - list_key: Tuple[int, Optional[int]] = ( + list_key: Tuple[int, int | None] = ( choice_idx, content_idx, ) @@ -607,7 +750,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): texts_to_check: List[str], images_to_check: List[str], tool_calls_to_check: List[Dict[str, Any]], - text_task_mappings: List[Tuple[int, Optional[int]]], + text_task_mappings: List[Tuple[int, int | None]], tool_call_task_mappings: List[Tuple[int, int]], ) -> None: """ @@ -619,7 +762,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): # Determine content source and tool calls based on choice type content = None - tool_calls: Optional[List[Any]] = None + tool_calls: List[Any] | None = None if isinstance(choice, litellm.Choices): content = choice.message.content tool_calls = choice.message.tool_calls @@ -662,7 +805,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): tool_calls_to_check.append(tool_call_dict) tool_call_task_mappings.append((choice_idx, int(tool_call_idx))) - def _convert_tool_call_to_dict(self, tool_call: Union[Dict[str, Any], Any]) -> Optional[Dict[str, Any]]: + def _convert_tool_call_to_dict(self, tool_call: Union[Dict[str, Any], Any]) -> Dict[str, Any] | None: """ Convert a tool call object to dictionary format. @@ -691,7 +834,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): self, response: "ModelResponse", responses: List[str], - task_mappings: List[Tuple[int, Optional[int]]], + task_mappings: List[Tuple[int, int | None]], ) -> None: """ Apply guardrail text responses back to output response. @@ -701,7 +844,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): for task_idx, guardrail_response in enumerate(responses): mapping = task_mappings[task_idx] choice_idx = cast(int, mapping[0]) - content_idx_optional = cast(Optional[int], mapping[1]) + content_idx_optional = cast(int | None, mapping[1]) choice = cast(Choices, response.choices[choice_idx]) @@ -755,7 +898,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): self, responses: List["ModelResponseStream"], guardrailed_texts: List[str], - task_mappings: List[Tuple[int, Optional[int]]], + task_mappings: List[Tuple[int, int | None]], ) -> None: """ Apply guardrail responses back to output streaming responses. @@ -771,16 +914,16 @@ class OpenAIChatCompletionsHandler(BaseTranslation): Override this method to customize how responses are applied to streaming responses. """ # Build a mapping of what guardrailed text to use for each (choice_idx, content_idx) - guardrail_map: Dict[Tuple[int, Optional[int]], str] = {} + guardrail_map: Dict[Tuple[int, int | None], str] = {} for task_idx, guardrail_response in enumerate(guardrailed_texts): mapping = task_mappings[task_idx] choice_idx = cast(int, mapping[0]) - content_idx_optional = cast(Optional[int], mapping[1]) + content_idx_optional = cast(int | None, mapping[1]) guardrail_map[(choice_idx, content_idx_optional)] = guardrail_response # Track which choices we've already set the guardrailed text for # Key: (choice_idx, content_idx), Value: boolean (True if already set) - already_set: Dict[Tuple[int, Optional[int]], bool] = {} + already_set: Dict[Tuple[int, int | None], bool] = {} # Iterate through all responses and update content for response_idx, response in enumerate(responses): @@ -797,7 +940,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): if isinstance(content, str): # String content - str_key: Tuple[int, Optional[int]] = (choice_idx_in_response, None) + str_key: Tuple[int, int | None] = (choice_idx_in_response, None) if str_key in guardrail_map: if str_key not in already_set: # First chunk - set the complete guardrailed text @@ -817,7 +960,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): # List content - handle each content item for content_idx, content_item in enumerate(content): if "text" in content_item: - list_key: Tuple[int, Optional[int]] = ( + list_key: Tuple[int, int | None] = ( choice_idx_in_response, content_idx, ) diff --git a/litellm/llms/openai/evals/transformation.py b/litellm/llms/openai/evals/transformation.py index 8a55fec58a6..1ccaed72f26 100644 --- a/litellm/llms/openai/evals/transformation.py +++ b/litellm/llms/openai/evals/transformation.py @@ -2,7 +2,7 @@ OpenAI Evals API configuration and transformations """ -from typing import Any, Dict, Optional, Tuple +from collections.abc import Mapping import httpx @@ -31,6 +31,10 @@ from litellm.types.router import GenericLiteLLMParams from litellm.types.utils import LlmProviders +def _parsed_response_json(raw_response: httpx.Response) -> Mapping[str, object]: + return raw_response.json() + + class OpenAIEvalsConfig(BaseEvalsAPIConfig): """OpenAI-specific Evals API configuration""" @@ -38,7 +42,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): def custom_llm_provider(self) -> LlmProviders: return LlmProviders.OPENAI - def validate_environment(self, headers: dict, litellm_params: Optional[GenericLiteLLMParams]) -> dict: + def validate_environment(self, headers: dict, litellm_params: GenericLiteLLMParams | None) -> dict: """Add OpenAI-specific headers""" import litellm from litellm.secret_managers.main import get_secret_str @@ -61,9 +65,9 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): def get_complete_url( self, - api_base: Optional[str], + api_base: str | None, endpoint: str, - eval_id: Optional[str] = None, + eval_id: str | None = None, ) -> str: """Get complete URL for OpenAI Evals API""" if api_base is None: @@ -79,7 +83,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): create_request: CreateEvalRequest, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Dict: + ) -> dict: """Transform create eval request for OpenAI""" verbose_logger.debug("Transforming create eval request: %s", create_request) @@ -94,17 +98,17 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> Eval: """Transform OpenAI response to Eval object""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming create eval response: %s", response_json) - return Eval(**response_json) + return Eval.model_validate(response_json) def transform_list_evals_request( self, list_params: ListEvalsParams, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict]: + ) -> tuple[str, dict]: """Transform list evals request for OpenAI""" api_base = "https://api.openai.com" if litellm_params and litellm_params.api_base: @@ -113,7 +117,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): url = self.get_complete_url(api_base=api_base, endpoint="evals") # Build query parameters - query_params: Dict[str, Any] = {} + query_params: dict[str, object] = {} if "limit" in list_params and list_params["limit"]: query_params["limit"] = list_params["limit"] if "after" in list_params and list_params["after"]: @@ -138,10 +142,10 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> ListEvalsResponse: """Transform OpenAI response to ListEvalsResponse""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming list evals response: %s", response_json) - return ListEvalsResponse(**response_json) + return ListEvalsResponse.model_validate(response_json) def transform_get_eval_request( self, @@ -149,7 +153,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict]: + ) -> tuple[str, dict]: """Transform get eval request for OpenAI""" url = self.get_complete_url(api_base=api_base, endpoint="evals", eval_id=eval_id) @@ -163,10 +167,10 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> Eval: """Transform OpenAI response to Eval object""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming get eval response: %s", response_json) - return Eval(**response_json) + return Eval.model_validate(response_json) def transform_update_eval_request( self, @@ -175,7 +179,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict, Dict]: + ) -> tuple[str, dict, dict]: """Transform update eval request for OpenAI""" url = self.get_complete_url(api_base=api_base, endpoint="evals", eval_id=eval_id) @@ -192,10 +196,10 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> Eval: """Transform OpenAI response to Eval object""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming update eval response: %s", response_json) - return Eval(**response_json) + return Eval.model_validate(response_json) def transform_delete_eval_request( self, @@ -203,7 +207,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict]: + ) -> tuple[str, dict]: """Transform delete eval request for OpenAI""" url = self.get_complete_url(api_base=api_base, endpoint="evals", eval_id=eval_id) @@ -217,10 +221,10 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> DeleteEvalResponse: """Transform OpenAI response to DeleteEvalResponse""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming delete eval response: %s", response_json) - return DeleteEvalResponse(**response_json) + return DeleteEvalResponse.model_validate(response_json) def transform_cancel_eval_request( self, @@ -228,12 +232,12 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict, Dict]: + ) -> tuple[str, dict, dict]: """Transform cancel eval request for OpenAI""" url = f"{self.get_complete_url(api_base=api_base, endpoint='evals', eval_id=eval_id)}/cancel" # Empty body for cancel request - request_body: Dict[str, Any] = {} + request_body: dict[str, object] = {} verbose_logger.debug("Cancel eval request - URL: %s", url) @@ -245,10 +249,10 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> CancelEvalResponse: """Transform OpenAI response to CancelEvalResponse""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming cancel eval response: %s", response_json) - return CancelEvalResponse(**response_json) + return CancelEvalResponse.model_validate(response_json) # Run API Transformations def transform_create_run_request( @@ -257,7 +261,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): create_request: CreateRunRequest, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict]: + ) -> tuple[str, dict]: """Transform create run request for OpenAI""" api_base = "https://api.openai.com" if litellm_params and litellm_params.api_base: @@ -279,10 +283,10 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> Run: """Transform OpenAI response to Run object""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming create run response: %s", response_json) - return Run(**response_json) + return Run.model_validate(response_json) def transform_list_runs_request( self, @@ -290,7 +294,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): list_params: ListRunsParams, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict]: + ) -> tuple[str, dict]: """Transform list runs request for OpenAI""" api_base = "https://api.openai.com" if litellm_params and litellm_params.api_base: @@ -300,7 +304,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): url = f"{api_base}/v1/evals/{encoded_eval_id}/runs" # Build query parameters - query_params: Dict[str, Any] = {} + query_params: dict[str, object] = {} if "limit" in list_params and list_params["limit"]: query_params["limit"] = list_params["limit"] if "after" in list_params and list_params["after"]: @@ -323,10 +327,10 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> ListRunsResponse: """Transform OpenAI response to ListRunsResponse""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming list runs response: %s", response_json) - return ListRunsResponse(**response_json) + return ListRunsResponse.model_validate(response_json) def transform_get_run_request( self, @@ -335,7 +339,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict]: + ) -> tuple[str, dict]: """Transform get run request for OpenAI""" encoded_eval_id = encode_url_path_segment(eval_id, field_name="eval_id") encoded_run_id = encode_url_path_segment(run_id, field_name="run_id") @@ -351,10 +355,10 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> Run: """Transform OpenAI response to Run object""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming get run response: %s", response_json) - return Run(**response_json) + return Run.model_validate(response_json) def transform_cancel_run_request( self, @@ -363,14 +367,14 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict, Dict]: + ) -> tuple[str, dict, dict]: """Transform cancel run request for OpenAI""" encoded_eval_id = encode_url_path_segment(eval_id, field_name="eval_id") encoded_run_id = encode_url_path_segment(run_id, field_name="run_id") url = f"{api_base}/v1/evals/{encoded_eval_id}/runs/{encoded_run_id}/cancel" # Empty body for cancel request - request_body: Dict[str, Any] = {} + request_body: dict[str, object] = {} verbose_logger.debug("Cancel run request - URL: %s", url) @@ -382,10 +386,10 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> CancelRunResponse: """Transform OpenAI response to CancelRunResponse""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming cancel run response: %s", response_json) - return CancelRunResponse(**response_json) + return CancelRunResponse.model_validate(response_json) def transform_delete_run_request( self, @@ -394,14 +398,14 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict, Dict]: + ) -> tuple[str, dict, dict]: """Transform delete run request for OpenAI""" encoded_eval_id = encode_url_path_segment(eval_id, field_name="eval_id") encoded_run_id = encode_url_path_segment(run_id, field_name="run_id") url = f"{api_base}/v1/evals/{encoded_eval_id}/runs/{encoded_run_id}" # Empty body for delete request - request_body: Dict[str, Any] = {} + request_body: dict[str, object] = {} verbose_logger.debug("Delete run request - URL: %s", url) @@ -413,7 +417,7 @@ class OpenAIEvalsConfig(BaseEvalsAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> RunDeleteResponse: """Transform OpenAI response to RunDeleteResponse""" - response_json = raw_response.json() + response_json = _parsed_response_json(raw_response) verbose_logger.debug("Transforming delete run response: %s", response_json) - return RunDeleteResponse(**response_json) + return RunDeleteResponse.model_validate(response_json) diff --git a/litellm/llms/openai/responses/guardrail_translation/handler.py b/litellm/llms/openai/responses/guardrail_translation/handler.py index 093dffccac0..d90703d1544 100644 --- a/litellm/llms/openai/responses/guardrail_translation/handler.py +++ b/litellm/llms/openai/responses/guardrail_translation/handler.py @@ -247,6 +247,8 @@ class OpenAIResponsesHandler(BaseTranslation): """ Merge remapped guardrailed tools with original tools that were not sent to the guardrail (e.g. web_search, web_search_preview), preserving order. + Tools a guardrail appended (``remapped`` longer than ``original_tools``) + have no original slot and are kept so an injected tool is not dropped. """ if not original_tools: return remapped @@ -262,6 +264,8 @@ class OpenAIResponsesHandler(BaseTranslation): if j < len(remapped): result.append(remapped[j]) j += 1 + # Keep guardrail-appended tools that matched no original slot above. + result.extend(remapped[j:]) return result def _apply_guardrailed_tools_to_data( diff --git a/litellm/llms/openai/responses/transformation.py b/litellm/llms/openai/responses/transformation.py index d107ca7a0d7..3c2ae238a0b 100644 --- a/litellm/llms/openai/responses/transformation.py +++ b/litellm/llms/openai/responses/transformation.py @@ -20,6 +20,8 @@ from litellm.types.utils import LlmProviders from ..common_utils import OpenAIError +OPENAI_RESPONSES_API_MIN_MAX_OUTPUT_TOKENS = 16 + if TYPE_CHECKING: from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj @@ -59,6 +61,19 @@ class OpenAIResponsesAPIConfig(BaseResponsesAPIConfig): key="supports_none_reasoning_effort", ) + @staticmethod + def _enforce_min_max_output_tokens(max_output_tokens: "int | None") -> "int | None": + """Raise sub-minimum max_output_tokens up to the OpenAI Responses API minimum. + + OpenAI's Responses API rejects max_output_tokens below 16 for every model + (not gpt-5 specific), so a client like Claude Code that sends a max_tokens=1 + warmup probe on model switch would otherwise 400. Values that are None or + already at/above the minimum are returned unchanged. + """ + if isinstance(max_output_tokens, int) and max_output_tokens < OPENAI_RESPONSES_API_MIN_MAX_OUTPUT_TOKENS: + return OPENAI_RESPONSES_API_MIN_MAX_OUTPUT_TOKENS + return max_output_tokens + def get_supported_openai_params(self, model: str) -> list: """ All OpenAI Responses API params are supported @@ -92,6 +107,9 @@ class OpenAIResponsesAPIConfig(BaseResponsesAPIConfig): """ params = dict(response_api_optional_params) + if "max_output_tokens" in params: + params["max_output_tokens"] = self._enforce_min_max_output_tokens(params.get("max_output_tokens")) + if self._is_gpt_5_model(model=model): temperature = params.get("temperature") if temperature is not None and temperature != 1: diff --git a/litellm/llms/openai_like/dynamic_config.py b/litellm/llms/openai_like/dynamic_config.py index 3c763ed9b9b..31c913d5d4e 100644 --- a/litellm/llms/openai_like/dynamic_config.py +++ b/litellm/llms/openai_like/dynamic_config.py @@ -91,7 +91,7 @@ def create_config_class(provider: SimpleProviderConfig): def get_supported_openai_params(self, model: str) -> list: """Get supported OpenAI params, excluding tool-related params for models that don't support function calling.""" - from litellm.utils import supports_function_calling + from litellm.utils import supports_function_calling, supports_reasoning supported_params = super().get_supported_openai_params(model=model) @@ -113,6 +113,10 @@ def create_config_class(provider: SimpleProviderConfig): f"function calling — removed tool-related params from supported params." ) + _supports_reasoning = supports_reasoning(model=model, custom_llm_provider=provider.slug) + if _supports_reasoning and "reasoning_effort" not in supported_params: + supported_params.append("reasoning_effort") + return supported_params def map_openai_params( diff --git a/litellm/llms/openai_like/messages/transformation.py b/litellm/llms/openai_like/messages/transformation.py index 0df8c6e830b..0d593d8d0f4 100644 --- a/litellm/llms/openai_like/messages/transformation.py +++ b/litellm/llms/openai_like/messages/transformation.py @@ -1,8 +1,11 @@ from typing import Any, Optional +import litellm from litellm.llms.anthropic.experimental_pass_through.messages.transformation import ( AnthropicMessagesConfig, ) +from litellm.llms.openai_like.json_loader import SimpleProviderConfig +from litellm.secret_managers.main import get_secret_str DEFAULT_ANTHROPIC_API_VERSION = "2023-06-01" @@ -67,3 +70,69 @@ class OpenAILikeAnthropicMessagesConfig(AnthropicMessagesConfig): if base.endswith("/v1"): base = base[: -len("/v1")] return f"{base}/v1/messages" + + +class JSONProviderAnthropicMessagesConfig(OpenAILikeAnthropicMessagesConfig): + """ + Provider-level native Anthropic Messages passthrough for JSON-configured + OpenAI-compatible providers whose ``supported_endpoints`` in providers.json + includes ``"/v1/messages"``. Resolves the api key and api base from the + provider's configured env vars, then forwards the Anthropic payload + untranslated like ``OpenAILikeAnthropicMessagesConfig``. + """ + + def __init__(self, provider: SimpleProviderConfig): + super().__init__() + self._provider = provider + + @property + def custom_llm_provider(self) -> Optional[str]: + return self._provider.slug + + def should_strip_billing_metadata(self) -> bool: + return True + + def _resolve_api_key(self, api_key: Optional[str]) -> Optional[str]: + return api_key or get_secret_str(self._provider.api_key_env) or litellm.api_key + + def _resolve_api_base(self, api_base: Optional[str]) -> str: + env_api_base = get_secret_str(self._provider.api_base_env) if self._provider.api_base_env else None + return api_base or env_api_base or self._provider.base_url + + def validate_anthropic_messages_environment( + self, + headers: dict[str, str], + model: str, + messages: list[Any], + optional_params: dict, + litellm_params: dict, + api_key: Optional[str] = None, + api_base: Optional[str] = None, + ) -> tuple[dict[str, str], Optional[str]]: + return super().validate_anthropic_messages_environment( + headers=headers, + model=model, + messages=messages, + optional_params=optional_params, + litellm_params=litellm_params, + api_key=self._resolve_api_key(api_key), + api_base=api_base, + ) + + def get_complete_url( + self, + api_base: Optional[str], + api_key: Optional[str], + model: str, + optional_params: dict, + litellm_params: dict, + stream: Optional[bool] = None, + ) -> str: + return super().get_complete_url( + api_base=self._resolve_api_base(api_base), + api_key=api_key, + model=model, + optional_params=optional_params, + litellm_params=litellm_params, + stream=stream, + ) diff --git a/litellm/llms/openai_like/providers.json b/litellm/llms/openai_like/providers.json index d87346fea70..164100d4194 100644 --- a/litellm/llms/openai_like/providers.json +++ b/litellm/llms/openai_like/providers.json @@ -168,6 +168,13 @@ }, "supported_endpoints": ["/v1/chat/completions", "/v1/responses"] }, + "meta": { + "base_url": "https://api.meta.ai/v1", + "api_key_env": "META_API_KEY", + "api_base_env": "META_API_BASE", + "base_class": "openai_gpt", + "supported_endpoints": ["/v1/chat/completions", "/v1/responses", "/v1/messages"] + }, "pinstripes": { "base_url": "https://pinstripes.io/v1", "api_key_env": "PINSTRIPES_API_KEY", diff --git a/litellm/llms/sagemaker/chat/transformation.py b/litellm/llms/sagemaker/chat/transformation.py index 4e4e088f491..4447d63e5a1 100644 --- a/litellm/llms/sagemaker/chat/transformation.py +++ b/litellm/llms/sagemaker/chat/transformation.py @@ -143,7 +143,7 @@ class SagemakerChatConfig(OpenAIGPTConfig, BaseAWSLLM): raise SagemakerError(status_code=response.status_code, message=response.text) custom_stream_decoder = AWSEventStreamDecoder(model="", is_messages_api=True) - completion_stream = custom_stream_decoder.iter_bytes(response.iter_bytes(chunk_size=1024)) + completion_stream = custom_stream_decoder.iter_bytes(response.iter_bytes()) streaming_response = CustomStreamWrapper( completion_stream=completion_stream, @@ -189,7 +189,7 @@ class SagemakerChatConfig(OpenAIGPTConfig, BaseAWSLLM): raise SagemakerError(status_code=response.status_code, message=response.text) custom_stream_decoder = AWSEventStreamDecoder(model="", is_messages_api=True) - completion_stream = custom_stream_decoder.aiter_bytes(response.aiter_bytes(chunk_size=1024)) + completion_stream = custom_stream_decoder.aiter_bytes(response.aiter_bytes()) streaming_response = CustomStreamWrapper( completion_stream=completion_stream, diff --git a/litellm/llms/sagemaker/completion/handler.py b/litellm/llms/sagemaker/completion/handler.py index 4b87271fd44..c27a3c3528c 100644 --- a/litellm/llms/sagemaker/completion/handler.py +++ b/litellm/llms/sagemaker/completion/handler.py @@ -200,23 +200,12 @@ class SagemakerLLM(BaseAWSLLM): # Add model_id as InferenceComponentName header # boto3 doc: https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_runtime_InvokeEndpoint.html prepared_request.headers.update({"X-Amzn-SageMaker-Inference-Component": model_id}) - sync_handler = _get_httpx_client() - sync_response = sync_handler.post( - url=prepared_request.url, + completion_stream = self.make_sync_call( + api_base=prepared_request.url, headers=prepared_request.headers, # type: ignore - data=prepared_request.body, - stream=stream, + data=cast(str, prepared_request.body), # cast-ok: signed body is a JSON str, mirrors async path + logging_obj=logging_obj, ) - - if sync_response.status_code != 200: - raise SagemakerError( - status_code=sync_response.status_code, - message=str(sync_response.read()), - ) - - decoder = AWSEventStreamDecoder(model="") - - completion_stream = decoder.iter_bytes(sync_response.iter_bytes(chunk_size=1024)) streaming_response = CustomStreamWrapper( completion_stream=completion_stream, model=model, @@ -334,6 +323,29 @@ class SagemakerLLM(BaseAWSLLM): litellm_params=litellm_params, ) + def make_sync_call( + self, + api_base: str, + headers: dict, + data: str, + logging_obj, + client=None, + ): + if client is None: + client = _get_httpx_client() + sync_response = client.post( + api_base, + headers=headers, + data=data, + stream=True, + ) + + if sync_response.status_code != 200: + raise SagemakerError(status_code=sync_response.status_code, message=str(sync_response.read())) + + decoder = AWSEventStreamDecoder(model="") + return decoder.iter_bytes(sync_response.iter_bytes()) + async def make_async_call( self, api_base: str, @@ -358,7 +370,7 @@ class SagemakerLLM(BaseAWSLLM): raise SagemakerError(status_code=response.status_code, message=response.text) decoder = AWSEventStreamDecoder(model="") - completion_stream = decoder.aiter_bytes(response.aiter_bytes(chunk_size=1024)) + completion_stream = decoder.aiter_bytes(response.aiter_bytes()) return completion_stream diff --git a/litellm/llms/vertex_ai/batches/transformation.py b/litellm/llms/vertex_ai/batches/transformation.py index 6bbe8f75701..df903ba7ef0 100644 --- a/litellm/llms/vertex_ai/batches/transformation.py +++ b/litellm/llms/vertex_ai/batches/transformation.py @@ -123,7 +123,8 @@ class VertexAIBatchTransformation: Gets the output file id from the Vertex AI Batch response """ - output_file_id: str = response.get("outputInfo", OutputInfo()).get("gcsOutputDirectory", "") + output_info = response.get("outputInfo") or OutputInfo() + output_file_id: str = output_info.get("gcsOutputDirectory", "") if output_file_id: output_file_id = output_file_id.rstrip("/") + "/predictions.jsonl" if output_file_id and output_file_id != "/predictions.jsonl": diff --git a/litellm/llms/vertex_ai/files/handler.py b/litellm/llms/vertex_ai/files/handler.py index 3bc09139f8f..4d2a1e18eb5 100644 --- a/litellm/llms/vertex_ai/files/handler.py +++ b/litellm/llms/vertex_ai/files/handler.py @@ -1,7 +1,9 @@ import asyncio +import json +import os import time from urllib.parse import unquote -from typing import Any, Coroutine, Optional, Tuple, Union +from typing import Any, Coroutine, Mapping, Optional, Tuple, Union import httpx @@ -10,6 +12,7 @@ from litellm.integrations.gcs_bucket.gcs_bucket_base import ( GCSBucketBase, GCSLoggingConfig, ) +from litellm.types.utils import StandardCallbackDynamicParams from litellm.litellm_core_utils.cloud_storage_security import ( VERTEX_AI_MANAGED_GCS_PREFIX, should_allow_legacy_cloud_file_ids, @@ -39,6 +42,35 @@ class VertexAIFilesHandler(GCSBucketBase): llm_provider=LlmProviders.VERTEX_AI, ) + def _resolve_read_gcs_config( + self, + litellm_params: Mapping[str, object] | None, + vertex_credentials: VERTEX_CREDENTIALS_TYPES | None, + ) -> tuple[str | None, str | None]: + """ + Resolve the GCS bucket and service-account credentials for the read/content path. + + Sources them from the deployment's ``litellm_params`` (``gcs_bucket_name`` / + ``bucket_name`` and ``vertex_credentials``), mirroring the write path in + ``VertexAIFilesConfig._get_configured_bucket_name``, and falls back to the global + ``GCS_BUCKET_NAME`` / ``GCS_PATH_SERVICE_ACCOUNT`` env vars. This lets Vertex batch + run entirely at the model-group level, so output written to a per-model bucket is + readable without setting the global env vars. + """ + params: Mapping[str, object] = litellm_params or {} + bucket_candidate = params.get("gcs_bucket_name") or params.get("bucket_name") + configured_bucket_name = bucket_candidate if isinstance(bucket_candidate, str) else os.getenv("GCS_BUCKET_NAME") + + credentials = params.get("vertex_credentials") or vertex_credentials + if isinstance(credentials, dict): + path_service_account: str | None = json.dumps(credentials) + elif isinstance(credentials, str): + path_service_account = credentials + else: + path_service_account = os.getenv("GCS_PATH_SERVICE_ACCOUNT") + + return configured_bucket_name, path_service_account + def _extract_bucket_and_object_from_file_id( self, file_id: str, @@ -91,7 +123,17 @@ class VertexAIFilesHandler(GCSBucketBase): if not file_id: raise ValueError("file_id is required in file_content_request") - gcs_logging_config: GCSLoggingConfig = await self.get_gcs_logging_config(kwargs={}) + configured_bucket_name, path_service_account = self._resolve_read_gcs_config( + litellm_params=litellm_params, + vertex_credentials=vertex_credentials, + ) + dynamic_params = StandardCallbackDynamicParams( + gcs_bucket_name=configured_bucket_name, + gcs_path_service_account=path_service_account, + ) + gcs_logging_config: GCSLoggingConfig = await self.get_gcs_logging_config( + kwargs={"standard_callback_dynamic_params": dynamic_params} + ) bucket_name, object_path = self._extract_bucket_and_object_from_file_id( file_id=file_id, configured_bucket_name=gcs_logging_config["bucket_name"], diff --git a/litellm/llms/vertex_ai/gemini/transformation.py b/litellm/llms/vertex_ai/gemini/transformation.py index 0db1118a7b4..cbca57c5e62 100644 --- a/litellm/llms/vertex_ai/gemini/transformation.py +++ b/litellm/llms/vertex_ai/gemini/transformation.py @@ -661,6 +661,10 @@ def _gemini_convert_messages_with_history( vertex_project = litellm_params.get("vertex_project") or litellm_params.get("vertex_ai_project") vertex_credentials = litellm_params.get("vertex_credentials") or litellm_params.get("vertex_ai_credentials") + from .vertex_and_google_ai_studio_gemini import VertexGeminiConfig + + forward_function_call_id = VertexGeminiConfig._forward_gemini_function_call_id(model or "") + try: while msg_i < len(messages): user_content: List[PartType] = [] @@ -910,7 +914,7 @@ def _gemini_convert_messages_with_history( gemini_tool_call_parts = convert_to_gemini_tool_call_invoke( assistant_msg, model=model, - custom_llm_provider=custom_llm_provider, + forward_function_call_id=forward_function_call_id, ) ## check if gemini_tool_call already exists in assistant_content for gemini_tool_call_part in gemini_tool_call_parts: @@ -973,8 +977,7 @@ def _gemini_convert_messages_with_history( _part = convert_to_gemini_tool_call_result( messages[msg_i], # type: ignore last_message_with_tool_calls, # type: ignore - model=model, - custom_llm_provider=custom_llm_provider, + forward_function_call_id=forward_function_call_id, ) msg_i += 1 # Handle both single part and list of parts (for Computer Use with images) diff --git a/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py b/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py index f9ed8cea9b5..126f82436e8 100644 --- a/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py +++ b/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py @@ -289,15 +289,13 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): return False @staticmethod - def _forward_gemini_function_call_id(model: str, custom_llm_provider: Optional[str] = None) -> bool: + def _forward_gemini_function_call_id(model: str) -> bool: """ Whether to include `id` on function_call / function_response parts. - Gemini 3+ on Google AI Studio accepts (and returns) `id` for strict - tool-call matching. Vertex AI rejects the field with HTTP 400. + Gemini 3+ accepts (and returns) `id` for strict tool-call matching, on Vertex AI and + Google AI Studio alike. Older Gemini models reject the field with HTTP 400. """ - if custom_llm_provider != "gemini": - return False return VertexGeminiConfig._is_gemini_3_or_newer(model) def _supports_penalty_parameters(self, model: str) -> bool: @@ -998,6 +996,8 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): response_modalities.append("IMAGE") elif modality == "audio": response_modalities.append("AUDIO") + elif modality == "video": + response_modalities.append("VIDEO") else: response_modalities.append("MODALITY_UNSPECIFIED") return response_modalities @@ -1729,18 +1729,42 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): """ Check if the candidate token count is inclusive of the thinking token count - if prompttokencount + candidatesTokenCount == totalTokenCount, then the candidate token count is inclusive of the thinking token count + if promptTokenCount + candidatesTokenCount + toolUsePromptTokenCount == totalTokenCount, then the candidate token count is inclusive of the thinking token count else the candidate token count is exclusive of the thinking token count Addresses - https://github.com/BerriAI/litellm/pull/10141#discussion_r2052272035 """ - if usage_metadata.get("promptTokenCount", 0) + usage_metadata.get( - "candidatesTokenCount", 0 - ) == usage_metadata.get("totalTokenCount", 0): - return True - else: + non_thinking_tokens = ( + usage_metadata.get("promptTokenCount", 0) + + usage_metadata.get("candidatesTokenCount", 0) + + usage_metadata.get("toolUsePromptTokenCount", 0) + ) + return non_thinking_tokens == usage_metadata.get("totalTokenCount", 0) + + @staticmethod + def _response_has_search_grounding( + completion_response: Union[GenerateContentResponseBody, BidiGenerateContentServerMessage], + ) -> bool: + """ + Whether the response used Grounding with Google Search, detected via + groundingMetadata.webSearchQueries (an actual web search was performed). + + Google bills grounding-with-Google-Search retrieved tokens separately (a per-request / + per-query search fee) and excludes them from input token billing, unlike URL context / + File Search / code execution whose tool-use tokens are charged at the input token rate. + URL context also emits groundingMetadata (with groundingChunks but no webSearchQueries), + so presence of groundingMetadata alone is not a sufficient signal. + See https://ai.google.dev/gemini-api/docs/pricing and + https://github.com/BerriAI/litellm/discussions/33198 + """ + if "candidates" not in completion_response: return False + for candidate in completion_response["candidates"] or []: + grounding_metadata, _, _, _ = VertexGeminiConfig._extract_candidate_metadata(candidate) + if VertexGeminiConfig._calculate_web_search_requests(grounding_metadata): + return True + return False @staticmethod def _calculate_usage( @@ -1886,12 +1910,21 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): response_tokens_details = CompletionTokensDetailsWrapper() response_tokens_details.reasoning_tokens = reasoning_tokens + tool_use_prompt_tokens = usage_metadata.get("toolUsePromptTokenCount") or None + prompt_tokens_details = PromptTokensDetailsWrapper( cached_tokens=cached_tokens, audio_tokens=prompt_audio_tokens, text_tokens=prompt_text_tokens, image_tokens=prompt_image_tokens, video_tokens=prompt_video_tokens, + tool_use_tokens=tool_use_prompt_tokens, + ) + + billable_tool_use_prompt_tokens = ( + 0 + if VertexGeminiConfig._response_has_search_grounding(completion_response) + else (tool_use_prompt_tokens or 0) ) completion_tokens = response_tokens or completion_response["usageMetadata"].get("candidatesTokenCount", 0) @@ -1899,7 +1932,7 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): completion_tokens = reasoning_tokens + completion_tokens ## GET USAGE ## usage = Usage( - prompt_tokens=usage_metadata.get("promptTokenCount", 0), + prompt_tokens=usage_metadata.get("promptTokenCount", 0) + billable_tool_use_prompt_tokens, completion_tokens=completion_tokens, total_tokens=usage_metadata.get("totalTokenCount", 0), prompt_tokens_details=prompt_tokens_details, @@ -3298,27 +3331,37 @@ class ModelResponseIterator: return self.chunk_parser(chunk=json_chunk) - def handle_accumulated_json_chunk(self, chunk: str) -> Optional["ModelResponseStream"]: - chunk = litellm.CustomStreamWrapper._strip_sse_data_from_chunk(chunk) or "" - message = chunk.replace("\n\n", "") + def handle_accumulated_json_chunk(self, chunk: str, is_final: bool = False) -> Optional["ModelResponseStream"]: + message = litellm.CustomStreamWrapper._strip_sse_data_from_chunk(chunk) or "" + self.accumulated_json = (self.accumulated_json + message.replace("\n\n", "")).strip() - self.accumulated_json += message - - # json.loads on the whole buffer after every fragment is O(n^2) and - # holds the GIL, freezing the event loop for seconds on large responses - # (https://github.com/BerriAI/litellm/issues/26181). A complete Gemini - # chunk is a JSON object/array, so only attempt the parse once the - # buffer's last non-whitespace byte can close one. - stripped = self.accumulated_json.rstrip() - if not stripped or stripped[-1] not in "}]": + # Mid-stream, defer parsing until the buffer's last byte can close a value: + # attempting a parse after every fragment of one large object is O(n^2) and + # holds the GIL, freezing the event loop. At end of stream (is_final) no more + # data is coming, so drain whatever complete values remain regardless of the + # trailing byte, otherwise a complete leading value sitting behind a truncated + # trailing one would be silently dropped. + if not is_final and (not self.accumulated_json or self.accumulated_json[-1] not in "}]"): return None - try: - _data = json.loads(self.accumulated_json) - self.accumulated_json = "" # reset after successful parsing - return self.chunk_parser(chunk=_data) - except json.JSONDecodeError: - return None + # Peel one complete JSON value from the front of the buffer and keep the + # unconsumed tail. Running json.loads over the whole buffer would fail + # forever once it held more than one concatenated value ("Extra data") while + # never resetting the buffer, so the buffer grew without bound and pinned the + # core. raw_decode reports where the value ended, so concatenated values drain + # one call at a time. A leading non-dict value (never emitted by Gemini in + # practice) is consumed and skipped so it cannot block the dict values behind it. + decoder = json.JSONDecoder() + while self.accumulated_json: + try: + raw_value = decoder.raw_decode(self.accumulated_json) + except json.JSONDecodeError: + return None + decoded, end_index = cast("tuple[object, int]", raw_value) # cast-ok: raw_decode -> tuple[Any,int] + self.accumulated_json = self.accumulated_json[end_index:].strip() + if isinstance(decoded, dict): + return self.chunk_parser(chunk=decoded) + return None def _common_chunk_parsing_logic(self, chunk: str) -> Optional["ModelResponseStream"]: try: @@ -3343,7 +3386,9 @@ class ModelResponseIterator: chunk = self.response_iterator.__next__() except StopIteration: if self.chunk_type == "accumulated_json" and self.accumulated_json: - return self.handle_accumulated_json_chunk(chunk="") + result = self.handle_accumulated_json_chunk(chunk="", is_final=True) + if result is not None: + return result raise StopIteration except ValueError as e: raise RuntimeError(f"Error receiving chunk from stream: {e}") @@ -3365,7 +3410,9 @@ class ModelResponseIterator: chunk = await self.async_response_iterator.__anext__() except StopAsyncIteration: if self.chunk_type == "accumulated_json" and self.accumulated_json: - return self.handle_accumulated_json_chunk(chunk="") + result = self.handle_accumulated_json_chunk(chunk="", is_final=True) + if result is not None: + return result raise StopAsyncIteration except ValueError as e: raise RuntimeError(f"Error receiving chunk from stream: {e}") diff --git a/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/experimental_pass_through/transformation.py b/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/experimental_pass_through/transformation.py index 8566496bf9c..32aaebab768 100644 --- a/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/experimental_pass_through/transformation.py +++ b/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/experimental_pass_through/transformation.py @@ -17,6 +17,10 @@ from ..output_params_utils import sanitize_vertex_anthropic_output_params class VertexAIPartnerModelsAnthropicMessagesConfig(AnthropicMessagesConfig, VertexBase): + @property + def custom_llm_provider(self) -> Optional[str]: + return "vertex_ai" + def should_strip_billing_metadata(self) -> bool: return True @@ -138,6 +142,8 @@ class VertexAIPartnerModelsAnthropicMessagesConfig(AnthropicMessagesConfig, Vert headers=headers, ) + self._normalize_system_role_messages(anthropic_messages_request, model=model) + self._remove_scope_from_cache_control(anthropic_messages_request) anthropic_messages_request["anthropic_version"] = "vertex-2023-10-16" diff --git a/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/output_params_utils.py b/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/output_params_utils.py index 280cc1c888a..b87d05ab1fd 100644 --- a/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/output_params_utils.py +++ b/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/output_params_utils.py @@ -26,7 +26,7 @@ def _model_accepts_output_config_effort(model: str) -> bool: """ from litellm.llms.anthropic.chat.transformation import AnthropicConfig - return AnthropicConfig._model_supports_effort_param(model) + return AnthropicConfig._model_supports_effort_param(model, "vertex_ai") def sanitize_vertex_anthropic_output_params(data: dict, model: str) -> None: diff --git a/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/transformation.py b/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/transformation.py index c8d91be359b..8fcefb04b34 100644 --- a/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/transformation.py +++ b/litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/transformation.py @@ -112,6 +112,7 @@ class VertexAIAnthropicConfig(AnthropicConfig): prompt_caching_set=self.is_cache_control_set(messages), file_id_used=self.is_file_id_used(messages), mcp_server_used=self.is_mcp_server_used(optional_params.get("mcp_servers")), + custom_llm_provider="vertex_ai", ) beta_set = set(auto_betas) diff --git a/litellm/llms/volcengine/responses/transformation.py b/litellm/llms/volcengine/responses/transformation.py index 56950151969..4b20962e100 100644 --- a/litellm/llms/volcengine/responses/transformation.py +++ b/litellm/llms/volcengine/responses/transformation.py @@ -1,11 +1,9 @@ +from collections.abc import Callable, Mapping, Sequence from typing import ( TYPE_CHECKING, Any, - Dict, - List, Literal, - Optional, - Tuple, + Protocol, Union, get_args, get_origin, @@ -17,10 +15,10 @@ from pydantic import fields as pyd_fields import litellm from litellm._logging import verbose_logger from litellm.litellm_core_utils.core_helpers import process_response_headers -from litellm.litellm_core_utils.url_utils import encode_url_path_segment from litellm.litellm_core_utils.llm_response_utils.convert_dict_to_response import ( _safe_convert_created_field, ) +from litellm.litellm_core_utils.url_utils import encode_url_path_segment from litellm.llms.openai.responses.transformation import OpenAIResponsesAPIConfig from litellm.secret_managers.main import get_secret_str from litellm.types.llms.openai import ( @@ -47,8 +45,15 @@ else: LiteLLMLoggingObj = Any +class _EventModelClass(Protocol): + @property + def model_fields(self) -> Mapping[str, pyd_fields.FieldInfo]: ... + + def model_validate(self, obj: Mapping[str, object]) -> ResponsesAPIStreamingResponse: ... + + class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): - _SUPPORTED_OPTIONAL_PARAMS: List[str] = [ + _SUPPORTED_OPTIONAL_PARAMS: list[str] = [ # Doc-listed knobs "instructions", "max_output_tokens", @@ -89,9 +94,7 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): supported.remove("metadata") return supported - def get_error_class( - self, error_message: str, status_code: int, headers: Union[dict, httpx.Headers] - ) -> VolcEngineError: + def get_error_class(self, error_message: str, status_code: int, headers: dict | httpx.Headers) -> VolcEngineError: typed_headers: httpx.Headers = headers if isinstance(headers, httpx.Headers) else httpx.Headers(headers or {}) return VolcEngineError( status_code=status_code, @@ -99,14 +102,14 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): headers=typed_headers, ) - def validate_environment(self, headers: dict, model: str, litellm_params: Optional[GenericLiteLLMParams]) -> dict: + def validate_environment(self, headers: dict, model: str, litellm_params: GenericLiteLLMParams | None) -> dict: """ Build auth headers for Volcengine Responses API. """ if litellm_params is None: litellm_params = GenericLiteLLMParams() elif isinstance(litellm_params, dict): - litellm_params = GenericLiteLLMParams(**litellm_params) + litellm_params = GenericLiteLLMParams.model_validate(litellm_params) api_key = ( litellm_params.api_key @@ -122,7 +125,7 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): def get_complete_url( self, - api_base: Optional[str], + api_base: str | None, litellm_params: dict, ) -> str: """ @@ -149,7 +152,7 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): response_api_optional_params: ResponsesAPIOptionalRequestParams, model: str, drop_params: bool, - ) -> Dict: + ) -> dict: """ Volcengine Responses API aligns with OpenAI parameters. Remove parameters not supported by the public docs. @@ -173,11 +176,11 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): def transform_responses_api_request( self, model: str, - input: Union[str, ResponseInputParam], - response_api_optional_request_params: Dict, + input: str | ResponseInputParam, + response_api_optional_request_params: dict, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Dict: + ) -> dict: """ Volcengine rejects any undocumented fields (including extra_body). Fail fast with clear errors and re-filter with the documented whitelist before delegating @@ -210,7 +213,7 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): def transform_streaming_response( self, model: str, - parsed_chunk: dict, + parsed_chunk: Mapping[str, object], logging_obj: LiteLLMLoggingObj, ) -> ResponsesAPIStreamingResponse: """ @@ -222,18 +225,19 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): if isinstance(chunk, dict): resp = chunk.get("response") if isinstance(resp, dict) and "output" not in resp: + resp_items: Mapping[str, object] = resp patched_chunk = dict(chunk) - patched_resp = dict(resp) + patched_resp = dict(resp_items) patched_resp["output"] = [] patched_chunk["response"] = patched_resp chunk = patched_chunk event_type = str(chunk.get("type")) if isinstance(chunk, dict) else None - event_pydantic_model = OpenAIResponsesAPIConfig.get_event_model_class(event_type=event_type) + event_pydantic_model: _EventModelClass = OpenAIResponsesAPIConfig.get_event_model_class(event_type=event_type) patched_chunk = self._fill_missing_fields(chunk, event_pydantic_model) - return event_pydantic_model(**patched_chunk) + return event_pydantic_model.model_validate(patched_chunk) def transform_response_api_response( self, @@ -246,7 +250,7 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): original_response=raw_response.text, additional_args={"complete_input_dict": {}}, ) - raw_response_json = raw_response.json() + raw_response_json = self._parsed_response_body(raw_response) if "created_at" in raw_response_json: raw_response_json["created_at"] = _safe_convert_created_field(raw_response_json["created_at"]) except Exception: @@ -256,10 +260,11 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): processed_headers = process_response_headers(raw_response_headers) try: - response = ResponsesAPIResponse(**raw_response_json) + response = ResponsesAPIResponse.model_validate(raw_response_json) except Exception: verbose_logger.debug("Volcengine Responses API: falling back to model_construct for response parsing.") - response = ResponsesAPIResponse.model_construct(**raw_response_json) + construct_response: Callable[..., ResponsesAPIResponse] = ResponsesAPIResponse.model_construct + response = construct_response(**raw_response_json) response._hidden_params["additional_headers"] = processed_headers response._hidden_params["headers"] = raw_response_headers @@ -274,10 +279,10 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict]: + ) -> tuple[str, dict]: encoded_response_id = encode_url_path_segment(response_id, field_name="response_id") url = f"{api_base}/{encoded_response_id}" - data: Dict = {} + data: dict = {} return url, data def transform_delete_response_api_response( @@ -286,16 +291,17 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> DeleteResponseResult: try: - raw_response_json = raw_response.json() + raw_response_json = self._parsed_response_body(raw_response) except Exception: raise VolcEngineError(message=raw_response.text, status_code=raw_response.status_code) try: - return DeleteResponseResult(**raw_response_json) + return DeleteResponseResult.model_validate(raw_response_json) except Exception: verbose_logger.debug( "Volcengine Responses API: falling back to model_construct for delete response parsing." ) - return DeleteResponseResult.model_construct(**raw_response_json) + construct_delete_result: Callable[..., DeleteResponseResult] = DeleteResponseResult.model_construct + return construct_delete_result(**raw_response_json) ######################################################### ########## GET RESPONSE API TRANSFORMATION ############### @@ -306,10 +312,10 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict]: + ) -> tuple[str, dict]: encoded_response_id = encode_url_path_segment(response_id, field_name="response_id") url = f"{api_base}/{encoded_response_id}" - data: Dict = {} + data: dict = {} return url, data def transform_get_response_api_response( @@ -318,14 +324,14 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> ResponsesAPIResponse: try: - raw_response_json = raw_response.json() + raw_response_json = self._parsed_response_body(raw_response) except Exception: raise VolcEngineError(message=raw_response.text, status_code=raw_response.status_code) raw_response_headers = dict(raw_response.headers) processed_headers = process_response_headers(raw_response_headers) - response = ResponsesAPIResponse(**raw_response_json) + response = ResponsesAPIResponse.model_validate(raw_response_json) response._hidden_params["additional_headers"] = processed_headers response._hidden_params["headers"] = raw_response_headers return response @@ -339,15 +345,15 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - after: Optional[str] = None, - before: Optional[str] = None, - include: Optional[List[str]] = None, + after: str | None = None, + before: str | None = None, + include: list[str] | None = None, limit: int = 20, order: Literal["asc", "desc"] = "desc", - ) -> Tuple[str, Dict]: + ) -> tuple[str, dict]: encoded_response_id = encode_url_path_segment(response_id, field_name="response_id") url = f"{api_base}/{encoded_response_id}/input_items" - params: Dict[str, Any] = {} + params: dict[str, str | int] = {} if after is not None: params["after"] = after if before is not None: @@ -364,9 +370,9 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): self, raw_response: httpx.Response, logging_obj: LiteLLMLoggingObj, - ) -> Dict: + ) -> dict: try: - return raw_response.json() + return self._parsed_response_body(raw_response) except Exception: raise VolcEngineError(message=raw_response.text, status_code=raw_response.status_code) @@ -379,10 +385,10 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): api_base: str, litellm_params: GenericLiteLLMParams, headers: dict, - ) -> Tuple[str, Dict]: + ) -> tuple[str, dict]: encoded_response_id = encode_url_path_segment(response_id, field_name="response_id") url = f"{api_base}/{encoded_response_id}/cancel" - data: Dict = {} + data: dict = {} return url, data def transform_cancel_response_api_response( @@ -391,23 +397,23 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): logging_obj: LiteLLMLoggingObj, ) -> ResponsesAPIResponse: try: - raw_response_json = raw_response.json() + raw_response_json = self._parsed_response_body(raw_response) except Exception: raise VolcEngineError(message=raw_response.text, status_code=raw_response.status_code) raw_response_headers = dict(raw_response.headers) processed_headers = process_response_headers(raw_response_headers) - response = ResponsesAPIResponse(**raw_response_json) + response = ResponsesAPIResponse.model_validate(raw_response_json) response._hidden_params["additional_headers"] = processed_headers response._hidden_params["headers"] = raw_response_headers return response def should_fake_stream( self, - model: Optional[str], - stream: Optional[bool], - custom_llm_provider: Optional[str] = None, + model: str | None, + stream: bool | None, + custom_llm_provider: str | None = None, ) -> bool: """ Volcengine Responses API supports native streaming; never fall back to fake stream. @@ -415,7 +421,24 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): return False @staticmethod - def _fill_missing_fields(chunk: Any, event_model: Any) -> Dict[str, Any]: + def _parsed_response_body(raw_response: httpx.Response) -> dict[str, object]: + return raw_response.json() + + @staticmethod + def _annotation_origin(annotation: object) -> object: + return get_origin(annotation) + + @staticmethod + def _annotation_args(annotation: object) -> tuple[object, ...]: + return get_args(annotation) + + @staticmethod + def _field_annotation(field: pyd_fields.FieldInfo) -> object: + annotation: object = field.annotation + return annotation + + @staticmethod + def _fill_missing_fields(chunk: Mapping[str, object], event_model: object | None) -> Mapping[str, object]: """ Heuristically fill missing required fields with safe defaults based on the event model's field annotations. This keeps parsing tolerant of providers that @@ -424,31 +447,37 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): if not isinstance(chunk, dict) or event_model is None: return chunk - patched: Dict[str, Any] = dict(chunk) - fields_map = getattr(event_model, "model_fields", {}) or {} + patched = dict(chunk) + fields_map: Mapping[str, pyd_fields.FieldInfo] = getattr(event_model, "model_fields", {}) or {} for name, field in fields_map.items(): if name in patched: - patched[name] = VolcEngineResponsesAPIConfig._maybe_fill_nested(patched[name], field.annotation) + patched[name] = VolcEngineResponsesAPIConfig._maybe_fill_nested( + patched[name], VolcEngineResponsesAPIConfig._field_annotation(field) + ) continue # Explicit default or factory - if field.default is not pyd_fields.PydanticUndefined and field.default is not None: - patched[name] = field.default + field_default: object = field.default + if field_default is not pyd_fields.PydanticUndefined and field_default is not None: + patched[name] = field_default continue - if field.default_factory is not None and field.default_factory is not pyd_fields.PydanticUndefined: - patched[name] = field.default_factory() + default_factory: Callable[..., object] | None = field.default_factory + if default_factory is not None and default_factory is not pyd_fields.PydanticUndefined: + patched[name] = default_factory() continue # Heuristic defaults for missing required fields - patched[name] = VolcEngineResponsesAPIConfig._default_for_annotation(field.annotation) + patched[name] = VolcEngineResponsesAPIConfig._default_for_annotation( + VolcEngineResponsesAPIConfig._field_annotation(field) + ) return patched @staticmethod - def _default_for_annotation(annotation: Any) -> Any: - origin = get_origin(annotation) - args = get_args(annotation) + def _default_for_annotation(annotation: object) -> object: + origin = VolcEngineResponsesAPIConfig._annotation_origin(annotation) + args = VolcEngineResponsesAPIConfig._annotation_args(annotation) if annotation is int: return 0 @@ -456,7 +485,7 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): return [] if origin is Union: # Prefer empty list when any option is a list - if any((arg is list or get_origin(arg) is list) for arg in args): + if any((arg is list or VolcEngineResponsesAPIConfig._annotation_origin(arg) is list) for arg in args): return [] if type(None) in args: return None @@ -467,53 +496,51 @@ class VolcEngineResponsesAPIConfig(OpenAIResponsesAPIConfig): return None @staticmethod - def _maybe_fill_nested(value: Any, annotation: Any) -> Any: + def _maybe_fill_nested(value: object, annotation: object) -> object: """ Recursively fill nested dict/list structures based on the annotated model. """ model_cls = VolcEngineResponsesAPIConfig._pick_model_class(annotation, value) - args = get_args(annotation) + args = VolcEngineResponsesAPIConfig._annotation_args(annotation) if isinstance(value, dict) and model_cls is not None: - return VolcEngineResponsesAPIConfig._fill_missing_fields(value, model_cls) + nested_items: Mapping[str, object] = value + return VolcEngineResponsesAPIConfig._fill_missing_fields(nested_items, model_cls) if isinstance(value, list): # Attempt to fill list elements if we know the element annotation - elem_ann: Any = args[0] if args else None + elem_ann: object = args[0] if args else None if elem_ann is not None: - return [VolcEngineResponsesAPIConfig._maybe_fill_nested(v, elem_ann) for v in value] + nested_elements: Sequence[object] = value + return [VolcEngineResponsesAPIConfig._maybe_fill_nested(v, elem_ann) for v in nested_elements] return value @staticmethod - def _pick_model_class(annotation: Any, value: Any) -> Optional[Any]: + def _pick_model_class(annotation: object, value: object) -> object | None: """ Choose the best-matching Pydantic model class for a nested dict. """ - candidates: List[Any] = [] - origin = get_origin(annotation) - - if hasattr(annotation, "model_fields"): - candidates.append(annotation) - if origin is Union: - for arg in get_args(annotation): - if hasattr(arg, "model_fields"): - candidates.append(arg) + origin = VolcEngineResponsesAPIConfig._annotation_origin(annotation) + union_args = VolcEngineResponsesAPIConfig._annotation_args(annotation) if origin is Union else () + candidates = tuple(candidate for candidate in (annotation, *union_args) if hasattr(candidate, "model_fields")) if not candidates: return None # Try to match by literal "type" field when available if isinstance(value, dict): - v_type = value.get("type") + value_items: Mapping[str, object] = value + v_type = value_items.get("type") for candidate in candidates: try: - type_field = candidate.model_fields.get("type") + candidate_fields: Mapping[str, pyd_fields.FieldInfo] = getattr(candidate, "model_fields") + type_field = candidate_fields.get("type") if type_field is None: continue - literal_ann = type_field.annotation - if get_origin(literal_ann) is Literal: - literal_values = get_args(literal_ann) + literal_ann = VolcEngineResponsesAPIConfig._field_annotation(type_field) + if VolcEngineResponsesAPIConfig._annotation_origin(literal_ann) is Literal: + literal_values = VolcEngineResponsesAPIConfig._annotation_args(literal_ann) if v_type in literal_values: return candidate except Exception: diff --git a/litellm/main.py b/litellm/main.py index 7d457d9cdd1..dc3ec469a1b 100644 --- a/litellm/main.py +++ b/litellm/main.py @@ -27,7 +27,6 @@ from typing import ( TYPE_CHECKING, Any, AsyncIterator, - Callable, Coroutine, Dict, Iterable, @@ -81,19 +80,19 @@ from litellm.constants import ( from litellm.exceptions import LiteLLMUnknownProvider from litellm.integrations.custom_logger import CustomLogger from litellm.litellm_core_utils.asyncify import run_async_function -from litellm.litellm_core_utils.chat_completion_agentic_loop import ( - maybe_run_chat_completion_agentic_loop, -) from litellm.litellm_core_utils.audio_utils.utils import ( calculate_request_duration, get_audio_file_for_health_check, ) -from litellm.litellm_core_utils.completion_timeout import CompletionTimeout -from litellm.litellm_core_utils.request_timeout_resolver import ( - get_configured_request_timeout, +from litellm.litellm_core_utils.chat_completion_agentic_loop import ( + maybe_run_chat_completion_agentic_loop, ) -from litellm.litellm_core_utils.get_litellm_params import OPTIONAL_KWARGS_KEYS +from litellm.litellm_core_utils.completion_timeout import CompletionTimeout from litellm.litellm_core_utils.dd_tracing import tracer +from litellm.litellm_core_utils.get_litellm_params import ( + AWS_CREDENTIAL_KWARGS_KEYS, + OPTIONAL_KWARGS_KEYS, +) from litellm.litellm_core_utils.get_provider_specific_headers import ( ProviderSpecificHeaderUtils, ) @@ -109,6 +108,9 @@ from litellm.litellm_core_utils.mock_functions import ( from litellm.litellm_core_utils.prompt_templates.common_utils import ( get_content_from_model_response, ) +from litellm.litellm_core_utils.request_timeout_resolver import ( + get_configured_request_timeout, +) from litellm.llms.base_llm import BaseConfig, BaseImageGenerationConfig from litellm.llms.base_llm.base_model_iterator import ( convert_model_response_to_streaming, @@ -210,7 +212,6 @@ from .llms.bedrock.embed.embedding import BedrockEmbedding from .llms.bedrock.image_edit.handler import BedrockImageEdit from .llms.bedrock.image_generation.image_handler import BedrockImageGeneration from .llms.bytez.chat.transformation import BytezChatConfig -from .llms.gdc.chat.transformation import GDCGeminiConfig from .llms.clarifai.chat.transformation import ClarifaiConfig from .llms.codestral.completion.handler import CodestralTextCompletion from .llms.cohere.embed import handler as cohere_embed @@ -219,24 +220,25 @@ from .llms.custom_httpx.llm_http_handler import BaseLLMHTTPHandler from .llms.custom_llm import CustomLLM, custom_chat_llm_router from .llms.databricks.embed.handler import DatabricksEmbeddingHandler from .llms.deprecated_providers import aleph_alpha, palm +from .llms.gdc.chat.transformation import GDCGeminiConfig from .llms.gemini.common_utils import get_api_key_from_env from .llms.groq.chat.handler import GroqChatCompletion from .llms.heroku.chat.transformation import HerokuChatConfig from .llms.huggingface.embedding.handler import HuggingFaceEmbedding from .llms.lemonade.chat.transformation import LemonadeChatConfig from .llms.nlp_cloud.chat.handler import completion as nlp_cloud_chat_completion -from .llms.oci.chat.transformation import OCIChatConfig -from .llms.ollama.completion import handler as ollama -from .llms.oobabooga.chat import oobabooga -from .llms.openai.completion.handler import OpenAITextCompletion -from .llms.openai.image_variations.handler import OpenAIImageVariationsHandler -from .llms.openai.openai import OpenAIChatCompletion from .llms.nvidia_riva.audio_transcription.handler import ( NvidiaRivaAudioTranscription, ) from .llms.nvidia_riva.audio_transcription.transformation import ( NvidiaRivaAudioTranscriptionConfig, ) +from .llms.oci.chat.transformation import OCIChatConfig +from .llms.ollama.completion import handler as ollama +from .llms.oobabooga.chat import oobabooga +from .llms.openai.completion.handler import OpenAITextCompletion +from .llms.openai.image_variations.handler import OpenAIImageVariationsHandler +from .llms.openai.openai import OpenAIChatCompletion from .llms.openai.transcriptions.handler import OpenAIAudioTranscription from .llms.openai_like.chat.handler import OpenAILikeChatHandler from .llms.openai_like.embedding.handler import OpenAILikeEmbeddingHandler @@ -507,6 +509,20 @@ async def acompletion( ######################################################### ######################################################### litellm_logging_obj = kwargs.get("litellm_logging_obj", None) + + from litellm.integrations.anthropic_cache_control_hook import ( + AnthropicCacheControlHook, + ) + from litellm.types.llms.openai import AllMessageValues + + AnthropicCacheControlHook.maybe_seed_default_injection_points( + non_default_params=kwargs, + messages=cast(list[AllMessageValues], messages), # cast-ok: acompletion types messages as a bare List + model=model, + custom_llm_provider=cast(Optional[str], custom_llm_provider), # cast-ok: read from untyped kwargs + tools=tools, + ) + if isinstance(litellm_logging_obj, LiteLLMLoggingObj) and ( litellm_logging_obj.should_run_prompt_management_hooks( prompt_id=kwargs.get("prompt_id", None), @@ -5052,6 +5068,19 @@ def completion( # type: ignore litellm_params = {} # used to prevent unbound var errors ## PROMPT MANAGEMENT HOOKS ## + from litellm.integrations.anthropic_cache_control_hook import ( + AnthropicCacheControlHook, + ) + from litellm.types.llms.openai import AllMessageValues + + AnthropicCacheControlHook.maybe_seed_default_injection_points( + non_default_params=non_default_params, + messages=cast(list[AllMessageValues], messages), # cast-ok: completion types messages as a bare List + model=model, + custom_llm_provider=cast(Optional[str], kwargs.get("custom_llm_provider")), # cast-ok: untyped kwargs + tools=tools, + ) + if isinstance(litellm_logging_obj, LiteLLMLoggingObj) and ( litellm_logging_obj.should_run_prompt_management_hooks( prompt_id=prompt_id, non_default_params=non_default_params @@ -5082,7 +5111,10 @@ def completion( # type: ignore try: if base_url is not None: api_base = base_url - if num_retries is not None: + is_router_call = any("model_group" in (kwargs.get(k) or ()) for k in ("metadata", "litellm_metadata")) + if is_router_call: + max_retries = 0 + elif num_retries is not None: max_retries = num_retries logging: LiteLLMLoggingObj = cast(LiteLLMLoggingObj, litellm_logging_obj) fallbacks = fallbacks or litellm.model_fallbacks @@ -5322,7 +5354,7 @@ def completion( # type: ignore tpm=kwargs.get("tpm"), rpm=kwargs.get("rpm"), use_xai_oauth=kwargs.get("use_xai_oauth", False), - aws_bedrock_project_id=kwargs.get("aws_bedrock_project_id"), + **{key: kwargs[key] for key in AWS_CREDENTIAL_KWARGS_KEYS if key in kwargs}, ) cast(LiteLLMLoggingObj, logging).update_environment_variables( model=model, @@ -7692,6 +7724,32 @@ def transcription( headers=extra_headers, provider_config=provider_config, # type: ignore[arg-type] ) + elif custom_llm_provider == "bedrock": + from litellm.llms.bedrock.audio_transcription import BedrockAudioTranscriptionRustDispatch + + dispatch = BedrockAudioTranscriptionRustDispatch() + if atranscription: + response = dispatch.async_audio_transcriptions( + model=model, + audio_file=file, + api_key=api_key, + api_base=api_base, + custom_llm_provider=custom_llm_provider, + extra_headers=extra_headers, + optional_params=optional_params, + timeout=timeout, + ) + else: + response = dispatch.audio_transcriptions( + model=model, + audio_file=file, + api_key=api_key, + api_base=api_base, + custom_llm_provider=custom_llm_provider, + extra_headers=extra_headers, + optional_params=optional_params, + timeout=timeout, + ) elif provider_config is not None: response = base_llm_http_handler.audio_transcriptions( model=model, diff --git a/litellm/model_prices_and_context_window_backup.json b/litellm/model_prices_and_context_window_backup.json index db534b52df9..87d9b6afc18 100644 --- a/litellm/model_prices_and_context_window_backup.json +++ b/litellm/model_prices_and_context_window_backup.json @@ -721,7 +721,8 @@ "supports_pdf_input": true, "supports_prompt_caching": true, "supports_response_schema": true, - "supports_tool_choice": true + "supports_tool_choice": true, + "prompt_cache_min_tokens": 2048 }, "anthropic.claude-haiku-4-5-20251001-v1:0": { "cache_creation_input_token_cost": 1.25e-06, @@ -745,7 +746,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "anthropic.claude-haiku-4-5@20251001": { "cache_creation_input_token_cost": 1.25e-06, @@ -770,7 +772,8 @@ "supports_vision": true, "supports_native_streaming": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "anthropic.claude-3-5-sonnet-20240620-v1:0": { "input_cost_per_token": 3e-06, @@ -935,7 +938,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "anthropic.claude-opus-4-20250514-v1:0": { "cache_creation_input_token_cost": 1.875e-05, @@ -960,7 +964,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "anthropic.claude-opus-4-5-20251101-v1:0": { "cache_creation_input_token_cost": 6.25e-06, @@ -990,7 +995,8 @@ "supports_native_structured_output": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "high", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "anthropic.claude-opus-4-6-v1": { "supports_adaptive_thinking": true, @@ -1022,7 +1028,8 @@ "supports_output_config": true, "supports_max_reasoning_effort": true, "bedrock_output_config_effort_ceiling": "max", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "global.anthropic.claude-opus-4-6-v1": { "supports_adaptive_thinking": true, @@ -1054,7 +1061,8 @@ "supports_output_config": true, "supports_max_reasoning_effort": true, "bedrock_output_config_effort_ceiling": "max", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "us.anthropic.claude-opus-4-6-v1": { "supports_adaptive_thinking": true, @@ -1086,7 +1094,8 @@ "supports_output_config": true, "supports_max_reasoning_effort": true, "bedrock_output_config_effort_ceiling": "max", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "eu.anthropic.claude-opus-4-6-v1": { "supports_adaptive_thinking": true, @@ -1118,7 +1127,8 @@ "supports_output_config": true, "supports_max_reasoning_effort": true, "bedrock_output_config_effort_ceiling": "max", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "au.anthropic.claude-opus-4-6-v1": { "supports_adaptive_thinking": true, @@ -1150,7 +1160,8 @@ "supports_output_config": true, "supports_max_reasoning_effort": true, "bedrock_output_config_effort_ceiling": "max", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "anthropic.claude-opus-4-7": { "bedrock_converse_supports_strict_tools": false, @@ -1185,7 +1196,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 2048 }, "anthropic.claude-mythos-preview": { "input_cost_per_token": 0, @@ -1235,7 +1247,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 2048 }, "us.anthropic.claude-opus-4-7": { "bedrock_converse_supports_strict_tools": false, @@ -1270,7 +1283,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 2048 }, "eu.anthropic.claude-opus-4-7": { "bedrock_converse_supports_strict_tools": false, @@ -1305,7 +1319,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 2048 }, "au.anthropic.claude-opus-4-7": { "bedrock_converse_supports_strict_tools": false, @@ -1340,7 +1355,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 2048 }, "anthropic.claude-fable-5": { "cache_creation_input_token_cost": 1.25e-05, @@ -1359,6 +1375,7 @@ "search_context_size_medium": 0.01 }, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -1374,7 +1391,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "global.anthropic.claude-fable-5": { "cache_creation_input_token_cost": 1.25e-05, @@ -1393,6 +1411,7 @@ "search_context_size_medium": 0.01 }, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -1408,7 +1427,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "us.anthropic.claude-fable-5": { "cache_creation_input_token_cost": 1.375e-05, @@ -1427,6 +1447,7 @@ "search_context_size_medium": 0.01 }, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -1442,7 +1463,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "eu.anthropic.claude-fable-5": { "cache_creation_input_token_cost": 1.375e-05, @@ -1461,6 +1483,7 @@ "search_context_size_medium": 0.01 }, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -1476,11 +1499,229 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 + }, + "anthropic.claude-opus-5": { + "bedrock_converse_supports_strict_tools": false, + "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, + "cache_creation_input_token_cost": 6.25e-06, + "cache_creation_input_token_cost_above_1hr": 1e-05, + "cache_read_input_token_cost": 5e-07, + "input_cost_per_token": 5e-06, + "litellm_provider": "bedrock_converse", + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2.5e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_native_structured_output": true, + "supports_max_reasoning_effort": true, + "supports_output_config": true, + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 512 + }, + "global.anthropic.claude-opus-5": { + "bedrock_converse_supports_strict_tools": false, + "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, + "cache_creation_input_token_cost": 6.25e-06, + "cache_creation_input_token_cost_above_1hr": 1e-05, + "cache_read_input_token_cost": 5e-07, + "input_cost_per_token": 5e-06, + "litellm_provider": "bedrock_converse", + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2.5e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_native_structured_output": true, + "supports_max_reasoning_effort": true, + "supports_output_config": true, + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 512 + }, + "us.anthropic.claude-opus-5": { + "bedrock_converse_supports_strict_tools": false, + "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, + "cache_creation_input_token_cost": 6.875e-06, + "cache_creation_input_token_cost_above_1hr": 1.1e-05, + "cache_read_input_token_cost": 5.5e-07, + "input_cost_per_token": 5.5e-06, + "litellm_provider": "bedrock_converse", + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2.75e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_native_structured_output": true, + "supports_max_reasoning_effort": true, + "supports_output_config": true, + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 512 + }, + "eu.anthropic.claude-opus-5": { + "bedrock_converse_supports_strict_tools": false, + "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, + "cache_creation_input_token_cost": 6.875e-06, + "cache_creation_input_token_cost_above_1hr": 1.1e-05, + "cache_read_input_token_cost": 5.5e-07, + "input_cost_per_token": 5.5e-06, + "litellm_provider": "bedrock_converse", + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2.75e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_native_structured_output": true, + "supports_max_reasoning_effort": true, + "supports_output_config": true, + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 512 + }, + "au.anthropic.claude-opus-5": { + "bedrock_converse_supports_strict_tools": false, + "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, + "cache_creation_input_token_cost": 6.875e-06, + "cache_creation_input_token_cost_above_1hr": 1.1e-05, + "cache_read_input_token_cost": 5.5e-07, + "input_cost_per_token": 5.5e-06, + "litellm_provider": "bedrock_converse", + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2.75e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_native_structured_output": true, + "supports_max_reasoning_effort": true, + "supports_output_config": true, + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 512 + }, + "jp.anthropic.claude-opus-5": { + "bedrock_converse_supports_strict_tools": false, + "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, + "cache_creation_input_token_cost": 6.875e-06, + "cache_creation_input_token_cost_above_1hr": 1.1e-05, + "cache_read_input_token_cost": 5.5e-07, + "input_cost_per_token": 5.5e-06, + "litellm_provider": "bedrock_converse", + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2.75e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_native_structured_output": true, + "supports_max_reasoning_effort": true, + "supports_output_config": true, + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 512 }, "anthropic.claude-opus-4-8": { "bedrock_converse_supports_strict_tools": false, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "cache_creation_input_token_cost": 6.25e-06, "cache_creation_input_token_cost_above_1hr": 1e-05, "cache_read_input_token_cost": 5e-07, @@ -1511,11 +1752,13 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "global.anthropic.claude-opus-4-8": { "bedrock_converse_supports_strict_tools": false, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "cache_creation_input_token_cost": 6.25e-06, "cache_creation_input_token_cost_above_1hr": 1e-05, "cache_read_input_token_cost": 5e-07, @@ -1546,11 +1789,13 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "us.anthropic.claude-opus-4-8": { "bedrock_converse_supports_strict_tools": false, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "cache_creation_input_token_cost": 6.875e-06, "cache_creation_input_token_cost_above_1hr": 1.1e-05, "cache_read_input_token_cost": 5.5e-07, @@ -1581,11 +1826,13 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "eu.anthropic.claude-opus-4-8": { "bedrock_converse_supports_strict_tools": false, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "cache_creation_input_token_cost": 6.875e-06, "cache_creation_input_token_cost_above_1hr": 1.1e-05, "cache_read_input_token_cost": 5.5e-07, @@ -1616,11 +1863,13 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "au.anthropic.claude-opus-4-8": { "bedrock_converse_supports_strict_tools": false, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "cache_creation_input_token_cost": 6.875e-06, "cache_creation_input_token_cost_above_1hr": 1.1e-05, "cache_read_input_token_cost": 5.5e-07, @@ -1651,7 +1900,45 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 + }, + "jp.anthropic.claude-opus-4-8": { + "bedrock_converse_supports_strict_tools": false, + "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, + "cache_creation_input_token_cost": 6.875e-06, + "cache_creation_input_token_cost_above_1hr": 1.1e-05, + "cache_read_input_token_cost": 5.5e-07, + "input_cost_per_token": 5.5e-06, + "litellm_provider": "bedrock_converse", + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2.75e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_native_structured_output": true, + "supports_max_reasoning_effort": true, + "supports_output_config": true, + "bedrock_output_config_effort_ceiling": "xhigh", + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "jp.anthropic.claude-opus-4-7": { "bedrock_converse_supports_strict_tools": false, @@ -1684,7 +1971,8 @@ "supports_native_structured_output": true, "supports_max_reasoning_effort": true, "supports_minimal_reasoning_effort": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 2048 }, "anthropic.claude-sonnet-5": { "cache_creation_input_token_cost": 2.5e-06, @@ -1703,6 +1991,7 @@ "search_context_size_medium": 0.01 }, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -1718,7 +2007,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "global.anthropic.claude-sonnet-5": { "cache_creation_input_token_cost": 2.5e-06, @@ -1737,6 +2027,7 @@ "search_context_size_medium": 0.01 }, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -1752,7 +2043,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "us.anthropic.claude-sonnet-5": { "cache_creation_input_token_cost": 2.75e-06, @@ -1771,6 +2063,7 @@ "search_context_size_medium": 0.01 }, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -1786,7 +2079,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "eu.anthropic.claude-sonnet-5": { "cache_creation_input_token_cost": 2.75e-06, @@ -1805,6 +2099,7 @@ "search_context_size_medium": 0.01 }, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -1820,7 +2115,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "au.anthropic.claude-sonnet-5": { "cache_creation_input_token_cost": 2.75e-06, @@ -1839,6 +2135,7 @@ "search_context_size_medium": 0.01 }, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -1854,7 +2151,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "jp.anthropic.claude-sonnet-5": { "cache_creation_input_token_cost": 2.75e-06, @@ -1873,6 +2171,7 @@ "search_context_size_medium": 0.01 }, "supports_adaptive_thinking": true, + "supports_mid_conversation_system": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -1888,7 +2187,8 @@ "supports_max_reasoning_effort": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "xhigh", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "anthropic.claude-sonnet-4-6": { "supports_adaptive_thinking": true, @@ -1919,7 +2219,8 @@ "supports_vision": true, "supports_native_structured_output": true, "supports_output_config": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "global.anthropic.claude-sonnet-4-6": { "supports_adaptive_thinking": true, @@ -1950,7 +2251,8 @@ "supports_vision": true, "supports_native_structured_output": true, "supports_output_config": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "us.anthropic.claude-sonnet-4-6": { "supports_adaptive_thinking": true, @@ -1981,7 +2283,8 @@ "supports_vision": true, "supports_native_structured_output": true, "supports_output_config": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "eu.anthropic.claude-sonnet-4-6": { "supports_adaptive_thinking": true, @@ -2012,7 +2315,8 @@ "supports_vision": true, "supports_native_structured_output": true, "supports_output_config": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "au.anthropic.claude-sonnet-4-6": { "supports_adaptive_thinking": true, @@ -2043,7 +2347,8 @@ "supports_vision": true, "supports_native_structured_output": true, "supports_output_config": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "jp.anthropic.claude-sonnet-4-6": { "supports_adaptive_thinking": true, @@ -2074,7 +2379,8 @@ "supports_vision": true, "supports_native_structured_output": true, "supports_output_config": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "anthropic.claude-sonnet-4-20250514-v1:0": { "cache_creation_input_token_cost": 3.75e-06, @@ -2104,7 +2410,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_vision": true, - "bedrock_converse_supports_strict_tools": false + "bedrock_converse_supports_strict_tools": false, + "prompt_cache_min_tokens": 1024 }, "anthropic.claude-sonnet-4-5-20250929-v1:0": { "cache_creation_input_token_cost": 3.75e-06, @@ -2137,7 +2444,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "anthropic.claude-v1": { "input_cost_per_token": 8e-06, @@ -2388,7 +2696,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "apac.anthropic.claude-3-sonnet-20240229-v1:0": { "input_cost_per_token": 3e-06, @@ -2434,7 +2743,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_vision": true, - "bedrock_converse_supports_strict_tools": false + "bedrock_converse_supports_strict_tools": false, + "prompt_cache_min_tokens": 1024 }, "assemblyai/best": { "input_cost_per_second": 3.333e-05, @@ -2479,7 +2789,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "azure/ada": { "input_cost_per_token": 1e-07, @@ -2576,7 +2887,7 @@ "input_cost_per_token": 5e-06, "output_cost_per_token": 2.5e-05, "litellm_provider": "azure_ai", - "max_input_tokens": 200000, + "max_input_tokens": 1000000, "max_output_tokens": 128000, "max_tokens": 128000, "mode": "chat", @@ -2605,7 +2916,7 @@ "input_cost_per_token": 5e-06, "output_cost_per_token": 2.5e-05, "litellm_provider": "azure_ai", - "max_input_tokens": 200000, + "max_input_tokens": 1000000, "max_output_tokens": 128000, "max_tokens": 128000, "mode": "chat", @@ -2631,6 +2942,7 @@ "supports_max_reasoning_effort": true }, "azure_ai/claude-fable-5": { + "supports_mid_conversation_system": true, "input_cost_per_token": 1e-05, "output_cost_per_token": 5e-05, "litellm_provider": "azure_ai", @@ -2660,12 +2972,45 @@ "supports_xhigh_reasoning_effort": true, "supports_max_reasoning_effort": true }, - "azure_ai/claude-opus-4-8": { + "azure_ai/claude-opus-5": { + "supports_mid_conversation_system": true, "supports_adaptive_thinking": true, "input_cost_per_token": 5e-06, "output_cost_per_token": 2.5e-05, "litellm_provider": "azure_ai", - "max_input_tokens": 200000, + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "cache_creation_input_token_cost": 6.25e-06, + "cache_creation_input_token_cost_above_1hr": 1e-05, + "cache_read_input_token_cost": 5e-07, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 512 + }, + "azure_ai/claude-opus-4-8": { + "supports_mid_conversation_system": true, + "supports_adaptive_thinking": true, + "input_cost_per_token": 5e-06, + "output_cost_per_token": 2.5e-05, + "litellm_provider": "azure_ai", + "max_input_tokens": 1000000, "max_output_tokens": 128000, "max_tokens": 128000, "mode": "chat", @@ -2733,6 +3078,7 @@ "supports_vision": true }, "azure_ai/claude-sonnet-5": { + "supports_mid_conversation_system": true, "cache_creation_input_token_cost": 2.5e-06, "cache_creation_input_token_cost_above_1hr": 4e-06, "cache_read_input_token_cost": 2e-07, @@ -3356,7 +3702,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 2.2e-05, "output_cost_per_token": 2.64e-06, "supports_audio_input": true, @@ -3375,7 +3721,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 0.00022, "output_cost_per_token": 2.2e-05, "supports_audio_input": true, @@ -3394,7 +3740,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 8e-05, "output_cost_per_token": 2.2e-05, "supported_modalities": [ @@ -4592,7 +4938,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 2e-05, "output_cost_per_token": 2.4e-06, "supports_audio_input": true, @@ -4612,7 +4958,7 @@ "max_input_tokens": 32000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 6.4e-05, "output_cost_per_token": 1.6e-05, "supported_endpoints": [ @@ -4644,7 +4990,7 @@ "max_input_tokens": 32000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 6.4e-05, "output_cost_per_token": 1.6e-05, "supported_endpoints": [ @@ -4676,7 +5022,7 @@ "max_input_tokens": 32000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 2e-05, "output_cost_per_token": 2.4e-06, "supported_endpoints": [ @@ -4737,7 +5083,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 0.0002, "output_cost_per_token": 2e-05, "supports_audio_input": true, @@ -4755,7 +5101,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 8e-05, "output_cost_per_token": 2e-05, "supported_modalities": [ @@ -6012,6 +6358,522 @@ "supports_vision": true, "supports_web_search": true }, + "azure/gpt-5.6": { + "cache_read_input_token_cost": 5e-07, + "cache_read_input_token_cost_above_272k_tokens": 1e-06, + "cache_read_input_token_cost_priority": 1e-06, + "cache_read_input_token_cost_above_272k_tokens_priority": 2e-06, + "input_cost_per_token": 5e-06, + "input_cost_per_token_above_272k_tokens": 1e-05, + "input_cost_per_token_priority": 1e-05, + "input_cost_per_token_above_272k_tokens_priority": 2e-05, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 3e-05, + "output_cost_per_token_above_272k_tokens": 4.5e-05, + "output_cost_per_token_priority": 6e-05, + "output_cost_per_token_above_272k_tokens_priority": 9e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/gpt-5.6-sol": { + "cache_read_input_token_cost": 5e-07, + "cache_read_input_token_cost_above_272k_tokens": 1e-06, + "cache_read_input_token_cost_priority": 1e-06, + "cache_read_input_token_cost_above_272k_tokens_priority": 2e-06, + "input_cost_per_token": 5e-06, + "input_cost_per_token_above_272k_tokens": 1e-05, + "input_cost_per_token_priority": 1e-05, + "input_cost_per_token_above_272k_tokens_priority": 2e-05, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 3e-05, + "output_cost_per_token_above_272k_tokens": 4.5e-05, + "output_cost_per_token_priority": 6e-05, + "output_cost_per_token_above_272k_tokens_priority": 9e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/gpt-5.6-terra": { + "cache_read_input_token_cost": 2.5e-07, + "cache_read_input_token_cost_above_272k_tokens": 5e-07, + "cache_read_input_token_cost_priority": 5e-07, + "cache_read_input_token_cost_above_272k_tokens_priority": 1e-06, + "input_cost_per_token": 2.5e-06, + "input_cost_per_token_above_272k_tokens": 5e-06, + "input_cost_per_token_priority": 5e-06, + "input_cost_per_token_above_272k_tokens_priority": 1e-05, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 1.5e-05, + "output_cost_per_token_above_272k_tokens": 2.25e-05, + "output_cost_per_token_priority": 3e-05, + "output_cost_per_token_above_272k_tokens_priority": 4.5e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/gpt-5.6-luna": { + "cache_read_input_token_cost": 1e-07, + "cache_read_input_token_cost_above_272k_tokens": 2e-07, + "cache_read_input_token_cost_priority": 2e-07, + "cache_read_input_token_cost_above_272k_tokens_priority": 4e-07, + "input_cost_per_token": 1e-06, + "input_cost_per_token_above_272k_tokens": 2e-06, + "input_cost_per_token_priority": 2e-06, + "input_cost_per_token_above_272k_tokens_priority": 4e-06, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 6e-06, + "output_cost_per_token_above_272k_tokens": 9e-06, + "output_cost_per_token_priority": 1.2e-05, + "output_cost_per_token_above_272k_tokens_priority": 1.8e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/us/gpt-5.6": { + "cache_read_input_token_cost": 5.5e-07, + "cache_read_input_token_cost_above_272k_tokens": 1.1e-06, + "cache_read_input_token_cost_priority": 1.375e-06, + "input_cost_per_token": 5.5e-06, + "input_cost_per_token_above_272k_tokens": 1.1e-05, + "input_cost_per_token_priority": 1.375e-05, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 3.3e-05, + "output_cost_per_token_above_272k_tokens": 4.95e-05, + "output_cost_per_token_priority": 8.25e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/us/gpt-5.6-sol": { + "cache_read_input_token_cost": 5.5e-07, + "cache_read_input_token_cost_above_272k_tokens": 1.1e-06, + "cache_read_input_token_cost_priority": 1.375e-06, + "input_cost_per_token": 5.5e-06, + "input_cost_per_token_above_272k_tokens": 1.1e-05, + "input_cost_per_token_priority": 1.375e-05, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 3.3e-05, + "output_cost_per_token_above_272k_tokens": 4.95e-05, + "output_cost_per_token_priority": 8.25e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/us/gpt-5.6-terra": { + "cache_read_input_token_cost": 2.75e-07, + "cache_read_input_token_cost_above_272k_tokens": 5.5e-07, + "cache_read_input_token_cost_priority": 6.875e-07, + "input_cost_per_token": 2.75e-06, + "input_cost_per_token_above_272k_tokens": 5.5e-06, + "input_cost_per_token_priority": 6.875e-06, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 1.65e-05, + "output_cost_per_token_above_272k_tokens": 2.475e-05, + "output_cost_per_token_priority": 4.125e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/us/gpt-5.6-luna": { + "cache_read_input_token_cost": 1.1e-07, + "cache_read_input_token_cost_above_272k_tokens": 2.2e-07, + "cache_read_input_token_cost_priority": 2.75e-07, + "input_cost_per_token": 1.1e-06, + "input_cost_per_token_above_272k_tokens": 2.2e-06, + "input_cost_per_token_priority": 2.75e-06, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 6.6e-06, + "output_cost_per_token_above_272k_tokens": 9.9e-06, + "output_cost_per_token_priority": 1.65e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/eu/gpt-5.6": { + "cache_read_input_token_cost": 5.5e-07, + "cache_read_input_token_cost_above_272k_tokens": 1.1e-06, + "cache_read_input_token_cost_priority": 1.375e-06, + "input_cost_per_token": 5.5e-06, + "input_cost_per_token_above_272k_tokens": 1.1e-05, + "input_cost_per_token_priority": 1.375e-05, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 3.3e-05, + "output_cost_per_token_above_272k_tokens": 4.95e-05, + "output_cost_per_token_priority": 8.25e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/eu/gpt-5.6-sol": { + "cache_read_input_token_cost": 5.5e-07, + "cache_read_input_token_cost_above_272k_tokens": 1.1e-06, + "cache_read_input_token_cost_priority": 1.375e-06, + "input_cost_per_token": 5.5e-06, + "input_cost_per_token_above_272k_tokens": 1.1e-05, + "input_cost_per_token_priority": 1.375e-05, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 3.3e-05, + "output_cost_per_token_above_272k_tokens": 4.95e-05, + "output_cost_per_token_priority": 8.25e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/eu/gpt-5.6-terra": { + "cache_read_input_token_cost": 2.75e-07, + "cache_read_input_token_cost_above_272k_tokens": 5.5e-07, + "cache_read_input_token_cost_priority": 6.875e-07, + "input_cost_per_token": 2.75e-06, + "input_cost_per_token_above_272k_tokens": 5.5e-06, + "input_cost_per_token_priority": 6.875e-06, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 1.65e-05, + "output_cost_per_token_above_272k_tokens": 2.475e-05, + "output_cost_per_token_priority": 4.125e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure/eu/gpt-5.6-luna": { + "cache_read_input_token_cost": 1.1e-07, + "cache_read_input_token_cost_above_272k_tokens": 2.2e-07, + "cache_read_input_token_cost_priority": 2.75e-07, + "input_cost_per_token": 1.1e-06, + "input_cost_per_token_above_272k_tokens": 2.2e-06, + "input_cost_per_token_priority": 2.75e-06, + "litellm_provider": "azure", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 6.6e-06, + "output_cost_per_token_above_272k_tokens": 9.9e-06, + "output_cost_per_token_priority": 1.65e-05, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, "azure/gpt-5.5": { "cache_read_input_token_cost": 5e-07, "cache_read_input_token_cost_above_272k_tokens": 1e-06, @@ -7311,7 +8173,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 2.2e-05, "output_cost_per_token": 2.64e-06, "supports_audio_input": true, @@ -7330,7 +8192,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 0.00022, "output_cost_per_token": 2.2e-05, "supports_audio_input": true, @@ -7349,7 +8211,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 8e-05, "output_cost_per_token": 2.2e-05, "supported_modalities": [ @@ -9923,7 +10785,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "bedrock/us-gov-east-1/claude-sonnet-4-5-20250929-v1:0": { "cache_creation_input_token_cost": 4.5e-06, @@ -9946,7 +10809,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "bedrock/us-gov-east-1/meta.llama3-70b-instruct-v1:0": { "input_cost_per_token": 2.65e-06, @@ -10100,7 +10964,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "bedrock/us-gov-west-1/claude-sonnet-4-5-20250929-v1:0": { "cache_creation_input_token_cost": 4.5e-06, @@ -10123,7 +10988,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "bedrock/us-gov-west-1/meta.llama3-70b-instruct-v1:0": { "input_cost_per_token": 2.65e-06, @@ -10373,7 +11239,8 @@ "supports_pdf_input": true, "supports_prompt_caching": true, "supports_response_schema": true, - "supports_tool_choice": true + "supports_tool_choice": true, + "prompt_cache_min_tokens": 2048 }, "black_forest_labs/flux-kontext-pro": { "litellm_provider": "black_forest_labs", @@ -10593,7 +11460,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 4096 }, "claude-haiku-4-5": { "cache_creation_input_token_cost": 1.25e-06, @@ -10614,7 +11482,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 4096 }, "claude-3-7-sonnet-20250219": { "cache_creation_input_token_cost": 3.75e-06, @@ -10704,7 +11573,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "claude-4-sonnet-20250514": { "cache_creation_input_token_cost": 3.75e-06, @@ -10734,7 +11604,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_vision": true, - "supports_web_search": true + "supports_web_search": true, + "prompt_cache_min_tokens": 1024 }, "claude-sonnet-4-5": { "cache_creation_input_token_cost": 3.75e-06, @@ -10764,8 +11635,10 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "claude-sonnet-4-5-20250929": { "cache_creation_input_token_cost": 3.75e-06, @@ -10795,9 +11668,11 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_tool_choice": true, "supports_vision": true, - "supports_web_search": true + "supports_web_search": true, + "prompt_cache_min_tokens": 1024 }, "claude-sonnet-5": { "cache_creation_input_token_cost": 2.5e-06, @@ -10831,7 +11706,8 @@ "provider_specific_entry": { "us": 1.1 }, - "supports_output_config": true + "supports_output_config": true, + "prompt_cache_min_tokens": 1024 }, "claude-sonnet-4-6": { "cache_creation_input_token_cost": 3.75e-06, @@ -10857,10 +11733,12 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_max_reasoning_effort": true, "supports_tool_choice": true, "supports_vision": true, - "supports_output_config": true + "supports_output_config": true, + "prompt_cache_min_tokens": 1024 }, "claude-sonnet-4-5-20250929-v1:0": { "cache_creation_input_token_cost": 3.75e-06, @@ -10887,7 +11765,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_vision": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "claude-opus-4-1": { "cache_creation_input_token_cost": 1.875e-05, @@ -10912,8 +11791,10 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "claude-opus-4-1-20250805": { "cache_creation_input_token_cost": 1.875e-05, @@ -10939,8 +11820,10 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "claude-opus-4-20250514": { "cache_creation_input_token_cost": 1.875e-05, @@ -10967,7 +11850,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "claude-opus-4-5-20251101": { "cache_creation_input_token_cost": 6.25e-06, @@ -10992,9 +11876,11 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_tool_choice": true, "supports_vision": true, - "supports_output_config": true + "supports_output_config": true, + "prompt_cache_min_tokens": 4096 }, "claude-opus-4-5": { "cache_creation_input_token_cost": 6.25e-06, @@ -11019,9 +11905,11 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_tool_choice": true, "supports_vision": true, - "supports_output_config": true + "supports_output_config": true, + "prompt_cache_min_tokens": 4096 }, "claude-opus-4-6": { "cache_creation_input_token_cost": 6.25e-06, @@ -11047,6 +11935,7 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_tool_choice": true, "supports_vision": true, "provider_specific_entry": { @@ -11055,7 +11944,8 @@ }, "supports_output_config": true, "supports_max_reasoning_effort": true, - "supports_speed": true + "supports_speed": true, + "prompt_cache_min_tokens": 4096 }, "claude-opus-4-6-20260205": { "cache_creation_input_token_cost": 6.25e-06, @@ -11081,6 +11971,7 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_tool_choice": true, "supports_vision": true, "provider_specific_entry": { @@ -11089,7 +11980,8 @@ }, "supports_max_reasoning_effort": true, "supports_output_config": true, - "supports_speed": true + "supports_speed": true, + "prompt_cache_min_tokens": 4096 }, "claude-opus-4-7": { "cache_creation_input_token_cost": 6.25e-06, @@ -11115,6 +12007,7 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_sampling_params": false, "supports_tool_choice": true, "supports_vision": true, @@ -11125,7 +12018,8 @@ "fast": 6.0 }, "supports_output_config": true, - "supports_speed": true + "supports_speed": true, + "prompt_cache_min_tokens": 2048 }, "claude-opus-4-7-20260416": { "cache_creation_input_token_cost": 6.25e-06, @@ -11151,6 +12045,7 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_sampling_params": false, "supports_tool_choice": true, "supports_vision": true, @@ -11161,7 +12056,8 @@ "fast": 6.0 }, "supports_output_config": true, - "supports_speed": true + "supports_speed": true, + "prompt_cache_min_tokens": 2048 }, "claude-fable-5": { "cache_creation_input_token_cost": 1.25e-05, @@ -11195,7 +12091,46 @@ "provider_specific_entry": { "us": 1.1 }, - "supports_output_config": true + "supports_output_config": true, + "prompt_cache_min_tokens": 512 + }, + "claude-opus-5": { + "cache_creation_input_token_cost": 6.25e-06, + "cache_creation_input_token_cost_above_1hr": 1e-05, + "cache_read_input_token_cost": 5e-07, + "input_cost_per_token": 5e-06, + "litellm_provider": "anthropic", + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2.5e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_adaptive_thinking": true, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_native_structured_output": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_max_reasoning_effort": true, + "provider_specific_entry": { + "us": 1.1, + "fast": 2.0 + }, + "supports_output_config": true, + "supports_speed": true, + "prompt_cache_min_tokens": 512 }, "claude-opus-4-8": { "cache_creation_input_token_cost": 6.25e-06, @@ -11221,6 +12156,7 @@ "supports_prompt_caching": true, "supports_reasoning": true, "supports_response_schema": true, + "supports_native_structured_output": true, "supports_sampling_params": false, "supports_tool_choice": true, "supports_vision": true, @@ -11231,7 +12167,8 @@ "fast": 2.0 }, "supports_output_config": true, - "supports_speed": true + "supports_speed": true, + "prompt_cache_min_tokens": 1024 }, "claude-sonnet-4-20250514": { "deprecation_date": "2026-05-14", @@ -11262,7 +12199,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "cloudflare/@cf/meta/llama-2-7b-chat-fp16": { "input_cost_per_token": 1.923e-06, @@ -12629,6 +13567,56 @@ } ] }, + "dashscope/qwen3.7-max": { + "cache_read_input_token_cost": 5e-07, + "input_cost_per_token": 2.5e-06, + "litellm_provider": "dashscope", + "max_input_tokens": 991808, + "max_output_tokens": 65536, + "max_tokens": 65536, + "mode": "chat", + "output_cost_per_token": 7.5e-06, + "source": "https://www.alibabacloud.com/help/en/model-studio/models", + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true + }, + "dashscope/qwen3.7-plus": { + "litellm_provider": "dashscope", + "max_input_tokens": 991808, + "max_output_tokens": 65536, + "max_tokens": 65536, + "mode": "chat", + "source": "https://www.alibabacloud.com/help/en/model-studio/models", + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true, + "tiered_pricing": [ + { + "cache_read_input_token_cost": 8e-08, + "input_cost_per_token": 4e-07, + "output_cost_per_token": 1.6e-06, + "range": [ + 0, + 256000.0 + ] + }, + { + "cache_read_input_token_cost": 2.4e-07, + "input_cost_per_token": 1.2e-06, + "output_cost_per_token": 4.8e-06, + "range": [ + 256000.0, + 1000000.0 + ] + } + ] + }, "dashscope/qwq-plus": { "input_cost_per_token": 8e-07, "litellm_provider": "dashscope", @@ -14935,7 +15923,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "cache_read_input_token_cost": 2.5e-08, - "cache_creation_input_token_cost": 3.125e-07 + "cache_creation_input_token_cost": 3.125e-07, + "prompt_cache_min_tokens": 2048 }, "eu.anthropic.claude-haiku-4-5-20251001-v1:0": { "cache_creation_input_token_cost": 1.375e-06, @@ -14960,7 +15949,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "eu.anthropic.claude-3-5-sonnet-20240620-v1:0": { "input_cost_per_token": 3e-06, @@ -15087,7 +16077,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "eu.anthropic.claude-opus-4-20250514-v1:0": { "cache_creation_input_token_cost": 1.875e-05, @@ -15112,7 +16103,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "eu.anthropic.claude-sonnet-4-20250514-v1:0": { "cache_creation_input_token_cost": 3.75e-06, @@ -15142,7 +16134,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_vision": true, - "bedrock_converse_supports_strict_tools": false + "bedrock_converse_supports_strict_tools": false, + "prompt_cache_min_tokens": 1024 }, "eu.anthropic.claude-sonnet-4-5-20250929-v1:0": { "cache_creation_input_token_cost": 4.125e-06, @@ -15175,7 +16168,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "eu.meta.llama3-2-1b-instruct-v1:0": { "input_cost_per_token": 1.3e-07, @@ -15617,7 +16611,7 @@ "supports_vision": false }, "fireworks_ai/accounts/fireworks/models/glm-5p2": { - "cache_read_input_token_cost": 2.6e-07, + "cache_read_input_token_cost": 1.4e-07, "input_cost_per_token": 1.4e-06, "litellm_provider": "fireworks_ai", "max_input_tokens": 1048576, @@ -16031,7 +17025,7 @@ "supports_vision": false }, "fireworks_ai/glm-5p2": { - "cache_read_input_token_cost": 2.6e-07, + "cache_read_input_token_cost": 1.4e-07, "input_cost_per_token": 1.4e-06, "litellm_provider": "fireworks_ai", "max_input_tokens": 1048576, @@ -16908,6 +17902,61 @@ }, "web_search_billing_unit": "per_query" }, + "gemini-3.5-flash-lite": { + "cache_read_input_token_cost": 3e-08, + "cache_read_input_token_cost_flex": 2e-08, + "cache_read_input_token_cost_priority": 5e-08, + "input_cost_per_token": 3e-07, + "input_cost_per_token_batches": 1.5e-07, + "input_cost_per_token_flex": 1.5e-07, + "input_cost_per_token_priority": 5.4e-07, + "litellm_provider": "vertex_ai-language-models", + "max_input_tokens": 1048576, + "max_output_tokens": 65536, + "max_tokens": 65536, + "mode": "chat", + "output_cost_per_reasoning_token": 2.5e-06, + "output_cost_per_token": 2.5e-06, + "output_cost_per_token_batches": 1.25e-06, + "output_cost_per_token_flex": 1.25e-06, + "output_cost_per_token_priority": 4.5e-06, + "source": "https://ai.google.dev/gemini-api/docs/pricing", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_input": true, + "supports_audio_output": false, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, "deep-research-pro-preview-12-2025": { "input_cost_per_image": 0.0011, "input_cost_per_token": 2e-06, @@ -17575,6 +18624,60 @@ }, "web_search_billing_unit": "per_query" }, + "vertex_ai/gemini-3.6-flash": { + "cache_read_input_token_cost": 1.5e-07, + "cache_read_input_token_cost_flex": 7.5e-08, + "input_cost_per_token": 1.5e-06, + "input_cost_per_token_batches": 7.5e-07, + "input_cost_per_token_flex": 7.5e-07, + "litellm_provider": "vertex_ai", + "max_input_tokens": 1048576, + "max_output_tokens": 65536, + "max_tokens": 65536, + "mode": "chat", + "output_cost_per_reasoning_token": 7.5e-06, + "output_cost_per_token": 7.5e-06, + "output_cost_per_token_batches": 3.75e-06, + "output_cost_per_token_flex": 3.75e-06, + "source": "https://cloud.google.com/vertex-ai/generative-ai/pricing", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_input": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "input_cost_per_token_priority": 2.7e-06, + "output_cost_per_token_priority": 1.35e-05, + "cache_read_input_token_cost_priority": 2.7e-07, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, "vertex_ai/gemini-3.1-pro-preview": { "cache_read_input_token_cost": 2e-07, "cache_read_input_token_cost_above_200k_tokens": 4e-07, @@ -18180,6 +19283,49 @@ }, "supports_image_size": false }, + "gemini/gemini-3-pro-image": { + "input_cost_per_image": 0.0011, + "input_cost_per_token": 2e-06, + "input_cost_per_token_batches": 1e-06, + "litellm_provider": "gemini", + "max_input_tokens": 65536, + "max_output_tokens": 32768, + "max_tokens": 32768, + "mode": "image_generation", + "output_cost_per_image": 0.134, + "output_cost_per_image_token": 0.00012, + "output_cost_per_token": 1.2e-05, + "rpm": 1000, + "tpm": 4000000, + "output_cost_per_token_batches": 6e-06, + "source": "https://ai.google.dev/gemini-api/docs/pricing#gemini-3-pro-image", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text", + "image" + ], + "supports_function_calling": false, + "supports_prompt_caching": true, + "supports_reasoning": false, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_vision": true, + "supports_web_search": true, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, "gemini/gemini-3-pro-image-preview": { "input_cost_per_image": 0.0011, "input_cost_per_token": 2e-06, @@ -18211,6 +19357,49 @@ ], "supports_function_calling": false, "supports_prompt_caching": true, + "supports_reasoning": false, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_vision": true, + "supports_web_search": true, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, + "gemini/gemini-3.1-flash-image": { + "input_cost_per_token": 2.5e-07, + "input_cost_per_token_batches": 1.25e-07, + "litellm_provider": "gemini", + "max_input_tokens": 65536, + "max_output_tokens": 32768, + "max_tokens": 32768, + "mode": "image_generation", + "output_cost_per_image": 0.045, + "output_cost_per_image_token": 6e-05, + "output_cost_per_token": 1.5e-06, + "output_cost_per_token_batches": 7.5e-07, + "rpm": 1000, + "tpm": 4000000, + "source": "https://ai.google.dev/gemini-api/docs/pricing#gemini-3.1-flash-image", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text", + "image" + ], + "supports_function_calling": false, + "supports_prompt_caching": true, + "supports_reasoning": false, "supports_response_schema": true, "supports_system_messages": true, "supports_vision": true, @@ -18252,6 +19441,7 @@ ], "supports_function_calling": false, "supports_prompt_caching": true, + "supports_reasoning": false, "supports_response_schema": true, "supports_system_messages": true, "supports_vision": true, @@ -18840,6 +20030,63 @@ }, "web_search_billing_unit": "per_query" }, + "gemini/gemini-3.5-flash-lite": { + "cache_read_input_token_cost": 3e-08, + "cache_read_input_token_cost_flex": 2e-08, + "cache_read_input_token_cost_priority": 5e-08, + "input_cost_per_token": 3e-07, + "input_cost_per_token_batches": 1.5e-07, + "input_cost_per_token_flex": 1.5e-07, + "input_cost_per_token_priority": 5.4e-07, + "litellm_provider": "gemini", + "max_input_tokens": 1048576, + "max_output_tokens": 65536, + "max_tokens": 65536, + "mode": "chat", + "output_cost_per_reasoning_token": 2.5e-06, + "output_cost_per_token": 2.5e-06, + "output_cost_per_token_batches": 1.25e-06, + "output_cost_per_token_flex": 1.25e-06, + "output_cost_per_token_priority": 4.5e-06, + "rpm": 15, + "source": "https://ai.google.dev/gemini-api/docs/pricing", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_input": true, + "supports_audio_output": false, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "tpm": 250000, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, "gemini/gemini-3-flash-preview": { "cache_read_input_token_cost": 5e-08, "input_cost_per_audio_token": 1e-06, @@ -18946,6 +20193,96 @@ }, "web_search_billing_unit": "per_query" }, + "gemini/gemini-3.6-flash": { + "cache_read_input_token_cost": 1.5e-07, + "cache_read_input_token_cost_flex": 7.5e-08, + "input_cost_per_token": 1.5e-06, + "input_cost_per_token_batches": 7.5e-07, + "input_cost_per_token_flex": 7.5e-07, + "litellm_provider": "gemini", + "max_input_tokens": 1048576, + "max_output_tokens": 65536, + "max_tokens": 65536, + "mode": "chat", + "output_cost_per_reasoning_token": 7.5e-06, + "output_cost_per_token": 7.5e-06, + "output_cost_per_token_batches": 3.75e-06, + "output_cost_per_token_flex": 3.75e-06, + "rpm": 2000, + "source": "https://ai.google.dev/pricing/gemini-3", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_output": false, + "supports_audio_input": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "tpm": 800000, + "input_cost_per_token_priority": 2.7e-06, + "output_cost_per_token_priority": 1.35e-05, + "cache_read_input_token_cost_priority": 2.7e-07, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, + "gemini/gemini-omni-flash-preview": { + "input_cost_per_audio_token": 1.5e-06, + "input_cost_per_token": 1.5e-06, + "litellm_provider": "gemini", + "max_input_tokens": 1048576, + "max_output_tokens": 65535, + "max_tokens": 65535, + "mode": "chat", + "output_cost_per_reasoning_token": 9e-06, + "output_cost_per_token": 9e-06, + "output_cost_per_video_token": 1.75e-05, + "rpm": 2000, + "source": "https://ai.google.dev/gemini-api/docs/pricing", + "supported_endpoints": [ + "/v1/chat/completions" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text", + "video" + ], + "supports_audio_input": true, + "supports_reasoning": true, + "supports_system_messages": true, + "supports_video_input": true, + "supports_vision": true, + "tpm": 800000 + }, "gemini/gemini-3.1-pro-preview": { "cache_read_input_token_cost": 2e-07, "cache_read_input_token_cost_above_200k_tokens": 4e-07, @@ -19110,6 +20447,37 @@ }, "web_search_billing_unit": "per_query" }, + "gemini-omni-flash-preview": { + "input_cost_per_audio_token": 1.5e-06, + "input_cost_per_token": 1.5e-06, + "litellm_provider": "vertex_ai-language-models", + "max_input_tokens": 1048576, + "max_output_tokens": 65535, + "max_tokens": 65535, + "mode": "chat", + "output_cost_per_reasoning_token": 9e-06, + "output_cost_per_token": 9e-06, + "output_cost_per_video_token": 1.75e-05, + "source": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/omni-flash-preview", + "supported_endpoints": [ + "/v1/chat/completions" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text", + "video" + ], + "supports_audio_input": true, + "supports_reasoning": true, + "supports_system_messages": true, + "supports_video_input": true, + "supports_vision": true + }, "gemini-3.5-flash": { "cache_read_input_token_cost": 1.5e-07, "input_cost_per_audio_token": 1e-06, @@ -19162,6 +20530,61 @@ }, "web_search_billing_unit": "per_query" }, + "gemini-3.6-flash": { + "cache_read_input_token_cost": 1.5e-07, + "cache_read_input_token_cost_flex": 7.5e-08, + "input_cost_per_token": 1.5e-06, + "input_cost_per_token_batches": 7.5e-07, + "input_cost_per_token_flex": 7.5e-07, + "litellm_provider": "vertex_ai-language-models", + "max_input_tokens": 1048576, + "max_output_tokens": 65536, + "max_tokens": 65536, + "mode": "chat", + "output_cost_per_reasoning_token": 7.5e-06, + "output_cost_per_token": 7.5e-06, + "output_cost_per_token_batches": 3.75e-06, + "output_cost_per_token_flex": 3.75e-06, + "source": "https://ai.google.dev/pricing/gemini-3", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_output": false, + "supports_audio_input": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "input_cost_per_token_priority": 2.7e-06, + "output_cost_per_token_priority": 1.35e-05, + "cache_read_input_token_cost_priority": 2.7e-07, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, "gemini/gemini-2.5-pro-preview-tts": { "cache_read_input_token_cost": 1.25e-07, "cache_read_input_token_cost_above_200k_tokens": 2.5e-07, @@ -20375,7 +21798,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "global.anthropic.claude-sonnet-4-20250514-v1:0": { "cache_creation_input_token_cost": 3.75e-06, @@ -20405,7 +21829,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_vision": true, - "bedrock_converse_supports_strict_tools": false + "bedrock_converse_supports_strict_tools": false, + "prompt_cache_min_tokens": 1024 }, "global.anthropic.claude-haiku-4-5-20251001-v1:0": { "cache_creation_input_token_cost": 1.25e-06, @@ -20429,7 +21854,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "global.amazon.nova-2-lite-v1:0": { "cache_read_input_token_cost": 7.5e-08, @@ -21285,7 +22711,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 2e-05, "output_cost_per_token": 2.4e-06, "supports_audio_input": true, @@ -21304,7 +22730,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 2e-05, "output_cost_per_token": 2.4e-06, "supports_audio_input": true, @@ -21398,7 +22824,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 8e-05, "output_cost_per_token": 2e-05, "supports_audio_input": true, @@ -21416,7 +22842,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 8e-05, "output_cost_per_token": 2e-05, "supports_audio_input": true, @@ -21434,7 +22860,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 8e-05, "output_cost_per_token": 2e-05, "supports_audio_input": true, @@ -22273,6 +23699,218 @@ "supports_xhigh_reasoning_effort": true, "supports_minimal_reasoning_effort": true }, + "gpt-5.6": { + "cache_creation_input_token_cost": 6.25e-06, + "cache_creation_input_token_cost_above_272k_tokens": 1.25e-05, + "cache_creation_input_token_cost_flex": 3.125e-06, + "cache_creation_input_token_cost_priority": 1.25e-05, + "cache_read_input_token_cost": 5e-07, + "cache_read_input_token_cost_above_272k_tokens": 1e-06, + "cache_read_input_token_cost_flex": 2.5e-07, + "cache_read_input_token_cost_priority": 1e-06, + "input_cost_per_token": 5e-06, + "input_cost_per_token_above_272k_tokens": 1e-05, + "input_cost_per_token_batches": 2.5e-06, + "input_cost_per_token_flex": 2.5e-06, + "input_cost_per_token_priority": 1e-05, + "litellm_provider": "openai", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 3e-05, + "output_cost_per_token_above_272k_tokens": 4.5e-05, + "output_cost_per_token_batches": 1.5e-05, + "output_cost_per_token_flex": 1.5e-05, + "output_cost_per_token_priority": 6e-05, + "regional_processing_uplift_multiplier_eu": 1.1, + "regional_processing_uplift_multiplier_us": 1.1, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_minimal_reasoning_effort": false, + "supports_native_streaming": true, + "supports_none_reasoning_effort": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_xhigh_reasoning_effort": true + }, + "gpt-5.6-sol": { + "cache_creation_input_token_cost": 6.25e-06, + "cache_creation_input_token_cost_above_272k_tokens": 1.25e-05, + "cache_creation_input_token_cost_flex": 3.125e-06, + "cache_creation_input_token_cost_priority": 1.25e-05, + "cache_read_input_token_cost": 5e-07, + "cache_read_input_token_cost_above_272k_tokens": 1e-06, + "cache_read_input_token_cost_flex": 2.5e-07, + "cache_read_input_token_cost_priority": 1e-06, + "input_cost_per_token": 5e-06, + "input_cost_per_token_above_272k_tokens": 1e-05, + "input_cost_per_token_batches": 2.5e-06, + "input_cost_per_token_flex": 2.5e-06, + "input_cost_per_token_priority": 1e-05, + "litellm_provider": "openai", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 3e-05, + "output_cost_per_token_above_272k_tokens": 4.5e-05, + "output_cost_per_token_batches": 1.5e-05, + "output_cost_per_token_flex": 1.5e-05, + "output_cost_per_token_priority": 6e-05, + "regional_processing_uplift_multiplier_eu": 1.1, + "regional_processing_uplift_multiplier_us": 1.1, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_minimal_reasoning_effort": false, + "supports_native_streaming": true, + "supports_none_reasoning_effort": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_xhigh_reasoning_effort": true + }, + "gpt-5.6-terra": { + "cache_creation_input_token_cost": 3.125e-06, + "cache_creation_input_token_cost_above_272k_tokens": 6.25e-06, + "cache_creation_input_token_cost_flex": 1.5625e-06, + "cache_creation_input_token_cost_priority": 6.25e-06, + "cache_read_input_token_cost": 2.5e-07, + "cache_read_input_token_cost_above_272k_tokens": 5e-07, + "cache_read_input_token_cost_flex": 1.25e-07, + "cache_read_input_token_cost_priority": 5e-07, + "input_cost_per_token": 2.5e-06, + "input_cost_per_token_above_272k_tokens": 5e-06, + "input_cost_per_token_batches": 1.25e-06, + "input_cost_per_token_flex": 1.25e-06, + "input_cost_per_token_priority": 5e-06, + "litellm_provider": "openai", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 1.5e-05, + "output_cost_per_token_above_272k_tokens": 2.25e-05, + "output_cost_per_token_batches": 7.5e-06, + "output_cost_per_token_flex": 7.5e-06, + "output_cost_per_token_priority": 3e-05, + "regional_processing_uplift_multiplier_eu": 1.1, + "regional_processing_uplift_multiplier_us": 1.1, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_minimal_reasoning_effort": false, + "supports_native_streaming": true, + "supports_none_reasoning_effort": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_xhigh_reasoning_effort": true + }, + "gpt-5.6-luna": { + "cache_creation_input_token_cost": 1.25e-06, + "cache_creation_input_token_cost_above_272k_tokens": 2.5e-06, + "cache_creation_input_token_cost_flex": 6.25e-07, + "cache_creation_input_token_cost_priority": 2.5e-06, + "cache_read_input_token_cost": 1e-07, + "cache_read_input_token_cost_above_272k_tokens": 2e-07, + "cache_read_input_token_cost_flex": 5e-08, + "cache_read_input_token_cost_priority": 2e-07, + "input_cost_per_token": 1e-06, + "input_cost_per_token_above_272k_tokens": 2e-06, + "input_cost_per_token_batches": 5e-07, + "input_cost_per_token_flex": 5e-07, + "input_cost_per_token_priority": 2e-06, + "litellm_provider": "openai", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 6e-06, + "output_cost_per_token_above_272k_tokens": 9e-06, + "output_cost_per_token_batches": 3e-06, + "output_cost_per_token_flex": 3e-06, + "output_cost_per_token_priority": 1.2e-05, + "regional_processing_uplift_multiplier_eu": 1.1, + "regional_processing_uplift_multiplier_us": 1.1, + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_minimal_reasoning_effort": false, + "supports_native_streaming": true, + "supports_none_reasoning_effort": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_xhigh_reasoning_effort": true + }, "gpt-5.5": { "cache_read_input_token_cost": 5e-07, "cache_read_input_token_cost_above_272k_tokens": 1e-06, @@ -23417,7 +25055,7 @@ "max_input_tokens": 32000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 6.4e-05, "output_cost_per_token": 1.6e-05, "supported_endpoints": [ @@ -23449,7 +25087,7 @@ "max_input_tokens": 32000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 6.4e-05, "output_cost_per_token": 1.6e-05, "supported_endpoints": [ @@ -23481,7 +25119,7 @@ "max_input_tokens": 32000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 6.4e-05, "output_cost_per_token": 1.6e-05, "supported_endpoints": [ @@ -23514,7 +25152,7 @@ "max_input_tokens": 128000, "max_output_tokens": 32000, "max_tokens": 32000, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 6.4e-05, "output_cost_per_token": 2.4e-05, "regional_processing_uplift_multiplier_eu": 1.1, @@ -23549,7 +25187,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 2e-05, "output_cost_per_token": 2.4e-06, "regional_processing_uplift_multiplier_eu": 1.1, @@ -23582,7 +25220,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 2e-05, "output_cost_per_token": 2.4e-06, "supported_endpoints": [ @@ -23614,7 +25252,7 @@ "max_input_tokens": 32000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 6.4e-05, "output_cost_per_token": 1.6e-05, "supported_endpoints": [ @@ -24569,7 +26207,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "jp.anthropic.claude-haiku-4-5-20251001-v1:0": { "cache_creation_input_token_cost": 1.375e-06, @@ -24593,7 +26232,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "crusoe/deepseek-ai/DeepSeek-R1-0528": { "input_cost_per_token": 3e-06, @@ -25289,6 +26929,42 @@ "supports_function_calling": true, "supports_tool_choice": false }, + "meta/muse-spark-1.1": { + "cache_read_input_token_cost": 1.5e-07, + "input_cost_per_token": 1.25e-06, + "litellm_provider": "meta", + "max_input_tokens": 1048576, + "max_output_tokens": 131072, + "max_tokens": 131072, + "mode": "chat", + "output_cost_per_token": 4.25e-06, + "source": "https://dev.meta.ai/docs/getting-started/pricing-rate-limits", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/responses", + "/v1/messages" + ], + "supported_modalities": [ + "text", + "image", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_minimal_reasoning_effort": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true, + "supports_xhigh_reasoning_effort": true + }, "meta_llama/Llama-3.3-70B-Instruct": { "litellm_provider": "meta_llama", "max_input_tokens": 128000, @@ -33185,7 +34861,8 @@ "supports_pdf_input": true, "supports_prompt_caching": true, "supports_response_schema": true, - "supports_tool_choice": true + "supports_tool_choice": true, + "prompt_cache_min_tokens": 2048 }, "us.anthropic.claude-haiku-4-5-20251001-v1:0": { "cache_creation_input_token_cost": 1.375e-06, @@ -33209,7 +34886,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "us.anthropic.claude-3-5-sonnet-20240620-v1:0": { "input_cost_per_token": 3e-06, @@ -33336,7 +35014,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "us.anthropic.claude-sonnet-4-5-20250929-v1:0": { "cache_creation_input_token_cost": 4.125e-06, @@ -33369,7 +35048,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "us-gov.anthropic.claude-sonnet-4-5-20250929-v1:0": { "cache_creation_input_token_cost": 4.5e-06, @@ -33397,7 +35077,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 1024 }, "au.anthropic.claude-haiku-4-5-20251001-v1:0": { "cache_creation_input_token_cost": 1.375e-06, @@ -33420,7 +35101,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_structured_output": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "us.anthropic.claude-opus-4-20250514-v1:0": { "cache_creation_input_token_cost": 1.875e-05, @@ -33445,7 +35127,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "us.anthropic.claude-opus-4-5-20251101-v1:0": { "cache_creation_input_token_cost": 6.875e-06, @@ -33475,7 +35158,8 @@ "supports_native_structured_output": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "high", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "global.anthropic.claude-opus-4-5-20251101-v1:0": { "cache_creation_input_token_cost": 6.25e-06, @@ -33505,7 +35189,8 @@ "supports_native_structured_output": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "high", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "eu.anthropic.claude-opus-4-5-20251101-v1:0": { "cache_creation_input_token_cost": 6.25e-06, @@ -33534,7 +35219,8 @@ "supports_native_structured_output": true, "supports_output_config": true, "bedrock_output_config_effort_ceiling": "high", - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "us.anthropic.claude-sonnet-4-20250514-v1:0": { "cache_creation_input_token_cost": 3.75e-06, @@ -33564,7 +35250,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_vision": true, - "bedrock_converse_supports_strict_tools": false + "bedrock_converse_supports_strict_tools": false, + "prompt_cache_min_tokens": 1024 }, "us.deepseek.r1-v1:0": { "input_cost_per_token": 1.35e-06, @@ -35086,7 +36773,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_native_streaming": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 4096 }, "vertex_ai/claude-haiku-4-5@20251001": { "cache_creation_input_token_cost": 1.25e-06, @@ -35108,7 +36796,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_native_streaming": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 4096 }, "vertex_ai/claude-3-5-sonnet": { "input_cost_per_token": 3e-06, @@ -35263,7 +36952,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/claude-opus-4-1": { "cache_creation_input_token_cost": 1.875e-05, @@ -35326,7 +37016,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_vision": true, - "supports_output_config": true + "supports_output_config": true, + "prompt_cache_min_tokens": 4096 }, "vertex_ai/claude-opus-4-5@20251101": { "cache_creation_input_token_cost": 6.25e-06, @@ -35354,7 +37045,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_native_streaming": true, - "supports_output_config": true + "supports_output_config": true, + "prompt_cache_min_tokens": 4096 }, "vertex_ai/claude-opus-4-6": { "supports_adaptive_thinking": true, @@ -35383,7 +37075,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_output_config": true, - "supports_max_reasoning_effort": true + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 4096 }, "vertex_ai/claude-opus-4-6@default": { "supports_adaptive_thinking": true, @@ -35412,7 +37105,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_output_config": true, - "supports_max_reasoning_effort": true + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 4096 }, "vertex_ai/claude-opus-4-7": { "supports_adaptive_thinking": true, @@ -35442,7 +37136,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_xhigh_reasoning_effort": true, - "supports_max_reasoning_effort": true + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 2048 }, "vertex_ai/claude-opus-4-7@default": { "supports_adaptive_thinking": true, @@ -35472,9 +37167,11 @@ "supports_tool_choice": true, "supports_vision": true, "supports_xhigh_reasoning_effort": true, - "supports_max_reasoning_effort": true + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 2048 }, "vertex_ai/claude-fable-5": { + "supports_mid_conversation_system": true, "cache_creation_input_token_cost": 1.25e-05, "cache_creation_input_token_cost_above_1hr": 2e-05, "cache_read_input_token_cost": 1e-06, @@ -35505,6 +37202,7 @@ "supports_max_reasoning_effort": true }, "vertex_ai/claude-fable-5@default": { + "supports_mid_conversation_system": true, "cache_creation_input_token_cost": 1.25e-05, "cache_creation_input_token_cost_above_1hr": 2e-05, "cache_read_input_token_cost": 1e-06, @@ -35534,7 +37232,8 @@ "supports_xhigh_reasoning_effort": true, "supports_max_reasoning_effort": true }, - "vertex_ai/claude-opus-4-8": { + "vertex_ai/claude-opus-5": { + "supports_mid_conversation_system": true, "supports_adaptive_thinking": true, "cache_creation_input_token_cost": 6.25e-06, "cache_creation_input_token_cost_above_1hr": 1e-05, @@ -35562,9 +37261,75 @@ "supports_tool_choice": true, "supports_vision": true, "supports_xhigh_reasoning_effort": true, - "supports_max_reasoning_effort": true + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 512 + }, + "vertex_ai/claude-opus-5@default": { + "supports_mid_conversation_system": true, + "supports_adaptive_thinking": true, + "cache_creation_input_token_cost": 6.25e-06, + "cache_creation_input_token_cost_above_1hr": 1e-05, + "cache_read_input_token_cost": 5e-07, + "input_cost_per_token": 5e-06, + "litellm_provider": "vertex_ai-anthropic_models", + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2.5e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 512 + }, + "vertex_ai/claude-opus-4-8": { + "supports_mid_conversation_system": true, + "supports_adaptive_thinking": true, + "cache_creation_input_token_cost": 6.25e-06, + "cache_creation_input_token_cost_above_1hr": 1e-05, + "cache_read_input_token_cost": 5e-07, + "input_cost_per_token": 5e-06, + "litellm_provider": "vertex_ai-anthropic_models", + "max_input_tokens": 1000000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2.5e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_assistant_prefill": false, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_sampling_params": false, + "supports_tool_choice": true, + "supports_vision": true, + "supports_xhigh_reasoning_effort": true, + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/claude-opus-4-8@default": { + "supports_mid_conversation_system": true, "supports_adaptive_thinking": true, "cache_creation_input_token_cost": 6.25e-06, "cache_creation_input_token_cost_above_1hr": 1e-05, @@ -35592,7 +37357,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_xhigh_reasoning_effort": true, - "supports_max_reasoning_effort": true + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/claude-sonnet-4-5": { "cache_creation_input_token_cost": 3.75e-06, @@ -35619,9 +37385,11 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/claude-sonnet-5": { + "supports_mid_conversation_system": true, "cache_creation_input_token_cost": 2.5e-06, "cache_creation_input_token_cost_above_1hr": 4e-06, "cache_read_input_token_cost": 2e-07, @@ -35649,7 +37417,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_xhigh_reasoning_effort": true, - "supports_max_reasoning_effort": true + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/claude-sonnet-4-6": { "supports_adaptive_thinking": true, @@ -35678,7 +37447,8 @@ "search_context_size_low": 0.01, "search_context_size_medium": 0.01 }, - "supports_output_config": true + "supports_output_config": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/claude-sonnet-4-5@20250929": { "cache_creation_input_token_cost": 3.75e-06, @@ -35706,7 +37476,8 @@ "supports_response_schema": true, "supports_tool_choice": true, "supports_vision": true, - "supports_native_streaming": true + "supports_native_streaming": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/claude-opus-4@20250514": { "cache_creation_input_token_cost": 1.875e-05, @@ -35732,7 +37503,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/claude-sonnet-4": { "cache_creation_input_token_cost": 3.75e-06, @@ -35762,7 +37534,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/claude-sonnet-4@20250514": { "cache_creation_input_token_cost": 3.75e-06, @@ -35792,7 +37565,8 @@ "supports_reasoning": true, "supports_response_schema": true, "supports_tool_choice": true, - "supports_vision": true + "supports_vision": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/mistralai/codestral-2@001": { "input_cost_per_token": 3e-07, @@ -35962,6 +37736,7 @@ "supports_parallel_function_calling": true, "supports_pdf_input": true, "supports_prompt_caching": true, + "supports_reasoning": false, "supports_response_schema": true, "supports_system_messages": true, "supports_tool_choice": true, @@ -35971,6 +37746,22 @@ "tpm": 8000000, "supports_image_size": false }, + "vertex_ai/gemini-3-pro-image": { + "input_cost_per_image": 0.0011, + "input_cost_per_token": 2e-06, + "input_cost_per_token_batches": 1e-06, + "litellm_provider": "vertex_ai-language-models", + "max_input_tokens": 65536, + "max_output_tokens": 32768, + "max_tokens": 32768, + "mode": "image_generation", + "output_cost_per_image": 0.134, + "output_cost_per_image_token": 0.00012, + "output_cost_per_token": 1.2e-05, + "output_cost_per_token_batches": 6e-06, + "supports_reasoning": false, + "source": "https://docs.cloud.google.com/vertex-ai/generative-ai/docs/models/gemini/3-pro-image" + }, "vertex_ai/gemini-3-pro-image-preview": { "input_cost_per_image": 0.0011, "input_cost_per_token": 2e-06, @@ -35984,8 +37775,23 @@ "output_cost_per_image_token": 0.00012, "output_cost_per_token": 1.2e-05, "output_cost_per_token_batches": 6e-06, + "supports_reasoning": false, "source": "https://docs.cloud.google.com/vertex-ai/generative-ai/docs/models/gemini/3-pro-image" }, + "vertex_ai/gemini-3.1-flash-image": { + "input_cost_per_image": 0.00056, + "input_cost_per_token": 5e-07, + "litellm_provider": "vertex_ai-language-models", + "max_input_tokens": 65536, + "max_output_tokens": 32768, + "max_tokens": 32768, + "mode": "image_generation", + "output_cost_per_image": 0.0672, + "output_cost_per_image_token": 6e-05, + "output_cost_per_token": 3e-06, + "supports_reasoning": false, + "source": "https://cloud.google.com/vertex-ai/generative-ai/pricing#gemini-models" + }, "vertex_ai/gemini-3.1-flash-image-preview": { "input_cost_per_image": 0.00056, "input_cost_per_token": 5e-07, @@ -35997,6 +37803,7 @@ "output_cost_per_image": 0.0672, "output_cost_per_image_token": 6e-05, "output_cost_per_token": 3e-06, + "supports_reasoning": false, "source": "https://cloud.google.com/vertex-ai/generative-ai/pricing#gemini-models" }, "vertex_ai/gemini-3.1-flash-lite-preview": { @@ -36103,6 +37910,61 @@ }, "web_search_billing_unit": "per_query" }, + "vertex_ai/gemini-3.5-flash-lite": { + "cache_read_input_token_cost": 3e-08, + "cache_read_input_token_cost_flex": 2e-08, + "cache_read_input_token_cost_priority": 5e-08, + "input_cost_per_token": 3e-07, + "input_cost_per_token_batches": 1.5e-07, + "input_cost_per_token_flex": 1.5e-07, + "input_cost_per_token_priority": 5.4e-07, + "litellm_provider": "vertex_ai-language-models", + "max_input_tokens": 1048576, + "max_output_tokens": 65536, + "max_tokens": 65536, + "mode": "chat", + "output_cost_per_reasoning_token": 2.5e-06, + "output_cost_per_token": 2.5e-06, + "output_cost_per_token_batches": 1.25e-06, + "output_cost_per_token_flex": 1.25e-06, + "output_cost_per_token_priority": 4.5e-06, + "source": "https://cloud.google.com/vertex-ai/generative-ai/pricing#gemini-models", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_input": true, + "supports_audio_output": false, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, "vertex_ai/deep-research-pro-preview-12-2025": { "input_cost_per_image": 0.0011, "input_cost_per_token": 2e-06, @@ -42452,7 +44314,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 2e-05, "output_cost_per_token": 2.4e-06, "supported_endpoints": [ @@ -42485,7 +44347,7 @@ "max_input_tokens": 128000, "max_output_tokens": 4096, "max_tokens": 4096, - "mode": "chat", + "mode": "realtime", "output_cost_per_audio_token": 2e-05, "output_cost_per_token": 2.4e-06, "supported_endpoints": [ @@ -43116,6 +44978,7 @@ } }, "vertex_ai/claude-sonnet-5@default": { + "supports_mid_conversation_system": true, "cache_creation_input_token_cost": 2.5e-06, "cache_creation_input_token_cost_above_1hr": 4e-06, "cache_read_input_token_cost": 2e-07, @@ -43143,7 +45006,8 @@ "supports_tool_choice": true, "supports_vision": true, "supports_xhigh_reasoning_effort": true, - "supports_max_reasoning_effort": true + "supports_max_reasoning_effort": true, + "prompt_cache_min_tokens": 1024 }, "vertex_ai/claude-sonnet-4-6@default": { "supports_adaptive_thinking": true, @@ -43172,7 +45036,8 @@ "search_context_size_low": 0.01, "search_context_size_medium": 0.01 }, - "supports_output_config": true + "supports_output_config": true, + "prompt_cache_min_tokens": 1024 }, "duckduckgo/search": { "litellm_provider": "duckduckgo", @@ -43250,6 +45115,90 @@ "supports_response_schema": true, "supports_tool_choice": true }, + "bedrock_mantle/openai.gpt-5.6-sol": { + "input_cost_per_token": 5.5e-06, + "cache_creation_input_token_cost": 6.875e-06, + "cache_read_input_token_cost": 5.5e-07, + "output_cost_per_token": 3.3e-05, + "litellm_provider": "bedrock_mantle", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "use_openai_responses_path": true, + "supported_endpoints": [ + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true + }, + "bedrock_mantle/openai.gpt-5.6-terra": { + "input_cost_per_token": 2.75e-06, + "cache_creation_input_token_cost": 3.4375e-06, + "cache_read_input_token_cost": 2.75e-07, + "output_cost_per_token": 1.65e-05, + "litellm_provider": "bedrock_mantle", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "use_openai_responses_path": true, + "supported_endpoints": [ + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true + }, + "bedrock_mantle/openai.gpt-5.6-luna": { + "input_cost_per_token": 1.1e-06, + "cache_creation_input_token_cost": 1.375e-06, + "cache_read_input_token_cost": 1.1e-07, + "output_cost_per_token": 6.6e-06, + "litellm_provider": "bedrock_mantle", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "use_openai_responses_path": true, + "supported_endpoints": [ + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true + }, "bedrock_mantle/openai.gpt-5.5": { "input_cost_per_token": 5.5e-06, "cache_read_input_token_cost": 5.5e-07, @@ -43362,6 +45311,7 @@ "supports_vision": true }, "bedrock_mantle/xai.grok-4.3": { + "use_openai_responses_path": true, "input_cost_per_token": 1.25e-06, "output_cost_per_token": 2.5e-06, "cache_read_input_token_cost": 2e-07, @@ -43583,7 +45533,8 @@ "supports_vision": true, "supports_native_structured_output": true, "supports_pdf_input": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "bedrock/us-gov-west-1/anthropic.claude-haiku-4-5-20251001-v1:0": { "cache_creation_input_token_cost": 1.5e-06, @@ -43607,7 +45558,8 @@ "supports_vision": true, "supports_native_structured_output": true, "supports_pdf_input": true, - "supports_parallel_tool_use_config": true + "supports_parallel_tool_use_config": true, + "prompt_cache_min_tokens": 4096 }, "snowflake/claude-sonnet-4-5": { "max_tokens": 16384, @@ -43988,6 +45940,7 @@ "supports_native_streaming": true, "supports_parallel_function_calling": true, "supports_prompt_caching": true, + "supports_reasoning": true, "supports_response_schema": true, "supports_system_messages": true, "supports_tool_choice": true, @@ -44013,6 +45966,7 @@ "supports_native_streaming": true, "supports_parallel_function_calling": true, "supports_prompt_caching": true, + "supports_reasoning": true, "supports_response_schema": true, "supports_system_messages": true, "supports_tool_choice": true, @@ -44038,6 +45992,7 @@ "supports_native_streaming": true, "supports_parallel_function_calling": true, "supports_prompt_caching": true, + "supports_reasoning": true, "supports_response_schema": true, "supports_system_messages": true, "supports_tool_choice": true, @@ -44097,6 +46052,7 @@ "supports_native_streaming": true, "supports_parallel_function_calling": true, "supports_prompt_caching": true, + "supports_reasoning": true, "supports_response_schema": true, "supports_system_messages": true, "supports_tool_choice": true, @@ -44235,20 +46191,26 @@ "fallback_generalizations": { "rules": [ { - "name": "anthropic-claude-adaptive-thinking", - "pattern": "(?:opus|sonnet|haiku)[-._](?:4[-._](?:[6-9]|[1-9]\\d)(?!\\d)|(?:[5-9]|[1-9]\\d{1,})[-._]\\d{1,2}(?!\\d))", - "description": "Claude opus/sonnet/haiku at version 4.6 or higher: 4.6 through 4.99, then any 5.x, 6.x or later major. The minor is capped at two digits so an 8-digit date suffix such as claude-opus-4-20250514 is never read as a >= 4.6 minor. Turns on adaptive thinking for new families with no code change.", - "extends": "anthropic-claude", + "name": "bedrock-claude-ids", + "pattern": "^(?:[a-z-]+\\.)?anthropic\\.claude-", + "description": "A Bedrock-syntax Claude id, for every version: anthropic.claude- at the start of the name, optionally behind a single dotted geo segment (us./eu./au./jp./apac./global./us-gov.). Anchored to the start because routing rules see the raw request string and provider inference feeds the proxy's provider/* wildcard access checks: an id under an unrecognized namespace such as bedrockz/anthropic.claude-... must stay unroutable rather than resolve to bedrock and slip through a bedrock/* key. Routes to bedrock before the bare-id Anthropic rule is consulted.", "model_info": { - "supports_adaptive_thinking": true + "litellm_provider": "bedrock" } }, { - "name": "anthropic-claude", - "pattern": "^claude-[a-z]+-\\d+[-.]\\d+(?:-\\d{8})?$", - "description": "Any Claude family-major-minor id, optionally with an 8-digit date suffix, anchored to the whole name. Version-neutral fallback that gives an unmapped Claude provider routing and baseline capabilities; it carries no pricing, so cost stays on the standard unpriced behavior rather than a guessed number.", + "name": "anthropic-claude-ids", + "pattern": "^claude-[a-z]+-\\d+(?:[-.]\\d+)?(?:-\\d{8})?$", + "description": "A bare Claude family-major id with an optional minor and an optional 8-digit date suffix, anchored to the whole name, so claude-newfamily-5 routes like claude-newfamily-5-1 does. Routes an unmapped Claude id that carries no provider namespace to the Anthropic API.", + "model_info": { + "litellm_provider": "anthropic" + } + }, + { + "name": "claude-family-baseline", + "pattern": "claude-[a-z]+-\\d+(?:[-.]\\d+)?(?:-\\d{8})?", + "description": "Any Claude family-major id with an optional minor and an optional 8-digit date suffix, under any provider namespace (bare, bedrock-dotted, vertex, databricks, ...), so bare majors like claude-newfamily-5 get the same baseline as claude-newfamily-5-1. Carries the model-family facts every Claude shares; it carries no pricing, so cost stays on the standard unpriced behavior rather than a guessed number.", "model_info": { - "litellm_provider": "anthropic", "mode": "chat", "max_input_tokens": 200000, "max_output_tokens": 64000, @@ -44264,6 +46226,22 @@ "supports_pdf_input": true, "supports_system_messages": true } + }, + { + "name": "claude-adaptive-thinking", + "pattern": "claude-[a-z]+-(?:4[-._](?:[6-9]|[1-9]\\d)(?!\\d)|(?:[5-9]|[1-9]\\d)(?!\\d)(?:[-._]\\d{1,2}(?!\\d))?)", + "description": "Claude at version 4.6 or higher, in any id shape that contains claude--: minors 4.6 through 4.99, any later major-minor, and bare 5+ majors so a new family shaped like claude-fable-5 matches. Requiring the claude- prefix keeps non-Claude names such as team-sonnet-5-1 out. The minor is capped at two digits so an 8-digit date suffix such as claude-opus-4-20250514 is never read as a >= 4.6 minor. Turns on adaptive thinking for new versions and new families with no code change.", + "model_info": { + "supports_adaptive_thinking": true + } + }, + { + "name": "claude-mid-conversation-system", + "pattern": "claude-[a-z]+-(?:4[-._](?:[89]|[1-9]\\d)(?!\\d)|(?:[5-9]|[1-9]\\d)(?!\\d)(?:[-._]\\d{1,2}(?!\\d))?)", + "description": "Claude at version 4.8 or higher, in any id shape that contains claude--: minors 4.8 through 4.99, any later major-minor, and bare 5+ majors so a new family like claude-fable-5 matches. Anthropic introduced mid-conversation system messages with Opus 4.8 and every newer Claude keeps them; 4.7 and below reject the system role inside messages.", + "model_info": { + "supports_mid_conversation_system": true + } } ] } diff --git a/litellm/models/mcp_server.py b/litellm/models/mcp_server.py index d9757cf80f4..23b26bd8e89 100644 --- a/litellm/models/mcp_server.py +++ b/litellm/models/mcp_server.py @@ -79,6 +79,7 @@ class LiteLLM_MCPServerTable(LiteLLMPydanticObjectBase): command: Optional[str] = None args: List[str] = Field(default_factory=list) env: Dict[str, str] = Field(default_factory=dict) + issuer: Optional[str] = None authorization_url: Optional[str] = None token_url: Optional[str] = None registration_url: Optional[str] = None @@ -96,6 +97,7 @@ class LiteLLM_MCPServerTable(LiteLLMPydanticObjectBase): available_on_public_internet: bool = True delegate_auth_to_upstream: bool = False oauth_passthrough: bool = False + dcr_bridge: Optional[bool] = None is_byok: bool = False byok_description: List[str] = Field(default_factory=list) byok_api_key_help_url: Optional[str] = None diff --git a/litellm/models/verification_token.py b/litellm/models/verification_token.py index d67726be584..519066b8266 100644 --- a/litellm/models/verification_token.py +++ b/litellm/models/verification_token.py @@ -36,6 +36,7 @@ class LiteLLM_VerificationToken(LiteLLMPydanticObjectBase): budget_reset_at: Optional[datetime] = None allowed_cache_controls: Optional[list] = [] allowed_routes: Optional[list] = [] + key_type: str | None = None permissions: Dict = {} model_spend: Dict = {} model_max_budget: Dict = {} diff --git a/litellm/ocr/main.py b/litellm/ocr/main.py index 5716155361d..f53f32eecfa 100644 --- a/litellm/ocr/main.py +++ b/litellm/ocr/main.py @@ -7,9 +7,10 @@ import base64 import mimetypes import os import re +from collections.abc import Callable, Coroutine, Mapping from dataclasses import dataclass from io import IOBase -from typing import Any, Callable, Coroutine, Union, cast +from typing import Any, cast import httpx @@ -17,6 +18,9 @@ import litellm from litellm._logging import verbose_logger from litellm.constants import request_timeout from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj +from litellm.llms.azure_ai.ocr.common_utils import ( + is_azure_document_intelligence_model, +) from litellm.llms.base_llm.ocr.transformation import BaseOCRConfig, OCRResponse from litellm.llms.custom_httpx.llm_http_handler import BaseLLMHTTPHandler from litellm.rust_bridge import ocr as rust_ocr_bridge @@ -39,7 +43,7 @@ class _PreparedOCRRequest: provider_config: BaseOCRConfig optional_params: dict[str, object] litellm_params: dict[str, object] - effective_timeout: Union[float, httpx.Timeout] + effective_timeout: float | httpx.Timeout litellm_logging_obj: LiteLLMLoggingObj @@ -60,13 +64,13 @@ _RUST_OCR_PROVIDERS = { def _prepare_ocr_request( model: str, - document: dict[str, Any], + document: Mapping[str, object], api_key: str | None, api_base: str | None, - timeout: Union[float, httpx.Timeout] | None, + timeout: float | httpx.Timeout | None, custom_llm_provider: str | None, - extra_headers: dict[str, Any] | None, - kwargs: dict[str, Any], + extra_headers: dict[str, object] | None, + kwargs: dict[str, object], ) -> _PreparedOCRRequest: litellm_logging_obj = cast(LiteLLMLoggingObj, kwargs.pop("litellm_logging_obj")) litellm_call_id = cast(str | None, kwargs.get("litellm_call_id", None)) @@ -83,6 +87,8 @@ def _prepare_ocr_request( if doc_type not in ["document_url", "image_url"]: raise ValueError(f"Invalid document type: {doc_type}. Must be 'document_url', 'image_url', or 'file'") + caller_supplied_api_base = api_base is not None + ( model, custom_llm_provider, @@ -95,9 +101,14 @@ def _prepare_ocr_request( api_key=api_key, ) + suppress_dynamic_api_base = ( + not caller_supplied_api_base + and custom_llm_provider == "azure_ai" + and is_azure_document_intelligence_model(model) + ) if dynamic_api_key: api_key = dynamic_api_key - if dynamic_api_base: + if dynamic_api_base and not suppress_dynamic_api_base: api_base = dynamic_api_base ocr_provider_config = ProviderConfigManager.get_provider_ocr_config( @@ -110,7 +121,7 @@ def _prepare_ocr_request( verbose_logger.debug(f"OCR call - model: {model}, provider: {custom_llm_provider}") - litellm_params = GenericLiteLLMParams(**kwargs) + litellm_params = GenericLiteLLMParams.model_validate(kwargs) supported_params = ocr_provider_config.get_supported_ocr_params(model=model) non_default_params = {} @@ -145,7 +156,7 @@ def _prepare_ocr_request( api_key=api_key, api_base=api_base, custom_llm_provider=custom_llm_provider, - extra_headers=cast(dict[str, object] | None, extra_headers), + extra_headers=extra_headers, provider_config=ocr_provider_config, optional_params=cast(dict[str, object], optional_params), litellm_params=dict(litellm_params), @@ -191,8 +202,7 @@ def _rust_bridge_api_base( if prepared_request.api_base is not None: return prepared_request.api_base if prepared_request.custom_llm_provider == "azure_ai": - model = prepared_request.model.lower() - if "doc-intelligence" in model or "documentintelligence" in model: + if is_azure_document_intelligence_model(prepared_request.model): return resolve_secret("AZURE_DOCUMENT_INTELLIGENCE_ENDPOINT") return resolve_secret("AZURE_AI_API_BASE") return None @@ -296,13 +306,13 @@ async def _run_rust_aocr( @client async def aocr( model: str, - document: dict[str, Any], + document: Mapping[str, object], api_key: str | None = None, api_base: str | None = None, - timeout: Union[float, httpx.Timeout] | None = None, + timeout: float | httpx.Timeout | None = None, custom_llm_provider: str | None = None, - extra_headers: dict[str, Any] | None = None, - **kwargs, + extra_headers: dict[str, object] | None = None, + **kwargs: object, ) -> OCRResponse: """ Async OCR function. @@ -558,14 +568,14 @@ def convert_file_document_to_url_document(document: dict[str, Any]) -> dict[str, @client def ocr( model: str, - document: dict[str, Any], + document: Mapping[str, object], api_key: str | None = None, api_base: str | None = None, - timeout: Union[float, httpx.Timeout] | None = None, + timeout: float | httpx.Timeout | None = None, custom_llm_provider: str | None = None, - extra_headers: dict[str, Any] | None = None, - **kwargs, -) -> Union[OCRResponse, Coroutine[Any, Any, OCRResponse]]: + extra_headers: dict[str, object] | None = None, + **kwargs: object, +) -> OCRResponse | Coroutine[object, object, OCRResponse]: """ Synchronous OCR function. diff --git a/litellm/proxy/_experimental/mcp_server/auth/token_exchange.py b/litellm/proxy/_experimental/mcp_server/auth/token_exchange.py deleted file mode 100644 index cd41dd648ee..00000000000 --- a/litellm/proxy/_experimental/mcp_server/auth/token_exchange.py +++ /dev/null @@ -1,192 +0,0 @@ -""" -OAuth 2.0 Token Exchange (RFC 8693) handler for MCP servers. - -Exchanges a user's incoming JWT (subject_token) for a scoped access token -at an IDP's token exchange endpoint. The exchanged token is then used to -authenticate requests to the upstream MCP server. - -See: https://datatracker.ietf.org/doc/html/rfc8693 -""" - -import asyncio -import hashlib -import weakref -from typing import TYPE_CHECKING, Dict, Tuple - -import httpx - -from litellm._logging import verbose_logger -from litellm.caching.in_memory_cache import InMemoryCache -from litellm.constants import ( - MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL, - MCP_OAUTH2_TOKEN_CACHE_MIN_TTL, - MCP_OAUTH2_TOKEN_EXPIRY_BUFFER_SECONDS, - MCP_TOKEN_EXCHANGE_CACHE_MAX_SIZE, -) -from litellm.llms.custom_httpx.http_handler import get_async_httpx_client -from litellm.proxy._experimental.mcp_server.auth.token_endpoint_auth import ( - build_token_endpoint_client_auth, -) -from litellm.types.llms.custom_http import httpxSpecialProvider -from litellm.types.mcp import DEFAULT_SUBJECT_TOKEN_TYPE - -if TYPE_CHECKING: - from litellm.types.mcp_server.mcp_server_manager import MCPServer - -# RFC 8693 grant type constant -TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange" - - -class TokenExchangeHandler: - """Handles OAuth 2.0 Token Exchange (RFC 8693) for MCP servers. - - Caches exchanged tokens keyed by ``hash(subject_token + server_id)`` so - repeated calls with the same user token skip the IDP round-trip. - """ - - def __init__(self) -> None: - self._cache = InMemoryCache( - max_size_in_memory=MCP_TOKEN_EXCHANGE_CACHE_MAX_SIZE, - default_ttl=MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL, - ) - # WeakValueDictionary so locks are GC'd once no coroutine holds a reference, - # preventing unbounded growth with many rotating user tokens. - self._locks: weakref.WeakValueDictionary[str, asyncio.Lock] = weakref.WeakValueDictionary() - - def _get_lock(self, cache_key: str) -> asyncio.Lock: - lock = self._locks.get(cache_key) - if lock is None: - lock = asyncio.Lock() - self._locks[cache_key] = lock - return lock - - @staticmethod - def _cache_key(subject_token: str, server_id: str) -> str: - raw = f"{subject_token}:{server_id}" - return hashlib.sha256(raw.encode()).hexdigest() - - async def exchange_token( - self, - subject_token: str, - server: "MCPServer", - ) -> str: - """Exchange *subject_token* for a scoped access token. - - Returns the exchanged ``access_token`` string (suitable for a - ``Bearer`` header). - - Raises ``ValueError`` on configuration or IDP errors. - """ - cache_key = self._cache_key(subject_token, server.server_id) - - # Fast path - cached = self._cache.get_cache(cache_key) - if cached is not None: - return cached - - # Slow path — one exchange at a time per (user, server) pair - async with self._get_lock(cache_key): - cached = self._cache.get_cache(cache_key) - if cached is not None: - return cached - - token, ttl = await self._do_exchange(subject_token, server) - self._cache.set_cache(cache_key, token, ttl=ttl) - return token - - async def _do_exchange( - self, - subject_token: str, - server: "MCPServer", - ) -> Tuple[str, int]: - """POST to the token exchange endpoint with RFC 8693 parameters. - - Returns ``(access_token, ttl_seconds)``. - """ - endpoint = server.token_exchange_endpoint or server.token_url - if not endpoint: - raise ValueError( - f"MCP server '{server.server_id}' has auth_type=oauth2_token_exchange " - f"but no token_exchange_endpoint or token_url configured" - ) - if not server.client_id or not server.client_secret: - raise ValueError( - f"MCP server '{server.server_id}' has auth_type=oauth2_token_exchange " - f"but missing client_id or client_secret" - ) - - client_auth = build_token_endpoint_client_auth( - auth_method=server.token_endpoint_auth_method, - client_id=server.client_id, - client_secret=server.client_secret, - ) - data: Dict[str, str] = { - "grant_type": TOKEN_EXCHANGE_GRANT_TYPE, - "subject_token": subject_token, - "subject_token_type": server.subject_token_type or DEFAULT_SUBJECT_TOKEN_TYPE, - **client_auth.body, - } - if server.audience: - data["audience"] = server.audience - if server.scopes: - data["scope"] = " ".join(server.scopes) - - verbose_logger.debug( - "Exchanging token for MCP server %s at %s (audience=%s)", - server.server_id, - endpoint, - server.audience, - ) - - client = get_async_httpx_client(llm_provider=httpxSpecialProvider.MCP) - post_kwargs = {"data": data, **({"headers": client_auth.headers} if client_auth.headers else {})} - try: - response = await client.post(endpoint, **post_kwargs) - response.raise_for_status() - except httpx.HTTPStatusError as exc: - verbose_logger.debug( - "Token exchange IDP error for MCP server %s (status %d)", - server.server_id, - exc.response.status_code, - ) - raise ValueError( - f"Token exchange for MCP server '{server.server_id}' failed with status {exc.response.status_code}" - ) from exc - - body = response.json() - if not isinstance(body, dict): - raise ValueError( - f"Token exchange response for MCP server '{server.server_id}' " - f"returned non-object JSON (got {type(body).__name__})" - ) - - access_token = body.get("access_token") - if not access_token: - raise ValueError(f"Token exchange response for MCP server '{server.server_id}' missing 'access_token'") - - raw_expires_in = body.get("expires_in") - try: - expires_in = int(raw_expires_in) if raw_expires_in is not None else MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL - except (TypeError, ValueError): - expires_in = MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL - - ttl = max( - expires_in - MCP_OAUTH2_TOKEN_EXPIRY_BUFFER_SECONDS, - MCP_OAUTH2_TOKEN_CACHE_MIN_TTL, - ) - - verbose_logger.info( - "Token exchange succeeded for MCP server %s (expires in %ds)", - server.server_id, - expires_in, - ) - return access_token, ttl - - def invalidate(self, subject_token: str, server_id: str) -> None: - """Remove a cached exchanged token (e.g. after a 401).""" - cache_key = self._cache_key(subject_token, server_id) - self._cache.delete_cache(cache_key) - - -# Module-level singleton -mcp_token_exchange_handler = TokenExchangeHandler() diff --git a/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py b/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py index e7ffef0e4e3..a27d6b92843 100644 --- a/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py +++ b/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py @@ -1,12 +1,33 @@ import re +from datetime import datetime, timezone from typing import Dict, List, Optional, Set, Tuple, cast from fastapi import HTTPException from starlette.datastructures import Headers from starlette.requests import Request from starlette.types import Scope +from typing_extensions import assert_never +import litellm from litellm._logging import verbose_logger +from litellm.proxy._experimental.mcp_server.oauth_utils import ( + get_request_base_url, + well_known_root_suffix, +) +from litellm.proxy._experimental.mcp_server.outbound_credentials.bridge_credentials import ( + BridgeEnvelopeAdmitted, + BridgeEnvelopeInvalid, + NotBridgeEnvelope, + envelope_keys_from_master_key, + is_bridge_envelope_shaped, + resolve_bridge_envelope, +) +from litellm.proxy._experimental.mcp_server.outbound_credentials.envelope import ( + EnvelopeIdentity, +) +from litellm.proxy._experimental.mcp_server.outbound_credentials.session_credentials import ( + is_session_bearer_shaped, +) from litellm.proxy._types import ( UI_TEAM_ID, LiteLLM_TeamTable, @@ -17,12 +38,17 @@ from litellm.proxy._types import ( UserAPIKeyAuth, ) from litellm.proxy.auth.ip_address_utils import IPAddressUtils -from litellm.proxy.auth.user_api_key_auth import user_api_key_auth +from litellm.proxy.auth.user_api_key_auth import ( + _run_centralized_common_checks, + user_api_key_auth, +) +from litellm.proxy.common_utils.http_parsing_utils import _read_request_body from litellm.proxy.common_utils.user_api_key_cache import get_management_object_ttl from litellm.repositories.table_repositories import ( AgentsRepository, MCPServerRepository, ) +from litellm.types.mcp_server.mcp_server_manager import MCPServer def _parse_mcp_server_names_from_path(path: str, mcp_servers_header: Optional[List[str]] = None) -> Optional[List[str]]: @@ -101,6 +127,115 @@ def _has_client_supplied_mcp_auth( return bool(mcp_auth_header) or bool(mcp_server_auth_headers) +def _is_mcp_admitted_user_subject(user_api_key_auth: UserAPIKeyAuth | None) -> bool: + """True when this auth is a keyless subject admitted by the gateway session / bridge user + path, as opposed to a JWT or other keyless auth that merely lacks a ``team_id``. + + Reads the server-only ``mcp_admitted_user_subject`` field, set only by ``_reload_admitted_user``. It + is deliberately NOT a ``metadata`` key, which is caller-controlled at key creation and so forgeable + on a personal key to gain the team grant union or dodge the egress scrub; this field cannot be.""" + return user_api_key_auth is not None and user_api_key_auth.mcp_admitted_user_subject is True + + +def _is_aggregate_mcp_scope(route: str, mcp_servers: list[str] | None) -> bool: + """True when a request targets the aggregate ``/mcp`` endpoint rather than any named + server. Named targets arrive either through ``x-mcp-servers`` (``mcp_servers``) or a + path segment (``/mcp/{server}`` / ``/{server}/mcp``); the aggregate scope has neither. + The gateway-DCR session arm and challenge fire only here, so a per-server flow is never + affected.""" + if mcp_servers: + return False + return len(MCPRequestHandler._extract_target_server_names_from_path(route)) == 0 + + +def _is_aggregate_gateway_dcr_challenge_scope( + route: str, + mcp_servers: list[str] | None, + mcp_auth_header: str | None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None, + exc: Exception, +) -> bool: + """True when an unauthenticated request to the aggregate ``/mcp`` endpoint + should receive the RFC 9728 401 challenge that advertises the gateway as + the authorization server. + + Fires only for a genuine 401 on the aggregate scope: any named target + (path or ``x-mcp-servers``) belongs to the per-server challenge paths, and + client-supplied MCP auth headers mean the caller is not a cold-start DCR + client. Fails closed to the original admission error otherwise.""" + if not _is_litellm_auth_admission_error(exc): + return False + if _has_client_supplied_mcp_auth(mcp_auth_header, mcp_server_auth_headers): + return False + return _is_aggregate_mcp_scope(route, mcp_servers) + + +def _aggregate_gateway_dcr_challenge(request: Request, invalid_token: bool) -> HTTPException: + """The RFC 9728 challenge for the aggregate endpoint: points the client at + the gateway's own protected-resource metadata so a DCR client discovers + the gateway as its authorization server and starts the sign-in flow. + + ``invalid_token`` adds the RFC 6750 error code for a request that DID + present a bearer that failed admission (expired or revoked), telling + spec-compliant clients to re-authorize rather than retry; a request with + no credentials at all gets the bare challenge per RFC 6750 section 3.1.""" + error_attr = 'error="invalid_token", ' if invalid_token else "" + resource_metadata_url = ( + f"{get_request_base_url(request)}/.well-known/oauth-protected-resource{well_known_root_suffix()}/mcp" + ) + return HTTPException( + status_code=401, + detail={ + "error": "authentication_required", + "message": "Authenticate with the gateway to use the MCP endpoint.", + }, + headers={"WWW-Authenticate": f'Bearer {error_attr}resource_metadata="{resource_metadata_url}"'}, + ) + + +def _admission_failure_fallback( + request: Request, + request_route: str, + mcp_servers: list[str] | None, + mcp_auth_header: str | None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None, + exc: Exception, + bearer_presented: bool, +) -> UserAPIKeyAuth: + """Map a failed LiteLLM admission to its anonymous fallback or challenge. + + Two fallbacks exist, both gated on a genuine 401 with no client-supplied + MCP auth headers. The pass-through cold start (RFC 9728 / MCP + Authorization spec discovery return) admits anonymously so the route's + 401 emitter can produce the per-server challenge. The aggregate + gateway-DCR scope converts the failure into the gateway's own + resource_metadata challenge, with the RFC 6750 ``invalid_token`` error + code when the caller DID present a bearer (an expired gateway session + must re-authorize, not retry a dead token). Anything else re-raises the + original admission error unchanged.""" + mcp_servers_from_path = _parse_mcp_server_names_from_path(request_route, mcp_servers) + if ( + mcp_servers_from_path is not None + and not _has_client_supplied_mcp_auth(mcp_auth_header, mcp_server_auth_headers) + and _is_litellm_auth_admission_error(exc) + and _is_mcp_passthrough_cold_start( + mcp_servers_from_path, + client_ip=IPAddressUtils.get_mcp_client_ip(request), + ) + ): + verbose_logger.debug("MCP pass-through cold start: deferring admission to route 401 emitter") + return UserAPIKeyAuth() + if _is_aggregate_gateway_dcr_challenge_scope( + route=request_route, + mcp_servers=mcp_servers, + mcp_auth_header=mcp_auth_header, + mcp_server_auth_headers=mcp_server_auth_headers, + exc=exc, + ): + raise _aggregate_gateway_dcr_challenge(request, invalid_token=bearer_presented) from exc + raise exc + + class MCPRequestHandler: """ Class to handle MCP request processing, including: @@ -226,59 +361,89 @@ class MCPRequestHandler: client_ip=IPAddressUtils.get_mcp_client_ip(request), ): validated_user_api_key_auth = UserAPIKeyAuth() + elif ( + ( + bridge_delegate_target := MCPRequestHandler._single_dcr_bridge_delegate_target( + path=request_route, + mcp_servers=mcp_servers, + client_ip=IPAddressUtils.get_mcp_client_ip(request), + ) + ) + is not None + and oauth2_headers + and is_bridge_envelope_shaped(oauth2_headers["Authorization"]) + ): + # A single DCR-bridge oauth_delegate target carrying an envelope-shaped + # Authorization: open the envelope, admit under its recovered identity, and + # inject the inner upstream token for egress. A non-envelope bearer on the same + # server is NOT admitted here — it falls through to the oauth2 arm, which 401s. + validated_user_api_key_auth, mcp_server_auth_headers = await MCPRequestHandler._admit_dcr_bridge_delegate( + server=bridge_delegate_target, + authorization_value=oauth2_headers["Authorization"], + mcp_server_auth_headers=mcp_server_auth_headers, + request=request, + route=request_route, + ) + elif ( + _is_aggregate_mcp_scope(request_route, mcp_servers) + and oauth2_headers + and is_session_bearer_shaped(oauth2_headers["Authorization"]) + ): + # A gateway DCR session bearer at the aggregate /mcp scope: open the identity-only session + # token and admit under the live litellm user. One that does not open fails closed with the + # aggregate invalid_token challenge; a non-session bearer falls through to the oauth2 arm. + validated_user_api_key_auth = await MCPRequestHandler._admit_gateway_session( + authorization_value=oauth2_headers["Authorization"], + request=request, + route=request_route, + ) elif oauth2_headers: # Authorization on a non-delegated server: the bearer must be a real # LiteLLM credential, so a failed validation is a genuine 401/403 and - # propagates. The sole anonymous fallback is the auth_type=none - # pass-through cold-start (RFC 9728 discovery return), gated on a 401 - # so a recognized-but-forbidden key still fails closed. - client_ip = IPAddressUtils.get_mcp_client_ip(request) + # propagates unless a fallback in _admission_failure_fallback applies. try: validated_user_api_key_auth = await user_api_key_auth(api_key=litellm_api_key, request=request) except (HTTPException, ProxyException) as e: - # ProxyException.code is normalized to str (possibly "None"), so - # compare both int and str forms rather than coercing. - status = e.status_code if isinstance(e, HTTPException) else e.code - is_unauthenticated = status in (401, "401") - mcp_servers_from_path = _parse_mcp_server_names_from_path(request_route, mcp_servers) - if ( - is_unauthenticated - and mcp_servers_from_path is not None - and not _has_client_supplied_mcp_auth( - mcp_auth_header, - mcp_server_auth_headers, - ) - and _is_mcp_passthrough_cold_start(mcp_servers_from_path, client_ip=client_ip) - ): - verbose_logger.debug( - "MCP pass-through return: forwarding Authorization as upstream OAuth token for delegated auth" - ) - validated_user_api_key_auth = UserAPIKeyAuth() - else: - raise + validated_user_api_key_auth = _admission_failure_fallback( + request=request, + request_route=request_route, + mcp_servers=mcp_servers, + mcp_auth_header=mcp_auth_header, + mcp_server_auth_headers=mcp_server_auth_headers, + exc=e, + bearer_presented=True, + ) else: try: validated_user_api_key_auth = await user_api_key_auth(api_key=litellm_api_key, request=request) except (HTTPException, ProxyException) as exc: - # Cold-start MCP OAuth discovery: RFC 9728 / MCP Authorization spec - # require unauthenticated requests to protected resources to receive - # 401 + WWW-Authenticate. Defer to _raise_preemptive_401_for_unauthenticated_servers - # for pass-through servers instead of surfacing a generic admission error. - mcp_servers_from_path = _parse_mcp_server_names_from_path(request_route, mcp_servers) - client_ip = IPAddressUtils.get_mcp_client_ip(request) - if ( - mcp_servers_from_path is not None - and not _has_client_supplied_mcp_auth( - mcp_auth_header, - mcp_server_auth_headers, - ) - and _is_litellm_auth_admission_error(exc) - and _is_mcp_passthrough_cold_start(mcp_servers_from_path, client_ip=client_ip) - ): - verbose_logger.debug("MCP pass-through cold start: deferring admission to route 401 emitter") - validated_user_api_key_auth = UserAPIKeyAuth() - else: - raise + validated_user_api_key_auth = _admission_failure_fallback( + request=request, + request_route=request_route, + mcp_servers=mcp_servers, + mcp_auth_header=mcp_auth_header, + mcp_server_auth_headers=mcp_server_auth_headers, + exc=exc, + bearer_presented=False, + ) + + # Leak-defense (single chokepoint): a gateway admission credential (session bearer or bridge + # envelope) is NEVER a valid upstream token. Scrub it from EVERY egress context so no + # client-forwarded, OBO, or passthrough path can send it upstream for replay. Anchored to the + # credential SHAPE, so a legitimate upstream/passthrough token is forwarded unchanged. + raw_headers = dict(headers) + ( + oauth2_headers, + raw_headers, + mcp_auth_header, + mcp_server_auth_headers, + ) = MCPRequestHandler._scrub_gateway_admission_credentials( + admitted=_is_mcp_admitted_user_subject(validated_user_api_key_auth), + oauth2_headers=oauth2_headers, + raw_headers=raw_headers, + mcp_auth_header=mcp_auth_header, + mcp_server_auth_headers=mcp_server_auth_headers, + ) return ( validated_user_api_key_auth, @@ -286,9 +451,56 @@ class MCPRequestHandler: mcp_servers, mcp_server_auth_headers, oauth2_headers, - dict(headers), + raw_headers, ) + @staticmethod + def _is_gateway_admission_credential(value: str | None) -> bool: + """True when a header value is a gateway admission credential — a session bearer or bridge + envelope. It proves who signed in to the GATEWAY, never a valid UPSTREAM token, so it must never + be forwarded (a hostile upstream could capture and replay it against the aggregate ``/mcp`` scope).""" + return value is not None and (is_session_bearer_shaped(value) or is_bridge_envelope_shaped(value)) + + @staticmethod + def _scrub_gateway_admission_credentials( + admitted: bool, + oauth2_headers: dict[str, str] | None, + raw_headers: dict[str, str], + mcp_auth_header: str | None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None, + ) -> tuple[dict[str, str] | None, dict[str, str], str | None, dict[str, dict[str, str]] | None]: + """Remove any gateway admission credential from EVERY egress header context, keyed on the credential + SHAPE: top-level ``Authorization`` (oauth2 + raw), the deprecated ``x-mcp-auth``, and per-server + ``x-mcp-{alias}-authorization``. A legitimate upstream/passthrough token is never gateway-shaped so + it survives (including the real upstream token the bridge arm injects per-server); an admitted + subject's top-level Authorization is dropped unconditionally as defense-in-depth.""" + cred = MCPRequestHandler._is_gateway_admission_credential + + # 1. Top-level Authorization → oauth2_headers. + authz = oauth2_headers.get("Authorization") if oauth2_headers else None + if admitted or cred(authz): + oauth2_headers = None + + # 2. raw_headers: drop the admitted subject's Authorization, and ANY header whose value is a + # gateway credential (covers x-mcp-auth and x-mcp-{alias}-authorization in their raw form). + raw_headers = { + k: v for k, v in raw_headers.items() if not ((admitted and k.lower() == "authorization") or cred(v)) + } + + # 3. Deprecated x-mcp-auth value. + if cred(mcp_auth_header): + mcp_auth_header = None + + # 4. Per-server x-mcp-{alias}-authorization values (drop the value, then any now-empty server dict). + if mcp_server_auth_headers: + stripped = { + alias: {h: val for h, val in hdrs.items() if not cred(val)} + for alias, hdrs in mcp_server_auth_headers.items() + } + mcp_server_auth_headers = {alias: hdrs for alias, hdrs in stripped.items() if hdrs} + + return oauth2_headers, raw_headers, mcp_auth_header, mcp_server_auth_headers + @staticmethod def _extract_target_server_names_from_path(path: str) -> List[str]: """ @@ -432,6 +644,441 @@ class MCPRequestHandler: return False return True + @staticmethod + def _single_dcr_bridge_delegate_target( + path: str, mcp_servers: Optional[List[str]], client_ip: Optional[str] + ) -> Optional[MCPServer]: + """The one DCR-bridge ``oauth_delegate`` server this request targets, or ``None``. + + Returns the server only when EXACTLY ONE target resolves and it is both + ``is_oauth_delegate`` and ``is_dcr_bridge``. Fails closed (``None``) on a + multi-target request, an unresolved target, or a non-matching server, so the + envelope admission arm never fires for an aggregate scope or a server that did not + opt into the bridge. Mirrors :meth:`_target_servers_are_true_passthrough`. + """ + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( + global_mcp_server_manager, + ) + + target_names = MCPRequestHandler._resolve_target_server_names(path=path, mcp_servers_header=mcp_servers) + if len(target_names) != 1: + return None + server = global_mcp_server_manager.get_mcp_server_by_name(target_names[0], client_ip=client_ip) + if server is None or not server.is_oauth_delegate or not server.is_dcr_bridge: + return None + # Egress resolves the injected per-server token only by alias / server_name; a server with + # neither cannot receive the forwarded token, so fail closed rather than admit-and-drop. + if not (server.server_name or server.alias): + return None + return server + + @staticmethod + async def _admit_dcr_bridge_delegate( + server: MCPServer, + authorization_value: str, + mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]], + request: Request, + route: str, + ) -> Tuple[UserAPIKeyAuth, Optional[Dict[str, Dict[str, str]]]]: + """Open the bridge envelope and admit the caller under the live key it references. + + The envelope's signature proves the user authenticated when it was minted, but + authorization is resolved fresh here rather than trusted from the envelope: the + sealed ``key_hash`` reloads the current ``UserAPIKeyAuth`` record, and the admitted + identity then runs through the standard pipeline's centralized policy gate, so the + key's present restrictions and revocation state gate the request instead of a + snapshot frozen at mint time. The inner upstream token is injected under the + server's per-server auth-header key so egress forwards it via the + ``PassthroughConfig`` override; the envelope ``Authorization`` the leak-defense + strips never reaches the upstream. A new headers dict is returned rather than + mutating the input. Fails closed with a 401 on an invalid or expired envelope, or + when the referenced key is missing, blocked, or expired, its owner is + SCIM-deactivated, or the centralized policy gate rejects it (blocked team or + project, org or budget limits). + + The sealed token is keyed alias-first, matching the order egress resolves + (``lookup_mcp_server_auth_in_headers`` tries ``alias`` before ``server_name``). Keying + under ``server_name`` would leave a caller-supplied ``x-mcp-{alias}-authorization`` at the + higher-priority alias slot, pairing the admitted identity with an attacker's upstream + credential; the alias-keyed injection overwrites any such caller value. + """ + from litellm.proxy.proxy_server import master_key + + if not master_key: + raise HTTPException(status_code=500, detail="Server misconfigured: master_key is not set") + + await MCPRequestHandler._run_pre_db_read_auth_checks(request=request, route=route) + + keys = envelope_keys_from_master_key(master_key) + result = resolve_bridge_envelope(authorization_value, keys, datetime.now(timezone.utc), server.server_id) + match result: + case BridgeEnvelopeAdmitted(): + header_key = server.alias or server.server_name + if header_key is None: + raise HTTPException(status_code=500, detail="Server misconfigured: MCP server has no routable name") + admitted = await MCPRequestHandler._reload_admitted_principal(result.identity) + await MCPRequestHandler._enforce_admitted_live_policy(admitted=admitted, request=request, route=route) + injected = {header_key: {"Authorization": result.upstream_authorization.get_secret_value()}} + new_headers = {**(mcp_server_auth_headers or {}), **injected} + return admitted, new_headers + case BridgeEnvelopeInvalid() | NotBridgeEnvelope(): + raise HTTPException(status_code=401, detail="Invalid or expired credential") + case _: + assert_never(result) + + @staticmethod + async def _admit_gateway_session( + authorization_value: str, + request: Request, + route: str, + ) -> UserAPIKeyAuth: + """Open a gateway DCR session bearer and admit the live litellm user it references. + + Identity-only sibling of :meth:`_admit_dcr_bridge_delegate`: the session token seals no + upstream credential (those are vaulted per user, resolved at egress), so authorization is + resolved fresh via :meth:`_reload_admitted_user` + the centralized policy gate rather than a + mint-time snapshot. Pre-DB gates (size, IP, route allowlist) run first, mirroring the standard + pipeline. Fails closed with the aggregate ``invalid_token`` challenge on an expired, tampered, + foreign, or refresh token, or a missing/deactivated/policy-rejected user.""" + from litellm.proxy._experimental.mcp_server.outbound_credentials.session_credentials import ( + NotSessionBearer, + SessionBearerAdmitted, + SessionBearerInvalid, + resolve_session_bearer, + session_keys_from_master_key, + ) + from litellm.proxy.proxy_server import master_key + + if not master_key: + raise HTTPException(status_code=500, detail="Server misconfigured: master_key is not set") + + await MCPRequestHandler._run_pre_db_read_auth_checks(request=request, route=route) + + keys = session_keys_from_master_key(master_key) + result = resolve_session_bearer(authorization_value, keys, datetime.now(timezone.utc)) + match result: + case SessionBearerAdmitted(): + try: + admitted = await MCPRequestHandler._reload_admitted_user(result.principal.user_id) + await MCPRequestHandler._enforce_admitted_live_policy( + admitted=admitted, request=request, route=route + ) + except HTTPException as exc: + # A cryptographically valid bearer whose referenced user is now missing or + # SCIM-deactivated is an invalid_token at the aggregate scope: relay the RFC 9728 + # challenge so the DCR client re-authorizes, matching the SessionBearerInvalid + # arm, instead of a bare 401 with no WWW-Authenticate. A 503 (DB outage) is a + # transient availability failure, not an auth failure, so it passes through. + if exc.status_code == 401: + raise _aggregate_gateway_dcr_challenge(request, invalid_token=True) from exc + raise + return admitted + case SessionBearerInvalid(): + raise _aggregate_gateway_dcr_challenge(request, invalid_token=True) + case NotSessionBearer(): + # Unreachable: the arm is entered only for an is_session_bearer_shaped + # value. Kept for match exhaustiveness and fails closed regardless. + raise _aggregate_gateway_dcr_challenge(request, invalid_token=True) + case _: + assert_never(result) + + @staticmethod + async def _run_pre_db_read_auth_checks(request: Request, route: str) -> None: + """Run the proxy-wide gates ``user_api_key_auth`` applies before any key lookup: the + request-size and body-safety limits, the IP allowlist, and the ``general_settings`` + route allowlist. The envelope arm bypasses ``user_api_key_auth`` (it opens the envelope + and reloads the identity itself), so without this a caller blocked by IP or hitting a + proxy route the allowlist forbids would be admitted through an envelope where the same + principal presented on the normal MCP admission path would be rejected. Runs before the + envelope crypto so a disallowed caller is turned away before any work, mirroring the + standard pipeline's pre-DB ordering. Violations raise the gate's own status (an IP or + route block is a 403, an oversized body its own limit error).""" + from litellm.proxy.auth.auth_utils import pre_db_read_auth_checks + + await pre_db_read_auth_checks( + request=request, + request_data=await _read_request_body(request=request), + route=route, + ) + + @staticmethod + async def _reload_admitted_principal(identity: EnvelopeIdentity) -> UserAPIKeyAuth: + """Reload the live litellm record the envelope's subject references. + + Dispatches on the sealed subject type: a ``key_hash`` reloads the virtual key that + minted the envelope (the scripted two-header client that presents a litellm key at the + token endpoint), a ``user_id`` reloads the user that authenticated interactively (the + DCR client, whose SSO login at the bridged authorize yields a user, not a key). Both + return a ``UserAPIKeyAuth`` the caller runs through the centralized policy gate, so + team/project/org/budget/SCIM enforcement is identical to the principal presenting + itself directly.""" + match identity.subject_type: + case "key_hash": + return await MCPRequestHandler._reload_admitted_key(identity.subject) + case "user_id": + return await MCPRequestHandler._reload_admitted_user(identity.subject) + case _: + assert_never(identity.subject_type) + + @staticmethod + async def _reload_admitted_user(user_id: str) -> UserAPIKeyAuth: + """Reload the live user an interactively-minted envelope references and admit them as themselves. + + The user's own object permission and ``org_id`` ride on the returned ``UserAPIKeyAuth``, and the + SAME ``get_allowed_mcp_servers`` the key path uses gates the request. The ``mcp_admitted_user_subject`` + marker (set below) makes that resolver union the servers the user reaches through ANY of their teams + on top of these direct grants, each source bounded by ITS OWN org, so a user spanning organizations + cannot leak one org's servers past another's ceiling. + + Error handling: ``get_user_object`` catches every DB failure and re-raises a bare ``ValueError``, so a + missing user and a real outage look identical (the cause survives only as ``__context__``). + ``_raise_503_if_db_unavailable`` walks the cause chain so an outage stays a retryable 503 while any + other failure fails closed as 401, not an opaque 500; the object-permission load shares that boundary.""" + from litellm.proxy.auth.auth_checks import get_object_permission, get_user_object + from litellm.proxy.proxy_server import prisma_client, user_api_key_cache + + if prisma_client is None: + raise HTTPException(status_code=500, detail="Server misconfigured: no database connection") + try: + user_object = await get_user_object( + user_id=user_id, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + user_id_upsert=False, + ) + # Resolve the user's own MCP object permission (get_user_object does not load it) so the shared + # get_allowed_mcp_servers can grant the user their litellm-granted servers. Reuses the same + # get_object_permission resolver the key and team paths use; no permission logic is duplicated. + object_permission = user_object.object_permission if user_object is not None else None + if user_object is not None and object_permission is None and user_object.object_permission_id: + object_permission = await get_object_permission( + object_permission_id=user_object.object_permission_id, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + ) + except (ProxyException, HTTPException): + raise HTTPException(status_code=401, detail="Invalid or expired credential") from None + except Exception as e: # noqa: BLE001 # a DB outage anywhere in the resolution is a retryable 503, not an opaque 500; anything else fails closed as 401 + MCPRequestHandler._raise_503_if_db_unavailable(e) + raise HTTPException(status_code=401, detail="Invalid or expired credential") from None + if user_object is None: + raise HTTPException(status_code=401, detail="Invalid or expired credential") + if isinstance(user_object.metadata, dict) and user_object.metadata.get("scim_active") is False: + raise HTTPException(status_code=401, detail="Invalid or expired credential") + admitted = UserAPIKeyAuth( + user_id=user_object.user_id, + user_role=user_object.user_role, + org_id=user_object.organization_id, + object_permission=object_permission, + object_permission_id=user_object.object_permission_id, + # Copy the live user's rate limits, as the standard user-subject path does: the parallel + # limiter reads these off the auth object and treats None as unlimited, so a keyless subject + # with them unset would outrun its user RPM/TPM. (Per-team mcp_rpm_limit is stamped below; + # per-KEY limits do not apply, there being no key.) + user_tpm_limit=user_object.tpm_limit, + user_rpm_limit=user_object.rpm_limit, + ) + # Server-only marker, set AFTER construction: the before-validator strips it from any validated + # input, so caller-supplied data (key metadata, JWT claims) can never forge it. + admitted.mcp_admitted_user_subject = True + # Carry each granting team's per-server mcp_rpm_limit: this subject reaches servers through + # several teams under its own identity, so without this a cross-team user outruns every team's + # limit. Resolved from the same roster-checked sources as the grant union, so a team throttles + # only what it granted. + admitted.mcp_source_team_rpm_limits = await MCPRequestHandler._admitted_subject_team_rpm_limits(admitted) + return admitted + + @staticmethod + async def _admitted_subject_team_rpm_limits(auth: UserAPIKeyAuth) -> dict[str, dict[str, int]] | None: + """``team_id -> mcp_rpm_limit`` for every team this subject reaches servers through, each map + filtered to the servers THAT team's grant actually reaches. + + A limit rides the same scope as the access it bounds, so a roster team is charged only for a + server its OWN grant reaches (never one the user reaches through a different team, which would + drain a bucket shared by that team's keys for access it never provided). Grant scope comes from + the SAME ``get_allowed_mcp_servers(source)`` authorization uses; limit-map keys are names/aliases + so each is resolved to an id via ``expand_permission_list`` before the membership check. Returns + None (no descriptors) when nothing applies; a lookup failure narrows to None rather than raising, + since rate limiting must not deny a request authorization already allowed.""" + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( + global_mcp_server_manager, + ) + + try: + limits: dict[str, dict[str, int]] = {} + source_grants = await MCPRequestHandler.admitted_source_grants(auth) + for source, granted_ids in source_grants: + if not source.team_id: + continue + team_obj = await MCPRequestHandler._roster_team_object(source.team_id, auth) + team_limit = (team_obj.metadata or {}).get("mcp_rpm_limit") if team_obj is not None else None + if not isinstance(team_limit, dict) or not team_limit: + continue + applicable: dict[str, int] = {} + for server_name, rpm in team_limit.items(): + for server_id in global_mcp_server_manager.expand_permission_list([server_name]): + if server_id not in granted_ids: + continue + # Charge ONLY the source billing attributes the call to (same owner), so one + # cross-team user cannot drain several teams' shared buckets on a single call, + # and a server the user's OWN grant reaches charges no team bucket. + attributed = await MCPRequestHandler.attributing_source_for_server( + auth, server_id, source_grants=source_grants + ) + if attributed is not None and attributed.team_id == source.team_id: + applicable[server_name] = rpm + break + if applicable: + limits[source.team_id] = applicable + return limits or None + except Exception as e: # noqa: BLE001 # throttling metadata must never fail an allowed request + verbose_logger.warning(f"Failed to resolve per-team MCP rpm limits for admitted subject: {str(e)}") + return None + + @staticmethod + async def _reload_admitted_key(key_hash: str) -> UserAPIKeyAuth: + """Reload the live key record an admitted envelope references and re-check live policy. + + Resolving the current ``UserAPIKeyAuth`` (cache first, then DB) is what stops the + envelope from carrying frozen authority: the key's present team/org/object-permission + restrictions ride on the returned object, and a key that has since been deleted, + blocked, or expired fails closed with a 401 here rather than being admitted as an + unrestricted identity. ``get_key_object`` raises for a hash with no key row; a + blocked or expired row is rejected explicitly because ``get_key_object`` resolves a + row without applying those checks (the main ``user_api_key_auth`` pipeline enforces + them downstream, which this admission path bypasses). The owner's SCIM state is the + other builder-inline check mirrored here, so IdP offboarding revokes every envelope + minted under the user's keys rather than leaving them live until expiry. Team, + project, org, and budget state are NOT re-checked here; the caller runs the admitted + identity through ``_enforce_admitted_live_policy`` for those. + """ + from litellm.proxy.auth.auth_checks import get_key_object + from litellm.proxy.proxy_server import prisma_client, user_api_key_cache + + if prisma_client is None: + raise HTTPException(status_code=500, detail="Server misconfigured: no database connection") + try: + key_object = await get_key_object( + hashed_token=key_hash, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + ) + except (ProxyException, HTTPException): + raise HTTPException(status_code=401, detail="Invalid or expired credential") from None + except Exception as e: # noqa: BLE001 # a DB outage during reload is a retryable 503, not an opaque 500 + MCPRequestHandler._raise_503_if_db_unavailable(e) + raise + if not MCPRequestHandler._admitted_key_is_active(key_object): + raise HTTPException(status_code=401, detail="Invalid or expired credential") + await MCPRequestHandler._reject_if_admitted_owner_scim_deactivated(key_object) + return key_object + + @staticmethod + def _raise_503_if_db_unavailable(e: Exception) -> None: + """Raise a retryable 503 when ``e`` means the auth database is unreachable, else return so the + caller applies its own fail-closed mapping. A DB outage must not masquerade as an auth failure + (401) or surface as an opaque 500; the caller retries. Mirrors ``UserAPIKeyAuthExceptionHandler``, + which renders a service-unavailable database error as 503 on the standard pipeline. + + Classifies across the ``__cause__``/``__context__`` chain, not just ``e`` itself: ``get_user_object`` + re-raises every DB failure as a bare ``ValueError``, so a type-based check on the top exception + would miss a real outage wrapped inside it.""" + from litellm.proxy.db.exception_handler import PrismaDBExceptionHandler + + if PrismaDBExceptionHandler.is_database_service_unavailable_error_in_chain(e): + raise HTTPException( + status_code=503, + detail="Service Unavailable, the authentication database is temporarily unreachable. Please retry shortly.", + ) from None + + @staticmethod + async def _reject_if_admitted_owner_scim_deactivated(key_object: UserAPIKeyAuth) -> None: + """Fail closed with a 401 when the key's owning user was deactivated via SCIM. + + The standard pipeline enforces this inline in ``_user_api_key_auth_builder`` rather + than in ``common_checks``, so the centralized policy gate does not cover it; without + this mirror, IdP offboarding would leave the user's already-minted envelopes live + until expiry. A failed user lookup skips the gate (fail-open), matching the builder: + this is the one deliberately fail-open check in an otherwise fail-closed arm, so a + transient DB outage during this lookup admits the request rather than rejecting it, + keeping parity with how the standard pipeline treats the same lookup failure.""" + if key_object.user_id is None: + return + from litellm.proxy.auth.auth_checks import get_user_object + from litellm.proxy.proxy_server import prisma_client, user_api_key_cache + + try: + user_object = await get_user_object( + user_id=key_object.user_id, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + user_id_upsert=False, + ) + except Exception as e: # noqa: BLE001 # mirror the builder's fail-open user lookup; DB errors are of any type + verbose_logger.debug(f"bridge admission: user lookup failed, skipping SCIM gate: {e}") + user_object = None + if user_object is None or not isinstance(user_object.metadata, dict): + return + if user_object.metadata.get("scim_active") is False: + raise HTTPException(status_code=401, detail="Invalid or expired credential") + + @staticmethod + async def _enforce_admitted_live_policy(admitted: UserAPIKeyAuth, request: Request, route: str) -> None: + """Run the standard pipeline's authorization checks over the admitted identity. + + Mirrors the ``user_api_key_auth`` wrapper between the builder and its return: clear the + request-scoped ``budget_reservation`` on the reloaded identity, run the route gate + (``RouteChecks.should_call_route``) to enforce the identity's ``allowed_routes`` and any + disabled/admin-only route, then run ``_run_centralized_common_checks`` (the same gate every + builder path funnels through) for team-block, project-block, org, and budget. The route gate + closes a bypass: a key barred from MCP routes could otherwise mint an envelope at the token + endpoint (not itself an MCP route) and replay it against MCP, because the centralized checks + treat MCP as an inference route and never re-check ``allowed_routes``. + + Failures surface with the status the standard pipeline would give them, mirroring + ``UserAPIKeyAuthExceptionHandler``: a disallowed route is the route gate's own 403, an + over-budget identity is a 429, a sub-check that raised its own ``HTTPException``/ + ``ProxyException`` keeps that status, a transient database outage is a retryable 503, and + only a genuinely unresolvable failure (a blocked team/project raises a bare ``Exception``, + same as the standard pipeline's fallback) becomes the fail-closed 401. Collapsing every + failure to 401 was misleading: it told an over-budget but validly-authenticated caller their + credential was invalid, which on a DCR client reads as broken auth and can trigger a + pointless re-authorize loop that cannot fix a budget problem, and it masked a DB outage as an + auth error.""" + from litellm.proxy.auth.route_checks import RouteChecks + + admitted.budget_reservation = None + try: + RouteChecks.should_call_route(route=route, valid_token=admitted, request=request) + await _run_centralized_common_checks( + user_api_key_auth_obj=admitted, + request=request, + request_data=await _read_request_body(request=request), + route=route, + ) + except (HTTPException, ProxyException): + raise + except litellm.BudgetExceededError as e: + raise HTTPException(status_code=getattr(e, "status_code", 429), detail=str(e)) from None + except Exception as e: # noqa: BLE001 # untyped gate failure: retryable 503 for a DB outage, else fail closed 401 + MCPRequestHandler._raise_503_if_db_unavailable(e) + raise HTTPException(status_code=401, detail="Invalid or expired credential") from None + + @staticmethod + def _admitted_key_is_active(key_object: UserAPIKeyAuth) -> bool: + """False when the referenced key is blocked or past its expiry, so a revoked key + cannot be admitted through its still-unexpired envelope. Mirrors the active-key gate + the bridge token endpoint applies at mint time.""" + if key_object.blocked is True: + return False + expires = key_object.expires + if expires is None: + return True + expiry = expires if isinstance(expires, datetime) else datetime.fromisoformat(expires) + if expiry.tzinfo is None or expiry.tzinfo.utcoffset(expiry) is None: + expiry = expiry.replace(tzinfo=timezone.utc) + return expiry >= datetime.now(timezone.utc) + @staticmethod def _resolve_target_server_names(path: str, mcp_servers_header: Optional[List[str]]) -> List[str]: """ @@ -635,6 +1282,8 @@ class MCPRequestHandler: @staticmethod async def get_allowed_mcp_servers( user_api_key_auth: Optional[UserAPIKeyAuth] = None, + *, + keyless_source: bool = False, ) -> List[str]: """ Get list of allowed MCP servers for the given user/key based on permissions. @@ -656,6 +1305,13 @@ class MCPRequestHandler: from litellm.proxy.proxy_server import general_settings try: + # A keyless admitted subject resolves per source BEFORE any single-source rule here. Ordering + # matters: the no_mcp_servers opt-out below reads the caller's own object_permission, so above + # this branch a user's own opt-out would wrongly zero their TEAMS' grants too (each source is + # independent; an opt-out silences only its own source, inside the recursive call). + if _is_mcp_admitted_user_subject(user_api_key_auth) and user_api_key_auth is not None: + return await MCPRequestHandler._resolve_admitted_subject_servers(user_api_key_auth) + # Get allowed servers from key and team allowed_mcp_servers_for_key = await MCPRequestHandler._get_allowed_mcp_servers_for_key(user_api_key_auth) @@ -685,8 +1341,18 @@ class MCPRequestHandler: # team's by default. With require_key_mcp_access_defined the # team is a ceiling rather than a default, so the key must # grant servers explicitly (or via an access group) to reach - # any — it inherits none. - base = set() if general_settings.get("require_key_mcp_access_defined", False) else team_set + # any — it inherits none. That ceiling is for VIRTUAL KEYS that + # can declare their own access; a keyless gateway/bridge-admitted + # user has no key to declare access on — team membership IS their + # only access path — so the flag must not zero their team grants. + # A keyless admitted subject returned above and never reaches this virtual-key ceiling, + # so require_key_mcp_access_defined can only ever zero a real key's inherited team grants. + # ``keyless_source`` marks one grant source of an admitted subject, which has no key + # to declare access on, so the flag must not zero its team grants. + require_key_access = ( + general_settings.get("require_key_mcp_access_defined", False) and not keyless_source + ) + base = team_set if not require_key_access else set() else: base = key_set & team_set # both restrict → intersect @@ -745,24 +1411,290 @@ class MCPRequestHandler: ######################################################### # Apply org-level ceiling if org_id is set ######################################################### - if user_api_key_auth and user_api_key_auth.org_id: - allowed_mcp_servers_for_org = await MCPRequestHandler._get_allowed_mcp_servers_for_org( - user_api_key_auth - ) - if len(allowed_mcp_servers_for_org) > 0: - if has_lower_level_mcp_restrictions: - # Lower-level restrictions exist, so org can only cap them. - allowed_mcp_servers = [s for s in allowed_mcp_servers if s in allowed_mcp_servers_for_org] - else: - # No lower-level restrictions → org list becomes the ceiling - allowed_mcp_servers = allowed_mcp_servers_for_org - verbose_logger.debug(f"Applied org ceiling filter. Final allowed servers: {allowed_mcp_servers}") + allowed_mcp_servers = await MCPRequestHandler._apply_primary_org_ceiling( + allowed_mcp_servers, + user_api_key_auth, + has_lower_level_mcp_restrictions, + keyless_source=keyless_source, + ) return list(set(allowed_mcp_servers)) except Exception as e: verbose_logger.warning(f"Failed to get allowed MCP servers: {str(e)}") return [] + @staticmethod + async def _apply_primary_org_ceiling( + allowed_mcp_servers: list[str], + user_api_key_auth: UserAPIKeyAuth | None, + has_lower_level_mcp_restrictions: bool, + keyless_source: bool = False, + ) -> list[str]: + """Cap the resolved server list by this caller's org ceiling: an explicit org list intersects + lower-level restrictions (else becomes the ceiling); no org or an empty list leaves it unchanged. + + ``keyless_source`` governs both divergences for a keyless admitted source. An UNRESOLVABLE ceiling + fails CLOSED for it (its only org bound is this ceiling, so dropping it on a fault would escalate a + cross-org user) while a key stays fail-open. And an org list may only ever INTERSECT a source (the + admitted model unions grants, so a ceiling must not become one), whereas for a key it may + substitute, that being the key ceiling model.""" + if not (user_api_key_auth and user_api_key_auth.org_id): + return allowed_mcp_servers + allowed_mcp_servers_for_org = await MCPRequestHandler._get_allowed_mcp_servers_for_org(user_api_key_auth) + if allowed_mcp_servers_for_org is None: + verbose_logger.warning( + f"MCP org ceiling unresolved for org_id={user_api_key_auth.org_id!r}; " + f"{'denying (keyless admitted subject)' if keyless_source else 'leaving uncapped (key auth)'}" + ) + return [] if keyless_source else allowed_mcp_servers + if len(allowed_mcp_servers_for_org) == 0: + return allowed_mcp_servers + if has_lower_level_mcp_restrictions or keyless_source: + # Org can only cap lower-level restrictions. A keyless admitted source ALWAYS takes this + # arm: its model unions GRANTS, so an org list may only narrow a source, never become one. + capped = [s for s in allowed_mcp_servers if s in allowed_mcp_servers_for_org] + else: + # No lower-level restrictions → org list becomes the ceiling. + capped = allowed_mcp_servers_for_org + verbose_logger.debug(f"Applied org ceiling filter. Final allowed servers: {capped}") + return capped + + @staticmethod + def _scoped_source_auth( + auth: UserAPIKeyAuth, + *, + team_id: str | None, + org_id: str | None, + carry_user_grants: bool, + ) -> UserAPIKeyAuth: + """A plain, UNMARKED auth describing ONE grant source of an admitted subject. + + Only the fields the resolver consults are carried; everything else is left at its default on + purpose: no ``api_key``/``token`` (not a key), no budget/spend/rate-limit (the subject's own + user-level limits meter the request, and per-source copies would double descriptors), no + ``user_role`` (an admin role would grant every server at the server-manager wrapper). The + admission marker cannot be set via the constructor (a before-validator pops it), so each source + resolves as an ordinary caller and cannot re-enter the admitted path.""" + scoped = UserAPIKeyAuth( + user_id=auth.user_id, + team_id=team_id, + org_id=org_id, + parent_otel_span=auth.parent_otel_span, + ) + if carry_user_grants: + # The user's OWN grants. A team source carries none of these (the resolver loads the team's + # own object_permission from team_id); mixing them in would widen the team with grants it never made. + scoped.object_permission = auth.object_permission + scoped.object_permission_id = auth.object_permission_id + scoped.access_group_ids = auth.access_group_ids + return scoped + + @staticmethod + async def _admitted_subject_sources(auth: UserAPIKeyAuth) -> list[UserAPIKeyAuth]: + """The independent sources a keyless admitted subject reaches MCP servers through: their own + direct grants, plus every team they are a live roster member of. + + Each team source carries that TEAM's org (falling back to the user's), so the canonical resolver + applies the team's OWN owning-org ceiling — a cross-org user's teams are each bounded by their + own org, not the caller's home org. Roster membership is checked HERE (not per resolution) + because a user's cached ``teams`` array can name a team whose ``members_with_roles`` no longer + lists them; the roster is the source of truth for revocation.""" + from litellm.proxy.proxy_server import prisma_client + + sources = [ + MCPRequestHandler._scoped_source_auth(auth, team_id=None, org_id=auth.org_id, carry_user_grants=True) + ] + if not auth.user_id or prisma_client is None: + return sources + for team_id in await MCPRequestHandler._resolve_user_team_ids(auth.user_id, auth): + team_obj = await MCPRequestHandler._roster_team_object(team_id, auth) + if team_obj is None: + continue + sources.append( + MCPRequestHandler._scoped_source_auth( + auth, + team_id=team_id, + org_id=team_obj.organization_id or auth.org_id, + carry_user_grants=False, + ) + ) + return sources + + @staticmethod + async def _roster_team_object(team_id: str, auth: UserAPIKeyAuth) -> LiteLLM_TeamTable | None: + """The team row for ``team_id``, but ONLY when ``auth``'s user is a live roster member of it. + + The single owner of "is this team really one of this subject's sources", so the grant union + and the per-team rate limits cannot disagree about which teams count. A team lingering in the + user's cached ``teams`` array whose ``members_with_roles`` no longer lists them returns None + here, which is what revokes both its grants and its throttle in one place.""" + from litellm.proxy.auth.auth_checks import get_team_object + from litellm.proxy.proxy_server import ( + prisma_client, + proxy_logging_obj, + user_api_key_cache, + ) + + if prisma_client is None or not auth.user_id: + return None + try: + team_obj: LiteLLM_TeamTable | None = await get_team_object( + team_id=team_id, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + parent_otel_span=auth.parent_otel_span, + proxy_logging_obj=proxy_logging_obj, + ) + except Exception as e: # noqa: BLE001 # per-source isolation: one team's blip must not deny the others + # Fault isolation is per SOURCE: an unresolvable team contributes nothing (fail closed for + # it alone, access only narrows) while every other source stands. Raising would collapse the + # whole union to deny-all over one momentarily-unreadable row. + verbose_logger.warning(f"MCP admitted-subject source team {team_id!r} unresolvable, skipping: {str(e)}") + return None + if team_obj is None: + return None + member_user_ids = {getattr(m, "user_id", None) for m in (team_obj.members_with_roles or [])} - {None} + if auth.user_id not in member_user_ids: + return None + # A team (or its owning org) over budget is not a live grantor, exactly as it is not for a key + # pinned to it. Enforced via the SAME owners the key path uses (_team_max_budget_check / + # _organization_max_budget_check), targeted at the TEAM's org through the scoped source view, so + # no consumer of the source list ever sees an over-budget team. This is ENFORCEMENT of an + # already-exceeded state; ATTRIBUTION of new spend stays with the user (documented deferral). + from litellm.exceptions import BudgetExceededError + from litellm.proxy.auth.auth_checks import ( + _organization_max_budget_check, + _team_max_budget_check, + ) + + source_view = MCPRequestHandler._scoped_source_auth( + auth, team_id=team_id, org_id=team_obj.organization_id or auth.org_id, carry_user_grants=False + ) + try: + await _team_max_budget_check( + team_object=team_obj, valid_token=source_view, proxy_logging_obj=proxy_logging_obj + ) + await _organization_max_budget_check( + valid_token=source_view, + team_object=team_obj, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + proxy_logging_obj=proxy_logging_obj, + ) + except BudgetExceededError as e: + verbose_logger.info(f"MCP admitted-subject source team {team_id!r} over budget, not a grantor: {str(e)}") + return None + except Exception as e: # noqa: BLE001 # per-source isolation: a budget-check fault narrows, never raises + verbose_logger.warning(f"MCP budget check failed for source team {team_id!r}, skipping source: {str(e)}") + return None + return team_obj + + @staticmethod + async def admitted_source_grants(auth: UserAPIKeyAuth) -> list[tuple[UserAPIKeyAuth, set[str]]]: + """``(source, the servers that source grants)`` for every source of an admitted subject. + + THE owner of "which source reaches which server". The reachable union, the per-team throttle + scope, the tool union and billing attribution are all just different reads of this one + answer — computing it separately per consumer is how they drift (a throttle map scoped by + roster instead of by grant charged unrelated teams' buckets).""" + return [ + (source, set(await MCPRequestHandler.get_allowed_mcp_servers(source, keyless_source=True))) + for source in await MCPRequestHandler._admitted_subject_sources(auth) + ] + + @staticmethod + async def _resolve_admitted_subject_servers(auth: UserAPIKeyAuth) -> list[str]: + """Union of what each of the admitted subject's sources reaches, each answered by the + canonical resolver so no rule is reimplemented for this caller shape.""" + reachable: set[str] = set() + for _source, granted in await MCPRequestHandler.admitted_source_grants(auth): + reachable.update(granted) + return list(reachable) + + @staticmethod + async def billing_auth_for_tool_call(auth: UserAPIKeyAuth, tool_name: str) -> UserAPIKeyAuth: + """The auth object a tool call's SPEND should be recorded against. + + ``auth`` unchanged for any non-admitted caller (key/JWT billing byte-identical). For an admitted + subject whose call is reached through a team's grant, a copy carrying that team's ``team_id`` and + owning ``org_id`` so the team's budget accumulates and the right org is charged. Falls back to + user-level attribution (rather than guessing a team) when the tool name does not resolve to a + server, reusing the manager's own tool-name lookup.""" + if not _is_mcp_admitted_user_subject(auth): + return auth + try: + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( + global_mcp_server_manager, + ) + + server = global_mcp_server_manager._get_mcp_server_from_tool_name(tool_name) + if server is None: + return auth + source = await MCPRequestHandler.attributing_source_for_server(auth, server.server_id) + if source is None or not source.team_id: + return auth + billed = auth.model_copy() + billed.team_id = source.team_id + billed.org_id = source.org_id + return billed + except Exception as e: # noqa: BLE001 # attribution must never fail an authorized call + verbose_logger.warning(f"MCP billing attribution failed for {tool_name!r}, billing the user: {str(e)}") + return auth + + @staticmethod + async def attributing_source_for_server( + auth: UserAPIKeyAuth, + server_id: str, + source_grants: list[tuple[UserAPIKeyAuth, set[str]]] | None = None, + ) -> UserAPIKeyAuth | None: + """The source a billable call to ``server_id`` is attributed to, or None to bill the caller as + themselves (their own grant reaches it, or nothing does). + + The rule: a user's OWN grant is not "through a team", so it bills the user; otherwise the call + bills a granting team, deterministically the lowest ``team_id`` when several grant the server so + the pick is stable rather than dict-ordering-dependent. Reads the one grant owner, so the billed + team is always one that actually granted the server (restoring the team budget accrual and + owning-org charge that a keyless, team_id-less subject otherwise skipped).""" + source_grants = source_grants or await MCPRequestHandler.admitted_source_grants(auth) + granting = [(source, granted) for source, granted in source_grants if server_id in granted] + if not granting: + return None + for source, _granted in granting: + if source.team_id is None: + return None # the user's own grant reaches it: their spend, their org + return min((source for source, _ in granting), key=lambda s: s.team_id or "") + + @staticmethod + async def _resolve_admitted_subject_tools(server_id: str, auth: UserAPIKeyAuth) -> list[str] | None: + """Effective tool allowlist on ``server_id`` for an admitted subject, as the union over the + sources that actually grant that server. + + A source that does not grant the server contributes nothing, so its tool rules cannot leak + onto a server reached through a different source. A source that grants the server with no + tool restriction means the user can use every tool on it, so allow-all wins the union. When + no source grants the server the result is ``[]`` — deny all, fail closed.""" + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( + global_mcp_server_manager, + ) + + # An OPEN channel (allow_all_keys, the user's own BYOM) makes the server REACHABLE through the + # user, though no grant source names it — without this the union returns [], listable but + # uninvokable. Reachability is ALL it confers, NOT a ceiling waiver: the user's own + # mcp_tool_permissions and org tool ceiling still bind, exactly as a key's do on an allow_all server. + reachable_via_open_channel = server_id in await global_mcp_server_manager.operator_open_server_ids(auth) + + allowed: set[str] = set() + for source, granted in await MCPRequestHandler.admitted_source_grants(auth): + # The open channel is evaluated against the user's OWN source (team_id is None), so that + # source's restrictions apply to it; a team's rules never ride an open-channel server. + if server_id not in granted and not (reachable_via_open_channel and source.team_id is None): + continue + tools = await MCPRequestHandler.get_allowed_tools_for_server(server_id, source, keyless_source=True) + if tools is None: + return None + allowed.update(tools) + return sorted(allowed) + @staticmethod def _get_key_object_permission( user_api_key_auth: Optional[UserAPIKeyAuth] = None, @@ -822,6 +1754,8 @@ class MCPRequestHandler: async def get_allowed_tools_for_server( server_id: str, user_api_key_auth: Optional[UserAPIKeyAuth] = None, + *, + keyless_source: bool = False, ) -> Optional[List[str]]: """ Get list of allowed tool names for a specific server based on key/team permissions. @@ -838,6 +1772,12 @@ class MCPRequestHandler: return None try: + # FIRST statement, mirroring get_allowed_mcp_servers: a keyless admitted subject resolves per + # source and shares nothing with the single-credential prelude below. Ordering is the invariant: + # sat after the prelude, a fault in a lookup the subject never uses denied tools its teams grant. + if _is_mcp_admitted_user_subject(user_api_key_auth): + return await MCPRequestHandler._resolve_admitted_subject_tools(server_id, user_api_key_auth) + # Get key and team object permissions (already loaded in main auth flow) key_obj_perm = MCPRequestHandler._get_key_object_permission(user_api_key_auth) team_obj_perm = await MCPRequestHandler._get_team_object_permission(user_api_key_auth) @@ -850,11 +1790,29 @@ class MCPRequestHandler: global_mcp_server_manager, ) - key_tools = ( + key_direct_tools = ( global_mcp_server_manager.expand_tool_permissions(key_obj_perm.mcp_tool_permissions).get(server_id) if key_obj_perm else None ) + + # Tools granted through the key's toolsets restrict this server exactly + # as direct tool permissions do; union with any direct grants so the + # tool-level check sees the key's full effective tool scope + key_toolset_ids = (key_obj_perm.mcp_toolsets or []) if key_obj_perm else [] + key_toolset_tools = ( + (await global_mcp_server_manager.resolve_toolset_tool_permissions(toolset_ids=key_toolset_ids)).get( + server_id + ) + if key_toolset_ids + else None + ) + + key_tools = ( + list(set(key_direct_tools or []) | set(key_toolset_tools or [])) + if key_direct_tools is not None or key_toolset_tools is not None + else None + ) team_tools = ( global_mcp_server_manager.expand_tool_permissions(team_obj_perm.mcp_tool_permissions).get(server_id) if team_obj_perm @@ -873,42 +1831,73 @@ class MCPRequestHandler: # No team restrictions → use key restrictions allowed_tools = cast(List[str], key_tools) - # Intersect with agent's tool permissions if agent_id is set - if user_api_key_auth.agent_id: - # Pre-fetch agent object_permission once to avoid duplicate DB query - agent_obj_perm = await MCPRequestHandler._get_agent_object_permission(user_api_key_auth) - agent_tools = await MCPRequestHandler._get_agent_tool_permissions_for_server( - server_id=server_id, - user_api_key_auth=user_api_key_auth, - agent_object_permission=agent_obj_perm, - ) - if agent_tools is not None: - if allowed_tools is not None: - allowed_tools = list(set(allowed_tools) & set(agent_tools)) - else: - allowed_tools = agent_tools - - # Apply org-level tool ceiling if org_id is set - if user_api_key_auth.org_id: - # _get_org_object_permission uses user_api_key_cache, so this is not a - # fresh DB round-trip when get_allowed_mcp_servers was already called. - org_obj_perm = await MCPRequestHandler._get_org_object_permission(user_api_key_auth) - org_tools = ( - global_mcp_server_manager.expand_tool_permissions(org_obj_perm.mcp_tool_permissions).get(server_id) - if org_obj_perm and org_obj_perm.mcp_tool_permissions - else None - ) - if org_tools is not None: - if allowed_tools is not None: - allowed_tools = list(set(allowed_tools) & set(org_tools)) - else: - allowed_tools = list(org_tools) - - return allowed_tools + return await MCPRequestHandler._apply_agent_and_org_tool_ceilings( + allowed_tools, server_id, user_api_key_auth, keyless_source=keyless_source + ) except Exception as e: verbose_logger.warning(f"Failed to get allowed tools for server: {str(e)}") - return None + # Fail CLOSED for a keyless admitted subject: ANY error must deny the server's tools ([]), + # not collapse to allow-all (None); key/JWT auth keeps its prior allow-all-on-error. Both + # keyless_source AND the marker are needed: each source resolves through an UNMARKED auth, so + # without keyless_source a fault under a source returns None and wins the union as allow-all. + return [] if (keyless_source or _is_mcp_admitted_user_subject(user_api_key_auth)) else None + + @staticmethod + async def _apply_agent_and_org_tool_ceilings( + allowed_tools: list[str] | None, + server_id: str, + user_api_key_auth: UserAPIKeyAuth, + keyless_source: bool = False, + ) -> list[str] | None: + """Narrow a key/team tool allowlist by the agent's tool permissions and the caller's org tool + ceiling. Each level only intersects; None at a level means no restriction from it. + + An UNRESOLVABLE org ceiling is decided per caller shape, mirroring the servers axis: a key stays + fail-open (skip the org step, keep the key/team/agent restrictions; letting the raise escape + would collapse them to allow-all, WIDER than before the fault), while a keyless source re-raises + so the outer handler denies that one source (its only org bound is this ceiling).""" + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( + global_mcp_server_manager, + ) + + if user_api_key_auth.agent_id: + # Pre-fetch agent object_permission once to avoid a duplicate DB query. + agent_obj_perm = await MCPRequestHandler._get_agent_object_permission(user_api_key_auth) + agent_tools = await MCPRequestHandler._get_agent_tool_permissions_for_server( + server_id=server_id, + user_api_key_auth=user_api_key_auth, + agent_object_permission=agent_obj_perm, + ) + if agent_tools is not None: + allowed_tools = ( + list(set(allowed_tools) & set(agent_tools)) if allowed_tools is not None else agent_tools + ) + + if user_api_key_auth.org_id: + # _get_org_object_permission uses user_api_key_cache, so this is not a fresh DB round-trip + # when get_allowed_mcp_servers was already called. + try: + org_obj_perm = await MCPRequestHandler._get_org_object_permission(user_api_key_auth) + except Exception as e: # noqa: BLE001 # unresolvable org ceiling, decided per caller shape + if keyless_source: + raise + verbose_logger.warning( + f"MCP org tool ceiling unresolvable for org_id={user_api_key_auth.org_id!r}; " + f"skipping org intersect, key/team/agent restrictions stand: {str(e)}" + ) + return allowed_tools + org_tools = ( + global_mcp_server_manager.expand_tool_permissions(org_obj_perm.mcp_tool_permissions).get(server_id) + if org_obj_perm and org_obj_perm.mcp_tool_permissions + else None + ) + if org_tools is not None: + allowed_tools = ( + list(set(allowed_tools) & set(org_tools)) if allowed_tools is not None else list(org_tools) + ) + + return allowed_tools @staticmethod async def is_tool_allowed_for_server( @@ -1060,8 +2049,18 @@ class MCPRequestHandler: global_mcp_server_manager.expand_tool_permissions(key_object_permission.mcp_tool_permissions).keys() ) + # servers referenced by the key's toolset grants are part of the key's + # scope on every path (list, call, REST), subject to the same team/org + # ceilings as any other key-level grant + toolset_ids = key_object_permission.mcp_toolsets or [] + toolset_servers = ( + list((await global_mcp_server_manager.resolve_toolset_tool_permissions(toolset_ids=toolset_ids)).keys()) + if toolset_ids + else [] + ) + # Combine all lists - all_servers = direct_mcp_servers + access_group_servers + tool_perm_servers + all_servers = direct_mcp_servers + access_group_servers + tool_perm_servers + toolset_servers return list(set(all_servers)) except Exception as e: verbose_logger.warning(f"Failed to get allowed MCP servers for key: {str(e)}") @@ -1069,10 +2068,96 @@ class MCPRequestHandler: @staticmethod async def _get_allowed_mcp_servers_for_team( - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - ) -> List[str]: + user_api_key_auth: UserAPIKeyAuth | None = None, + ) -> list[str]: + """Get allowed MCP servers a caller inherits from the team it is pinned to. + + Exactly one team, or none. A subject that reaches servers through SEVERAL teams does not + fan out here: it is resolved one source per team in ``_resolve_admitted_subject_servers``, + and each of those sources pins a single ``team_id`` before reaching this point. Keeping the + fan-out here as well would be a second multi-team path to drift from that one. """ - Get allowed MCP servers for a team. + team_ids = await MCPRequestHandler._team_ids_for_mcp_grant(user_api_key_auth) + if not team_ids: + return [] + return await MCPRequestHandler._allowed_mcp_servers_for_single_team(team_ids[0], user_api_key_auth) + + @staticmethod + async def _team_ids_for_mcp_grant(user_api_key_auth: UserAPIKeyAuth | None) -> list[str]: + """The team ids whose MCP grants a caller inherits. + + A caller with an explicit ``team_id`` uses that single team; every other caller inherits no + team grants. That covers key auth and JWT auth (a keyless ``user_id`` auth with no team_id, + which must NOT silently gain the union across every team the user belongs to), and it covers + each single-source auth an admitted subject fans out into — those pin a team_id, so they land + on the first branch. The admitted subject itself never reaches here: it resolves per source + in ``_resolve_admitted_subject_servers`` before this point. The ``UI_TEAM_ID`` sentinel + resolves to no teams exactly as before.""" + if user_api_key_auth is None or not user_api_key_auth.team_id: + return [] + return [] if user_api_key_auth.team_id == UI_TEAM_ID else [user_api_key_auth.team_id] + + @staticmethod + async def _resolve_user_team_ids(user_id: str, user_api_key_auth: UserAPIKeyAuth) -> list[str]: + """The distinct team ids a user belongs to, from the live user record. Returns [] on + no DB, a missing user, or any resolution failure so a lookup blip narrows access + rather than raising; the caller's direct grants still apply.""" + from litellm.proxy.auth.auth_checks import get_user_object + from litellm.proxy.proxy_server import ( + prisma_client, + proxy_logging_obj, + user_api_key_cache, + ) + + if prisma_client is None: + return [] + try: + user_object = await get_user_object( + user_id=user_id, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + user_id_upsert=False, + parent_otel_span=user_api_key_auth.parent_otel_span, + proxy_logging_obj=proxy_logging_obj, + ) + except Exception as e: # noqa: BLE001 # a team-resolution blip narrows access, never raises + verbose_logger.warning(f"Failed to resolve user teams for MCP grant: {str(e)}") + return [] + if user_object is None or not user_object.teams: + return [] + return list(dict.fromkeys(t for t in user_object.teams if t and t != UI_TEAM_ID)) + + @staticmethod + async def _team_granted_servers(team_obj: LiteLLM_TeamTable, team_access_group_servers: list[str]) -> set[str]: + """The raw MCP-server set a team grants (before any org ceiling): its object_permission (direct + ``mcp_servers``, the ``all_proxy_servers`` sentinel → the full registry, legacy access groups, + tool-perm-referenced servers) unioned with its unified ``access_group_ids`` servers.""" + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( + global_mcp_server_manager, + ) + + object_permissions = team_obj.object_permission + if object_permissions is None: + return set(team_access_group_servers) + if SpecialMCPServerName.all_proxy_servers.value in (object_permissions.mcp_servers or []): + return set(global_mcp_server_manager.get_registry().keys()) + legacy_access_group_servers = await MCPRequestHandler._get_mcp_servers_from_access_groups( + object_permissions.mcp_access_groups or [] + ) + return ( + set(global_mcp_server_manager.expand_permission_list(object_permissions.mcp_servers or [])) + | set(legacy_access_group_servers) + | set(global_mcp_server_manager.expand_tool_permissions(object_permissions.mcp_tool_permissions).keys()) + | set(team_access_group_servers) + ) + + @staticmethod + async def _allowed_mcp_servers_for_single_team( + team_id: str, + user_api_key_auth: UserAPIKeyAuth | None, + ) -> list[str]: + """Allowed MCP servers granted by ONE team (its raw grant, then capped by the team's own org + for a keyless admitted subject). Unions two sources: - Legacy team.object_permission (mcp_servers, mcp_access_groups, @@ -1083,9 +2168,6 @@ class MCPRequestHandler: the gate (no assigned_team_ids check needed here). """ try: - from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( - global_mcp_server_manager, - ) from litellm.proxy.auth.auth_checks import ( _get_mcp_server_ids_from_access_groups, get_team_object, @@ -1096,22 +2178,24 @@ class MCPRequestHandler: user_api_key_cache, ) - if user_api_key_auth is None or not user_api_key_auth.team_id or prisma_client is None: + if not team_id or team_id == UI_TEAM_ID or prisma_client is None: return [] - if user_api_key_auth.team_id == UI_TEAM_ID: - return [] - - team_obj: Optional[LiteLLM_TeamTable] = await get_team_object( - team_id=user_api_key_auth.team_id, + parent_otel_span = user_api_key_auth.parent_otel_span if user_api_key_auth is not None else None + team_obj: LiteLLM_TeamTable | None = await get_team_object( + team_id=team_id, prisma_client=prisma_client, user_api_key_cache=user_api_key_cache, - parent_otel_span=user_api_key_auth.parent_otel_span, + parent_otel_span=parent_otel_span, proxy_logging_obj=proxy_logging_obj, ) if team_obj is None: return [] - + if team_obj.blocked: + # A blocked team grants nothing. The central policy gate enforces this for a key + # pinned to a single team_id, but a keyless admitted identity (no team_id) unions + # across all of its teams and would otherwise inherit a blocked team's MCP grants. + return [] team_access_group_servers = await _get_mcp_server_ids_from_access_groups( access_group_ids=team_obj.access_group_ids or [], prisma_client=prisma_client, @@ -1119,27 +2203,8 @@ class MCPRequestHandler: proxy_logging_obj=proxy_logging_obj, ) - object_permissions = team_obj.object_permission - if object_permissions is None: - return list(set(team_access_group_servers)) - - if SpecialMCPServerName.all_proxy_servers.value in (object_permissions.mcp_servers or []): - return list(global_mcp_server_manager.get_registry().keys()) - - direct_mcp_servers = global_mcp_server_manager.expand_permission_list(object_permissions.mcp_servers or []) - - legacy_access_group_servers = await MCPRequestHandler._get_mcp_servers_from_access_groups( - object_permissions.mcp_access_groups or [] - ) - - tool_perm_servers = list( - global_mcp_server_manager.expand_tool_permissions(object_permissions.mcp_tool_permissions).keys() - ) - - all_servers = ( - direct_mcp_servers + legacy_access_group_servers + tool_perm_servers + team_access_group_servers - ) - return list(set(all_servers)) + servers = await MCPRequestHandler._team_granted_servers(team_obj, team_access_group_servers) + return list(servers) except Exception as e: verbose_logger.warning(f"Failed to get allowed MCP servers for team: {str(e)}") return [] @@ -1153,7 +2218,11 @@ class MCPRequestHandler: ``get_object_permission`` helpers so MCP requests share the same ``user_api_key_cache`` entries as the rest of the proxy. """ - from litellm.proxy.auth.auth_checks import get_object_permission, get_org_object + from litellm.proxy.auth.auth_checks import ( + OrganizationNotFoundError, + get_object_permission, + get_org_object, + ) from litellm.proxy.proxy_server import ( prisma_client, proxy_logging_obj, @@ -1167,6 +2236,8 @@ class MCPRequestHandler: verbose_logger.debug("prisma_client is None") return None + # A team's organization_id can point at a deleted or not-yet-synced row; get_org_object raises + # OrganizationNotFoundError for that. That is a determinate ABSENCE (no ceiling), handled below. try: org_obj = await get_org_object( org_id=user_api_key_auth.org_id, @@ -1175,21 +2246,32 @@ class MCPRequestHandler: parent_otel_span=user_api_key_auth.parent_otel_span, proxy_logging_obj=proxy_logging_obj, ) - - if org_obj is None or not org_obj.object_permission_id: - return None - - return await get_object_permission( - object_permission_id=org_obj.object_permission_id, - prisma_client=prisma_client, - user_api_key_cache=user_api_key_cache, - parent_otel_span=user_api_key_auth.parent_otel_span, - proxy_logging_obj=proxy_logging_obj, - ) - except Exception as e: - verbose_logger.warning(f"Failed to get org object permission: {str(e)}") + except OrganizationNotFoundError as e: + # CONFIRMED absent: places no ceiling. Every OTHER exception propagates as an unresolvable + # ceiling (denies for a keyless source, fail-open for a key); catching bare Exception here + # would treat a DB outage as "no org" and silently drop a real ceiling for its duration. + verbose_logger.debug(f"MCP org ceiling: org {user_api_key_auth.org_id!r} does not exist: {e}") return None + if org_obj is None or not org_obj.object_permission_id: + return None + + # The org NAMES a permission; failing to read it is INDETERMINATE and must not collapse into the + # None that means "no ceiling". Raise and let each caller pick fail-open or fail-closed. + object_permission = await get_object_permission( + object_permission_id=org_obj.object_permission_id, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + parent_otel_span=user_api_key_auth.parent_otel_span, + proxy_logging_obj=proxy_logging_obj, + ) + if object_permission is None: + raise ValueError( + f"org {user_api_key_auth.org_id!r} names object_permission_id " + f"{org_obj.object_permission_id!r} which could not be loaded" + ) + return object_permission + @staticmethod async def _get_allowed_mcp_servers_for_org( user_api_key_auth: Optional[UserAPIKeyAuth] = None, @@ -1224,8 +2306,10 @@ class MCPRequestHandler: all_servers = direct_mcp_servers + access_group_servers + tool_perm_servers return list(set(all_servers)) except Exception as e: + # None = ceiling UNRESOLVED, distinct from [] = org places no restriction. Collapsing them + # let a DB fault silently drop a ceiling; the caller picks fail-open/closed from this signal. verbose_logger.warning(f"Failed to get allowed MCP servers for org: {str(e)}") - return [] + return None @staticmethod async def _get_allowed_mcp_servers_for_end_user( diff --git a/litellm/proxy/_experimental/mcp_server/bridge_token_flow.py b/litellm/proxy/_experimental/mcp_server/bridge_token_flow.py new file mode 100644 index 00000000000..19048e2eb7c --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/bridge_token_flow.py @@ -0,0 +1,694 @@ +"""Bridge token flow: litellm identity resolution and the DCR-bridge oauth_delegate mint/refresh pipeline.""" + +import math +from dataclasses import dataclass +from datetime import datetime, timezone +from typing import TYPE_CHECKING, Literal, Optional + +from fastapi import HTTPException, Request +from fastapi.responses import JSONResponse +from pydantic import SecretStr +from typing_extensions import assert_never + +from litellm._logging import verbose_logger +from litellm.proxy._experimental.mcp_server.oauth_utils import TOKEN_NO_CACHE_HEADERS +from litellm.types.mcp_server.mcp_server_manager import MCPServer + +if TYPE_CHECKING: + from litellm.proxy._experimental.mcp_server.discoverable_endpoints import _BridgeAuthorizationCode + from litellm.proxy._experimental.mcp_server.outbound_credentials.envelope import ( + EnvelopeIdentity, + EnvelopeKeys, + RefreshCredential, + UpstreamTokenGrant, + ) + from litellm.proxy._types import UserAPIKeyAuth + + +def _litellm_key_from_request(request: Request) -> Optional[str]: + """Return the LiteLLM API key presented on the request, or ``None``. + + Accepts the key from ``x-litellm-api-key`` (what MCP clients such as Claude Desktop/Code + send) as well as ``Authorization``; either may carry a bare token or ``Bearer ``. + ``x-litellm-api-key`` wins when both are present, since ``Authorization`` may instead carry + an OAuth/upstream bearer. + """ + for header_value in ( + request.headers.get("x-litellm-api-key"), + request.headers.get("Authorization") or request.headers.get("authorization"), + ): + if not header_value: + continue + value = header_value.strip() + if value.lower().startswith("bearer "): + value = value[7:].strip() + if value: + return value + return None + + +def _key_is_active(key_obj: "UserAPIKeyAuth") -> bool: + """``True`` when the presented key is neither blocked nor past its expiry. + + The OAuth token endpoint is unauthenticated, so the presented key is validated here before it is + trusted; a revoked or expired key must not mint a bridge envelope or write a stored credential. + ``get_key_object`` resolves a row without these checks (the main ``user_api_key_auth`` pipeline + enforces them downstream, which this endpoint bypasses), so they are applied here. Deleted keys + are already rejected upstream, where ``get_key_object`` raises on a row that no longer exists. + + This is an active-state gate only; it deliberately does not require a ``user_id``. A valid + team-scoped or service-account key has no ``user_id`` yet is a legitimate credential, so gating + on ``user_id`` presence would wrongly reject it. Callers that need the user (the per-user token + store) derive it separately via :func:`_active_key_user_id`. + + Total by design: ``expires`` is typed ``str | datetime``, and an unparseable string would make + ``datetime.fromisoformat`` raise. Since the callers run this outside their key-resolution + ``try``, an uncaught parse error would surface as a 500 instead of the endpoint's fail-closed + behavior, so a malformed expiry is treated as inactive (return ``False``) rather than raising. + """ + if key_obj.blocked is True: + return False + expires = key_obj.expires + if expires is not None: + if isinstance(expires, datetime): + expiry = expires + else: + try: + expiry = datetime.fromisoformat(expires) + except (ValueError, TypeError): + return False + if expiry.tzinfo is None or expiry.tzinfo.utcoffset(expiry) is None: + expiry = expiry.replace(tzinfo=timezone.utc) + if expiry < datetime.now(timezone.utc): + return False + return True + + +def _active_key_user_id(key_obj: "UserAPIKeyAuth") -> str | None: + """The active key's ``user_id``, or ``None`` when the key is blocked/expired or simply has no + ``user_id`` (a team-scoped or service-account key). Used only by the per-user token store, which + needs a user to key the stored credential; the bridge mint uses the key hash and does not.""" + return key_obj.user_id if _key_is_active(key_obj) else None + + +@dataclass(frozen=True, slots=True) +class _ResolvedKey: + """An active litellm key resolved from the token request: its hash (the value ``get_key_object`` + and the cache/DB layer key the record by) and the live record.""" + + key_hash: str + key: "UserAPIKeyAuth" + + +_KeyResolutionFailure = Literal["no_active_key", "unavailable", "unresolvable"] +"""Why a token request yielded no active litellm key, kept distinct so a caller statuses each truthfully +instead of blaming the client for a gateway problem: +- ``no_active_key``: none was presented, or the presented key is unknown / blocked / expired (the + caller's request is at fault) +- ``unavailable``: the auth database was transiently unreachable while resolving (retryable) +- ``unresolvable``: the gateway cannot resolve identity right now (no DB connection, or an unexpected + error) -- a gateway fault, not the caller's +The classification mirrors admission's ``_reload_admitted_key`` so the mint (ingress) and admission +(egress) never disagree on the status of the same outage.""" + + +async def _resolve_active_litellm_key(request: Request) -> "_ResolvedKey | _KeyResolutionFailure": + """Resolve the presented litellm key to an active key record, or say precisely why not. + + Single resolution path the OAuth token endpoint reuses, resolving authoritatively via + ``get_key_object`` (cache first, then DB). The failure is a value, not a bare ``None``, so a caller + can tell "the client sent no usable credential" (a request error) apart from "the gateway could not + check" (an infrastructure error) and status each truthfully; collapsing both to ``None`` is what let + a DB outage read as a 400. A resolved key is still gated by ``_key_is_active``, so a blocked or + expired key is ``no_active_key`` while a valid team-scoped or service-account key (no ``user_id``) + resolves. Classification mirrors admission's ``_reload_admitted_key``: no DB connection is a gateway + fault, a ``ProxyException`` / ``HTTPException`` from ``get_key_object`` is an unknown or invalid key, + a database-service-unavailable error is a retryable outage, and anything else is an unexpected + gateway fault.""" + token = _litellm_key_from_request(request) + if not token: + return "no_active_key" + from litellm.proxy._types import hash_token # noqa: PLC0415 # inline import avoids a module-load circular import + + return await _reload_active_key_by_hash(hash_token(token)) + + +async def _reload_active_key_by_hash(key_hash: str) -> "_ResolvedKey | _KeyResolutionFailure": + """Reload the live key record for ``key_hash`` (cache first, then DB) and gate it on active state, + returning the resolved key or a precise failure. Shared by the token request's presented-key + resolution (:func:`_resolve_active_litellm_key`, which hashes the presented key) and the refresh + path (which already holds the hash sealed in the refresh envelope), so both re-validate identity + through one active-key gate and one failure classification. Classification mirrors admission's + ``_reload_admitted_key``: no DB connection is a gateway fault, a ``ProxyException`` / ``HTTPException`` + from ``get_key_object`` is an unknown or invalid key, a database-service-unavailable error is a + retryable outage, and anything else is an unexpected gateway fault. A blocked or expired key is + ``no_active_key``, so a revoked key can neither mint nor refresh a bridge envelope.""" + from litellm.proxy._types import ( + ProxyException, # noqa: PLC0415 # inline import avoids a module-load circular import + ) + from litellm.proxy.auth.auth_checks import ( # noqa: PLC0415 # inline import avoids a module-load circular import + get_key_object, + ) + from litellm.proxy.db.exception_handler import ( # noqa: PLC0415 # inline import avoids a module-load circular import + PrismaDBExceptionHandler, + ) + from litellm.proxy.proxy_server import ( # noqa: PLC0415 # inline import avoids a module-load circular import + prisma_client, + user_api_key_cache, + ) + + if prisma_client is None: + return "unresolvable" + try: + key_obj = await get_key_object( + hashed_token=key_hash, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + ) + except (ProxyException, HTTPException): + return "no_active_key" + except Exception as exc: # noqa: BLE001 # classify: a DB outage is retryable, anything else is an opaque gateway fault + if PrismaDBExceptionHandler.is_database_service_unavailable_error(exc): + return "unavailable" + verbose_logger.debug( + "_reload_active_key_by_hash: unexpected key-resolution error (%s)", + type(exc).__name__, + ) + return "unresolvable" + if not _key_is_active(key_obj): + return "no_active_key" + return _ResolvedKey(key_hash=key_hash, key=key_obj) + + +async def _reload_active_user_by_id(user_id: str) -> "_KeyResolutionFailure | None": + """Re-validate a live litellm user by id, returning ``None`` when the user is active or a precise + failure otherwise. The interactive DCR client authenticates via SSO, so its refresh envelope seals a + user subject; renewing it must re-check the user is still live (present and not SCIM-deactivated) so a + deactivated user cannot keep refreshing, mirroring how admission re-validates the same user subject on + the egress side. No DB connection is a gateway fault (``unresolvable``) and a + database-service-unavailable error is a retryable outage (``unavailable``). Everything else fails + closed as ``no_active_key`` (the caller maps it to invalid_grant): a ``ProxyException`` / + ``HTTPException``, a SCIM-deactivated user, and, unlike the key path, a missing user. ``get_user_object`` + catches every DB failure and re-raises a bare ``ValueError`` (a deleted user and a real outage look + identical, the original error surviving only as ``__context__``), so the outage check walks the cause + chain, and a missing user falls through to ``no_active_key`` rather than an opaque gateway fault.""" + from litellm.proxy._types import ( + ProxyException, # noqa: PLC0415 # inline import avoids a module-load circular import + ) + from litellm.proxy.auth.auth_checks import ( # noqa: PLC0415 # inline import avoids a module-load circular import + get_user_object, + ) + from litellm.proxy.db.exception_handler import ( # noqa: PLC0415 # inline import avoids a module-load circular import + PrismaDBExceptionHandler, + ) + from litellm.proxy.proxy_server import ( # noqa: PLC0415 # inline import avoids a module-load circular import + prisma_client, + user_api_key_cache, + ) + + if prisma_client is None: + return "unresolvable" + try: + user_object = await get_user_object( + user_id=user_id, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + user_id_upsert=False, + ) + except (ProxyException, HTTPException): + return "no_active_key" + except Exception as exc: # noqa: BLE001 # a DB outage is retryable; a missing user (get_user_object's wrapped ValueError) or any other resolution failure fails closed as no_active_key, never a 500 + if PrismaDBExceptionHandler.is_database_service_unavailable_error_in_chain(exc): + return "unavailable" + verbose_logger.debug("_reload_active_user_by_id: user-resolution error (%s)", type(exc).__name__) + return "no_active_key" + if user_object is None: + return "no_active_key" + if isinstance(user_object.metadata, dict) and user_object.metadata.get("scim_active") is False: + return "no_active_key" + return None + + +async def _key_owner_scim_deactivated(key: "UserAPIKeyAuth") -> bool: + """True only when the key's owning user was explicitly SCIM-deactivated, so a refresh revokes an + offboarded owner's key exactly as admission does via ``_reject_if_admitted_owner_scim_deactivated``. + A key with no owner, a missing owner record, or a failed lookup fails OPEN (returns ``False``), + matching admission and the standard builder: a key may outlive its owner record, and a transient DB + blip must not revoke a live key. Only an explicit ``scim_active`` of ``False`` gates renewal.""" + if key.user_id is None: + return False + from litellm.proxy.auth.auth_checks import ( # noqa: PLC0415 # inline import avoids a module-load circular import + get_user_object, + ) + from litellm.proxy.proxy_server import ( # noqa: PLC0415 # inline import avoids a module-load circular import + prisma_client, + user_api_key_cache, + ) + + if prisma_client is None: + return False + try: + owner = await get_user_object( + user_id=key.user_id, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + user_id_upsert=False, + ) + except Exception as exc: # noqa: BLE001 # fail open: a missing owner (get_user_object's wrapped ValueError) or a DB blip must not revoke a live key + verbose_logger.debug("refresh: key-owner SCIM lookup failed, not revoking (%s)", type(exc).__name__) + return False + return owner is not None and isinstance(owner.metadata, dict) and owner.metadata.get("scim_active") is False + + +async def _revalidate_active_subject(identity: "EnvelopeIdentity") -> "_KeyResolutionFailure | None": + """Re-validate that the subject sealed in a refresh envelope is still live, dispatching on its type: + a key_hash reloads the virtual key, a user_id reloads the user. Returns ``None`` when the subject is + active or a precise failure otherwise, so revocation gates renewal for either identity source the same + way admission gates the egress: a blocked or expired key, a SCIM-deactivated key owner (mirroring + admission's owner check, so an offboarded user cannot keep renewing a still-active key), and a + deactivated or deleted user all fail closed to ``no_active_key``.""" + match identity.subject_type: + case "key_hash": + reloaded = await _reload_active_key_by_hash(identity.subject) + if not isinstance(reloaded, _ResolvedKey): + return reloaded + if await _key_owner_scim_deactivated(reloaded.key): + return "no_active_key" + return None + case "user_id": + return await _reload_active_user_by_id(identity.subject) + case _: + assert_never(identity.subject_type) + + +async def _extract_user_id_from_request(request: Request) -> str | None: + """The litellm ``user_id`` for the token request, so a per-user token is stored under the same + identity the egress later reads it by. Storage is best-effort, so every non-resolved outcome + (including a transient DB outage) collapses to ``None`` here and the caller simply skips the store; + the bridge mint, which must status those outcomes differently, consumes + :func:`_resolve_active_litellm_key` directly.""" + resolved = await _resolve_active_litellm_key(request) + if not isinstance(resolved, _ResolvedKey): + return None + return _active_key_user_id(resolved.key) + + +_UpstreamGrantRejection = Literal["no_access_token", "expired_lifetime"] +"""Why an upstream token response cannot back a bridge envelope: +- ``no_access_token``: the response carries no usable ``access_token`` +- ``expired_lifetime``: the response reports a parseable, non-positive ``expires_in``, i.e. an upstream + token that is already dead, so sealing it would forward a bearer the edge cannot use +An absent or unparseable ``expires_in`` is NOT a rejection; the lifetime is merely unknown and the +envelope caps it, the by-design behaviour for an upstream that omits the field.""" + + +def _classify_upstream_lifetime(raw_expires_in: object) -> "int | Literal['unspecified', 'expired']": + """Classify an upstream ``expires_in`` into a positive number of seconds, ``"unspecified"`` (absent + or unparseable, so the envelope caps it), or ``"expired"`` (a non-positive value the upstream reports + as already elapsed). Telling "we do not know the lifetime" apart from "the upstream says it is + already dead" is what stops an explicitly-expired token from silently receiving the envelope's 1h + cap. The expired decision is made on the parsed numeric value, not on ``int(...)`` of it, so a + positive sub-second lifetime in ``(0, 1)`` is not truncated to ``0`` and misread as elapsed; the + envelope works in whole seconds, so such a lifetime clamps up to its 1s floor. ``bool`` is excluded + (an ``int`` subclass but never a real lifetime), and the conversions can raise on ``NaN`` / + ``Infinity`` / oversized input, which reads as unparseable rather than surfacing as a 500.""" + if raw_expires_in is None or isinstance(raw_expires_in, bool) or not isinstance(raw_expires_in, (int, float, str)): + return "unspecified" + try: + numeric = float(raw_expires_in) + seconds = int(numeric) + except (ValueError, TypeError, OverflowError): + return "unspecified" + if numeric <= 0: + return "expired" + return max(1, seconds) + + +def _bridge_grant_from_token_response(token_response: object) -> "UpstreamTokenGrant | _UpstreamGrantRejection": + """Validate an upstream OAuth token response into a typed grant, or say why it cannot back an + envelope. Each field is isinstance-checked so nothing untyped from ``response.json()`` reaches the + grant. ``expires_in`` is read three ways (see :func:`_classify_upstream_lifetime`): an unknown + lifetime leaves the grant ``expires_in`` ``None`` for the envelope to cap, a positive value is + honoured, and an explicit already-elapsed value is a rejection rather than a silent fall-through to + the cap.""" + from litellm.proxy._experimental.mcp_server.outbound_credentials.envelope import ( # noqa: PLC0415 # inline import avoids a module-load circular import + UpstreamTokenGrant, + ) + + if not isinstance(token_response, dict): + return "no_access_token" + access = token_response.get("access_token") + if not isinstance(access, str) or not access: + return "no_access_token" + lifetime = _classify_upstream_lifetime(token_response.get("expires_in")) + if lifetime == "expired": + return "expired_lifetime" + token_type = token_response.get("token_type") + scope = token_response.get("scope") + return UpstreamTokenGrant( + access_token=SecretStr(access), + token_type=token_type if isinstance(token_type, str) and token_type else "Bearer", + # The upstream refresh_token is deliberately NOT sealed: the edge never consumes it (it forwards + # only token_type + access_token), so it would be dead weight embedding a long-lived upstream + # credential in the client-held bearer, and it enlarges the envelope. Refresh support is a + # follow-up (a dedicated refresh-envelope); the client re-runs authorization_code at the cap. + refresh_token=None, + scope=scope if isinstance(scope, str) and scope else None, + expires_in=lifetime if isinstance(lifetime, int) else None, + ) + + +# --------------------------------------------------------------------------- +# DCR-bridge oauth_delegate mint: a three-phase pipeline whose failures are values. +# +# prepare (before the upstream exchange) -> validate every precondition and resolve identity+keys +# exchange (the single-use upstream code is consumed here, in exchange_token_with_server) +# finish (after the exchange) -> seal the upstream grant into the client-held envelope +# +# Every precondition lives in ``prepare``, which runs BEFORE the exchange, so no failure can burn the +# single-use code or rotate a refresh token, for either grant type -- that whole class of bug is gone +# by construction rather than guarded case by case. Failures are values mapped to an OAuth-shaped +# response in one place (``_bridge_mint_error_response``), so status codes and the RFC 6749 §5.2 body +# shape are uniform. Adding a failure mode is a new literal plus a match arm the type checker forces. +# --------------------------------------------------------------------------- + +_BridgeMintError = Literal[ + "no_identity", + "invalid_refresh", + "identity_unavailable", + "identity_unresolvable", + "not_configured", + "no_upstream_token", + "upstream_token_expired", + "too_large", +] + + +@dataclass(frozen=True, slots=True) +class _BridgeMintReady: + """Everything the seal needs, resolved once before the exchange: the identity to bind the envelope + to and the master-key-derived envelope keys. The identity is a key_hash subject for the scripted + two-header client (resolved from the litellm key it presents) or a user_id subject for the + interactive SSO client (the user recovered from the gateway authorization code), so one phase-3 seal + serves both. Resolving identity here means ``_finish_bridge_mint`` has no preconditions left to + fail.""" + + identity: "EnvelopeIdentity" + keys: "EnvelopeKeys" + + +def _bridge_mint_error_response(error: _BridgeMintError) -> JSONResponse: + """Map a bridge-mint failure value to its token-endpoint response: one place, RFC 6749 §5.2 shape + (top-level ``error``, no-store headers) for every case, with a status truthful about where the + failure is. The caller's request is 400, a transient gateway outage is 503, a gateway + misconfiguration is 500, and an upstream problem is 502. The identity-resolution statuses match how + admission statuses the same conditions on the egress side, so mint and admit never disagree under + one outage.""" + match error: + case "no_identity": + status, code, desc = ( + 400, + "invalid_request", + "this server issues a gateway-bound credential; complete the interactive sign-in, or " + "send a litellm credential (x-litellm-api-key or Authorization) on the token request", + ) + case "invalid_refresh": + status, code, desc = ( + 400, + "invalid_grant", + "the refresh credential is not a valid, live refresh envelope for this server; " + "re-run authorization_code to obtain a new one", + ) + case "identity_unavailable": + status, code, desc = ( + 503, + "temporarily_unavailable", + "the authentication database is temporarily unreachable; retry shortly", + ) + case "identity_unresolvable": + status, code, desc = ( + 500, + "server_error", + "the gateway could not resolve the litellm identity for this request", + ) + case "not_configured": + status, code, desc = ( + 500, + "server_error", + "the gateway is not configured to mint a gateway-bound credential (master_key is not set)", + ) + case "no_upstream_token": + status, code, desc = ( + 502, + "server_error", + "the upstream token response has no usable access_token", + ) + case "upstream_token_expired": + status, code, desc = ( + 502, + "server_error", + "the upstream token response reports an already-expired lifetime", + ) + case "too_large": + status, code, desc = ( + 502, + "server_error", + "the upstream token is too large to seal into a gateway-bound credential", + ) + case _: + assert_never(error) + return JSONResponse( + status_code=status, content={"error": code, "error_description": desc}, headers=TOKEN_NO_CACHE_HEADERS + ) + + +def _key_resolution_failure_to_mint_error(failure: _KeyResolutionFailure) -> _BridgeMintError: + """Lift an identity-resolution failure into the mint taxonomy, preserving origin so the status stays + truthful: the caller's missing credential is 400, a transient DB outage is 503, and a gateway that + cannot resolve identity is 500.""" + match failure: + case "no_active_key": + return "no_identity" + case "unavailable": + return "identity_unavailable" + case "unresolvable": + return "identity_unresolvable" + case _: + assert_never(failure) + + +def _upstream_rejection_to_mint_error(rejection: _UpstreamGrantRejection) -> _BridgeMintError: + """Lift an upstream-response rejection into the mint taxonomy; both are upstream faults (502).""" + match rejection: + case "no_access_token": + return "no_upstream_token" + case "expired_lifetime": + return "upstream_token_expired" + case _: + assert_never(rejection) + + +async def _prepare_bridge_mint( + request: Request, + mcp_server: MCPServer, + bridge_identity: "_BridgeAuthorizationCode | None" = None, +) -> "_BridgeMintReady | _BridgeMintError": + """Phase 1 for the authorization_code grant, BEFORE the upstream exchange: confirm the gateway can + mint (master_key set), resolve the litellm identity, and derive the envelope keys. Returns a ready + context or a precise failure value. Running before the exchange is what makes every failure here fail + closed without consuming the single-use code. + + Two identity sources, one envelope. The interactive DCR client authenticates via SSO at the bridged + authorize, so its identity arrives as ``bridge_identity`` (the user recovered from the gateway + authorization code) and mints a user subject. The scripted two-header client presents a litellm key + on the token request instead, so its identity is the active key's hash and mints a key_hash subject. + A missing or invalid presented key keeps its resolution origin so the mapper statuses it truthfully; + neither source present is ``no_identity``. The refresh_token grant has its own phase-1 + (:func:`_prepare_bridge_refresh`), which recovers identity from the presented refresh envelope.""" + from litellm.proxy._experimental.mcp_server.outbound_credentials.bridge_credentials import ( # noqa: PLC0415 # inline import avoids a module-load circular import + envelope_keys_from_master_key, + ) + from litellm.proxy._experimental.mcp_server.outbound_credentials.envelope import ( # noqa: PLC0415 # inline import avoids a module-load circular import + key_hash_identity, + user_identity, + ) + from litellm.proxy.proxy_server import ( # noqa: PLC0415 # inline import avoids a module-load circular import + master_key, + ) + + if not master_key: + return "not_configured" + keys = envelope_keys_from_master_key(master_key) + if bridge_identity is not None: + identity = user_identity(server_id=mcp_server.server_id, user_id=bridge_identity.litellm_user_id) + return _BridgeMintReady(identity=identity, keys=keys) + resolved = await _resolve_active_litellm_key(request) + if not isinstance(resolved, _ResolvedKey): + return _key_resolution_failure_to_mint_error(resolved) + identity = key_hash_identity(server_id=mcp_server.server_id, key_hash=resolved.key_hash) + return _BridgeMintReady(identity=identity, keys=keys) + + +@dataclass(frozen=True, slots=True) +class _BridgeRefreshReady: + """A validated refresh request: the identity+keys to mint the renewed pair under, the upstream refresh + token (unwrapped from the client's refresh envelope) to exchange with the upstream IdP, and the scope + sealed alongside it at mint. The upstream refresh token is a ``SecretStr`` like every other credential + in this layer, so a repr or a traceback that captures this value never exposes the raw upstream refresh + token in plaintext. ``upstream_scope`` carries the originally-granted scope so the renewal re-requests + it when the client (a DCR/MCP client that typically omits scope on refresh) sends none, keeping the + renewed token's scope stable against an upstream that would otherwise narrow or drop it.""" + + ready: "_BridgeMintReady" + upstream_refresh_token: SecretStr + upstream_scope: str | None = None + + +def _refresh_key_failure_to_mint_error(failure: _KeyResolutionFailure) -> _BridgeMintError: + """Lift an identity-resolution failure on the refresh path into the mint taxonomy. Unlike the mint + path, a resolved-but-inactive (or unknown) key is ``invalid_grant`` rather than ``invalid_request``: + the client did present an identity (sealed in the refresh envelope), but it is no longer live, so the + refresh is invalid and the client must re-authenticate. A transient outage is still 503 and a gateway + fault still 500, matching the mint path and admission.""" + match failure: + case "no_active_key": + return "invalid_refresh" + case "unavailable": + return "identity_unavailable" + case "unresolvable": + return "identity_unresolvable" + case _: + assert_never(failure) + + +async def _prepare_bridge_refresh( + mcp_server: MCPServer, refresh_value: str | None +) -> "_BridgeRefreshReady | _BridgeMintError": + """Phase 1 for the refresh_token grant, BEFORE the upstream exchange: open the client's refresh + envelope, re-validate the sealed litellm identity so a revoked key cannot keep refreshing, and + recover the upstream refresh token to exchange. Identity comes entirely from the sealed envelope, not + the HTTP request, so the request object is not needed here. The client presents a refresh envelope, + never a raw upstream refresh token, so a missing value, a non-envelope, an unopenable envelope, or one + minted for another server is ``invalid_grant``. Running before the exchange means a rejected refresh + never consumes or rotates the upstream refresh token.""" + from litellm.proxy._experimental.mcp_server.outbound_credentials.bridge_credentials import ( # noqa: PLC0415 # inline import avoids a module-load circular import + BridgeRefreshOpened, + envelope_keys_from_master_key, + open_bridge_refresh_envelope, + ) + from litellm.proxy.proxy_server import ( # noqa: PLC0415 # inline import avoids a module-load circular import + master_key, + ) + + if not master_key: + return "not_configured" + if not refresh_value: + return "invalid_refresh" + keys = envelope_keys_from_master_key(master_key) + opened = open_bridge_refresh_envelope(refresh_value, keys, datetime.now(timezone.utc), mcp_server.server_id) + if not isinstance(opened, BridgeRefreshOpened): + return "invalid_refresh" + failure = await _revalidate_active_subject(opened.identity) + if failure is not None: + return _refresh_key_failure_to_mint_error(failure) + return _BridgeRefreshReady( + ready=_BridgeMintReady(identity=opened.identity, keys=keys), + upstream_refresh_token=opened.refresh.refresh_token, + upstream_scope=opened.refresh.scope, + ) + + +def _finish_bridge_mint( + ready: "_BridgeMintReady", mcp_server: MCPServer, token_response: object, now: datetime +) -> "JSONResponse | _BridgeMintError": + """Phase 3, AFTER the upstream exchange: seal the upstream grant into the client-held access envelope + using the pre-resolved identity and keys, and, when the upstream returned a refresh token, seal a + long-lived refresh envelope alongside it so the client can renew without re-authenticating. Shared by + the authorization_code and refresh_token paths, so a renewal that the upstream rotates re-issues a + fresh refresh envelope. The only hard failures here are properties of the upstream access token (no + usable token, an already-expired lifetime, or a token too large to seal); a refresh token that cannot + be sealed degrades to an access-only response rather than failing the whole exchange.""" + from litellm.proxy._experimental.mcp_server.outbound_credentials.bridge_credentials import ( # noqa: PLC0415 # inline import avoids a module-load circular import + build_bridge_token_response, + ) + from litellm.proxy._experimental.mcp_server.outbound_credentials.envelope import ( # noqa: PLC0415 # inline import avoids a module-load circular import + SealedEnvelope, + UpstreamTokenGrant, + ) + + grant = _bridge_grant_from_token_response(token_response) + if not isinstance(grant, UpstreamTokenGrant): + return _upstream_rejection_to_mint_error(grant) + sealed = build_bridge_token_response(ready.identity, grant, ready.keys, now) + if not isinstance(sealed, SealedEnvelope): + return "too_large" + # Report expires_in from the JWT's own second-truncated exp, rounding the elapsed portion up, so the + # client is never told the bearer lives past the point admission (which uses that exp) rejects it. + expires_in = max(0, int(sealed.expires_at.timestamp()) - math.ceil(now.timestamp())) + refresh_envelope = _mint_refresh_envelope_value(ready.identity, token_response, ready.keys, now, mcp_server) + body = { + "access_token": sealed.token.get_secret_value(), + "token_type": "Bearer", + "expires_in": expires_in, + # A refresh envelope rides along only when the upstream returned a refresh token to seal; when it + # rotates on renewal, the client receives the new one and the old envelope's upstream token dies. + **({"refresh_token": refresh_envelope} if refresh_envelope is not None else {}), + } + return JSONResponse(body, headers=TOKEN_NO_CACHE_HEADERS) + + +def _upstream_refresh_credential(token_response: object) -> "RefreshCredential | None": + """Extract the upstream refresh grant from a token response, or ``None`` when there is none to seal. + Each field is isinstance-checked so nothing untyped reaches the refresh envelope; ``refresh_expires_in`` + (the refresh token's own lifetime, when the upstream reports it) is classified like ``expires_in`` and + bounds the refresh envelope's TTL. An upstream that reports the refresh token itself as already elapsed + (``refresh_expires_in`` non-positive) yields ``None`` rather than a refresh envelope: sealing a dead + token would hand the client a full-TTL-capped envelope the IdP will reject, so the exchange degrades to + an access-only response (the client re-authenticates at access expiry), mirroring how + :func:`_bridge_grant_from_token_response` refuses an already-elapsed access token instead of capping it.""" + from litellm.proxy._experimental.mcp_server.outbound_credentials.envelope import ( # noqa: PLC0415 # inline import avoids a module-load circular import + RefreshCredential, + ) + + if not isinstance(token_response, dict): + return None + refresh = token_response.get("refresh_token") + if not isinstance(refresh, str) or not refresh: + return None + lifetime = _classify_upstream_lifetime(token_response.get("refresh_expires_in")) + if lifetime == "expired": + return None + scope = token_response.get("scope") + return RefreshCredential( + refresh_token=SecretStr(refresh), + scope=scope if isinstance(scope, str) and scope else None, + expires_in=lifetime if isinstance(lifetime, int) else None, + ) + + +def _mint_refresh_envelope_value( + identity: "EnvelopeIdentity", token_response: object, keys: "EnvelopeKeys", now: datetime, mcp_server: MCPServer +) -> str | None: + """Seal the upstream refresh grant (if any) into a refresh envelope and return its bearer string, or + ``None`` when the upstream returned no refresh token or the refresh token is too large to seal. A + too-large refresh token degrades to an access-only response (logged) rather than failing an exchange + that already succeeded upstream: the client simply re-authenticates when the access envelope expires.""" + from litellm.proxy._experimental.mcp_server.outbound_credentials.bridge_credentials import ( # noqa: PLC0415 # inline import avoids a module-load circular import + build_bridge_refresh_token_response, + ) + from litellm.proxy._experimental.mcp_server.outbound_credentials.envelope import ( # noqa: PLC0415 # inline import avoids a module-load circular import + SealedEnvelope, + ) + + refresh_credential = _upstream_refresh_credential(token_response) + if refresh_credential is None: + return None + sealed = build_bridge_refresh_token_response(identity, refresh_credential, keys, now) + if isinstance(sealed, SealedEnvelope): + return sealed.token.get_secret_value() + verbose_logger.warning( + "bridge mint: the upstream refresh token is too large to seal into a refresh envelope for " + "server=%s; issuing an access-only response, so the client re-authenticates at access expiry", + mcp_server.server_id, + ) + return None diff --git a/litellm/proxy/_experimental/mcp_server/db.py b/litellm/proxy/_experimental/mcp_server/db.py index 10081ce19de..3221f3b8dd4 100644 --- a/litellm/proxy/_experimental/mcp_server/db.py +++ b/litellm/proxy/_experimental/mcp_server/db.py @@ -2,22 +2,25 @@ import base64 import binascii import hashlib import json +from collections.abc import Awaitable, Callable, Iterable, Mapping, Sequence from datetime import datetime, timedelta, timezone -from typing import TYPE_CHECKING, Any, Dict, Iterable, List, Optional, Set, Union, cast +from typing import ( + TYPE_CHECKING, + Any, + TypedDict, + cast, +) from litellm._logging import verbose_proxy_logger from litellm._uuid import uuid from litellm.constants import MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS from litellm.llms.custom_httpx.http_handler import get_async_httpx_client -from litellm.proxy._experimental.mcp_server.auth.token_endpoint_auth import ( - build_token_endpoint_client_auth, - normalize_token_endpoint_auth_method, -) +from litellm.proxy._experimental.mcp_server.oauth_utils import build_upstream_oauth2_token_request from litellm.proxy._types import ( LiteLLM_MCPServerTable, LiteLLM_ObjectPermissionTable, - LiteLLM_TeamTable, MCPApprovalStatus, + MCPEnvVar, MCPEnvVarScope, MCPSubmissionsSummary, NewMCPServerRequest, @@ -33,6 +36,7 @@ from litellm.proxy.common_utils.encrypt_decrypt_utils import ( from litellm.proxy.utils import PrismaClient from litellm.repositories.object_permission_repository import ObjectPermissionRepository from litellm.repositories.table_repositories import ( + MCPServerOAuthClientRepository, MCPServerRepository, MCPUserCredentialsRepository, ) @@ -44,14 +48,20 @@ from litellm.types.llms.custom_http import httpxSpecialProvider from litellm.types.mcp import MCPCredentials if TYPE_CHECKING: + from prisma import models as prisma_db_models + from prisma import types as prisma_db_types + from prisma.actions import LiteLLM_MCPUserCredentialsActions, LiteLLM_MCPUserEnvVarsActions + from litellm.types.mcp_server.mcp_server_manager import MCPServer -_AUTH_FLOW_SCOPED_FIELDS: frozenset = frozenset( +_AUTH_FLOW_SCOPED_FIELDS: "frozenset[str]" = frozenset( { + "issuer", "authorization_url", "token_url", "registration_url", "oauth2_flow", + "dcr_bridge", "token_exchange_endpoint", "audience", "subject_token_type", @@ -59,6 +69,13 @@ _AUTH_FLOW_SCOPED_FIELDS: frozenset = frozenset( } ) + +def _blank_to_none(value: str | None) -> str | None: + if not isinstance(value, str): + return None + return value.strip() or None + + # Token-exchange settings with dedicated columns that also exist on # ``MCPCredentials`` as a legacy shape (rows and REST callers that predate the # columns). Every write lifts blob values into the columns and strips them from @@ -66,7 +83,7 @@ _AUTH_FLOW_SCOPED_FIELDS: frozenset = frozenset( # the current code has never written — a cleared column can then never be # silently resurrected by a stale blob copy. These keys are stored plaintext # (endpoints/identifiers, not secrets), so values lift as-is. -_TOKEN_EXCHANGE_COLUMN_FIELDS: frozenset = frozenset( +_TOKEN_EXCHANGE_COLUMN_FIELDS: "frozenset[str]" = frozenset( { "token_exchange_endpoint", "audience", @@ -75,14 +92,62 @@ _TOKEN_EXCHANGE_COLUMN_FIELDS: frozenset = frozenset( } ) +# The client-forwarded token modes share one stored-credential shape: the admin-declared upstream +# OAuth app (client_id/client_secret) plus the same authorize relay, and neither mints anything the +# gateway keeps. So a switch WITHIN this class must preserve the stored app, unlike a cross-class +# switch (e.g. an oauth2 row whose client may be DCR-minted and is not reusable elsewhere). +_CLIENT_FORWARDED_AUTH_TYPES: "frozenset[str]" = frozenset({"true_passthrough", "oauth_delegate"}) -def _is_global_env_var_scope(scope: Any) -> bool: +# Minted token material that must never survive a client rotation on a persisted row. +_MINTED_TOKEN_CREDENTIAL_FIELDS: "frozenset[str]" = frozenset({"access_token", "refresh_token", "expires_in"}) + + +class _OAuthCredentialAccessToken(TypedDict): + access_token: str + + +class OAuthCredentialPayload(_OAuthCredentialAccessToken, total=False): + type: str + refresh_token: str + expires_at: str + connected_at: str + scopes: list[str] + server_id: str + + +class _OAuthTokenRefreshResponse(TypedDict, total=False): + access_token: str + refresh_token: str + expires_in: int + scope: str + + +def _credential_auth_class(auth_type: str | None) -> str | None: + """Collapse the client-forwarded modes to one credential class; every other auth_type is its own + class. Used so credential handling keys off whether the stored-credential shape actually changed, + not off a raw auth_type inequality that treats true_passthrough<->oauth_delegate as a full reset.""" + if auth_type in _CLIENT_FORWARDED_AUTH_TYPES: + return "client_forwarded" + return auth_type + + +def _drop_stale_minted_on_client_rotation(merged: dict[str, object], new_creds: dict[str, object]) -> dict[str, object]: + """When the update rotates the client, drop stale minted token keys it did not itself set, so an old + app's access/refresh token never rides forward under the new client. A no-op when no client key changed.""" + if "client_id" not in new_creds and "client_secret" not in new_creds: + return merged + return { + key: value for key, value in merged.items() if key not in _MINTED_TOKEN_CREDENTIAL_FIELDS or key in new_creds + } + + +def _is_global_env_var_scope(scope: object) -> bool: """``scope="user"`` entries are placeholders the user fills in; everything else (including a missing scope) is an admin-supplied global value.""" return scope != MCPEnvVarScope.user and scope != "user" -def _encrypt_global_env_var_values(env_vars: Iterable[Dict[str, Any]]) -> None: +def _encrypt_global_env_var_values(env_vars: Iterable[dict[str, str]]) -> None: """Encrypt ``scope="global"`` env var values in place before persisting. Global values hold admin-supplied secrets (API keys, passwords) that get @@ -98,7 +163,7 @@ def _encrypt_global_env_var_values(env_vars: Iterable[Dict[str, Any]]) -> None: entry["value"] = encrypt_value_helper(value) -def decrypt_global_env_var_values(env_vars: Optional[Iterable[Any]]) -> None: +def decrypt_global_env_var_values(env_vars: Iterable[MCPEnvVar | dict[str, str]] | None) -> None: """Decrypt ``scope="global"`` env var values in place after reading the DB. Accepts ``MCPEnvVar`` models (``LiteLLM_MCPServerTable``) or plain dicts @@ -137,7 +202,7 @@ def decrypt_global_env_var_values(env_vars: Optional[Iterable[Any]]) -> None: entry.value = decrypted -def _decrypt_env_vars_on_returned_row(row: Any) -> None: +def _decrypt_env_vars_on_returned_row(row: object) -> None: """Decrypt ``scope="global"`` env var values on a row returned by Prisma create/update. Prisma may hand back ``env_vars`` either as a parsed list (the common case for @@ -167,8 +232,8 @@ def _decrypt_env_vars_on_returned_row(row: Any) -> None: def _reencrypt_global_env_var_values( - env_vars: Optional[Iterable[Any]], new_encryption_key: str -) -> Optional[List[Dict[str, Any]]]: + env_vars: str | Iterable[Mapping[str, str]] | None, new_encryption_key: str +) -> list[dict[str, str]] | None: """Re-encrypt ``scope="global"`` env var values for master-key rotation. Each global value is decrypted with the current salt key and re-encrypted @@ -179,14 +244,17 @@ def _reencrypt_global_env_var_values( """ if not env_vars: return None + entries: Iterable[Mapping[str, str]] if isinstance(env_vars, str): try: - env_vars = json.loads(env_vars) + entries = json.loads(env_vars) except (json.JSONDecodeError, TypeError): return None - if not env_vars: + if not entries: return None - rebuilt = [dict(v) for v in env_vars] + else: + entries = env_vars + rebuilt = [dict(v) for v in entries] rotated = False for entry in rebuilt: if not _is_global_env_var_scope(entry.get("scope")): @@ -212,10 +280,10 @@ def _reencrypt_global_env_var_values( def _prepare_mcp_server_data( - data: Union[NewMCPServerRequest, UpdateMCPServerRequest], + data: NewMCPServerRequest | UpdateMCPServerRequest, exclude_unset: bool = False, - fields_set: Optional[Set[str]] = None, -) -> Dict[str, Any]: + fields_set: set[str] | None = None, +) -> dict[str, Any]: """ Helper function to prepare MCP server data for database operations. Handles JSON field serialization for mcp_info and env fields. @@ -291,7 +359,7 @@ def _prepare_mcp_server_data( # column so the exclude_unset filter is respected: a partial update that # omits env_vars never overwrites the stored value. Global values are # encrypted at rest before serialization. - env_vars = data_dict.get("env_vars") + env_vars: Sequence[Mapping[str, str]] | None = data_dict.get("env_vars") if env_vars is not None: serialized_env_vars = [dict(v) for v in env_vars] _encrypt_global_env_var_values(serialized_env_vars) @@ -318,7 +386,7 @@ def _prepare_mcp_server_data( return data_dict -def encrypt_credentials(credentials: MCPCredentials, encryption_key: Optional[str]) -> MCPCredentials: +def encrypt_credentials(credentials: MCPCredentials, encryption_key: str | None) -> MCPCredentials: auth_value = credentials.get("auth_value") if auth_value is not None: credentials["auth_value"] = encrypt_value_helper( @@ -337,6 +405,12 @@ def encrypt_credentials(credentials: MCPCredentials, encryption_key: Optional[st value=client_secret, new_encryption_key=encryption_key, ) + client_private_key = credentials.get("client_private_key") + if client_private_key is not None: + credentials["client_private_key"] = encrypt_value_helper( + value=client_private_key, + new_encryption_key=encryption_key, + ) # AWS SigV4 credential fields aws_access_key_id = credentials.get("aws_access_key_id") if aws_access_key_id is not None: @@ -360,6 +434,98 @@ def encrypt_credentials(credentials: MCPCredentials, encryption_key: Optional[st return credentials +def _credentials_blob_to_mutable_dict(blob: str | Mapping[str, object]) -> dict[str, object]: + parsed_blob: dict[str, object] = json.loads(blob) if isinstance(blob, str) else dict(blob) + return parsed_blob + + +async def _db_find_mcp_server_rows( + prisma_client: PrismaClient, + where: "prisma_db_types.LiteLLM_MCPServerTableWhereInput | None" = None, +) -> "list[prisma_db_models.LiteLLM_MCPServerTable]": + rows: list[prisma_db_models.LiteLLM_MCPServerTable] = await MCPServerRepository(prisma_client).table.find_many( + where=where + ) + return rows + + +async def _db_find_mcp_server_row( + prisma_client: PrismaClient, server_id: str +) -> "prisma_db_models.LiteLLM_MCPServerTable | None": + row: prisma_db_models.LiteLLM_MCPServerTable | None = await MCPServerRepository(prisma_client).table.find_unique( + where={"server_id": server_id} + ) + return row + + +async def _db_update_mcp_server_row( + prisma_client: PrismaClient, + server_id: str, + data: "prisma_db_types.LiteLLM_MCPServerTableUpdateInput", +) -> "prisma_db_models.LiteLLM_MCPServerTable": + row: prisma_db_models.LiteLLM_MCPServerTable = await MCPServerRepository(prisma_client).table.update( + where={"server_id": server_id}, + data=data, + ) + return row + + +def _user_credential_actions( + prisma_client: PrismaClient, +) -> "LiteLLM_MCPUserCredentialsActions[prisma_db_models.LiteLLM_MCPUserCredentials]": + table: LiteLLM_MCPUserCredentialsActions[prisma_db_models.LiteLLM_MCPUserCredentials] = ( + MCPUserCredentialsRepository(prisma_client).table + ) + return table + + +def _user_env_var_actions( + prisma_client: PrismaClient, +) -> "LiteLLM_MCPUserEnvVarsActions[prisma_db_models.LiteLLM_MCPUserEnvVars]": + table: LiteLLM_MCPUserEnvVarsActions[prisma_db_models.LiteLLM_MCPUserEnvVars] = ( + prisma_client.db.litellm_mcpuserenvvars + ) + return table + + +async def _db_find_user_credential_row( + prisma_client: PrismaClient, user_id: str, server_id: str +) -> "prisma_db_models.LiteLLM_MCPUserCredentials | None": + return await _user_credential_actions(prisma_client).find_unique( + where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}} + ) + + +async def _db_find_user_credential_rows( + prisma_client: PrismaClient, + where: "prisma_db_types.LiteLLM_MCPUserCredentialsWhereInput | None" = None, +) -> "list[prisma_db_models.LiteLLM_MCPUserCredentials]": + return await _user_credential_actions(prisma_client).find_many(where=where) + + +async def _db_upsert_user_credential_row( + prisma_client: PrismaClient, user_id: str, server_id: str, credential_b64: str +) -> None: + await MCPUserCredentialsRepository(prisma_client).table.upsert( + where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}}, + data={ + "create": { + "user_id": user_id, + "server_id": server_id, + "credential_b64": credential_b64, + }, + "update": {"credential_b64": credential_b64}, + }, + ) + + +async def _db_find_user_env_var_rows( + prisma_client: PrismaClient, + where: "prisma_db_types.LiteLLM_MCPUserEnvVarsWhereInput | None" = None, +) -> "list[prisma_db_models.LiteLLM_MCPUserEnvVars]": + return await _user_env_var_actions(prisma_client).find_many(where=where) + + def decrypt_credentials( credentials: MCPCredentials, ) -> MCPCredentials: @@ -368,6 +534,7 @@ def decrypt_credentials( "auth_value", "client_id", "client_secret", + "client_private_key", "aws_access_key_id", "aws_secret_access_key", "aws_session_token", @@ -386,19 +553,19 @@ def decrypt_credentials( async def get_all_mcp_servers( prisma_client: PrismaClient, - approval_status: Optional[str] = None, -) -> List[LiteLLM_MCPServerTable]: + approval_status: str | None = None, +) -> list[LiteLLM_MCPServerTable]: """ Returns mcp servers from the db, optionally filtered by approval_status. Pass approval_status=None to return all servers regardless of approval state. """ try: - where: Dict[str, Any] = {} + where: prisma_db_types.LiteLLM_MCPServerTableWhereInput = {} if approval_status is not None: where["approval_status"] = approval_status - mcp_servers = await MCPServerRepository(prisma_client).table.find_many(where=where if where else {}) + mcp_servers = await _db_find_mcp_server_rows(prisma_client, where if where else {}) - tables = [LiteLLM_MCPServerTable(**mcp_server.model_dump()) for mcp_server in mcp_servers] + tables = [LiteLLM_MCPServerTable.model_validate(mcp_server.model_dump()) for mcp_server in mcp_servers] for table in tables: decrypt_global_env_var_values(table.env_vars) return tables @@ -409,45 +576,45 @@ async def get_all_mcp_servers( return [] -async def get_mcp_server(prisma_client: PrismaClient, server_id: str) -> Optional[LiteLLM_MCPServerTable]: +async def get_mcp_server(prisma_client: PrismaClient, server_id: str) -> LiteLLM_MCPServerTable | None: """ Returns the matching mcp server from the db iff exists """ - mcp_server: Optional[LiteLLM_MCPServerTable] = await MCPServerRepository(prisma_client).table.find_unique( - where={ - "server_id": server_id, - } - ) + mcp_server = await _db_find_mcp_server_row(prisma_client, server_id) if mcp_server is None: return None - table = LiteLLM_MCPServerTable(**mcp_server.model_dump()) + table = LiteLLM_MCPServerTable.model_validate(mcp_server.model_dump()) decrypt_global_env_var_values(table.env_vars) return table -async def get_mcp_servers(prisma_client: PrismaClient, server_ids: Iterable[str]) -> List[LiteLLM_MCPServerTable]: +async def get_mcp_servers(prisma_client: PrismaClient, server_ids: Iterable[str]) -> list[LiteLLM_MCPServerTable]: """ Returns the matching mcp servers from the db with the server_ids """ - _mcp_servers: List[LiteLLM_MCPServerTable] = await MCPServerRepository(prisma_client).table.find_many( + _mcp_servers: list[prisma_db_models.LiteLLM_MCPServerTable] = await MCPServerRepository( + prisma_client + ).table.find_many( where={ "server_id": {"in": server_ids}, } ) - final_mcp_servers: List[LiteLLM_MCPServerTable] = [] + final_mcp_servers: list[LiteLLM_MCPServerTable] = [] for _mcp_server in _mcp_servers: - table = LiteLLM_MCPServerTable(**_mcp_server.model_dump()) + table = LiteLLM_MCPServerTable.model_validate(_mcp_server.model_dump()) decrypt_global_env_var_values(table.env_vars) final_mcp_servers.append(table) return final_mcp_servers -async def get_mcp_servers_by_verificationtoken(prisma_client: PrismaClient, token: str) -> List[str]: +async def get_mcp_servers_by_verificationtoken(prisma_client: PrismaClient, token: str) -> list[str]: """ Returns the mcp servers from the db for the verification token """ - verification_token_record: LiteLLM_TeamTable = await VerificationTokenRepository(prisma_client).table.find_unique( + verification_token_record: prisma_db_models.LiteLLM_VerificationToken | None = await VerificationTokenRepository( + prisma_client + ).table.find_unique( where={ "token": token, }, @@ -456,17 +623,17 @@ async def get_mcp_servers_by_verificationtoken(prisma_client: PrismaClient, toke }, ) - mcp_servers: Optional[List[str]] = [] + mcp_servers: list[str] | None = [] if verification_token_record is not None and verification_token_record.object_permission is not None: mcp_servers = verification_token_record.object_permission.mcp_servers return mcp_servers or [] -async def get_mcp_servers_by_team(prisma_client: PrismaClient, team_id: str) -> List[str]: +async def get_mcp_servers_by_team(prisma_client: PrismaClient, team_id: str) -> list[str]: """ Returns the mcp servers from the db for the team id """ - team_record: LiteLLM_TeamTable = await TeamRepository(prisma_client).table.find_unique( + team_record: prisma_db_models.LiteLLM_TeamTable | None = await TeamRepository(prisma_client).table.find_unique( where={ "team_id": team_id, }, @@ -475,7 +642,7 @@ async def get_mcp_servers_by_team(prisma_client: PrismaClient, team_id: str) -> }, ) - mcp_servers: Optional[List[str]] = [] + mcp_servers: list[str] | None = [] if team_record is not None and team_record.object_permission is not None: mcp_servers = team_record.object_permission.mcp_servers return mcp_servers or [] @@ -484,14 +651,14 @@ async def get_mcp_servers_by_team(prisma_client: PrismaClient, team_id: str) -> async def get_all_mcp_servers_for_user( prisma_client: PrismaClient, user: UserAPIKeyAuth, -) -> List[LiteLLM_MCPServerTable]: +) -> list[LiteLLM_MCPServerTable]: """ Get all the mcp servers filtered by the given user has access to. Following Least-Privilege Principle - the requestor should only be able to see the mcp servers that they have access to. """ - mcp_server_ids: Set[str] = set() + mcp_server_ids: set[str] = set() mcp_servers = [] # Get the mcp servers for the key @@ -512,11 +679,13 @@ async def get_all_mcp_servers_for_user( async def get_objectpermissions_for_mcp_server( prisma_client: PrismaClient, mcp_server_id: str -) -> List[LiteLLM_ObjectPermissionTable]: +) -> list[LiteLLM_ObjectPermissionTable]: """ Get all the object permissions records and the associated team and verficiationtoken records that have access to the mcp server """ - object_permission_records = await ObjectPermissionRepository(prisma_client).table.find_many( + object_permission_records: list[LiteLLM_ObjectPermissionTable] = await ObjectPermissionRepository( + prisma_client + ).table.find_many( where={ "mcp_servers": {"has": mcp_server_id}, }, @@ -529,11 +698,15 @@ async def get_objectpermissions_for_mcp_server( return object_permission_records -async def get_virtualkeys_for_mcp_server(prisma_client: PrismaClient, server_id: str) -> List: +async def get_virtualkeys_for_mcp_server( + prisma_client: PrismaClient, server_id: str +) -> "list[prisma_db_models.LiteLLM_VerificationToken]": """ Get all the virtual keys that have access to the mcp server """ - virtual_keys = await VerificationTokenRepository(prisma_client).table.find_many( + virtual_keys: list[prisma_db_models.LiteLLM_VerificationToken] | None = await VerificationTokenRepository( + prisma_client + ).table.find_many( where={ "mcp_servers": {"has": server_id}, }, @@ -558,7 +731,11 @@ async def delete_mcp_server_from_virtualkey(): pass -async def delete_mcp_server(prisma_client: PrismaClient, server_id: str) -> Optional[LiteLLM_MCPServerTable]: +async def delete_mcp_server( + prisma_client: PrismaClient, + server_id: str, + invalidate_token_cache: Callable[[str, str], Awaitable[None]] | None = None, +) -> LiteLLM_MCPServerTable | None: """ Delete the mcp server from the db by server_id @@ -569,6 +746,12 @@ async def delete_mcp_server(prisma_client: PrismaClient, server_id: str) -> Opti caller-visible error. Each table is cleaned independently so a failure on one still attempts the other. + Each enumerated credential row's user also gets their cached per-user token + invalidated (legacy cache + v2 store, via invalidate_token_cache, defaulting + to the manager's shared invalidation): the caches are keyed by + (user_id, server_id), so without this a re-created server reusing the same + server_id would serve tokens minted for the deleted server until TTL. + Returns the deleted mcp server record if it exists, otherwise None """ deleted_server = await MCPServerRepository(prisma_client).table.delete( @@ -577,9 +760,22 @@ async def delete_mcp_server(prisma_client: PrismaClient, server_id: str) -> Opti }, ) if deleted_server is not None: + credential_user_ids: list[str] = [] + try: + credential_rows: Sequence[ + prisma_db_models.LiteLLM_MCPUserCredentials + ] = await prisma_client.db.litellm_mcpusercredentials.find_many(where={"server_id": server_id}) + credential_user_ids = [row.user_id for row in credential_rows] + except Exception as e: # noqa: BLE001 - enumeration is best-effort; cached tokens expire by TTL + verbose_proxy_logger.warning( + "MCP server %s deleted but per-user credential enumeration failed; cached tokens expire by TTL: %s", + server_id, + e, + ) for model, label in ( (prisma_client.db.litellm_mcpusercredentials, "credential"), (prisma_client.db.litellm_mcpuserenvvars, "env var"), + (prisma_client.db.litellm_mcpserveroauthclient, "OAuth client"), ): try: await model.delete_many(where={"server_id": server_id}) @@ -591,6 +787,15 @@ async def delete_mcp_server(prisma_client: PrismaClient, server_id: str) -> Opti label, e, ) + if credential_user_ids: + if invalidate_token_cache is None: + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( + global_mcp_server_manager, + ) + + invalidate_token_cache = global_mcp_server_manager.invalidate_user_oauth_token_cache + for user_id in credential_user_ids: + await invalidate_token_cache(user_id, server_id) return deleted_server @@ -610,7 +815,7 @@ async def create_mcp_server( data_dict["created_by"] = touched_by data_dict["updated_by"] = touched_by - new_mcp_server = await MCPServerRepository(prisma_client).table.create( + new_mcp_server: LiteLLM_MCPServerTable = await MCPServerRepository(prisma_client).table.create( data=data_dict # type: ignore ) @@ -622,13 +827,11 @@ async def update_mcp_server( prisma_client: PrismaClient, data: UpdateMCPServerRequest, touched_by: str, - fields_set: Optional[Set[str]] = None, + fields_set: set[str] | None = None, ) -> LiteLLM_MCPServerTable: """ Update a new mcp server record in the db """ - import json - from litellm.litellm_core_utils.safe_json_dumps import safe_dumps # Use helper to prepare data with proper JSON serialization. @@ -637,25 +840,46 @@ async def update_mcp_server( # of being reset to a schema default (transport=sse, allow_all_keys=False...). data_dict = _prepare_mcp_server_data(data, exclude_unset=True, fields_set=fields_set) - # Pre-fetch existing record once if we need it for auth_type or credential logic + # Pre-fetch existing record once if we need it for auth_type, url, or credential logic existing = None has_credentials = "credentials" in data_dict and data_dict["credentials"] is not None # An explicit token-exchange column write (set or clear) also migrates the # legacy blob copies below, so the existing row is needed for those updates. explicit_te_write = bool(_TOKEN_EXCHANGE_COLUMN_FIELDS & data_dict.keys()) - if data.auth_type or has_credentials or explicit_te_write: - existing = await MCPServerRepository(prisma_client).table.find_unique(where={"server_id": data.server_id}) + url_provided = "url" in data_dict and data_dict["url"] is not None + issuer_provided = "issuer" in data_dict + if data.auth_type or has_credentials or explicit_te_write or url_provided or issuer_provided: + existing = await _db_find_mcp_server_row(prisma_client, data.server_id) auth_type_changed = bool( - data.auth_type and existing and existing.auth_type is not None and existing.auth_type != data.auth_type + data.auth_type + and existing + and _credential_auth_class(existing.auth_type) != _credential_auth_class(data.auth_type) + ) + # A url change re-points the server at a potentially different upstream, so any discovered or + # trust-on-first-use OAuth endpoints/issuer belong to the old upstream and must re-discover. + url_changed = bool(url_provided and existing and existing.url != data_dict["url"]) + old_issuer = _blank_to_none(getattr(existing, "issuer", None)) if existing else None + issuer_changed = bool( + issuer_provided and old_issuer is not None and _blank_to_none(data_dict.get("issuer")) != old_issuer ) # Clear stale credentials when auth_type changes but no new credentials provided if auth_type_changed and "credentials" not in data_dict: data_dict["credentials"] = None - if auth_type_changed: - data_dict.update({field: None for field in _AUTH_FLOW_SCOPED_FIELDS if field not in data_dict}) + if auth_type_changed or url_changed or issuer_changed: + # Clear each auth-flow-scoped field that the caller either omitted (partial update) or + # resubmitted unchanged. The edit form re-sends every field, so a stale issuer/endpoint + # belonging to the old upstream would otherwise survive a url/auth_type change and win in the + # resolution merge; only a genuinely new submitted value is kept. + data_dict.update( + { + field: None + for field in _AUTH_FLOW_SCOPED_FIELDS + if field not in data_dict or data_dict[field] == getattr(existing, field, None) + } + ) # An explicit column write that does not touch credentials must still migrate # the row's legacy blob copies: lift values for columns the caller left @@ -665,9 +889,7 @@ async def update_mcp_server( # repopulate the column the admin just cleared. (When credentials ARE in the # update, the merge below performs the same migration.) if explicit_te_write and "credentials" not in data_dict and existing is not None and existing.credentials: - existing_creds = ( - json.loads(existing.credentials) if isinstance(existing.credentials, str) else dict(existing.credentials) - ) + existing_creds = _credentials_blob_to_mutable_dict(existing.credentials) if _TOKEN_EXCHANGE_COLUMN_FIELDS & existing_creds.keys(): for te_field in _TOKEN_EXCHANGE_COLUMN_FIELDS: legacy_value = existing_creds.pop(te_field, None) @@ -680,23 +902,17 @@ async def update_mcp_server( # would wipe encrypted secrets that the UI cannot display back. if "credentials" in data_dict and data_dict["credentials"] is not None: if existing and existing.credentials: - # Only merge when auth_type is unchanged. Switching auth types - # (e.g. oauth2 → api_key) should replace credentials entirely - # to avoid stale secrets from the previous auth type lingering. - auth_type_unchanged = data.auth_type is None or data.auth_type == existing.auth_type - if auth_type_unchanged: - existing_creds = ( - json.loads(existing.credentials) - if isinstance(existing.credentials, str) - else dict(existing.credentials) - ) - new_creds = ( - json.loads(data_dict["credentials"]) - if isinstance(data_dict["credentials"], str) - else dict(data_dict["credentials"]) - ) - # New values override existing; existing keys not in update are preserved - merged = {**existing_creds, **new_creds} + # Only merge when the credential CLASS is unchanged. A cross-class switch + # (e.g. oauth2 → api_key, or oauth2 → true_passthrough) replaces credentials + # entirely to avoid stale secrets from the previous class lingering; a switch + # within the client-forwarded class (true_passthrough ↔ oauth_delegate) keeps + # the same declared app and so must merge, not replace. + if not auth_type_changed: + existing_creds = _credentials_blob_to_mutable_dict(existing.credentials) + new_creds = _credentials_blob_to_mutable_dict(data_dict["credentials"]) + # New values override existing; existing keys not in update are preserved. A client + # rotation additionally drops the previous app's stale minted token keys. + merged = _drop_stale_minted_on_client_rotation({**existing_creds, **new_creds}, new_creds) # Migrate-on-write for legacy rows: token-exchange settings the # old blob shape carried move to their dedicated columns (unless # the caller set the column this update, or the row already has @@ -715,7 +931,15 @@ async def update_mcp_server( # Add audit fields data_dict["updated_by"] = touched_by - updated_mcp_server = await MCPServerRepository(prisma_client).table.update( + # prisma-python rejects a raw ``None`` for a ``Json?`` field ("value is required but not set"); the + # clear paths above use ``None`` as the merge-skip sentinel, so translate it here to ``Json(None)``, + # which writes SQL null and reads back as ``None``. Done at the edge so the merge guards stay simple. + if "credentials" in data_dict and data_dict["credentials"] is None: + from prisma import Json # noqa: PLC0415 # local import: prisma may be ungenerated at module load in some tools + + data_dict["credentials"] = Json(None) + + updated_mcp_server: LiteLLM_MCPServerTable = await MCPServerRepository(prisma_client).table.update( where={"server_id": data.server_id}, data=data_dict, # type: ignore ) @@ -724,26 +948,70 @@ async def update_mcp_server( return updated_mcp_server -async def rotate_mcp_server_credentials_master_key(prisma_client: PrismaClient, touched_by: str, new_master_key: str): +async def get_mcp_server_oauth_client_credentials(prisma_client: PrismaClient, server_id: str) -> object | None: + """Read the persisted (encrypted) DCR OAuth client blob for a server from the + server-scoped store, or None. Config.yaml-declared servers have no + LiteLLM_MCPServerTable row, so their dynamically registered client lives here keyed + by server_id. The returned value is the raw credentials blob for + ``_get_persisted_dcr_credentials`` to parse.""" + row: prisma_db_models.LiteLLM_MCPServerOAuthClient | None = await MCPServerOAuthClientRepository( + prisma_client + ).table.find_unique(where={"server_id": server_id}) + if row is None: + return None + return row.credentials + + +async def upsert_mcp_server_oauth_client_credentials( + prisma_client: PrismaClient, server_id: str, credentials: MCPCredentials +) -> None: + """Persist a server's dynamically registered OAuth client (RFC 7591 DCR) in the + server-scoped store keyed by server_id, independent of any LiteLLM_MCPServerTable row. + client_id/client_secret are encrypted at rest with the same salt key used for the + server row's credentials blob, so ``_apply_persisted_dcr_credentials`` decrypts them the + same way regardless of which store a server's client came from.""" from litellm.litellm_core_utils.safe_json_dumps import safe_dumps - mcp_servers = await MCPServerRepository(prisma_client).table.find_many() + encrypted = encrypt_credentials(credentials=MCPCredentials(**credentials), encryption_key=_get_salt_key()) + blob = safe_dumps(encrypted) + await MCPServerOAuthClientRepository(prisma_client).table.upsert( + where={"server_id": server_id}, + data={ + "create": {"server_id": server_id, "credentials": blob}, + "update": {"credentials": blob}, + }, + ) + + +def _reencrypt_mcp_credentials_blob( + credentials: "str | Mapping[str, object] | None", new_master_key: str +) -> str | None: + """Decrypt an at-rest MCP credentials blob with the current key and re-encrypt it under + new_master_key, returning the serialized blob or None when there is nothing to rotate. Shared by + every table that stores an encrypted MCP credentials blob so a master-key rotation covers them + uniformly and cannot silently skip one.""" + if not credentials: + return None + from litellm.litellm_core_utils.safe_json_dumps import safe_dumps # noqa: PLC0415 # avoids circular import + + creds_dict = _credentials_blob_to_mutable_dict(credentials) + decrypted = decrypt_credentials(credentials=cast(MCPCredentials, creds_dict)) + encrypted = encrypt_credentials(credentials=decrypted, encryption_key=new_master_key) + return safe_dumps(encrypted) + + +async def rotate_mcp_server_credentials_master_key(prisma_client: PrismaClient, touched_by: str, new_master_key: str): + from litellm.litellm_core_utils.safe_json_dumps import safe_dumps # noqa: PLC0415 # avoids circular import + + mcp_servers = await _db_find_mcp_server_rows(prisma_client) updated = 0 for mcp_server in mcp_servers: - update_data: Dict[str, Any] = {} + update_data: dict[str, str] = {} - credentials = mcp_server.credentials - if credentials: - # Decrypt with current key first, then re-encrypt with new key - decrypted_credentials = decrypt_credentials( - credentials=cast(MCPCredentials, dict(credentials)), - ) - encrypted_credentials = encrypt_credentials( - credentials=decrypted_credentials, - encryption_key=new_master_key, - ) - update_data["credentials"] = safe_dumps(encrypted_credentials) + rotated_credentials = _reencrypt_mcp_credentials_blob(mcp_server.credentials, new_master_key) + if rotated_credentials is not None: + update_data["credentials"] = rotated_credentials rotated_env_vars = _reencrypt_global_env_var_values(mcp_server.env_vars, new_master_key) if rotated_env_vars is not None: @@ -758,13 +1026,29 @@ async def rotate_mcp_server_credentials_master_key(prisma_client: PrismaClient, data=update_data, ) updated += 1 + + oauth_clients: list[prisma_db_models.LiteLLM_MCPServerOAuthClient] = await MCPServerOAuthClientRepository( + prisma_client + ).table.find_many() + oauth_updated = 0 + for oauth_client in oauth_clients: + rotated_credentials = _reencrypt_mcp_credentials_blob(oauth_client.credentials, new_master_key) + if rotated_credentials is None: + continue + await MCPServerOAuthClientRepository(prisma_client).table.update( + where={"server_id": oauth_client.server_id}, + data={"credentials": rotated_credentials}, + ) + oauth_updated += 1 + verbose_proxy_logger.info( - "rotate_mcp_server_credentials_master_key: rotated %d MCP server row(s)", + "rotate_mcp_server_credentials_master_key: rotated %d MCP server row(s) and %d OAuth-client row(s)", updated, + oauth_updated, ) -def _decode_user_credential(stored: str) -> Optional[str]: +def _decode_user_credential(stored: str) -> str | None: """Read back a value persisted in ``LiteLLM_MCPUserCredentials.credential_b64``. Tries nacl decryption first (current write format). Falls back to a @@ -786,7 +1070,7 @@ def _decode_user_credential(stored: str) -> Optional[str]: return None -def _decode_oauth_payload(stored: str) -> Optional[Dict[str, Any]]: +def _decode_oauth_payload(stored: str) -> OAuthCredentialPayload | None: """Return the OAuth2 payload dict if ``stored`` holds one, else ``None``. A row is considered an OAuth2 credential iff its decoded value parses as @@ -796,6 +1080,7 @@ def _decode_oauth_payload(stored: str) -> Optional[Dict[str, Any]]: decoded = _decode_user_credential(stored) if decoded is None: return None + parsed: OAuthCredentialPayload | None try: parsed = json.loads(decoded) except (ValueError, TypeError): @@ -813,7 +1098,7 @@ async def rotate_mcp_user_credentials_master_key(prisma_client: PrismaClient, ne under the new master key. Rows that are unreadable under both paths are logged and skipped so one corrupt row does not abort the rotation. """ - rows = await MCPUserCredentialsRepository(prisma_client).table.find_many() + rows = await _db_find_user_credential_rows(prisma_client) rotated = 0 skipped = 0 for row in rows: @@ -828,7 +1113,7 @@ async def rotate_mcp_user_credentials_master_key(prisma_client: PrismaClient, ne skipped += 1 continue re_encrypted = encrypt_value_helper(plaintext, new_encryption_key=new_master_key) - await MCPUserCredentialsRepository(prisma_client).table.update( + await _user_credential_actions(prisma_client).update( where={ "user_id_server_id": { "user_id": row.user_id, @@ -853,7 +1138,7 @@ async def rotate_mcp_user_env_vars_master_key(prisma_client: PrismaClient, new_m skipped so one corrupt row does not abort the rotation nor overwrite values that may still be recoverable. """ - rows = await prisma_client.db.litellm_mcpuserenvvars.find_many() + rows = await _db_find_user_env_var_rows(prisma_client) rotated = 0 skipped = 0 for row in rows: @@ -872,7 +1157,7 @@ async def rotate_mcp_user_env_vars_master_key(prisma_client: PrismaClient, new_m skipped += 1 continue re_encrypted = encrypt_value_helper(plaintext, new_encryption_key=new_master_key) - await prisma_client.db.litellm_mcpuserenvvars.update( + await _user_env_var_actions(prisma_client).update( where={ "user_id_server_id": { "user_id": row.user_id, @@ -898,29 +1183,17 @@ async def store_user_credential( """Store a user credential for a BYOK MCP server.""" encoded = encrypt_value_helper(credential) - await MCPUserCredentialsRepository(prisma_client).table.upsert( - where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}}, - data={ - "create": { - "user_id": user_id, - "server_id": server_id, - "credential_b64": encoded, - }, - "update": {"credential_b64": encoded}, - }, - ) + await _db_upsert_user_credential_row(prisma_client, user_id, server_id, encoded) async def get_user_credential( prisma_client: PrismaClient, user_id: str, server_id: str, -) -> Optional[str]: +) -> str | None: """Return credential for a user+server pair, or None.""" - row = await MCPUserCredentialsRepository(prisma_client).table.find_unique( - where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}} - ) + row = await _db_find_user_credential_row(prisma_client, user_id, server_id) if row is None: return None return _decode_user_credential(row.credential_b64) @@ -932,9 +1205,7 @@ async def has_user_credential( server_id: str, ) -> bool: """Return True if the user has a stored credential for this server.""" - row = await MCPUserCredentialsRepository(prisma_client).table.find_unique( - where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}} - ) + row = await _db_find_user_credential_row(prisma_client, user_id, server_id) return row is not None @@ -944,7 +1215,7 @@ async def delete_user_credential( server_id: str, ) -> None: """Delete the user's stored credential for a BYOK MCP server.""" - await MCPUserCredentialsRepository(prisma_client).table.delete( + await _user_credential_actions(prisma_client).delete( where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}} ) @@ -957,9 +1228,9 @@ async def store_user_oauth_credential( user_id: str, server_id: str, access_token: str, - refresh_token: Optional[str] = None, - expires_in: Optional[int] = None, - scopes: Optional[List[str]] = None, + refresh_token: str | None = None, + expires_in: int | None = None, + scopes: list[str] | None = None, skip_byok_guard: bool = False, ) -> None: """Persist an OAuth2 access token for a user+server pair. @@ -969,11 +1240,11 @@ async def store_user_oauth_credential( differentiates it from plain BYOK API keys. """ - expires_at: Optional[str] = None + expires_at: str | None = None if expires_in is not None: expires_at = (datetime.now(timezone.utc) + timedelta(seconds=expires_in)).isoformat() - payload: Dict[str, Any] = { + payload: OAuthCredentialPayload = { "type": "oauth2", "access_token": access_token, "connected_at": datetime.now(timezone.utc).isoformat(), @@ -989,9 +1260,7 @@ async def store_user_oauth_credential( # Skip the guard when the caller knows the row is already an OAuth2 credential # (e.g. during token refresh), saving an extra DB round-trip. if not skip_byok_guard: - existing = await MCPUserCredentialsRepository(prisma_client).table.find_unique( - where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}} - ) + existing = await _db_find_user_credential_row(prisma_client, user_id, server_id) if existing is not None and _decode_oauth_payload(existing.credential_b64) is None: # Existing row is either a BYOK secret or an OAuth2 row that no # longer decrypts (e.g. after a salt-key rotation). In either @@ -1004,20 +1273,10 @@ async def store_user_oauth_credential( ) encoded = encrypt_value_helper(json.dumps(payload)) - await MCPUserCredentialsRepository(prisma_client).table.upsert( - where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}}, - data={ - "create": { - "user_id": user_id, - "server_id": server_id, - "credential_b64": encoded, - }, - "update": {"credential_b64": encoded}, - }, - ) + await _db_upsert_user_credential_row(prisma_client, user_id, server_id, encoded) -def is_oauth_credential_expired(cred: Dict[str, Any], buffer_seconds: int = 0) -> bool: +def is_oauth_credential_expired(cred: OAuthCredentialPayload, buffer_seconds: int = 0) -> bool: """Return True if the OAuth2 credential's access_token has expired. Checks the ``expires_at`` ISO-format string stored in the credential payload. @@ -1042,12 +1301,10 @@ async def get_user_oauth_credential( prisma_client: PrismaClient, user_id: str, server_id: str, -) -> Optional[Dict[str, Any]]: +) -> OAuthCredentialPayload | None: """Return the decoded OAuth2 payload dict for a user+server pair, or None.""" - row = await MCPUserCredentialsRepository(prisma_client).table.find_unique( - where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}} - ) + row = await _db_find_user_credential_row(prisma_client, user_id, server_id) if row is None: return None return _decode_oauth_payload(row.credential_b64) @@ -1056,11 +1313,11 @@ async def get_user_oauth_credential( async def list_user_oauth_credentials( prisma_client: PrismaClient, user_id: str, -) -> List[Dict[str, Any]]: +) -> list[OAuthCredentialPayload]: """Return all OAuth2 credential payloads for a user, tagged with server_id.""" - rows = await MCPUserCredentialsRepository(prisma_client).table.find_many(where={"user_id": user_id}) - results: List[Dict[str, Any]] = [] + rows = await _db_find_user_credential_rows(prisma_client, {"user_id": user_id}) + results: list[OAuthCredentialPayload] = [] for row in rows: payload = _decode_oauth_payload(row.credential_b64) if payload is None: @@ -1070,12 +1327,111 @@ async def list_user_oauth_credentials( return results +def _decrypted_credential_field(creds: dict[str, object], field: str) -> object: + """Return one credential field decrypted with the global salt key; non-string and legacy + plaintext values come back unchanged (decrypt_value_helper returns the original on failure).""" + value = creds.get(field) + if not isinstance(value, str): + return value + return decrypt_value_helper( + value=value, + key=field, + exception_type="debug", + return_original_value=True, + ) + + +def mcp_oauth_token_identity(server: object) -> tuple[object, ...]: + """The upstream-OAuth-token-determining fields of an MCP server: the resource/audience (url, or + spec_path for OpenAPI servers, plus the RFC 8707 upstream_resource sent on the authorize and + token legs), the OAuth mode/grant (auth_type, oauth2_flow), the authorization-server endpoints, + and the OAuth client + scopes. Mirrors the dashboard's getOAuthAuthorizationIdentity. When any + of these change on a server update, previously stored per-user tokens were minted for the old + identity and are stale. Excludes transport and delegate_auth_to_upstream, which do not affect + what token is minted (RFC 8693). + + client_id/client_secret are compared decrypted: stored values are NaCl-encrypted with a fresh + nonce on every write, so comparing ciphertext would flag every routine save as an identity + change and purge tokens that are still valid.""" + creds = getattr(server, "credentials", None) + if isinstance(creds, str): + try: + parsed: dict[str, object] | None = json.loads(creds) + except ValueError: + parsed = None + else: + parsed = creds + creds_dict: dict[str, object] = parsed if isinstance(parsed, dict) else {} + return ( + getattr(server, "url", None), + getattr(server, "spec_path", None), + getattr(server, "auth_type", None), + getattr(server, "oauth2_flow", None), + getattr(server, "issuer", None), + getattr(server, "authorization_url", None), + getattr(server, "token_url", None), + getattr(server, "registration_url", None), + _decrypted_credential_field(creds_dict, "client_id"), + _decrypted_credential_field(creds_dict, "client_secret"), + creds_dict.get("scopes"), + creds_dict.get("upstream_resource"), + ) + + +async def purge_user_oauth_credentials_for_server( + prisma_client: PrismaClient, + server_id: str, + invalidate_token_cache: Callable[[str, str], Awaitable[None]] | None = None, +) -> int: + """Delete every stored per-user OAuth token for a server and invalidate each user's cached + token everywhere it can be served from (the legacy per-user token cache and the v2 per-user OAuth + token store), so no user keeps a token minted for a superseded configuration. Called when a server + update changes a mint-relevant field (see mcp_oauth_token_identity). Returns the number of rows + removed. + + LiteLLM_MCPUserCredentials also stores BYOK API keys in the same column; only rows whose payload + decodes as an OAuth2 credential (see _decode_oauth_payload) are deleted, because a config change + only invalidates minted tokens, never a user's own stored key. Rows are therefore deleted per + (user_id, server_id) pair rather than by a blanket server_id filter. An OAuth row inserted while + the purge runs for a user not yet enumerated survives; a re-auth completing in the window for an + already-enumerated user is deleted along with the stale row (the pair delete cannot tell them + apart), which costs that user one extra re-auth and nothing else. + + invalidate_token_cache is injectable for tests; it defaults to the manager's shared + invalidate_user_oauth_token_cache, the single invalidation point for per-user tokens.""" + rows = await _db_find_user_credential_rows(prisma_client, {"server_id": server_id}) + oauth_rows = [row for row in rows if _decode_oauth_payload(row.credential_b64) is not None] + if not oauth_rows: + return 0 + deleted_count = await _user_credential_actions(prisma_client).delete_many( + where={"server_id": server_id, "user_id": {"in": [row.user_id for row in oauth_rows]}} + ) + if invalidate_token_cache is None: + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( + global_mcp_server_manager, + ) + + invalidate_token_cache = global_mcp_server_manager.invalidate_user_oauth_token_cache + + for row in oauth_rows: + await invalidate_token_cache(row.user_id, server_id) + if deleted_count != len(oauth_rows): + verbose_proxy_logger.warning( + "MCP server %s: purge removed %d OAuth credential row(s) but %d were enumerated; " + "row(s) were deleted concurrently during the purge", + server_id, + deleted_count, + len(oauth_rows), + ) + return deleted_count + + async def refresh_user_oauth_token( prisma_client: PrismaClient, user_id: str, - server: Any, - cred: Dict[str, Any], -) -> Optional[Dict[str, Any]]: + server: "MCPServer", + cred: OAuthCredentialPayload, +) -> OAuthCredentialPayload | None: """Attempt to refresh a per-user OAuth2 token using its stored refresh_token. POSTs to ``server.token_url`` with ``grant_type=refresh_token``. @@ -1086,11 +1442,11 @@ async def refresh_user_oauth_token( warning and returns ``None`` — the caller is responsible for clearing the stale credential and triggering re-authentication. """ - refresh_token: Optional[str] = cred.get("refresh_token") - token_url: Optional[str] = getattr(server, "token_url", None) + refresh_token: str | None = cred.get("refresh_token") + token_url: str | None = getattr(server, "token_url", None) server_id: str = getattr(server, "server_id", "") - client_id: Optional[str] = getattr(server, "client_id", None) - client_secret: Optional[str] = getattr(server, "client_secret", None) + client_id: str | None = getattr(server, "client_id", None) + client_secret: str | None = getattr(server, "client_secret", None) if not refresh_token: verbose_proxy_logger.debug( @@ -1107,24 +1463,25 @@ async def refresh_user_oauth_token( return None try: - client_auth = build_token_endpoint_client_auth( - auth_method=normalize_token_endpoint_auth_method(getattr(server, "token_endpoint_auth_method", None)), + token_request = build_upstream_oauth2_token_request( + server, + auth_method=getattr(server, "token_endpoint_auth_method", None), client_id=client_id, client_secret=client_secret, ) - token_data: Dict[str, str] = { + token_data: dict[str, str] = { "grant_type": "refresh_token", "refresh_token": refresh_token, - **client_auth.body, + **token_request.body, } async_client = get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Check) response = await async_client.post( token_url, - headers={"Accept": "application/json", **client_auth.headers}, + headers={"Accept": "application/json", **token_request.headers}, data=token_data, ) response.raise_for_status() - body: Dict[str, Any] = response.json() + body: _OAuthTokenRefreshResponse = response.json() except Exception as exc: verbose_proxy_logger.warning( "refresh_user_oauth_token: refresh request failed for user=%s server=%s: %s", @@ -1134,7 +1491,7 @@ async def refresh_user_oauth_token( ) return None - access_token: Optional[str] = body.get("access_token") + access_token: str | None = body.get("access_token") if not access_token: verbose_proxy_logger.warning( "refresh_user_oauth_token: token response missing access_token for user=%s server=%s", @@ -1143,7 +1500,7 @@ async def refresh_user_oauth_token( ) return None - expires_in: Optional[int] = None + expires_in: int | None = None raw_expires = body.get("expires_in") try: expires_in = int(raw_expires) if raw_expires is not None else None @@ -1151,10 +1508,10 @@ async def refresh_user_oauth_token( pass # Rotate refresh token when the provider returns a new one - new_refresh_token: Optional[str] = body.get("refresh_token") or refresh_token + new_refresh_token: str | None = body.get("refresh_token") or refresh_token raw_scope = body.get("scope") - scopes: Optional[List[str]] = (raw_scope.split() if isinstance(raw_scope, str) and raw_scope else None) or cred.get( + scopes: list[str] | None = (raw_scope.split() if isinstance(raw_scope, str) and raw_scope else None) or cred.get( "scopes" ) @@ -1179,10 +1536,10 @@ async def refresh_user_oauth_token( async def resolve_valid_user_oauth_token( user_id: str, - server: Any, - cred: Optional[Dict[str, Any]], - prisma_client: Optional[PrismaClient] = None, -) -> Optional[Dict[str, Any]]: + server: "MCPServer", + cred: OAuthCredentialPayload | None, + prisma_client: PrismaClient | None = None, +) -> OAuthCredentialPayload | None: """Return an OAuth2 credential whose access_token is good for the next request. Returns the credential unchanged while its token is valid for at least @@ -1220,7 +1577,7 @@ async def resolve_valid_user_oauth_token( async def resolve_user_oauth_access_token( user_id: str | None, server: "MCPServer", - prefetched_creds: dict[str, dict[str, object]] | None = None, + prefetched_creds: Mapping[str, OAuthCredentialPayload] | None = None, ) -> str | None: """Resolve a user's valid OAuth2 access token for a server: Redis cache, else DB + refresh. @@ -1231,7 +1588,7 @@ async def resolve_user_oauth_access_token( usable token; any error is swallowed to ``None`` so a transient failure reads as "not authorized" rather than raising. """ - server_id = getattr(server, "server_id", None) + server_id: str | None = getattr(server, "server_id", None) if not user_id or not server_id: return None try: @@ -1308,8 +1665,9 @@ async def get_active_submitted_mcp_server_ids_for_user( if not user_id: return [] - rows = await MCPServerRepository(prisma_client).table.find_many( - where={ + rows = await _db_find_mcp_server_rows( + prisma_client, + { "submitted_by": user_id, "approval_status": MCPApprovalStatus.active, }, @@ -1324,15 +1682,16 @@ async def approve_mcp_server( ) -> LiteLLM_MCPServerTable: """Set approval_status=active and record reviewed_at.""" now = datetime.now(timezone.utc) - updated = await MCPServerRepository(prisma_client).table.update( - where={"server_id": server_id}, - data={ + updated = await _db_update_mcp_server_row( + prisma_client, + server_id, + { "approval_status": MCPApprovalStatus.active, "reviewed_at": now, "updated_by": touched_by, }, ) - table = LiteLLM_MCPServerTable(**updated.model_dump()) + table = LiteLLM_MCPServerTable.model_validate(updated.model_dump()) decrypt_global_env_var_values(table.env_vars) return table @@ -1341,22 +1700,19 @@ async def reject_mcp_server( prisma_client: PrismaClient, server_id: str, touched_by: str, - review_notes: Optional[str] = None, + review_notes: str | None = None, ) -> LiteLLM_MCPServerTable: """Set approval_status=rejected, record reviewed_at and review_notes.""" now = datetime.now(timezone.utc) - data: Dict[str, Any] = { + data: prisma_db_types.LiteLLM_MCPServerTableUpdateInput = { "approval_status": MCPApprovalStatus.rejected, "reviewed_at": now, "updated_by": touched_by, } if review_notes is not None: data["review_notes"] = review_notes - updated = await MCPServerRepository(prisma_client).table.update( - where={"server_id": server_id}, - data=data, - ) - table = LiteLLM_MCPServerTable(**updated.model_dump()) + updated = await _db_update_mcp_server_row(prisma_client, server_id, data) + table = LiteLLM_MCPServerTable.model_validate(updated.model_dump()) decrypt_global_env_var_values(table.env_vars) return table @@ -1369,12 +1725,12 @@ async def get_mcp_submissions( along with a summary count breakdown by approval_status. Mirrors get_guardrail_submissions() from guardrail_endpoints.py. """ - rows = await MCPServerRepository(prisma_client).table.find_many( + rows: list[prisma_db_models.LiteLLM_MCPServerTable] = await MCPServerRepository(prisma_client).table.find_many( where={"submitted_at": {"not": None}}, order={"submitted_at": "desc"}, take=500, # safety cap; paginate if needed in a future iteration ) - items = [LiteLLM_MCPServerTable(**r.model_dump()) for r in rows] + items = [LiteLLM_MCPServerTable.model_validate(r.model_dump()) for r in rows] for item in items: decrypt_global_env_var_values(item.env_vars) @@ -1394,7 +1750,7 @@ async def get_mcp_submissions( # ── Per-user MCP environment variables ──────────────────────────────────── -def _decode_user_env_vars(stored: str) -> Dict[str, str]: +def _decode_user_env_vars(stored: str) -> dict[str, str]: """Decrypt a ``values_b64`` blob and parse it as a flat ``{name: value}`` dict.""" decrypted = decrypt_value_helper( value=stored, @@ -1410,6 +1766,7 @@ def _decode_user_env_vars(stored: str) -> Dict[str, str]: "re-enter them rather than silently forwarding ciphertext" ) return {} + parsed: dict[str, object] | None try: parsed = json.loads(decrypted) except (ValueError, TypeError): @@ -1423,9 +1780,9 @@ async def get_user_env_vars( prisma_client: PrismaClient, user_id: str, server_id: str, -) -> Dict[str, str]: +) -> dict[str, str]: """Return the calling user's env var dict for ``server_id`` (empty if none).""" - row = await prisma_client.db.litellm_mcpuserenvvars.find_unique( + row = await _user_env_var_actions(prisma_client).find_unique( where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}} ) if row is None: @@ -1437,7 +1794,7 @@ async def get_user_env_vars_bulk( prisma_client: PrismaClient, user_id: str, server_ids: Iterable[str], -) -> Dict[str, Dict[str, str]]: +) -> dict[str, dict[str, str]]: """Return ``{server_id: {var_name: value}}`` for one user across many servers. Servers with no stored row are simply absent from the result. @@ -1445,7 +1802,7 @@ async def get_user_env_vars_bulk( ids = list(server_ids) if not ids: return {} - rows = await prisma_client.db.litellm_mcpuserenvvars.find_many(where={"user_id": user_id, "server_id": {"in": ids}}) + rows = await _db_find_user_env_var_rows(prisma_client, {"user_id": user_id, "server_id": {"in": ids}}) return {row.server_id: _decode_user_env_vars(row.values_b64) for row in rows} @@ -1453,9 +1810,9 @@ async def merge_user_env_vars( prisma_client: PrismaClient, user_id: str, server_id: str, - updates: Dict[str, str], + updates: dict[str, str], allowed_names: Iterable[str], -) -> Dict[str, str]: +) -> dict[str, str]: """Merge ``updates`` into the user's stored env vars for ``server_id`` and return the resulting set. @@ -1472,7 +1829,7 @@ async def merge_user_env_vars( ) async with prisma_client.db.tx() as tx: await tx.execute_raw("SELECT pg_advisory_xact_lock($1::bigint)", lock_key) - row = await tx.litellm_mcpuserenvvars.find_unique( + row: prisma_db_models.LiteLLM_MCPUserEnvVars | None = await tx.litellm_mcpuserenvvars.find_unique( where={"user_id_server_id": {"user_id": user_id, "server_id": server_id}} ) existing = _decode_user_env_vars(row.values_b64) if row is not None else {} @@ -1502,4 +1859,4 @@ async def delete_user_env_vars( Uses ``delete_many`` so a missing row is a no-op; real DB errors still propagate to the caller instead of being silently swallowed. """ - await prisma_client.db.litellm_mcpuserenvvars.delete_many(where={"user_id": user_id, "server_id": server_id}) + await _user_env_var_actions(prisma_client).delete_many(where={"user_id": user_id, "server_id": server_id}) diff --git a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py index c87e900aa2a..caa5c65894c 100644 --- a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py +++ b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py @@ -3,6 +3,7 @@ import html as _html import json import secrets import time +from collections.abc import Mapping from datetime import datetime, timezone from typing import TYPE_CHECKING, Any, Dict, Literal, Optional, Tuple from urllib.parse import parse_qsl, urlencode, urlparse, urlunparse @@ -10,21 +11,53 @@ from urllib.parse import parse_qsl, urlencode, urlparse, urlunparse import httpx from fastapi import APIRouter, Form, HTTPException, Request from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse, Response -from pydantic import BaseModel, ValidationError +from pydantic import BaseModel, ConfigDict, Field, SecretStr, ValidationError from litellm._logging import verbose_logger +from litellm.caching.in_memory_cache import InMemoryCache from litellm.llms.custom_httpx.http_handler import ( get_async_httpx_client, httpxSpecialProvider, ) from litellm.proxy._experimental.mcp_server.auth.token_endpoint_auth import ( TokenEndpointAuthConfigError, - build_token_endpoint_client_auth, + normalize_token_endpoint_auth_method, +) +from litellm.types.mcp_server.mcp_server_manager import MCPTokenEndpointAuthMethod +from litellm.proxy._experimental.mcp_server.bridge_token_flow import ( + _bridge_mint_error_response, + _BridgeMintReady, + _BridgeRefreshReady, + _extract_user_id_from_request, + _finish_bridge_mint, + _prepare_bridge_mint, + _prepare_bridge_refresh, + _reload_active_user_by_id, +) +from litellm.proxy._experimental.mcp_server.faults import ( + CallerRejected, + CredentialSource, + UpstreamProtocolFault, + classify_upstream_dcr_rejection, + classify_upstream_token_rejection, + dcr_fault_detail, + render_token_fault, +) +from litellm.proxy._experimental.mcp_server.gateway_dcr_flow import ( + aggregate_authorize, + aggregate_token, + complete_connect_flow, + is_gateway_dcr_client_id, + register_aggregate_client, + relative_request_url, ) from litellm.proxy._experimental.mcp_server.oauth_utils import ( TOKEN_NO_CACHE_HEADERS, + build_upstream_oauth2_token_request, get_request_base_url, + resolve_upstream_resource, validate_trusted_redirect_uri, + well_known_root_suffix, ) from litellm.proxy.auth.ip_address_utils import IPAddressUtils from litellm.proxy.common_utils.encrypt_decrypt_utils import ( @@ -32,12 +65,11 @@ from litellm.proxy.common_utils.encrypt_decrypt_utils import ( encrypt_value_helper, ) from litellm.proxy.common_utils.http_parsing_utils import _read_request_body -from litellm.proxy.utils import get_server_root_path from litellm.types.mcp import MCPAuth, MCPCredentials from litellm.types.mcp_server.mcp_server_manager import MCPServer if TYPE_CHECKING: - from litellm.proxy._types import LiteLLM_MCPServerTable, UserAPIKeyAuth + from litellm.proxy._types import LiteLLM_MCPServerTable # TTL cache for upstream OAuth metadata fetched from pass-through MCP servers. # Keeps us from hammering the upstream IdP on each discovery request. @@ -91,6 +123,11 @@ def encode_state_with_base_url( code_challenge: Optional[str] = None, code_challenge_method: Optional[str] = None, client_redirect_uri: Optional[str] = None, + litellm_user_id: str | None = None, + mcp_server_id: str | None = None, + dcr_client_id: str | None = None, + dcr_client_secret: str | None = None, + dcr_token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None, ) -> str: """ Encode the base_url, original state, and PKCE parameters using encryption. @@ -101,6 +138,21 @@ def encode_state_with_base_url( code_challenge: PKCE code challenge from client code_challenge_method: PKCE code challenge method from client client_redirect_uri: Original redirect_uri from client + litellm_user_id: The SSO-authenticated litellm user captured at the bridge authorize + (interactive dcr_bridge oauth_delegate only); the callback seals it into the gateway + authorization code so the token mint can bind the envelope to this user + mcp_server_id: The server the flow targets, sealed alongside litellm_user_id (bridge) or + dcr_client_id (ephemeral mint) so the gateway code cannot be replayed against another + server + dcr_client_id: The ephemeral DCR client the gateway minted at authorize for a + client-forwarded-token server with no caller-supplied client; the callback seals it + into the forwarded authorization code so the token exchange can authenticate with it + while the gateway stores nothing + dcr_client_secret: The minted client's secret, when the upstream issued one + dcr_token_endpoint_auth_method: The token-endpoint auth method the upstream's registration + response granted the minted client, sealed alongside the credentials so the exchange + authenticates the way the upstream expects instead of falling back to the server row's + configured method Returns: An encrypted string that encodes all values @@ -111,6 +163,11 @@ def encode_state_with_base_url( "code_challenge": code_challenge, "code_challenge_method": code_challenge_method, "client_redirect_uri": client_redirect_uri, + "litellm_user_id": litellm_user_id, + "mcp_server_id": mcp_server_id, + "dcr_client_id": dcr_client_id, + "dcr_client_secret": dcr_client_secret, + "dcr_token_endpoint_auth_method": dcr_token_endpoint_auth_method, } state_json = json.dumps(state_data, sort_keys=True) encrypted_state = encrypt_value_helper(state_json) @@ -138,6 +195,166 @@ def decode_state_hash(encrypted_state: str) -> dict: return state_data +_BRIDGE_AUTH_CODE_PREFIX = "llm_bcode_" + + +class _BridgeAuthorizationCode(BaseModel): + """The identity and upstream code the gateway seals into the authorization code it hands a DCR + client for an interactive dcr_bridge oauth_delegate sign-in, recovered at the token endpoint.""" + + model_config = ConfigDict(frozen=True) + upstream_code: str = Field(min_length=1) + litellm_user_id: str = Field(min_length=1) + mcp_server_id: str = Field(min_length=1) + + +def is_bridge_authorization_code(code: str) -> bool: + """Cheap prefix check that ``code`` is a gateway-sealed bridge authorization code rather than a + raw upstream code, so the token endpoint can route without decrypting.""" + return code.startswith(_BRIDGE_AUTH_CODE_PREFIX) + + +def seal_bridge_authorization_code(upstream_code: str, litellm_user_id: str, mcp_server_id: str) -> str: + """Seal the upstream authorization code and the SSO-captured litellm user into a gateway + authorization code. The DCR client only echoes this opaque value back at the token endpoint; the + gateway decrypts it there to recover the user (to bind the envelope) and the upstream code (to + exchange with the upstream), so a litellm identity captured in the browser at authorize survives + to the back-channel token call with nothing stored server-side. Encrypted with the repo's + authenticated symmetric helper (the same family the OAuth state uses), so the client can neither + read nor forge it.""" + payload = json.dumps( + {"upstream_code": upstream_code, "litellm_user_id": litellm_user_id, "mcp_server_id": mcp_server_id}, + sort_keys=True, + ) + return _BRIDGE_AUTH_CODE_PREFIX + encrypt_value_helper(payload) + + +def open_bridge_authorization_code(code: str) -> _BridgeAuthorizationCode | None: + """Recover the sealed identity and upstream code, or ``None`` when ``code`` is not a gateway + bridge code or does not decrypt / validate. Total over hostile input: a raw upstream code (the + scripted two-header path) returns ``None`` and the caller falls through to the existing + behavior.""" + if not is_bridge_authorization_code(code): + return None + decrypted = decrypt_value_helper( + code[len(_BRIDGE_AUTH_CODE_PREFIX) :], "bridge_authorization_code", return_original_value=False + ) + if not isinstance(decrypted, str): + return None + try: + return _BridgeAuthorizationCode.model_validate_json(decrypted) + except ValidationError: + return None + + +_PASSTHROUGH_AUTH_CODE_PREFIX = "llm_ptcode_" + + +class PassthroughAuthorizationCode(BaseModel): + """The ephemeral DCR client and upstream code the gateway seals into the authorization code it + forwards for a client-forwarded-token server (``true_passthrough`` / ``oauth_delegate``) whose + authorize fell through to gateway-side registration. These modes forbid the gateway from storing + an OAuth client identity, so the minted client survives only inside this sealed value: the + client echoes it back at the token endpoint, where the gateway recovers the client to + authenticate the upstream exchange. ``mcp_server_id`` binds the code to the server it was minted + for so it cannot be spent at another server's token endpoint.""" + + model_config = ConfigDict(frozen=True) + upstream_code: str = Field(min_length=1) + client_id: str = Field(min_length=1) + client_secret: str | None = None + token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None + mcp_server_id: str = Field(min_length=1) + + +def seal_passthrough_authorization_code( + upstream_code: str, + client_id: str, + client_secret: str | None, + mcp_server_id: str, + token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None, +) -> str: + """Seal the upstream authorization code together with the ephemeral DCR client that authorized + it. Encrypted with the same authenticated symmetric helper as the OAuth state and bridge codes, + so the client can neither read the (possibly confidential) client credentials nor forge a + code.""" + payload = json.dumps( + { + "upstream_code": upstream_code, + "client_id": client_id, + "client_secret": client_secret, + "token_endpoint_auth_method": token_endpoint_auth_method, + "mcp_server_id": mcp_server_id, + }, + sort_keys=True, + ) + return _PASSTHROUGH_AUTH_CODE_PREFIX + encrypt_value_helper(payload) + + +def open_passthrough_authorization_code(code: str) -> PassthroughAuthorizationCode | None: + """Recover the sealed ephemeral client and upstream code, or ``None`` when ``code`` is not a + gateway passthrough code or does not decrypt / validate, so a raw upstream code falls through to + the existing caller-supplied-client behavior.""" + if not code.startswith(_PASSTHROUGH_AUTH_CODE_PREFIX): + return None + decrypted = decrypt_value_helper( + code[len(_PASSTHROUGH_AUTH_CODE_PREFIX) :], "passthrough_authorization_code", return_original_value=False + ) + if not isinstance(decrypted, str): + return None + try: + return PassthroughAuthorizationCode.model_validate_json(decrypted) + except ValidationError: + return None + + +def redeem_passthrough_authorization_code( + code: str | None, mcp_server: MCPServer, code_verifier: str | None +) -> PassthroughAuthorizationCode | None: + """The single redemption gate for sealed passthrough codes: a raw or foreign code returns + ``None`` so the caller keeps its existing behavior, while a genuine sealed code must be spent + at the server it was minted for and must carry the PKCE verifier of the S256 flow that minted + it (the mint refuses downgraded flows, so a verifier-less redemption is an interception + attempt, not a legitimate client).""" + if not code: + return None + sealed = open_passthrough_authorization_code(code) + if sealed is None: + return None + if sealed.mcp_server_id != mcp_server.server_id: + raise HTTPException( + status_code=400, + detail="Authorization code was issued for a different MCP server", + ) + if not code_verifier: + raise HTTPException( + status_code=400, + detail="code_verifier is required to redeem this authorization code", + ) + return sealed + + +def _session_cookie_user_id(request: Request) -> str | None: + """The signed-in litellm user for a browser request, or ``None``. Thin wrapper so the + aggregate DCR flow's verbs receive the identity as a plain value instead of parsing + cookies themselves.""" + from litellm.proxy._experimental.mcp_server.byok_oauth_endpoints import ( # noqa: PLC0415 # circular import at module load + _user_id_from_session_cookie, + ) + + return _user_id_from_session_cookie(request) + + +def _redirect_to_litellm_login(request: Request) -> RedirectResponse: + """Send an unauthenticated browser through litellm login before the interactive bridge authorize + can capture its identity. The bridge oauth_delegate flow seals the SSO user into the gateway code, + so a session is required; without one there is nothing to bind. A same-origin relative + ``return_to`` (honored by the SSO callback) brings the browser straight back to this authorize + request after login instead of stranding it on the dashboard.""" + base_url = get_request_base_url(request) + return RedirectResponse(f"{base_url}/sso/key/generate?{urlencode({'return_to': relative_request_url(request)})}") + + # LIT-4197: some upstream authorization servers reject an over-long ``state`` # (the encrypted OAuth session blob routinely exceeds their limit). The upstream # only needs an opaque value it echoes back on ``/callback``, so we forward a @@ -304,90 +521,6 @@ def _validate_token_response( ) -def _litellm_key_from_request(request: Request) -> Optional[str]: - """Return the LiteLLM API key presented on the request, or ``None``. - - Accepts the key from ``x-litellm-api-key`` (what MCP clients such as Claude Desktop/Code - send) as well as ``Authorization``; either may carry a bare token or ``Bearer ``. - ``x-litellm-api-key`` wins when both are present, since ``Authorization`` may instead carry - an OAuth/upstream bearer. - """ - for header_value in ( - request.headers.get("x-litellm-api-key"), - request.headers.get("Authorization") or request.headers.get("authorization"), - ): - if not header_value: - continue - value = header_value.strip() - if value.lower().startswith("bearer "): - value = value[7:].strip() - if value: - return value - return None - - -def _active_key_user_id(key_obj: "UserAPIKeyAuth") -> Optional[str]: - """The key's ``user_id``, or ``None`` if the key is blocked or expired. - - The OAuth token endpoint is unauthenticated, so the presented key is validated here before its - identity is trusted to key a stored credential; a revoked or expired key must not be able to - write or overwrite the per-user OAuth token. ``get_key_object`` resolves a row without these - checks (the main ``user_api_key_auth`` pipeline enforces them downstream, which this endpoint - bypasses), so they are applied here. Deleted keys are already rejected upstream, where - ``get_key_object`` raises on a row that no longer exists. - """ - if key_obj.blocked is True: - return None - expires = key_obj.expires - if expires is not None: - expiry = expires if isinstance(expires, datetime) else datetime.fromisoformat(expires) - if expiry.tzinfo is None or expiry.tzinfo.utcoffset(expiry) is None: - expiry = expiry.replace(tzinfo=timezone.utc) - if expiry < datetime.now(timezone.utc): - return None - return key_obj.user_id - - -async def _extract_user_id_from_request(request: Request) -> Optional[str]: - """Resolve the LiteLLM ``user_id`` at the OAuth token endpoint so a per-user token is stored - under the same identity the egress later reads it by (``user_api_key_auth.user_id``). - - Resolves authoritatively via ``get_key_object`` (cache first, then DB) instead of a raw cache - peek. On a multi-replica gateway the token-exchange request can land on a worker whose in-memory - cache never saw the key, and a cross-replica Redis hit deserializes to a plain ``dict`` rather - than a ``UserAPIKeyAuth``; the previous code read only ``Authorization`` and did - ``getattr(cached, "user_id")`` with no ``model_type`` rehydration and no DB fallback, so it - silently returned ``None`` and the token was never persisted, which makes the egress 401 on every - reconnect. The resolved key is validated (``_active_key_user_id``) before its identity is trusted, - so a blocked or expired key cannot write. Returns ``None`` when no key is present, the key cannot - be resolved, or it is blocked/expired. - """ - token = _litellm_key_from_request(request) - if not token: - return None - try: - from litellm.proxy._types import hash_token # noqa: PLC0415 - from litellm.proxy.auth.auth_checks import get_key_object # noqa: PLC0415 - from litellm.proxy.proxy_server import ( # noqa: PLC0415 - prisma_client, - user_api_key_cache, - ) - - key_obj = await get_key_object( - hashed_token=hash_token(token), - prisma_client=prisma_client, - user_api_key_cache=user_api_key_cache, - ) - return _active_key_user_id(key_obj) - except Exception as exc: - verbose_logger.debug( - "_extract_user_id_from_request: could not resolve a LiteLLM user_id for the presented " - "key (%s); per-user token will not be stored server-side.", - type(exc).__name__, - ) - return None - - async def _store_per_user_token_server_side( server: MCPServer, user_id: str, @@ -465,8 +598,20 @@ async def _store_per_user_token_server_side( def _raise_if_not_oauth2(mcp_server: MCPServer) -> None: - """Reject a non-oauth2 server from the gateway's OAuth authorize/token/register flow.""" - if mcp_server.auth_type == MCPAuth.oauth2: + """Reject a server without upstream OAuth from the gateway's authorize/token/register flow. + + The client-forwarded token modes (``true_passthrough`` / ``oauth_delegate``) are allowed + through: the caller owns the upstream token, and this relayed flow is how a browser obtains + one against the upstream IdP (the admin UI's browser-only Authorize uses it). The minted + token is upstream-audienced and held by the caller; the gateway persists nothing for these + modes (``_persist_dcr_client_registration`` skips them unconditionally, so even the admin + Authorize path with ``persist_credentials`` enabled writes nothing to the server row). + """ + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( # noqa: PLC0415 # circular import with mcp_server_manager at module load + _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES, + ) + + if mcp_server.auth_type in _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES: return raise HTTPException( status_code=400, @@ -482,28 +627,122 @@ def _raise_if_not_oauth2(mcp_server: MCPServer) -> None: ) +def _endpoint_not_configured_detail( + mcp_server: MCPServer, + endpoint_label: str, + manual_remedy: str, + issuer_remedy: str, +) -> str: + """The 400 detail for an unresolved OAuth endpoint, naming the likely cause for this server's + shape (LIT-4658): an anchored issuer whose metadata fell short, a configured (possibly + misconfigured) server url whose discovery failed, or no discovery source at all. Kept free of + URLs and issuer values because these endpoints are reachable pre-auth.""" + if mcp_server.issuer_is_anchored: + return ( + f"MCP server {endpoint_label} is not configured. Endpoint discovery anchored on the configured " + f"Issuer (RFC 8414) failed or its metadata did not include this endpoint; check the proxy logs " + f"for 'MCP OAuth' warnings from server load, verify the Issuer, or {manual_remedy}." + ) + if mcp_server.url: + return ( + f"MCP server {endpoint_label} is not configured. OAuth endpoint discovery against the configured " + f"server url did not resolve it; the url may be misconfigured. Check the proxy logs for " + f"'MCP OAuth' warnings from server load, verify the server url, or {manual_remedy}, or " + f"{issuer_remedy}." + ) + return ( + f"MCP server {endpoint_label} is not configured. Servers with no url (OpenAPI spec or stdio) run no " + f"resource discovery, so {manual_remedy}, or {issuer_remedy}." + ) + + def _raise_unless_oauth2_discovery_server( mcp_server: Optional[MCPServer], mcp_server_name: Optional[str], description: str, ) -> None: - """404 a NAMED discovery request unless it resolves to an oauth2 server. + """404 a NAMED discovery request unless it resolves to an oauth2 or DCR-bridge server. A named server that is unknown (or hidden from the caller) and one that exists but is non-oauth2 both return the same 404, so the well-known discovery paths cannot be used to enumerate non-OAuth server names. Root discovery (no name) is unaffected, and pass-through servers are resolved by the caller before this runs. + DCR-bridge servers are admitted because they serve the gateway's own authorization + server metadata (the register, authorize, and token relays). """ if mcp_server_name is None: return if mcp_server is not None and mcp_server.auth_type == MCPAuth.oauth2: return + if mcp_server is not None and mcp_server.is_dcr_bridge: + return raise HTTPException( status_code=404, detail=f"MCP server '{mcp_server_name}' is {description}", ) +def _dcr_bridge_relays_client_registration(mcp_server: MCPServer) -> bool: + """True when a DCR-bridge server relays client registration to the upstream authorization + server instead of short-circuiting to an admin-configured OAuth client. In the relay arm the + upstream holds each client's own registration, so the authorize and token relays pass the + client's ``client_id`` and ``redirect_uri`` through verbatim and the authorization code + returns directly to the client's redirect URI without transiting the gateway. Gateway-side + redirect trust and the ``/callback`` state relay therefore only apply to the short-circuit + arm, where the upstream only knows the gateway's own callback.""" + return mcp_server.is_dcr_bridge and bool(mcp_server.registration_url) and not mcp_server.client_id + + +def _require_s256_pkce( + code_challenge: Optional[str], + code_challenge_method: Optional[str], +) -> Tuple[str, str]: + """DCR-bridge servers serve unauthenticated public OAuth clients, so the PKCE downgrade + paths (no challenge, or a non-S256 method; RFC 7636 defaults a missing method to ``plain``) + are rejected at the gateway instead of relying on upstream enforcement. Returns the + validated pair so callers get non-optional values.""" + if code_challenge and code_challenge_method == "S256": + return code_challenge, code_challenge_method + raise HTTPException( + status_code=400, + detail=( + "This server requires PKCE: send code_challenge with " + "code_challenge_method=S256 on the authorization request" + ), + ) + + +def _redirect_to_upstream_authorize( + *, + mcp_server: MCPServer, + client_id: str, + redirect_uri: str, + state: str, + code_challenge: str, + code_challenge_method: str, + response_type: Optional[str], + scope: Optional[str], +) -> RedirectResponse: + """The bridge relay arm's authorize redirect: every client-supplied parameter passes through + to the upstream authorize endpoint verbatim, no relay state cookie is set, and the upstream + enforces its own registered redirect binding for the client.""" + scope_value = scope or (" ".join(mcp_server.scopes) if mcp_server.scopes else None) + upstream_resource = resolve_upstream_resource(mcp_server) + passthrough_params = { + "client_id": client_id, + "redirect_uri": redirect_uri, + "state": state, + "response_type": response_type or "code", + "code_challenge": code_challenge, + "code_challenge_method": code_challenge_method, + **({"scope": scope_value} if scope_value else {}), + **({"resource": upstream_resource} if upstream_resource else {}), + } + parsed_auth_url = urlparse(mcp_server.authorization_url or "") + merged_params = {**dict(parse_qsl(parsed_auth_url.query)), **passthrough_params} + return RedirectResponse(urlunparse(parsed_auth_url._replace(query=urlencode(merged_params)))) + + async def authorize_with_server( request: Request, mcp_server: MCPServer, @@ -514,11 +753,40 @@ async def authorize_with_server( code_challenge_method: Optional[str] = None, response_type: Optional[str] = None, scope: Optional[str] = None, + ephemeral_dcr_client: "EphemeralDcrClient | None" = None, ): - if mcp_server.auth_type != "oauth2": - raise HTTPException(status_code=400, detail="MCP server is not OAuth2") + _raise_if_not_oauth2(mcp_server) if mcp_server.authorization_url is None: - raise HTTPException(status_code=400, detail="MCP server authorization url is not set") + raise HTTPException( + status_code=400, + detail=_endpoint_not_configured_detail( + mcp_server, + "authorization url", + "set Authorization URL and Token URL manually", + "set Issuer to discover them from the identity provider (RFC 8414)", + ), + ) + + if mcp_server.is_dcr_bridge: + # Enforce S256 PKCE on both bridge arms. The relay arm forwards the validated, + # now-non-optional pair to the upstream authorize; the short-circuit arm keeps + # calling this for its enforcement side effect, then falls through to the gateway + # /callback flow below, which reads the original code_challenge names. + bridge_challenge, bridge_method = _require_s256_pkce(code_challenge, code_challenge_method) + # A gateway-minted ephemeral client is registered against {base}/callback, so its + # flow must run the short-circuit arm; the relay arm is only for clients that + # registered themselves through the front door and hold their own redirect binding. + if _dcr_bridge_relays_client_registration(mcp_server) and ephemeral_dcr_client is None: + return _redirect_to_upstream_authorize( + mcp_server=mcp_server, + client_id=client_id, + redirect_uri=redirect_uri, + state=state, + code_challenge=bridge_challenge, + code_challenge_method=bridge_method, + response_type=response_type, + scope=scope, + ) # Trusted redirect_uri: same-origin, loopback, or ops-allowlisted. # The URI is encrypted into the OAuth state and decoded on @@ -528,12 +796,36 @@ async def authorize_with_server( parsed = urlparse(redirect_uri) base_url = urlunparse(parsed._replace(query="")) request_base_url = get_request_base_url(request) + + # Interactive dcr_bridge oauth_delegate sign-in: this arm runs the gateway /callback and /token in + # the loop, so the gateway can capture the litellm user here (from the browser's UI session) and + # carry it to the back-channel token mint. Seal the SSO user and the target server into the state; + # the callback reads them back to mint the gateway authorization code. A DCR client cannot present a + # litellm key, so the browser session is the only identity source; without one there is nothing to + # bind, so send the user through login first. Every other oauth2 server keeps the identity-less state. + litellm_user_id: str | None = None + if mcp_server.is_dcr_bridge and mcp_server.is_oauth_delegate: + from litellm.proxy._experimental.mcp_server.byok_oauth_endpoints import ( # noqa: PLC0415 # inline import avoids a module-load circular import + _user_id_from_session_cookie, + ) + + litellm_user_id = _user_id_from_session_cookie(request) + if litellm_user_id is None: + return _redirect_to_litellm_login(request) + encoded_state = encode_state_with_base_url( base_url=base_url, original_state=state, code_challenge=code_challenge, code_challenge_method=code_challenge_method, client_redirect_uri=redirect_uri, + litellm_user_id=litellm_user_id, + mcp_server_id=mcp_server.server_id if (litellm_user_id or ephemeral_dcr_client) else None, + dcr_client_id=ephemeral_dcr_client.client_id if ephemeral_dcr_client else None, + dcr_client_secret=ephemeral_dcr_client.client_secret if ephemeral_dcr_client else None, + dcr_token_endpoint_auth_method=ephemeral_dcr_client.token_endpoint_auth_method + if ephemeral_dcr_client + else None, ) relay_state = secrets.token_urlsafe(_OAUTH_STATE_HANDLE_BYTES) @@ -553,6 +845,10 @@ async def authorize_with_server( if code_challenge_method: params["code_challenge_method"] = code_challenge_method + upstream_resource = resolve_upstream_resource(mcp_server) + if upstream_resource: + params["resource"] = upstream_resource + parsed_auth_url = urlparse(mcp_server.authorization_url) existing_params = dict(parse_qsl(parsed_auth_url.query)) existing_params.update(params) @@ -562,6 +858,13 @@ async def authorize_with_server( return response +def _token_credential_source(mcp_server: MCPServer) -> CredentialSource: + """Mirrors the resolved-client rule in :func:`exchange_token_with_server`: when the server has a + stored client_id the gateway presents its own credentials upstream, so a credential rejection is + the operator's fault, not the caller's.""" + return "gateway_stored" if mcp_server.client_id else "caller_supplied" + + async def exchange_token_with_server( request: Request, mcp_server: MCPServer, @@ -573,73 +876,166 @@ async def exchange_token_with_server( code_verifier: Optional[str], refresh_token: Optional[str] = None, scope: Optional[str] = None, + client_token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None, ): _raise_if_not_oauth2(mcp_server) if grant_type not in ("authorization_code", "refresh_token"): raise HTTPException(status_code=400, detail="Unsupported grant_type") if mcp_server.token_url is None: - raise HTTPException(status_code=400, detail="MCP server token url is not set") + raise HTTPException( + status_code=400, + detail=_endpoint_not_configured_detail( + mcp_server, + "token url", + "set Token URL manually", + "set Issuer to discover it from the identity provider (RFC 8414)", + ), + ) - # The id and secret must come from the same source. When the server-side client_id wins, - # falling back to the caller's secret pairs the persisted client with a foreign secret; the - # register short-circuit hands clients a placeholder secret ("dummy"), so a re-auth against a - # persisted public PKCE client (no stored secret) would send that placeholder and the IdP 401s. + # The id, secret, and token-endpoint auth method must come from the same source. When the + # server-side client_id wins, falling back to the caller's secret pairs the persisted client + # with a foreign secret; the register short-circuit hands clients a placeholder secret + # ("dummy"), so a re-auth against a persisted public PKCE client (no stored secret) would send + # that placeholder and the IdP 401s. Symmetrically, a caller-side client (an ephemeral mint + # recovered from a sealed code) must authenticate the way its own registration was granted, + # not the way the server row is configured; callers that carry no method keep the row's method + # as before. resolved_client_id = mcp_server.client_id if mcp_server.client_id else client_id resolved_client_secret = mcp_server.client_secret if mcp_server.client_id else client_secret + resolved_auth_method = ( + mcp_server.token_endpoint_auth_method + if mcp_server.client_id + else (client_token_endpoint_auth_method or mcp_server.token_endpoint_auth_method) + ) try: - client_auth = build_token_endpoint_client_auth( - auth_method=mcp_server.token_endpoint_auth_method, + token_request = build_upstream_oauth2_token_request( + mcp_server, + auth_method=resolved_auth_method, client_id=resolved_client_id, client_secret=resolved_client_secret, ) except TokenEndpointAuthConfigError as exc: raise HTTPException(status_code=400, detail=str(exc)) from exc + bridge_identity: _BridgeAuthorizationCode | None = None + bridge_mint_ready: _BridgeMintReady | None = None + bridge_upstream_refresh: SecretStr | None = None + bridge_upstream_scope: str | None = None + refresh_request_scope: str | None = None + is_bridge = mcp_server.is_oauth_delegate and mcp_server.is_dcr_bridge + if grant_type == "refresh_token": - if not refresh_token: + # Phase 1 for a bridge refresh: open the client's refresh envelope, re-validate the sealed + # identity, and unwrap the real upstream refresh token BEFORE building token_data, so the exchange + # sends the upstream token and never the envelope. A failure returns without touching the upstream. + if is_bridge: + prepared_refresh = await _prepare_bridge_refresh(mcp_server, refresh_token) + if not isinstance(prepared_refresh, _BridgeRefreshReady): + return _bridge_mint_error_response(prepared_refresh) + bridge_mint_ready = prepared_refresh.ready + bridge_upstream_refresh = prepared_refresh.upstream_refresh_token + bridge_upstream_scope = prepared_refresh.upstream_scope + # A bridge server sends the unwrapped upstream refresh token recovered from the client's refresh + # envelope above; every other server sends the client's own refresh token verbatim. + upstream_refresh_token = ( + bridge_upstream_refresh.get_secret_value() if bridge_upstream_refresh is not None else refresh_token + ) + if not upstream_refresh_token: raise HTTPException( status_code=400, detail="refresh_token is required for refresh_token grant", ) token_data: dict = { "grant_type": "refresh_token", - "refresh_token": refresh_token, - **client_auth.body, + "refresh_token": upstream_refresh_token, + **token_request.body, } - if scope: - token_data["scope"] = scope + refresh_request_scope = scope or bridge_upstream_scope + if refresh_request_scope: + token_data["scope"] = refresh_request_scope else: if not code: raise HTTPException( status_code=400, detail="code is required for authorization_code grant", ) + # Interactive dcr_bridge oauth_delegate: the client presents the gateway authorization code the + # callback sealed. Recover the SSO user and the real upstream code from it; the upstream exchange + # below uses the upstream code, and the mint binds the envelope to the recovered user. Bind the + # sealed server to this request so a code minted for one bridge server cannot be spent at another. + # A raw upstream code (scripted path) opens to None and the code is used as-is. + bridge_identity = open_bridge_authorization_code(code) + if bridge_identity is not None: + if bridge_identity.mcp_server_id != mcp_server.server_id: + raise HTTPException( + status_code=400, + detail="Authorization code was issued for a different MCP server", + ) + code = bridge_identity.upstream_code + bridge_token_relay = _dcr_bridge_relays_client_registration(mcp_server) + if bridge_token_relay and not redirect_uri: + raise HTTPException( + status_code=400, + detail=( + "redirect_uri is required for the authorization_code grant on this server; " + "send the same redirect_uri used on the authorization request" + ), + ) proxy_base_url = get_request_base_url(request) + resolved_redirect_uri = redirect_uri if bridge_token_relay else f"{proxy_base_url}/callback" token_data = { "grant_type": "authorization_code", "code": code, - "redirect_uri": f"{proxy_base_url}/callback", - **client_auth.body, + "redirect_uri": resolved_redirect_uri, + **token_request.body, } if code_verifier: token_data["code_verifier"] = code_verifier + # Phase 1 for a bridge authorization_code mint: resolve identity (the SSO user recovered above, or + # the presented litellm key) and the envelope keys BEFORE the exchange consumes the single-use code. + if is_bridge: + prepared = await _prepare_bridge_mint(request, mcp_server, bridge_identity) + if not isinstance(prepared, _BridgeMintReady): + return _bridge_mint_error_response(prepared) + bridge_mint_ready = prepared async_client = get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Check) - response = await async_client.post( - mcp_server.token_url, - headers={"Accept": "application/json", **client_auth.headers}, - data=token_data, - ) + try: + response = await async_client.post( + mcp_server.token_url, + headers={"Accept": "application/json", **token_request.headers}, + data=token_data, + ) + if response is not None: + response.raise_for_status() + except httpx.HTTPStatusError as exc: + fault = classify_upstream_token_rejection( + exc.response, + credential_source=_token_credential_source(mcp_server), + log_context=mcp_server.server_id, + ) + upstream_rejected_bridge_refresh = ( + is_bridge + and grant_type == "refresh_token" + and isinstance(fault, CallerRejected) + and fault.code == "invalid_grant" + ) + if upstream_rejected_bridge_refresh: + verbose_logger.info( + "bridge refresh: the upstream rejected the sealed refresh token for server=%s with " + "invalid_grant (revoked or expired at the IdP); returning invalid_grant so the client " + "re-runs authorization_code rather than an opaque upstream error", + mcp_server.server_id, + ) + return _bridge_mint_error_response("invalid_refresh") + return render_token_fault(fault) if response is None: raise HTTPException( status_code=502, detail="MCP upstream token endpoint returned no response", ) - - response.raise_for_status() token_response = response.json() - access_token = token_response["access_token"] # Validate token response against server-configured rules before any storage. # This rejects tokens from wrong Slack workspaces, Atlassian orgs, etc. @@ -679,8 +1075,23 @@ async def exchange_token_with_server( mcp_server.server_id, ) + # A DCR-bridge oauth_delegate server hands the client a gateway-bound envelope (identity plus the + # upstream token) instead of the raw upstream token, so the one bearer both admits the caller and + # forwards the upstream credential. Only this mode mints; every other server returns the raw token. + if bridge_mint_ready is not None: + if refresh_request_scope and isinstance(token_response, dict) and not token_response.get("scope"): + token_response = {**token_response, "scope": refresh_request_scope} + # Phase 3: seal the upstream grant into the client-held envelope; failures map through the same + # OAuth-shaped response as the phase-1 preconditions. + minted = _finish_bridge_mint(bridge_mint_ready, mcp_server, token_response, datetime.now(timezone.utc)) + return minted if isinstance(minted, JSONResponse) else _bridge_mint_error_response(minted) + + raw_access_token = token_response.get("access_token") if isinstance(token_response, dict) else None + if not isinstance(raw_access_token, str) or not raw_access_token: + return render_token_fault(UpstreamProtocolFault(note="the upstream token response has no usable access_token")) + result = { - "access_token": access_token, + "access_token": raw_access_token, "token_type": token_response.get("token_type", "Bearer"), } @@ -708,6 +1119,22 @@ class _PersistedDcrCredentials(BaseModel): client_id: Optional[str] = None client_secret: Optional[str] = None token_endpoint_auth_method: Optional[str] = None + redirect_uris: Optional[list[str]] = None + + +def _redirect_uri_not_registered(credentials: _PersistedDcrCredentials, current_redirect_uri: str) -> bool: + """Whether a persisted DCR client is positively known NOT to cover the current callback. + + A DCR client is bound to the redirect_uris it was registered with; if the proxy's + resolved public origin has since changed, every authorize built for it will be + rejected by the IdP. Clients persisted before ``redirect_uris`` was recorded (and + admin-configured clients, which never get a recording) return False so they are + grandfathered rather than re-registered, because re-minting a client_id orphans + every user's refresh tokens for that server.""" + recorded = credentials.redirect_uris + if not recorded: + return False + return current_redirect_uri not in recorded def _get_persisted_dcr_credentials(credentials: object) -> Optional[_PersistedDcrCredentials]: @@ -744,66 +1171,156 @@ def _apply_persisted_dcr_credentials(mcp_server: MCPServer, credentials: _Persis return True -async def _get_persisted_mcp_server_with_dcr_client_id( - mcp_server: MCPServer, -) -> Optional[tuple["LiteLLM_MCPServerTable", _PersistedDcrCredentials]]: - from litellm.proxy._experimental.mcp_server.db import get_mcp_server # noqa: PLC0415 - from litellm.proxy.utils import get_prisma_client_or_throw # noqa: PLC0415 +async def _load_store_dcr_credentials(mcp_server: MCPServer) -> _PersistedDcrCredentials | None: + """DCR client persisted in the server-scoped OAuth-client store for a config-declared server + (which has no LiteLLM_MCPServerTable row). Returns None when the store has no usable client_id + or the DB is unreachable.""" + from litellm.proxy._experimental.mcp_server.db import ( # noqa: PLC0415 # avoids circular import + get_mcp_server_oauth_client_credentials, + ) + from litellm.proxy.utils import get_prisma_client_or_throw # noqa: PLC0415 # avoids circular import try: prisma_client = get_prisma_client_or_throw("Database not connected. Cannot read MCP OAuth client registration.") - persisted_mcp_server = await get_mcp_server( - prisma_client=prisma_client, - server_id=mcp_server.server_id, + blob = await get_mcp_server_oauth_client_credentials( + prisma_client=prisma_client, server_id=mcp_server.server_id ) - except Exception as exc: # noqa: BLE001 + except Exception as exc: # noqa: BLE001 # best-effort read; DB may be unreachable verbose_logger.debug( - "register_client_with_server: failed to read persisted DCR client registration for server_id=%s: %s", + "register_client_with_server: failed to read stored DCR client for server_id=%s: %s", mcp_server.server_id, exc, ) return None - if persisted_mcp_server is None: - return None - - credentials = _get_persisted_dcr_credentials(persisted_mcp_server.credentials) + credentials = _get_persisted_dcr_credentials(blob) if credentials is None or not credentials.client_id: return None - - return persisted_mcp_server, credentials + return credentials -async def _reuse_persisted_dcr_client_if_available(mcp_server: MCPServer) -> bool: - persisted = await _get_persisted_mcp_server_with_dcr_client_id(mcp_server) - if persisted is None: +async def hydrate_config_server_dcr_client(mcp_server: MCPServer) -> bool: + """Overlay a config-declared server's persisted DCR client onto its in-memory object so token + refresh can authenticate. Config.yaml servers have no LiteLLM_MCPServerTable row, so their + minted client lives in the server-scoped store; without this overlay the in-memory server + carries no client_id after a restart. An explicit client_id set in config.yaml wins and is never + overwritten by a persisted store client.""" + if mcp_server.client_id: + return False + credentials = await _load_store_dcr_credentials(mcp_server) + if credentials is None: + return False + return _apply_persisted_dcr_credentials(mcp_server, credentials) + + +async def _resolve_persisted_dcr_client( + mcp_server: MCPServer, +) -> tuple[Optional["LiteLLM_MCPServerTable"], _PersistedDcrCredentials | None]: + """Resolve a server's persisted DCR client using the same two-level rule the write path uses, so + read and write always agree. First, whether the server HAS a LiteLLM_MCPServerTable row: a row is + always resolved to that row and the store is never consulted for a server that has a row, so a + caller-chosen server_id colliding with a config-declared server cannot inherit that config + server's client, and a row that exists but carries no usable client_id yields (row, None) rather + than a store fallback. Second, among rowless servers: a config-declared server keeps its client in + the server-scoped store, while a rowless non-config server is a throwaway temp/session server with + no persisted client. Returns (row_or_None, credentials_or_None); the row is only needed by the + reuse path to refresh the registry for a DB-declared server.""" + from litellm.proxy._experimental.mcp_server.db import get_mcp_server # noqa: PLC0415 # avoids circular import + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( # noqa: PLC0415 # avoids circular import + global_mcp_server_manager, + ) + from litellm.proxy.utils import get_prisma_client_or_throw # noqa: PLC0415 # avoids circular import + + try: + prisma_client = get_prisma_client_or_throw("Database not connected. Cannot read MCP OAuth client registration.") + row = await get_mcp_server(prisma_client=prisma_client, server_id=mcp_server.server_id) + except Exception as exc: # noqa: BLE001 # best-effort read; DB may be unreachable + verbose_logger.debug( + "register_client_with_server: failed to read persisted DCR client for server_id=%s: %s", + mcp_server.server_id, + exc, + ) + return None, None + + if row is not None: + credentials = _get_persisted_dcr_credentials(row.credentials) + if credentials is not None and credentials.client_id: + return row, credentials + return row, None + if global_mcp_server_manager.is_config_declared_server(mcp_server.server_id): + return None, await _load_store_dcr_credentials(mcp_server) + return None, None + + +async def _reuse_persisted_dcr_client_if_available( + mcp_server: MCPServer, current_redirect_uri: Optional[str] = None +) -> bool: + persisted_mcp_server, credentials = await _resolve_persisted_dcr_client(mcp_server) + if credentials is None: + return False + if current_redirect_uri is not None and _redirect_uri_not_registered(credentials, current_redirect_uri): + verbose_logger.debug( + "register_client_with_server: not reusing persisted DCR client for server_id=%s; its registered " + "redirect_uris=%s do not include the current callback %s. The operator-facing warning for this " + "re-registration event is emitted once by _persisted_dcr_redirect_uri_is_stale.", + mcp_server.server_id, + credentials.redirect_uris, + current_redirect_uri, + ) return False - persisted_mcp_server, credentials = persisted if not _apply_persisted_dcr_credentials(mcp_server, credentials): return False - from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( # noqa: PLC0415 - global_mcp_server_manager, - ) - - try: - await global_mcp_server_manager.update_server(persisted_mcp_server) - except Exception as exc: # noqa: BLE001 - verbose_logger.warning( - "register_client_with_server: failed to refresh persisted DCR client registration for server_id=%s: %s", - mcp_server.server_id, - exc, + if persisted_mcp_server is not None: + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( # noqa: PLC0415 # avoids circular import + global_mcp_server_manager, ) + + try: + await global_mcp_server_manager.update_server(persisted_mcp_server) + except Exception as exc: # noqa: BLE001 # best-effort registry refresh + verbose_logger.warning( + "register_client_with_server: failed to refresh persisted DCR client registration for server_id=%s: %s", + mcp_server.server_id, + exc, + ) return bool(mcp_server.client_id) -DcrRegistrationPersistenceResult = Literal["persisted", "reused", "failed"] +async def _persisted_dcr_redirect_uri_is_stale(mcp_server: MCPServer, current_redirect_uri: str) -> bool: + """Whether the server's persisted DCR client is bound to redirect_uris that no longer + cover the current proxy callback, meaning authorize is guaranteed to fail IdP-side. + + Consulted when the in-memory server already carries a hydrated client_id, which + otherwise short-circuits registration before any redirect check can run. Servers + without a persisted DCR recording (admin-configured client_id, or registered before + redirect_uris were recorded) are never reported stale.""" + _, credentials = await _resolve_persisted_dcr_client(mcp_server) + if credentials is None: + return False + if not _redirect_uri_not_registered(credentials, current_redirect_uri): + return False + verbose_logger.warning( + "register_client_with_server: persisted DCR client for server_id=%s is registered with redirect_uris=%s " + "which do not include the current callback %s (proxy origin changed); registering a replacement client. " + "Users previously signed in to this server will need to re-authenticate.", + mcp_server.server_id, + credentials.redirect_uris, + current_redirect_uri, + ) + return True + + +DcrRegistrationPersistenceResult = Literal["persisted", "reused", "skipped", "failed"] async def _persist_dcr_client_registration( - mcp_server: MCPServer, registration_response: object + mcp_server: MCPServer, registration_response: object, current_redirect_uri: str ) -> DcrRegistrationPersistenceResult: - """Persist the dynamically registered OAuth client (RFC 7591) onto the MCP server row. + """Persist the dynamically registered OAuth client (RFC 7591) to its single home: the server's + ``LiteLLM_MCPServerTable`` row when it has one, otherwise the server-scoped store when the server + is config-declared. A rowless server that is not config-declared is a throwaway temp/session + server, so its client is overlaid in memory only and not persisted. The interactive authorization_code flow mints a ``client_id`` via Dynamic Client Registration that discovery cannot re-derive; without persisting it the autonomous @@ -811,7 +1328,23 @@ async def _persist_dcr_client_registration( full re-authorization instead of a silent refresh. Mirrors the ``encrypt_credentials`` write that ``client_credentials`` and token exchange already use. Failures are logged, never raised: registration still returns to the caller even when persistence fails. + + The client-forwarded token modes (``true_passthrough`` / ``oauth_delegate``) are skipped + unconditionally: the caller holds the upstream token and the gateway must hold no OAuth + client identity for these servers. Persisting here would stamp ``oauth2_flow`` and a + ``client_id`` onto a server whose mode promises the gateway stores nothing, making a + fresh pass-through server read as gateway-authorized. + + ``redirect_uris`` records what the client is bound to so a later origin change can be + detected as a positive mismatch and trigger re-registration instead of stranding the + server on IdP-side redirect_uri rejections. ``client_secret`` and + ``token_endpoint_auth_method`` are written explicitly (None when absent) because + ``update_mcp_server`` merges credential blobs: a re-registered public client must not + inherit the previous client's secret or auth method. """ + if mcp_server.is_true_passthrough or mcp_server.is_oauth_delegate: + return "skipped" + try: registration = _DcrClientRegistration.model_validate(registration_response) except ValidationError as exc: @@ -823,20 +1356,23 @@ async def _persist_dcr_client_registration( ) return "failed" - if await _reuse_persisted_dcr_client_if_available(mcp_server): + if await _reuse_persisted_dcr_client_if_available(mcp_server, current_redirect_uri=current_redirect_uri): return "reused" + token_endpoint_auth_method = ( + "client_secret_basic" if registration.token_endpoint_auth_method == "client_secret_basic" else None + ) credentials: MCPCredentials = { "client_id": registration.client_id, - **({"client_secret": registration.client_secret} if registration.client_secret is not None else {}), - **( - {"token_endpoint_auth_method": "client_secret_basic"} - if registration.token_endpoint_auth_method == "client_secret_basic" - else {} - ), + "client_secret": registration.client_secret, + "token_endpoint_auth_method": token_endpoint_auth_method, + "redirect_uris": [current_redirect_uri], } - from litellm.proxy._experimental.mcp_server.db import update_mcp_server # noqa: PLC0415 + from litellm.proxy._experimental.mcp_server.db import ( # noqa: PLC0415 # avoids circular import + update_mcp_server, + upsert_mcp_server_oauth_client_credentials, + ) from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( # noqa: PLC0415 global_mcp_server_manager, ) @@ -857,7 +1393,18 @@ async def _persist_dcr_client_registration( ), touched_by="mcp_oauth_dcr", ) - await global_mcp_server_manager.update_server(updated_row) + if updated_row is not None: + await global_mcp_server_manager.update_server(updated_row) + return "persisted" + if global_mcp_server_manager.is_config_declared_server(mcp_server.server_id): + await upsert_mcp_server_oauth_client_credentials( + prisma_client=prisma_client, + server_id=mcp_server.server_id, + credentials=credentials, + ) + mcp_server.client_id = registration.client_id + mcp_server.client_secret = registration.client_secret + mcp_server.token_endpoint_auth_method = token_endpoint_auth_method return "persisted" except Exception as exc: # noqa: BLE001 verbose_logger.warning( @@ -868,6 +1415,154 @@ async def _persist_dcr_client_registration( return "failed" +def client_supplied_redirect_uris(value: object) -> list[str] | None: + """RFC 7591 redirect_uris must be a non-empty array of URI strings. Any other shape (not a list, + an empty list, or a list holding a non-string or empty-string element) yields None so every + register arm falls back to the gateway callback instead of echoing a malformed value back to the + client as its redirect_uris. The redirect actually used is trust-validated later at /authorize by + validate_trusted_redirect_uri; this guard only keeps the client-facing echo well-typed.""" + if not isinstance(value, list) or not value: + return None + uris = [uri for uri in value if isinstance(uri, str) and uri] + return uris if len(uris) == len(value) else None + + +async def _post_dcr_registration( + registration_url: str, + register_data: Mapping[str, object], + server_id: str, +) -> httpx.Response: + """POST an RFC 7591 registration to the upstream and return its response, relaying a classified + upstream rejection instead of a generic 500 and failing loud on an absent response.""" + headers = { + "Content-Type": "application/json", + "Accept": "application/json", + } + async_client = get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Register) + try: + response = await async_client.post( + registration_url, + headers=headers, + json=register_data, + ) + if response is not None: + response.raise_for_status() + except httpx.HTTPStatusError as exc: + status_code, detail = dcr_fault_detail(classify_upstream_dcr_rejection(exc.response, log_context=server_id)) + raise HTTPException(status_code=status_code, detail=detail) from exc + if response is None: + raise HTTPException( + status_code=502, + detail="MCP upstream registration endpoint returned no response", + ) + return response + + +class EphemeralDcrClient(BaseModel): + """A DCR client minted for a single authorize round trip and never stored by the gateway.""" + + model_config = ConfigDict(frozen=True) + client_id: str = Field(min_length=1) + client_secret: str | None = None + token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None + + +_EPHEMERAL_DCR_CLIENT_CACHE = InMemoryCache(default_ttl=_OAUTH_STATE_COOKIE_TTL_SECONDS) +_EPHEMERAL_DCR_MINT_LOCKS: dict[str, asyncio.Lock] = {} + + +async def mint_ephemeral_dcr_client(request: Request, mcp_server: MCPServer) -> EphemeralDcrClient | None: + """Mint a throwaway OAuth client via the upstream's RFC 7591 registration endpoint for a + client-forwarded-token server whose authorize arrived with no client_id. Returns ``None`` when + the upstream exposes no registration endpoint, so the caller keeps its existing failure path. + The minted client is deliberately not persisted anywhere: ``true_passthrough`` / + ``oauth_delegate`` require the gateway to hold no OAuth client identity, so it survives only in + the encrypted OAuth state and the sealed authorization code the callback forwards. + + Reloading the authorize page or retrying a flow must not register a fresh upstream client every + time (an OAuth client identifies the application, not the user, so reuse is semantically + correct). A per-process TTL cache bounded to the OAuth state cookie's lifetime dedupes the mint + per (server, gateway origin), and a per-server lock single-flights concurrent mints (the + ``_OAUTH_METADATA_FETCH_LOCKS`` pattern; keyed by server_id alone so the lock registry stays + bounded by the server count even when the request origin varies) so parallel authorize requests + cannot each register an upstream client; the cache stamps nothing onto the server record and + correctness never depends on it because the sealed state carries the client through the flow.""" + if mcp_server.registration_url is None: + return None + request_base_url = get_request_base_url(request) + cache_key = f"mcp_ephemeral_dcr_client:{mcp_server.server_id}:{request_base_url}" + cached = _EPHEMERAL_DCR_CLIENT_CACHE.get_cache(cache_key) + if isinstance(cached, EphemeralDcrClient): + return cached + lock = _EPHEMERAL_DCR_MINT_LOCKS.setdefault(mcp_server.server_id, asyncio.Lock()) + async with lock: + cached_after_wait = _EPHEMERAL_DCR_CLIENT_CACHE.get_cache(cache_key) + if isinstance(cached_after_wait, EphemeralDcrClient): + return cached_after_wait + register_data: dict[str, object] = { + "client_name": mcp_server.server_name or mcp_server.server_id, + "redirect_uris": [f"{request_base_url}/callback"], + "grant_types": ["authorization_code", "refresh_token"], + "response_types": ["code"], + "token_endpoint_auth_method": "none", + } + response = await _post_dcr_registration( + registration_url=mcp_server.registration_url, + register_data=register_data, + server_id=mcp_server.server_id, + ) + try: + registration = _DcrClientRegistration.model_validate_json(response.text) + except ValidationError as exc: + raise HTTPException( + status_code=502, + detail="MCP upstream registration endpoint returned no usable client_id", + ) from exc + if not registration.client_id: + raise HTTPException( + status_code=502, + detail="MCP upstream registration endpoint returned no usable client_id", + ) + minted = EphemeralDcrClient( + client_id=registration.client_id, + client_secret=registration.client_secret, + token_endpoint_auth_method=normalize_token_endpoint_auth_method(registration.token_endpoint_auth_method), + ) + _EPHEMERAL_DCR_CLIENT_CACHE.set_cache(cache_key, minted) + return minted + + +async def resolve_ephemeral_dcr_client( + request: Request, + mcp_server: MCPServer, + code_challenge: str | None, + code_challenge_method: str | None, + redirect_uri: str, +) -> EphemeralDcrClient | None: + """The single owner of the gateway-side mint policy for a clientless authorize. Returns + ``None`` for servers whose mode does not permit gateway minting and for upstreams without a + registration endpoint, so those callers keep their existing failure paths: plain ``oauth2`` + keeps its persisted-client contract, and the interactive ``oauth_delegate`` dcr_bridge + sign-in has its own sealed-identity flow. ``true_passthrough`` mints regardless of the + ``dcr_bridge`` flag (the UI creates passthrough servers with the flag on by default): a + minted flow runs the bridge short-circuit arm, while the relay front door remains for + external clients that registered themselves. Flows that could never succeed fail loud + before any upstream registration: a missing ``authorization_url``, a downgraded PKCE pair + (without S256 the sealed code would be bearer-redeemable by any authenticated caller who + intercepts the redirect), or an untrusted ``redirect_uri`` (a rejected redirect must not be + usable to generate orphan IdP clients).""" + if not (mcp_server.is_true_passthrough or (mcp_server.is_oauth_delegate and not mcp_server.is_dcr_bridge)): + return None + if mcp_server.authorization_url is None: + raise HTTPException( + status_code=400, + detail="MCP server authorization url is not set", + ) + _require_s256_pkce(code_challenge, code_challenge_method) + validate_trusted_redirect_uri(request, redirect_uri) + return await mint_ephemeral_dcr_client(request, mcp_server) + + async def register_client_with_server( request: Request, mcp_server: MCPServer, @@ -877,59 +1572,75 @@ async def register_client_with_server( token_endpoint_auth_method: Optional[str], fallback_client_id: Optional[str] = None, persist_credentials: bool = False, + client_redirect_uris: list[str] | None = None, ): _raise_if_not_oauth2(mcp_server) request_base_url = get_request_base_url(request) + current_redirect_uri = f"{request_base_url}/callback" + client_facing_redirect_uris = client_redirect_uris or [current_redirect_uri] dummy_return = { "client_id": fallback_client_id or mcp_server.server_name, "client_secret": "dummy", - "redirect_uris": [f"{request_base_url}/callback"], + "redirect_uris": client_facing_redirect_uris, } - if mcp_server.client_id: + if mcp_server.client_id and not ( + persist_credentials + and mcp_server.registration_url + and await _persisted_dcr_redirect_uri_is_stale(mcp_server, current_redirect_uri) + ): return dummy_return - if await _reuse_persisted_dcr_client_if_available(mcp_server): + if await _reuse_persisted_dcr_client_if_available( + mcp_server, + current_redirect_uri=current_redirect_uri if persist_credentials else None, + ): return dummy_return if mcp_server.authorization_url is None: - raise HTTPException(status_code=400, detail="MCP server authorization url is not set") + raise HTTPException( + status_code=400, + detail=_endpoint_not_configured_detail( + mcp_server, + "authorization url", + "set Authorization URL and Token URL manually", + "set Issuer to discover them from the identity provider (RFC 8414)", + ), + ) if mcp_server.registration_url is None: return dummy_return + bridge_relay = _dcr_bridge_relays_client_registration(mcp_server) + if bridge_relay and not client_redirect_uris: + raise HTTPException( + status_code=400, + detail="redirect_uris is required to register a client with this server", + ) + register_data = { "client_name": client_name, - "redirect_uris": [f"{request_base_url}/callback"], - "grant_types": grant_types or [], - "response_types": response_types or [], - "token_endpoint_auth_method": token_endpoint_auth_method or "", + "redirect_uris": client_redirect_uris if bridge_relay else [current_redirect_uri], + "grant_types": grant_types or (["authorization_code", "refresh_token"] if bridge_relay else []), + "response_types": response_types or (["code"] if bridge_relay else []), + "token_endpoint_auth_method": token_endpoint_auth_method or ("none" if bridge_relay else ""), } - headers = { - "Content-Type": "application/json", - "Accept": "application/json", - } - - async_client = get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Register) - response = await async_client.post( - mcp_server.registration_url, - headers=headers, - json=register_data, + response = await _post_dcr_registration( + registration_url=mcp_server.registration_url, + register_data=register_data, + server_id=mcp_server.server_id, ) - if response is None: - raise HTTPException( - status_code=502, - detail="MCP upstream registration endpoint returned no response", - ) - response.raise_for_status() token_response = response.json() - if persist_credentials: - persistence_result = await _persist_dcr_client_registration(mcp_server, token_response) + if persist_credentials and not bridge_relay: + persistence_result = await _persist_dcr_client_registration(mcp_server, token_response, current_redirect_uri) if persistence_result == "reused": return dummy_return + if client_redirect_uris and not bridge_relay and isinstance(token_response, dict): + token_response = {**token_response, "redirect_uris": client_facing_redirect_uris} + return JSONResponse(token_response) @@ -951,6 +1662,18 @@ async def authorize( global_mcp_server_manager, ) + if mcp_server_name is None and client_id and is_gateway_dcr_client_id(client_id): + return aggregate_authorize( + request=request, + client_id=client_id, + redirect_uri=redirect_uri, + state=state, + code_challenge=code_challenge, + code_challenge_method=code_challenge_method, + response_type=response_type, + session_user_id=_session_cookie_user_id(request), + ) + lookup_name: Optional[str] = mcp_server_name or client_id client_ip = IPAddressUtils.get_mcp_client_ip(request) mcp_server = ( @@ -1014,6 +1737,25 @@ async def token_endpoint( global_mcp_server_manager, ) + if mcp_server_name is None and is_gateway_dcr_client_id(client_id): + from litellm.proxy.proxy_server import ( # noqa: PLC0415 # circular import at module load + master_key, + user_api_key_cache, + ) + + return await aggregate_token( + request=request, + grant_type=grant_type, + code=code, + redirect_uri=redirect_uri, + client_id=client_id, + code_verifier=code_verifier, + refresh_token=refresh_token, + master_key=master_key, + reload_user=_reload_active_user_by_id, + cache=user_api_key_cache, + ) + lookup_name = mcp_server_name or client_id client_ip = IPAddressUtils.get_mcp_client_ip(request) mcp_server = global_mcp_server_manager.get_mcp_server_by_name(lookup_name, client_ip=client_ip) @@ -1035,6 +1777,21 @@ async def token_endpoint( ) +@router.post("/authorize/complete") +async def authorize_complete(request: Request, flow: str = Form(...)): + """Finish an aggregate connect flow: mint the gateway authorization code for the + signed-in user and redirect back to the DCR client. POST plus the per-flow HttpOnly + cookie set at /authorize; an anonymous or bad-flow request just 400s.""" + from litellm.proxy.proxy_server import user_api_key_cache # noqa: PLC0415 # circular import at module load + + return await complete_connect_flow( + request=request, + flow_handle=flow, + session_user_id=_session_cookie_user_id(request), + cache=user_api_key_cache, + ) + + # Per RFC 6749 §4.1.2.1, an IdP that rejects an OAuth authorization request # redirects back to the configured redirect URI with ``error`` / # ``error_description`` / ``error_uri`` query params and no ``code``. The MCP @@ -1149,7 +1906,32 @@ async def callback( # states while permitting same-origin / allowlisted clients. redirect_uri = _get_validated_client_redirect_uri(request, state_data) - params = {"code": code, "state": original_state} + # Interactive dcr_bridge oauth_delegate: the state carries the litellm user the authorize step + # captured. Instead of forwarding the raw upstream code (which the client would present at the + # token endpoint with no way to prove who signed in), seal the user and the upstream code into a + # gateway authorization code and forward THAT. The token endpoint decrypts it to bind the + # envelope to this user. Every other flow forwards the raw code unchanged. + litellm_user_id = state_data.get("litellm_user_id") + mcp_server_id = state_data.get("mcp_server_id") + dcr_client_id = state_data.get("dcr_client_id") + dcr_client_secret = state_data.get("dcr_client_secret") + forwarded_code = code + if isinstance(litellm_user_id, str) and litellm_user_id and isinstance(mcp_server_id, str) and mcp_server_id: + forwarded_code = seal_bridge_authorization_code( + upstream_code=code, litellm_user_id=litellm_user_id, mcp_server_id=mcp_server_id + ) + elif isinstance(dcr_client_id, str) and dcr_client_id and isinstance(mcp_server_id, str) and mcp_server_id: + forwarded_code = seal_passthrough_authorization_code( + upstream_code=code, + client_id=dcr_client_id, + client_secret=dcr_client_secret if isinstance(dcr_client_secret, str) and dcr_client_secret else None, + mcp_server_id=mcp_server_id, + token_endpoint_auth_method=normalize_token_endpoint_auth_method( + state_data.get("dcr_token_endpoint_auth_method") + ), + ) + + params = {"code": forwarded_code, "state": original_state} complete_returned_url = _append_query_params(redirect_uri, params) response = RedirectResponse(url=complete_returned_url, status_code=302) _clear_oauth_state_cookie(response, request, state) @@ -1349,6 +2131,13 @@ async def _build_oauth_protected_resource_response( else: resource_url = f"{request_base_url}/mcp" + if mcp_server is not None and mcp_server_name and mcp_server.is_dcr_bridge: + return { + "authorization_servers": [f"{request_base_url}/{mcp_server_name}"], + "resource": resource_url, + "scopes_supported": (mcp_server.scopes if mcp_server.scopes else []), + } + # Pass-through branch: proxy the upstream's own metadata so discovery # directs the client at the real IdP (Okta, Keycloak, …) instead of us. if mcp_server is not None and ( @@ -1448,11 +2237,88 @@ def _jwt_auth_issuers() -> list: return issuers +def _build_aggregate_protected_resource_response(request: Request) -> dict: + """RFC 9728 metadata for the aggregate /mcp resource: the gateway itself is + the authorization server. No per-server names or scopes leak here; access + is resolved after sign-in from the authenticated user's grants. + + The advertised authorization server is ``{base}/mcp`` (not the bare + origin) so RFC 8414 path-insertion resolves its metadata at + ``/.well-known/oauth-authorization-server/mcp``, a route this module + owns. The bare-origin well-known is registered first by the BYOK OAuth + feature and describes the BYOK flow, so it must not be the aggregate + discovery entry point (same pattern as the per-server documents, which + advertise ``{base}/{server_name}``).""" + request_base_url = get_request_base_url(request) + return { + "authorization_servers": [f"{request_base_url}/mcp"], + "resource": f"{request_base_url}/mcp", + "scopes_supported": [], + } + + +def _build_aggregate_authorization_server_response(request: Request) -> dict: + """RFC 8414 metadata for the gateway as the aggregate authorization server. + + The issuer is ``{base}/mcp`` and must stay equal to the value the + aggregate protected-resource document advertises: spec clients verify the + issuer in the metadata matches the one that derived the well-known URL. + Advertises the root /authorize, /token, and /register endpoints and + ``token_endpoint_auth_methods_supported: ["none", ...]`` because DCR + clients (Claude Desktop, MCP Inspector) register as public clients; PKCE + S256 is mandatory in the gateway's authorize flow.""" + request_base_url = get_request_base_url(request) + return { + "issuer": f"{request_base_url}/mcp", + "authorization_endpoint": f"{request_base_url}/authorize", + "token_endpoint": f"{request_base_url}/token", + "registration_endpoint": f"{request_base_url}/register", + "response_types_supported": ["code"], + "scopes_supported": [], + "grant_types_supported": ["authorization_code", "refresh_token"], + "code_challenge_methods_supported": ["S256"], + "token_endpoint_auth_methods_supported": ["none", "client_secret_post"], + } + + +# RFC 9728 path-appended discovery for the aggregate /mcp endpoint. A client +# pointed at {base}/mcp inserts the well-known segment before the resource +# path, so this exact route must exist for aggregate discovery to work at all. +# Declared before the parameterized well-known routes below: Starlette matches +# in registration order, and /.well-known/oauth-authorization-server/{name} +# would otherwise capture the "/mcp" suffix as a server name. +@router.get(f"/.well-known/oauth-protected-resource{well_known_root_suffix()}/mcp") +async def oauth_protected_resource_aggregate(request: Request): + """ + OAuth protected resource discovery for the aggregate /mcp endpoint. + + The single-segment ``/mcp`` path does not collide with any per-server PRM pattern + (those are two-segment: ``/mcp/{server}`` or ``/{server}/mcp``), so this unambiguously + describes the aggregate resource. + """ + return _build_aggregate_protected_resource_response(request) + + +@router.get(f"/.well-known/oauth-authorization-server{well_known_root_suffix()}/mcp") +async def oauth_authorization_server_aggregate(request: Request): + """ + OAuth authorization server discovery for the aggregate /mcp endpoint, the RFC 8414 + path-inserted form for a client that treats {base}/mcp as its authorization base URL. + + The single-segment /mcp is reserved for the aggregate so the discovery chain stays + consistent: the aggregate protected-resource document advertises {base}/mcp as its + authorization server, so the document served here must have issuer {base}/mcp. A server + literally named ``mcp`` therefore does not take this route; it keeps its standard + two-segment discovery at /.well-known/oauth-authorization-server/mcp/mcp. Letting the + per-server row win here instead would serve an issuer of {base} against a resource that + advertised {base}/mcp, which fails the RFC 8414 issuer check and breaks the front door. + """ + return _build_aggregate_authorization_server_response(request) + + # Standard MCP pattern: /.well-known/oauth-protected-resource/mcp/{server_name} # This is the pattern expected by standard MCP clients (mcp-inspector, VSCode Copilot) -@router.get( - f"/.well-known/oauth-protected-resource{'' if get_server_root_path() == '/' else get_server_root_path()}/mcp/{{mcp_server_name}}" -) +@router.get(f"/.well-known/oauth-protected-resource{well_known_root_suffix()}/mcp/{{mcp_server_name}}") async def oauth_protected_resource_mcp_standard(request: Request, mcp_server_name: str): """ OAuth protected resource discovery endpoint using standard MCP URL pattern. @@ -1472,9 +2338,7 @@ async def oauth_protected_resource_mcp_standard(request: Request, mcp_server_nam # LiteLLM legacy pattern: /.well-known/oauth-protected-resource/{server_name}/mcp # Kept for backward compatibility with existing deployments -@router.get( - f"/.well-known/oauth-protected-resource{'' if get_server_root_path() == '/' else get_server_root_path()}/{{mcp_server_name}}/mcp" -) +@router.get(f"/.well-known/oauth-protected-resource{well_known_root_suffix()}/{{mcp_server_name}}/mcp") @router.get("/.well-known/oauth-protected-resource") async def oauth_protected_resource_mcp(request: Request, mcp_server_name: Optional[str] = None): """ @@ -1544,9 +2408,7 @@ def _build_oauth_authorization_server_response( # Standard MCP pattern: /.well-known/oauth-authorization-server/mcp/{server_name} -@router.get( - f"/.well-known/oauth-authorization-server{'' if get_server_root_path() == '/' else get_server_root_path()}/mcp/{{mcp_server_name}}" -) +@router.get(f"/.well-known/oauth-authorization-server{well_known_root_suffix()}/mcp/{{mcp_server_name}}") async def oauth_authorization_server_mcp_standard(request: Request, mcp_server_name: str): """ OAuth authorization server discovery endpoint using standard MCP URL pattern. @@ -1561,9 +2423,7 @@ async def oauth_authorization_server_mcp_standard(request: Request, mcp_server_n # LiteLLM legacy pattern and root endpoint -@router.get( - f"/.well-known/oauth-authorization-server{'' if get_server_root_path() == '/' else get_server_root_path()}/{{mcp_server_name}}" -) +@router.get(f"/.well-known/oauth-authorization-server{well_known_root_suffix()}/{{mcp_server_name}}") @router.get("/.well-known/oauth-authorization-server") async def oauth_authorization_server_mcp(request: Request, mcp_server_name: Optional[str] = None): """ @@ -1660,14 +2520,22 @@ async def register_client(request: Request, mcp_server_name: Optional[str] = Non request_data = await _read_request_body(request=request) data: dict = {**request_data} + client_redirect_uris = client_supplied_redirect_uris(data.get("redirect_uris")) dummy_return = { "client_id": mcp_server_name or "dummy_client", "client_secret": "dummy", - "redirect_uris": [f"{request_base_url}/callback"], + "redirect_uris": client_redirect_uris or [f"{request_base_url}/callback"], } client_ip = IPAddressUtils.get_mcp_client_ip(request) if not mcp_server_name: + # A real DCR request carries redirect_uris (RFC 7591): route it to the aggregate DCR + # endpoint the aggregate authorization-server metadata advertises. A single-server + # deployment registers at /{server}/register instead (its bare-origin discovery + # advertises that), so this does not affect it. A request without redirect_uris is not + # a DCR request, so the legacy single-server-or-dummy fallback is kept for it. + if data.get("redirect_uris"): + return await register_aggregate_client(request=request, request_body=data) resolved = _resolve_oauth2_server_for_root_endpoints(client_ip=client_ip) if resolved: return await register_client_with_server( @@ -1678,6 +2546,7 @@ async def register_client(request: Request, mcp_server_name: Optional[str] = Non response_types=data.get("response_types", []), token_endpoint_auth_method=data.get("token_endpoint_auth_method", ""), fallback_client_id=resolved.server_name or resolved.name, + client_redirect_uris=client_redirect_uris, ) return dummy_return @@ -1692,4 +2561,5 @@ async def register_client(request: Request, mcp_server_name: Optional[str] = Non response_types=data.get("response_types", []), token_endpoint_auth_method=data.get("token_endpoint_auth_method", ""), fallback_client_id=mcp_server_name, + client_redirect_uris=client_redirect_uris, ) diff --git a/litellm/proxy/_experimental/mcp_server/exceptions.py b/litellm/proxy/_experimental/mcp_server/exceptions.py index 3e3e549008d..74752809e86 100644 --- a/litellm/proxy/_experimental/mcp_server/exceptions.py +++ b/litellm/proxy/_experimental/mcp_server/exceptions.py @@ -88,3 +88,19 @@ class MCPToolResultError(Exception): into two identities, breaking ``isinstance`` checks against instances created before the reload. """ + + +class MCPServerListError(Exception): + """Carrier for a classified per-server listing fault (``faults.list_outcomes.ServerListFault``). + + Raised where a server fetch used to silently return an empty tool list, so each boundary can + apply its own policy: the aggregate listing absorbs it into that server's outcome, while + single-server routes relay a truthful HTTP status instead of empty-success. The fault value is + typed as ``object`` here only to avoid a circular import with the faults package; construction + sites always pass a ``ServerListFault``. + """ + + def __init__(self, fault: object, server_name: str) -> None: + self.fault = fault + self.server_name = server_name + super().__init__(f"Listing tools from MCP server {server_name!r} failed") diff --git a/litellm/proxy/_experimental/mcp_server/faults/__init__.py b/litellm/proxy/_experimental/mcp_server/faults/__init__.py new file mode 100644 index 00000000000..1b9ee77d795 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/faults/__init__.py @@ -0,0 +1,40 @@ +"""Typed fault values for upstream OAuth/DCR failures (phase 1 of the MCP error-handling framework). + +The invariant this package exists to enforce: an upstream failure is classified ONCE into a single +fault value, and the response status, wire error code, and prose are all derived from that value. +Deriving all three from one classification makes contradictory pairings (a caller-fault error code on +a server-fault status) unrepresentable, and gives the trust-boundary rule one enforcement point: +spec-defined machine fields may cross to callers, upstream prose and raw bodies go to server logs. +""" + +from litellm.proxy._experimental.mcp_server.faults.classify import ( + classify_upstream_dcr_rejection, + classify_upstream_token_rejection, +) +from litellm.proxy._experimental.mcp_server.faults.render_oauth import ( + dcr_fault_detail, + render_token_fault, +) +from litellm.proxy._experimental.mcp_server.faults.traversal import iter_exception_tree +from litellm.proxy._experimental.mcp_server.faults.types import ( + CallerRejected, + CredentialSource, + GatewayRejected, + UpstreamOAuthFault, + UpstreamProtocolFault, + UpstreamReportedFault, +) + +__all__ = [ + "CallerRejected", + "CredentialSource", + "GatewayRejected", + "UpstreamOAuthFault", + "UpstreamProtocolFault", + "UpstreamReportedFault", + "classify_upstream_dcr_rejection", + "classify_upstream_token_rejection", + "dcr_fault_detail", + "iter_exception_tree", + "render_token_fault", +] diff --git a/litellm/proxy/_experimental/mcp_server/faults/classify.py b/litellm/proxy/_experimental/mcp_server/faults/classify.py new file mode 100644 index 00000000000..d585df90caa --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/faults/classify.py @@ -0,0 +1,136 @@ +"""The single place that reads upstream OAuth/DCR failure responses. + +Every accessor here is total: an upstream that lies about its content encoding, sends an undecodable +body, or omits the spec fields yields a classified fault, never an exception. Nothing outside this +module should touch a failed upstream response's body. +""" + +from __future__ import annotations + +import httpx + +from litellm._logging import verbose_logger +from litellm.proxy._experimental.mcp_server.faults.types import ( + GATEWAY_CAPABILITY_CODES, + GATEWAY_CREDENTIAL_CODES, + MAX_WIRE_FIELD_CHARS, + CallerRejected, + CredentialSource, + GatewayRejected, + UpstreamOAuthFault, + UpstreamProtocolFault, + UpstreamReportedFault, +) + + +def _safe_text(response: httpx.Response) -> str: + try: + return response.text + except Exception: + return "" + + +def _safe_json(response: httpx.Response) -> object: + try: + return response.json() + except Exception: + return None + + +def _bounded_field(value: object) -> str | None: + if not isinstance(value, str) or not value: + return None + return value[:MAX_WIRE_FIELD_CHARS] + + +def _log_out_of_contract(endpoint_kind: str, response: httpx.Response, log_context: str) -> None: + verbose_logger.warning( + "MCP upstream %s endpoint (%s) returned HTTP %s outside the OAuth error contract (first %s chars): %s", + endpoint_kind, + log_context, + response.status_code, + MAX_WIRE_FIELD_CHARS, + _safe_text(response)[:MAX_WIRE_FIELD_CHARS], + ) + + +def _classify_oauth_error_code( + code: str, + description: str | None, + error_uri: str | None, + credential_source: CredentialSource, + log_context: str, +) -> UpstreamOAuthFault: + """Blame assignment for a contract-conformant OAuth error code, shared by the token and DCR + classifiers. Codes by which the upstream blames itself keep that blame; ``invalid_target`` is a + gateway configuration gap (the RFC 8707 resource indicator this server sends, or fails to send) + no matter whose credentials were presented; credential-indicting codes follow the credential + source; everything else, including codes we do not recognize, is the caller's to act on. The + upstream's HTTP status is deliberately never consulted: status derives from this classification + at render time, which is what keeps status and code from contradicting each other.""" + if code == "server_error" or code == "temporarily_unavailable": + return UpstreamReportedFault(code=code) + if code in GATEWAY_CAPABILITY_CODES: + verbose_logger.warning( + "MCP server %s: the upstream authorization server rejected the request with " + "invalid_target, meaning it did not accept the RFC 8707 resource indicator for this " + "request. Set upstream_resource on this server to the exact resource identifier the " + "authorization server expects (or to 'auto' to send the server's own canonical url); " + "if it is already set and the authorization server does not support resource " + "indicators, unset it and express the target audience through scopes instead", + log_context, + ) + return GatewayRejected(code=code) + if credential_source == "gateway_stored" and code in GATEWAY_CREDENTIAL_CODES: + verbose_logger.warning( + "MCP server %s: upstream authorization server rejected the gateway's configured client " + "credentials (%s): %s", + log_context, + code, + description or "", + ) + return GatewayRejected(code=code) + return CallerRejected(code=code, description=description, error_uri=error_uri) + + +def classify_upstream_token_rejection( + response: httpx.Response, + credential_source: CredentialSource, + log_context: str, +) -> UpstreamOAuthFault: + """Classify a token-endpoint rejection into exactly one fault: a body with an RFC 6749 §5.2 + ``error`` field goes through blame assignment (:func:`_classify_oauth_error_code`); anything + without a usable ``error`` field is an upstream protocol fault.""" + parsed = _safe_json(response) + fields = parsed if isinstance(parsed, dict) else {} + code = _bounded_field(fields.get("error")) + if code is None: + _log_out_of_contract("token", response, log_context) + return UpstreamProtocolFault(note=f"upstream token endpoint returned HTTP {response.status_code}") + return _classify_oauth_error_code( + code, + description=_bounded_field(fields.get("error_description")), + error_uri=_bounded_field(fields.get("error_uri")), + credential_source=credential_source, + log_context=log_context, + ) + + +def classify_upstream_dcr_rejection(response: httpx.Response, log_context: str) -> UpstreamOAuthFault: + """Classify a dynamic-client-registration rejection. RFC 7591 §3.2.2 errors carry + ``error`` / ``error_description`` and go through the same blame assignment as token errors + (registration sends no client credentials, so credential codes stay caller-actionable); anything + without a usable ``error`` field is an upstream protocol fault.""" + parsed = _safe_json(response) + fields = parsed if isinstance(parsed, dict) else {} + code = _bounded_field(fields.get("error")) + if code is None: + _log_out_of_contract("registration", response, log_context) + return UpstreamProtocolFault(note=f"upstream registration failed with HTTP {response.status_code}") + return _classify_oauth_error_code( + code, + description=_bounded_field(fields.get("error_description")), + error_uri=None, + credential_source="caller_supplied", + log_context=log_context, + ) diff --git a/litellm/proxy/_experimental/mcp_server/faults/list_outcomes.py b/litellm/proxy/_experimental/mcp_server/faults/list_outcomes.py new file mode 100644 index 00000000000..10463496409 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/faults/list_outcomes.py @@ -0,0 +1,177 @@ +"""Per-server outcomes for the aggregate MCP tools/list fan-out. + +The aggregate listing deliberately keeps serving the healthy subset when one server fails, but a +failed server must contribute a classified outcome instead of silently shrinking the list: an empty +contribution with no signal makes a broken upstream indistinguishable from a healthy server with no +tools. Outcomes carry only machine fields (category and status code) so nothing from an upstream +body crosses the trust boundary; classification is total, so any exception out of a server fetch +becomes an outcome, never a second failure. +""" + +from __future__ import annotations + +from collections.abc import Iterator +from typing import Literal, NamedTuple, NoReturn, TypeAlias + +import httpx +from mcp.types import Tool as MCPTool +from pydantic import BaseModel, ConfigDict +from typing_extensions import assert_never + +from litellm.proxy._experimental.mcp_server.exceptions import ( + MCPServerListError, + MCPUpstreamAuthError, +) +from litellm.proxy._experimental.mcp_server.faults.traversal import iter_exception_tree + +ListFaultCategory: TypeAlias = Literal[ + "auth_required", + "forbidden", + "timeout", + "unreachable", + "upstream_error", + "internal", +] + + +class ServerListOk(BaseModel): + model_config = ConfigDict(frozen=True) + tag: Literal["ok"] = "ok" + tool_count: int + + +class ServerListFault(BaseModel): + """Why a server contributed nothing to a listing: the caller must authenticate upstream + (``auth_required``/``forbidden``), the upstream did not answer (``timeout``/``unreachable``), + the upstream answered outside its contract (``upstream_error``), or the gateway itself failed + (``internal``). ``status_code`` is the upstream HTTP status when one exists.""" + + model_config = ConfigDict(frozen=True) + tag: ListFaultCategory + status_code: int | None = None + + +ServerOutcome: TypeAlias = ServerListOk | ServerListFault + +SERVER_OUTCOMES_META_KEY = "litellm.ai/server_outcomes" +"""The tools/list result ``_meta`` key carrying per-server outcomes. Prefixed with the litellm.ai +domain per the MCP spec's ``_meta`` key format so it cannot collide with spec-reserved names.""" + + +class AggregateToolListing(NamedTuple): + tools: list[MCPTool] + outcomes: dict[str, ServerOutcome] + + +def _iter_upstream_responses(exc: BaseException) -> Iterator[httpx.Response]: + """Yield every ``httpx.Response`` in the exception tree, in the shared traversal's deliberate + order (explicit causes first, ExceptionGroup members in raise order, the incidental + ``__context__`` chain last), so a response raised while handling the real failure can never + shadow one on the explicit causal chain. Consumers apply their own predicate over the stream: + selecting the first response and THEN testing it would miss a causal auth response sitting + behind an unrelated earlier one.""" + for current in iter_exception_tree(exc): + response = getattr(current, "response", None) + if isinstance(response, httpx.Response): + yield response + + +def _find_upstream_response(exc: BaseException) -> httpx.Response | None: + return next(_iter_upstream_responses(exc), None) + + +def upstream_auth_challenge(exc: BaseException) -> tuple[int, str | None] | None: + """The first upstream 401/403 in deliberate order and its ``WWW-Authenticate`` challenge, both + read from the SAME response, so the status that picks the carrier channel and the challenge that + rides with it can never come from two different responses in the tree. Non-auth responses do not + end the scan: a causal 401 behind an unrelated 5xx must still be found, or the client never + receives the challenge it needs to re-authenticate.""" + for response in _iter_upstream_responses(exc): + if response.status_code in (401, 403): + return response.status_code, response.headers.get("www-authenticate") + return None + + +def raise_classified_list_failure( + exc: BaseException, + server_name: str, + suppress_challenge: bool = False, +) -> NoReturn: + """The one place a failed server fetch chooses its carrier: an upstream 401/403 travels as + ``MCPUpstreamAuthError`` with the upstream's own challenge preserved (a challenge is only ever + fabricated at the HTTP edge, and only for a 401), everything else as ``MCPServerListError`` with + a classified fault. Every fetch site delegates here so the two channels cannot drift apart per + call site. ``suppress_challenge`` is for dcr_bridge servers, whose upstream challenge points + clients at the wrong protected-resource metadata and must never relay.""" + auth = upstream_auth_challenge(exc) + if auth is not None: + status_code, challenge = auth + raise MCPUpstreamAuthError( + status_code=status_code, + www_authenticate=None if suppress_challenge else challenge, + server_name=server_name, + ) from exc + raise MCPServerListError(classify_list_exception(exc), server_name) from exc + + +def classify_list_exception(exc: BaseException) -> ServerListFault: + """Classify a per-server listing failure into exactly one outcome. Total: an exception this + function cannot recognize is the gateway's own fault (``internal``), never a re-raise.""" + if isinstance(exc, MCPServerListError) and isinstance(exc.fault, ServerListFault): + return exc.fault + if isinstance(exc, MCPUpstreamAuthError): + tag = "forbidden" if exc.status_code == 403 else "auth_required" + return ServerListFault(tag=tag, status_code=exc.status_code) + if isinstance(exc, TimeoutError): + return ServerListFault(tag="timeout") + if isinstance(exc, ConnectionError): + return ServerListFault(tag="unreachable") + auth = upstream_auth_challenge(exc) + if auth is not None: + status_code, _ = auth + return ServerListFault( + tag="forbidden" if status_code == 403 else "auth_required", + status_code=status_code, + ) + response = _find_upstream_response(exc) + if response is not None: + return ServerListFault(tag="upstream_error", status_code=response.status_code) + if isinstance(exc, (httpx.TimeoutException,)): + return ServerListFault(tag="timeout") + if isinstance(exc, httpx.TransportError): + return ServerListFault(tag="unreachable") + return ServerListFault(tag="internal") + + +def outcome_wire_value(outcome: ServerOutcome) -> dict[str, object]: + """The client-visible form of one outcome, for the tools/list result ``_meta`` and the REST + response: category plus status code only, never upstream prose or URLs.""" + match outcome.tag: + case "ok": + return {"status": "ok", "tool_count": outcome.tool_count} + case "auth_required" | "forbidden" | "timeout" | "unreachable" | "upstream_error" | "internal": + return { + "status": outcome.tag, + **({"http_status": outcome.status_code} if outcome.status_code is not None else {}), + } + case _: + assert_never(outcome.tag) + + +def list_fault_http_status(fault: ServerListFault) -> int: + """The truthful HTTP status for a single-upstream listing fault per RFC 9110: the upstream's own + 401/403 for auth, 504 for a timeout, 502 for an unreachable or misbehaving upstream, and 500 only + for the gateway's own failure.""" + match fault.tag: + case "auth_required": + return fault.status_code or 401 + case "forbidden": + return 403 + case "timeout": + return 504 + case "unreachable" | "upstream_error": + return 502 + case "internal": + return 500 + case _: + assert_never(fault.tag) diff --git a/litellm/proxy/_experimental/mcp_server/faults/render_oauth.py b/litellm/proxy/_experimental/mcp_server/faults/render_oauth.py new file mode 100644 index 00000000000..d7806bc8917 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/faults/render_oauth.py @@ -0,0 +1,91 @@ +"""Render upstream OAuth/DCR faults onto the wire. The only place that chooses statuses and bodies +for these faults, so every consumer emits the same contract: RFC 6749 §5.2-shaped JSON with the §5.1 +no-store headers on token endpoints, HTTPException details on registration. Status, code, and prose +all derive from the fault tag; exhaustive matches keep a new fault arm from shipping unrendered. +""" + +from __future__ import annotations + +from fastapi.responses import JSONResponse +from typing_extensions import assert_never + +from litellm.proxy._experimental.mcp_server.faults.types import UpstreamOAuthFault +from litellm.proxy._experimental.mcp_server.oauth_utils import TOKEN_NO_CACHE_HEADERS + + +def _gateway_rejected_description(code: str) -> str: + if code == "invalid_target": + return ( + "the upstream authorization server rejected the request (invalid_target); it did not " + "accept this server's RFC 8707 resource indicator. Set upstream_resource on the MCP " + "server to the resource identifier the authorization server expects, or unset it if " + "that authorization server does not support resource indicators" + ) + return ( + f"the upstream authorization server rejected the gateway's configured client credentials " + f"({code}); verify the MCP server's client_id and client_secret" + ) + + +def _upstream_reported_status_and_description(code: str) -> tuple[int, str]: + if code == "temporarily_unavailable": + return 503, "the upstream authorization server is temporarily unavailable; retry shortly" + return 502, "the upstream authorization server reported an internal error" + + +def render_token_fault(fault: UpstreamOAuthFault) -> JSONResponse: + """RFC 6749 §5.2 response for a token-endpoint fault. Caller-actionable rejections relay the + upstream's code on the status that code implies (401 for invalid_client per §5.2, else 400); + gateway-side faults are 502 ``server_error`` with gateway-authored prose so a caller is never + blamed for, or shown the internals of, a failure only the operator can fix.""" + match fault.tag: + case "caller_rejected": + content = { + "error": fault.code, + **({"error_description": fault.description} if fault.description else {}), + **({"error_uri": fault.error_uri} if fault.error_uri else {}), + } + status_code = 401 if fault.code == "invalid_client" else 400 + return JSONResponse(status_code=status_code, content=content, headers=TOKEN_NO_CACHE_HEADERS) + case "gateway_rejected": + return JSONResponse( + status_code=502, + content={ + "error": "server_error", + "error_description": _gateway_rejected_description(fault.code), + }, + headers=TOKEN_NO_CACHE_HEADERS, + ) + case "upstream_reported_fault": + status_code, description = _upstream_reported_status_and_description(fault.code) + return JSONResponse( + status_code=status_code, + content={"error": fault.code, "error_description": description}, + headers=TOKEN_NO_CACHE_HEADERS, + ) + case "upstream_protocol_fault": + return JSONResponse( + status_code=502, + content={"error": "server_error", "error_description": fault.note}, + headers=TOKEN_NO_CACHE_HEADERS, + ) + case _: + assert_never(fault.tag) + + +def dcr_fault_detail(fault: UpstreamOAuthFault) -> tuple[int, str]: + """Status and detail string for a registration fault, raised as HTTPException by the caller. + RFC 7591 §3.2.2 defines registration errors as 400, so a contract-conformant rejection is 400 + regardless of the status the upstream chose; everything else is a 502 upstream fault.""" + match fault.tag: + case "caller_rejected": + detail = f"{fault.code}: {fault.description}" if fault.description else fault.code + return 400, detail + case "gateway_rejected": + return 502, _gateway_rejected_description(fault.code) + case "upstream_reported_fault": + return _upstream_reported_status_and_description(fault.code) + case "upstream_protocol_fault": + return 502, fault.note + case _: + assert_never(fault.tag) diff --git a/litellm/proxy/_experimental/mcp_server/faults/traversal.py b/litellm/proxy/_experimental/mcp_server/faults/traversal.py new file mode 100644 index 00000000000..78e94e22e70 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/faults/traversal.py @@ -0,0 +1,35 @@ +"""Shared exception-tree traversal for fault classification. + +Failures cross the MCP SDK's anyio task groups wrapped in ``ExceptionGroup``s and chained through +``raise ... from`` causes, so every classifier that needs an exception buried in the tree (an +upstream ``httpx.Response``, a context-window overflow) has to walk the same shapes. One traversal +with one deliberate order keeps blame assignment consistent across classifiers: explicit links are +searched before incidental ones, so an exception raised while handling the real failure can never +shadow the failure itself. +""" + +from __future__ import annotations + +from collections.abc import Iterator + + +def iter_exception_tree(exc: BaseException) -> Iterator[BaseException]: + """Yield ``exc`` and every exception reachable from it, explicit links first: each node's + ``raise ... from`` cause subtree, then ``ExceptionGroup`` members in raise order, then the + incidental ``__context__`` chain last. Cycle-safe via identity tracking, and iterative so a + deep chain cannot overflow the interpreter stack.""" + seen: set[int] = set() + stack = [exc] + while stack: + current = stack.pop() + if id(current) in seen: + continue + seen.add(id(current)) + yield current + if current.__context__ is not None: + stack.append(current.__context__) + exceptions = getattr(current, "exceptions", None) + if isinstance(exceptions, tuple): + stack.extend(reversed(exceptions)) + if current.__cause__ is not None: + stack.append(current.__cause__) diff --git a/litellm/proxy/_experimental/mcp_server/faults/types.py b/litellm/proxy/_experimental/mcp_server/faults/types.py new file mode 100644 index 00000000000..635a66dcf68 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/faults/types.py @@ -0,0 +1,80 @@ +"""Fault taxonomy for upstream OAuth token and DCR registration failures. + +Each fault is a frozen model on a ``tag`` literal. The tag alone decides the HTTP status, the wire +error code, and whose prose the caller sees, so those three facts can never disagree the way they can +when an upstream's status and error code are relayed independently. +""" + +from __future__ import annotations + +from typing import Literal, TypeAlias + +from pydantic import BaseModel, ConfigDict + +MAX_WIRE_FIELD_CHARS = 500 +"""Bound on every upstream-derived string that crosses to a caller or into a log line.""" + +CredentialSource: TypeAlias = Literal["gateway_stored", "caller_supplied"] +"""Whose client credentials the gateway presented upstream: the MCP server's stored configuration or +credentials the caller supplied on the request. Decides whether a credential rejection is the +caller's problem to fix or the gateway operator's.""" + +GATEWAY_CREDENTIAL_CODES: frozenset[str] = frozenset({"invalid_client", "unauthorized_client"}) +"""RFC 6749 error codes that indict the OAuth client's credentials or grant authorization. When the +gateway presented its own stored credentials, these are gateway-side faults the caller cannot act on; +when the caller supplied the credentials, they are the caller's to fix.""" + +GATEWAY_CAPABILITY_CODES: frozenset[str] = frozenset({"invalid_target"}) +"""Codes that indict gateway configuration regardless of whose credentials were presented: +``invalid_target`` means the upstream did not accept the RFC 8707 resource indicator the server +sent, or requires one it was not configured to send (``upstream_resource``). Never the caller's +fault.""" + +UPSTREAM_FAULT_CODES: frozenset[str] = frozenset({"server_error", "temporarily_unavailable"}) +"""Codes by which the upstream blames itself. Relaying them as caller faults would invert blame, so +they classify as upstream-reported faults and render on the 5xx their meaning implies.""" + + +class CallerRejected(BaseModel): + """The upstream spoke the OAuth error contract and the failure is actionable by our caller + (e.g. ``invalid_grant``: re-run authorization). The code and its bounded prose relay on the + 4xx status the code itself implies.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["caller_rejected"] = "caller_rejected" + code: str + description: str | None = None + error_uri: str | None = None + + +class GatewayRejected(BaseModel): + """The upstream rejected the request for a cause only the gateway operator can address: the + server's stored client credentials or a gateway capability gap. Not actionable by the caller: + rendered as 502 with gateway-authored prose naming the code; the upstream's prose goes to + server logs only.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["gateway_rejected"] = "gateway_rejected" + code: str + + +class UpstreamReportedFault(BaseModel): + """The upstream blamed itself in the OAuth vocabulary. Rendered on the 5xx the code implies + (``server_error`` 502, ``temporarily_unavailable`` 503) so blame and status agree.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["upstream_reported_fault"] = "upstream_reported_fault" + code: Literal["server_error", "temporarily_unavailable"] + + +class UpstreamProtocolFault(BaseModel): + """The upstream broke the error contract: no JSON ``error`` field, an undecodable body, or a + success response without a usable token. Rendered as 502 with a gateway-authored note; the + upstream body never crosses to the caller.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["upstream_protocol_fault"] = "upstream_protocol_fault" + note: str + + +UpstreamOAuthFault: TypeAlias = CallerRejected | GatewayRejected | UpstreamReportedFault | UpstreamProtocolFault diff --git a/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py b/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py new file mode 100644 index 00000000000..58233c4c9e5 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py @@ -0,0 +1,637 @@ +"""The gateway-level DCR flow for the aggregate ``/mcp`` endpoint (``mcp_gateway_dcr``). + +An OAuth-only DCR client (Claude Desktop, Claude Code, MCP Inspector) pointed at the +aggregate ``/mcp`` endpoint discovers the gateway as its authorization server (PR 1 of +this track) and then walks the flow implemented here: + +1. ``POST /register``: stateless dynamic client registration. The ``client_id`` IS the + registration: the client's redirect URIs are sealed into it with the repo's + authenticated symmetric helper, so nothing is persisted and a forged or tampered + client_id simply fails to open. Clients are always public (``token_endpoint_auth_method + "none"``); PKCE S256 is what protects the code. +2. ``GET /authorize``: validates the client and redirect URI, requires S256 PKCE, and + interposes LiteLLM sign-in. Without a session cookie the browser is sent through + ``/sso/key/generate`` with a same-origin ``return_to`` so it lands back here after + login. With a session, the flow parameters and the SSO user are sealed into a per-flow + HttpOnly cookie (the same pattern as the upstream OAuth state relay) and the browser is + sent to the connect page, where the user authorizes individual servers (vaulting those + tokens server-side) before finishing. +3. ``POST /authorize/complete``: the deliberate finish step. A POST (not GET) bound to the + SameSite=Lax flow cookie, so a cross-site link cannot silently mint a code with the + victim's session, and the signed-in user must match the user sealed into the flow. + Mints a short-lived, single-use, gateway-sealed authorization code and redirects to the + client's registered redirect URI. +4. ``POST /token``: exchanges the code (PKCE-verified, client- and redirect-bound, + single-use) for the identity-only session tokens of + :mod:`.outbound_credentials.session_token`, re-validating that the litellm user is + still active first; the ``refresh_token`` grant rotates the pair the same way. + +Nothing here stores state server-side except the single-use code guard (a TTL cache +entry). Every sealed value is authenticated encryption over the proxy salt/master key +family, opened totally (bad input maps to an OAuth error, never a raise), and every +identity is a stable reference re-validated live at mint, refresh, and (in the admission +PR) tool-call time. Upstream server credentials never appear anywhere in this flow; they +are vaulted per user by the existing ``/v1/mcp`` authorize endpoints and resolved at +egress by user id. +""" + +from __future__ import annotations + +import hashlib +import hmac +import secrets +from base64 import urlsafe_b64encode +from collections.abc import Mapping +from datetime import datetime, timezone +from typing import Awaitable, Callable, Literal, TypeVar +from urllib.parse import parse_qsl, urlencode, urlparse, urlunparse + +from fastapi import HTTPException, Request +from fastapi.responses import JSONResponse, RedirectResponse, Response +from pydantic import BaseModel, ConfigDict, Field, ValidationError +from typing_extensions import assert_never + +from litellm._logging import verbose_logger +from litellm.caching.caching import DualCache +from litellm.proxy._experimental.mcp_server.oauth_utils import ( + TOKEN_NO_CACHE_HEADERS, + get_request_base_url, + is_loopback_redirect_host, + validate_redirect_uri_shape, +) +from litellm.proxy._experimental.mcp_server.outbound_credentials.session_credentials import ( + SessionRefreshOpened, + open_session_refresh_bearer, + session_keys_from_master_key, +) +from litellm.proxy._experimental.mcp_server.outbound_credentials.session_token import ( + SESSION_REFRESH_TTL_SECONDS, + MintedSessionToken, + SessionKeys, + SessionPrincipal, + mint_session_refresh_token, + mint_session_token, +) +from litellm.proxy.common_utils.encrypt_decrypt_utils import ( + decrypt_value_helper, + encrypt_value_helper, +) + +GATEWAY_DCR_CLIENT_ID_PREFIX = "llm_dcrc_" +"""Marker prefix on every gateway-issued DCR client_id so the root authorize/token +endpoints can route an aggregate-flow request without decrypting, and existing per-server +flows (whose client_ids are upstream-issued) are never captured by the aggregate arm.""" + +GATEWAY_AUTH_CODE_PREFIX = "llm_gcode_" +"""Marker prefix on the gateway-sealed authorization code, distinct from the bridge +``llm_bcode_`` so neither flow can consume the other's codes.""" + +CONNECT_FLOW_COOKIE_PREFIX = "mcp_connect_flow_" +"""Per-flow HttpOnly cookie holding the sealed connect flow, keyed by a short random +handle carried in the connect-page URL (the same handle-plus-cookie pattern as the +``mcp_oauth_state_`` upstream relay, for the same reasons: replica-safe with no +server-side session store, and the sealed value never appears in a URL).""" + +CONNECT_FLOW_TTL_SECONDS = 600 +GATEWAY_AUTH_CODE_TTL_SECONDS = 120 +_CLAIM_TTL_BUFFER_SECONDS = 60 +_USED_CODE_CACHE_PREFIX = "mcp_gateway_dcr_code_used:" +_USED_FLOW_CACHE_PREFIX = "mcp_gateway_dcr_flow_used:" +_USED_REFRESH_CACHE_PREFIX = "mcp_gateway_dcr_refresh_used:" + +MAX_REDIRECT_URIS = 3 +MAX_REDIRECT_URI_LENGTH = 256 +MAX_CLIENT_ID_LENGTH = 2048 +"""Registration bounds. They exist to bound the sealed client_id, which rides inside +every session-token claim set: 3 URIs of 256 bytes seal to roughly 1.2KB, comfortably +under this cap and under the session token's own 4KB ceiling. Claude Desktop and MCP +Inspector register one or two redirect URIs.""" + +MAX_STATE_LENGTH = 1024 +"""Bound on the client ``state`` sealed into the flow cookie and echoed on the auth-code +redirect. An unbounded ``state`` can push the sealed cookie past the browser's ~4KB cap +(silently dropped, breaking the flow); spec clients send a short opaque value.""" + +MIN_CODE_VERIFIER_LENGTH = 43 +MAX_CODE_VERIFIER_LENGTH = 128 +"""RFC 7636 section 4.1 bounds for the PKCE ``code_verifier``. Enforced so an out-of-range +verifier gets a clean ``invalid_request`` instead of an opaque PKCE-mismatch.""" + +_UNPREFIXED = "" +"""Prefix for a sealed value that carries no wire marker because it is never routed by +prefix (the connect flow lives only in its own per-handle cookie, opened by that one +handle). Named so the empty-string argument to ``_seal`` / ``_open_sealed`` reads as +deliberate rather than a typo.""" + +_CLIENT_RECORD_DEBUG_KEY = "gateway_dcr_client" +_CONNECT_FLOW_DEBUG_KEY = "gateway_connect_flow" +_AUTH_CODE_DEBUG_KEY = "gateway_authorization_code" + +ReloadUserFailure = Literal["unresolvable", "unavailable", "no_active_key"] +ReloadUser = Callable[[str], Awaitable[ReloadUserFailure | None]] +"""Injected live-user revalidation (the token endpoint's mirror of admission): +``None`` means the user is active; ``unavailable`` is a retryable DB outage; anything +else fails the grant closed.""" + + +class GatewayDcrClient(BaseModel): + """The registration record sealed into a gateway DCR ``client_id``. + + ``extra="forbid"`` so a sealed value of another type (an auth code, a connect flow) + that happened to decrypt under the shared key can never validate as a client record: + cross-type confusion is rejected at the model boundary, not left to differing required + fields.""" + + model_config = ConfigDict(frozen=True, extra="forbid") + redirect_uris: tuple[str, ...] = Field(min_length=1, max_length=MAX_REDIRECT_URIS) + iat: int + + +class _ConnectFlow(BaseModel): + """One in-flight authorize: the SSO user it belongs to and the client parameters + needed to mint the code at the finish step. Sealed into the per-flow cookie. ``jti`` + makes the flow single-use at complete; ``extra="forbid"`` rejects cross-type + confusion.""" + + model_config = ConfigDict(frozen=True, extra="forbid") + user_id: str = Field(min_length=1) + client_id: str = Field(min_length=1) + redirect_uri: str = Field(min_length=1) + state: str + code_challenge: str = Field(min_length=1) + jti: str = Field(min_length=1) + exp: int + + +class _GatewayAuthCode(BaseModel): + """The gateway-sealed authorization code: the user consent it represents and the + bindings the token endpoint must verify (client, redirect URI, PKCE challenge), + plus a ``jti`` for the single-use guard. ``extra="forbid"`` rejects cross-type + confusion.""" + + model_config = ConfigDict(frozen=True, extra="forbid") + user_id: str = Field(min_length=1) + client_id: str = Field(min_length=1) + redirect_uri: str = Field(min_length=1) + code_challenge: str = Field(min_length=1) + jti: str = Field(min_length=1) + iat: int + exp: int + + +def is_gateway_dcr_client_id(client_id: str | None) -> bool: + """Cheap prefix routing test so the root endpoints only enter the aggregate arm for + clients this flow registered; every other client_id keeps today's behavior.""" + return client_id is not None and client_id.startswith(GATEWAY_DCR_CLIENT_ID_PREFIX) + + +def _oauth_error(status_code: int, error: str, description: str) -> JSONResponse: + """RFC 6749 section 5.2 / RFC 7591 section 3.2.2 error body. Descriptions carry no + token, code, or URL material so they are safe to relay to any client.""" + return JSONResponse( + status_code=status_code, + content={"error": error, "error_description": description}, + headers=TOKEN_NO_CACHE_HEADERS, + ) + + +def _seal(prefix: str, payload: BaseModel) -> str: + return prefix + encrypt_value_helper(payload.model_dump_json()) + + +_SealedModelT = TypeVar("_SealedModelT", bound=BaseModel) + + +def _open_sealed(value: str, prefix: str, model: type[_SealedModelT], debug_key: str) -> _SealedModelT | None: + """Open a sealed value totally: anything that is not prefix-shaped, does not decrypt, + or does not validate returns ``None`` for the caller to map onto an OAuth error.""" + if not value.startswith(prefix): + return None + decrypted = decrypt_value_helper(value[len(prefix) :], debug_key, return_original_value=False) + if not isinstance(decrypted, str): + return None + try: + return model.model_validate_json(decrypted) + except ValidationError: + return None + + +def open_gateway_dcr_client(client_id: str) -> GatewayDcrClient | None: + return _open_sealed(client_id, GATEWAY_DCR_CLIENT_ID_PREFIX, GatewayDcrClient, _CLIENT_RECORD_DEBUG_KEY) + + +async def register_aggregate_client(request: Request, request_body: Mapping[str, object]) -> Response: + """RFC 7591 dynamic registration against the gateway itself, statelessly. + + Only ``redirect_uris`` is authoritative; every client is registered as a public + ``token_endpoint_auth_method "none"`` client regardless of what it asked for (RFC + 7591 lets the server override metadata), because the gateway never issues client + secrets: possession of a secret would add nothing over the mandatory S256 PKCE, and a + stateless registration has nowhere to keep one. Nothing is persisted, so open + registration cannot be used to fill storage. + + Redirect-URI *hygiene* is not decided here: :func:`validate_redirect_uri_shape` is + the single owner of that rule across the MCP OAuth surface, so allowlisted native + callbacks (``cursor://``) are accepted and fragments, missing hosts, userinfo + (``https://claude.ai@attacker.example/cb``) and backslash hosts are rejected exactly + as they are on /authorize and /callback. + + What this endpoint does decide is its own trust policy, which is deliberately wider + than :func:`validate_trusted_redirect_uri`'s: registration is *public*, so any https + client may register (that is what lets a hosted MCP client register at all), and the + controls are mandatory S256 PKCE plus the consent screen showing the client origin. + http is confined to loopback per RFC 8252 section 7.3. + """ + raw_uris = request_body.get("redirect_uris") + if not isinstance(raw_uris, list) or not raw_uris or len(raw_uris) > MAX_REDIRECT_URIS: + return _oauth_error( + 400, + "invalid_redirect_uri", + f"redirect_uris must be a list of 1 to {MAX_REDIRECT_URIS} URIs", + ) + if not all(isinstance(uri, str) and len(uri) <= MAX_REDIRECT_URI_LENGTH for uri in raw_uris): + return _oauth_error( + 400, + "invalid_redirect_uri", + f"each redirect URI must be a string of at most {MAX_REDIRECT_URI_LENGTH} characters", + ) + for uri in raw_uris: + parsed = urlparse(uri) + try: + if validate_redirect_uri_shape(parsed): + continue # allowlisted native callback, e.g. cursor:// + except HTTPException as exc: + # The shared validator speaks HTTP; RFC 7591 registration answers with an OAuth + # error object, so translate the shape without re-deciding the rule. + return _oauth_error(400, "invalid_redirect_uri", str(exc.detail)) + if parsed.scheme == "https" or (parsed.scheme == "http" and is_loopback_redirect_host(parsed)): + continue + return _oauth_error( + 400, + "invalid_redirect_uri", + "each redirect URI must be https, http on a loopback host, or a registered native callback", + ) + now = datetime.now(timezone.utc) + client_id = _seal( + GATEWAY_DCR_CLIENT_ID_PREFIX, GatewayDcrClient(redirect_uris=tuple(raw_uris), iat=int(now.timestamp())) + ) + if len(client_id) > MAX_CLIENT_ID_LENGTH: + return _oauth_error(400, "invalid_client_metadata", "registered metadata is too large") + return JSONResponse( + status_code=201, + content={ + "client_id": client_id, + "client_id_issued_at": int(now.timestamp()), + "redirect_uris": list(raw_uris), + "token_endpoint_auth_method": "none", + "grant_types": ["authorization_code", "refresh_token"], + "response_types": ["code"], + }, + ) + + +def _flow_cookie_name(handle: str) -> str: + return f"{CONNECT_FLOW_COOKIE_PREFIX}{handle}" + + +def _cookie_path_and_secure(request: Request) -> tuple[str, bool]: + parsed = urlparse(get_request_base_url(request)) + return parsed.path or "/", parsed.scheme == "https" + + +def _append_query_params(url: str, params: dict[str, str]) -> str: + parsed = urlparse(url) + query = parse_qsl(parsed.query, keep_blank_values=True) + list(params.items()) + return urlunparse(parsed._replace(query=urlencode(query))) + + +def relative_request_url(request: Request) -> str: + """The request's own path and query as a same-origin ``return_to`` target for the + login round-trip; relative by construction, so it can never leave the gateway.""" + path = request.url.path + return f"{path}?{request.url.query}" if request.url.query else path + + +def aggregate_authorize( + request: Request, + client_id: str, + redirect_uri: str, + state: str, + code_challenge: str | None, + code_challenge_method: str | None, + response_type: str | None, + session_user_id: str | None, +) -> Response: + """The aggregate authorize verb: validate the client, require S256 PKCE, interpose + LiteLLM sign-in, and hand the browser to the connect page with the flow sealed into a + per-flow cookie. + + Validation failures respond directly with 400 and never redirect: per RFC 6749 + section 4.1.2.1 an unvalidated redirect URI must not receive an error redirect, and + once the client is at fault there is no trusted place to send the browser. + """ + client = open_gateway_dcr_client(client_id) + if client is None: + return _oauth_error(400, "invalid_client", "unknown or malformed client_id") + if redirect_uri not in client.redirect_uris: + return _oauth_error(400, "invalid_request", "redirect_uri is not registered for this client") + if response_type != "code": + return _oauth_error(400, "unsupported_response_type", "response_type must be 'code'") + if not code_challenge or code_challenge_method != "S256": + return _oauth_error( + 400, + "invalid_request", + "PKCE is required: send code_challenge with code_challenge_method=S256", + ) + if len(state) > MAX_STATE_LENGTH: + return _oauth_error(400, "invalid_request", f"state must be at most {MAX_STATE_LENGTH} characters") + base_url = get_request_base_url(request) + if session_user_id is None: + login_url = f"{base_url}/sso/key/generate?{urlencode({'return_to': relative_request_url(request)})}" + return RedirectResponse(login_url, status_code=303) + now = datetime.now(timezone.utc) + handle = secrets.token_urlsafe(24) + flow = _ConnectFlow( + user_id=session_user_id, + client_id=client_id, + redirect_uri=redirect_uri, + state=state, + code_challenge=code_challenge, + jti=secrets.token_urlsafe(24), + exp=int(now.timestamp()) + CONNECT_FLOW_TTL_SECONDS, + ) + connect_url = _append_query_params( + f"{base_url}/ui/chat/integrations", + {"connect_flow": handle, "connect_client": _origin_only(redirect_uri)}, + ) + response = RedirectResponse(connect_url, status_code=303) + path, secure = _cookie_path_and_secure(request) + response.set_cookie( + key=_flow_cookie_name(handle), + value=_seal(_UNPREFIXED, flow), + max_age=CONNECT_FLOW_TTL_SECONDS, + path=path, + secure=secure, + httponly=True, + samesite="lax", + ) + return response + + +def _origin_only(url: str) -> str: + """Scheme+host for display on the connect page; never the full redirect URI, whose + path or query could carry values that do not belong in a page URL or logs.""" + parsed = urlparse(url) + return f"{parsed.scheme}://{parsed.netloc}" if parsed.netloc else "" + + +async def complete_connect_flow( + request: Request, + flow_handle: str, + session_user_id: str | None, + cache: DualCache, +) -> Response: + """The deliberate finish step of the connect flow: mint the gateway authorization + code and send the browser back to the client. + + Reached by POST so a cross-site GET cannot trigger it, and bound to the HttpOnly + per-flow cookie plus an exact match between the signed-in user and the user sealed + into the flow: a link crafted by another party dies here with ``access_denied`` + instead of minting a code for the victim's identity. The flow is single-use (an atomic + claim on its ``jti``), so a double-submit cannot mint two codes from one sign-in. + """ + sealed_flow = request.cookies.get(_flow_cookie_name(flow_handle)) + if sealed_flow is None: + return _oauth_error(400, "invalid_request", "unknown or expired connect flow") + flow = _open_sealed(sealed_flow, _UNPREFIXED, _ConnectFlow, _CONNECT_FLOW_DEBUG_KEY) + if flow is None: + return _oauth_error(400, "invalid_request", "unknown or expired connect flow") + now = datetime.now(timezone.utc) + if now.timestamp() >= flow.exp: + return _oauth_error(400, "invalid_request", "the connect flow has expired; restart the connection") + if session_user_id is None: + return _oauth_error(401, "login_required", "sign in to LiteLLM to finish connecting") + if session_user_id != flow.user_id: + return _oauth_error(403, "access_denied", "the signed-in user does not match this connect flow") + if not await _SingleUseGuard(cache).claim( + f"{_USED_FLOW_CACHE_PREFIX}{flow.jti}", CONNECT_FLOW_TTL_SECONDS + _CLAIM_TTL_BUFFER_SECONDS + ): + return _oauth_error(400, "invalid_request", "this connect flow was already completed; restart the connection") + code = _seal( + GATEWAY_AUTH_CODE_PREFIX, + _GatewayAuthCode( + user_id=flow.user_id, + client_id=flow.client_id, + redirect_uri=flow.redirect_uri, + code_challenge=flow.code_challenge, + jti=secrets.token_urlsafe(24), + iat=int(now.timestamp()), + exp=int(now.timestamp()) + GATEWAY_AUTH_CODE_TTL_SECONDS, + ), + ) + params = {"code": code, **({"state": flow.state} if flow.state else {})} + response = RedirectResponse(_append_query_params(flow.redirect_uri, params), status_code=303) + path, secure = _cookie_path_and_secure(request) + response.delete_cookie(key=_flow_cookie_name(flow_handle), path=path, secure=secure, httponly=True, samesite="lax") + return response + + +def _pkce_verifier_matches(code_verifier: str, code_challenge: str) -> bool: + """RFC 7636 S256 verification, total over hostile input. The comparison is over bytes + so a non-ASCII ``code_challenge`` (which reaches here unvalidated from the client's + authorize request) simply fails to match instead of raising ``TypeError`` the way + ``hmac.compare_digest`` does on two ``str`` with non-ASCII content. The verifier is + ASCII per spec; a compliant client's challenge is base64url and matches.""" + digest = hashlib.sha256(code_verifier.encode("ascii", "replace")).digest() + computed = urlsafe_b64encode(digest).rstrip(b"=") + return hmac.compare_digest(computed, code_challenge.encode("utf-8")) + + +class _SingleUseGuard: + """Atomic single-use claim for a one-time id (an auth-code, connect-flow ``jti``, or refresh-token + ``jti``) over the injected proxy cache. + + Uses an atomic increment rather than a get-then-set: two concurrent redemptions of the same id + cannot both observe "unused", because exactly one increment returns 1. The claim IS the gate, so it + fails closed. Crucially, the increment must be recorded in a backend SHARED across replicas, or the + single-use property is per-worker only (each replica's in-memory counter returns 1, so a captured + id replays through a different worker): + + - When a Redis backend is configured it is the SOLE authority: the claim goes straight to Redis + (``INCR`` is atomic across replicas), and any Redis fault fails the claim CLOSED — it never falls + back to the per-worker in-memory count (``DualCache.async_increment_cache`` does fall back, which + is exactly the replay window this avoids). + - With no Redis configured (single-replica) the in-memory increment is authoritative within the one + process. A multi-worker deployment must run Redis for the guarantee to hold across workers. + + The id's own TTL is the outer bound. For the auth code, PKCE binding is the primary defense against + interception; this makes the RFC 6749 4.1.2 single-use property reliable on top of it.""" + + def __init__(self, cache: DualCache) -> None: + self._cache = cache + + async def claim(self, key: str, ttl_seconds: int) -> bool: + """Atomically claim ``key``. ``True`` iff this caller is the first (increment to 1); ``False`` + on a replay (>1) or when the claim could not be recorded in the shared backend (fail closed).""" + from litellm.proxy.proxy_server import redis_usage_cache # noqa: PLC0415 # circular import at module load + + # Resolve the shared authority HERE rather than trusting the injected cache: callers pass + # user_api_key_cache, which only carries a redis_cache when enable_redis_auth_cache is set + # (off by default), so a guard that read its injected cache silently degraded every claim to + # a per-worker count on a stock multi-worker deployment. redis_usage_cache is the store the + # proxy already treats as cross-worker, so no call site can wire the guarantee away. + redis_cache = redis_usage_cache or getattr(self._cache, "redis_cache", None) + if redis_cache is not None: + # Shared, atomic authority for multi-replica deployments. Claim ONLY against Redis and fail + # CLOSED on any Redis fault (async_increment re-raises) rather than fall back to the + # per-worker in-memory count, which would let each replica observe count==1 and replay the id. + try: + count = await redis_cache.async_increment(key, 1, ttl=ttl_seconds) + except Exception as e: # noqa: BLE001 # ANY Redis fault fails the single-use claim closed + verbose_logger.warning( + "mcp gateway single-use claim: shared cache backend unavailable, failing closed: %s", e + ) + return False + return count == 1 + # No shared backend configured (single-replica): the in-memory increment is authoritative. + count = await self._cache.async_increment_cache(key, 1, ttl=ttl_seconds, local_only=True) + return count == 1 + + +def _session_token_pair(principal: SessionPrincipal, keys: SessionKeys, now: datetime) -> Response: + access = mint_session_token(principal, keys, now) + refresh = mint_session_refresh_token(principal, keys, now) + if not isinstance(access, MintedSessionToken) or not isinstance(refresh, MintedSessionToken): + return _oauth_error(500, "server_error", "failed to mint the session credential") + return JSONResponse( + status_code=200, + content={ + "access_token": access.token.get_secret_value(), + "token_type": "Bearer", + "expires_in": int((access.expires_at - now).total_seconds()), + "refresh_token": refresh.token.get_secret_value(), + }, + headers=TOKEN_NO_CACHE_HEADERS, + ) + + +def _reload_failure_response(failure: ReloadUserFailure) -> Response: + """Map the live-user revalidation failure onto its OAuth error, exhaustively, so a new + ``ReloadUserFailure`` member is a type error here rather than silently 400ing.""" + match failure: + case "unavailable": + return _oauth_error(503, "temporarily_unavailable", "the gateway database is unavailable; retry") + case "unresolvable": + return _oauth_error(500, "server_error", "the gateway is not configured to resolve users") + case "no_active_key": + return _oauth_error(400, "invalid_grant", "the user for this grant is no longer active") + case _: + assert_never(failure) + + +async def aggregate_token( + request: Request, + grant_type: str, + code: str | None, + redirect_uri: str | None, + client_id: str, + code_verifier: str | None, + refresh_token: str | None, + master_key: str | None, + reload_user: ReloadUser, + cache: DualCache, +) -> Response: + """The aggregate token verb: authorization_code and refresh_token grants for the + identity-only session pair. Every path re-validates the litellm user live before + minting, so a deactivated user cannot obtain or renew a session.""" + if master_key is None: + verbose_logger.error("mcp_gateway_dcr token grant rejected: no master_key configured") + return _oauth_error(500, "server_error", "the gateway has no master key configured") + keys = session_keys_from_master_key(master_key) + now = datetime.now(timezone.utc) + if grant_type == "authorization_code": + return await _authorization_code_grant( + code=code, + redirect_uri=redirect_uri, + client_id=client_id, + code_verifier=code_verifier, + keys=keys, + now=now, + reload_user=reload_user, + guard=_SingleUseGuard(cache), + ) + if grant_type == "refresh_token": + return await _refresh_token_grant( + refresh_token=refresh_token, + client_id=client_id, + keys=keys, + now=now, + reload_user=reload_user, + guard=_SingleUseGuard(cache), + ) + return _oauth_error(400, "unsupported_grant_type", "grant_type must be authorization_code or refresh_token") + + +async def _authorization_code_grant( + code: str | None, + redirect_uri: str | None, + client_id: str, + code_verifier: str | None, + keys: SessionKeys, + now: datetime, + reload_user: ReloadUser, + guard: _SingleUseGuard, +) -> Response: + if not code or not redirect_uri or not code_verifier: + return _oauth_error(400, "invalid_request", "code, redirect_uri, and code_verifier are required") + if not MIN_CODE_VERIFIER_LENGTH <= len(code_verifier) <= MAX_CODE_VERIFIER_LENGTH: + return _oauth_error(400, "invalid_request", "code_verifier must be 43 to 128 characters (RFC 7636)") + parsed = _open_sealed(code, GATEWAY_AUTH_CODE_PREFIX, _GatewayAuthCode, _AUTH_CODE_DEBUG_KEY) + if parsed is None: + return _oauth_error(400, "invalid_grant", "the authorization code is invalid") + if now.timestamp() >= parsed.exp: + return _oauth_error(400, "invalid_grant", "the authorization code has expired") + if client_id != parsed.client_id or redirect_uri != parsed.redirect_uri: + return _oauth_error(400, "invalid_grant", "the authorization code was issued to a different client") + if not _pkce_verifier_matches(code_verifier, parsed.code_challenge): + return _oauth_error(400, "invalid_grant", "PKCE verification failed") + # Revalidate the user BEFORE claiming the code, so a transient DB outage (a retryable + # 503) does not consume a still-valid code and force the client to restart sign-in. + failure = await reload_user(parsed.user_id) + if failure is not None: + return _reload_failure_response(failure) + # Atomic single-use claim is the gate: on a concurrent double-redeem exactly one caller + # wins, and a claim that cannot be recorded fails closed. + if not await guard.claim( + f"{_USED_CODE_CACHE_PREFIX}{parsed.jti}", GATEWAY_AUTH_CODE_TTL_SECONDS + _CLAIM_TTL_BUFFER_SECONDS + ): + return _oauth_error(400, "invalid_grant", "the authorization code was already used") + return _session_token_pair(SessionPrincipal(user_id=parsed.user_id, client_id=client_id), keys, now) + + +async def _refresh_token_grant( + refresh_token: str | None, + client_id: str, + keys: SessionKeys, + now: datetime, + reload_user: ReloadUser, + guard: _SingleUseGuard, +) -> Response: + if not refresh_token: + return _oauth_error(400, "invalid_request", "refresh_token is required") + opened = open_session_refresh_bearer(refresh_token, keys, now, expected_client_id=client_id) + if not isinstance(opened, SessionRefreshOpened): + return _oauth_error(400, "invalid_grant", "the refresh token is invalid for this client") + failure = await reload_user(opened.principal.user_id) + if failure is not None: + return _reload_failure_response(failure) + # Refresh-token rotation (OAuth 2.0 Security BCP section 4.13): the presented refresh token is + # single-use. Claim its jti before issuing the replacement pair, so a captured or replayed + # refresh token cannot mint a second pair after the legitimate holder rotated. Claimed AFTER + # user revalidation so a transient DB 503 does not burn a still-valid token; a claim that + # cannot be recorded fails closed, exactly like the authorization-code path. + if not await guard.claim( + f"{_USED_REFRESH_CACHE_PREFIX}{opened.jti}", SESSION_REFRESH_TTL_SECONDS + _CLAIM_TTL_BUFFER_SECONDS + ): + return _oauth_error(400, "invalid_grant", "the refresh token was already used") + return _session_token_pair(opened.principal, keys, now) diff --git a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py index c4ad673b88f..3e0775ac09e 100644 --- a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py +++ b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py @@ -13,6 +13,7 @@ import json import os import re import time +from collections.abc import Sequence from contextlib import asynccontextmanager from typing import Any, AsyncIterator, Callable, Literal, Optional, Union, cast from urllib.parse import urlparse @@ -49,15 +50,29 @@ from litellm.litellm_core_utils.url_utils import SSRFError, async_safe_get from litellm.llms.custom_httpx.http_handler import get_async_httpx_client from litellm.proxy._experimental.mcp_server.auth.user_api_key_auth_mcp import ( MCPRequestHandler, + _is_mcp_admitted_user_subject, ) -from litellm.proxy._experimental.mcp_server.exceptions import MCPUpstreamAuthError from litellm.proxy._experimental.mcp_server.elicitation_handler import ( MCP_ELICITATION_AVAILABLE, ) -from litellm.proxy._experimental.mcp_server.sampling_handler import ( - MCP_SAMPLING_AVAILABLE, +from litellm.proxy._experimental.mcp_server.exceptions import ( + MCPServerListError, + MCPUpstreamAuthError, +) +from litellm.proxy._experimental.mcp_server.faults.list_outcomes import ( + ServerListFault, + raise_classified_list_failure, + upstream_auth_challenge, +) +from litellm.proxy._experimental.mcp_server.oauth2_token_cache import ( + MCPPerUserTokenCache, + mcp_per_user_token_cache, + resolve_mcp_auth, +) +from litellm.proxy._experimental.mcp_server.oauth_utils import ( + _redact_mcp_resource_url, + canonicalize_url_identity, ) -from litellm.proxy._experimental.mcp_server.oauth2_token_cache import resolve_mcp_auth from litellm.proxy._experimental.mcp_server.outbound_credentials import ( Error, Ok, @@ -81,10 +96,16 @@ from litellm.proxy._experimental.mcp_server.outbound_credentials.token_exchange_ ) from litellm.proxy._experimental.mcp_server.outbound_credentials.types import ( AuthorizationCodeConfig, + ClientCredentialsConfig, + CredError, + IdJagConfig, PassthroughConfig, ServerSpec, TokenExchangeConfig, ) +from litellm.proxy._experimental.mcp_server.sampling_handler import ( + MCP_SAMPLING_AVAILABLE, +) from litellm.proxy._experimental.mcp_server.utils import ( MCP_TOOL_PREFIX_SEPARATOR, MCPMissingUserEnvVarsError, @@ -101,7 +122,6 @@ from litellm.proxy._experimental.mcp_server.utils import ( normalize_server_name, parse_admin_env_vars, split_server_prefix_from_name, - strip_known_server_prefix, validate_mcp_server_name, ) from litellm.proxy._types import ( @@ -128,11 +148,9 @@ from litellm.types.mcp_server.mcp_server_manager import ( from litellm.types.utils import CallTypes try: - from mcp.shared.tool_name_validation import ( - validate_tool_name, # pyright: ignore[reportAssignmentType] - ) from mcp.shared.tool_name_validation import ( SEP_986_URL, + validate_tool_name, # pyright: ignore[reportAssignmentType] ) except ImportError: from pydantic import BaseModel @@ -171,6 +189,390 @@ _user_env_vars_cache: dict[tuple[str, str], tuple[dict[str, str], float]] = {} _USER_ENV_VARS_CACHE_TTL = 60 # seconds _USER_ENV_VARS_CACHE_MAX_SIZE = 4096 # cap to prevent unbounded growth +# Auth types whose upstream OAuth endpoints (protected-resource + authorization-server metadata) the +# gateway discovers from the upstream itself: interactive oauth2 and the two client-forwarded modes. +# OBO/M2M endpoint discovery is decided separately via _obo_needs_endpoint_discovery. Shared by the +# config-YAML and DB server loaders so the two paths cannot drift on which modes trigger discovery. +_UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES: tuple[MCPAuth, ...] = ( + MCPAuth.oauth2, + MCPAuth.true_passthrough, + MCPAuth.oauth_delegate, +) + + +# OAuth discovery retry cooldown for servers whose endpoints stay unresolved. The base is one +# reload cadence so a transient upstream failure recovers immediately; the cap bounds the request +# amplification and log volume of a permanently broken configuration. +_OAUTH_DISCOVERY_RETRY_BASE_SECONDS = 30.0 +_OAUTH_DISCOVERY_RETRY_MAX_SECONDS = 900.0 + + +def _blank_to_none(value: str | None) -> str | None: + """Collapse an absent, empty, or whitespace-only string to ``None``. + + OAuth endpoint fields are consumed by truthiness-based merges (``row or discovered``) and by the + corroboration gate. A whitespace-only value is truthy to ``or`` but is not a usable endpoint, so + without this the merge would keep the blank value for redirects while the gate treats it as + unpinned and backfills the other fields, yielding a broken half-discovered config. Normalizing + the pinned fields once, at each build entry point, gives every downstream consumer a single + notion of "blank" so those code paths cannot disagree. + """ + if not isinstance(value, str): + return None + return value.strip() or None + + +def _uses_issuer_anchor(manual_issuer: str | None, is_discovery_auth_type: bool) -> bool: + """Whether the endpoints are authoritatively anchored to an admin-pinned issuer (RFC 8414 §3.3). + + This is the trust/provenance property, distinct from whether the ``issuer`` field is merely + populated: a trust-on-first-use discovered issuer sets ``issuer`` for token identity but is NOT + anchored, so its endpoints stay resource-rooted. Anchoring holds only when the issuer was pinned + (present on the row/config) on a discovery auth type. Every consumer of "is this anchored" reads + this one definition, so the answer cannot diverge across build paths. + """ + return _blank_to_none(manual_issuer) is not None and is_discovery_auth_type + + +def _has_oauth_discovery_source(server_url: str | None, use_issuer_anchor: bool) -> bool: + """Whether the server has any source OAuth discovery can fetch metadata from. + + Resource-rooted discovery (RFC 9728) is fetched from the server ``url``, so spec-only + (OpenAPI) and stdio servers, which have none, could never discover: their OAuth endpoints + stayed unset unless entered manually and ``/authorize`` served its 400 with no hint of why. + An admin-pinned issuer is a trust anchor in its own right (RFC 8414 section 3.3) whose + metadata fetch does not touch the resource at all, so an anchored server can discover with + no ``url``. Called by both build paths (config and DB) so the two cannot disagree on when + discovery is reachable. + """ + return bool(server_url) or use_issuer_anchor + + +def _endpoints_yield_to_issuer( + issuer: str | None, + is_discovery_auth_type: bool, + authorization_url: str | None, + token_url: str | None, + registration_url: str | None, + server_ref: str, +) -> tuple[str | None, str | None, str | None]: + """The single rule that makes an admin-configured ``issuer`` the sole authoritative endpoint + source (RFC 8414 §3.3): when it is set for a discovery auth type, the stored/manual + ``authorization_url``/``token_url``/``registration_url`` do not apply. They neither anchor nor + short-circuit discovery, never override the issuer document in the merge, and never substitute for + it when the issuer fetch fails (fail-closed). Returns the endpoint values that remain in force, + i.e. all ``None`` when issuer-anchored, else the inputs unchanged. Called at every resolution site + so the invariant holds in one place instead of being re-derived per merge. + """ + if issuer is None or not is_discovery_auth_type: + return authorization_url, token_url, registration_url + discarded = sorted( + label + for label, value in ( + ("authorization_url", authorization_url), + ("token_url", token_url), + ("registration_url", registration_url), + ) + if value + ) + if discarded: + verbose_logger.warning( + "MCP server %s has a pinned Issuer, so its stored %s %s not used: an anchored issuer is the " + "sole endpoint source (RFC 8414 section 3.3) and a failed issuer fetch fails closed rather " + "than falling back to them. To use manually configured endpoints instead, clear the Issuer " + "field and re-enter the endpoint urls (clearing the Issuer also clears endpoints that may " + "have been resolved under it), or clear the Issuer alone to re-discover from the server url.", + server_ref, + ", ".join(discarded), + "is" if len(discarded) == 1 else "are", + ) + return None, None, None + + +def _normalized_authorize_endpoint(url: str) -> str: + """Compare authorize endpoints / issuers on scheme, host, and path only, through the shared URL + canonicalizer: the default port is elided and the host is lowercased so + ``https://IDP.example.com:443/authorize/`` and ``https://idp.example.com/authorize`` are the same + identity, while query, fragment and a trailing slash are dropped.""" + return canonicalize_url_identity(url) + + +def _issuer_matches(claimed_issuer: object, configured_issuer: str) -> bool: + """RFC 8414 §3.3 issuer equality between the metadata document's self-attested ``issuer`` and the + admin-configured issuer, tolerant only of URL-insignificant differences (scheme/host case, the + default port, a trailing slash). A non-string or empty claimed issuer never matches, so a + document that omits ``issuer`` fails closed under issuer-anchored discovery. + """ + if not isinstance(claimed_issuer, str) or not claimed_issuer: + return False + return _normalized_authorize_endpoint(claimed_issuer) == _normalized_authorize_endpoint(configured_issuer) + + +def _flow_endpoints_missing( + auth_type: MCPAuthType | None, + oauth2_flow: str | None, + authorization_url: str | None, + token_url: str | None, + token_exchange_endpoint: str | None = None, +) -> bool: + """Whether a built server is missing an endpoint its flow needs to run at all. + + Used by the reload fast-path exemption: discovery runs at build time only, and the fast path + reuses an unchanged row's registry entry verbatim, so a server whose discovery came back empty + (transient upstream failure, rate limiting) would stay broken until some unrelated config write + bumps ``updated_at``, serving its 400 the whole time. Rebuilding just these entries retries + discovery on the normal reload cadence. It costs no extra fetch for servers that resolved, and + none for those with no discovery source, since the build skips discovery for both. + """ + if auth_type == MCPAuth.oauth2_token_exchange: + # A configured exchange endpoint replaces discovery entirely; only a server that must + # discover its token endpoint and still has none is unresolved. + return token_exchange_endpoint is None and token_url is None + if auth_type not in _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES: + return False + if oauth2_flow == "client_credentials": + return token_url is None + return authorization_url is None or token_url is None + + +def _oauth_endpoints_unresolved(server: MCPServer) -> bool: + """``_flow_endpoints_missing`` over a built registry entry, for the reload fast-path check. + + The flow comes from ``effective_oauth2_flow``, the one column-first, shape-fallback judge every + flow decision uses, not from the raw column: a legacy row the startup backfill deliberately left + unstamped (the ambiguous M2M shape) serves M2M at request time, and reading the bare column here + would classify it as interactive-missing-endpoints and re-run discovery on every reload. + """ + if ( + server.auth_type == MCPAuth.oauth2_token_exchange + and server.token_exchange_profile == "entra_obo" + and not server.scopes + ): + # entra_obo fails closed at exchange time without a scope (token_exchanger.py), and scopes + # can come from resource discovery, so a server that resolved its endpoints but no scopes is + # still unresolved for its flow. + return True + if server.is_dcr_bridge and not server.client_id and server.registration_url is None: + # A DCR bridge with no admin-configured client can only register callers through the + # upstream's registration endpoint, so a build that resolved the authorize and token + # endpoints but not registration_endpoint (partial metadata) is still unresolved for its + # flow and must keep retrying; without this it silently degrades to the short-circuit arm + # until an unrelated config write. Scopes are deliberately NOT part of completeness: they + # are a request hint the authorization server bounds at consent (RFC 6749 section 3.3), + # and a server without them is fully functional. + return True + return _flow_endpoints_missing( + server.auth_type, + MCPServerManager.effective_oauth2_flow(server), + server.authorization_url, + server.token_url, + server.token_exchange_endpoint, + ) + + +def _endpoints_corroborate_authorization_url( + source_authorization_url: str | None, + trusted_authorization_url: str | None, +) -> bool: + """Whether a source's ``token_url``/``registration_url`` may be paired with a trusted authorize + endpoint. This is the single trust rule for adopting OAuth endpoints from any non-manual source. + + Discovery is rooted at the MCP resource (RFC 9728), so a compromised upstream can advertise an + attacker-run authorization server. When ``authorization_url`` is admin-pinned, pairing it with a + ``token_url`` from a different source is the RFC 9700 authorization-server mix-up: the user signs + in at the trusted authorize endpoint while the gateway redeems the code, with the stored client + secret and PKCE verifier, at the attacker's token endpoint. Endpoints are trustworthy together + only when they share an authorization server, so a source's endpoints are adopted only when the + same source advertised an ``authorization_endpoint`` matching the pinned value. With no pinned + value (``trusted_authorization_url is None``) there is nothing to protect: the authorize endpoint + comes from the same source as the token endpoint, so they corroborate each other by construction. + """ + if not (trusted_authorization_url and trusted_authorization_url.strip()): + return True + return bool(source_authorization_url) and _normalized_authorize_endpoint( + source_authorization_url + ) == _normalized_authorize_endpoint(trusted_authorization_url) + + +def _carry_forward_resolved_oauth_endpoints(new_server: MCPServer, previous_server: MCPServer | None) -> None: + """Keep the last known good OAuth endpoints when a rebuild's re-discovery comes back empty. + + A rebuild wholesale-replaces the registry entry, so without this a transient upstream outage + during re-discovery downgrades a working server (``authorization_url`` set) to a broken one + (``None``, /authorize 400s) with no configuration change. Mirrors the ``short_prefix`` + carry-forward. Skipped when the server's ``url`` or ``auth_type`` changed, since the previous + endpoints may then belong to a different upstream. Discovery results live only on the in-memory + registry entry; the gateway never writes them to the row, whose OAuth columns carry admin intent + alone, so this carry is the sole last-known-good mechanism and restores exactly the values the + previous build already ran with. + + Carry-forward is a non-manual endpoint source, so the same trust rule as discovery applies: the + previous ``token_url``/``registration_url``/``scopes`` are carried only when the previous + ``authorization_url`` corroborates the authorize endpoint this build will use, i.e. when the + incoming build has no pinned authorize endpoint (``None`` -> we adopt the previous one too, a + consistent group) or pins the same one. An admin re-pointing ``authorization_url`` to a different + server must not keep serving the old server's token endpoint or granted scopes. + + When the server is issuer-anchored (``issuer_is_anchored`` -- a pinned issuer on a discovery auth + type), the endpoints come solely from the §3.3-validated issuer document, so carry-forward is + skipped entirely for its endpoints: a failed issuer fetch leaves them ``None`` and must stay + ``None`` (fail-closed), never resurrected from the previous registry entry. A merely discovered + (trust-on-first-use) issuer is NOT anchored -- ``issuer`` is set for token identity but the + endpoints are resource-rooted, so they still carry forward as last-known-good, gated by the + corroboration check below like any other resource-rooted server. Scopes stay resource-driven and + can carry either way. + """ + if previous_server is None: + return + if previous_server.url != new_server.url or previous_server.auth_type != new_server.auth_type: + return + if new_server.issuer_is_anchored: + # Endpoints come solely from the §3.3-validated issuer document; a failed fetch stays + # fail-closed and must not be resurrected from the previous entry. Only the resource-driven + # scopes carry as last-known-good. + if not new_server.scopes and previous_server.scopes: + new_server.scopes = previous_server.scopes + return + may_carry = _endpoints_corroborate_authorization_url( + previous_server.authorization_url, new_server.authorization_url + ) + if new_server.authorization_url is None and previous_server.authorization_url: + new_server.authorization_url = previous_server.authorization_url + if may_carry and new_server.token_url is None and previous_server.token_url: + new_server.token_url = previous_server.token_url + if may_carry and new_server.registration_url is None and previous_server.registration_url: + new_server.registration_url = previous_server.registration_url + if may_carry and not new_server.scopes and previous_server.scopes: + new_server.scopes = previous_server.scopes + + +def _restrict_discovery_to_corroborated_authorization_server( + metadata: MCPOAuthMetadata | None, + manual_authorization_url: str | None, + server_identifier: str, + is_dcr_bridge: bool, +) -> MCPOAuthMetadata | None: + """Reject discovered token/registration endpoints a manually pinned authorize endpoint cannot + vouch for (the RFC 9700 authorization-server mix-up). + + Discovery is rooted at the MCP resource, so a compromised upstream can advertise an attacker + ``token_endpoint``: with ``authorization_url`` admin-pinned but ``token_url`` blank, the merge + would pair the trusted authorize endpoint with that attacker token endpoint, and the gateway would + post the authorization code and client secret there. So the discovered ``token_url`` and + ``registration_url`` are kept only if the document corroborates the pin (its + ``authorization_endpoint`` matches). ``scopes`` are deliberately NOT gated here: per the MCP + authorization spec Scope Selection Strategy and RFC 9700 §2.3, the scopes a client requests are + resource-driven (the WWW-Authenticate challenge or the RFC 9728 protected-resource + ``scopes_supported``), and scope inflation by a compromised resource is bounded by the + authorization server and user consent (RFC 6749 §3.3), not by the client second-guessing the + request. With no pin there is no trust anchor to protect, so discovery is returned as-is. + """ + if metadata is None or not (manual_authorization_url and manual_authorization_url.strip()): + return metadata + if _endpoints_corroborate_authorization_url(metadata.authorization_url, manual_authorization_url): + return metadata + if not metadata.token_url and not metadata.registration_url: + return metadata + bridge_note = ( + " The discovered registration_url is rejected with it, so this dcr_bridge server stays on the" + " short-circuit registration arm." + if is_dcr_bridge and metadata.registration_url + else "" + ) + verbose_logger.warning( + "MCP OAuth discovery for server %s advertised authorization_endpoint %s, which does not match the " + "manually configured authorization_url %s; rejecting the discovered token_url/registration_url so " + "authorization codes and client credentials only follow the configured authorization server. " + "Configure Token URL manually if the mismatch is intentional.%s", + server_identifier, + _normalized_authorize_endpoint(metadata.authorization_url) if metadata.authorization_url else "", + _normalized_authorize_endpoint(manual_authorization_url), + bridge_note, + ) + return metadata.model_copy(update={"token_url": None, "registration_url": None}) + + +def _redacted_origin_list(urls: Sequence[str]) -> str: + return ", ".join(_redact_mcp_resource_url(url) or "" for url in urls) + + +def _sanitized_error_text(exc: Exception) -> str: + return re.sub(r"https?://\S+", "", str(exc))[:200] + + +def _discovery_failure_leaves_needs_unresolved( + *, + needs_authorization_url: bool, + needs_token_url: bool, + manual_authorization_url: str | None, + manual_token_url: str | None, +) -> bool: + return (needs_authorization_url and not manual_authorization_url) or (needs_token_url and not manual_token_url) + + +def _warn_oauth_endpoints_unresolved( + *, + server_ref: str, + server_url: str | None, + discovery_attempted: bool, + issuer_anchored: bool, + metadata: MCPOAuthMetadata | None, + needs_authorization_url: bool, + needs_token_url: bool, + manual_authorization_url: str | None, + manual_token_url: str | None, +) -> None: + """Log one actionable warning when a server that depends on OAuth endpoint discovery finishes a + build without the endpoints that its flows need (LIT-4658). + + This is the operator-facing signal for a misconfigured server url: discovery failures themselves + are logged where they happen (``_descovery_metadata``), and this names WHICH server is affected, + which endpoints stayed unresolved after manual configuration was considered, and the remedies. + Scopes never trigger the warning on their own: scope-less metadata is normal for many servers and + warning on it every rebuild would be noise. Callers own the per-flow policy of which endpoints + are needed (client_credentials never needs authorization_url; OBO needs only token_url); the + issuer-anchored arm is excluded here because it has its own RFC 8414 §3.3 warning. + """ + if issuer_anchored: + return + unresolved = tuple( + field + for field, needed, value in ( + ( + "authorization_url", + needs_authorization_url, + manual_authorization_url or (metadata.authorization_url if metadata else None), + ), + ( + "token_url", + needs_token_url, + manual_token_url or (metadata.token_url if metadata else None), + ), + ) + if needed and not value + ) + if not unresolved: + return + if discovery_attempted: + verbose_logger.warning( + "MCP server %s: OAuth endpoint discovery left %s unresolved (server url origin: %s). OAuth flows " + "that need them will fail with 'not configured' errors until they resolve. Check the preceding " + "'MCP OAuth' log lines for why discovery failed, verify the configured server url, or set the " + "unresolved endpoint urls manually, or set issuer to discover them from the identity provider " + "(RFC 8414)", + server_ref, + ", ".join(unresolved), + _redact_mcp_resource_url(server_url) or "", + ) + return + verbose_logger.warning( + "MCP server %s uses OAuth but has no discovery source (no server url or pinned issuer), and %s not " + "set manually. Set the missing endpoint urls on the server, or set issuer to discover them from the " + "identity provider (RFC 8414)", + server_ref, + " and ".join(unresolved) + (" is" if len(unresolved) == 1 else " are"), + ) + def invalidate_user_env_vars_cache(user_id: str, server_id: str) -> None: """Drop a cached entry after the user stores or clears their env var values @@ -388,6 +790,34 @@ def _passthrough_token_from_mcp_auth_header( return None +async def _materialize_auth_headers(auth: httpx.Auth | None) -> dict[str, str] | None: + """Extract the header a resolved ``httpx.Auth`` would set, as a plain dict, or None. + + OpenAPI tool closures egress through ``AsyncHTTPHandler`` methods that accept headers but no + ``auth``, so a resolved credential must be materialized into a header value. Driving one step + of the auth's own flow (against a throwaway request that is never sent) keeps this generic + across every auth shape without per-class branching; ``header_name`` is the resolver-arm + convention for "this auth sets a header" (``NoOpAuth`` has none and yields nothing to apply). + The materialized value is point-in-time: flow behaviors past the first request, like the M2M + one-shot 401 refetch, do not apply on this arm. + """ + if auth is None: + return None + header_name = getattr(auth, "header_name", None) + if not isinstance(header_name, str) or not header_name: + return None + probe = httpx.Request("GET", "http://localhost/") + flow = auth.async_auth_flow(probe) + try: + first_request = await flow.__anext__() + except StopAsyncIteration: + return None + finally: + await flow.aclose() + header_value = first_request.headers.get(header_name) + return {header_name: header_value} if header_value else None + + def _consumes_caller_authorization(server: MCPServer) -> bool: """True when this server's egress forwards the caller's request-wide ``Authorization`` upstream: the client-forwarded token modes, legacy OAuth pass-through, and legacy upstream-delegated @@ -402,6 +832,47 @@ def _consumes_caller_authorization(server: MCPServer) -> bool: ) +_REGISTRY_DUMP_SECRET_FIELDS = frozenset( + {"authentication_token", "client_secret", "client_private_key", "aws_secret_access_key", "aws_session_token"} +) + + +def _redacted_registry_dump(servers: dict[str, MCPServer]) -> dict[str, dict[str, str]]: + """A JSON-safe view of the server registry with credential fields masked, for debug logging. + + The registry holds long-lived secrets as plain strings (the static token, OAuth client secret, + the ID-JAG signing key, AWS keys); dumping them verbatim hands the gateway's client identity to + anyone who can read debug logs. + """ + dumps: dict[str, dict[str, object]] = {server_id: server.model_dump() for server_id, server in servers.items()} + return { + server_id: { + field: ("**REDACTED**" if field in _REGISTRY_DUMP_SECRET_FIELDS and value is not None else str(value)) + for field, value in dump.items() + } + for server_id, dump in dumps.items() + } + + +def _to_server_spec_fail_closed(server: MCPServer) -> Optional[ServerSpec]: + """`to_server_spec`, except a half-configured `oauth2_id_jag` server refuses instead of deferring. + + ID-JAG has no v1 arm, so deferring to v1 would let `resolve_mcp_auth` honor a caller x-mcp-* + override or fall through to the static `authentication_token`, both of which bypass the per-user + identity assertion the mode promises. That is an operator misconfiguration, not a fallback. + """ + spec = to_server_spec(server) + if spec is None and server.auth_type == MCPAuth.oauth2_id_jag: + raise_public( + CredError.of_misconfigured( + "oauth2_id_jag requires token_exchange_endpoint, id_jag_resource_token_endpoint, " + "client_id, and a client_secret or client_private_key; refusing to fall back to " + "a static credential." + ) + ) + return spec + + def _caller_authorization_fans_out( server: MCPServer, scope_servers: Optional[list[MCPServer]], @@ -422,49 +893,14 @@ def _caller_authorization_fans_out( def _extract_upstream_auth_failure( exc: BaseException, ) -> Optional[tuple[int, Optional[str]]]: - """Walk the exception tree looking for an HTTP 401/403 response from the - upstream MCP server. + """The upstream 401/403 and its ``WWW-Authenticate`` header from the exception tree, or ``None``. - The MCP SDK wraps transport errors in anyio ``ExceptionGroup`` objects and - may chain through ``__cause__`` / ``__context__``. We inspect all of those - layers for an ``httpx.Response``-bearing exception (typically - ``httpx.HTTPStatusError``) and extract the status code and any upstream - ``WWW-Authenticate`` header. - - Returns ``(status_code, www_authenticate)`` on match, else ``None``. - """ - seen: set[int] = set() - stack: list[BaseException] = [exc] - while stack: - current = stack.pop() - if id(current) in seen: - continue - seen.add(id(current)) - - response = getattr(current, "response", None) - if response is not None: - status_code = getattr(response, "status_code", None) - if isinstance(status_code, int) and status_code in (401, 403): - www_authenticate: Optional[str] = None - headers = getattr(response, "headers", None) - if headers is not None: - try: - www_authenticate = headers.get("www-authenticate") - except Exception: - www_authenticate = None - return status_code, www_authenticate - - # anyio / PEP 654 ExceptionGroup - sub_exceptions = getattr(current, "exceptions", None) - if sub_exceptions: - stack.extend(sub_exceptions) - - if current.__cause__ is not None: - stack.append(current.__cause__) - if current.__context__ is not None and current.__context__ is not current.__cause__: - stack.append(current.__context__) - - return None + Delegates to the shared traversal in ``faults`` so every consumer (tool listing, + tool calls, the connect-time probe) selects the same response with the same deliberate order: + explicit ``raise ... from`` causes first, ExceptionGroup members in raise order, the incidental + ``__context__`` chain last. A response raised while handling the real failure can therefore never + shadow the causal one.""" + return upstream_auth_challenge(exc) def _warn_on_server_name_fields( @@ -614,10 +1050,10 @@ def _create_sampling_callback(user_api_key_auth: Optional[Any] = None): return None async def _sampling_callback(context, params): + import litellm from litellm.proxy._experimental.mcp_server.sampling_handler import ( handle_sampling_create_message, ) - import litellm from litellm.proxy._experimental.mcp_server.server import ( get_active_auth_context, ) @@ -789,10 +1225,12 @@ class MCPServerManager: self, cred_provider: Optional[UpstreamCredentialProvider] = None, per_user_oauth_token_store: Optional[InvalidatableOAuthTokenStore] = None, + per_user_token_cache: Optional[MCPPerUserTokenCache] = None, ): self._per_user_oauth_token_store = per_user_oauth_token_store or LazyPerUserOAuthTokenStore( self.get_mcp_server_by_id ) + self._per_user_token_cache = per_user_token_cache or mcp_per_user_token_cache self._cred_provider = cred_provider or UpstreamCredentialProvider( oauth_token_store=self._per_user_oauth_token_store, token_exchanger=build_token_exchanger(), @@ -833,6 +1271,40 @@ class MCPServerManager: # empty result, or failure). Used to throttle re-probes for servers that do # not return instructions, and to apply a short cooldown after failures. self._upstream_initialize_instructions_probed_at: dict[str, float] = {} + # Per-server (consecutive failures, monotonic timestamp) for OAuth discovery retries, so a + # server whose endpoints never resolve backs off instead of re-running the full + # RFC 9728 -> 8414 chain, and re-logging its warning, on every reload forever. + self._oauth_discovery_retry_state: dict[ + str, tuple[int, float] + ] = {} # mutable-ok: retry cooldown cache, keyed per server and pruned on success + + def _oauth_discovery_retry_due(self, server_id: str) -> bool: + """Whether an unresolved server is due for another discovery attempt. + + The reload fast-path exemption is what retries a failed discovery, so without a cooldown a + permanently unresolvable server re-runs the whole RFC 9728 -> RFC 8414 -> origin-fallback + chain and re-emits its unresolved-endpoints warning on every reload, per server, forever. + Delay doubles per consecutive failure from ``_OAUTH_DISCOVERY_RETRY_BASE_SECONDS`` up to + ``_OAUTH_DISCOVERY_RETRY_MAX_SECONDS``, so a transient outage still recovers on the next + reload while a broken configuration settles to one attempt per cap. + """ + state = self._oauth_discovery_retry_state.get(server_id) + if state is None: + return True + failures, attempted_at = state + delay = min( + _OAUTH_DISCOVERY_RETRY_BASE_SECONDS * (2 ** max(failures - 1, 0)), + _OAUTH_DISCOVERY_RETRY_MAX_SECONDS, + ) + return (time.monotonic() - attempted_at) >= delay + + def _record_oauth_discovery_outcome(self, server: MCPServer) -> None: + """Advance or clear a server's retry cooldown after a rebuild resolved it or did not.""" + if not _oauth_endpoints_unresolved(server): + self._oauth_discovery_retry_state.pop(server.server_id, None) + return + failures, _ = self._oauth_discovery_retry_state.get(server.server_id, (0, 0.0)) + self._oauth_discovery_retry_state[server.server_id] = (failures + 1, time.monotonic()) def _remember_upstream_initialize_instructions(self, server: MCPServer, client: MCPClient) -> None: raw = getattr(client, "_last_initialize_instructions", None) @@ -914,6 +1386,14 @@ class MCPServerManager: """ return self.config_mcp_servers | self.registry + def is_config_declared_server(self, server_id: str) -> bool: + """True when server_id was declared in config.yaml (present in the in-memory config map). + Config servers are rowless and persistent, so their DCR client belongs in the server-scoped + store; a rowless server that is NOT config-declared is a throwaway temp/session server whose + client must not be persisted. This never overrides the row-existence check: a server that has + a LiteLLM_MCPServerTable row is always resolved to that row first.""" + return server_id in self.config_mcp_servers + async def load_servers_from_config( self, mcp_servers_config: dict[str, Any], @@ -983,38 +1463,80 @@ class MCPServerManager: ) auth_type = server_config.get("auth_type", None) - if server_url and ( - auth_type == MCPAuth.oauth2 - or self._obo_needs_endpoint_discovery( - auth_type, - server_config.get("token_exchange_endpoint"), - server_config.get("token_url"), - ) - ): + manual_issuer = _blank_to_none(server_config.get("issuer")) + manual_authorization_url = _blank_to_none(server_config.get("authorization_url")) + manual_token_url = _blank_to_none(server_config.get("token_url")) + manual_registration_url = _blank_to_none(server_config.get("registration_url")) + is_discovery_auth_type = auth_type in _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES + obo_needs_discovery = self._obo_needs_endpoint_discovery( + auth_type, + server_config.get("token_exchange_endpoint"), + manual_token_url, + ) + use_issuer_anchor = _uses_issuer_anchor(manual_issuer, is_discovery_auth_type or obo_needs_discovery) + manual_authorization_url, manual_token_url, manual_registration_url = _endpoints_yield_to_issuer( + manual_issuer, + is_discovery_auth_type, + manual_authorization_url, + manual_token_url, + manual_registration_url, + server_name or server_id, + ) + should_discover = _has_oauth_discovery_source(server_url, use_issuer_anchor) and ( + is_discovery_auth_type or obo_needs_discovery + ) + config_oauth2_flow = server_config.get("oauth2_flow", None) + needs_authorization_url = is_discovery_auth_type and config_oauth2_flow != "client_credentials" + needs_token_url = is_discovery_auth_type or obo_needs_discovery + warn_on_empty_discovery = _discovery_failure_leaves_needs_unresolved( + needs_authorization_url=needs_authorization_url, + needs_token_url=needs_token_url, + manual_authorization_url=manual_authorization_url, + manual_token_url=manual_token_url, + ) + if not should_discover: + mcp_oauth_metadata = None + elif use_issuer_anchor and manual_issuer is not None: + mcp_oauth_metadata = await self._fetch_issuer_anchored_oauth_metadata(manual_issuer, server_url) + else: mcp_oauth_metadata = await self._descovery_metadata( server_url=server_url, - allow_origin_fallback=auth_type == MCPAuth.oauth2, + allow_origin_fallback=is_discovery_auth_type, + warn_when_no_metadata=warn_on_empty_discovery, + ) + + if use_issuer_anchor: + gated_oauth_metadata = mcp_oauth_metadata + elif is_discovery_auth_type: + gated_oauth_metadata = _restrict_discovery_to_corroborated_authorization_server( + mcp_oauth_metadata, + manual_authorization_url, + server_name or server_id, + bool(server_config.get("dcr_bridge")), ) else: - mcp_oauth_metadata = None + gated_oauth_metadata = mcp_oauth_metadata # Filter blank scopes (e.g. YAML ``scopes: [""]``) the same way the DB-build path does, so # an all-blank list normalizes to None rather than a ``("",)`` tuple that skips the # entra_obo fail-closed scope precondition and POSTs an empty scope to the IdP. resolved_scopes = self._extract_scopes(server_config.get("scopes")) or ( - mcp_oauth_metadata.scopes if mcp_oauth_metadata else None + gated_oauth_metadata.scopes if gated_oauth_metadata else None ) - resolved_authorization_url = server_config.get("authorization_url") or ( - mcp_oauth_metadata.authorization_url if mcp_oauth_metadata else None + resolved_authorization_url = manual_authorization_url or ( + gated_oauth_metadata.authorization_url if gated_oauth_metadata else None ) - resolved_token_url = server_config.get("token_url") or ( - mcp_oauth_metadata.token_url if mcp_oauth_metadata else None + resolved_token_url = manual_token_url or (gated_oauth_metadata.token_url if gated_oauth_metadata else None) + resolved_registration_url = manual_registration_url or ( + gated_oauth_metadata.registration_url if gated_oauth_metadata else None ) - resolved_registration_url = server_config.get("registration_url") or ( - mcp_oauth_metadata.registration_url if mcp_oauth_metadata else None + discovered_issuer = ( + gated_oauth_metadata.discovered_issuer + if gated_oauth_metadata and not gated_oauth_metadata.from_origin_fallback + else None ) + effective_issuer = manual_issuer or discovered_issuer - config_oauth2_flow = server_config.get("oauth2_flow", None) if auth_type == MCPAuth.oauth2 and config_oauth2_flow not in ( "client_credentials", "authorization_code", @@ -1028,6 +1550,36 @@ class MCPServerManager: "browser sign-in, including delegate_auth_to_upstream)." ) + config_dcr_bridge = server_config.get("dcr_bridge", None) + if config_dcr_bridge is not None and not isinstance(config_dcr_bridge, bool): + raise ValueError( + f"Invalid config for MCP server '{server_name or server_id}': dcr_bridge " + f"must be a boolean (got {config_dcr_bridge!r})." + ) + if config_dcr_bridge and auth_type not in ( + MCPAuth.true_passthrough, + MCPAuth.oauth_delegate, + ): + raise ValueError( + f"Invalid config for MCP server '{server_name or server_id}': dcr_bridge is only " + f"supported for auth_type true_passthrough or oauth_delegate (got {auth_type!r}). " + "The DCR bridge serves gateway-hosted OAuth discovery for the client-forwarded " + "token modes; interactive oauth2 servers already run the gateway " + "authorization-code flow." + ) + + _warn_oauth_endpoints_unresolved( + server_ref=server_name or server_id, + server_url=server_url, + discovery_attempted=should_discover, + issuer_anchored=use_issuer_anchor, + metadata=gated_oauth_metadata, + needs_authorization_url=needs_authorization_url, + needs_token_url=needs_token_url, + manual_authorization_url=manual_authorization_url, + manual_token_url=manual_token_url, + ) + new_server = MCPServer( server_id=server_id, name=name_for_prefix, @@ -1043,6 +1595,8 @@ class MCPServerManager: client_secret=server_config.get("client_secret", None), oauth2_flow=self._explicit_oauth2_flow(config_oauth2_flow), scopes=resolved_scopes, + issuer=effective_issuer, + issuer_is_anchored=use_issuer_anchor, authorization_url=resolved_authorization_url, token_url=resolved_token_url, registration_url=resolved_registration_url, @@ -1063,6 +1617,7 @@ class MCPServerManager: available_on_public_internet=bool(server_config.get("available_on_public_internet", True)), delegate_auth_to_upstream=bool(server_config.get("delegate_auth_to_upstream", False)), oauth_passthrough=bool(server_config.get("oauth_passthrough", False)), + dcr_bridge=config_dcr_bridge, # AWS SigV4 fields aws_access_key_id=server_config.get("aws_access_key_id", None), aws_secret_access_key=server_config.get("aws_secret_access_key", None), @@ -1079,6 +1634,13 @@ class MCPServerManager: "subject_token_type", DEFAULT_SUBJECT_TOKEN_TYPE, ), + upstream_resource=server_config.get("upstream_resource", None), + # ID-JAG fields + id_jag_resource_token_endpoint=server_config.get("id_jag_resource_token_endpoint", None), + id_jag_resource=server_config.get("id_jag_resource", None), + client_private_key=server_config.get("client_private_key", None), + client_private_key_id=server_config.get("client_private_key_id", None), + client_assertion_signing_alg=server_config.get("client_assertion_signing_alg", "RS256"), token_exchange_profile=server_config.get("token_exchange_profile", "rfc8693"), allow_sampling=bool(server_config.get("allow_sampling", False)), allow_elicitation=bool(server_config.get("allow_elicitation", False)), @@ -1099,10 +1661,36 @@ class MCPServerManager: base_url=server_config.get("url", ""), ) - verbose_logger.debug(f"Loaded MCP Servers: {json.dumps(self.config_mcp_servers, indent=4, default=str)}") + verbose_logger.debug( + f"Loaded MCP Servers: {json.dumps(_redacted_registry_dump(self.config_mcp_servers), indent=4)}" + ) + + await self._hydrate_config_servers_dcr_clients() self.initialize_tool_name_to_mcp_server_name_mapping() + async def _hydrate_config_servers_dcr_clients(self) -> None: + """Overlay each config-declared server's persisted DCR client (from the server-scoped + store) onto its in-memory object so token refresh authenticates after a restart. A + best-effort no-op when the DB is unreachable at config-load time.""" + from litellm.proxy._experimental.mcp_server.discoverable_endpoints import ( # noqa: PLC0415 # circular import + hydrate_config_server_dcr_client, + ) + + for server in self.config_mcp_servers.values(): + try: + if await hydrate_config_server_dcr_client(server): + verbose_logger.debug( + "hydrated persisted DCR client onto config MCP server server_id=%s", + server.server_id, + ) + except Exception as exc: # noqa: BLE001 # best-effort hydration; never fail config load + verbose_logger.debug( + "load_servers_from_config: failed to hydrate DCR client for server_id=%s: %s", + server.server_id, + exc, + ) + async def _register_openapi_tools(self, spec_path: str, server: MCPServer, base_url: str): """ Register tools from an OpenAPI specification for a given server. @@ -1120,14 +1708,12 @@ class MCPServerManager: from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import ( build_input_schema, create_tool_function, + load_openapi_spec_async, + resolve_operation_params, ) from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import ( get_base_url as get_openapi_base_url, ) - from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import ( - load_openapi_spec_async, - resolve_operation_params, - ) from litellm.proxy._experimental.mcp_server.tool_registry import ( global_mcp_tool_registry, ) @@ -1302,6 +1888,70 @@ class MCPServerManager: decrypt_global_env_var_values(env_vars_list) return env_vars_list + async def _resolve_table_oauth_metadata( + self, + *, + mcp_server: LiteLLM_MCPServerTable, + auth_type: MCPAuthType, + server_url: Optional[str], + manual_issuer: Optional[str], + manual_authorization_url: Optional[str], + manual_token_url: Optional[str], + is_discovery_auth_type: bool, + use_issuer_anchor: bool, + scopes: Optional[list[str]], + token_exchange_endpoint: Optional[str], + ) -> Optional[MCPOAuthMetadata]: + obo_needs_discovery = self._obo_needs_endpoint_discovery(auth_type, token_exchange_endpoint, manual_token_url) + needs_authorization_url = ( + is_discovery_auth_type and getattr(mcp_server, "oauth2_flow", None) != "client_credentials" + ) + needs_token_url = is_discovery_auth_type or obo_needs_discovery + warn_on_empty_discovery = _discovery_failure_leaves_needs_unresolved( + needs_authorization_url=needs_authorization_url, + needs_token_url=needs_token_url, + manual_authorization_url=manual_authorization_url, + manual_token_url=manual_token_url, + ) + has_all_upstream_oauth_fields = bool(manual_authorization_url and manual_token_url and scopes) + needs_discovery = _has_oauth_discovery_source(server_url, use_issuer_anchor) and ( + (is_discovery_auth_type and not has_all_upstream_oauth_fields) or obo_needs_discovery + ) + if not needs_discovery: + mcp_oauth_metadata: Optional[MCPOAuthMetadata] = None + elif use_issuer_anchor and manual_issuer is not None: + mcp_oauth_metadata = await self._fetch_issuer_anchored_oauth_metadata(manual_issuer, server_url) + else: + mcp_oauth_metadata = await self._descovery_metadata( + server_url=server_url, # type: ignore[arg-type] + allow_origin_fallback=is_discovery_auth_type, + warn_when_no_metadata=warn_on_empty_discovery, + ) + if use_issuer_anchor: + return mcp_oauth_metadata + gated_metadata = ( + _restrict_discovery_to_corroborated_authorization_server( + mcp_oauth_metadata, + manual_authorization_url, + mcp_server.server_id, + bool(getattr(mcp_server, "dcr_bridge", None)), + ) + if is_discovery_auth_type + else mcp_oauth_metadata + ) + _warn_oauth_endpoints_unresolved( + server_ref=mcp_server.alias or mcp_server.server_name or mcp_server.server_id, + server_url=server_url, + discovery_attempted=needs_discovery, + issuer_anchored=False, + metadata=gated_metadata, + needs_authorization_url=needs_authorization_url, + needs_token_url=needs_token_url, + manual_authorization_url=manual_authorization_url, + manual_token_url=manual_token_url, + ) + return gated_metadata + async def build_mcp_server_from_table( self, mcp_server: LiteLLM_MCPServerTable, @@ -1384,25 +2034,47 @@ class MCPServerManager: auth_type = cast(MCPAuthType, mcp_server.auth_type) server_url = mcp_server.url - needs_discovery = bool(server_url) and ( - (auth_type == MCPAuth.oauth2 and not mcp_server.authorization_url) - or self._obo_needs_endpoint_discovery( - auth_type, - mcp_server.token_exchange_endpoint - or (credentials_dict.get("token_exchange_endpoint") if credentials_dict else None), - mcp_server.token_url, - ) + manual_issuer = _blank_to_none(mcp_server.issuer) + manual_authorization_url = _blank_to_none(mcp_server.authorization_url) + manual_token_url = _blank_to_none(mcp_server.token_url) + manual_registration_url = _blank_to_none(mcp_server.registration_url) + is_discovery_auth_type = auth_type in _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES + token_exchange_endpoint = mcp_server.token_exchange_endpoint or ( + credentials_dict.get("token_exchange_endpoint") if credentials_dict else None ) - mcp_oauth_metadata = ( - await self._descovery_metadata( - server_url=server_url, # type: ignore[arg-type] - allow_origin_fallback=auth_type == MCPAuth.oauth2, - ) - if needs_discovery - else None + use_issuer_anchor = _uses_issuer_anchor( + manual_issuer, + is_discovery_auth_type + or self._obo_needs_endpoint_discovery(auth_type, token_exchange_endpoint, manual_token_url), + ) + manual_authorization_url, manual_token_url, manual_registration_url = _endpoints_yield_to_issuer( + manual_issuer, + is_discovery_auth_type, + manual_authorization_url, + manual_token_url, + manual_registration_url, + mcp_server.alias or mcp_server.server_name or mcp_server.server_id, + ) + gated_oauth_metadata = await self._resolve_table_oauth_metadata( + mcp_server=mcp_server, + auth_type=auth_type, + server_url=server_url, + manual_issuer=manual_issuer, + manual_authorization_url=manual_authorization_url, + manual_token_url=manual_token_url, + is_discovery_auth_type=is_discovery_auth_type, + use_issuer_anchor=use_issuer_anchor, + scopes=scopes, + token_exchange_endpoint=token_exchange_endpoint, ) - resolved_scopes = scopes or (mcp_oauth_metadata.scopes if mcp_oauth_metadata else None) + resolved_scopes = scopes or (gated_oauth_metadata.scopes if gated_oauth_metadata else None) + discovered_issuer = ( + gated_oauth_metadata.discovered_issuer + if gated_oauth_metadata and not gated_oauth_metadata.from_origin_fallback + else None + ) + effective_issuer = manual_issuer or discovered_issuer new_server = MCPServer( server_id=mcp_server.server_id, @@ -1422,9 +2094,11 @@ class MCPServerManager: client_secret=client_secret_value or getattr(mcp_server, "client_secret", None), oauth2_flow=self._explicit_oauth2_flow(getattr(mcp_server, "oauth2_flow", None)), scopes=resolved_scopes, - authorization_url=mcp_server.authorization_url or getattr(mcp_oauth_metadata, "authorization_url", None), - token_url=mcp_server.token_url or getattr(mcp_oauth_metadata, "token_url", None), - registration_url=mcp_server.registration_url or getattr(mcp_oauth_metadata, "registration_url", None), + issuer=effective_issuer, + issuer_is_anchored=use_issuer_anchor, + authorization_url=manual_authorization_url or getattr(gated_oauth_metadata, "authorization_url", None), + token_url=manual_token_url or getattr(gated_oauth_metadata, "token_url", None), + registration_url=manual_registration_url or getattr(gated_oauth_metadata, "registration_url", None), token_endpoint_auth_method=( credentials_dict.get("token_endpoint_auth_method") if credentials_dict else None ), @@ -1438,6 +2112,7 @@ class MCPServerManager: available_on_public_internet=bool(getattr(mcp_server, "available_on_public_internet", True)), delegate_auth_to_upstream=bool(getattr(mcp_server, "delegate_auth_to_upstream", False)), oauth_passthrough=bool(getattr(mcp_server, "oauth_passthrough", False)), + dcr_bridge=getattr(mcp_server, "dcr_bridge", None), created_at=getattr(mcp_server, "created_at", None), updated_at=getattr(mcp_server, "updated_at", None), tool_name_to_display_name=_deserialize_json_dict(getattr(mcp_server, "tool_name_to_display_name", None)), @@ -1463,6 +2138,22 @@ class MCPServerManager: subject_token_type=mcp_server.subject_token_type or (credentials_dict.get("subject_token_type") if credentials_dict else None) or DEFAULT_SUBJECT_TOKEN_TYPE, + upstream_resource=(credentials_dict.get("upstream_resource") if credentials_dict else None), + # ID-JAG fields — read from credentials JSON blob + id_jag_resource_token_endpoint=( + credentials_dict.get("id_jag_resource_token_endpoint") if credentials_dict else None + ), + id_jag_resource=(credentials_dict.get("id_jag_resource") if credentials_dict else None), + client_private_key=self._decrypt_credential_field( + credentials_dict.get("client_private_key") if credentials_dict else None, + "client_private_key", + credentials_are_encrypted, + ), + client_private_key_id=(credentials_dict.get("client_private_key_id") if credentials_dict else None), + client_assertion_signing_alg=( + credentials_dict.get("client_assertion_signing_alg") if credentials_dict else None + ) + or "RS256", token_exchange_profile=mcp_server.token_exchange_profile or (credentials_dict.get("token_exchange_profile") if credentials_dict else None) or "rfc8693", @@ -1470,49 +2161,8 @@ class MCPServerManager: max_concurrent_requests=getattr(mcp_server, "max_concurrent_requests", None), ) _warn_internal_delegate_pkce_if_applicable(new_server, source="database") - await self._persist_discovered_obo_token_url( - server_id=mcp_server.server_id, - auth_type=auth_type, - existing_token_url=mcp_server.token_url, - discovered_token_url=new_server.token_url, - ) return new_server - async def _persist_discovered_obo_token_url( - self, - *, - server_id: str, - auth_type: Optional[MCPAuthType], - existing_token_url: Optional[str], - discovered_token_url: Optional[str], - ) -> None: - """Write a freshly discovered OBO token endpoint back onto the DB row. - - ``build_mcp_server_from_table`` resolves ``token_url`` via RFC 9728 -> RFC 8414 for an - ``oauth2_token_exchange`` server that has none configured, but that resolved value otherwise - lives only on the returned in-memory object; the row keeps ``token_url=None`` so every rebuild - re-runs discovery, and a transient upstream outage during a rebuild leaves the server with no - endpoint until discovery next succeeds. Persisting it makes ``_obo_needs_endpoint_discovery`` - return False on the next build. Fires at most once per server (skipped once the row has a - value), and is best-effort: a write failure just means discovery runs again next time. - """ - if auth_type != MCPAuth.oauth2_token_exchange: - return - if existing_token_url or not discovered_token_url: - return - from litellm.proxy.proxy_server import prisma_client # noqa: PLC0415 - - if prisma_client is None: - return - try: - await MCPServerRepository(prisma_client).table.update( - where={"server_id": server_id}, - data={"token_url": discovered_token_url}, - ) - verbose_logger.debug("Persisted discovered OBO token_url for MCP server %s", server_id) - except Exception as exc: # noqa: BLE001 - best-effort; a failed write re-discovers next build - verbose_logger.warning("Failed to persist discovered OBO token_url for MCP server %s: %s", server_id, exc) - async def _maybe_register_openapi_tools(self, server: MCPServer, *, initialize_mapping: bool = True): """Register OpenAPI tools if the server has a spec_path configured.""" if server.spec_path: @@ -1571,6 +2221,10 @@ class MCPServerManager: existing_prefix = self.registry[mcp_server.server_id].short_prefix if existing_prefix and not new_server.short_prefix: new_server.short_prefix = existing_prefix + _carry_forward_resolved_oauth_endpoints( + new_server=new_server, + previous_server=self.registry[mcp_server.server_id], + ) self._assign_unique_short_prefix(new_server) self.registry[mcp_server.server_id] = new_server await self._maybe_register_openapi_tools(new_server) @@ -1652,6 +2306,56 @@ class MCPServerManager: return [server_id for server_id in submitted_server_ids if self.get_mcp_server_by_id(server_id) is not None] + async def operator_open_server_ids( + self, + user_api_key_auth: UserAPIKeyAuth | None = None, + *, + allow_all_server_ids: list[str] | None = None, + submitted_server_ids: list[str] | None = None, + ) -> set: + """Servers reachable through OPEN channels rather than a grant: operator-opened + ``allow_all_keys`` servers, plus the caller's own active BYOM submissions when the caller + carries no explicit ``mcp_servers`` scope. + + The single owner of that question for BOTH axes. The server union in + ``get_allowed_mcp_servers`` adds these ids, and the admitted subject's tool resolution asks + the same question to treat an open-channel server as default-open for tools — exactly how a + virtual key experiences it. Encoding the channel membership twice is how a server ends up + listable but uninvokable. + + Empty inside a toolset scope: toolset_mcp_route / dynamic_mcp_route set + ``_mcp_active_toolset_id`` before calling the handler, pinning the request to the toolset's + own servers (checking op.mcp_toolsets==[] instead would false-positive on DB-default rows + where Postgres initialises the column to ARRAY[]::TEXT[]). + + ``allow_all_server_ids`` / ``submitted_server_ids`` are injectable so the server union, + which precomputes both for its fallback path, does not compute them twice.""" + from litellm.proxy._experimental.mcp_server.mcp_context import ( # noqa: PLC0415 + _mcp_active_toolset_id, + ) + + if _mcp_active_toolset_id.get() is not None: + return set() + if allow_all_server_ids is None: + allow_all_server_ids = self.get_allow_all_keys_server_ids() + open_ids = set(allow_all_server_ids) + key_object_permission = user_api_key_auth.object_permission if user_api_key_auth else None + # "Explicitly scoped, so do not widen with BYOM" is a rule about a CREDENTIAL that carries + # its own mcp_servers list. It does not describe a keyless admitted subject: its + # object_permission is the user's own row, whose mcp_servers column is [] by DB default, so + # applying this rule would hide almost every admitted user's OWN submitted servers. Their + # submissions are theirs by authorship, and their scope comes from the per-source union. + has_explicit_object_permission = ( + not _is_mcp_admitted_user_subject(user_api_key_auth) + and key_object_permission is not None + and (key_object_permission.mcp_servers is not None) + ) + if not has_explicit_object_permission: + if submitted_server_ids is None: + submitted_server_ids = await self._get_active_submitted_mcp_server_ids_for_user(user_api_key_auth) + open_ids.update(submitted_server_ids) + return open_ids + async def get_allowed_mcp_servers(self, user_api_key_auth: Optional[UserAPIKeyAuth] = None) -> list[str]: """ Get the allowed MCP Servers for the user. @@ -1665,11 +2369,22 @@ class MCPServerManager: allow_all_server_ids = self.get_allow_all_keys_server_ids() + # A keyless admitted subject is resolved per grant source, and channel decisions that are + # absolute for a scoped KEY credential are not absolute for it: its own opt-out silences its + # own source (handled per source in the resolver), never its teams' grants, and its admin + # role does not swallow the grant model — a session bearer is a third-party client + # credential, not the dashboard, so an admin signing in through the connect flow gets their + # grants like anyone else rather than handing the client the full registry ahead of every + # per-team org ceiling. + is_admitted_subject = _is_mcp_admitted_user_subject(user_api_key_auth) + # The key explicitly opted out of every MCP server. Return zero before # layering on allow_all_keys or submitted servers so the opt-out is absolute. key_object_permission = user_api_key_auth.object_permission if user_api_key_auth else None - if key_object_permission is not None and ( - SpecialMCPServerNames.no_mcp_servers.value in (key_object_permission.mcp_servers or []) + if ( + not is_admitted_subject + and key_object_permission is not None + and (SpecialMCPServerNames.no_mcp_servers.value in (key_object_permission.mcp_servers or [])) ): return [] @@ -1689,8 +2404,14 @@ class MCPServerManager: ) try: - # If admin but NO explicit object permission, get all servers - if user_api_key_auth and _user_has_admin_view(user_api_key_auth) and not has_explicit_object_permission: + # If admin but NO explicit object permission, get all servers (never for an admitted + # subject — see is_admitted_subject above) + if ( + user_api_key_auth + and not is_admitted_subject + and _user_has_admin_view(user_api_key_auth) + and not has_explicit_object_permission + ): verbose_logger.debug("Admin user without explicit object_permission - returning all servers") return list(self.get_registry().keys()) @@ -1698,20 +2419,14 @@ class MCPServerManager: allowed_mcp_servers = await MCPRequestHandler.get_allowed_mcp_servers(user_api_key_auth) verbose_logger.debug(f"Allowed MCP Servers for user api key auth: {allowed_mcp_servers}") combined_servers = set(allowed_mcp_servers) - # Only skip allow_all_keys servers when the request is inside a toolset - # scope. toolset_mcp_route / dynamic_mcp_route set _mcp_active_toolset_id - # before calling the handler — that ContextVar is the reliable signal. - # Using op.mcp_toolsets==[] would false-positive on DB-default rows where - # Postgres initialises the column to ARRAY[]::TEXT[]. - from litellm.proxy._experimental.mcp_server.mcp_context import ( # noqa: PLC0415 - _mcp_active_toolset_id, + combined_servers.update( + await self.operator_open_server_ids( + user_api_key_auth, + allow_all_server_ids=allow_all_server_ids, + submitted_server_ids=submitted_server_ids, + ) ) - in_toolset_scope = _mcp_active_toolset_id.get() is not None - if not in_toolset_scope: - combined_servers.update(allow_all_server_ids) - combined_servers.update(submitted_server_ids) - # For anonymous callers (no user_id, no role), also surface any # servers the operator has opted into upstream-delegated auth. # These servers handle their own auth at the upstream level, so @@ -1764,6 +2479,13 @@ class MCPServerManager: the given toolsets. Results are cached via ``user_api_key_cache`` (a Redis-backed ``DualCache`` in production) so that cache entries are shared across workers and cold-cache DB hits are minimised. + + A row names a tool on the server identified by ``server_id``, so the + stored name is the tool's own name and is used as written. It is never + reduced by the server's wire prefix: that prefix is added on the way out + and is not part of any tool's identity, so treating a leading segment as + one silently renames the tool when a native name happens to begin with + it (``greyhound_internal_events`` on a server prefixed ``greyhound``). """ from litellm.proxy._experimental.mcp_server.toolset_db import list_mcp_toolsets from litellm.proxy.proxy_server import prisma_client, user_api_key_cache @@ -1781,12 +2503,9 @@ class MCPServerManager: tool_permissions: dict[str, list[str]] = {} for toolset in toolsets: for tool in toolset.tools: - raw_name = tool["tool_name"] - server = self.get_mcp_server_by_id(tool["server_id"]) - unprefixed = strip_known_server_prefix(raw_name, server) - tool_permissions.setdefault(tool["server_id"], []) - if unprefixed not in tool_permissions[tool["server_id"]]: - tool_permissions[tool["server_id"]].append(unprefixed) + allowed_names = tool_permissions.setdefault(tool["server_id"], []) + if tool["tool_name"] not in allowed_names: + allowed_names.append(tool["tool_name"]) await user_api_key_cache.async_set_cache( key=cache_key, value=tool_permissions, @@ -2241,13 +2960,18 @@ class MCPServerManager: ) if not conflicts: return auth, extra_headers - if isinstance(spec.config, (TokenExchangeConfig, AuthorizationCodeConfig)): - # The resolver owns the per-user credential here (token_exchange's exchanged - # token, authorization_code's stored token). It is authoritative: a guardrail such - # as MCPJWTSigner, static_headers, or any other injected Authorization must NOT - # shadow it (otherwise the upstream gets e.g. the signer's JWT instead of the - # exchanged token and rejects it). Drop the conflicting header so the resolved - # token reaches upstream. + if isinstance( + spec.config, + (TokenExchangeConfig, AuthorizationCodeConfig, IdJagConfig, ClientCredentialsConfig), + ): + # The resolver owns the credential here (token_exchange's exchanged token, + # authorization_code's stored token, id_jag's minted assertion, + # client_credentials' gateway-minted M2M token). It is authoritative: a + # guardrail such as MCPJWTSigner, static_headers, or any other injected + # Authorization must NOT shadow it (otherwise the upstream gets e.g. the + # signer's JWT instead of the minted token and rejects it, and for M2M the + # one-shot 401 refetch is lost with it). Drop the conflicting header so the + # resolved token reaches upstream. return auth, _without_authorization(extra_headers) # Other modes: an Authorization already supplied via extra_headers (a forwarded caller # header or static_headers) is intentional and wins; v1 applies those last. @@ -2334,25 +3058,26 @@ class MCPServerManager: Configured MCP client instance. """ transport = server.transport or MCPTransport.sse - spec = None if transport == MCPTransport.stdio else to_server_spec(server) + spec = None if transport == MCPTransport.stdio else _to_server_spec_fail_closed(server) provider = cred_provider or self._cred_provider # A caller-supplied per-request override (mcp_auth_header / x-mcp-*) defers to the v1 path # so it wins - except for the modes the v2 resolver owns per-caller (authorization_code's - # stored token, token_exchange's RFC 8693 minted token, and the passthrough modes' - # forwarded caller token). A caller must not be able to substitute another user's stored - # credential, nor silently disable the OBO exchange and forward an arbitrary bearer - # upstream, so we keep the v2 spec and ignore the override for these; the REST tools - # preview supplies its not-yet-persisted token through the resolver (cred_provider), - # never this path. + # stored token, token_exchange's RFC 8693 minted token, id_jag's minted assertion, and the + # passthrough modes' forwarded caller token). A caller must not be able to substitute another + # user's stored credential, nor silently disable the OBO / ID-JAG exchange and forward an + # arbitrary bearer upstream, so we keep the v2 spec and ignore the override for these; the + # REST tools preview supplies its not-yet-persisted token through the resolver + # (cred_provider), never this path. if ( spec is not None and mcp_auth_header - and not isinstance(spec.config, (AuthorizationCodeConfig, PassthroughConfig, TokenExchangeConfig)) + and not isinstance( + spec.config, + (AuthorizationCodeConfig, IdJagConfig, PassthroughConfig, TokenExchangeConfig), + ) ): spec = None - auth_value = ( - await resolve_mcp_auth(server, mcp_auth_header, subject_token=subject_token) if spec is None else None - ) + auth_value = await resolve_mcp_auth(server, mcp_auth_header) if spec is None else None # Create sampling and elicitation callbacks for this client sampling_cb = _create_sampling_callback(user_api_key_auth=user_api_key_auth) if server.allow_sampling else None @@ -2594,10 +3319,16 @@ class MCPServerManager: return prefixed_or_original_tools - except MCPUpstreamAuthError: + except MCPUpstreamAuthError as upstream_auth_error: # Pass-through 401 must surface to single-server routes so the # client triggers the upstream OAuth flow. The multi-server # aggregator catches this explicitly to keep absorbing. + if server.is_dcr_bridge and upstream_auth_error.www_authenticate is not None: + raise MCPUpstreamAuthError( + status_code=upstream_auth_error.status_code, + www_authenticate=None, + server_name=upstream_auth_error.server_name, + ) from upstream_auth_error raise except HTTPException as e: # A v2 resolver auth challenge (token_exchange's RFC 9728 401, authorization_code's @@ -2607,16 +3338,19 @@ class MCPServerManager: # Non-auth HTTP errors stay absorbed so one misconfigured server can't blank the listing. if e.status_code in (401, 403): headers = e.headers or {} + challenge_header = headers.get("WWW-Authenticate") or headers.get("www-authenticate") raise MCPUpstreamAuthError( status_code=e.status_code, - www_authenticate=headers.get("WWW-Authenticate") or headers.get("www-authenticate"), + www_authenticate=None if server.is_dcr_bridge else challenge_header, server_name=server.name, ) from e verbose_logger.warning(f"Failed to get tools from server {server.name}: {str(e)}") - return [] + raise MCPServerListError(ServerListFault(tag="internal", status_code=e.status_code), server.name) from e + except MCPServerListError: + raise except Exception as e: verbose_logger.warning(f"Failed to get tools from server {server.name}: {str(e)}") - return [] + raise_classified_list_failure(e, server.name, suppress_challenge=server.is_dcr_bridge) async def get_prompts_from_server( self, @@ -2868,6 +3602,7 @@ class MCPServerManager: server_url: str, *, allow_origin_fallback: bool = True, + warn_when_no_metadata: bool = False, ) -> Optional[MCPOAuthMetadata]: """Discover OAuth metadata by following RFC 9728 (protected resource metadata discovery). @@ -2876,8 +3611,32 @@ class MCPServerManager: it (a human sees the redirect), but token_exchange (OBO) sets it False so the gateway never exchanges a subject token against an endpoint it inferred rather than one explicitly configured or authoritatively advertised via RFC 9728 / RFC 8414. - """ + ``warn_when_no_metadata`` makes an all-empty result log one WARNING with the per-step attempt + outcomes (LIT-4658), so a misconfigured server url is diagnosable from default-level logs. The + server loaders set it; the issuer-anchored resource-scopes lookup keeps it off because empty + scopes are not a fault there. + """ + metadata, attempts = await self._discover_metadata_recording_attempts( + server_url, allow_origin_fallback=allow_origin_fallback + ) + if metadata is None and warn_when_no_metadata: + verbose_logger.warning( + "MCP OAuth endpoint discovery against %s found no authorization server metadata. Attempts: %s. " + "The MCP server url may be misconfigured, or the upstream may not support OAuth discovery " + "(RFC 9728 / RFC 8414)", + _redact_mcp_resource_url(server_url) or "", + "; ".join(attempts) if attempts else "none recorded", + ) + return metadata + + async def _discover_metadata_recording_attempts( + self, + server_url: str, + *, + allow_origin_fallback: bool, + ) -> tuple[MCPOAuthMetadata | None, tuple[str, ...]]: + origin = _redact_mcp_resource_url(server_url) or "" try: client = get_async_httpx_client(llm_provider=httpxSpecialProvider.MCP) response = await client.get(server_url) @@ -2890,63 +3649,112 @@ class MCPServerManager: if metadata is None and not resource_scopes and authorization_servers and response.status_code == 200: verbose_logger.warning( "MCP OAuth discovery for %s received 200 OK without RFC 9728 challenge and no discoverable authorization metadata.", - server_url, + origin, ) + attempts = ( + f"GET {origin}: HTTP {response.status_code} (no RFC 9728 challenge)", + *( + ("well-known protected-resource lookup found no authorization servers",) + if not authorization_servers + else () + ), + *( + (f"authorization server metadata fetch failed for: {_redacted_origin_list(authorization_servers)}",) + if authorization_servers and metadata is None + else () + ), + ) if metadata is None and resource_scopes: - return MCPOAuthMetadata(scopes=resource_scopes) + return MCPOAuthMetadata(scopes=resource_scopes), attempts if metadata is not None and resource_scopes: metadata.scopes = resource_scopes - return metadata + return metadata, attempts except HTTPStatusError as exc: - verbose_logger.debug( - "MCP OAuth discovery for %s received status error: %s", - server_url, - exc, - ) - - header_value: Optional[str] = None - if exc.response is not None: - header_value = exc.response.headers.get("WWW-Authenticate") or exc.response.headers.get( - "www-authenticate" - ) - - resource_metadata_url, scopes = self._parse_www_authenticate_header(header_value) - - authorization_servers = [] - resource_scopes = None - if resource_metadata_url: - ( - authorization_servers, - resource_scopes, - ) = await self._fetch_oauth_metadata_from_resource(resource_metadata_url, server_url) - else: - ( - authorization_servers, - resource_scopes, - ) = await self._attempt_well_known_discovery(server_url) - - metadata = None - if allow_origin_fallback and not authorization_servers: - try: - parsed_url = urlparse(server_url) - if parsed_url.scheme and parsed_url.netloc: - authorization_servers = [f"{parsed_url.scheme}://{parsed_url.netloc}"] - except Exception: - authorization_servers = [] - - if authorization_servers: - metadata = await self._fetch_authorization_server_metadata(authorization_servers, server_url) - - preferred_scopes = scopes or resource_scopes - if metadata is None and preferred_scopes: - metadata = MCPOAuthMetadata(scopes=preferred_scopes) - elif metadata is not None and preferred_scopes: - metadata.scopes = preferred_scopes - - return metadata + return await self._discover_after_status_error(server_url, exc, allow_origin_fallback=allow_origin_fallback) except Exception as exc: # pragma: no cover - network/transient issues verbose_logger.debug("MCP OAuth discovery failed for %s: %s", server_url, exc) - return None + return None, (f"GET {origin}: {type(exc).__name__}: {_sanitized_error_text(exc)}",) + + async def _discover_after_status_error( + self, + server_url: str, + exc: HTTPStatusError, + *, + allow_origin_fallback: bool, + ) -> tuple[MCPOAuthMetadata | None, tuple[str, ...]]: + origin = _redact_mcp_resource_url(server_url) or "" + verbose_logger.debug( + "MCP OAuth discovery for %s received status error: %s", + server_url, + exc, + ) + + header_value: Optional[str] = None + if exc.response is not None: + header_value = exc.response.headers.get("WWW-Authenticate") or exc.response.headers.get("www-authenticate") + status_attempt = ( + f"GET {origin}: HTTP {exc.response.status_code}" + if exc.response is not None + else f"GET {origin}: status error" + ) + + resource_metadata_url, scopes = self._parse_www_authenticate_header(header_value) + + authorization_servers = [] + resource_scopes = None + if resource_metadata_url: + ( + authorization_servers, + resource_scopes, + ) = await self._fetch_oauth_metadata_from_resource(resource_metadata_url, server_url) + lookup_attempt = ( + None + if authorization_servers + else "challenge-advertised resource metadata yielded no authorization servers" + ) + else: + ( + authorization_servers, + resource_scopes, + ) = await self._attempt_well_known_discovery(server_url) + lookup_attempt = ( + None + if authorization_servers + else "no challenge-advertised resource metadata; well-known protected-resource lookup found no authorization servers" + ) + + metadata = None + used_origin_fallback = False + if allow_origin_fallback and not authorization_servers: + try: + parsed_url = urlparse(server_url) + if parsed_url.scheme and parsed_url.netloc: + authorization_servers = [f"{parsed_url.scheme}://{parsed_url.netloc}"] + used_origin_fallback = True + except Exception: + authorization_servers = [] + + fallback_attempt = None + if authorization_servers: + metadata = await self._fetch_authorization_server_metadata(authorization_servers, server_url) + if metadata is not None and used_origin_fallback: + metadata.from_origin_fallback = True + if metadata is None: + fallback_attempt = ( + f"origin fallback: no authorization server metadata at {origin}" + if used_origin_fallback + else f"authorization server metadata fetch failed for: {_redacted_origin_list(authorization_servers)}" + ) + + attempts = tuple(entry for entry in (status_attempt, lookup_attempt, fallback_attempt) if entry) + + preferred_scopes = scopes or resource_scopes + if metadata is None and preferred_scopes: + return MCPOAuthMetadata(scopes=preferred_scopes), attempts + if metadata is not None and preferred_scopes: + metadata.scopes = preferred_scopes + + return metadata, attempts def _parse_www_authenticate_header(self, header_value: Optional[str]) -> tuple[Optional[str], Optional[list[str]]]: if not header_value: @@ -3042,8 +3850,41 @@ class MCPServerManager: return metadata return None + async def _fetch_issuer_anchored_oauth_metadata( + self, issuer: str, server_url: Optional[str] + ) -> Optional[MCPOAuthMetadata]: + """RFC 8414 issuer-anchored discovery for the OAuth endpoints, with resource-driven scopes. + + Fetch authorization-server metadata from the admin-configured issuer's own origin and adopt + its ``token_endpoint``/``registration_endpoint`` only when the document self-attests that same + issuer (RFC 8414 §3.3). Because the trust anchor is the pinned issuer rather than anything the + MCP resource advertises, the endpoints are authoritative for that issuer and cannot be + substituted by a compromised resource. Fails closed (returns None) on a §3.3 mismatch or a + fetch failure. The issuer is passed as its own ``server_url`` so the endpoint fetch is treated + as same-authority and is not subject to the resource-scoped SSRF shortcut. + + Scopes are NOT taken from the issuer document. Per the MCP authorization spec Scope Selection + Strategy and RFC 9728, the scopes a client requests are resource-driven (the WWW-Authenticate + challenge or the protected-resource ``scopes_supported``), so the resource's advertised scopes + are fetched separately and used; the resource can influence only the requested scope, which + the authorization server and user consent bound (RFC 6749 §3.3), never the token endpoint. + """ + metadata = await self._fetch_single_authorization_server_metadata(issuer, issuer, require_issuer=issuer) + if metadata is None: + verbose_logger.warning( + "MCP OAuth issuer-anchored discovery for issuer %s yielded no metadata whose issuer " + "matched (RFC 8414 §3.3); OAuth endpoints stay unresolved until a rebuild succeeds", + issuer, + ) + return None + resource_metadata = ( + await self._descovery_metadata(server_url, allow_origin_fallback=False) if server_url else None + ) + resource_scopes = resource_metadata.scopes if resource_metadata else None + return metadata.model_copy(update={"scopes": resource_scopes}) + async def _fetch_single_authorization_server_metadata( - self, issuer_url: str, server_url: str + self, issuer_url: str, server_url: str, require_issuer: Optional[str] = None ) -> Optional[MCPOAuthMetadata]: try: parsed = urlparse(issuer_url) @@ -3087,20 +3928,33 @@ class MCPServerManager: ) continue - scopes = self._extract_scopes(data.get("scopes_supported")) + claimed_issuer = data.get("issuer") verbose_logger.debug( "Authorization server metadata from %s: issuer=%s grant_types_supported=%s " "token_endpoint_auth_methods_supported=%s", url, - data.get("issuer"), + claimed_issuer, data.get("grant_types_supported"), data.get("token_endpoint_auth_methods_supported"), ) + if require_issuer is not None and not _issuer_matches(claimed_issuer, require_issuer): + verbose_logger.warning( + "MCP OAuth issuer-anchored discovery: metadata at %s self-attests issuer %r, which " + "does not match the configured issuer %r (RFC 8414 §3.3); rejecting so a compromised " + "resource cannot substitute an attacker authorization server", + url, + claimed_issuer, + require_issuer, + ) + continue + + scopes = self._extract_scopes(data.get("scopes_supported")) metadata = MCPOAuthMetadata( scopes=scopes, authorization_url=data.get("authorization_endpoint"), token_url=data.get("token_endpoint"), registration_url=data.get("registration_endpoint"), + discovered_issuer=claimed_issuer if isinstance(claimed_issuer, str) and claimed_issuer else None, ) if any( @@ -3198,16 +4052,17 @@ class MCPServerManager: Uses anyio.fail_after() instead of asyncio.wait_for() to avoid conflicts with the MCP SDK's anyio TaskGroup. See GitHub issue #20715 for details. - An upstream HTTP 401 is converted into :class:`MCPUpstreamAuthError` - instead of being swallowed to an empty tool list, regardless of the - server's auth_type. Callers route it by surface: the single-server HTTP - routes turn it into a 401 + ``WWW-Authenticate`` challenge so standards- - compliant MCP clients trigger the upstream OAuth flow, while the - multi-server ``/mcp`` aggregator absorbs it to an empty list so one - unauthenticated server doesn't fail the whole listing. Only a 401 - (missing/invalid credential) drives the re-auth challenge; a 403 - (authenticated but forbidden, e.g. insufficient scope) is not a re-auth - signal and, like other non-auth errors, returns an empty list. + Failures never return an empty tool list. An upstream 401 or 403 raises + :class:`MCPUpstreamAuthError` carrying the upstream's own + ``WWW-Authenticate`` challenge when one was sent (a challenge is only + ever fabricated at the HTTP edge, and only for a 401: a 403 means the + caller is authenticated but not allowed, so prompting re-auth would be + wrong, while an upstream-sent 403 challenge is the RFC 6750 + insufficient_scope step-up and relays verbatim). Every other failure + raises :class:`MCPServerListError` with a classified fault. Each + boundary then applies its own policy: single-server routes relay the + truthful status, the multi-server aggregator absorbs the failure into + that server's listing outcome. Args: client: MCP client instance @@ -3221,27 +4076,18 @@ class MCPServerManager: tools = await client.list_tools(raise_on_error=True) verbose_logger.debug(f"Tools from {server_name}: {tools}") return tools - except TimeoutError: + except TimeoutError as e: verbose_logger.warning(f"Timeout while listing tools from {server_name}") - return [] - except asyncio.CancelledError: + raise MCPServerListError(ServerListFault(tag="timeout"), server_name) from e + except asyncio.CancelledError as e: verbose_logger.warning(f"Task cancelled while listing tools from {server_name}") - return [] + raise MCPServerListError(ServerListFault(tag="internal"), server_name) from e except ConnectionError as e: verbose_logger.warning(f"Connection error while listing tools from {server_name}: {str(e)}") - return [] + raise MCPServerListError(ServerListFault(tag="unreachable"), server_name) from e except Exception as e: - auth_info = _extract_upstream_auth_failure(e) - if auth_info is not None and auth_info[0] == 401: - _, www_authenticate = auth_info - verbose_logger.info(f"Upstream auth failure from MCP server {server_name}: HTTP 401") - raise MCPUpstreamAuthError( - status_code=401, - www_authenticate=www_authenticate, - server_name=server_name, - ) from e verbose_logger.warning(f"Error listing tools from {server_name}: {str(e)}") - return [] + raise_classified_list_failure(e, server_name) _SHORT_PREFIX_MAX_REHASH_ATTEMPTS = 1024 @@ -3825,10 +4671,13 @@ class MCPServerManager: if server_auth_header is None: server_auth_header = mcp_auth_header - # Extract subject token for OAuth2 Token Exchange (OBO) flow + # Extract subject token for OAuth2 Token Exchange (OBO) and ID-JAG flows subject_token: Optional[str] = None extra_headers: Optional[dict[str, str]] = None - if mcp_server.auth_type == MCPAuth.oauth2_token_exchange: + if mcp_server.auth_type in ( + MCPAuth.oauth2_token_exchange, + MCPAuth.oauth2_id_jag, + ): subject_token = self._extract_bearer_token(oauth2_headers, raw_headers) elif mcp_server.auth_type == MCPAuth.oauth2: if mcp_server.has_client_credentials: @@ -3930,10 +4779,10 @@ class MCPServerManager: arguments=arguments, ) - if mcp_server.auth_type == MCPAuth.oauth2_token_exchange and subject_token: - # OBO: the exchanged token may have been revoked/rotated upstream since it was cached, so - # an upstream 401 gets one re-mint + retry. Gated to this mode; all others keep the plain - # single call below. + if mcp_server.auth_type in (MCPAuth.oauth2_token_exchange, MCPAuth.oauth2_id_jag) and subject_token: + # OBO / ID-JAG: the exchanged token may have been revoked/rotated upstream since it was + # cached, so an upstream 401 gets one invalidate + re-mint + retry. Gated to these modes; + # all others keep the plain single call below. async def _obo_call_tool_limited(): async with self._limit_outbound_concurrency(mcp_server): return await self._obo_call_tool_with_retry( @@ -3950,10 +4799,50 @@ class MCPServerManager: tool_call_coro = _obo_call_tool_limited() else: + # Scoped to the two client-forwarded token modes this stack introduced; legacy + # oauth2 + delegate_auth_to_upstream (is_oauth_passthrough) is being removed, so it is not + # added here even though the list path still relays for it. + relays_upstream_auth = mcp_server.is_true_passthrough or mcp_server.is_oauth_delegate + server_label = mcp_server.name or mcp_server.server_name or mcp_server.alias or "" async def _call_tool_via_client(client, params): async with self._limit_outbound_concurrency(mcp_server): - return await client.call_tool(params, host_progress_callback=host_progress_callback) + if not relays_upstream_auth: + return await client.call_tool(params, host_progress_callback=host_progress_callback) + # The client-forwarded modes carry the caller's own upstream token, so an upstream + # 401 (expired/invalid token) is the caller's to resolve: relay it as + # MCPUpstreamAuthError so single-server REST callers turn it into a 401 + + # WWW-Authenticate and re-run the upstream OAuth flow. Only 401 is a re-auth signal + # (mirrors the list path and MCPUpstreamAuthError's contract); a 403 is a genuine + # authorization failure that re-auth won't fix, so it takes the non-auth branch and + # stays a visible warning. raise_on_error only re-raises transport failures + # (tool-level isError results are still returned normally); a non-auth failure keeps + # the same isError degradation the default path produces. + try: + return await client.call_tool( + params, host_progress_callback=host_progress_callback, raise_on_error=True + ) + except Exception as e: + auth_info = _extract_upstream_auth_failure(e) + if auth_info is None or auth_info[0] != 401: + # A genuine (non-auth or 403-forbidden) upstream/transport failure. + # raise_on_error demoted the client-layer log to debug, so surface it here at + # warning level to keep the outage visible; the caller still gets the graceful + # isError result the default masking path would have produced. Log the + # exception type only, never str(e), which for an httpx error embeds the + # upstream URL (a credential can hide in it). + verbose_logger.warning( + "Pass-through MCP tool call failed against %s (non-auth, %s)", + server_label, + type(e).__name__, + ) + return client.error_tool_result(e) + _, www_authenticate = auth_info + raise MCPUpstreamAuthError( + status_code=401, + www_authenticate=www_authenticate, + server_name=server_label, + ) from e tool_call_coro = _call_tool_via_client(client, call_tool_params) @@ -4043,10 +4932,13 @@ class MCPServerManager: return await self._cred_provider.has_user_token(to_subject(user_api_key_auth, None), spec) async def invalidate_user_oauth_token_cache(self, user_id: str, server_id: str) -> None: - """Drop the v2 chain's cached token for ``(user_id, server_id)`` after the credential row - changes (re-auth, revoke), so the next resolve reads the new row instead of serving the - replaced token until its cache TTL. Best-effort: a cache-drop failure is logged, never - raised, because the DB write already succeeded and the TTL remains the backstop. + """Drop every cached token for ``(user_id, server_id)`` after the credential row changes + (re-auth, revoke, config-change purge): the v2 chain's cache and the legacy per-user token + cache, so the next resolve reads the new row instead of serving the replaced token until its + cache TTL, whichever path resolves it. This is the single invalidation point for per-user + OAuth tokens; callers must not evict individual caches directly. Best-effort: a cache-drop + failure is logged, never raised, because the DB write already succeeded and the TTL remains + the backstop. """ try: await self._per_user_oauth_token_store.invalidate(user_id, server_id) @@ -4054,6 +4946,12 @@ class MCPServerManager: verbose_logger.warning( "Failed to invalidate cached MCP OAuth token for user=%s server=%s: %s", user_id, server_id, exc ) + try: + await self._per_user_token_cache.delete(user_id, server_id) + except Exception as exc: # noqa: BLE001 - cache drop is best-effort; TTL is the backstop + verbose_logger.warning( + "Failed to drop legacy cached MCP OAuth token for user=%s server=%s: %s", user_id, server_id, exc + ) async def _resolve_oauth2_headers_for_tool_call( self, @@ -4095,6 +4993,61 @@ class MCPServerManager: ) return oauth2_headers + async def resolve_openapi_upstream_auth( + self, + *, + mcp_server: MCPServer, + oauth2_headers: dict[str, str] | None, + raw_headers: dict[str, str] | None, + mcp_auth_header: str | dict[str, str] | None, + user_api_key_auth: UserAPIKeyAuth | None, + forwarded_headers: dict[str, str] | None, + ) -> tuple[dict[str, str] | None, dict[str, str] | None]: + """Resolve the gateway-owned upstream credential for a spec_path (OpenAPI) tool call. + + OpenAPI tools egress through a plain httpx call assembled from ContextVars, never through + ``_create_mcp_client``, so the v2 resolver graft there does not run for them and a resolved + credential (authorization_code's stored per-user token, client_credentials' minted M2M + token, token_exchange's exchanged token, passthrough's forwarded caller token) must be + materialized into headers here. Returns ``(resolved_auth_headers, forwarded_headers)``: + the resolved headers are authoritative over every other Authorization source (the same + rule ``_resolve_v2_auth`` applies on the MCPClient path) and ``forwarded_headers`` comes + back with any header the resolver claimed already dropped. Unmigrated (v1) servers resolve + through the stored-token lookup instead, and a missing per-user credential raises the same + discovery challenge the MCPClient path serves, rather than egressing unauthenticated. + + The resolved headers carry only credentials the gateway itself resolved (a stored per-user + token, a minted or exchanged token). Caller-supplied ``oauth2_headers`` are never promoted + into them: on the v2 arm they feed only subject-token extraction (the designed RFC 8693 + input), and on the v1 arm their presence disables the stored lookup entirely, so a + caller's gateway credential can never displace a per-server BYOK header or leak upstream + as the resolved credential. + """ + spec = to_server_spec(mcp_server) + if spec is None: + if oauth2_headers: + return None, forwarded_headers + stored_headers = await self._resolve_oauth2_headers_for_tool_call(mcp_server, None, user_api_key_auth) + return stored_headers, forwarded_headers + + subject_token: str | None = None + if isinstance(spec.config, (TokenExchangeConfig, IdJagConfig)): + subject_token = self._extract_bearer_token(oauth2_headers, raw_headers) + elif isinstance(spec.config, PassthroughConfig): + inbound_token, forwarded_headers = _take_forwarded_authorization(forwarded_headers) + per_server_token = _passthrough_token_from_mcp_auth_header(mcp_auth_header) + subject_token = per_server_token if per_server_token is not None else inbound_token + + resolved_auth, forwarded_headers = await self._resolve_v2_auth( + server=mcp_server, + spec=spec, + provider=self._cred_provider, + subject_token=subject_token, + user_api_key_auth=user_api_key_auth, + extra_headers=forwarded_headers, + ) + return await _materialize_auth_headers(resolved_auth), forwarded_headers + async def _gather_openapi_tool_tasks( self, tasks: list[Any], @@ -4186,6 +5139,7 @@ class MCPServerManager: ) tasks.append(during_hook_task) + caller_oauth2_headers = oauth2_headers oauth2_headers = await self._resolve_oauth2_headers_for_tool_call(mcp_server, oauth2_headers, user_api_key_auth) # For OpenAPI servers, call the tool handler directly instead of via MCP client @@ -4203,22 +5157,32 @@ class MCPServerManager: auth_header_value = ( _format_byok_openapi_auth_header(mcp_server, mcp_auth_header) if mcp_auth_header else None ) - forwarded_headers = _openapi_forwarded_extra_headers(mcp_server, raw_headers, user_api_key_auth) + resolved_auth_headers, forwarded_headers = await self.resolve_openapi_upstream_auth( + mcp_server=mcp_server, + oauth2_headers=caller_oauth2_headers, + raw_headers=raw_headers, + mcp_auth_header=mcp_auth_header, + user_api_key_auth=user_api_key_auth, + forwarded_headers=_openapi_forwarded_extra_headers(mcp_server, raw_headers, user_api_key_auth), + ) async def _call_openapi_via_handler(): from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import ( _request_auth_header, _request_extra_headers, + _request_resolved_auth_headers, ) auth_token = _request_auth_header.set(auth_header_value) extra_token = _request_extra_headers.set(forwarded_headers) + resolved_token = _request_resolved_auth_headers.set(resolved_auth_headers) try: async with self._limit_outbound_concurrency(mcp_server): return await self._call_openapi_tool_handler(mcp_server, name, arguments) finally: _request_auth_header.reset(auth_token) _request_extra_headers.reset(extra_token) + _request_resolved_auth_headers.reset(resolved_token) tasks.append(asyncio.create_task(_call_openapi_via_handler())) else: @@ -4376,6 +5340,10 @@ class MCPServerManager: and existing_server.updated_at is not None and server.updated_at is not None and existing_server.updated_at == server.updated_at + and not ( + _oauth_endpoints_unresolved(existing_server) + and self._oauth_discovery_retry_due(server.server_id) + ) ): # Re-use existing server instance to avoid re-running build_mcp_server_from_table() # which can perform network discovery for OAuth2 servers. @@ -4393,10 +5361,12 @@ class MCPServerManager: # already-decrypted records add_server/update_server are handed. # Decrypt them while building the registry entry. new_server = await self.build_mcp_server_from_table(server, env_vars_are_encrypted=True) + self._record_oauth_discovery_outcome(new_server) # Carry the cached short_prefix from the previous registry entry # (if any) so the prefix is stable across reloads. if existing_server is not None and existing_server.short_prefix: new_server.short_prefix = existing_server.short_prefix + _carry_forward_resolved_oauth_endpoints(new_server=new_server, previous_server=existing_server) new_registry[server.server_id] = new_server except Exception as e: verbose_logger.exception( @@ -4434,6 +5404,8 @@ class MCPServerManager: verbose_logger.debug("MCP registry refreshed (%s servers in registry)", len(registered_registry)) + await self._hydrate_config_servers_dcr_clients() + def get_mcp_servers_from_ids(self, server_ids: list[str]) -> list[MCPServer]: servers = [] registry = self.get_registry() @@ -4771,10 +5743,12 @@ class MCPServerManager: command=getattr(server, "command", None), args=getattr(server, "args", None) or [], env=getattr(server, "env", None) or {}, + issuer=server.issuer, authorization_url=server.authorization_url, token_url=server.token_url, registration_url=server.registration_url, oauth2_flow=server.oauth2_flow, + dcr_bridge=server.dcr_bridge, token_exchange_endpoint=server.token_exchange_endpoint, audience=server.audience, subject_token_type=server.subject_token_type, @@ -4879,6 +5853,7 @@ class MCPServerManager: command=getattr(server, "command", None), args=getattr(server, "args", None) or [], env=getattr(server, "env", None) or {}, + issuer=server.issuer, authorization_url=server.authorization_url, token_url=server.token_url, registration_url=server.registration_url, @@ -4891,6 +5866,7 @@ class MCPServerManager: available_on_public_internet=server.available_on_public_internet, delegate_auth_to_upstream=server.delegate_auth_to_upstream, oauth_passthrough=getattr(server, "oauth_passthrough", False), + dcr_bridge=server.dcr_bridge, is_byok=server.is_byok, byok_description=server.byok_description, byok_api_key_help_url=server.byok_api_key_help_url, diff --git a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py index 33f0641b732..b2b3f70d200 100644 --- a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py +++ b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py @@ -6,6 +6,7 @@ with ``client_id``, ``client_secret``, and ``token_url``. """ import asyncio +import hashlib from typing import TYPE_CHECKING, Dict, Optional, Tuple, Union import httpx @@ -26,9 +27,9 @@ from litellm.proxy.common_utils.encrypt_decrypt_utils import ( decrypt_value_helper, encrypt_value_helper, ) -from litellm.proxy._experimental.mcp_server.auth import token_exchange -from litellm.proxy._experimental.mcp_server.auth.token_endpoint_auth import ( - build_token_endpoint_client_auth, +from litellm.proxy._experimental.mcp_server.oauth_utils import ( + build_upstream_oauth2_token_request, + resolve_upstream_resource, ) from litellm.types.llms.custom_http import httpxSpecialProvider @@ -38,10 +39,18 @@ if TYPE_CHECKING: class MCPOAuth2TokenCache(InMemoryCache): """ - In-memory cache for OAuth2 client_credentials tokens, keyed by server_id. + In-memory cache for OAuth2 client_credentials tokens, keyed by the identity of the token + request rather than by server_id alone. + + A minted token is only reusable for the exact request that produced it. Keying on server_id + alone served a token minted under the previous configuration whenever any of those inputs + changed, so editing scopes, rotating the client secret, or setting ``upstream_resource`` + silently kept handing out a token carrying the old scopes or audience until it expired. The + identity below covers every input ``_fetch_token`` puts on the wire, so a change to any of + them misses the cache and mints afresh. Inherits from ``InMemoryCache`` for TTL-based storage and eviction. - Adds per-server ``asyncio.Lock`` to prevent duplicate concurrent fetches. + Adds a per-identity ``asyncio.Lock`` to prevent duplicate concurrent fetches. """ def __init__(self) -> None: @@ -51,43 +60,55 @@ class MCPOAuth2TokenCache(InMemoryCache): ) self._locks: Dict[str, asyncio.Lock] = {} - def _get_lock(self, server_id: str) -> asyncio.Lock: - return self._locks.setdefault(server_id, asyncio.Lock()) + @staticmethod + def _token_identity(server: "MCPServer") -> str: + """Cache key for the token this server's config would mint, prefixed by server_id so a + single server's entries stay greppable and invalidatable. The secret is hashed with the + rest of the identity rather than stored in a key.""" + material = "\x00".join( + ( + server.token_url or "", + server.client_id or "", + server.client_secret or "", + " ".join(server.scopes or ()), + resolve_upstream_resource(server) or "", + server.token_endpoint_auth_method or "", + ) + ) + return f"{server.server_id}:{hashlib.sha256(material.encode()).hexdigest()}" + + def _get_lock(self, identity: str) -> asyncio.Lock: + return self._locks.setdefault(identity, asyncio.Lock()) @staticmethod def _has_client_credentials_config(server: "MCPServer") -> bool: return bool(server.client_id and server.client_secret and server.token_url) - async def async_get_token( - self, - server: "MCPServer", - *, - require_client_credentials_flow: bool = True, - ) -> Optional[str]: + async def async_get_token(self, server: "MCPServer") -> Optional[str]: """Return a valid access token, fetching or refreshing as needed. Returns ``None`` when the server lacks client credentials config. """ - if require_client_credentials_flow and not server.has_client_credentials: + if not server.has_client_credentials: return None if not self._has_client_credentials_config(server): return None - server_id = server.server_id + identity = self._token_identity(server) # Fast path — cached token is still valid - cached = self.get_cache(server_id) + cached = self.get_cache(identity) if cached is not None: return cached - # Slow path — acquire per-server lock then double-check - async with self._get_lock(server_id): - cached = self.get_cache(server_id) + # Slow path — acquire per-identity lock then double-check + async with self._get_lock(identity): + cached = self.get_cache(identity) if cached is not None: return cached token, ttl = await self._fetch_token(server) - self.set_cache(server_id, token, ttl=ttl) + self.set_cache(identity, token, ttl=ttl) return token async def _fetch_token(self, server: "MCPServer") -> Tuple[str, int]: @@ -106,14 +127,15 @@ class MCPOAuth2TokenCache(InMemoryCache): f"token_url={bool(server.token_url)}" ) - client_auth = build_token_endpoint_client_auth( + token_request = build_upstream_oauth2_token_request( + server, auth_method=server.token_endpoint_auth_method, client_id=server.client_id, client_secret=server.client_secret, ) data: Dict[str, str] = { "grant_type": "client_credentials", - **client_auth.body, + **token_request.body, } if server.scopes: data["scope"] = " ".join(server.scopes) @@ -123,7 +145,7 @@ class MCPOAuth2TokenCache(InMemoryCache): server.server_id, ) - post_kwargs = {"data": data, **({"headers": client_auth.headers} if client_auth.headers else {})} + post_kwargs = {"data": data, **({"headers": token_request.headers} if token_request.headers else {})} try: response = await client.post(server.token_url, **post_kwargs) response.raise_for_status() @@ -165,8 +187,14 @@ class MCPOAuth2TokenCache(InMemoryCache): return access_token, ttl def invalidate(self, server_id: str) -> None: - """Remove a cached token (e.g. after a 401).""" - self.delete_cache(server_id) + """Remove every cached token for a server (e.g. after a 401). + + Entries are keyed by token identity, so one server can hold more than one entry across a + config change; a 401 invalidates all of them rather than only the current configuration's. + """ + prefix = f"{server_id}:" + for key in [k for k in self.cache_dict if isinstance(k, str) and k.startswith(prefix)]: + self.delete_cache(key) mcp_oauth2_token_cache = MCPOAuth2TokenCache() @@ -175,16 +203,18 @@ mcp_oauth2_token_cache = MCPOAuth2TokenCache() def _compute_per_user_token_ttl(server: "MCPServer", expires_in: Optional[int]) -> int: """Compute Redis TTL for a per-user token. - Uses server.token_storage_ttl_seconds when configured; otherwise derives - TTL from expires_in minus the expiry buffer; falls back to the default TTL. + Uses server.token_storage_ttl_seconds when configured, capped at the token's + remaining lifetime (expires_in minus the expiry buffer) so a cached entry never + outlives the token itself; otherwise derives TTL from expires_in minus the + expiry buffer; falls back to the default TTL. """ + lifetime_bound = expires_in - MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS if expires_in is not None else None if server.token_storage_ttl_seconds is not None: - return max(server.token_storage_ttl_seconds, 1) - if expires_in is not None: - return max( - expires_in - MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS, - 1, - ) + if lifetime_bound is None: + return max(server.token_storage_ttl_seconds, 1) + return max(min(server.token_storage_ttl_seconds, lifetime_bound), 1) + if lifetime_bound is not None: + return max(lifetime_bound, 1) return MCP_PER_USER_TOKEN_DEFAULT_TTL @@ -276,36 +306,16 @@ mcp_per_user_token_cache = MCPPerUserTokenCache() async def resolve_mcp_auth( server: "MCPServer", mcp_auth_header: Optional[Union[str, Dict[str, str]]] = None, - subject_token: Optional[str] = None, ) -> Optional[Union[str, Dict[str, str]]]: """Resolve the auth value for an MCP server. Priority: 1. ``mcp_auth_header`` — per-request/per-user override - 2. OAuth2 Token Exchange (OBO / RFC 8693) — exchange user token for scoped token - 3. OAuth2 client_credentials token — auto-fetched and cached - 4. ``server.authentication_token`` — static token from config/DB + 2. OAuth2 client_credentials token — auto-fetched and cached + 3. ``server.authentication_token`` — static token from config/DB """ if mcp_auth_header: return mcp_auth_header - if server.has_token_exchange_config: - if subject_token: - return await token_exchange.mcp_token_exchange_handler.exchange_token(subject_token, server) - # No subject_token — fall back to client_credentials using the same client - # credentials and token_url so M2M scenarios still work. - if server.client_id and server.client_secret and server.token_url: - return await mcp_oauth2_token_cache.async_get_token( - server, - require_client_credentials_flow=False, - ) - # OBO configured but no subject_token and missing client credentials — warn - # rather than silently proceeding unauthenticated. - verbose_logger.warning( - "MCP server '%s' is configured for token exchange (OBO) but no subject_token " - "was provided and client credentials (client_id/client_secret/token_url) are " - "incomplete. The request will proceed without authentication.", - server.server_id, - ) if server.has_client_credentials: return await mcp_oauth2_token_cache.async_get_token(server) return server.authentication_token diff --git a/litellm/proxy/_experimental/mcp_server/oauth_issuer_stamp_backfill.py b/litellm/proxy/_experimental/mcp_server/oauth_issuer_stamp_backfill.py new file mode 100644 index 00000000000..874fcc64772 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/oauth_issuer_stamp_backfill.py @@ -0,0 +1,148 @@ +"""One-time heal for MCP server rows whose ``issuer`` a released version wrote by itself. + +Until the write was removed, OAuth discovery stamped the issuer it discovered onto the ``issuer`` +column trust-on-first-use. That column means "the admin pinned this trust anchor", so the next +registry build read the gateway's own output back as admin intent: the server turned issuer-anchored +(RFC 8414 section 3.3), its stored authorization/token/registration URLs stopped applying, and a +failed issuer-document fetch left it with no authorize endpoint (GH #34985). + +Deleting the write fixes every row created afterwards but cannot fix a row already stamped, which +still reads as pinned. This heals those rows by clearing the stamp so their configured endpoints +apply again. + +The signal is a heuristic, and deliberately a narrow one. ``updated_by`` records only the most recent +writer, and no audit trail says which field that writer touched, so "discovery wrote this issuer" is +not directly knowable. Two independent clauses bound it, and each rules out a different way of +destroying a pin an admin meant. + +Configured endpoints must be present. A deliberately pinned row very often has none, both because the +Issuer field is documented as overriding them and because ``update_mcp_server`` clears them when an +issuer changes, so "issuer set, endpoints empty" is the canonical shape of a real pin and must never +be cleared on this evidence. Skipping those rows costs little: with nothing configured to restore, the +anchored and resource-rooted paths resolve from the same upstream document, and the row still gets the +unresolved-endpoint retry and the anchored-discard warning. + +The configured endpoints must also share the issuer's origin. A stamped issuer is by construction the +one self-attested by the authorization-server document discovery reached from this very server, so +endpoints typed alongside it address that same authority. An admin who pinned an issuer and typed +endpoints for a different authority is expressing an intent that clearing the issuer would discard, so +that row is warned about and never healed. + +What survives both clauses is a row whose configured endpoints and stamped issuer share an origin, +which is exactly the GH #34985 shape. An admin who pinned that same origin by hand lands here too, and +for them the clear is close to a no-op: their typed endpoints keep serving and still anchor the +RFC 9700 corroboration gate, with only the stricter section 3.3 anchoring lost. Every heal logs the +cleared value so it can be restored, and the clear is recorded under this module's actor so the heal +runs at most once per row. +""" + +from typing import Protocol +from urllib.parse import urlparse + +from litellm._logging import verbose_proxy_logger +from litellm.proxy._experimental.mcp_server.oauth_utils import canonicalize_url_identity +from litellm.proxy.utils import PrismaClient + +# The actor the removed discovery write-back stamped rows with. +_DISCOVERY_ACTOR = "mcp_oauth_discovery" + +# The actor recorded on a healed row, which also makes the heal idempotent: once a row is cleared it +# no longer matches ``updated_by == _DISCOVERY_ACTOR`` and is never reconsidered. +_BACKFILL_ACTOR = "mcp_oauth_issuer_stamp_backfill" + +_AUTH_TYPES_WITH_ISSUER_ANCHORING = ("oauth2", "true_passthrough", "oauth_delegate") + + +def _origin(url: str) -> str | None: + """The scheme-and-authority identity of ``url``, or ``None`` when it has none. + + Built on the shared URL canonicalizer so the lowercase-host and default-port rules match the + RFC 8414 issuer comparison the resolution path uses, instead of being re-derived here. + """ + parsed = urlparse(canonicalize_url_identity(url)) + if not parsed.scheme or not parsed.netloc: + return None + return f"{parsed.scheme}://{parsed.netloc}" + + +class _MCPServerRow(Protocol): + """The MCP server row fields this heal reads, so the untyped DB record is narrowed once here.""" + + server_id: str + alias: str | None + server_name: str | None + auth_type: str | None + issuer: str | None + authorization_url: str | None + token_url: str | None + registration_url: str | None + updated_by: str | None + + +def _is_stamped_issuer_row(row: _MCPServerRow) -> bool: + """Whether this row carries the full signature of a gateway-written issuer stamp. + + The whole rule lives here, including the writer check the query also filters on, so the decision + to clear an admin-visible field is auditable in one place rather than split between a predicate + and a query. + """ + if getattr(row, "updated_by", None) != _DISCOVERY_ACTOR: + return False + if not (getattr(row, "issuer", None) or "").strip(): + return False + if getattr(row, "auth_type", None) not in _AUTH_TYPES_WITH_ISSUER_ANCHORING: + return False + configured = tuple( + value.strip() + for value in (row.authorization_url, row.token_url, row.registration_url) + if value and value.strip() + ) + if not configured: + return False + issuer_origin = _origin(row.issuer or "") + return issuer_origin is not None and all(_origin(endpoint) == issuer_origin for endpoint in configured) + + +async def backfill_discovery_stamped_issuers(prisma_client: PrismaClient) -> int: + """Clear gateway-written issuer stamps, returning the number of rows healed.""" + candidate_rows: list[_MCPServerRow] = await prisma_client.db.litellm_mcpservertable.find_many( + where={ + "updated_by": _DISCOVERY_ACTOR, + "auth_type": {"in": list(_AUTH_TYPES_WITH_ISSUER_ANCHORING)}, + }, + ) + stamped = tuple(row for row in candidate_rows if _is_stamped_issuer_row(row)) + if not stamped: + return 0 + + healed = 0 + for row in stamped: + try: + await prisma_client.db.litellm_mcpservertable.update( + where={"server_id": row.server_id}, + data={"issuer": None, "updated_by": _BACKFILL_ACTOR}, + ) + except Exception as exc: # noqa: BLE001 - per-row best effort; the next boot retries + verbose_proxy_logger.warning( + "MCP issuer stamp backfill: could not heal server_id=%s: %s", row.server_id, exc + ) + continue + healed += 1 + verbose_proxy_logger.warning( + "MCP issuer stamp backfill: cleared issuer %r on server_id=%s (alias=%s). OAuth discovery " + "had written that value onto the Issuer column, which made the server issuer-anchored and " + "fail-closed, and its configured Authorization/Token/Registration URLs were being ignored " + "as a result; those now apply again. If you pinned this issuer deliberately, set it again " + "via the dashboard or PUT /v1/mcp/server to restore RFC 8414 section 3.3 anchoring.", + row.issuer, + row.server_id, + row.alias or row.server_name, + ) + + if healed: + verbose_proxy_logger.warning( + "MCP issuer stamp backfill: healed %d server(s) whose Issuer had been written by OAuth " + "discovery rather than by an admin", + healed, + ) + return healed diff --git a/litellm/proxy/_experimental/mcp_server/oauth_utils.py b/litellm/proxy/_experimental/mcp_server/oauth_utils.py index 4d5813dbc5b..5daec9f97be 100644 --- a/litellm/proxy/_experimental/mcp_server/oauth_utils.py +++ b/litellm/proxy/_experimental/mcp_server/oauth_utils.py @@ -3,14 +3,22 @@ import os from ipaddress import ip_address -from typing import Any, Dict, List, NoReturn, Optional -from urllib.parse import ParseResult, urlparse, urlunparse +from typing import TYPE_CHECKING, Any, Dict, List, NoReturn, Optional +from urllib.parse import ParseResult, urlparse, urlsplit, urlunparse, urlunsplit from fastapi import HTTPException, Request from litellm._logging import verbose_logger +from litellm.proxy._experimental.mcp_server.auth.token_endpoint_auth import ( + TokenEndpointClientAuth, + build_token_endpoint_client_auth, + normalize_token_endpoint_auth_method, +) from litellm.proxy.auth.ip_address_utils import IPAddressUtils +if TYPE_CHECKING: + from litellm.types.mcp_server.mcp_server_manager import MCPServer + # RFC 6749 §5.1 / OAuth 2.1 draft-15 §4.1.3: token-endpoint responses # must not be cached — both success and error bodies may reveal secrets. TOKEN_NO_CACHE_HEADERS = {"Cache-Control": "no-store", "Pragma": "no-cache"} @@ -21,6 +29,10 @@ TOKEN_NO_CACHE_HEADERS = {"Cache-Control": "no-store", "Pragma": "no-cache"} # explicit port, which would otherwise break a literal netloc compare). _DEFAULT_PORTS = {"http": 80, "https": 443} +# Sentinel ``upstream_resource`` value meaning "derive the RFC 8707 resource identifier from the +# server's own url". RFC 8707 requires an absolute URI, so this can never be a real resource value. +UPSTREAM_RESOURCE_AUTO = "auto" + # Env var for ops to allowlist additional redirect_uri origins beyond # same-origin + loopback — needed for first-party OAuth clients hosted # on sister domains (e.g. a web app on app.example.com registering as @@ -70,6 +82,29 @@ def _origin_label(scheme: str, netloc: str) -> str: return f"{scheme}://{netloc}" if netloc else f"{scheme}://" +def _redact_mcp_resource_url(url: Optional[str]) -> Optional[str]: + """Reduce an MCP server URL to its origin (scheme + host + port) for logging. + + Everything else is dropped: userinfo (``user:pass@``), the query string, the + fragment, and the path, because hosted MCP servers routinely embed the + credential in the path (e.g. ``/mcp/s/``) and this value is persisted + in spend-log metadata that a caller who can invoke the tool can read back. + Returns None when the URL has no host to identify (nothing safe to log). + """ + if not isinstance(url, str) or not url: + return None + try: + parts = urlsplit(url) + hostname = parts.hostname + port = parts.port + except ValueError: + return None + if not hostname: + return None + netloc = f"{hostname}:{port}" if port else hostname + return urlunsplit((parts.scheme, netloc, "", "", "")) or None + + def _resolve_proxy_base_url_env() -> Optional[str]: global _warned_invalid_proxy_base_url configured = os.environ.get("PROXY_BASE_URL", "").strip() @@ -129,7 +164,19 @@ def get_request_base_url(request: Request) -> str: if x_forwarded_port and ":" not in netloc: netloc = f"{netloc}:{x_forwarded_port}" - return urlunparse((scheme, netloc, parsed.path, "", "", "")) + return urlunparse((scheme, _strip_default_port(scheme, netloc), parsed.path, "", "", "")) + + +def well_known_root_suffix() -> str: + """The ``SERVER_ROOT_PATH`` segment inserted into a ``.well-known`` path (RFC 8414 / 9728 + path insertion), empty for a root-mounted proxy or an explicit ``/``. + + The discovery route registrations and the 401 challenges that advertise those routes both + derive their path from this one function, so the ``resource_metadata`` URL a client is told + to fetch cannot drift from the route that actually serves it. + """ + root = os.getenv("SERVER_ROOT_PATH", "") + return "" if root == "/" else root def validate_loopback_redirect_uri(redirect_uri: str) -> None: @@ -331,8 +378,36 @@ def _parse_redirect_uri_for_validation(redirect_uri: str) -> ParseResult: ) -def _validate_trusted_http_redirect_shape(parsed: ParseResult) -> bool: - """Return True when ``parsed`` is an allowlisted native callback (caller may return).""" +def is_loopback_redirect_host(parsed: ParseResult) -> bool: + """True when the redirect host is loopback (RFC 8252 section 7.3). + + Shared by every redirect-URI policy in the MCP OAuth surface so that none of them + hand-rolls its own host list: a literal ``("localhost", "127.0.0.1", "::1")`` tuple + silently misses the rest of 127.0.0.0/8 and IPv6-mapped forms. + """ + host = (parsed.hostname or "").lower() + if host == "localhost": + return True + try: + return ip_address(host).is_loopback + except ValueError: + return False + + +def validate_redirect_uri_shape(parsed: ParseResult) -> bool: + """Validate redirect-URI *hygiene* and resolve allowlisted native callbacks. + + Returns True when ``parsed`` is an allowlisted native callback (the caller may accept + it outright); returns False for http/https, leaving the trust decision to the caller; + raises for a URI that no policy should ever accept (bad scheme, fragment, missing + host, userinfo, backslash in the host). + + This is deliberately separate from :func:`validate_trusted_redirect_uri`, which adds + the *first-party* trust policy (same-origin, loopback, ops allowlist) appropriate to + the proxy's own OAuth endpoints. Public dynamic-client registration accepts any https + client and relies on PKCE plus the consent screen instead, so it shares this hygiene + rule but not that trust policy. + """ if parsed.scheme not in ("http", "https"): if _matches_trusted_native_redirect_uri(parsed): return True @@ -384,14 +459,8 @@ def _trusted_redirect_uri_is_allowed( ): return True - host = (parsed.hostname or "").lower() - if host == "localhost": + if is_loopback_redirect_host(parsed): return True - try: - if ip_address(host).is_loopback: - return True - except ValueError: - pass if parsed.scheme == "https": for entry in _parse_trusted_redirect_origins(): @@ -453,7 +522,10 @@ def _raise_trusted_redirect_uri_rejected( "Align the proxy public URL with the browser URL. Set PROXY_BASE_URL to your " "HTTPS origin (e.g. https://litellm.example.com), or enable " "general_settings.use_x_forwarded_for with mcp_trusted_proxy_ranges for your " - "ingress. Verify: curl https:///.well-known/oauth-authorization-server " + "ingress. If the redirect_uri is a legitimate separate-origin OAuth client " + "(e.g. a web app registering with the proxy from another host via dynamic client " + f"registration), add its origin to {_TRUSTED_REDIRECT_ORIGINS_ENV}. " + "Verify: curl https:///.well-known/oauth-authorization-server " "| jq .issuer — issuer must match window.location.origin in the UI." ) @@ -507,10 +579,119 @@ def validate_trusted_redirect_uri(request: Request, redirect_uri: str) -> None: :func:`validate_loopback_redirect_uri`. """ parsed = _parse_redirect_uri_for_validation(redirect_uri) - if _validate_trusted_http_redirect_shape(parsed): + if validate_redirect_uri_shape(parsed): return redirect_netloc = _strip_default_port(parsed.scheme, parsed.netloc) proxy_base = _resolve_proxy_base_for_redirect(request) if _trusted_redirect_uri_is_allowed(parsed, redirect_netloc, proxy_base): return _raise_trusted_redirect_uri_rejected(request, redirect_uri, parsed, redirect_netloc, proxy_base) + + +def canonicalize_url_identity(url: str) -> str: + """Normalize a URL to a comparable identity: lowercase scheme and host, drop the scheme's default + port, and strip userinfo, params, query, fragment and a trailing slash while keeping IPv6 + brackets. The one URL-canonicalization primitive shared by the RFC 8707 resource emitter and the + RFC 8414 issuer/authorize-endpoint comparison, so the default-port and IPv6 rules cannot be + present in one and missing in the other. The netloc (not ``parsed.hostname``) carries the + authority so ``[::1]:8080`` survives with its brackets intact.""" + parsed = urlparse(url) + scheme = parsed.scheme.lower() + netloc = _strip_default_port(scheme, parsed.netloc.rpartition("@")[2]) + return urlunparse((scheme, netloc, parsed.path.rstrip("/"), "", "", "")) + + +def _canonical_resource_uri(url: str) -> str | None: + """Canonicalize an upstream MCP server URL into an RFC 8707 resource identifier. + + Keeps only the scheme, host, port and path, which is the shape the MCP authorization spec's + "Canonical Server URI" section describes and every one of its examples takes; the reference + implementation is ``mcp.shared.auth_utils.resource_url_from_server_url``, and this is the stricter + variant. The scheme and host are lowercased, the scheme's default port is dropped so + ``https://host:443/mcp`` and ``https://host/mcp`` never present as two resources, and a trailing + slash is dropped so ``https://host/mcp/`` and ``https://host/mcp`` do not either. + + Userinfo, query and fragment are dropped rather than carried. A transport URL routinely holds + credentials in exactly those components (``user:password@``, ``?api_key=``), while a resource + indicator names the resource and nothing else; this value is published somewhere the transport + URL never goes, into the authorization redirect the browser follows and into token request + bodies, so carrying them would disclose them to the authorization server, its logs, and browser + history. RFC 8707 forbids a fragment outright and says a resource SHOULD NOT carry a query. An + upstream whose identifier genuinely needs more than this is served by setting + ``upstream_resource`` explicitly, which is passed through untouched. + + Returns ``None`` when the URL is not absolute, which cannot yield a valid resource identifier. + """ + parsed = urlparse(url) + if not parsed.scheme or not parsed.netloc: + return None + return canonicalize_url_identity(url) + + +def resolve_upstream_resource(mcp_server: "MCPServer") -> str | None: + """Resolve the RFC 8707 ``resource`` value this server's upstream OAuth legs must carry. + + The MCP authorization spec requires an MCP client to send ``resource`` on both the + authorization request and every token request, naming the canonical URI of the MCP server the + token is for. Authorization server temperaments are irreconcilable and undetectable, so this + stays an explicit per-server opt-in: most SaaS providers ignore the parameter, some hard-reject + it and express audience through scopes instead, and strict or MCP-native ones refuse to mint a + correctly scoped token without it (``invalid_target``). + + ``None`` or blank omits the parameter, which is the default and preserves the behavior of every + server working today. ``"auto"`` derives the canonical URI from the server's own URL; it is not + an absolute URI, so RFC 8707 guarantees it can never collide with a real resource value. Any + other value is sent verbatim, because the identifier has to match what the authorization server + expects exactly and normalizing it could break that match. + + Every upstream leg for a server resolves through this one function, so the authorize request + and the token requests cannot disagree; a token request naming a resource the authorization + request never asked for is itself an ``invalid_target`` under RFC 8707. + """ + configured = (mcp_server.upstream_resource or "").strip() + if not configured: + return None + if configured.lower() != UPSTREAM_RESOURCE_AUTO: + return configured + if not mcp_server.url: + verbose_logger.warning( + "MCP server %s sets upstream_resource=auto but has no url to derive a resource " + "identifier from; omitting the RFC 8707 resource parameter. Set upstream_resource to " + "the exact resource identifier the authorization server expects instead.", + mcp_server.server_id, + ) + return None + canonical = _canonical_resource_uri(mcp_server.url) + if canonical is None: + verbose_logger.warning( + "MCP server %s sets upstream_resource=auto but its url is not an absolute URI, so no " + "RFC 8707 resource identifier could be derived; omitting the resource parameter", + mcp_server.server_id, + ) + return canonical + + +def build_upstream_oauth2_token_request( + mcp_server: "MCPServer", + *, + auth_method: object, + client_id: str | None, + client_secret: str | None, +) -> TokenEndpointClientAuth: + """Client auth plus the RFC 8707 ``resource`` for one upstream plain-OAuth2 token request. + + Resolving both in one call is what stops a leg authenticating without naming the resource its + sibling legs named; the RFC 8693 legs (OBO, id_jag) carry ``audience`` and stay on + ``build_token_endpoint_client_auth``. The client-auth inputs are passed in because a leg may + authenticate as the caller's own client rather than the server's; ``resource`` always comes from + the server, so no leg can choose or forget it. + """ + client_auth = build_token_endpoint_client_auth( + auth_method=normalize_token_endpoint_auth_method(auth_method), + client_id=client_id, + client_secret=client_secret, + ) + resource = resolve_upstream_resource(mcp_server) + if not resource: + return client_auth + return TokenEndpointClientAuth(headers=client_auth.headers, body={**client_auth.body, "resource": resource}) diff --git a/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py b/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py index 1ee300be718..0b795057837 100644 --- a/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py +++ b/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py @@ -62,6 +62,14 @@ _request_extra_headers: contextvars.ContextVar[Optional[Dict[str, str]]] = conte "_request_extra_headers", default=None ) +# Per-request headers carrying the gateway-resolved upstream credential +# (stored per-user OAuth token, minted M2M token, exchanged OBO token). +# Set from MCPServerManager.resolve_openapi_upstream_auth; authoritative +# over every other Authorization source in _merge_openapi_tool_request_headers. +_request_resolved_auth_headers: contextvars.ContextVar[dict[str, str] | None] = contextvars.ContextVar( + "_request_resolved_auth_headers", default=None +) + def _sanitize_path_parameter_value(param_value: Any, param_name: str) -> str: """Ensure path params cannot introduce directory traversal.""" @@ -294,10 +302,15 @@ def _merge_openapi_tool_request_headers( """Merge static closure headers with per-request ContextVar overrides. Precedence (highest to lowest): - 1. ``_request_auth_header`` — BYOK override of ``Authorization`` - 2. ``static_headers`` — operator-configured headers baked into the + 1. ``_request_resolved_auth_headers`` — the gateway-resolved upstream + credential (stored per-user OAuth token, minted M2M token, + exchanged OBO token). The resolver is authoritative: a BYOK or + forwarded ``Authorization`` must not shadow it, mirroring + ``_resolve_v2_auth`` on the MCPClient path + 2. ``_request_auth_header`` — BYOK override of ``Authorization`` + 3. ``static_headers`` — operator-configured headers baked into the tool closure at registration time - 3. ``_request_extra_headers`` — per-request headers forwarded from + 4. ``_request_extra_headers`` — per-request headers forwarded from the MCP caller (allowlisted by ``MCPServer.extra_headers``) This matches the existing MCP invariant in @@ -323,6 +336,12 @@ def _merge_openapi_tool_request_headers( del effective_headers[existing] effective_headers["Authorization"] = override_auth + resolved_auth_headers = _request_resolved_auth_headers.get() or {} + for name, value in resolved_auth_headers.items(): + for existing in [k for k in effective_headers if k.lower() == name.lower()]: + del effective_headers[existing] + effective_headers[name] = value + return effective_headers diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/__init__.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/__init__.py index 73166a45d6e..2bdb8770e4e 100644 --- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/__init__.py +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/__init__.py @@ -31,10 +31,14 @@ from litellm.proxy._experimental.mcp_server.outbound_credentials.types import ( AwsCredentialSource, AwsSigV4Config, Byok, + ClientAuth, ClientCredentialsConfig, + ClientSecretAuth, CredError, + IdJagConfig, NoneConfig, PassthroughConfig, + PrivateKeyJwtAuth, ServerSpec, SharedKey, StaticKeys, @@ -59,6 +63,10 @@ __all__ = [ "AuthorizationCodeConfig", "ClientCredentialsConfig", "TokenExchangeConfig", + "IdJagConfig", + "ClientAuth", + "PrivateKeyJwtAuth", + "ClientSecretAuth", "ApiKeyConfig", "ApiKeySource", "SharedKey", diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/adapter.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/adapter.py index e87e8081ced..efaa7b742c2 100644 --- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/adapter.py +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/adapter.py @@ -18,12 +18,18 @@ from fastapi import HTTPException from pydantic import SecretStr from typing_extensions import assert_never +from litellm.proxy._experimental.mcp_server.oauth_utils import resolve_upstream_resource from litellm.proxy._experimental.mcp_server.outbound_credentials.types import ( ApiKeyConfig, AuthorizationCodeConfig, + ClientAuth, + ClientCredentialsConfig, + ClientSecretAuth, CredError, + IdJagConfig, NoneConfig, PassthroughConfig, + PrivateKeyJwtAuth, ServerSpec, SharedKey, Subject, @@ -35,6 +41,9 @@ if TYPE_CHECKING: from litellm.proxy._types import UserAPIKeyAuth from litellm.types.mcp_server.mcp_server_manager import MCPServer +_TOKEN_EXCHANGE_SUBJECT_TOKEN_DEFAULT = "urn:ietf:params:oauth:token-type:access_token" +_ID_JAG_SUBJECT_TOKEN_DEFAULT = "urn:ietf:params:oauth:token-type:id_token" + def to_subject(user_api_key_auth: Optional[UserAPIKeyAuth], subject_token: Optional[str]) -> Subject: """Map v1's authenticated principal onto the resolver's Subject. @@ -63,10 +72,10 @@ def to_server_spec(server: MCPServer) -> Optional[ServerSpec]: an ``assert_never`` tail, so a newly added auth mode fails the type gate here until it is explicitly mapped or explicitly deferred, rather than silently falling through to v1. Live modes: ``none``, the static-header family (``api_key`` plus the Authorization schemes, - all shared-key), ``oauth2`` per-user tokens (``authorization_code``), ``oauth2_token_exchange`` - (OBO), and the client-forwarded token modes ``true_passthrough`` / ``oauth_delegate`` - (``PassthroughConfig``); client_credentials (M2M), delegated/passthrough oauth2, and SigV4 - return None and stay on v1. + all shared-key), ``oauth2`` per-user tokens (``authorization_code``), ``oauth2`` M2M + (``client_credentials``), ``oauth2_token_exchange`` (OBO), and the client-forwarded token + modes ``true_passthrough`` / ``oauth_delegate`` (``PassthroughConfig``); delegated/passthrough + oauth2 and SigV4 return None and stay on v1. """ if server.is_byok: return None # per-user BYOK source not migrated yet -> defer to v1 (any auth_type) @@ -88,14 +97,9 @@ def to_server_spec(server: MCPServer) -> Optional[ServerSpec]: case MCPAuth.basic: return _shared_key_spec(server, resource, "Authorization", "Basic", encode=True) case MCPAuth.oauth2: - if server.needs_user_oauth_token and not server.delegate_auth_to_upstream: - return ServerSpec( - server_id=server.server_id, - resource=resource, - config=AuthorizationCodeConfig(), - ) - # client_credentials (M2M) and delegate/passthrough oauth2 stay on v1 - return None + return _oauth2_spec(server, resource) + case MCPAuth.oauth2_id_jag: + return _id_jag_spec(server, resource) case MCPAuth.true_passthrough | MCPAuth.oauth_delegate: return ServerSpec(server_id=server.server_id, resource=resource, config=PassthroughConfig()) case MCPAuth.oauth2_token_exchange: @@ -105,6 +109,48 @@ def to_server_spec(server: MCPServer) -> Optional[ServerSpec]: assert_never(auth_type) +def _oauth2_spec(server: MCPServer, resource: str) -> ServerSpec | None: + """Dispatch the oauth2 auth_type across its sub-modes: M2M, gateway-managed interactive, or v1. + + ``client_credentials`` (the explicit ``oauth2_flow`` opt-in) builds the M2M spec, per-user + ``authorization_code`` without upstream delegation builds the interactive spec, and the + delegate/passthrough shapes defer to v1 (None). + """ + if server.has_client_credentials: + return _client_credentials_spec(server, resource) + if server.needs_user_oauth_token and not server.delegate_auth_to_upstream: + return ServerSpec( + server_id=server.server_id, + resource=resource, + config=AuthorizationCodeConfig(), + ) + return None + + +def _client_credentials_spec(server: MCPServer, resource: str) -> ServerSpec: + """Build a client_credentials (M2M) spec; the explicit ``oauth2_flow`` opt-in owns the server. + + Missing grant fields (``client_id``/``client_secret``/``token_url``) are NOT a reason to defer: + v1 would connect unauthenticated and the upstream's 401 gets absorbed into an empty tool list, + so the arm fails closed with ``misconfigured`` instead, naming the missing fields (mirrors the + OBO ownership rule). ``audience`` is forwarded only when the operator set it; a missing one is + omitted, not derived, since a fabricated value risks the IdP rejecting the grant. + """ + return ServerSpec( + server_id=server.server_id, + resource=resource, + config=ClientCredentialsConfig( + client_id=server.client_id, + client_secret=SecretStr(server.client_secret) if server.client_secret else None, + token_url=server.token_url, + scopes=tuple(server.scopes or ()), + audience=server.audience, + upstream_resource=resolve_upstream_resource(server), + token_endpoint_auth_method=server.token_endpoint_auth_method, + ), + ) + + def _token_exchange_spec(server: MCPServer, resource: str) -> Optional[ServerSpec]: """Build a token_exchange (OBO) spec, or defer (None) when it is not OBO-configured. @@ -167,6 +213,58 @@ def _shared_key_spec( ) +def _id_jag_spec(server: MCPServer, resource: str) -> Optional[ServerSpec]: + """Build an ID-JAG spec from the v1 server's raw fields, or defer (None) if half-configured. + + The enum already routes here, but a server missing an endpoint, ``client_id``, or any client-auth + secret would make ``IdJagConfig`` raise at construction; returning None instead defers to v1 so a + partially configured server does not 500. ``token_exchange_endpoint`` is leg 1 (the IdP org AS); + leg 2 is ``id_jag_resource_token_endpoint`` (the upstream resource AS). + """ + org_token_endpoint = server.token_exchange_endpoint + resource_token_endpoint = server.id_jag_resource_token_endpoint + client_id = server.client_id + client_auth = _id_jag_client_auth(server) + if not org_token_endpoint or not resource_token_endpoint or not client_id or client_auth is None: + return None + return ServerSpec( + server_id=server.server_id, + resource=resource, + config=IdJagConfig( + org_token_endpoint=org_token_endpoint, + resource_token_endpoint=resource_token_endpoint, + client_id=client_id, + client_auth=client_auth, + subject_token_type=_id_jag_subject_token_type(server), + audience=server.audience, + resource=server.id_jag_resource, + scopes=tuple(server.scopes or ()), + ), + ) + + +def _id_jag_client_auth(server: MCPServer) -> Optional[ClientAuth]: + """Private-key JWT when a key is configured, else client_secret, else None (defer to v1).""" + if server.client_private_key: + return PrivateKeyJwtAuth( + private_key=SecretStr(server.client_private_key), + key_id=server.client_private_key_id, + signing_alg=server.client_assertion_signing_alg, + ) + if server.client_secret: + return ClientSecretAuth(client_secret=SecretStr(server.client_secret)) + return None + + +def _id_jag_subject_token_type(server: MCPServer) -> str: + """ID-JAG asserts the user's id_token, so the token-exchange access_token default maps to id_token; + an explicitly configured value (e.g. a SAML2 assertion type) is honored verbatim.""" + configured = server.subject_token_type + if configured and configured != _TOKEN_EXCHANGE_SUBJECT_TOKEN_DEFAULT: + return configured + return _ID_JAG_SUBJECT_TOKEN_DEFAULT + + def raise_public(error: CredError) -> NoReturn: """Map a resolver CredError onto the proxy's public HTTP contract. The one edge that raises.""" match error.tag: diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/authz_code_refresher.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/authz_code_refresher.py index 977fe9c38aa..1d7fcf5afbc 100644 --- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/authz_code_refresher.py +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/authz_code_refresher.py @@ -17,8 +17,8 @@ from typing import TYPE_CHECKING, Protocol from litellm._logging import verbose_logger from litellm.proxy._experimental.mcp_server.auth.token_endpoint_auth import ( TokenEndpointAuthConfigError, - build_token_endpoint_client_auth, ) +from litellm.proxy._experimental.mcp_server.oauth_utils import build_upstream_oauth2_token_request from litellm.proxy._experimental.mcp_server.outbound_credentials.oauth_token_store import ( OAuthToken, ) @@ -92,7 +92,8 @@ class AuthorizationCodeRefresher: return None try: - client_auth = build_token_endpoint_client_auth( + token_request = build_upstream_oauth2_token_request( + server, auth_method=server.token_endpoint_auth_method, client_id=server.client_id, client_secret=server.client_secret, @@ -103,9 +104,9 @@ class AuthorizationCodeRefresher: form = { "grant_type": "refresh_token", "refresh_token": token.refresh_token, - **client_auth.body, + **token_request.body, } - body = await self._token_endpoint(server.token_url, form, client_auth.headers) + body = await self._token_endpoint(server.token_url, form, token_request.headers) if body is None: return None access_token = body.get("access_token") diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py new file mode 100644 index 00000000000..c352f3a683e --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py @@ -0,0 +1,243 @@ +"""Producer and consumer helpers for the DCR-bridge ``oauth_delegate`` envelope. + +A DCR-bridge ``oauth_delegate`` client presents ONE bearer that is a litellm-signed +envelope (see :mod:`.envelope`) carrying both a litellm identity and the upstream OAuth +token. The gateway token endpoint mints it (producer) at OAuth issuance, and at the MCP +admission edge the gateway derives the envelope keys from the proxy ``master_key``, opens +it, admits the request under the recovered identity, and forwards the inner upstream token +to the upstream MCP server (consumer). This module is the pure surface for both sides; the +token-endpoint and admission wiring live in their respective call sites. +""" + +import hashlib +from datetime import datetime +from functools import lru_cache +from typing import Literal, TypeAlias + +from pydantic import BaseModel, ConfigDict, SecretStr + +from litellm.proxy._experimental.mcp_server.outbound_credentials.envelope import ( + EnvelopeIdentity, + EnvelopeKeys, + EnvelopeMintError, + OpenedEnvelope, + OpenedRefreshEnvelope, + RefreshCredential, + SealedEnvelope, + UpstreamTokenGrant, + is_envelope, + is_refresh_envelope, + mint_envelope, + mint_refresh_envelope, + open_envelope, + open_refresh_envelope, +) + +_SIGNING_KEY_DOMAIN = b"litellm-mcp-bridge:envelope-signing:" +_ENCRYPTION_KEY_DOMAIN = b"litellm-mcp-bridge:envelope-encryption:" + +# scrypt work factors (RFC 7914). n=2**15 with r=8/p=1 costs ~50ms and ~32MB per derivation, which +# makes offline guessing of a candidate master key memory-hard rather than a bare hash comparison. +_SCRYPT_N = 2**15 +_SCRYPT_R = 8 +_SCRYPT_P = 1 +# scrypt's working-set is ~128 * N * r * p bytes; cap at twice that so the maxmem ceiling scales +# with every work factor and a future p or r bump does not trip "memory limit exceeded". +_SCRYPT_MAXMEM = 128 * _SCRYPT_N * _SCRYPT_R * _SCRYPT_P * 2 +_DERIVED_KEY_BYTES = 32 + + +@lru_cache(maxsize=8) +def envelope_keys_from_master_key(master_key: str) -> EnvelopeKeys: + """Derive the envelope signing and encryption keys from the proxy master key. + + A memory-hard scrypt KDF (RFC 7914) over two distinct domain-label salts yields two + independent 256-bit subkeys from the one secret, so the producer (mint) and consumer + (open) agree on keys without persisting any. scrypt is used rather than a bare hash or + HMAC so that a captured envelope is not a cheap offline oracle for the master key: each + candidate guess costs a full memory-hard derivation, which is what protects a deployment + whose master key is weaker than it should be. The result is cached (the master key is + fixed for a process), so the KDF runs once per key and adds nothing to the per-request + admission path. The derivation is deterministic; rotating ``master_key`` invalidates + every outstanding envelope, which is the intended behavior for a signing-key change. + """ + signing = hashlib.scrypt( + master_key.encode(), + salt=_SIGNING_KEY_DOMAIN, + n=_SCRYPT_N, + r=_SCRYPT_R, + p=_SCRYPT_P, + maxmem=_SCRYPT_MAXMEM, + dklen=_DERIVED_KEY_BYTES, + ).hex() + encryption = hashlib.scrypt( + master_key.encode(), + salt=_ENCRYPTION_KEY_DOMAIN, + n=_SCRYPT_N, + r=_SCRYPT_R, + p=_SCRYPT_P, + maxmem=_SCRYPT_MAXMEM, + dklen=_DERIVED_KEY_BYTES, + ).hex() + return EnvelopeKeys(signing_key=SecretStr(signing), encryption_key=SecretStr(encryption)) + + +def build_bridge_token_response( + identity: EnvelopeIdentity, + grant: UpstreamTokenGrant, + keys: EnvelopeKeys, + now: datetime, +) -> SealedEnvelope | EnvelopeMintError: + """Seal ``grant`` for ``identity`` into the client-held bearer the token endpoint returns. + + The producer mirror of :func:`resolve_bridge_envelope`: a thin, pure wrapper over + :func:`mint_envelope` that returns the sealed envelope, or the mint error as a value + (an oversized grant) for the caller to map onto an OAuth error response. + """ + return mint_envelope(identity, grant, keys, now) + + +def build_bridge_refresh_token_response( + identity: EnvelopeIdentity, + refresh: RefreshCredential, + keys: EnvelopeKeys, + now: datetime, +) -> SealedEnvelope | EnvelopeMintError: + """Seal ``refresh`` for ``identity`` into the long-lived refresh envelope the token endpoint returns + alongside the access envelope, so the client can renew without re-authenticating. A thin, pure + wrapper over :func:`mint_refresh_envelope`; returns the mint error as a value for the caller to map. + """ + return mint_refresh_envelope(identity, refresh, keys, now) + + +class BridgeRefreshOpened(BaseModel): + """A valid refresh envelope presented to the token endpoint: the identity to re-validate and renew + under, and the upstream refresh grant to exchange.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["opened"] = "opened" + identity: EnvelopeIdentity + refresh: RefreshCredential + + +class BridgeRefreshInvalid(BaseModel): + """The presented refresh grant is not a valid refresh envelope for this server (not refresh-shaped, + will not open, or minted for a different server); the token endpoint fails the refresh closed.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["invalid"] = "invalid" + + +BridgeRefreshResult: TypeAlias = BridgeRefreshOpened | BridgeRefreshInvalid + + +def open_bridge_refresh_envelope( + refresh_value: str, + keys: EnvelopeKeys, + now: datetime, + expected_server_id: str, +) -> BridgeRefreshResult: + """Open a refresh envelope a bridge ``oauth_delegate`` client presented on a refresh_token grant. + + The token-endpoint mirror of :func:`resolve_bridge_envelope`: strips an optional ``Bearer`` scheme, + then returns ``BridgeRefreshOpened`` with the recovered identity and upstream refresh grant, or + ``BridgeRefreshInvalid`` for anything that is not a valid refresh envelope for this server. Never + raises; total over hostile input via :func:`open_refresh_envelope`. ``expected_server_id`` binds the + envelope to the server the request targets, so a refresh envelope minted for one server cannot renew + against another. A raw upstream refresh token (not envelope-shaped) is ``BridgeRefreshInvalid``: this + mode never hands the client a bare upstream refresh token, so it must never accept one. + """ + candidate = _strip_bearer(refresh_value) + if not is_refresh_envelope(candidate): + return BridgeRefreshInvalid() + opened = open_refresh_envelope(candidate, keys, now) + if not isinstance(opened, OpenedRefreshEnvelope): + return BridgeRefreshInvalid() + if opened.identity.server_id != expected_server_id: + return BridgeRefreshInvalid() + return BridgeRefreshOpened(identity=opened.identity, refresh=opened.refresh) + + +class NotBridgeEnvelope(BaseModel): + """The bearer is not an envelope; admission continues on its normal path.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["not_bridge_envelope"] = "not_bridge_envelope" + + +class BridgeEnvelopeAdmitted(BaseModel): + """A valid envelope: the identity to admit under and the full upstream ``Authorization`` + value (``token_type access_token``) to forward to the upstream MCP server.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["admitted"] = "admitted" + identity: EnvelopeIdentity + upstream_authorization: SecretStr + + +class BridgeEnvelopeInvalid(BaseModel): + """The bearer is envelope-shaped but did not open (expired, tampered, wrong key); + admission must fail closed rather than fall through to normal validation.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["invalid"] = "invalid" + + +BridgeEnvelopeResult: TypeAlias = NotBridgeEnvelope | BridgeEnvelopeAdmitted | BridgeEnvelopeInvalid + + +def _strip_bearer(value: str) -> str: + parts = value.split(None, 1) + if len(parts) == 2 and parts[0].lower() == "bearer": + return parts[1] + return value + + +def is_bridge_envelope_shaped(authorization_value: str) -> bool: + """Cheap, keyless test that an ``Authorization`` value carries an envelope of either kind (optional + ``Bearer`` scheme stripped). The admission edge engages the bridge arm for an access envelope (to + admit) and for a refresh envelope (to reject it explicitly, since a refresh credential is never + usable at the tool-call edge); a plain upstream bearer falls through to normal oauth2 admission.""" + candidate = _strip_bearer(authorization_value) + return is_envelope(candidate) or is_refresh_envelope(candidate) + + +def resolve_bridge_envelope( + authorization_value: str, + keys: EnvelopeKeys, + now: datetime, + expected_server_id: str, +) -> BridgeEnvelopeResult: + """Classify an ``Authorization`` value presented to a bridge ``oauth_delegate`` server. + + Strips an optional ``Bearer`` scheme, then returns ``NotBridgeEnvelope`` for a + non-envelope bearer (normal admission continues), ``BridgeEnvelopeAdmitted`` with the + recovered identity and the upstream ``Authorization`` value to forward for a valid + envelope, and ``BridgeEnvelopeInvalid`` for an envelope-shaped bearer that will not + open. Never raises: it is total over hostile input via :func:`open_envelope`. + + A refresh envelope is ``BridgeEnvelopeInvalid`` here: it is a valid gateway credential but only ever + presented back to the token endpoint, never usable to authenticate a tool call, so admission must + fail it closed rather than let it fall through to another arm. + + ``expected_server_id`` is the ``server_id`` of the MCP server the request targets; an + opened envelope whose sealed ``server_id`` does not match is rejected as + ``BridgeEnvelopeInvalid``. Binding here (rather than leaving it to the caller) prevents + replaying an envelope minted for one server against another, which would forward the + first server's upstream credential across a server boundary. ``server_id`` is not a + secret (the caller targets that server), so a plain equality check is sufficient and, + unlike ``hmac.compare_digest`` on ``str``, does not raise on a non-ASCII server_id. + """ + candidate = _strip_bearer(authorization_value) + if is_refresh_envelope(candidate): + return BridgeEnvelopeInvalid() + if not is_envelope(candidate): + return NotBridgeEnvelope() + opened = open_envelope(candidate, keys, now) + if not isinstance(opened, OpenedEnvelope): + return BridgeEnvelopeInvalid() + if opened.identity.server_id != expected_server_id: + return BridgeEnvelopeInvalid() + grant = opened.grant + upstream_authorization = f"{grant.token_type} {grant.access_token.get_secret_value()}" + return BridgeEnvelopeAdmitted(identity=opened.identity, upstream_authorization=SecretStr(upstream_authorization)) diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/client_credentials.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/client_credentials.py new file mode 100644 index 00000000000..225b7edb547 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/client_credentials.py @@ -0,0 +1,350 @@ +"""The ``client_credentials`` (M2M) arm's token source and retrying bearer auth. + +Implements the client-credentials behavior contract for the v2 resolver: + +- **Acquisition**: POST ``grant_type=client_credentials`` to the configured token endpoint with + the configured scopes and (when set) the IdP's ``audience`` parameter, authenticating the + client per ``token_endpoint_auth_method`` (RFC 6749 section 2.3.1, shared helper). +- **Caching**: tokens are cached per ``(client identity, server)`` where the identity key hashes + ``token_url`` / ``client_id`` / ``client_secret`` / auth method / scopes / audience — rotating + or re-scoping the credentials changes the key, so a stale token can never be served for the + new identity (the contract's rotation-invalidation clause). +- **Expiry**: the cache TTL respects ``expires_in`` minus a skew so an entry lapses before the + real token does; a response with no ``expires_in`` is cached briefly + (``default_ttl_seconds``), not assumed long-lived. No refresh_token is ever expected. +- **401 recovery**: ``ClientCredentialsBearerAuth`` retries an upstream request exactly once + after a 401 — discard the cached token, mint a fresh one, resend; a second failure surfaces + the upstream's own auth error unchanged. +- **No user context**: nothing here reads a ``Subject``; every caller shares the one client + identity. + +The token-endpoint POST is injected (``M2MTokenEndpointPost``) so the grant orchestration is +testable without a live IdP; ``post_client_credentials_grant`` is the httpx edge and the one +place the untyped response boundary is contained. Failures are values: the source returns +``Result[OAuthToken, CredError]``; only the httpx edge touches exceptions. +""" + +from __future__ import annotations + +import asyncio +import hashlib +import time +from collections.abc import AsyncGenerator, Awaitable, Callable, Generator +from dataclasses import dataclass +from typing import Annotated, Literal + +import httpx +from pydantic import BaseModel, ConfigDict, Field, SecretStr, TypeAdapter, ValidationError +from typing_extensions import assert_never + +from litellm.proxy._experimental.mcp_server.outbound_credentials.oauth_token_store import ( + InMemoryTokenCacheBackend, + OAuthToken, + TokenCacheBackend, +) +from litellm.proxy._experimental.mcp_server.outbound_credentials.result import ( + Error, + Ok, + Result, +) +from litellm.proxy._experimental.mcp_server.outbound_credentials.types import ( + ClientCredentialsConfig, + CredError, +) + + +class TokenEndpointSuccess(BaseModel): + """The endpoint returned a JSON object; field validation is the caller's job.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["success"] = "success" + body: dict[str, object] + + +class TokenEndpointDenied(BaseModel): + """The endpoint answered but did not grant a token (an HTTP error or a non-JSON body).""" + + model_config = ConfigDict(frozen=True) + tag: Literal["denied"] = "denied" + status_code: int + detail: str + + +class TokenEndpointUnreachable(BaseModel): + """The endpoint could not be reached (DNS, TLS, connect/read failure).""" + + model_config = ConfigDict(frozen=True) + tag: Literal["unreachable"] = "unreachable" + detail: str + + +TokenEndpointOutcome = Annotated[ + TokenEndpointSuccess | TokenEndpointDenied | TokenEndpointUnreachable, + Field(discriminator="tag"), +] + +M2MTokenEndpointPost = Callable[[str, "dict[str, str]", "dict[str, str]"], Awaitable[TokenEndpointOutcome]] + + +_TOKEN_BODY_ADAPTER: TypeAdapter[dict[str, object]] = TypeAdapter(dict[str, object]) + + +async def post_client_credentials_grant( + url: str, form: dict[str, str], headers: dict[str, str] +) -> TokenEndpointOutcome: + """POST the grant to the token endpoint and classify the transport outcome. + + The httpx edge: litellm's handler is partially typed (and raises ``HTTPStatusError`` itself on + a 4xx/5xx), so the untyped boundary is contained here and every field the caller reads comes + out of a validated ``TokenEndpointOutcome``. + """ + from litellm.llms.custom_httpx.http_handler import ( # noqa: PLC0415 # defer heavy handler import to call time + get_async_httpx_client, # pyright: ignore[reportUnknownVariableType] # handler is partially typed + ) + from litellm.types.llms.custom_http import httpxSpecialProvider # noqa: PLC0415 # deferred with the handler import + + try: + client = get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Check) + response = await client.post( # pyright: ignore[reportUnknownMemberType, reportUnknownVariableType] # handler is partially typed + url, headers={"Accept": "application/json", **headers}, data=form + ) + except httpx.HTTPStatusError as status_err: + status_code = status_err.response.status_code + return TokenEndpointDenied(status_code=status_code, detail=f"token endpoint returned HTTP {status_code}") + except Exception as exc: # noqa: BLE001 # any transport failure is the same outcome: unreachable + return TokenEndpointUnreachable(detail=str(exc)) + if not isinstance(response, httpx.Response): + return TokenEndpointUnreachable(detail="token endpoint returned no response") + try: + body = _TOKEN_BODY_ADAPTER.validate_json(response.content) + except ValidationError: + return TokenEndpointDenied( + status_code=response.status_code, detail="token endpoint returned a non-JSON-object body" + ) + return TokenEndpointSuccess(body=body) + + +def _parse_expires_in(raw: object) -> int | None: + if isinstance(raw, bool): + return None + if isinstance(raw, int): + return raw + if isinstance(raw, str): + try: + return int(raw) + except ValueError: + return None + return None + + +def _parse_granted_scopes(raw: object) -> tuple[str, ...] | None: + return tuple(raw.split()) if isinstance(raw, str) and raw else None + + +@dataclass(frozen=True, slots=True) +class _PreparedGrant: + """A validated, ready-to-POST grant plus the identity key its token caches under.""" + + token_url: str + form: dict[str, str] + headers: dict[str, str] + identity_key: str + + +class ClientCredentialsTokenSource: + """Cached M2M access tokens, one per ``(client identity, server)``. + + ``get`` serves from the cache while the entry's TTL (derived from ``expires_in`` minus + ``expiry_skew_seconds``) holds, fetching under a per-server lock so concurrent misses + produce one grant. ``refetch`` is the 401-recovery path: it drops the failed token and + mints a fresh one, unless a concurrent caller already replaced it. + """ + + def __init__( + self, + post: M2MTokenEndpointPost = post_client_credentials_grant, + *, + backend: TokenCacheBackend | None = None, + default_ttl_seconds: float = 300.0, + expiry_skew_seconds: float = 60.0, + min_cache_seconds: float = 10.0, + max_locks: int = 1024, + clock: Callable[[], float] = time.time, + ) -> None: + self._post = post + self._backend: TokenCacheBackend = backend or InMemoryTokenCacheBackend(clock=clock) + self._default_ttl_seconds = default_ttl_seconds + self._expiry_skew_seconds = expiry_skew_seconds + self._min_cache_seconds = min_cache_seconds + self._max_locks = max_locks + self._clock = clock + self._locks: dict[str, asyncio.Lock] = {} + + def _lock(self, server_id: str) -> asyncio.Lock: + """Per-server single-flight lock, bounded so ephemeral server ids (e.g. the REST tools + preview mints a fresh id per call) cannot grow the dict for the life of the process. + Evicting the oldest entry while a task still holds it only means a concurrent caller for + that server may run its own grant — single-flight is an optimization, not correctness. + """ + if server_id not in self._locks and len(self._locks) >= self._max_locks: + self._locks.pop(next(iter(self._locks)), None) + return self._locks.setdefault(server_id, asyncio.Lock()) + + async def get(self, server_id: str, config: ClientCredentialsConfig) -> Result[OAuthToken, CredError]: + match _prepare_grant(config): + case Error(err): + return Error(err) + case Ok(grant): + cached = await self._backend.get(grant.identity_key, server_id) + if cached is not None: + return Ok(cached) + async with self._lock(server_id): + cached = await self._backend.get(grant.identity_key, server_id) + if cached is not None: + return Ok(cached) + return await self._fetch_and_cache(server_id, grant) + + async def refetch(self, server_id: str, config: ClientCredentialsConfig, failed_access_token: str) -> str | None: + """Replace a token the upstream just 401'd; returns the fresh bearer value or ``None``. + + Runs under the same per-server lock as ``get``: if a concurrent caller already replaced + the failed token, that replacement is returned without another grant, so a burst of 401s + yields one fetch. A failed refetch returns ``None`` and the caller surfaces the + upstream's original auth error (the contract's retry-once-then-give-up clause). + """ + match _prepare_grant(config): + case Error(_): + return None + case Ok(grant): + async with self._lock(server_id): + cached = await self._backend.get(grant.identity_key, server_id) + if cached is not None and cached.access_token != failed_access_token: + return cached.access_token + await self._backend.delete(grant.identity_key, server_id) + match await self._fetch_and_cache(server_id, grant): + case Ok(token): + return token.access_token + case Error(_): + return None + + async def _fetch_and_cache(self, server_id: str, grant: _PreparedGrant) -> Result[OAuthToken, CredError]: + outcome = await self._post(grant.token_url, grant.form, grant.headers) + match outcome: + case TokenEndpointUnreachable(): + return Error(CredError.of_upstream_unavailable(f"OAuth2 token endpoint unreachable: {outcome.detail}")) + case TokenEndpointDenied(): + if outcome.status_code >= 500: + return Error(CredError.of_upstream_unavailable(f"OAuth2 token endpoint failed: {outcome.detail}")) + return Error(CredError.of_misconfigured(f"OAuth2 client_credentials grant rejected: {outcome.detail}")) + case TokenEndpointSuccess(): + return await self._cache_token(server_id, grant, outcome.body) + assert_never(outcome) + + async def _cache_token( + self, server_id: str, grant: _PreparedGrant, body: dict[str, object] + ) -> Result[OAuthToken, CredError]: + access_token = body.get("access_token") + if not isinstance(access_token, str) or not access_token: + return Error(CredError.of_misconfigured("OAuth2 token response is missing 'access_token'")) + expires_in = _parse_expires_in(body.get("expires_in")) + token = OAuthToken( + access_token=access_token, + expires_at=self._clock() + expires_in if expires_in is not None else None, + scopes=_parse_granted_scopes(body.get("scope")) or (), + ) + # The min-cache floor is itself capped at the token's real lifetime, so a token whose + # expires_in is below the skew is never served past its actual expiry; a non-positive + # expires_in caches nothing (every request re-fetches, serialized by the per-server lock). + ttl = ( + max(expires_in - self._expiry_skew_seconds, min(float(expires_in), self._min_cache_seconds), 0.0) + if expires_in is not None + else self._default_ttl_seconds + ) + if ttl > 0: + await self._backend.set(grant.identity_key, server_id, token, ttl) + return Ok(token) + + +def _prepare_grant(config: ClientCredentialsConfig) -> Result[_PreparedGrant, CredError]: + if not config.client_id or not config.client_secret or not config.token_url: + missing = ", ".join( + name + for name, present in ( + ("client_id", bool(config.client_id)), + ("client_secret", bool(config.client_secret)), + ("token_url", bool(config.token_url)), + ) + if not present + ) + return Error(CredError.of_misconfigured(f"client_credentials config is missing: {missing}")) + + from litellm.proxy._experimental.mcp_server.auth.token_endpoint_auth import ( # noqa: PLC0415 # keep package v1-free at import time + build_token_endpoint_client_auth, + ) + + client_auth = build_token_endpoint_client_auth( + auth_method=config.token_endpoint_auth_method, + client_id=config.client_id, + client_secret=config.client_secret.get_secret_value(), + ) + form = { + "grant_type": "client_credentials", + **client_auth.body, + **({"scope": " ".join(config.scopes)} if config.scopes else {}), + **({"audience": config.audience} if config.audience else {}), + **({"resource": config.upstream_resource} if config.upstream_resource else {}), + } + return Ok( + _PreparedGrant( + token_url=config.token_url, + form=form, + headers=client_auth.headers, + identity_key=_identity_key(config), + ) + ) + + +def _identity_key(config: ClientCredentialsConfig) -> str: + """Hash of everything that names the client identity; any rotation yields a new key.""" + material = "\n".join( + ( + config.token_url or "", + config.client_id or "", + config.client_secret.get_secret_value() if config.client_secret else "", + config.token_endpoint_auth_method or "", + " ".join(config.scopes), + config.audience or "", + config.upstream_resource or "", + ) + ) + return hashlib.sha256(material.encode("utf-8")).hexdigest() + + +class ClientCredentialsBearerAuth(httpx.Auth): + """Bearer auth that retries an upstream 401 exactly once with a freshly minted token. + + The initial token was already resolved (so config/IdP failures surfaced as typed errors + before any upstream request); ``refetch`` is the source's 401-recovery callback. If the + refetch fails, or the retried request 401s again, the upstream's response stands. + """ + + def __init__(self, access_token: str, refetch: Callable[[str], Awaitable[str | None]]) -> None: + self.header_name = "Authorization" + self._access_token = SecretStr(access_token) + self._refetch = refetch + + async def async_auth_flow(self, request: httpx.Request) -> AsyncGenerator[httpx.Request, httpx.Response]: + token = self._access_token.get_secret_value() + request.headers[self.header_name] = f"Bearer {token}" + response = yield request + if response.status_code != 401: + return + fresh = await self._refetch(token) + if fresh is None: + return + self._access_token = SecretStr(fresh) + request.headers[self.header_name] = f"Bearer {fresh}" + yield request + + def sync_auth_flow(self, request: httpx.Request) -> Generator[httpx.Request, httpx.Response, None]: + raise RuntimeError("ClientCredentialsBearerAuth only supports async httpx clients") diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/envelope.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/envelope.py new file mode 100644 index 00000000000..9118a3e129d --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/envelope.py @@ -0,0 +1,568 @@ +"""Client-held sealed envelope for the oauth_delegate DCR bridge. + +A DCR-bridge client holds ONE bearer that must carry BOTH a litellm identity and the +upstream OAuth grant, with zero server-side storage. The gateway token endpoint mints a +litellm-signed envelope (:func:`mint_envelope`); the MCP edge validates it, recovers the +identity claims and the inner upstream grant (:func:`open_envelope`), and forwards the +inner access token upstream. This module is pure and unwired: it imports nothing from +endpoint or edge code, reads no proxy globals, and takes all key material and the clock +as explicit parameters. + +Wire shape: ``llm_env_`` + an HS256 JWT (same signing approach as the BYOK session +bearer in ``byok_oauth_endpoints.py``). Registered claims are ``iss``/``iat``/``exp``; +custom claims are ``server_id``, ``key_hash``, and ``grant``, where ``grant`` is the +upstream token grant serialized to JSON, encrypted with the repo's symmetric +encryption helpers (``encrypt_value``/``decrypt_value`` from +``encrypt_decrypt_utils`` — the same family ``encrypt_value_helper`` applies to +persisted DCR credentials), and base64url-encoded, so the inner token never appears +in plaintext anywhere in the envelope. + +Failures are values: :func:`open_envelope` returns one of the frozen +``EnvelopeOpenError`` variants (discriminated on ``tag``) for invalid, expired, +tampered, or undecryptable input, and :func:`mint_envelope` returns +``EnvelopeTooLarge`` for oversized grants. Error values carry tags and sizes only, +never token material. + +The pydantic input models reject programmer errors at construction (e.g. a +non-positive ``expires_in`` or an empty required field). :func:`open_envelope` is +additionally total over hostile, attacker-controlled input: it never raises, only +returns an ``EnvelopeOpenError``. :func:`mint_envelope` operates on a +gateway-supplied grant (an upstream IdP's UTF-8 JSON token response), so it does not +defend against non-UTF-8 field content that cannot survive JSON parsing; its only +value-typed failure is ``EnvelopeTooLarge``. +""" + +from __future__ import annotations + +import base64 +from datetime import datetime, timedelta +from typing import Literal, TypeAlias + +import jwt +from pydantic import BaseModel, ConfigDict, Field, SecretStr, ValidationError + +from litellm.proxy.common_utils.encrypt_decrypt_utils import decrypt_value, encrypt_value + +ENVELOPE_PREFIX = "llm_env_" +"""Marker prefix on every serialized ACCESS envelope so the edge can cheaply tell an envelope +from a raw upstream token before doing any cryptography.""" + +REFRESH_ENVELOPE_PREFIX = "llm_refresh_" +"""Marker prefix on every serialized REFRESH envelope. A distinct prefix keeps the two credentials +routable without crypto and, together with the signed ``kind`` claim, stops one from being presented +where the other is expected: a refresh envelope carries a long-lived upstream refresh token and is only +ever presented back to the token endpoint, never forwarded upstream on a tool call.""" + +ENVELOPE_ISSUER = "litellm-mcp-bridge" +"""``iss`` claim stamped into every envelope and required back on open.""" + +MAX_ENVELOPE_TTL_SECONDS = 3600 +"""Hard ceiling on ACCESS envelope lifetime. ``exp`` is ``min(upstream expires_in, this cap)`` +(the cap alone when the upstream omits ``expires_in``), matching the 1h lifetime of the +BYOK session bearer this module's signing approach is borrowed from: a client-held +credential should never outlive a bounded window even when the upstream token does.""" + +MAX_REFRESH_ENVELOPE_TTL_SECONDS = 1209600 +"""Hard ceiling on REFRESH envelope lifetime (14 days). A refresh envelope only renews the short-lived +access envelope, and each renewal re-validates the sealed litellm key (revocation gates it) and is +re-minted with a fresh window, so the practical bound is idle time, not a fixed session. ``exp`` is +``min(upstream refresh_expires_in, this cap)`` (the cap alone when the upstream omits it); if the +upstream refresh token dies first, the next renewal simply fails at the upstream and the client +re-authenticates. The value is deliberately far shorter than a typical upstream refresh-token lifetime +so a leaked refresh envelope is bounded even if the upstream would have honoured it for longer.""" + +MAX_ENVELOPE_BYTES = 12288 +"""Size cap on the final serialized envelope (prefix + JWT, in bytes). Upstream JWTs +commonly run 2-4KB; base64 plus encryption overhead roughly doubles that inside the +envelope, and common proxy/server header limits sit around 16KB total. 12288 leaves +comfortable headroom for a large upstream token while keeping the envelope safely +transmittable as a single Authorization header. Oversized grants are rejected with a +typed error, never truncated.""" + +_ENVELOPE_JWT_ALGORITHM = "HS256" + +EnvelopeKind = Literal["access", "refresh"] +"""Which credential an envelope is. Stamped into the signed claims and required to match on open, so a +signature-valid envelope of one kind cannot be replayed as the other even if its wire prefix is swapped +(the prefix is not part of the signed payload; this claim is).""" + + +EnvelopeSubjectType: TypeAlias = Literal["key_hash", "user_id"] +"""Discriminator for what litellm principal the envelope binds the grant to. + +``key_hash`` is a hashed virtual key (the scripted two-header client mints under the key it +presents at the token endpoint); ``user_id`` is a litellm user subject (the interactive DCR +client mints under the SSO-authenticated user, which is the only identity that browser login +yields). Admission reloads a key record for the first and a user record for the second, then +runs both through the same live-policy gate, so team/org/budget/revocation enforcement is +identical either way.""" + + +class EnvelopeIdentity(BaseModel): + """The litellm principal the envelope binds the inner grant to. + + ``subject`` is the principal identifier and ``subject_type`` says how to resolve it: a + hashed litellm key (``key_hash``) or a litellm user id (``user_id``), never a raw + credential (and the edge rejects a bare hash or id presented as a bearer). Admission + reloads the live record by it, so the principal's current team/org restrictions and its + revocation state are enforced at use time rather than frozen at mint time. ``server_id`` + binds the envelope to one MCP server so it cannot be replayed across a server boundary. + """ + + model_config = ConfigDict(frozen=True) + server_id: str = Field(min_length=1) + subject_type: EnvelopeSubjectType + subject: str = Field(min_length=1) + + +def key_hash_identity(server_id: str, key_hash: str) -> EnvelopeIdentity: + """The identity for the scripted client that mints under a presented virtual key.""" + return EnvelopeIdentity(server_id=server_id, subject_type="key_hash", subject=key_hash) + + +def user_identity(server_id: str, user_id: str) -> EnvelopeIdentity: + """The identity for the interactive DCR client that mints under its SSO user subject.""" + return EnvelopeIdentity(server_id=server_id, subject_type="user_id", subject=user_id) + + +class UpstreamTokenGrant(BaseModel): + """The upstream OAuth token response fields sealed inside the envelope. + + ``expires_in`` must be positive when present; a non-positive value is a programmer + error rejected at construction. Token fields are ``SecretStr`` so reprs never leak + them. + """ + + model_config = ConfigDict(frozen=True) + access_token: SecretStr = Field(min_length=1) + token_type: str = Field(min_length=1) + refresh_token: SecretStr | None = None + scope: str | None = None + expires_in: int | None = Field(default=None, gt=0) + + +class RefreshCredential(BaseModel): + """The upstream refresh grant sealed inside a refresh envelope. + + Only the refresh token (plus the scope to re-request and the refresh token's own lifetime, when the + upstream reports it) is sealed; the access token is never in a refresh envelope. ``refresh_token`` is + a ``SecretStr`` so reprs never leak it, and ``expires_in`` (the refresh token's lifetime, not the + access token's) must be positive when present. + """ + + model_config = ConfigDict(frozen=True) + refresh_token: SecretStr = Field(min_length=1) + scope: str | None = None + expires_in: int | None = Field(default=None, gt=0) + + +class EnvelopeKeys(BaseModel): + """Injected key material: the HS256 signing key and the symmetric encryption key. + + ``signing_key`` must be at least 32 bytes: HS256's HMAC-SHA256 has a 256-bit + security level, RFC 7518 requires a key of at least that size, and a shorter key + makes PyJWT emit ``InsecureKeyLengthWarning``. + """ + + model_config = ConfigDict(frozen=True) + signing_key: SecretStr = Field(min_length=32) + encryption_key: SecretStr = Field(min_length=1) + + +class SealedEnvelope(BaseModel): + """A minted envelope: the client-held bearer value and when it expires.""" + + model_config = ConfigDict(frozen=True) + token: SecretStr + expires_at: datetime + + +class OpenedEnvelope(BaseModel): + """A validated access envelope: the identity it was minted for and the recovered grant.""" + + model_config = ConfigDict(frozen=True) + identity: EnvelopeIdentity + grant: UpstreamTokenGrant + + +class OpenedRefreshEnvelope(BaseModel): + """A validated refresh envelope: the identity it was minted for and the recovered refresh grant.""" + + model_config = ConfigDict(frozen=True) + identity: EnvelopeIdentity + refresh: RefreshCredential + + +class EnvelopeTooLarge(BaseModel): + """The serialized envelope exceeded ``MAX_ENVELOPE_BYTES``; carries sizes only.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["envelope_too_large"] = "envelope_too_large" + size_bytes: int + max_bytes: int + + +EnvelopeMintError: TypeAlias = EnvelopeTooLarge + + +class NotAnEnvelope(BaseModel): + """The candidate does not carry the envelope prefix.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["not_an_envelope"] = "not_an_envelope" + + +class BadSignature(BaseModel): + """The JWT signature does not verify under the provided signing key.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["bad_signature"] = "bad_signature" + + +class Expired(BaseModel): + """The envelope's ``exp`` is not in the future relative to the provided ``now``.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["expired"] = "expired" + + +class MalformedPayload(BaseModel): + """The token is not a well-formed envelope: undecodable JWT, wrong issuer, missing + or mistyped claims, or a decrypted grant that fails validation.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["malformed_payload"] = "malformed_payload" + + +class DecryptFailed(BaseModel): + """The signed ``grant`` blob could not be decrypted under the provided key.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["decrypt_failed"] = "decrypt_failed" + + +EnvelopeOpenError: TypeAlias = NotAnEnvelope | BadSignature | Expired | MalformedPayload | DecryptFailed + + +class _EnvelopeClaims(BaseModel): + """Decoded-claims boundary that pins the exact shape :func:`mint_envelope` emits. + + ``server_id``/``key_hash`` mirror the ``min_length`` constraints of + :class:`EnvelopeIdentity` so any claim set that validates here also constructs an + identity, keeping :func:`open_envelope` raise-free: a correctly signed JWT with an + empty identity claim fails here and maps to ``MalformedPayload``. + + ``strict`` rejects coerced types (``exp: "123"``, ``exp: 123.0``) rather than opening + on them, and ``extra="forbid"`` rejects any claim the gateway never mints (a hostile + ``nbf``/``aud``/... rides along on a re-signed token). Since PyJWT's own ``iat``/ + ``nbf``/``exp`` validators are disabled at decode (they raise on hostile claim types + and, for ``iat``/``nbf``, compare against the wall clock rather than the injected + ``now``), this model is the sole, total type gate for every registered claim. + """ + + model_config = ConfigDict(frozen=True, strict=True, extra="forbid") + iss: str + iat: int + exp: int + kind: EnvelopeKind + server_id: str = Field(min_length=1) + subject_type: EnvelopeSubjectType + subject: str = Field(min_length=1) + grant: str = Field(min_length=1) + + +class _GrantWire(BaseModel): + model_config = ConfigDict(frozen=True) + access_token: str + token_type: str + refresh_token: str | None = None + scope: str | None = None + expires_in: int | None = None + + +class _RefreshWire(BaseModel): + model_config = ConfigDict(frozen=True) + refresh_token: str + scope: str | None = None + expires_in: int | None = None + + +def is_envelope(candidate: str) -> bool: + """Cheap prefix check for an ACCESS envelope so the edge can route envelopes vs raw tokens without + crypto. A refresh envelope has a different prefix and is not an access envelope.""" + return candidate.startswith(ENVELOPE_PREFIX) + + +def is_refresh_envelope(candidate: str) -> bool: + """Cheap prefix check for a REFRESH envelope so the token endpoint can route a refresh grant that + carries an envelope vs a raw upstream refresh token without crypto.""" + return candidate.startswith(REFRESH_ENVELOPE_PREFIX) + + +def mint_envelope( + identity: EnvelopeIdentity, + grant: UpstreamTokenGrant, + keys: EnvelopeKeys, + now: datetime, +) -> SealedEnvelope | EnvelopeMintError: + """Seal ``grant`` for ``identity`` into a client-held envelope. + + ``exp`` is ``min(grant.expires_in, MAX_ENVELOPE_TTL_SECONDS)`` seconds from ``now`` + (the cap alone when ``expires_in`` is absent). Returns ``EnvelopeTooLarge`` when the + serialized envelope exceeds ``MAX_ENVELOPE_BYTES``. + """ + expires_at = now + timedelta(seconds=_envelope_ttl_seconds(grant.expires_in)) + return _seal( + kind="access", + prefix=ENVELOPE_PREFIX, + identity=identity, + grant_blob=_encrypt_grant_blob(_grant_plaintext(grant), keys.encryption_key), + expires_at=expires_at, + signing_key=keys.signing_key, + now=now, + ) + + +def open_envelope( + candidate: str, + keys: EnvelopeKeys, + now: datetime, +) -> OpenedEnvelope | EnvelopeOpenError: + """Validate ``candidate`` and recover the identity and inner grant. + + Never raises for bad input: every invalid, expired, tampered, or undecryptable + candidate maps to a distinct ``EnvelopeOpenError`` variant. The recovered + ``grant.expires_in`` is the value the upstream reported at mint time and is not + re-derived, so it is stale by up to the envelope's lifetime; callers that need a + live remaining lifetime should use ``now`` against the upstream, not this field. + """ + claims = _open_claims(candidate, prefix=ENVELOPE_PREFIX, expected_kind="access", keys=keys, now=now) + if not isinstance(claims, _EnvelopeClaims): + return claims + grant = _decrypt_grant(claims.grant, keys.encryption_key) + if not isinstance(grant, UpstreamTokenGrant): + return grant + return OpenedEnvelope( + identity=EnvelopeIdentity(server_id=claims.server_id, subject_type=claims.subject_type, subject=claims.subject), + grant=grant, + ) + + +def mint_refresh_envelope( + identity: EnvelopeIdentity, + refresh: RefreshCredential, + keys: EnvelopeKeys, + now: datetime, +) -> SealedEnvelope | EnvelopeMintError: + """Seal ``refresh`` for ``identity`` into a long-lived, client-held refresh envelope. + + ``exp`` is ``min(refresh.expires_in, MAX_REFRESH_ENVELOPE_TTL_SECONDS)`` seconds from ``now`` (the + cap alone when the upstream omits the refresh lifetime). Sealing a distinct ``kind="refresh"`` claim + is what keeps a refresh envelope from ever opening as an access credential at the MCP edge. Returns + ``EnvelopeTooLarge`` when the serialized envelope exceeds ``MAX_ENVELOPE_BYTES``. + """ + expires_at = now + timedelta(seconds=_refresh_ttl_seconds(refresh.expires_in)) + return _seal( + kind="refresh", + prefix=REFRESH_ENVELOPE_PREFIX, + identity=identity, + grant_blob=_encrypt_grant_blob(_refresh_plaintext(refresh), keys.encryption_key), + expires_at=expires_at, + signing_key=keys.signing_key, + now=now, + ) + + +def open_refresh_envelope( + candidate: str, + keys: EnvelopeKeys, + now: datetime, +) -> OpenedRefreshEnvelope | EnvelopeOpenError: + """Validate a refresh ``candidate`` and recover the identity and inner refresh grant. + + Total over hostile input exactly like :func:`open_envelope`: every invalid, expired, tampered, + wrong-kind, or undecryptable candidate maps to a distinct ``EnvelopeOpenError`` variant, never a + raise. The ``kind="refresh"`` claim is required, so an access envelope re-prefixed as a refresh one + is rejected as ``MalformedPayload``. + """ + claims = _open_claims(candidate, prefix=REFRESH_ENVELOPE_PREFIX, expected_kind="refresh", keys=keys, now=now) + if not isinstance(claims, _EnvelopeClaims): + return claims + refresh = _decrypt_refresh(claims.grant, keys.encryption_key) + if not isinstance(refresh, RefreshCredential): + return refresh + return OpenedRefreshEnvelope( + identity=EnvelopeIdentity(server_id=claims.server_id, subject_type=claims.subject_type, subject=claims.subject), + refresh=refresh, + ) + + +def _seal( + kind: EnvelopeKind, + prefix: str, + identity: EnvelopeIdentity, + grant_blob: str, + expires_at: datetime, + signing_key: SecretStr, + now: datetime, +) -> SealedEnvelope | EnvelopeTooLarge: + """Sign the claims for either envelope kind and enforce the size cap. Shared by both mints so the + JWT shape, issuer, and size guard cannot drift between access and refresh envelopes.""" + claims = _EnvelopeClaims( + iss=ENVELOPE_ISSUER, + iat=int(now.timestamp()), + exp=int(expires_at.timestamp()), + kind=kind, + server_id=identity.server_id, + subject_type=identity.subject_type, + subject=identity.subject, + grant=grant_blob, + ) + token = prefix + jwt.encode(claims.model_dump(), signing_key.get_secret_value(), algorithm=_ENVELOPE_JWT_ALGORITHM) + size_bytes = len(token.encode("utf-8")) + if size_bytes > MAX_ENVELOPE_BYTES: + return EnvelopeTooLarge(size_bytes=size_bytes, max_bytes=MAX_ENVELOPE_BYTES) + return SealedEnvelope(token=SecretStr(token), expires_at=expires_at) + + +def _open_claims( + candidate: str, + prefix: str, + expected_kind: EnvelopeKind, + keys: EnvelopeKeys, + now: datetime, +) -> _EnvelopeClaims | EnvelopeOpenError: + """Prefix-route, size-bound, signature-verify, kind-check, and expiry-check an attacker-controlled + candidate, shared by both openers so the security gate is identical for access and refresh. Returns + the validated claims or a distinct ``EnvelopeOpenError``; never raises.""" + if not candidate.startswith(prefix): + return NotAnEnvelope() + # UTF-8 byte length is never below character length, so a character count already over the cap + # rejects an oversize candidate in O(1) without encoding it; the exact byte check then runs only on + # candidates already bounded to <= MAX_ENVELOPE_BYTES characters. + if len(candidate) > MAX_ENVELOPE_BYTES: + return MalformedPayload() + if len(candidate.encode("utf-8", "surrogatepass")) > MAX_ENVELOPE_BYTES: + return MalformedPayload() + claims = _decode_claims(candidate.removeprefix(prefix), keys.signing_key) + if not isinstance(claims, _EnvelopeClaims): + return claims + if claims.kind != expected_kind: + return MalformedPayload() + if now.timestamp() >= claims.exp: + return Expired() + return claims + + +def _envelope_ttl_seconds(upstream_expires_in: int | None) -> int: + if upstream_expires_in is None: + return MAX_ENVELOPE_TTL_SECONDS + return min(upstream_expires_in, MAX_ENVELOPE_TTL_SECONDS) + + +def _refresh_ttl_seconds(upstream_refresh_expires_in: int | None) -> int: + if upstream_refresh_expires_in is None: + return MAX_REFRESH_ENVELOPE_TTL_SECONDS + return min(upstream_refresh_expires_in, MAX_REFRESH_ENVELOPE_TTL_SECONDS) + + +def _grant_plaintext(grant: UpstreamTokenGrant) -> str: + wire = _GrantWire( + access_token=grant.access_token.get_secret_value(), + token_type=grant.token_type, + refresh_token=None if grant.refresh_token is None else grant.refresh_token.get_secret_value(), + scope=grant.scope, + expires_in=grant.expires_in, + ) + return wire.model_dump_json(exclude_none=True) + + +def _refresh_plaintext(refresh: RefreshCredential) -> str: + wire = _RefreshWire( + refresh_token=refresh.refresh_token.get_secret_value(), + scope=refresh.scope, + expires_in=refresh.expires_in, + ) + return wire.model_dump_json(exclude_none=True) + + +def _decode_claims( + compact: str, + signing_key: SecretStr, +) -> _EnvelopeClaims | BadSignature | MalformedPayload: + """Verify the HS256 signature and shape of an attacker-controlled compact JWT. + + ``compact`` is fully hostile and bounded to ``MAX_ENVELOPE_BYTES`` by the caller. + PyJWT's ``iat``/``nbf``/``exp`` validators are disabled: they raise on hostile claim + types and, for ``iat``/``nbf``, compare against the wall clock rather than the + injected ``now`` (``exp`` is checked by the caller against ``now``). Apart from a + signature mismatch (``BadSignature``), every decode failure is ``MalformedPayload``: + a non-UTF-8 candidate surfaces as ``UnicodeEncodeError`` (a ``ValueError``), a + non-string registered claim such as ``iss`` as a ``TypeError`` from PyJWT's claim + validators, and a wrong issuer or structurally invalid token as an + ``InvalidTokenError``. ``_EnvelopeClaims`` is the total type gate for the payload. + """ + try: + payload = jwt.decode( + compact, + signing_key.get_secret_value(), + algorithms=[_ENVELOPE_JWT_ALGORITHM], + issuer=ENVELOPE_ISSUER, + options={ + "verify_exp": False, + "verify_iat": False, + "verify_nbf": False, + "require": ["iss", "iat", "exp"], + }, + ) + except jwt.InvalidSignatureError: + return BadSignature() + except (jwt.InvalidTokenError, ValueError, TypeError): + return MalformedPayload() + try: + return _EnvelopeClaims.model_validate(payload) + except ValidationError: + return MalformedPayload() + + +def _encrypt_grant_blob(plaintext: str, encryption_key: SecretStr) -> str: + ciphertext = bytes(encrypt_value(value=plaintext, signing_key=encryption_key.get_secret_value())) + return base64.urlsafe_b64encode(ciphertext).decode("ascii") + + +def _decrypt_grant( + blob: str, + encryption_key: SecretStr, +) -> UpstreamTokenGrant | DecryptFailed | MalformedPayload: + from nacl.exceptions import CryptoError + + try: + plaintext = decrypt_value( + value=base64.urlsafe_b64decode(blob), + signing_key=encryption_key.get_secret_value(), + ) + except (CryptoError, ValueError): + return DecryptFailed() + try: + return UpstreamTokenGrant.model_validate_json(plaintext) + except ValidationError: + return MalformedPayload() + + +def _decrypt_refresh( + blob: str, + encryption_key: SecretStr, +) -> RefreshCredential | DecryptFailed | MalformedPayload: + from nacl.exceptions import CryptoError + + try: + plaintext = decrypt_value( + value=base64.urlsafe_b64decode(blob), + signing_key=encryption_key.get_secret_value(), + ) + except (CryptoError, ValueError): + return DecryptFailed() + try: + return RefreshCredential.model_validate_json(plaintext) + except ValidationError: + return MalformedPayload() diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/per_user_oauth_store.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/per_user_oauth_store.py index 21001c09f25..3a2c748bb82 100644 --- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/per_user_oauth_store.py +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/per_user_oauth_store.py @@ -11,7 +11,7 @@ collaborators acquire their globals per call, mirroring v1's lazy-import pattern from __future__ import annotations import asyncio -from collections.abc import Callable +from collections.abc import Callable, Mapping from typing import TYPE_CHECKING from litellm._logging import verbose_logger @@ -54,7 +54,7 @@ ServerLookup = Callable[[str], "MCPServer | None"] StoreBuilder = Callable[[ServerLookup], tuple[InvalidatableOAuthTokenStore, bool]] -async def _read_credential(user_id: str, server_id: str) -> dict[str, object] | None: +async def _read_credential(user_id: str, server_id: str) -> Mapping[str, object] | None: from litellm.proxy._experimental.mcp_server.db import ( # noqa: PLC0415 get_user_oauth_credential, ) diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/resolver.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/resolver.py index ecfd471190c..69984a56311 100644 --- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/resolver.py +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/resolver.py @@ -9,16 +9,24 @@ at runtime instead of returning `None`. `none`, `api_key` (shared-key source), and `passthrough` (forwards the caller's own inbound token) are live, as is `authorization_code`, which reads the user's token from the injected -`OAuthTokenStore`, and `token_exchange`, which swaps the caller's inbound token through the -injected `TokenExchanger`. The remaining arms are `not_implemented` stubs that each land in a -follow-up PR with their seam. Pure v2: no imports from v1. +`OAuthTokenStore`, `token_exchange`, which swaps the caller's inbound token through the injected +`TokenExchanger`, and `client_credentials`, which mints and caches the gateway's M2M token through +the injected `ClientCredentialsTokenSource`. The remaining arms are `not_implemented` stubs that +each land in a follow-up PR with their seam. Pure v2: no imports from v1. """ from __future__ import annotations +import hashlib +from functools import partial + import httpx from typing_extensions import assert_never +from litellm.proxy._experimental.mcp_server.outbound_credentials.client_credentials import ( + ClientCredentialsBearerAuth, + ClientCredentialsTokenSource, +) from litellm.proxy._experimental.mcp_server.outbound_credentials.httpx_auth import ( NoOpAuth, StaticHeaderAuth, @@ -33,6 +41,11 @@ from litellm.proxy._experimental.mcp_server.outbound_credentials.result import ( Ok, Result, ) +from litellm.proxy._experimental.mcp_server.outbound_credentials.token_endpoint import ( + ExchangedToken, + ExchangedTokenCache, + TokenEndpointClient, +) from litellm.proxy._experimental.mcp_server.outbound_credentials.token_exchanger import ( TokenExchanger, ) @@ -42,16 +55,24 @@ from litellm.proxy._experimental.mcp_server.outbound_credentials.types import ( AuthSpecKind, AwsSigV4Config, Byok, + ClientAuth, ClientCredentialsConfig, + ClientSecretAuth, CredError, + IdJagConfig, NoneConfig, PassthroughConfig, + PrivateKeyJwtAuth, ServerSpec, SharedKey, Subject, TokenExchangeConfig, ) +_TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange" +_JWT_BEARER_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer" +_ID_JAG_REQUESTED_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:id-jag" + class _NullOAuthTokenStore: """Fail-closed default: with no token store wired, every user reads as not authorized.""" @@ -87,9 +108,15 @@ class UpstreamCredentialProvider: self, oauth_token_store: OAuthTokenStore | None = None, token_exchanger: TokenExchanger | None = None, + token_endpoint: TokenEndpointClient | None = None, + exchanged_tokens: ExchangedTokenCache | None = None, + client_credentials_source: ClientCredentialsTokenSource | None = None, ) -> None: self._oauth_token_store: OAuthTokenStore = oauth_token_store or _NullOAuthTokenStore() self._token_exchanger: TokenExchanger = token_exchanger or _NullTokenExchanger() + self._token_endpoint: TokenEndpointClient = token_endpoint or TokenEndpointClient() + self._exchanged_tokens: ExchangedTokenCache = exchanged_tokens or ExchangedTokenCache() + self._client_credentials_source = client_credentials_source or ClientCredentialsTokenSource() async def resolve_credentials(self, subject: Subject, server: ServerSpec) -> Result[httpx.Auth, CredError]: match server.config: @@ -99,10 +126,12 @@ class UpstreamCredentialProvider: return self._api_key(config) case PassthroughConfig(): return self._passthrough(subject) - case ClientCredentialsConfig(): - return _not_implemented(AuthSpecKind.client_credentials) + case ClientCredentialsConfig() as config: + return await self._client_credentials(server.server_id, config) case TokenExchangeConfig() as config: return await self._token_exchange(subject, server, config) + case IdJagConfig() as config: + return await self._id_jag(subject, server, config) case AuthorizationCodeConfig(): return await self._authorization_code(subject, server) case AwsSigV4Config(): @@ -141,12 +170,76 @@ class UpstreamCredentialProvider: return Error(CredError.of_not_implemented("api_key BYOK source not implemented yet")) assert_never(config.key_source) + async def _id_jag(self, subject: Subject, server: ServerSpec, config: IdJagConfig) -> Result[httpx.Auth, CredError]: + if subject.inbound_token is None: + return Error( + CredError.of_precondition_required( + "ID-JAG requires a caller identity token; it asserts the calling " + "user's identity upstream and cannot use a static credential." + ) + ) + token = subject.inbound_token.get_secret_value() + cache_key = _id_jag_cache_key(token, server.server_id, config) + + async def _exchange() -> Result[ExchangedToken, CredError]: + leg1_params = { + "grant_type": _TOKEN_EXCHANGE_GRANT_TYPE, + "requested_token_type": _ID_JAG_REQUESTED_TOKEN_TYPE, + "subject_token": token, + "subject_token_type": config.subject_token_type, + **({"audience": config.audience} if config.audience else {}), + **({"resource": config.resource} if config.resource else {}), + **({"scope": " ".join(config.scopes)} if config.scopes else {}), + } + match await self._token_endpoint.fetch( + config.org_token_endpoint, + config.client_id, + leg1_params, + config.client_auth, + ): + case Error(err): + return Error(err) + case Ok(id_jag): + leg2_params = { + "grant_type": _JWT_BEARER_GRANT_TYPE, + "assertion": id_jag.access_token, + } + return await self._token_endpoint.fetch( + config.resource_token_endpoint, + config.client_id, + leg2_params, + config.client_auth, + ) + + match await self._exchanged_tokens.get_or_compute(cache_key, _exchange): + case Ok(access_token): + return Ok(StaticHeaderAuth(f"Bearer {access_token}")) + case Error(err): + return Error(err) + async def _authorization_code(self, subject: Subject, server: ServerSpec) -> Result[StaticHeaderAuth, CredError]: token = await self._authz_token(subject, server) if token is None: return Error(CredError.of_unauthorized("Authorization required: complete the OAuth flow for this server.")) return Ok(StaticHeaderAuth(f"Bearer {token.access_token}", header_name="Authorization")) + async def _client_credentials( + self, server_id: str, config: ClientCredentialsConfig + ) -> Result[httpx.Auth, CredError]: + """The M2M arm: resolve a cached (or freshly minted) gateway token; no user context. + + The token is resolved here, before any upstream request, so a misconfigured grant or an + unreachable IdP surfaces as a typed ``CredError``. The returned auth carries the source's + ``refetch``, so an upstream 401 is retried exactly once with a freshly minted token (the + contract's invalid-token recovery); a second 401 surfaces the upstream's own error. + """ + match await self._client_credentials_source.get(server_id, config): + case Ok(token): + refetch = partial(self._client_credentials_source.refetch, server_id, config) + return Ok(ClientCredentialsBearerAuth(token.access_token, refetch)) + case Error(err): + return Error(err) + async def _token_exchange( self, subject: Subject, server: ServerSpec, config: TokenExchangeConfig ) -> Result[StaticHeaderAuth, CredError]: @@ -176,13 +269,21 @@ class UpstreamCredentialProvider: """Drop any cached credential the resolver owns for this `(subject, server)`. Used after an upstream rejects the injected credential, so the next resolve re-mints rather - than serving the same rejected token until TTL. Only `token_exchange` holds a re-mintable - cached credential here; other modes are a no-op. + than serving the same rejected token until TTL. `token_exchange` and `id_jag` hold a + re-mintable cached credential here; `client_credentials` recovers inside its own auth flow + (`ClientCredentialsBearerAuth` retries the 401'd request once with a fresh token), and + other modes are a no-op. """ - if isinstance(server.config, TokenExchangeConfig) and subject.inbound_token is not None: + if subject.inbound_token is None: + return + if isinstance(server.config, TokenExchangeConfig): await self._token_exchanger.invalidate( subject.inbound_token.get_secret_value(), server, server.config, tenant_id=subject.tenant_id ) + if isinstance(server.config, IdJagConfig): + self._exchanged_tokens.invalidate( + _id_jag_cache_key(subject.inbound_token.get_secret_value(), server.server_id, server.config) + ) async def _authz_token(self, subject: Subject, server: ServerSpec) -> OAuthToken | None: """The user's authorization_code token, or None when absent or the store is unreachable. @@ -196,5 +297,41 @@ class UpstreamCredentialProvider: return None +def _id_jag_cache_key(subject_token: str, server_id: str, config: IdJagConfig) -> str: + """Bind the cached leg-2 bearer to the caller token, the server, AND the config that minted it. + + Every exchange parameter derives from the config (endpoints, audience, resource, scopes, client + auth), so a server update that changes any of them must change the key; otherwise the old bearer, + authorized under the old policy, keeps being served until its TTL. Everything is hashed, so no + secret is held in the key. + """ + material = "\x00".join( + ( + subject_token, + server_id, + config.org_token_endpoint, + config.resource_token_endpoint, + config.client_id, + _client_auth_fingerprint(config.client_auth), + config.subject_token_type, + config.audience or "", + config.resource or "", + " ".join(config.scopes), + ) + ) + return hashlib.sha256(material.encode()).hexdigest() + + +def _client_auth_fingerprint(client_auth: ClientAuth) -> str: + match client_auth: + case PrivateKeyJwtAuth() as auth: + return "\x00".join( + ("private_key_jwt", auth.private_key.get_secret_value(), auth.key_id or "", auth.signing_alg) + ) + case ClientSecretAuth() as auth: + return "\x00".join(("client_secret", auth.client_secret.get_secret_value())) + assert_never(client_auth) + + def _not_implemented(kind: AuthSpecKind) -> Result[httpx.Auth, CredError]: return Error(CredError.of_not_implemented(f"{kind.value}: resolver arm not implemented yet")) diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py new file mode 100644 index 00000000000..8844d8c8ad0 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py @@ -0,0 +1,191 @@ +"""Producer and consumer helpers for the gateway-level DCR session token. + +The aggregate ``/mcp`` front door (``mcp_gateway_dcr``) issues the identity-only session +tokens defined in :mod:`.session_token`. The gateway token endpoint mints them (producer) +after SSO sign-in, and at the MCP admission edge the gateway derives the session signing +key from the proxy ``master_key``, opens the bearer, and admits the request under the +recovered litellm user (consumer), reloading the live user record and policy before +anything runs. This module is the pure surface for both sides; the token-endpoint and +admission wiring live in their respective call sites. + +The signing key is derived with the same memory-hard scrypt construction as +:func:`~.bridge_credentials.envelope_keys_from_master_key` but under a distinct domain +label, so session tokens and bridge envelopes never share key material: a token of one +family is unverifiable in the other by key separation, on top of the distinct issuers, +prefixes, and claim shapes. +""" + +import hashlib +from datetime import datetime +from functools import lru_cache +from typing import Literal, TypeAlias + +from pydantic import BaseModel, ConfigDict, SecretStr + +from litellm.proxy._experimental.mcp_server.outbound_credentials.session_token import ( + OpenedSessionToken, + SessionExpired, + SessionKeys, + SessionPrincipal, + is_session_refresh_token, + is_session_token, + open_session_refresh_token, + open_session_token, +) + +_SESSION_SIGNING_KEY_DOMAIN = b"litellm-mcp-gateway:session-signing:" + +# scrypt work factors (RFC 7914), identical to the envelope KDF: memory-hard so a captured +# session token is not a cheap offline oracle for the master key. +_SCRYPT_N = 2**15 +_SCRYPT_R = 8 +_SCRYPT_P = 1 +_SCRYPT_MAXMEM = 128 * _SCRYPT_N * _SCRYPT_R * _SCRYPT_P * 2 +_DERIVED_KEY_BYTES = 32 + + +@lru_cache(maxsize=8) +def session_keys_from_master_key(master_key: str) -> SessionKeys: + """Derive the session signing key from the proxy master key. + + A memory-hard scrypt KDF (RFC 7914) over a session-specific domain-label salt yields a + 256-bit subkey from the one secret, so the producer (mint) and consumer (open) agree on + the key without persisting any. The domain label differs from both envelope labels in + :mod:`.bridge_credentials`, so compromise or misuse of one token family never crosses + into the other. The result is cached (the master key is fixed for a process); rotating + ``master_key`` invalidates every outstanding session, which is the intended behavior + for a signing-key change. + """ + signing = hashlib.scrypt( + master_key.encode(), + salt=_SESSION_SIGNING_KEY_DOMAIN, + n=_SCRYPT_N, + r=_SCRYPT_R, + p=_SCRYPT_P, + maxmem=_SCRYPT_MAXMEM, + dklen=_DERIVED_KEY_BYTES, + ).hex() + return SessionKeys(signing_key=SecretStr(signing)) + + +class NotSessionBearer(BaseModel): + """The bearer is not session-shaped; admission continues on its normal path.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["not_session_bearer"] = "not_session_bearer" + + +class SessionBearerAdmitted(BaseModel): + """A valid session access token: the principal to admit under after a live reload.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["admitted"] = "admitted" + principal: SessionPrincipal + + +class SessionBearerInvalid(BaseModel): + """The bearer is session-shaped but must not admit (expired, tampered, wrong key, or a + refresh token presented at the tool-call edge); admission fails closed with the + ``invalid_token`` challenge rather than falling through to another arm. ``expired`` + distinguishes a routine expiry (debug-log worthy) from a tampered or foreign token.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["invalid"] = "invalid" + expired: bool = False + + +SessionBearerResult: TypeAlias = NotSessionBearer | SessionBearerAdmitted | SessionBearerInvalid + + +def _strip_bearer(value: str) -> str: + parts = value.split(None, 1) + if len(parts) == 2 and parts[0].lower() == "bearer": + return parts[1] + return value + + +def is_session_bearer_shaped(authorization_value: str) -> bool: + """Cheap, keyless test that an ``Authorization`` value carries a session token of either + kind (optional ``Bearer`` scheme stripped). The admission edge engages the session arm + for an access token (to admit) and for a refresh token (to reject it explicitly, since + a refresh credential is never usable at the tool-call edge); anything else falls + through to normal admission.""" + candidate = _strip_bearer(authorization_value) + return is_session_token(candidate) or is_session_refresh_token(candidate) + + +def resolve_session_bearer( + authorization_value: str, + keys: SessionKeys, + now: datetime, +) -> SessionBearerResult: + """Classify an ``Authorization`` value presented at the aggregate MCP edge. + + Strips an optional ``Bearer`` scheme, then returns ``NotSessionBearer`` for a + non-session bearer (normal admission continues), ``SessionBearerAdmitted`` with the + recovered principal for a valid access token, and ``SessionBearerInvalid`` for a + session-shaped bearer that must not admit. Never raises: total over hostile input via + :func:`~.session_token.open_session_token`. + + A refresh token is ``SessionBearerInvalid`` here: it is a valid gateway credential but + only ever presented back to the token endpoint, so admission must fail it closed rather + than let it fall through to another arm. + """ + candidate = _strip_bearer(authorization_value) + if is_session_refresh_token(candidate): + return SessionBearerInvalid() + if not is_session_token(candidate): + return NotSessionBearer() + opened = open_session_token(candidate, keys, now) + if isinstance(opened, OpenedSessionToken): + return SessionBearerAdmitted(principal=opened.principal) + return SessionBearerInvalid(expired=isinstance(opened, SessionExpired)) + + +class SessionRefreshOpened(BaseModel): + """A valid session refresh token presented to the token endpoint: the principal to + re-validate and renew under.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["opened"] = "opened" + principal: SessionPrincipal + jti: str + + +class SessionRefreshInvalid(BaseModel): + """The presented refresh grant is not a valid session refresh token for this client + (not refresh-shaped, will not open, or bound to a different ``client_id``); the token + endpoint fails the refresh closed.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["invalid"] = "invalid" + + +SessionRefreshResult: TypeAlias = SessionRefreshOpened | SessionRefreshInvalid + + +def open_session_refresh_bearer( + refresh_value: str, + keys: SessionKeys, + now: datetime, + expected_client_id: str, +) -> SessionRefreshResult: + """Open a session refresh token presented on a ``refresh_token`` grant. + + The token-endpoint mirror of :func:`resolve_session_bearer`: strips an optional + ``Bearer`` scheme, then returns ``SessionRefreshOpened`` with the recovered principal, + or ``SessionRefreshInvalid`` for anything that is not a valid session refresh token + issued to ``expected_client_id``. Never raises. The client binding (RFC 6749 section 6) + stops a refresh token stolen from one DCR client from being renewed through another; + ``client_id`` is not a secret (the caller presents it), so a plain equality check is + sufficient and, unlike ``hmac.compare_digest`` on ``str``, does not raise on non-ASCII. + """ + candidate = _strip_bearer(refresh_value) + if not is_session_refresh_token(candidate): + return SessionRefreshInvalid() + opened = open_session_refresh_token(candidate, keys, now) + if not isinstance(opened, OpenedSessionToken): + return SessionRefreshInvalid() + if opened.principal.client_id != expected_client_id: + return SessionRefreshInvalid() + return SessionRefreshOpened(principal=opened.principal, jti=opened.jti) diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_token.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_token.py new file mode 100644 index 00000000000..4ccbcd1a511 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_token.py @@ -0,0 +1,365 @@ +"""Identity-only session tokens for the gateway-level (aggregate ``/mcp``) DCR front door. + +A DCR client that signs in through LiteLLM SSO holds ONE bearer that carries ONLY a +litellm identity; unlike the :mod:`.envelope` bridge bearer it seals no upstream +credential, because the custody model vaults every upstream token server-side in +``LiteLLM_MCPUserCredentials`` and egress resolves them by user at call time. The token +is therefore a stable REFERENCE, not an authorization: admission reloads the live user +record and policy on every request, so deactivating the user (or their team) kills +outstanding sessions immediately without a revocation store. + +Wire shape: ``llm_session_`` (access) / ``llm_srefresh_`` (refresh) + an HS256 JWT, +the same signing approach as :mod:`.envelope`. Claims are ``iss``/``iat``/``exp`` +plus ``jti`` (per-mint uniqueness, so two tokens minted in the same second never +collide and a future revocation list has a stable handle), ``kind``, ``user_id``, and +``client_id``; ``client_id`` binds the refresh token +to the DCR client it was issued to (RFC 6749 section 6) and is carried on the access +token for parity and audit. There is no encrypted payload: nothing in a session token +is secret beyond the signature, and reprs never print the signed value because minted +tokens are ``SecretStr``. + +This module is pure and unwired: it imports nothing from endpoint or edge code, reads +no proxy globals, and takes all key material and the clock as explicit parameters. +Failures are values: :func:`open_session_token` and :func:`open_session_refresh_token` +are total over hostile, attacker-controlled input and return a +``SessionTokenOpenError`` variant rather than raising. PyJWT's ``iat``/``nbf``/``exp`` +validators are disabled for the same reasons documented in :mod:`.envelope` (they +raise on hostile claim types and compare against the wall clock instead of the +injected ``now``); the strict pydantic claims model is the sole, total type gate. +""" + +from __future__ import annotations + +import secrets +from datetime import datetime, timedelta +from typing import Literal, TypeAlias + +import jwt +from pydantic import BaseModel, ConfigDict, Field, SecretStr, ValidationError + +SESSION_TOKEN_PREFIX = "llm_session_" +"""Marker prefix on every serialized session ACCESS token so the admission edge can cheaply +tell a gateway session from a litellm key, JWT, or bridge envelope before doing any +cryptography. Distinct from the ``llm_env_``/``llm_refresh_`` envelope prefixes.""" + +SESSION_REFRESH_PREFIX = "llm_srefresh_" +"""Marker prefix on every serialized session REFRESH token. A distinct prefix keeps the two +credentials routable without crypto and, together with the signed ``kind`` claim, stops one +from being presented where the other is expected: the refresh token is only ever presented +back to the token endpoint, never at the MCP edge.""" + +SESSION_ISSUER = "litellm-mcp-gateway" +"""``iss`` claim stamped into every session token and required back on open. Distinct from +the envelope issuer so a token of one family can never validate in the other even under a +hypothetical shared signing key.""" + +SESSION_TTL_SECONDS = 3600 +"""Session ACCESS token lifetime (1h), matching the access-envelope and BYOK session bearer +windows: a client-held credential never outlives a bounded window, and each refresh +re-validates the live user before re-minting.""" + +SESSION_REFRESH_TTL_SECONDS = 1209600 +"""Session REFRESH token lifetime (14 days), matching the refresh-envelope bound. Each +renewal re-validates the sealed user against the live record (deactivation gates it) and +rotates the refresh token, so the practical bound is idle time, not a fixed session.""" + +MAX_SESSION_TOKEN_BYTES = 4096 +"""Size cap on the serialized token (prefix + JWT, in bytes) and on any candidate accepted +by the openers. Session claims are small; the only variable-length field is ``client_id`` +(a sealed DCR client record), and 4096 leaves ample headroom under common 8-16KB header +limits while bounding hostile input before JWT parsing.""" + +_SESSION_JWT_ALGORITHM = "HS256" + +SessionTokenKind = Literal["session", "session_refresh"] +"""Which credential a session token is. Stamped into the signed claims and required to match +on open, so a signature-valid token of one kind cannot be replayed as the other even if its +wire prefix is swapped (the prefix is not part of the signed payload; this claim is).""" + + +class SessionPrincipal(BaseModel): + """The litellm user a session token identifies and the DCR client it was issued to. + + ``user_id`` is the SSO-established litellm user subject, never a credential: admission + reloads the live user record by it, so current role, team, and revocation state are + enforced at use time rather than frozen at mint time. ``client_id`` is the (stateless, + gateway-sealed) DCR client identifier the token was issued to; the token endpoint + requires it to match on the refresh grant. + """ + + model_config = ConfigDict(frozen=True) + user_id: str = Field(min_length=1) + client_id: str = Field(min_length=1) + + +class SessionKeys(BaseModel): + """Injected key material: the HS256 signing key. + + ``signing_key`` must be at least 32 bytes: HS256's HMAC-SHA256 has a 256-bit security + level, RFC 7518 requires a key of at least that size, and a shorter key makes PyJWT + emit ``InsecureKeyLengthWarning``. + """ + + model_config = ConfigDict(frozen=True) + signing_key: SecretStr = Field(min_length=32) + + +class MintedSessionToken(BaseModel): + """A minted session token: the client-held bearer value and when it expires.""" + + model_config = ConfigDict(frozen=True) + token: SecretStr + expires_at: datetime + + +class OpenedSessionToken(BaseModel): + """A validated session token of either kind: the principal it was minted for, plus the + ``jti`` so the token endpoint can enforce single-use rotation on a refresh token.""" + + model_config = ConfigDict(frozen=True) + principal: SessionPrincipal + jti: str + + +class SessionTokenTooLarge(BaseModel): + """The serialized token exceeded ``MAX_SESSION_TOKEN_BYTES``; carries sizes only. Only + reachable through an oversized ``client_id``, which registration should have bounded.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["session_token_too_large"] = "session_token_too_large" + size_bytes: int + max_bytes: int + + +SessionTokenMintError: TypeAlias = SessionTokenTooLarge + + +class NotASessionToken(BaseModel): + """The candidate does not carry the expected session prefix.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["not_a_session_token"] = "not_a_session_token" + + +class SessionBadSignature(BaseModel): + """The JWT signature does not verify under the provided signing key.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["session_bad_signature"] = "session_bad_signature" + + +class SessionExpired(BaseModel): + """The token's ``exp`` is not in the future relative to the provided ``now``.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["session_expired"] = "session_expired" + + +class SessionMalformed(BaseModel): + """The token is not a well-formed session token: undecodable JWT, wrong issuer, wrong + ``kind``, or missing/mistyped/extra claims.""" + + model_config = ConfigDict(frozen=True) + tag: Literal["session_malformed"] = "session_malformed" + + +SessionTokenOpenError: TypeAlias = NotASessionToken | SessionBadSignature | SessionExpired | SessionMalformed + + +class _SessionClaims(BaseModel): + """Decoded-claims boundary that pins the exact shape the mints emit. + + ``user_id``/``client_id`` mirror the ``min_length`` constraints of + :class:`SessionPrincipal` so any claim set that validates here also constructs a + principal, keeping the openers raise-free: a correctly signed JWT with an empty + identity claim fails here and maps to ``SessionMalformed``. ``strict`` rejects coerced + types (``exp: "123"``) and ``extra="forbid"`` rejects any claim the gateway never + mints; PyJWT's own registered-claim validators are disabled at decode (see module + docstring), so this model is the sole, total type gate for every claim. + """ + + model_config = ConfigDict(frozen=True, strict=True, extra="forbid") + iss: str + iat: int + exp: int + jti: str = Field(min_length=1) + kind: SessionTokenKind + user_id: str = Field(min_length=1) + client_id: str = Field(min_length=1) + + +def is_session_token(candidate: str) -> bool: + """Cheap prefix check for a session ACCESS token so the admission edge can route gateway + sessions vs keys, JWTs, and envelopes without crypto.""" + return candidate.startswith(SESSION_TOKEN_PREFIX) + + +def is_session_refresh_token(candidate: str) -> bool: + """Cheap prefix check for a session REFRESH token so the token endpoint can route a + refresh grant without crypto.""" + return candidate.startswith(SESSION_REFRESH_PREFIX) + + +def mint_session_token( + principal: SessionPrincipal, + keys: SessionKeys, + now: datetime, +) -> MintedSessionToken | SessionTokenMintError: + """Mint the short-lived session ACCESS token for ``principal``. + + ``exp`` is ``SESSION_TTL_SECONDS`` from ``now``. Returns ``SessionTokenTooLarge`` when + the serialized token exceeds ``MAX_SESSION_TOKEN_BYTES``. + """ + return _mint( + kind="session", + prefix=SESSION_TOKEN_PREFIX, + principal=principal, + expires_at=now + timedelta(seconds=SESSION_TTL_SECONDS), + keys=keys, + now=now, + ) + + +def mint_session_refresh_token( + principal: SessionPrincipal, + keys: SessionKeys, + now: datetime, +) -> MintedSessionToken | SessionTokenMintError: + """Mint the long-lived session REFRESH token for ``principal``. + + ``exp`` is ``SESSION_REFRESH_TTL_SECONDS`` from ``now``. Minting a distinct + ``kind="session_refresh"`` claim is what keeps a refresh token from ever opening as an + access credential at the MCP edge. + """ + return _mint( + kind="session_refresh", + prefix=SESSION_REFRESH_PREFIX, + principal=principal, + expires_at=now + timedelta(seconds=SESSION_REFRESH_TTL_SECONDS), + keys=keys, + now=now, + ) + + +def open_session_token( + candidate: str, + keys: SessionKeys, + now: datetime, +) -> OpenedSessionToken | SessionTokenOpenError: + """Validate a session ACCESS ``candidate`` and recover the principal. + + Never raises for bad input: every invalid, expired, tampered, or wrong-kind candidate + maps to a distinct ``SessionTokenOpenError`` variant. + """ + return _open(candidate, prefix=SESSION_TOKEN_PREFIX, expected_kind="session", keys=keys, now=now) + + +def open_session_refresh_token( + candidate: str, + keys: SessionKeys, + now: datetime, +) -> OpenedSessionToken | SessionTokenOpenError: + """Validate a session REFRESH ``candidate`` and recover the principal. + + Total over hostile input exactly like :func:`open_session_token`. The + ``kind="session_refresh"`` claim is required, so an access token re-prefixed as a + refresh one is rejected as ``SessionMalformed``. + """ + return _open(candidate, prefix=SESSION_REFRESH_PREFIX, expected_kind="session_refresh", keys=keys, now=now) + + +def _mint( + kind: SessionTokenKind, + prefix: str, + principal: SessionPrincipal, + expires_at: datetime, + keys: SessionKeys, + now: datetime, +) -> MintedSessionToken | SessionTokenTooLarge: + """Sign the claims for either token kind and enforce the size cap. Shared by both mints + so the JWT shape, issuer, and size guard cannot drift between access and refresh.""" + claims = _SessionClaims( + iss=SESSION_ISSUER, + iat=int(now.timestamp()), + exp=int(expires_at.timestamp()), + jti=secrets.token_urlsafe(16), + kind=kind, + user_id=principal.user_id, + client_id=principal.client_id, + ) + token = prefix + jwt.encode( + claims.model_dump(), keys.signing_key.get_secret_value(), algorithm=_SESSION_JWT_ALGORITHM + ) + size_bytes = len(token.encode("utf-8")) + if size_bytes > MAX_SESSION_TOKEN_BYTES: + return SessionTokenTooLarge(size_bytes=size_bytes, max_bytes=MAX_SESSION_TOKEN_BYTES) + return MintedSessionToken(token=SecretStr(token), expires_at=expires_at) + + +def _open( + candidate: str, + prefix: str, + expected_kind: SessionTokenKind, + keys: SessionKeys, + now: datetime, +) -> OpenedSessionToken | SessionTokenOpenError: + """Prefix-route, size-bound, signature-verify, kind-check, and expiry-check an + attacker-controlled candidate, shared by both openers so the security gate is identical + for access and refresh. Returns the opened token or a distinct error; never raises.""" + if not candidate.startswith(prefix): + return NotASessionToken() + # UTF-8 byte length is never below character length, so a character count already over + # the cap rejects an oversize candidate in O(1) without encoding it; the exact byte + # check then runs only on candidates already bounded to the cap in characters. + if len(candidate) > MAX_SESSION_TOKEN_BYTES: + return SessionMalformed() + if len(candidate.encode("utf-8", "surrogatepass")) > MAX_SESSION_TOKEN_BYTES: + return SessionMalformed() + claims = _decode_claims(candidate.removeprefix(prefix), keys.signing_key) + if not isinstance(claims, _SessionClaims): + return claims + if claims.kind != expected_kind: + return SessionMalformed() + if now.timestamp() >= claims.exp: + return SessionExpired() + return OpenedSessionToken( + principal=SessionPrincipal(user_id=claims.user_id, client_id=claims.client_id), jti=claims.jti + ) + + +def _decode_claims( + compact: str, + signing_key: SecretStr, +) -> _SessionClaims | SessionBadSignature | SessionMalformed: + """Verify the HS256 signature and shape of an attacker-controlled compact JWT. + + ``compact`` is fully hostile and bounded to ``MAX_SESSION_TOKEN_BYTES`` by the caller. + PyJWT's ``iat``/``nbf``/``exp`` validators are disabled: they raise on hostile claim + types and, for ``iat``/``nbf``, compare against the wall clock rather than the injected + ``now`` (``exp`` is checked by the caller against ``now``). Apart from a signature + mismatch, every decode failure is ``SessionMalformed``: a non-UTF-8 candidate surfaces + as ``UnicodeEncodeError`` (a ``ValueError``), a non-string registered claim as a + ``TypeError`` from PyJWT's claim validators, and a wrong issuer or structurally invalid + token as an ``InvalidTokenError``. ``_SessionClaims`` is the total type gate. + """ + try: + payload = jwt.decode( + compact, + signing_key.get_secret_value(), + algorithms=[_SESSION_JWT_ALGORITHM], + issuer=SESSION_ISSUER, + options={ + "verify_exp": False, + "verify_iat": False, + "verify_nbf": False, + "require": ["iss", "iat", "exp"], + }, + ) + except jwt.InvalidSignatureError: + return SessionBadSignature() + except (jwt.InvalidTokenError, ValueError, TypeError): + return SessionMalformed() + try: + return _SessionClaims.model_validate(payload) + except ValidationError: + return SessionMalformed() diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/sso_assertion_store.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/sso_assertion_store.py new file mode 100644 index 00000000000..e0927cc4f64 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/sso_assertion_store.py @@ -0,0 +1,214 @@ +"""Store for the enterprise IdP identity assertion captured at SSO login (EMA). + +The ``oauth2_id_jag`` egress arm needs the user's IdP ``id_token`` as its RFC 8693 +``subject_token``. A front-door client holds an identity-only ``llm_session_`` bearer, not an +IdP assertion, so the assertion captured at the one SSO login is the only usable subject +source for it. This module owns both sides of that state: the SSO callback persists here +(write-through to the DB so a login on one pod is visible to every pod) and the resolver +seam reads back by ``user_id``. Retention is gated on an ``oauth2_id_jag`` server actually +being registered, so a gateway with no EMA upstream never stores bearer material. + +The row is one encrypted payload per user, latest login wins. ``expires_at`` mirrors the +id_token ``exp`` claim and is judged by the reader, never enforced by deletion here: an +expired assertion with a refresh token is still renewable, and the DB row is the source of +truth, the same contract as the per-user OAuth credential store. +""" + +from __future__ import annotations + +import json +from datetime import datetime, timezone +from typing import TYPE_CHECKING + +import jwt +from pydantic import BaseModel, ConfigDict, SecretStr, TypeAdapter, ValidationError + +from litellm._logging import verbose_proxy_logger + +if TYPE_CHECKING: + from litellm.proxy.utils import PrismaClient + +_ASSERTION_DECRYPT_LOG_KEY = "sso_identity_assertion" +_STR_ADAPTER: TypeAdapter[str] = TypeAdapter(str) +_MAYBE_STR_ADAPTER: TypeAdapter[str | None] = TypeAdapter(str | None) + + +class SSOIdentityAssertion(BaseModel): + """The IdP material an EMA exchange needs: ``id_token`` is the RFC 8693 subject token, + ``expires_at`` bounds its usefulness, and the refresh token renews it without re-login.""" + + model_config = ConfigDict(frozen=True) + + id_token: SecretStr + refresh_token: SecretStr | None = None + issuer: str | None = None + expires_at: datetime | None = None + + +class _IdTokenClaims(BaseModel): + exp: float | None = None + iss: str | None = None + + +class _StoredAssertionPayload(BaseModel): + id_token: str + refresh_token: str | None = None + issuer: str | None = None + expires_at: datetime | None = None + + +def assertion_from_sso_login(id_token: object, refresh_token: object) -> SSOIdentityAssertion | None: + """The typed carrier built where the raw token response exists; ``None`` when the provider + sent no id_token or sent one that is not a decodable JWT, since neither is exchangeable + under EMA. Inputs are ``object`` because they come straight from the provider's untyped + token response; this is the one boundary that validates them. The token arrived over TLS + from the IdP's own token endpoint, so claims are read without signature verification, + matching how the SSO callback already decodes it for identity.""" + raw_id_token = id_token if isinstance(id_token, str) and id_token else None + if raw_id_token is None: + return None + raw_refresh_token = refresh_token if isinstance(refresh_token, str) and refresh_token else None + try: + claims = _IdTokenClaims.model_validate(jwt.decode(raw_id_token, options={"verify_signature": False})) + expires_at = datetime.fromtimestamp(claims.exp, tz=timezone.utc) if claims.exp is not None else None + except Exception: # noqa: BLE001 # decode failure = not retainable; never raise into login + verbose_proxy_logger.warning( + "SSO id_token could not be decoded or its claims were unusable; not retaining it for EMA egress." + ) + return None + return SSOIdentityAssertion( + id_token=SecretStr(raw_id_token), + refresh_token=SecretStr(raw_refresh_token) if raw_refresh_token else None, + issuer=claims.iss, + expires_at=expires_at, + ) + + +async def ema_assertion_retention_enabled() -> bool: + """Whether any MCP server uses ``oauth2_id_jag``, evaluated per login so the gateway only + retains bearer material while an EMA upstream exists to spend it on. Judged against the two + configuration authorities: the pod-local config declaration and the shared DB row. The + in-memory registry is deliberately not consulted in either direction; it is a per-process + snapshot of the DB state that can be stale both ways (a server added on another pod would + silently drop the write, one removed on another pod would keep retaining bearer material), + and a gate guarding a shared-DB write must judge against that storage's authority.""" + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( # noqa: PLC0415 # avoids import cycle + global_mcp_server_manager, + ) + from litellm.proxy.proxy_server import prisma_client # noqa: PLC0415 # runtime global + from litellm.types.mcp import MCPAuth # noqa: PLC0415 # runtime global + + config_servers = global_mcp_server_manager.config_mcp_servers.values() + if any(server.auth_type == MCPAuth.oauth2_id_jag for server in config_servers): + return True + if prisma_client is None: + return False + row = await prisma_client.db.litellm_mcpservertable.find_first(where={"auth_type": MCPAuth.oauth2_id_jag.value}) + return row is not None + + +async def persist_sso_identity_assertion(user_id: str, assertion: SSOIdentityAssertion) -> None: + from litellm.proxy.common_utils.encrypt_decrypt_utils import encrypt_value_helper # noqa: PLC0415 # runtime global + from litellm.proxy.proxy_server import prisma_client # noqa: PLC0415 # runtime global + + if prisma_client is None: + return + payload: dict[str, str] = { + "id_token": assertion.id_token.get_secret_value(), + **({"refresh_token": assertion.refresh_token.get_secret_value()} if assertion.refresh_token else {}), + **({"issuer": assertion.issuer} if assertion.issuer else {}), + **({"expires_at": assertion.expires_at.isoformat()} if assertion.expires_at else {}), + } + encoded = _STR_ADAPTER.validate_python(encrypt_value_helper(json.dumps(payload))) + await prisma_client.db.litellm_ssoidentityassertion.upsert( + where={"user_id": user_id}, + data={ + "create": {"user_id": user_id, "assertion_b64": encoded}, + "update": {"assertion_b64": encoded}, + }, + ) + + +async def fetch_sso_identity_assertion(user_id: str) -> SSOIdentityAssertion | None: + """The stored assertion for ``user_id``, or ``None`` when absent, undecryptable (salt-key + rotation), or unparseable. Expiry is not judged here; the reader owns that policy.""" + from litellm.proxy.common_utils.encrypt_decrypt_utils import decrypt_value_helper # noqa: PLC0415 # runtime global + from litellm.proxy.proxy_server import prisma_client # noqa: PLC0415 # runtime global + + if prisma_client is None: + return None + row = await prisma_client.db.litellm_ssoidentityassertion.find_unique(where={"user_id": user_id}) + if row is None: + return None + raw = _MAYBE_STR_ADAPTER.validate_python( + decrypt_value_helper(row.assertion_b64, _ASSERTION_DECRYPT_LOG_KEY, exception_type="debug") + ) + if raw is None: + return None + try: + payload = _StoredAssertionPayload.model_validate_json(raw) + except ValidationError: + verbose_proxy_logger.warning( + "Stored SSO identity assertion for user_id=%s could not be parsed; treating as absent.", user_id + ) + return None + return SSOIdentityAssertion( + id_token=SecretStr(payload.id_token), + refresh_token=SecretStr(payload.refresh_token) if payload.refresh_token else None, + issuer=payload.issuer, + expires_at=payload.expires_at, + ) + + +async def rotate_sso_identity_assertions_master_key(prisma_client: PrismaClient, new_master_key: str) -> None: + """Re-encrypt every stored assertion under ``new_master_key`` during a salt-key rotation, + mirroring the sibling per-user credential tables; an unreadable row is skipped so one + corrupt row does not abort the rotation. Rows are decrypted one at a time inside the loop + so the whole table's plaintext is never held in memory at once.""" + from prisma.models import LiteLLM_SSOIdentityAssertion as AssertionRow # noqa: PLC0415 # generated at runtime + + from litellm.proxy.common_utils.encrypt_decrypt_utils import ( # noqa: PLC0415 # runtime global + decrypt_value_helper, + encrypt_value_helper, + ) + + async def _rotate_row(row: AssertionRow) -> bool: + plaintext = _MAYBE_STR_ADAPTER.validate_python( + decrypt_value_helper(row.assertion_b64, _ASSERTION_DECRYPT_LOG_KEY, exception_type="debug") + ) + if plaintext is None: + verbose_proxy_logger.warning( + "rotate_sso_identity_assertions_master_key: could not decrypt assertion for user_id=%s, skipping", + row.user_id, + ) + return False + re_encrypted = _STR_ADAPTER.validate_python(encrypt_value_helper(plaintext, new_encryption_key=new_master_key)) + await prisma_client.db.litellm_ssoidentityassertion.update( + where={"user_id": row.user_id}, + data={"assertion_b64": re_encrypted}, + ) + return True + + rows = await prisma_client.db.litellm_ssoidentityassertion.find_many() + outcomes = [await _rotate_row(row) for row in rows] + verbose_proxy_logger.info( + "rotate_sso_identity_assertions_master_key: rotated %d row(s), skipped %d", + sum(outcomes), + len(outcomes) - sum(outcomes), + ) + + +async def retain_sso_identity_assertion_for_ema(user_id: str, assertion: SSOIdentityAssertion | None) -> None: + """The SSO-callback hook: a no-op unless there is material AND an EMA server is registered. + A store failure is logged and swallowed because the login itself must not fail on an + egress-side write; the cost of a miss is a 401 challenge at the EMA upstream, not a lockout.""" + if assertion is None: + return + try: + if not await ema_assertion_retention_enabled(): + return + await persist_sso_identity_assertion(user_id, assertion) + except Exception as exc: # noqa: BLE001 # the login itself must not fail on an egress-side write + verbose_proxy_logger.warning( + "Failed to persist the SSO identity assertion for EMA egress (user_id=%s): %s", user_id, exc + ) diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/token_endpoint.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/token_endpoint.py new file mode 100644 index 00000000000..4bc5732ec0e --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/token_endpoint.py @@ -0,0 +1,225 @@ +"""An authenticated OAuth token-endpoint call plus a short-lived-token cache. + +`TokenEndpointClient.fetch` POSTs one grant to a token endpoint, authenticating the gateway as +an OAuth client via `client_auth` (RFC 7523 private-key JWT, or `client_secret_post`), and returns +the minted token or a typed `CredError`. `ExchangedTokenCache` memoizes the final token string per +opaque cache key with per-key single-flight, so concurrent callers share one round-trip and a hit +skips the endpoint entirely. + +Pure v2: no imports from the v1 MCP auth handlers. The multi-leg flows that compose these (ID-JAG, +and later token_exchange / client_credentials) live in the resolver arms; this collaborator owns +only the single authenticated call and the cache. +""" + +from __future__ import annotations + +import asyncio +import json +import time +import uuid +import weakref +from collections.abc import Awaitable, Callable, Mapping +from dataclasses import dataclass + +import httpx +import jwt +from pydantic import BaseModel, ValidationError +from typing_extensions import assert_never + +from litellm._logging import verbose_proxy_logger +from litellm.caching.in_memory_cache import InMemoryCache +from litellm.constants import ( + MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL, + MCP_OAUTH2_TOKEN_CACHE_MIN_TTL, + MCP_OAUTH2_TOKEN_EXPIRY_BUFFER_SECONDS, + MCP_TOKEN_EXCHANGE_CACHE_MAX_SIZE, +) +from litellm.exceptions import Timeout +from litellm.llms.custom_httpx.http_handler import ( + get_async_httpx_client, # pyright: ignore[reportUnknownVariableType] # litellm http handler is untyped +) +from litellm.proxy._experimental.mcp_server.outbound_credentials.result import ( + Error, + Ok, + Result, +) +from litellm.proxy._experimental.mcp_server.outbound_credentials.types import ( + ClientAuth, + ClientSecretAuth, + CredError, + PrivateKeyJwtAuth, +) +from litellm.types.llms.custom_http import httpxSpecialProvider + +CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" +CLIENT_ASSERTION_LIFETIME_SECONDS = 60 + + +@dataclass(frozen=True, slots=True) +class ExchangedToken: + access_token: str + expires_in: int | None + + +class _TokenEndpointResponse(BaseModel): + access_token: str + expires_in: int | None = None + + +class TokenEndpointClient: + """One authenticated POST to an OAuth token endpoint, returning the minted token as a value.""" + + async def fetch( + self, + endpoint: str, + client_id: str, + grant_params: Mapping[str, str], + client_auth: ClientAuth, + ) -> Result[ExchangedToken, CredError]: + try: + data = {**grant_params, **_client_auth_params(endpoint, client_id, client_auth)} + except (ValueError, TypeError, NotImplementedError, jwt.PyJWTError): + verbose_proxy_logger.warning("MCP token endpoint %s: could not sign the client assertion", endpoint) + return Error( + CredError.of_misconfigured( + "token exchange failed: could not sign the client assertion; " + "check client_private_key and client_assertion_signing_alg" + ) + ) + try: + raw = await _post_form(endpoint, data) + except httpx.HTTPStatusError as exc: + verbose_proxy_logger.warning( + "MCP token endpoint %s failed with status %s", endpoint, exc.response.status_code + ) + return Error( + CredError.of_upstream_unavailable(f"token exchange failed with status {exc.response.status_code}") + ) + except (httpx.RequestError, Timeout) as exc: + verbose_proxy_logger.warning("MCP token endpoint %s unreachable: %s", endpoint, type(exc).__name__) + return Error( + CredError.of_upstream_unavailable( + f"token exchange failed: token endpoint unreachable ({type(exc).__name__})" + ) + ) + except json.JSONDecodeError: + verbose_proxy_logger.warning("MCP token endpoint %s returned a non-JSON response", endpoint) + return Error( + CredError.of_upstream_unavailable("token exchange failed: token endpoint returned a non-JSON response") + ) + if raw is None: + verbose_proxy_logger.warning("MCP token endpoint %s returned no response", endpoint) + return Error(CredError.of_upstream_unavailable("token exchange failed: no response from token endpoint")) + try: + parsed = _TokenEndpointResponse.model_validate(raw) + except ValidationError: + verbose_proxy_logger.warning("MCP token endpoint %s response missing access_token", endpoint) + return Error( + CredError.of_upstream_unavailable("token exchange failed: token endpoint response missing access_token") + ) + return Ok(ExchangedToken(access_token=parsed.access_token, expires_in=parsed.expires_in)) + + +class ExchangedTokenCache: + """Memoizes the final token string per key, single-flighting concurrent misses on one lock.""" + + def __init__(self) -> None: + self._cache = InMemoryCache( + max_size_in_memory=MCP_TOKEN_EXCHANGE_CACHE_MAX_SIZE, + default_ttl=MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL, + ) + self._locks: weakref.WeakValueDictionary[str, asyncio.Lock] = weakref.WeakValueDictionary() + + async def get_or_compute( + self, + cache_key: str, + compute: Callable[[], Awaitable[Result[ExchangedToken, CredError]]], + ) -> Result[str, CredError]: + cached = self._get(cache_key) + if cached is not None: + return Ok(cached) + async with self._lock(cache_key): + cached = self._get(cache_key) + if cached is not None: + return Ok(cached) + match await compute(): + case Ok(token): + self._cache.set_cache( # pyright: ignore[reportUnknownMemberType] # InMemoryCache is untyped + cache_key, + token.access_token, + ttl=_cache_ttl_seconds(token.expires_in), + ) + return Ok(token.access_token) + case Error(err): + return Error(err) + + def invalidate(self, cache_key: str) -> None: + """Evict one cached token so the next `get_or_compute` re-mints (e.g. after an upstream 401).""" + self._cache.delete_cache(cache_key) # pyright: ignore[reportUnknownMemberType] # InMemoryCache is untyped + + def _get(self, cache_key: str) -> str | None: + value = self._cache.get_cache(cache_key) # pyright: ignore[reportUnknownMemberType,reportUnknownVariableType] # InMemoryCache is untyped; narrowed by isinstance below + return value if isinstance(value, str) else None + + def _lock(self, cache_key: str) -> asyncio.Lock: + lock = self._locks.get(cache_key) + if lock is None: + lock = asyncio.Lock() + self._locks[cache_key] = lock + return lock + + +def _cache_ttl_seconds(expires_in: int | None) -> int: + lifetime = expires_in if expires_in is not None else MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL + return max( + lifetime - MCP_OAUTH2_TOKEN_EXPIRY_BUFFER_SECONDS, + MCP_OAUTH2_TOKEN_CACHE_MIN_TTL, + ) + + +async def _post_form(endpoint: str, data: dict[str, str]) -> object | None: + # litellm's httpx handler and httpx.Response are only partially typed; the token endpoint + # returns a JSON object that `_TokenEndpointResponse` validates, so the untyped boundary is + # contained here. A non-2xx raises `httpx.HTTPStatusError`, an unreachable endpoint raises + # `httpx.RequestError` (or litellm's `Timeout`, which the handler substitutes for + # `httpx.TimeoutException`), and a non-JSON body raises `json.JSONDecodeError`; `fetch` maps + # each to a CredError. + client = get_async_httpx_client(llm_provider=httpxSpecialProvider.MCP) # pyright: ignore[reportUnknownVariableType] # litellm http handler is untyped + response = await client.post(endpoint, data=data) # pyright: ignore[reportUnknownMemberType,reportUnknownVariableType] # litellm http handler is untyped + if response is None: + return None + response.raise_for_status() + return response.json() # pyright: ignore[reportAny] # untyped JSON; validated by _TokenEndpointResponse in fetch + + +def _client_auth_params(endpoint: str, client_id: str, client_auth: ClientAuth) -> dict[str, str]: + match client_auth: + case PrivateKeyJwtAuth() as auth: + return { + "client_id": client_id, + "client_assertion_type": CLIENT_ASSERTION_TYPE, + "client_assertion": _client_assertion(endpoint, client_id, auth), + } + case ClientSecretAuth() as auth: + return { + "client_id": client_id, + "client_secret": auth.client_secret.get_secret_value(), + } + assert_never(client_auth) + + +def _client_assertion(endpoint: str, client_id: str, auth: PrivateKeyJwtAuth) -> str: + now = int(time.time()) + return jwt.encode( + { + "iss": client_id, + "sub": client_id, + "aud": endpoint, + "jti": uuid.uuid4().hex, + "iat": now, + "exp": now + CLIENT_ASSERTION_LIFETIME_SECONDS, + }, + auth.private_key.get_secret_value(), + algorithm=auth.signing_alg, + headers={"kid": auth.key_id} if auth.key_id else None, + ) diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/types.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/types.py index 7e04be4f045..0f276cb8e5c 100644 --- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/types.py +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/types.py @@ -56,6 +56,7 @@ class AuthSpecKind(str, Enum): authorization_code = "authorization_code" # per-user 3LO; gateway-stored token client_credentials = "client_credentials" # gateway service account (M2M) token_exchange = "token_exchange" # RFC 8693: token endpoint + subject_token (OBO) + id_jag = "id_jag" # draft-ietf-oauth-identity-assertion-authz-grant: two-leg exchange then jwt-bearer api_key = "api_key" # static header, any scheme (BYOK = per-user-seeded source) passthrough = "passthrough" # client forwards an upstream-audience token none = "none" # no upstream credential; resolve yields a no-op auth, never an error @@ -183,7 +184,12 @@ class ClientCredentialsConfig(BaseModel): Fields are optional so the config can be built incomplete: a value may be supplied at runtime (`token_url` via RFC 8414 discovery, `client_id`/`secret` via DCR), and the - resolver arm raises `CredError.misconfigured` when a needed field is still absent. + resolver arm returns `CredError.misconfigured` when a needed field is still absent. + + `audience` is the IdP-specific audience parameter some authorization servers require on + the client_credentials grant (sent as `audience` in the token request when set). + `token_endpoint_auth_method` selects how the client authenticates to the token endpoint + (RFC 6749 section 2.3.1); `None` defaults to `client_secret_post`. """ model_config = ConfigDict(frozen=True) @@ -192,6 +198,9 @@ class ClientCredentialsConfig(BaseModel): client_secret: SecretStr | None = None token_url: str | None = None scopes: tuple[str, ...] = () + audience: str | None = None + upstream_resource: str | None = None + token_endpoint_auth_method: Literal["client_secret_post", "client_secret_basic"] | None = None class TokenExchangeConfig(BaseModel): @@ -225,6 +234,49 @@ class TokenExchangeConfig(BaseModel): scopes: tuple[str, ...] = () +class PrivateKeyJwtAuth(BaseModel): + """RFC 7523 private-key-JWT client authentication: the gateway signs a `client_assertion`.""" + + model_config = ConfigDict(frozen=True) + source: Literal["private_key_jwt"] = "private_key_jwt" + private_key: SecretStr + key_id: str | None = None + signing_alg: str = "RS256" + + +class ClientSecretAuth(BaseModel): + """`client_secret_post` client authentication: the gateway posts `client_id` + `client_secret`.""" + + model_config = ConfigDict(frozen=True) + source: Literal["client_secret"] = "client_secret" + client_secret: SecretStr + + +ClientAuth = Annotated[PrivateKeyJwtAuth | ClientSecretAuth, Field(discriminator="source")] + + +class IdJagConfig(BaseModel): + """draft-ietf-oauth-identity-assertion-authz-grant (Okta "AI agent token exchange"). + + Two legs: leg 1 is an RFC 8693 token exchange at the IdP org AS (`org_token_endpoint`) that + swaps the caller's identity token for an ID-JAG assertion; leg 2 is an RFC 7523 jwt-bearer at + the upstream resource AS (`resource_token_endpoint`) that swaps the assertion for the access + token. The gateway authenticates to both endpoints as `client_id` via `client_auth`. Required + fields are enforced at construction so a half-configured server cannot reach the arm. + """ + + model_config = ConfigDict(frozen=True) + kind: Literal[AuthSpecKind.id_jag] = AuthSpecKind.id_jag + org_token_endpoint: str + resource_token_endpoint: str + client_id: str + client_auth: ClientAuth + subject_token_type: str = "urn:ietf:params:oauth:token-type:id_token" + audience: str | None = None + resource: str | None = None + scopes: tuple[str, ...] = () + + class SharedKey(BaseModel): """A fixed key configured on the server, identical for every caller.""" @@ -323,6 +375,7 @@ AuthConfig = Annotated[ AuthorizationCodeConfig | ClientCredentialsConfig | TokenExchangeConfig + | IdJagConfig | ApiKeyConfig | PassthroughConfig | NoneConfig diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/v2_token_store.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/v2_token_store.py index f1b68042c94..eefeec84bfa 100644 --- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/v2_token_store.py +++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/v2_token_store.py @@ -10,14 +10,14 @@ injected, so the DB/decoding plumbing stays testable and out of this seam. from __future__ import annotations -from collections.abc import Awaitable, Callable +from collections.abc import Awaitable, Callable, Mapping from datetime import datetime, timezone from litellm.proxy._experimental.mcp_server.outbound_credentials.oauth_token_store import ( OAuthToken, ) -CredentialReader = Callable[[str, str], Awaitable["dict[str, object] | None"]] +CredentialReader = Callable[[str, str], Awaitable["Mapping[str, object] | None"]] def _iso_to_epoch(expires_at: str) -> float | None: @@ -39,7 +39,7 @@ def _to_scopes(raw: object) -> tuple[str, ...]: return () -def _to_oauth_token(payload: dict[str, object]) -> OAuthToken | None: +def _to_oauth_token(payload: Mapping[str, object]) -> OAuthToken | None: access_token = payload.get("access_token") if not isinstance(access_token, str): return None diff --git a/litellm/proxy/_experimental/mcp_server/rest_endpoints.py b/litellm/proxy/_experimental/mcp_server/rest_endpoints.py index b917530dd52..af3d966c95b 100644 --- a/litellm/proxy/_experimental/mcp_server/rest_endpoints.py +++ b/litellm/proxy/_experimental/mcp_server/rest_endpoints.py @@ -1,35 +1,39 @@ import asyncio import importlib +from collections.abc import Awaitable, Callable, Mapping from datetime import datetime from typing import ( + TYPE_CHECKING, Any, - Awaitable, - Callable, - Dict, - List, Literal, - Mapping, - Optional, - Set, - Tuple, - Union, ) import httpx from fastapi import APIRouter, Depends, HTTPException, Query, Request, status from litellm._logging import verbose_logger -from litellm.proxy._experimental.mcp_server.exceptions import MCPUpstreamAuthError +from litellm.proxy._experimental.mcp_server.exceptions import ( + MCPServerListError, + MCPUpstreamAuthError, +) +from litellm.proxy._experimental.mcp_server.faults.list_outcomes import ( + classify_list_exception, + list_fault_http_status, +) from litellm.proxy._experimental.mcp_server.ui_session_utils import ( build_effective_auth_contexts, ) from litellm.proxy._experimental.mcp_server.utils import ( MCPMissingUserEnvVarsError, + get_server_prefix, merge_mcp_headers, ) from litellm.proxy._types import LitellmUserRoles, UserAPIKeyAuth from litellm.proxy.auth.ip_address_utils import IPAddressUtils from litellm.proxy.auth.user_api_key_auth import user_api_key_auth + +if TYPE_CHECKING: + from litellm.proxy._experimental.mcp_server.db import OAuthCredentialPayload from litellm.proxy.common_utils.http_parsing_utils import _safe_get_request_headers from litellm.types.mcp import MCPAuth from litellm.types.utils import CallTypes @@ -69,6 +73,7 @@ if MCP_AVAILABLE: from mcp.types import Tool as MCPTool from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( + _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES, global_mcp_server_manager, ) from litellm.proxy._experimental.mcp_server.oauth_utils import ( @@ -88,12 +93,12 @@ if MCP_AVAILABLE: ######################################################## ############ MCP Server REST API Routes ################# async def _safe_fire_mcp_tool_call_logging( - logging_obj: Optional[Any], + logging_obj: Any | None, result: Any, start_time: datetime, end_time: datetime, - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - request_data: Optional[Mapping[str, object]] = None, + user_api_key_auth: UserAPIKeyAuth | None = None, + request_data: Mapping[str, object] | None = None, ) -> None: if logging_obj is None: return @@ -114,11 +119,98 @@ if MCP_AVAILABLE: if isinstance(logging_error, BaseException): verbose_logger.warning("MCP tool call logging failed (continuing): %s", logging_error) + def _relay_upstream_auth_http_exception(e: MCPUpstreamAuthError, request: Request) -> HTTPException: + """Convert a client-forwarded pass-through upstream 401 into an HTTPException that preserves the + upstream WWW-Authenticate, so a standards-compliant MCP client can run the upstream OAuth flow + instead of the generic 500 the endpoint catch-all would return.""" + return e.to_http_exception( + base_url=get_request_base_url(request), + request_path=request.scope.get("_original_path") or request.url.path, + ) + + async def _handle_virtual_mcp_tool( + request: Request, + data: dict[str, Any], + tool_name: str, + user_api_key_dict: UserAPIKeyAuth, + ) -> Any: + """Handle the virtual ``mcp_tool_search`` / ``mcp_tool_call`` REST tools (gated on + ``mcp_tool_search_enabled``). Kept out of ``call_tool_rest_api`` so that endpoint stays a single + dispatch. An upstream 401 raised by the virtual ``mcp_tool_call`` propagates unhandled to the + caller's ``except MCPUpstreamAuthError`` relay, the same as the direct call path.""" + from litellm.proxy._experimental.mcp_server.auth.user_api_key_auth_mcp import ( + MCPRequestHandler, + ) + from litellm.proxy._experimental.mcp_server.tool_search import ( + MCP_TOOL_SEARCH_TOOL_NAME, + coerce_top_k, + handle_mcp_tool_call, + handle_mcp_tool_search, + ) + from litellm.proxy.common_request_processing import ProxyBaseLLMRequestProcessing + from litellm.proxy.proxy_server import general_settings, proxy_config, proxy_logging_obj + + if not getattr(getattr(user_api_key_dict, "object_permission", None), "mcp_tool_search_enabled", False): + raise HTTPException( + status_code=403, + detail={"error": "forbidden", "message": f"{tool_name} requires mcp_tool_search_enabled on the key"}, + ) + tool_arguments = data.get("arguments") or {} + rest_client_ip = IPAddressUtils.get_mcp_client_ip(request) + ( + virtual_mcp_auth_header, + virtual_mcp_server_auth_headers, + virtual_raw_headers, + ) = _extract_mcp_headers_from_request(request, MCPRequestHandler) + virtual_oauth2_headers = MCPRequestHandler._get_oauth2_headers_from_headers(request.headers) + if tool_name == MCP_TOOL_SEARCH_TOOL_NAME: + return await handle_mcp_tool_search( + query=tool_arguments.get("query", ""), + top_k=coerce_top_k(tool_arguments.get("top_k", 5)), + user_api_key_dict=user_api_key_dict, + client_ip=rest_client_ip, + mcp_auth_header=virtual_mcp_auth_header, + mcp_server_auth_headers=virtual_mcp_server_auth_headers, + oauth2_headers=virtual_oauth2_headers, + raw_headers=virtual_raw_headers, + ) + # MCP_TOOL_CALL_TOOL_NAME: run the same pre-call pipeline as the normal path so the tool + # execution is spend-logged and guardrail-checked. + (_, virtual_logging_obj) = await ProxyBaseLLMRequestProcessing(data=data).common_processing_pre_call_logic( + request=request, + user_api_key_dict=user_api_key_dict, + proxy_config=proxy_config, + route_type=CallTypes.call_mcp_tool.value, + proxy_logging_obj=proxy_logging_obj, + general_settings=general_settings, + ) + _tool_start_time = datetime.now() + result = await handle_mcp_tool_call( + tool_name=tool_arguments.get("tool_name", ""), + arguments=tool_arguments.get("arguments") or {}, + user_api_key_dict=user_api_key_dict, + client_ip=rest_client_ip, + mcp_auth_header=virtual_mcp_auth_header, + mcp_server_auth_headers=virtual_mcp_server_auth_headers, + oauth2_headers=virtual_oauth2_headers, + raw_headers=virtual_raw_headers, + litellm_logging_obj=virtual_logging_obj, + ) + await _safe_fire_mcp_tool_call_logging( + virtual_logging_obj, + result, + _tool_start_time, + datetime.now(), + user_api_key_auth=user_api_key_dict, + request_data=data, + ) + return result + def _get_server_auth_header( server, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]], - mcp_auth_header: Optional[str], - ) -> Optional[Union[Dict[str, str], str]]: + mcp_server_auth_headers: dict[str, dict[str, str]] | None, + mcp_auth_header: str | None, + ) -> dict[str, str] | str | None: """Helper function to get server-specific auth header with case-insensitive matching.""" from litellm.proxy._experimental.mcp_server.utils import ( lookup_mcp_server_auth_in_headers, @@ -134,34 +226,53 @@ if MCP_AVAILABLE: return server_auth return mcp_auth_header - def _get_oauth2_server_ids(allowed_server_ids: List[str]) -> Set[str]: - """Return the subset of *allowed_server_ids* whose servers use OAuth2 auth. + def _is_v1_resolved_oauth2_server(server: MCPServer | None) -> bool: + """Whether this server's per-user OAuth2 token is still resolved by v1. - Used as a cheap pre-flight check to skip bulk credential fetching when no - OAuth2 servers are involved in the current request. + A server the v2 resolver owns reads its stored token from the resolver at connect + time and drops any Authorization built for it here, so the v1 lookup would be a DB + round-trip whose result is discarded. Mirrors the same guard on the protocol listing + path and in ``_resolve_oauth2_headers_for_tool_call``. + """ + from litellm.proxy._experimental.mcp_server.outbound_credentials.adapter import ( + to_server_spec, + ) + + if getattr(server, "auth_type", None) != MCPAuth.oauth2: + return False + return to_server_spec(server) is None + + def _v1_resolved_oauth2_server_ids(allowed_server_ids: list[str]) -> set[str]: + """Return the subset of *allowed_server_ids* whose per-user OAuth2 token is still + resolved by v1. + + Used as a cheap pre-flight check to skip bulk credential fetching when no such + server is involved in the current request. """ return { sid for sid in allowed_server_ids - if getattr(global_mcp_server_manager.get_mcp_server_by_id(sid), "auth_type", None) == MCPAuth.oauth2 + if _is_v1_resolved_oauth2_server(global_mcp_server_manager.get_mcp_server_by_id(sid)) } async def _get_user_oauth_extra_headers( - server, + server: MCPServer, user_api_key_dict: UserAPIKeyAuth, - prefetched_creds: Optional[Dict[str, Dict[str, Any]]] = None, - ) -> Optional[Dict[str, str]]: + prefetched_creds: dict[str, "OAuthCredentialPayload"] | None = None, + ) -> dict[str, str] | None: """ For OAuth2 servers, look up the user's stored access token and return it as extra_headers {"Authorization": "Bearer "} so that it reaches the MCP server the same way the admin "Add MCP / Authorize and Fetch" flow does. Returns None for non-OAuth2 servers or when no credential is stored. + A server the v2 resolver owns is skipped; see ``_is_v1_resolved_oauth2_server``. + Args: prefetched_creds: Optional dict keyed by server_id with credential payloads. When provided, avoids a per-server DB round-trip. """ - if getattr(server, "auth_type", None) != MCPAuth.oauth2: + if not _is_v1_resolved_oauth2_server(server): return None user_id = getattr(user_api_key_dict, "user_id", None) server_id = getattr(server, "server_id", None) @@ -200,7 +311,7 @@ if MCP_AVAILABLE: async def _prefetch_user_oauth_creds( user_api_key_dict: UserAPIKeyAuth, - ) -> Dict[str, Dict[str, Any]]: + ) -> dict[str, "OAuthCredentialPayload"]: """Fetch all OAuth2 credentials for the user in a single DB query. Returns a dict keyed by server_id. Used to avoid N+1 DB queries when @@ -224,38 +335,6 @@ if MCP_AVAILABLE: verbose_logger.warning(f"_prefetch_user_oauth_creds: failed to prefetch for user={user_id}: {e}") return {} - async def _get_bulk_user_oauth_headers( - user_api_key_dict: UserAPIKeyAuth, - ) -> Dict[str, Dict[str, str]]: - """ - Fetch ALL OAuth2 credentials for the current user in a single DB query and - return a mapping of server_id → {"Authorization": "Bearer "}. - - This is the batch alternative to calling _get_user_oauth_extra_headers - per-server inside a loop (N+1 DB queries). - """ - user_id = getattr(user_api_key_dict, "user_id", None) - if not user_id: - return {} - try: - from litellm.proxy._experimental.mcp_server.db import ( - list_user_oauth_credentials, - ) - from litellm.proxy.utils import get_prisma_client_or_throw - - prisma_client = get_prisma_client_or_throw( - "Database not connected. Connect a database to use OAuth2 MCP tools." - ) - creds = await list_user_oauth_credentials(prisma_client, user_id) - return { - c["server_id"]: {"Authorization": f"Bearer {c['access_token']}"} - for c in creds - if c.get("access_token") and c.get("server_id") - } - except Exception: - verbose_logger.debug("Failed to bulk-fetch OAuth credentials", exc_info=True) - return {} - def _create_tool_response_objects(tools, server: MCPServer): """Helper function to create tool response objects. @@ -296,8 +375,8 @@ if MCP_AVAILABLE: def _resolve_mcp_server_id_for_rest( server_id: str, - allowed_server_ids: Union[Set[str], List[str]], - client_ip: Optional[str] = None, + allowed_server_ids: set[str] | list[str], + client_ip: str | None = None, ) -> str: """ Map REST ``server_id`` (UUID, server_name, or alias) to canonical server_id. @@ -317,7 +396,7 @@ if MCP_AVAILABLE: request: Request, user_api_key_dict: UserAPIKeyAuth, server_id: str, - ) -> Tuple[List[MCPServer], str]: + ) -> tuple[list[MCPServer], str]: """ Resolve allowed MCP servers for a tool call with IP filtering. @@ -388,7 +467,7 @@ if MCP_AVAILABLE: ) # Build allowed_mcp_servers list (only include allowed servers) - allowed_mcp_servers: List[MCPServer] = [] + allowed_mcp_servers: list[MCPServer] = [] for allowed_server_id in allowed_server_ids_set: server = global_mcp_server_manager.get_mcp_server_by_id(allowed_server_id) if server is not None: @@ -399,9 +478,9 @@ if MCP_AVAILABLE: async def _get_tools_for_single_server( server, server_auth_header, - raw_headers: Optional[Dict[str, str]] = None, - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - extra_headers: Optional[Dict[str, str]] = None, + raw_headers: dict[str, str] | None = None, + user_api_key_auth: UserAPIKeyAuth | None = None, + extra_headers: dict[str, str] | None = None, apply_tool_filters: bool = True, ): """Helper function to get tools for a single server. @@ -427,20 +506,19 @@ if MCP_AVAILABLE: # enforced even when no allowlist is set (matches the SSE/HTTP path). tools = filter_tools_by_allowed_tools(tools, server) - # Filter tools based on user_api_key_auth.object_permission.mcp_tool_permissions - # This provides per-key/team/org control over which tools can be accessed - if ( - user_api_key_auth - and user_api_key_auth.object_permission - and user_api_key_auth.object_permission.mcp_tool_permissions - ): - # Dict keys may be server_ids OR names/aliases; normalize so lookup - # by concrete server_id resolves name-keyed restrictions too. - allowed_tools_for_server = global_mcp_server_manager.expand_tool_permissions( - user_api_key_auth.object_permission.mcp_tool_permissions - ).get(server.server_id) - if allowed_tools_for_server is not None and len(allowed_tools_for_server) > 0: - # Filter tools to only include those in the allowed list + # Filter by the key's effective tool permissions through the same + # primitive the MCP protocol path uses (direct grants, toolset grants, + # and team/agent/org ceilings), so REST listing cannot drift from it + if user_api_key_auth: + from litellm.proxy._experimental.mcp_server.auth.user_api_key_auth_mcp import ( + MCPRequestHandler, + ) + + allowed_tools_for_server = await MCPRequestHandler.get_allowed_tools_for_server( + server_id=server.server_id, + user_api_key_auth=user_api_key_auth, + ) + if allowed_tools_for_server is not None: tools = [tool for tool in tools if _tool_name_matches(tool.name, allowed_tools_for_server)] return _create_tool_response_objects(tools, server) @@ -448,7 +526,7 @@ if MCP_AVAILABLE: async def _resolve_allowed_mcp_servers_for_tool_call( user_api_key_dict: UserAPIKeyAuth, server_id: str, - ) -> List[MCPServer]: + ) -> list[MCPServer]: """Resolve allowed MCP servers for the given user and validate server_id access.""" auth_contexts = await build_effective_auth_contexts(user_api_key_dict) allowed_server_ids_set = set() @@ -463,7 +541,7 @@ if MCP_AVAILABLE: "message": f"The key is not allowed to access server {server_id}", }, ) - allowed_mcp_servers: List[MCPServer] = [] + allowed_mcp_servers: list[MCPServer] = [] for allowed_server_id in allowed_server_ids_set: server = global_mcp_server_manager.get_mcp_server_by_id(allowed_server_id) if server is not None: @@ -472,10 +550,10 @@ if MCP_AVAILABLE: async def _list_tools_for_single_server( server_id: str, - allowed_server_ids: List[str], - rest_client_ip: Optional[str], + allowed_server_ids: list[str], + rest_client_ip: str | None, mcp_server_auth_headers: dict, - mcp_auth_header: Optional[str], + mcp_auth_header: str | None, raw_headers_from_request: dict, user_api_key_dict: UserAPIKeyAuth, apply_tool_filters: bool = True, @@ -539,6 +617,16 @@ if MCP_AVAILABLE: # matching status code and WWW-Authenticate challenge; that is what # lets standards-compliant MCP clients run the upstream OAuth flow. raise + except MCPServerListError as e: + fault = classify_list_exception(e) + verbose_logger.info(f"Listing tools from {server.name} failed with a {fault.tag} fault") + raise HTTPException( + status_code=list_fault_http_status(fault), + detail={ + "error": fault.tag, + "message": f"Failed to list tools from server {get_server_prefix(server)}", + }, + ) from e except Exception as e: verbose_logger.exception(f"Error getting tools from {server.name}: {e}") return { @@ -552,12 +640,12 @@ if MCP_AVAILABLE: "message": "Successfully retrieved tools", } - def _as_query_str(value: Any) -> Optional[str]: + def _as_query_str(value: Any) -> str | None: """Coerce an Optional[str] Query param to str|None, dropping unresolved FastAPI defaults.""" return value if isinstance(value, str) else None async def _resolve_toolset_scope( - toolset_name: Optional[str], + toolset_name: str | None, user_api_key_dict: UserAPIKeyAuth, ) -> UserAPIKeyAuth: """Resolve ``toolset_name`` to its scoped ``UserAPIKeyAuth``, or return unchanged.""" @@ -578,11 +666,9 @@ if MCP_AVAILABLE: @router.get("/tools/list", dependencies=[Depends(user_api_key_auth)]) async def list_tool_rest_api( request: Request, - server_id: Optional[str] = Query(None, description="The server id to list tools for"), - mcp_server_name: Optional[str] = Query( - None, description="Filter tools to a single MCP server by name or alias" - ), - toolset_name: Optional[str] = Query(None, description="Filter tools to a single toolset by name"), + server_id: str | None = Query(None, description="The server id to list tools for"), + mcp_server_name: str | None = Query(None, description="Filter tools to a single MCP server by name or alias"), + toolset_name: str | None = Query(None, description="Filter tools to a single toolset by name"), include_disabled_tools: bool = Query( False, description=( @@ -720,7 +806,7 @@ if MCP_AVAILABLE: # to avoid an unnecessary DB round-trip on requests with no OAuth2 MCP servers. prefetched_oauth_creds = ( await _prefetch_user_oauth_creds(user_api_key_dict) - if _get_oauth2_server_ids(allowed_server_ids) + if _v1_resolved_oauth2_server_ids(allowed_server_ids) else {} ) @@ -750,7 +836,11 @@ if MCP_AVAILABLE: list_tools_result.extend(tools_result) except Exception as e: verbose_logger.exception(f"Error getting tools from {server.name}: {e}") - errors.append(f"{server.name}: {str(e)}") + errors.append( + f"{get_server_prefix(server)}: {classify_list_exception(e).tag}" + if isinstance(e, (MCPServerListError, MCPUpstreamAuthError)) + else f"{get_server_prefix(server)}: {str(e)}" + ) continue if errors and not list_tools_result: @@ -770,7 +860,10 @@ if MCP_AVAILABLE: request_path=request.scope.get("_original_path") or request.url.path, ) except HTTPException as http_exc: - if http_exc.status_code == status.HTTP_404_NOT_FOUND: + if http_exc.status_code == status.HTTP_404_NOT_FOUND or server_id: + # Single-server requests relay the truthful status (a 502/504 upstream fault must + # not masquerade as a 200 empty-success body); only the multi-server aggregate + # keeps the legacy error-dict response shape below. raise # Internal access/IP 403s keep the legacy error-dict response shape # so the existing contract stays intact. @@ -820,77 +913,10 @@ if MCP_AVAILABLE: from litellm.proxy._experimental.mcp_server.tool_search import ( MCP_TOOL_CALL_TOOL_NAME, MCP_TOOL_SEARCH_TOOL_NAME, - coerce_top_k, - handle_mcp_tool_call, - handle_mcp_tool_search, ) if tool_name in (MCP_TOOL_SEARCH_TOOL_NAME, MCP_TOOL_CALL_TOOL_NAME): - if not getattr( - getattr(user_api_key_dict, "object_permission", None), - "mcp_tool_search_enabled", - False, - ): - raise HTTPException( - status_code=403, - detail={ - "error": "forbidden", - "message": f"{tool_name} requires mcp_tool_search_enabled on the key", - }, - ) - rest_client_ip = IPAddressUtils.get_mcp_client_ip(request) - ( - virtual_mcp_auth_header, - virtual_mcp_server_auth_headers, - virtual_raw_headers, - ) = _extract_mcp_headers_from_request(request, MCPRequestHandler) - virtual_oauth2_headers = MCPRequestHandler._get_oauth2_headers_from_headers(request.headers) - if tool_name == MCP_TOOL_SEARCH_TOOL_NAME: - return await handle_mcp_tool_search( - query=tool_arguments.get("query", ""), - top_k=coerce_top_k(tool_arguments.get("top_k", 5)), - user_api_key_dict=user_api_key_dict, - client_ip=rest_client_ip, - mcp_auth_header=virtual_mcp_auth_header, - mcp_server_auth_headers=virtual_mcp_server_auth_headers, - oauth2_headers=virtual_oauth2_headers, - raw_headers=virtual_raw_headers, - ) - else: # MCP_TOOL_CALL_TOOL_NAME - # Run the same pre-call pipeline as the normal call path so the - # tool execution is spend-logged and guardrail-checked. - ( - _, - virtual_logging_obj, - ) = await ProxyBaseLLMRequestProcessing(data=data).common_processing_pre_call_logic( - request=request, - user_api_key_dict=user_api_key_dict, - proxy_config=proxy_config, - route_type=CallTypes.call_mcp_tool.value, - proxy_logging_obj=proxy_logging_obj, - general_settings=general_settings, - ) - _tool_start_time = datetime.now() - result = await handle_mcp_tool_call( - tool_name=tool_arguments.get("tool_name", ""), - arguments=tool_arguments.get("arguments") or {}, - user_api_key_dict=user_api_key_dict, - client_ip=rest_client_ip, - mcp_auth_header=virtual_mcp_auth_header, - mcp_server_auth_headers=virtual_mcp_server_auth_headers, - oauth2_headers=virtual_oauth2_headers, - raw_headers=virtual_raw_headers, - litellm_logging_obj=virtual_logging_obj, - ) - await _safe_fire_mcp_tool_call_logging( - virtual_logging_obj, - result, - _tool_start_time, - datetime.now(), - user_api_key_auth=user_api_key_dict, - request_data=data, - ) - return result + return await _handle_virtual_mcp_tool(request, data, tool_name, user_api_key_dict) # Validate required parameters early server_id = data.get("server_id") @@ -949,7 +975,7 @@ if MCP_AVAILABLE: ) = await _resolve_allowed_mcp_servers_with_ip_filter(request, user_api_key_dict, server_id) # Look up per-user OAuth headers for this server (mirrors list_tool_rest_api). - user_oauth_extra_headers: Optional[Dict[str, str]] = None + user_oauth_extra_headers: dict[str, str] | None = None target_server = next( (s for s in allowed_mcp_servers if s.server_id == canonical_server_id), None, @@ -1019,8 +1045,16 @@ if MCP_AVAILABLE: "guardrail_name": getattr(e, "guardrail_name", None), }, ) + except MCPUpstreamAuthError as e: + # A client-forwarded pass-through upstream 401 from either the direct or the virtual call + # branch. Relay it as a 401 + WWW-Authenticate so the MCP client can re-run upstream OAuth, + # and log at info: an expected caller-must-reauth signal, not an operator-actionable error. + verbose_logger.info(f"MCP tool call relaying upstream HTTP {e.status_code}") + raise _relay_upstream_auth_http_exception(e, request) except HTTPException as e: - # Re-raise HTTPException as-is to preserve status code and detail + # Locally generated denials (tool/server permission, IP filtering, BYOK) stay at error level + # so restriction probing keeps full monitoring visibility; the relayed upstream 401 above is + # the only status demoted to info. verbose_logger.error(f"HTTPException in MCP tool call: {str(e)}") raise e except Exception as e: @@ -1054,18 +1088,18 @@ if MCP_AVAILABLE: (client_id, client_secret, scopes) — any value may be ``None``. """ creds = request.credentials if isinstance(request.credentials, dict) else {} - client_id: Optional[str] = creds.get("client_id") - client_secret: Optional[str] = creds.get("client_secret") + client_id: str | None = creds.get("client_id") + client_secret: str | None = creds.get("client_secret") scopes_raw = creds.get("scopes") - scopes: Optional[List[str]] = scopes_raw if isinstance(scopes_raw, list) else None + scopes: list[str] | None = scopes_raw if isinstance(scopes_raw, list) else None return client_id, client_secret, scopes async def _execute_with_mcp_client( request: NewMCPServerRequest, operation: Callable[..., Awaitable[Any]], - mcp_auth_header: Optional[Union[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, + mcp_auth_header: str | dict[str, str] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, ) -> dict: """ Create a temporary MCP client from *request*, run *operation*, and return the result. @@ -1088,7 +1122,7 @@ if MCP_AVAILABLE: try: client_id, client_secret, scopes = _extract_credentials(request) - _oauth2_flow: Optional[Literal["client_credentials", "authorization_code"]] = request.oauth2_flow or ( + _oauth2_flow: Literal["client_credentials", "authorization_code"] | None = request.oauth2_flow or ( "client_credentials" if client_id and client_secret and request.token_url else None ) # client_credentials requires token_url to fetch a token; without it the @@ -1109,6 +1143,7 @@ if MCP_AVAILABLE: static_headers=request.static_headers, client_id=client_id, client_secret=client_secret, + issuer=request.issuer, token_url=request.token_url, scopes=scopes, authorization_url=request.authorization_url, @@ -1203,7 +1238,7 @@ if MCP_AVAILABLE: spec = await load_openapi_spec_async(spec_path) paths = spec.get("paths", {}) components = spec.get("components", {}) - tools: List[dict] = [] + tools: list[dict] = [] used_names: set = set() for path, path_item in paths.items(): for method in ("get", "post", "put", "delete", "patch"): @@ -1310,7 +1345,7 @@ if MCP_AVAILABLE: headers = request.headers - mcp_auth_header: Optional[str] = None + mcp_auth_header: str | None = None if new_mcp_server_request.auth_type in { MCPAuth.api_key, MCPAuth.bearer_token, @@ -1321,8 +1356,13 @@ if MCP_AVAILABLE: if isinstance(credentials, dict): mcp_auth_header = credentials.get("auth_value") - oauth2_headers: Optional[Dict[str, str]] = None - if new_mcp_server_request.auth_type == MCPAuth.oauth2: + # Authorization doubles as the admission fallback (LITELLM_API_KEY_HEADER_NAME_SECONDARY): + # when the primary x-litellm-api-key header is absent, the Authorization value is the + # caller's LiteLLM key, not an upstream token, and must never be forwarded upstream. + oauth2_headers: dict[str, str] | None = None + if new_mcp_server_request.auth_type in _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES and headers.get( + MCPRequestHandler.LITELLM_API_KEY_HEADER_NAME_PRIMARY + ): oauth2_headers = MCPRequestHandler._get_oauth2_headers_from_headers(headers) async def _list_tools_operation(client): @@ -1330,8 +1370,8 @@ if MCP_AVAILABLE: return await session.list_tools() list_tools_response = await client.run_with_session(_list_tools_session_operation) - list_tools_result: List[MCPTool] = list_tools_response.tools - model_dumped_tools: List[dict] = [tool.model_dump() for tool in list_tools_result] + list_tools_result: list[MCPTool] = list_tools_response.tools + model_dumped_tools: list[dict] = [tool.model_dump() for tool in list_tools_result] return { "tools": model_dumped_tools, "error": None, diff --git a/litellm/proxy/_experimental/mcp_server/semantic_tool_filter.py b/litellm/proxy/_experimental/mcp_server/semantic_tool_filter.py index f24d5715e83..ed78f7c6fb8 100644 --- a/litellm/proxy/_experimental/mcp_server/semantic_tool_filter.py +++ b/litellm/proxy/_experimental/mcp_server/semantic_tool_filter.py @@ -4,9 +4,13 @@ Semantic MCP Tool Filtering using semantic-router Filters MCP tools semantically for /chat/completions and /responses endpoints. """ +import asyncio from typing import TYPE_CHECKING, Any, Dict, List, Optional from litellm._logging import verbose_logger +from litellm.exceptions import ContextWindowExceededError +from litellm.litellm_core_utils.exception_mapping_utils import ExceptionCheckers +from litellm.proxy._experimental.mcp_server.faults import iter_exception_tree from litellm.proxy._experimental.mcp_server.utils import MCP_TOOL_PREFIX_SEPARATOR if TYPE_CHECKING: @@ -15,6 +19,33 @@ if TYPE_CHECKING: from litellm.router import Router +class SemanticToolFilterContextWindowError(Exception): + """Raised when the embedding model exceeds its context window, so semantic filtering cannot run.""" + + def __init__(self, embedding_model: str, stage: str, original_error: str): + self.embedding_model = embedding_model + self.stage = stage + self.original_error = original_error + super().__init__( + f"MCP semantic tool filtering could not run: embedding model '{embedding_model}' " + f"exceeded its context window while embedding {stage}. " + f"The request was blocked instead of silently passing all tools through. " + f"Switch to an embedding model with a larger context window, or disable " + f"semantic tool filtering." + ) + + +def _is_context_window_error(error: Optional[BaseException]) -> bool: + """Detect a context-window overflow anywhere in an exception's tree.""" + if error is None: + return False + return any( + isinstance(current, ContextWindowExceededError) + or ExceptionCheckers.is_error_str_context_window_exceeded(str(current)) + for current in iter_exception_tree(error) + ) + + class SemanticMCPToolFilter: """Filters MCP tools using semantic similarity to reduce context window size.""" @@ -42,7 +73,9 @@ class SemanticMCPToolFilter: self.embedding_model = embedding_model self.router_instance = litellm_router_instance self.tool_router: Optional["SemanticRouter"] = None + self.context_window_error: Optional[str] = None self._tool_map: Dict[str, Any] = {} # MCPTool objects or OpenAI function dicts + self._index_sync_lock = asyncio.Lock() async def build_router_from_mcp_registry(self) -> None: """Build semantic router from all MCP tools in the registry (no auth checks).""" @@ -111,6 +144,7 @@ class SemanticMCPToolFilter: return try: + self.context_window_error = None # Convert tools to routes routes = [] self._tool_map = {} @@ -143,8 +177,86 @@ class SemanticMCPToolFilter: except Exception as e: verbose_logger.error(f"Failed to build semantic router: {e}") self.tool_router = None + if _is_context_window_error(e): + self.context_window_error = str(e) + return raise + def _has_tools_missing_from_index(self, tools: list[Any]) -> bool: + """Allocation-free check for any named tool not yet in the semantic index.""" + return any(name and name not in self._tool_map for name in (self._extract_tool_info(t)[0] for t in tools)) + + def _tools_missing_from_index(self, tools: list[Any]) -> dict[str, Any]: + """Map name -> tool for every named tool not yet in the semantic index.""" + return { + name: tool + for name, tool in ((self._extract_tool_info(t)[0], t) for t in tools) + if name and name not in self._tool_map + } + + async def _ensure_tools_indexed(self, available_tools: list[Any]) -> None: + """ + Index request-time tools the startup build never saw. + + The startup index lists every registered MCP server WITHOUT per-user + credentials, so servers requiring per-user auth (interactive OAuth + tokens, user-scoped env vars) contribute zero routes. Tools reaching + the filter came through an authenticated expansion; without indexing + them here they can never be selected, so requests either bypass + filtering entirely (N->N) or lose every tool to unrelated matches. + + Runs async-only (no synchronous embedding on the request path) and + never writes shared error state: an embedding failure here raises and + is scoped to the requesting call, so one request's oversized tool + description cannot poison the filter for other users on the worker. + """ + from semantic_router.routers import SemanticRouter + from semantic_router.routers.base import Route + + from litellm.router_strategy.auto_router.litellm_encoder import ( + LiteLLMRouterEncoder, + ) + + if not self._has_tools_missing_from_index(available_tools): + return + + async with self._index_sync_lock: + missing = self._tools_missing_from_index(available_tools) + if not missing: + return + + descriptions = {name: self._extract_tool_info(tool)[1] for name, tool in missing.items()} + routes = [ + Route( + name=name, + description=description, + utterances=[description], + score_threshold=self.similarity_threshold, + ) + for name, description in descriptions.items() + ] + + if self.tool_router is None: + router = SemanticRouter( + routes=[], + encoder=LiteLLMRouterEncoder( + litellm_router_instance=self.router_instance, + model_name=self.embedding_model, + score_threshold=self.similarity_threshold, + ), + auto_sync="local", + top_k=self.top_k, + ) + await router.aadd(routes) + self.tool_router = router + else: + await self.tool_router.aadd(routes) + + self._tool_map.update(missing) + verbose_logger.info( + f"Semantic tool filter indexed {len(routes)} request-time tools missing from the startup index" + ) + async def filter_tools( self, query: str, @@ -169,26 +281,55 @@ class SemanticMCPToolFilter: if not available_tools: return available_tools - if not query or not query.strip(): - return available_tools + if self.context_window_error is not None: + raise SemanticToolFilterContextWindowError( + embedding_model=self.embedding_model, + stage="the MCP tool descriptions during semantic router build", + original_error=self.context_window_error, + ) - # Router should be built on startup - if not, something went wrong - if self.tool_router is None: - verbose_logger.warning("Router not initialized - was build_router_from_mcp_registry() called on startup?") + if not query or not query.strip(): return available_tools # Run semantic filtering try: + await self._ensure_tools_indexed(available_tools) + + if self.tool_router is None: + verbose_logger.warning("Semantic router could not be built from the request's tools") + return available_tools + + available_names = [name for name in (self._extract_tool_info(t)[0] for t in available_tools) if name] + if not available_names: + return available_tools + limit = top_k or self.top_k - matches = self.tool_router(text=query, limit=limit) + if self.tool_router.top_k < limit: + self.tool_router.top_k = limit + matches = self.tool_router(text=query, limit=limit, route_filter=available_names) matched_tool_names = self._extract_tool_names_from_matches(matches) if not matched_tool_names: return available_tools - return self._get_tools_by_names(matched_tool_names, available_tools) + filtered_tools = self._get_tools_by_names(matched_tool_names, available_tools) + if not filtered_tools: + return available_tools + return filtered_tools + except SemanticToolFilterContextWindowError: + raise except Exception as e: + if _is_context_window_error(e): + verbose_logger.error( + f"Semantic tool filter embedding exceeded its context window: {e}", + exc_info=True, + ) + raise SemanticToolFilterContextWindowError( + embedding_model=self.embedding_model, + stage="the user query or the MCP tool descriptions being indexed", + original_error=str(e), + ) from e verbose_logger.error(f"Semantic tool filter failed: {e}", exc_info=True) return available_tools diff --git a/litellm/proxy/_experimental/mcp_server/server.py b/litellm/proxy/_experimental/mcp_server/server.py index 55a0fa083c0..14673cf12c1 100644 --- a/litellm/proxy/_experimental/mcp_server/server.py +++ b/litellm/proxy/_experimental/mcp_server/server.py @@ -13,18 +13,11 @@ import time import traceback import types import uuid +from collections.abc import AsyncIterator, Callable, Mapping from datetime import datetime from typing import ( + TYPE_CHECKING, Any, - AsyncIterator, - Callable, - Dict, - List, - Mapping, - Optional, - Set, - Tuple, - Union, cast, ) @@ -58,6 +51,9 @@ from litellm.proxy._experimental.mcp_server.mcp_context import ( _mcp_gateway_server_name, ) from litellm.proxy._experimental.mcp_server.mcp_debug import MCPDebug +from litellm.proxy._experimental.mcp_server.oauth_utils import ( + _redact_mcp_resource_url, +) from litellm.proxy._experimental.mcp_server.utils import ( LITELLM_MCP_SERVER_DESCRIPTION, LITELLM_MCP_SERVER_NAME, @@ -83,11 +79,14 @@ from litellm.types.mcp_server.mcp_server_manager import MCPInfo, MCPServer from litellm.types.utils import CallTypes, StandardLoggingMCPToolCall from litellm.utils import Rules, client, function_setup +if TYPE_CHECKING: + from litellm.proxy._experimental.mcp_server.db import OAuthCredentialPayload + # Short-lived in-memory cache for BYOK credentials. # Keyed by (user_id, server_id); value is (credential_or_None, monotonic_timestamp). # Storing the credential value (not just a bool) means _get_byok_credential and # _check_byok_credential share a single DB round-trip per TTL window. -_byok_cred_cache: Dict[Tuple[str, str], Tuple[Optional[str], float]] = {} +_byok_cred_cache: dict[tuple[str, str], tuple[str | None, float]] = {} _BYOK_CRED_CACHE_TTL = 60 # seconds _BYOK_CRED_CACHE_MAX_SIZE = 4096 # cap to prevent unbounded growth _STATEFUL_SESSION_IDLE_TIMEOUT_SECONDS = 30 * 60 @@ -103,6 +102,9 @@ _MAX_STATEFUL_SESSIONS_PER_OWNER = 100 # prevents an authenticated client from forcing the proxy to buffer an # arbitrarily large body just to make a routing decision. _MCP_ROUTING_PEEK_MAX_BYTES = 4096 +# ASGI scope key holding the tracing span of the request carrying an MCP +# message, written on the request task and read back by the message handler. +_MCP_TRANSPORT_SPAN_SCOPE_KEY = "litellm_otel_transport_span" def _invalidate_byok_cred_cache(user_id: str, server_id: str) -> None: @@ -114,7 +116,7 @@ def _invalidate_byok_cred_cache(user_id: str, server_id: str) -> None: _byok_cred_cache.pop((user_id, server_id), None) -def _write_byok_cred_cache(user_id: str, server_id: str, credential: Optional[str]) -> None: +def _write_byok_cred_cache(user_id: str, server_id: str, credential: str | None) -> None: """Write a credential value to the cache, evicting all entries if at capacity.""" if len(_byok_cred_cache) >= _BYOK_CRED_CACHE_MAX_SIZE: _byok_cred_cache.clear() @@ -144,7 +146,7 @@ try: # Robust auth lookup keyed by session_object. _session_obj_auth_storage: "weakref.WeakKeyDictionary[Any, MCPAuthenticatedUser]" = weakref.WeakKeyDictionary() - active_mcp_session_var: contextvars.ContextVar[Optional[_McpServerSession]] = contextvars.ContextVar( + active_mcp_session_var: contextvars.ContextVar[_McpServerSession | None] = contextvars.ContextVar( "active_mcp_session", default=None ) except ImportError as e: @@ -169,8 +171,8 @@ _INITIALIZATION_LOCK = asyncio.Lock() def _mcp_session_id_from_headers( - raw_headers: Optional[Dict[str, str]], -) -> Optional[str]: + raw_headers: dict[str, str] | None, +) -> str | None: """The ``mcp-session-id`` of a stateful MCP session, read case-insensitively from the request headers. ``None`` for stateless calls (no such header).""" if not raw_headers: @@ -195,10 +197,10 @@ def _jsonrpc_text_has_top_level_method(text: str) -> bool: depth = 0 in_string = False escaped = False - in_object: List[bool] = [] + in_object: list[bool] = [] reading_key = False expect_key = False - key_chars: List[str] = [] + key_chars: list[str] = [] for ch in text: if in_string: if escaped: @@ -235,14 +237,16 @@ def _jsonrpc_text_has_top_level_method(text: str) -> bool: return False -def _mcp_meta_trace_carrier(req_ctx: object) -> Optional[dict[str, str]]: +def _mcp_meta_trace_carrier(req_ctx: object) -> dict[str, str] | None: """The W3C trace context (``traceparent``/``tracestate``) the MCP client propagated in the request's ``params._meta`` (SEP-414), or ``None``. - Per the OTel MCP semconv the MCP span parents to this propagated context rather - than to the HTTP/session transport (which is recorded as a link instead), so a - streamable-HTTP session that multiplexes many messages does not glue every - message under the session's first request. The client's W3C Baggage is + When present, per the OTel MCP semconv the MCP span parents to this propagated + context rather than to the HTTP transport (which is recorded as a link instead). + When absent, the span nests under the transport span of the request carrying + this specific message, so a streamable-HTTP session that multiplexes many + messages still does not glue every message under the session's first request; + see ``resolve_mcp_span_context``. The client's W3C Baggage is deliberately excluded: it is caller-controlled, and the otel baggage processor stamps allowlisted baggage keys (``litellm.team.id``, ``litellm.metadata.*``, ...) onto the span, so honoring remote baggage would let a client spoof a @@ -256,7 +260,7 @@ def _mcp_meta_trace_carrier(req_ctx: object) -> Optional[dict[str, str]]: return carrier or None -def _otel_set_mcp_trace_carrier(carrier: Optional[dict[str, str]]) -> object: +def _otel_set_mcp_trace_carrier(carrier: dict[str, str] | None) -> object: """Stash ``carrier`` for the otel_v2 MCP span and return a reset token, or ``None`` when otel_v2 is unavailable. Lazily imported so opentelemetry stays an optional dependency.""" @@ -285,6 +289,82 @@ def _otel_reset_mcp_trace_carrier(token: object) -> None: return +def _otel_publish_transport_span_on_scope(scope: Scope) -> None: + """Record this request's tracing span on its own ASGI scope. + + Resolved on the ASGI request task, where the proxy's server span is anchored, + and read back by the MCP message handler through ``req_ctx.request`` — the + ``Request`` the transport attaches to each message. A stateful streamable-HTTP + session handles every message on the task spawned by its ``initialize`` POST, so + the handler's own task cannot see later requests' spans. + + The scope, not the shared session auth context: a JSON-RPC *response* POST + deliberately skips the per-session lock (it can arrive while the tool call that + awaits it is still in flight), so a field on that shared object would be + overwritten mid-call and the tool call would attribute itself to the response's + request. A scope belongs to exactly one request and dies with it, which also + keeps a finished span from being retained by an idle session. + + The live span, not just its context: a failed tool call stamps ``error.*`` on it, + which needs a span still open for writes. Lazily imported so opentelemetry stays + an optional dependency; a no-op when otel_v2 is unavailable or no request span is + anchored.""" + try: + from litellm.integrations.otel.plumbing.context import ( + request_root_span, + ) + + span = request_root_span() + except ImportError: + return + if span is not None: + scope[_MCP_TRANSPORT_SPAN_SCOPE_KEY] = span + + +def _otel_transport_span_from_message(req_ctx: object) -> object: + """The tracing span of the HTTP request that carried this MCP message. + + Read off that request's ASGI scope, reached through the ``Request`` the + streamable-HTTP transport attaches to each message, so it is this message's + transport and not whichever request happens to have touched the session last. + Returns whatever the scope holds; the otel plumbing validates it.""" + request = getattr(req_ctx, "request", None) + scope = getattr(request, "scope", None) + if not isinstance(scope, Mapping): + return None + return scope.get(_MCP_TRANSPORT_SPAN_SCOPE_KEY) + + +def _otel_set_mcp_transport_span(span: object) -> object: + """Publish the current message's transport span, which the otel_v2 MCP span + attaches to and a failed tool call stamps its error on. Returns a reset token, + or ``None`` when otel_v2 is unavailable.""" + if span is None: + return None + try: + from litellm.integrations.otel.plumbing.context import ( + set_mcp_message_transport_span, + ) + + return set_mcp_message_transport_span(span) + except ImportError: + return None + + +def _otel_reset_mcp_transport_span(token: object) -> None: + """Paired with ``_otel_set_mcp_transport_span``.""" + if token is None: + return + try: + from litellm.integrations.otel.plumbing.context import ( + reset_mcp_message_transport_span, + ) + + reset_mcp_message_transport_span(token) + except ImportError: + return + + def _proxy_exception_to_http_exception(exc: ProxyException) -> HTTPException: """Map a ``ProxyException`` to an ``HTTPException`` that preserves its real status code and headers. @@ -326,6 +406,7 @@ if MCP_AVAILABLE: CallToolResult, EmbeddedResource, ImageContent, + ListToolsResult, Prompt, TextContent, ) @@ -334,6 +415,14 @@ if MCP_AVAILABLE: from litellm.proxy._experimental.mcp_server.auth.litellm_auth_handler import ( MCPAuthenticatedUser, ) + from litellm.proxy._experimental.mcp_server.faults.list_outcomes import ( + SERVER_OUTCOMES_META_KEY, + AggregateToolListing, + ServerListOk, + ServerOutcome, + classify_list_exception, + outcome_wire_value, + ) from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( MCPServerManager, _caller_authorization_fans_out, @@ -345,6 +434,7 @@ if MCP_AVAILABLE: from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import ( _request_auth_header, _request_extra_headers, + _request_resolved_auth_headers, ) from litellm.proxy._experimental.mcp_server.sse_transport import SseServerTransport from litellm.proxy._experimental.mcp_server.tool_registry import ( @@ -368,12 +458,12 @@ if MCP_AVAILABLE: Object returned by the /tools/list REST API route. """ - mcp_info: Optional[MCPInfo] = None + mcp_info: MCPInfo | None = None model_config = ConfigDict(arbitrary_types_allowed=True) - def _normalize_resource_contents(contents: list) -> List[ReadResourceContents]: + def _normalize_resource_contents(contents: list) -> list[ReadResourceContents]: """Normalize ResourceContents to ReadResourceContents, preserving meta (MCP 1.26.0+).""" - normalized: List[ReadResourceContents] = [] + normalized: list[ReadResourceContents] = [] for content in contents: meta = getattr(content, "meta", None) if meta is None and hasattr(content, "model_dump"): @@ -401,15 +491,15 @@ if MCP_AVAILABLE: def _gateway_create_initialization_options( self, - notification_options: Optional[NotificationOptions] = None, - experimental_capabilities: Optional[Dict[str, Dict[str, Any]]] = None, + notification_options: NotificationOptions | None = None, + experimental_capabilities: dict[str, dict[str, Any]] | None = None, ) -> InitializationOptions: opts = Server.create_initialization_options( self, notification_options=notification_options, experimental_capabilities=experimental_capabilities or {}, ) - updates: Dict[str, Any] = {} + updates: dict[str, Any] = {} merged = _mcp_gateway_initialize_instructions.get() if merged is not None: updates["instructions"] = merged @@ -444,21 +534,21 @@ if MCP_AVAILABLE: json_response=False, # enables SSE streaming stateless=False, ) - _stateful_session_auth_contexts: Dict[str, MCPAuthenticatedUser] = {} - _stateful_session_auth_context_last_seen: Dict[str, float] = {} + _stateful_session_auth_contexts: dict[str, MCPAuthenticatedUser] = {} + _stateful_session_auth_context_last_seen: dict[str, float] = {} # Maps session_id -> owner identifier (hashed API key/token) so we can # reject requests that supply a session_id created by a different caller. # Without this, a leaked mcp-session-id could be driven (or terminated) # by any other authenticated proxy user. - _stateful_session_owners: Dict[str, str] = {} + _stateful_session_owners: dict[str, str] = {} # Per-session lock that serializes ``handle_request`` for the same # mcp-session-id. The stored ``MCPAuthenticatedUser`` is mutated in place # by ``_update_auth_context`` each request; without this lock, two # concurrent requests on the same session would clobber each other's # auth headers / mcp_servers / oauth state while in-flight callbacks are # still reading the shared object. - _stateful_session_locks: Dict[str, asyncio.Lock] = {} - _stateful_session_active_request_counts: Dict[str, int] = {} + _stateful_session_locks: dict[str, asyncio.Lock] = {} + _stateful_session_active_request_counts: dict[str, int] = {} def _remove_stateful_session_tracking(session_id: str) -> None: _stateful_session_auth_contexts.pop(session_id, None) @@ -482,10 +572,10 @@ if MCP_AVAILABLE: _session_manager_cm = None _session_manager_stateful_cm = None _sse_session_manager_cm = None - _stateful_auth_context_cleanup_task: Optional[asyncio.Task] = None + _stateful_auth_context_cleanup_task: asyncio.Task | None = None async def _purge_expired_stateful_session_auth_contexts( - now: Optional[float] = None, + now: float | None = None, ) -> None: """Terminate expired stateful sessions and drop their auth contexts.""" now = time.monotonic() if now is None else now @@ -532,7 +622,7 @@ if MCP_AVAILABLE: """ server_instances = getattr(session_manager_stateful, "_server_instances", {}) - def _owned_live_session_ids() -> List[str]: + def _owned_live_session_ids() -> list[str]: return [ session_id for session_id, session_owner in _stateful_session_owners.items() @@ -642,9 +732,12 @@ if MCP_AVAILABLE: ######################################################## @server.list_tools() - async def handle_list_tools() -> List[Tool]: + async def handle_list_tools() -> "ListToolsResult | list[Tool]": """ - List all available tools. + List all available tools, with each server's listing outcome attached to the result's + ``_meta`` (SERVER_OUTCOMES_META_KEY) so a broken upstream is distinguishable from a healthy + server with no tools. Returning a ListToolsResult (rather than a bare list) makes the MCP SDK + pass the result through unwrapped, which is what lets the ``_meta`` survive to the client. Also captures the active session for propagation to callbacks. """ from mcp.server.lowlevel.server import request_ctx @@ -654,9 +747,11 @@ if MCP_AVAILABLE: if req_ctx: _session_reset_token = active_mcp_session_var.set(req_ctx.session) _trace_token = None + _transport_token = None try: _trace_token = _otel_set_mcp_trace_carrier(_mcp_meta_trace_carrier(req_ctx)) + _transport_token = _otel_set_mcp_transport_span(_otel_transport_span_from_message(req_ctx)) # Get user authentication from context variable ( user_api_key_auth, @@ -687,7 +782,7 @@ if MCP_AVAILABLE: # Get mcp_servers from context variable verbose_logger.debug("MCP list_tools - Calling _list_mcp_tools") - tools = await _list_mcp_tools( + listing = await _list_mcp_tools( user_api_key_auth=user_api_key_auth, mcp_auth_header=mcp_auth_header, mcp_servers=mcp_servers, @@ -697,19 +792,27 @@ if MCP_AVAILABLE: log_list_tools_to_spendlogs=True, list_tools_log_source="mcp_protocol", ) - verbose_logger.info(f"MCP list_tools - Successfully returned {len(tools)} tools") - return tools + verbose_logger.info(f"MCP list_tools - Successfully returned {len(listing.tools)} tools") + if not listing.outcomes: + return listing.tools + outcome_meta = { + SERVER_OUTCOMES_META_KEY: { + key: outcome_wire_value(outcome) for key, outcome in listing.outcomes.items() + } + } + return ListToolsResult.model_validate({"tools": listing.tools, "_meta": outcome_meta}) except Exception as e: verbose_logger.exception(f"Error in list_tools endpoint: {str(e)}") # Return empty list instead of failing completely # This prevents the HTTP stream from failing and allows the client to get a response return [] finally: + _otel_reset_mcp_transport_span(_transport_token) _otel_reset_mcp_trace_carrier(_trace_token) if _session_reset_token is not None: active_mcp_session_var.reset(_session_reset_token) - def _capture_host_progress_callback(host_server) -> Optional[Callable]: + def _capture_host_progress_callback(host_server) -> Callable | None: """Return a progress-forwarding callback bound to the host MCP session. Returns ``None`` when the host did not supply a progress token. @@ -727,7 +830,7 @@ if MCP_AVAILABLE: return None host_session = host_ctx.session - async def forward_progress(progress: float, total: Optional[float]): + async def forward_progress(progress: float, total: float | None): """Forward progress notifications from external MCP to Host""" try: await host_session.send_progress_notification( @@ -746,7 +849,7 @@ if MCP_AVAILABLE: name: str, arguments: dict[str, Any], user_api_key_auth: UserAPIKeyAuth, - ) -> Optional[LiteLLMLoggingObj]: + ) -> LiteLLMLoggingObj | None: """Run the pre-call pipeline (guardrails + logging setup) for a virtual mcp_tool_call so the SSE path spend-logs like the REST path.""" from fastapi import Request @@ -782,15 +885,15 @@ if MCP_AVAILABLE: async def _dispatch_virtual_mcp_tool( name: str, - arguments: Optional[dict[str, Any]], - user_api_key_auth: Optional[UserAPIKeyAuth], - client_ip: Optional[str], - mcp_servers: Optional[list[str]] = None, - mcp_auth_header: Optional[str] = None, - mcp_server_auth_headers: Optional[dict[str, dict[str, str]]] = None, - oauth2_headers: Optional[dict[str, str]] = None, - raw_headers: Optional[dict[str, str]] = None, - ) -> Optional[CallToolResult]: + arguments: dict[str, Any] | None, + user_api_key_auth: UserAPIKeyAuth | None, + client_ip: str | None, + mcp_servers: list[str] | None = None, + mcp_auth_header: str | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + ) -> CallToolResult | None: """Handle the mcp_tool_search / mcp_tool_call virtual tools. Returns a CallToolResult when ``name`` is a virtual tool, else ``None`` so @@ -854,7 +957,7 @@ if MCP_AVAILABLE: ) @server.call_tool() - async def mcp_server_tool_call(name: str, arguments: Dict[str, Any] | None) -> CallToolResult: + async def mcp_server_tool_call(name: str, arguments: dict[str, Any] | None) -> CallToolResult: """ Call a specific tool with the provided arguments Args: @@ -878,9 +981,11 @@ if MCP_AVAILABLE: if req_ctx: _session_reset_token = active_mcp_session_var.set(req_ctx.session) _trace_token = None + _transport_token = None try: _trace_token = _otel_set_mcp_trace_carrier(_mcp_meta_trace_carrier(req_ctx)) + _transport_token = _otel_set_mcp_transport_span(_otel_transport_span_from_message(req_ctx)) # Validate arguments ( user_api_key_auth, @@ -935,7 +1040,17 @@ if MCP_AVAILABLE: data = await add_litellm_data_to_request( data=body_data, request=request, - user_api_key_dict=user_api_key_auth, + # Bill a team-derived call to the team that granted it. A keyless admitted + # subject carries no team_id, so spend skipped team updates entirely and + # charged the user's PRIMARY org — the granting team's budget never + # accumulated (so it could never begin to block) and, cross-org, the wrong + # organization was charged. This is the ACCOUNTING half; the enforcement + # half (an already-over-budget team stops granting) lives in the source gate. + # Authorization is unaffected: it ran before this, and the union is resolved + # from the untouched auth object passed to call_mcp_tool below. + user_api_key_dict=await MCPRequestHandler.billing_auth_for_tool_call( + user_api_key_auth, tool_name=name + ), proxy_config=proxy_config, ) else: @@ -984,6 +1099,22 @@ if MCP_AVAILABLE: content=[TextContent(text=f"Error: {str(e.detail)}", type="text")], isError=True, ) + except MCPUpstreamAuthError as e: + # The MCP session manager serializes handler exceptions as JSON-RPC errors, so a + # mid-session tool call cannot emit a raw 401 + WWW-Authenticate the way the REST + # call path and the connect-time preemptive check do. Return an explicit isError + # naming the upstream status (at info level, not a traceback) so the client still + # learns it must re-authenticate upstream and expected pass-through 401s don't spam. + verbose_logger.info(f"Upstream auth failure calling MCP tool: HTTP {e.status_code}") + return CallToolResult( + content=[ + TextContent( + text=f"Error: upstream authentication required (HTTP {e.status_code})", + type="text", + ) + ], + isError=True, + ) except Exception as e: verbose_logger.exception(f"MCP mcp_server_tool_call - error: {e}") return CallToolResult( @@ -993,12 +1124,13 @@ if MCP_AVAILABLE: return response finally: + _otel_reset_mcp_transport_span(_transport_token) _otel_reset_mcp_trace_carrier(_trace_token) if _session_reset_token is not None: active_mcp_session_var.reset(_session_reset_token) @server.list_prompts() - async def list_prompts() -> List[Prompt]: + async def list_prompts() -> list[Prompt]: """ List all available prompts """ @@ -1047,7 +1179,7 @@ if MCP_AVAILABLE: active_mcp_session_var.reset(_session_reset_token) @server.get_prompt() - async def get_prompt(name: str, arguments: Optional[Dict[str, str]]) -> GetPromptResult: + async def get_prompt(name: str, arguments: dict[str, str] | None) -> GetPromptResult: """ Get a specific prompt with the provided arguments @@ -1094,7 +1226,7 @@ if MCP_AVAILABLE: active_mcp_session_var.reset(_session_reset_token) @server.list_resources() - async def list_resources() -> List[Resource]: + async def list_resources() -> list[Resource]: """List all available resources.""" from mcp.server.lowlevel.server import request_ctx @@ -1137,7 +1269,7 @@ if MCP_AVAILABLE: active_mcp_session_var.reset(_session_reset_token) @server.list_resource_templates() - async def list_resource_templates() -> List[ResourceTemplate]: + async def list_resource_templates() -> list[ResourceTemplate]: """List all available resource templates.""" from mcp.server.lowlevel.server import request_ctx @@ -1225,9 +1357,9 @@ if MCP_AVAILABLE: ######################################################## async def _get_allowed_mcp_servers_from_mcp_server_names( - mcp_servers: Optional[List[str]], - allowed_mcp_servers: List[MCPServer], - ) -> List[MCPServer]: + mcp_servers: list[str] | None, + allowed_mcp_servers: list[MCPServer], + ) -> list[MCPServer]: """ Get the filtered MCP servers from the MCP server names. @@ -1282,7 +1414,7 @@ if MCP_AVAILABLE: return allowed_mcp_servers - def _tool_name_matches(tool_name: str, filter_list: List[str]) -> bool: + def _tool_name_matches(tool_name: str, filter_list: list[str]) -> bool: """ Check if a tool name matches any name in the filter list. @@ -1312,9 +1444,9 @@ if MCP_AVAILABLE: return unprefixed_name.lower() in filter_list_lower def filter_tools_by_allowed_tools( - tools: List[MCPTool], + tools: list[MCPTool], mcp_server: MCPServer, - ) -> List[MCPTool]: + ) -> list[MCPTool]: """ Filter tools by allowed/disallowed tools configuration. @@ -1350,9 +1482,9 @@ if MCP_AVAILABLE: return tools_to_return def apply_tool_overrides( - tools: List[MCPTool], + tools: list[MCPTool], mcp_server: MCPServer, - ) -> List[MCPTool]: + ) -> list[MCPTool]: """Apply admin-configured display name/description overrides to tools. Overrides are keyed by the unprefixed tool name, same convention as @@ -1372,7 +1504,7 @@ if MCP_AVAILABLE: tool.description = description_map[lookup_key] return tools - def _get_client_ip_from_context() -> Optional[str]: + def _get_client_ip_from_context() -> str | None: """ Extract client_ip from auth context. Returns None if context not set (caller should handle this as "no IP filtering"). @@ -1386,10 +1518,10 @@ if MCP_AVAILABLE: return None async def _get_allowed_mcp_servers( - user_api_key_auth: Optional[UserAPIKeyAuth], - mcp_servers: Optional[List[str]], - client_ip: Optional[str] = None, - ) -> List[MCPServer]: + user_api_key_auth: UserAPIKeyAuth | None, + mcp_servers: list[str] | None, + client_ip: str | None = None, + ) -> list[MCPServer]: """Return allowed MCP servers for a request after applying filters. Args: @@ -1430,7 +1562,7 @@ if MCP_AVAILABLE: _ip_blocked, client_ip, ) - allowed_mcp_servers: List[MCPServer] = [] + allowed_mcp_servers: list[MCPServer] = [] for allowed_mcp_server_id in allowed_mcp_server_ids: mcp_server = global_mcp_server_manager.get_mcp_server_by_id(allowed_mcp_server_id) if mcp_server is not None: @@ -1448,7 +1580,7 @@ if MCP_AVAILABLE: def _client_has_per_server_auth_header( server: MCPServer, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]], + mcp_server_auth_headers: dict[str, dict[str, str]] | None, ) -> bool: """True if the request carries a per-server ``x-mcp-{alias}-authorization`` header for this server. This is the multi-server binding: it names one @@ -1477,8 +1609,8 @@ if MCP_AVAILABLE: def _client_has_passthrough_authorization( server: MCPServer, - oauth2_headers: Optional[Dict[str, str]], - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]], + oauth2_headers: dict[str, str] | None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None, ) -> bool: """True if the incoming request already carries an ``Authorization`` header the gateway will forward to this pass-through server. @@ -1496,9 +1628,9 @@ if MCP_AVAILABLE: async def _get_user_oauth_extra_headers_from_db( server: MCPServer, - user_api_key_auth: Optional[UserAPIKeyAuth], - prefetched_creds: Optional[Dict[str, Dict[str, Any]]] = None, - ) -> Optional[Dict[str, str]]: + user_api_key_auth: UserAPIKeyAuth | None, + prefetched_creds: dict[str, dict[str, Any]] | None = None, + ) -> dict[str, str] | None: """Stored OAuth2 token for (user, server) as an ``Authorization: Bearer`` header, or None. Thin wrapper over ``resolve_user_oauth_access_token`` (Redis cache, else DB + refresh); @@ -1516,8 +1648,8 @@ if MCP_AVAILABLE: return {"Authorization": f"Bearer {token}"} if token else None async def _prefetch_oauth_creds_for_user( - user_api_key_auth: Optional[UserAPIKeyAuth], - ) -> Dict[str, Dict[str, Any]]: + user_api_key_auth: UserAPIKeyAuth | None, + ) -> dict[str, "OAuthCredentialPayload"]: """Fetch all OAuth2 credentials for the user in one DB query. Returns a dict keyed by server_id to avoid N+1 queries in asyncio.gather loops. @@ -1542,13 +1674,13 @@ if MCP_AVAILABLE: def _prepare_mcp_server_headers( server: MCPServer, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]], - mcp_auth_header: Optional[str], - oauth2_headers: Optional[Dict[str, str]], - raw_headers: Optional[Dict[str, str]], - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - scope_servers: Optional[list[MCPServer]] = None, - ) -> Tuple[Optional[Union[Dict[str, str], str]], Optional[Dict[str, str]]]: + mcp_server_auth_headers: dict[str, dict[str, str]] | None, + mcp_auth_header: str | None, + oauth2_headers: dict[str, str] | None, + raw_headers: dict[str, str] | None, + user_api_key_auth: UserAPIKeyAuth | None = None, + scope_servers: list[MCPServer] | None = None, + ) -> tuple[dict[str, str] | str | None, dict[str, str] | None]: """Build auth and extra headers for a server. ``scope_servers`` is the full server list a fan-out handler iterates. Passing it lets the @@ -1557,7 +1689,7 @@ if MCP_AVAILABLE: explicitly-addressed operations leave it None. Per-server ``x-mcp-{alias}-authorization`` headers are unaffected — they bind one token to one server and are the multi-server shape. """ - server_auth_header: Optional[Union[Dict[str, str], str]] = None + server_auth_header: dict[str, str] | str | None = None if mcp_server_auth_headers: from litellm.proxy._experimental.mcp_server.utils import ( lookup_mcp_server_auth_in_headers, @@ -1569,7 +1701,7 @@ if MCP_AVAILABLE: server_name=server.server_name, ) - extra_headers: Optional[Dict[str, str]] = None + extra_headers: dict[str, str] | None = None is_client_forwarded_mode = server.is_true_passthrough or server.is_oauth_delegate # In a multi-server listing scope the request-wide Authorization can only carry one token, # so it is withheld from a client-forwarded server when another server in scope also consumes @@ -1645,13 +1777,13 @@ if MCP_AVAILABLE: return server_auth_header, extra_headers def _merge_gateway_initialize_instructions( - allowed_mcp_servers: List[MCPServer], - ) -> Optional[str]: + allowed_mcp_servers: list[MCPServer], + ) -> str | None: """YAML/DB override, else upstream text (prefetch on init, or list_tools / health_check / call_tool cache).""" if not allowed_mcp_servers: return None - texts: List[Tuple[str, str]] = [] + texts: list[tuple[str, str]] = [] for server in allowed_mcp_servers: label = server.alias or server.server_name or server.name or server.server_id or "mcp" if server.instructions and server.instructions.strip(): @@ -1671,9 +1803,9 @@ if MCP_AVAILABLE: @contextlib.asynccontextmanager async def _gateway_initialize_instructions_request_scope( - user_api_key_auth: Optional[UserAPIKeyAuth], - mcp_servers: Optional[List[str]], - client_ip: Optional[str], + user_api_key_auth: UserAPIKeyAuth | None, + mcp_servers: list[str] | None, + client_ip: str | None, scoped_server_endpoint: bool = False, ) -> AsyncIterator[None]: allowed = await _get_allowed_mcp_servers( @@ -1708,19 +1840,26 @@ if MCP_AVAILABLE: _mcp_gateway_initialize_instructions.reset(instructions_token) _mcp_gateway_server_name.reset(server_name_token) + def _aggregate_server_key(server: MCPServer) -> str: + """The client-visible key for a server in listing outcomes and spend metadata: the same + display prefix (alias, or the short prefix when that mode is enabled) the caller already + sees on the tool names. Canonical internal server names never key a caller-readable + surface; when the display naming deliberately hides them, the outcome keys must too.""" + return get_server_prefix(server) or "unknown" + async def _get_tools_from_mcp_servers( - user_api_key_auth: Optional[UserAPIKeyAuth], - mcp_auth_header: Optional[str], - mcp_servers: Optional[List[str]], - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, + user_api_key_auth: UserAPIKeyAuth | None, + mcp_auth_header: str | None, + mcp_servers: list[str] | None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, log_list_tools_to_spendlogs: bool = False, - list_tools_log_source: Optional[str] = None, - litellm_trace_id: Optional[str] = None, - request_tags: Optional[list[str]] = None, - client_ip: Optional[str] = None, - ) -> List[MCPTool]: + list_tools_log_source: str | None = None, + litellm_trace_id: str | None = None, + request_tags: list[str] | None = None, + client_ip: str | None = None, + ) -> AggregateToolListing: """ Helper method to fetch tools from MCP servers based on server filtering criteria. @@ -1732,14 +1871,15 @@ if MCP_AVAILABLE: oauth2_headers: Optional dict of oauth2 headers Returns: - List[MCPTool]: Combined list of tools from filtered servers + AggregateToolListing: Combined tools from filtered servers plus each server's + classified listing outcome """ if not MCP_AVAILABLE: - return [] + return AggregateToolListing(tools=[], outcomes={}) list_tools_start_time = datetime.now() - litellm_logging_obj: Optional[LiteLLMLoggingObj] = None - list_tools_request_data: Dict[str, Any] = {} + litellm_logging_obj: LiteLLMLoggingObj | None = None + list_tools_request_data: dict[str, Any] = {} if log_list_tools_to_spendlogs: # This is intentionally minimal: only async_success_handler / post_call_failure_hook @@ -1747,7 +1887,7 @@ if MCP_AVAILABLE: list_tools_call_id = str(uuid.uuid4()) # Derive trace_id from raw_headers when not explicitly passed (same as A2A / MCP call_tool) effective_litellm_trace_id = litellm_trace_id or get_chain_id_from_headers(raw_headers) - spend_logs_metadata: Dict[str, Any] = { + spend_logs_metadata: dict[str, Any] = { "mcp_operation": "list_tools", } if isinstance(list_tools_log_source, str): @@ -1820,10 +1960,12 @@ if MCP_AVAILABLE: async def _fetch_and_filter_server_tools( server: MCPServer, - ) -> List[MCPTool]: - """Fetch and filter tools from a single server with error handling.""" + ) -> "tuple[list[MCPTool], ServerOutcome]": + """Fetch and filter tools from a single server, classifying any failure into that + server's outcome so the aggregate can keep serving the healthy subset without a + broken server masquerading as an empty one.""" if server is None: - return [] + return [], ServerListOk(tool_count=0) server_auth_header, extra_headers = _prepare_mcp_server_headers( server=server, @@ -1893,8 +2035,8 @@ if MCP_AVAILABLE: verbose_logger.debug( f"Successfully fetched {len(tools)} tools from server {server.name}, {len(filtered_tools)} after filtering" ) - return filtered_tools - except MCPUpstreamAuthError: + return filtered_tools, ServerListOk(tool_count=len(filtered_tools)) + except MCPUpstreamAuthError as e: # Absorb so one unauthenticated server does not empty every other server's # tools. Surfacing the upstream 401 to the client as a re-auth challenge is # intentionally not done here: raising from this list handler cannot produce a @@ -1902,31 +2044,30 @@ if MCP_AVAILABLE: # error). Single-server routes surface it via the request-scope preemptive # check in _raise_preemptive_401_for_unauthenticated_servers instead. verbose_logger.debug(f"MCP list_tools: omitting {server.name}; it needs upstream auth") - return [] + return [], classify_list_exception(e) except Exception as e: verbose_logger.exception(f"Error getting tools from server {server.name}: {str(e)}") - return [] + return [], classify_list_exception(e) # Fetch tools from all servers in parallel tasks = [_fetch_and_filter_server_tools(server) for server in allowed_mcp_servers] results = await asyncio.gather(*tasks) # Flatten results into single list - all_tools: List[MCPTool] = [tool for tools in results for tool in tools] + all_tools: list[MCPTool] = [tool for tools, _ in results for tool in tools] + server_outcomes: dict[str, ServerOutcome] = { + _aggregate_server_key(server): outcome + for server, (_, outcome) in zip(allowed_mcp_servers, results) + if server is not None + } # If logging is enabled, enrich spend_logs_metadata with counts if litellm_logging_obj: - per_server_tool_counts: Dict[str, int] = {} - for server, server_tools in zip(allowed_mcp_servers, results): - if server is None: - continue - server_key = ( - getattr(server, "server_name", None) - or getattr(server, "alias", None) - or getattr(server, "name", None) - or "unknown" - ) - per_server_tool_counts[str(server_key)] = len(server_tools) + per_server_tool_counts: dict[str, int] = { + _aggregate_server_key(server): len(server_tools) + for server, (server_tools, _) in zip(allowed_mcp_servers, results) + if server is not None + } metadata_dict = litellm_logging_obj.model_call_details.get("metadata") if isinstance(metadata_dict, dict): @@ -1937,6 +2078,9 @@ if MCP_AVAILABLE: spend_meta["allowed_server_count"] = len(allowed_mcp_servers) spend_meta["tool_count_total"] = len(all_tools) spend_meta["per_server_tool_counts"] = per_server_tool_counts + spend_meta["per_server_list_outcomes"] = { + key: outcome_wire_value(outcome) for key, outcome in server_outcomes.items() + } end_time = datetime.now() try: @@ -1957,7 +2101,7 @@ if MCP_AVAILABLE: verbose_logger.info(f"Successfully fetched {len(all_tools)} tools total from all MCP servers") - return all_tools + return AggregateToolListing(tools=all_tools, outcomes=server_outcomes) except Exception as e: # Only fire failure hook if logging was requested for this list-tools execution if log_list_tools_to_spendlogs and user_api_key_auth is not None: @@ -1978,13 +2122,13 @@ if MCP_AVAILABLE: raise async def _get_prompts_from_mcp_servers( - user_api_key_auth: Optional[UserAPIKeyAuth], - mcp_auth_header: Optional[str], - mcp_servers: Optional[List[str]], - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - ) -> List[Prompt]: + user_api_key_auth: UserAPIKeyAuth | None, + mcp_auth_header: str | None, + mcp_servers: list[str] | None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + ) -> list[Prompt]: """ Helper method to fetch prompt from MCP servers based on server filtering criteria. @@ -2043,13 +2187,13 @@ if MCP_AVAILABLE: return all_prompts async def _get_resources_from_mcp_servers( - user_api_key_auth: Optional[UserAPIKeyAuth], - mcp_auth_header: Optional[str], - mcp_servers: Optional[List[str]], - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - ) -> List[Resource]: + user_api_key_auth: UserAPIKeyAuth | None, + mcp_auth_header: str | None, + mcp_servers: list[str] | None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + ) -> list[Resource]: """Fetch resources from allowed MCP servers.""" if not MCP_AVAILABLE: @@ -2060,7 +2204,7 @@ if MCP_AVAILABLE: mcp_servers=mcp_servers, ) - all_resources: List[Resource] = [] + all_resources: list[Resource] = [] for server in allowed_mcp_servers: if server is None: continue @@ -2094,13 +2238,13 @@ if MCP_AVAILABLE: return all_resources async def _get_resource_templates_from_mcp_servers( - user_api_key_auth: Optional[UserAPIKeyAuth], - mcp_auth_header: Optional[str], - mcp_servers: Optional[List[str]], - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - ) -> List[ResourceTemplate]: + user_api_key_auth: UserAPIKeyAuth | None, + mcp_auth_header: str | None, + mcp_servers: list[str] | None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + ) -> list[ResourceTemplate]: """Fetch resource templates from allowed MCP servers.""" if not MCP_AVAILABLE: @@ -2111,7 +2255,7 @@ if MCP_AVAILABLE: mcp_servers=mcp_servers, ) - all_resource_templates: List[ResourceTemplate] = [] + all_resource_templates: list[ResourceTemplate] = [] for server in allowed_mcp_servers: if server is None: continue @@ -2155,10 +2299,10 @@ if MCP_AVAILABLE: return all_resource_templates async def filter_tools_by_key_team_permissions( - tools: List[MCPTool], + tools: list[MCPTool], server_id: str, - user_api_key_auth: Optional[UserAPIKeyAuth], - ) -> List[MCPTool]: + user_api_key_auth: UserAPIKeyAuth | None, + ) -> list[MCPTool]: """ Filter tools based on key/team mcp_tool_permissions. @@ -2180,54 +2324,17 @@ if MCP_AVAILABLE: server = global_mcp_server_manager.get_mcp_server_by_id(server_id) return [t for t in tools if strip_known_server_prefix(t.name, server) in allowed_tool_names] - async def _merge_toolset_permissions( - user_api_key_auth: Optional[UserAPIKeyAuth], - ) -> Optional[UserAPIKeyAuth]: - """ - Resolve mcp_toolsets on the key's object_permission into tool-level permissions - and merge them (union) into object_permission.mcp_tool_permissions. - - Returns the (possibly mutated copy of) user_api_key_auth. - """ - if user_api_key_auth is None: - return None - op = user_api_key_auth.object_permission - if op is None: - return user_api_key_auth - toolset_ids = getattr(op, "mcp_toolsets", None) or [] - if not toolset_ids: - return user_api_key_auth - - toolset_perms = await global_mcp_server_manager.resolve_toolset_tool_permissions(toolset_ids=toolset_ids) - if not toolset_perms: - return user_api_key_auth - - # Merge toolset_perms into existing mcp_tool_permissions (union) - existing = dict(op.mcp_tool_permissions or {}) - for server_id, tool_names in toolset_perms.items(): - existing_tools = existing.get(server_id, []) - merged = list(set(existing_tools) | set(tool_names)) - existing[server_id] = merged - - # Build updated object_permission with merged tool permissions and server IDs. - # Union the toolset's server IDs into mcp_servers so downstream server-level - # filtering doesn't silently drop servers that the toolset references but that - # aren't already in the key's explicit mcp_servers list. - merged_servers = list(set(op.mcp_servers or []) | set(existing.keys())) - updated_op = op.model_copy(update={"mcp_servers": merged_servers, "mcp_tool_permissions": existing}) - return user_api_key_auth.model_copy(update={"object_permission": updated_op}) - async def _list_mcp_tools( - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - mcp_auth_header: Optional[str] = None, - mcp_servers: Optional[List[str]] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, + user_api_key_auth: UserAPIKeyAuth | None = None, + mcp_auth_header: str | None = None, + mcp_servers: list[str] | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, log_list_tools_to_spendlogs: bool = False, - list_tools_log_source: Optional[str] = None, - client_ip: Optional[str] = None, - ) -> List[MCPTool]: + list_tools_log_source: str | None = None, + client_ip: str | None = None, + ) -> AggregateToolListing: """ List all available MCP tools. @@ -2239,19 +2346,14 @@ if MCP_AVAILABLE: client_ip: Client IP for IP-based server access control Returns: - List[MCPTool]: Combined list of tools from all accessible servers + AggregateToolListing: Combined tools from all accessible servers plus each server's + classified listing outcome """ if not MCP_AVAILABLE: - return [] + return AggregateToolListing(tools=[], outcomes={}) - # Resolve toolset permissions and merge into the key's object_permission - # so that the existing filter_tools_by_key_team_permissions logic picks them up. - user_api_key_auth = await _merge_toolset_permissions(user_api_key_auth) - - # Get tools from managed MCP servers with error handling - managed_tools = [] try: - managed_tools = await _get_tools_from_mcp_servers( + listing = await _get_tools_from_mcp_servers( user_api_key_auth=user_api_key_auth, mcp_auth_header=mcp_auth_header, mcp_servers=mcp_servers, @@ -2262,21 +2364,21 @@ if MCP_AVAILABLE: list_tools_log_source=list_tools_log_source, client_ip=client_ip, ) - verbose_logger.debug(f"Successfully fetched {len(managed_tools)} tools from managed MCP servers") + verbose_logger.debug(f"Successfully fetched {len(listing.tools)} tools from managed MCP servers") + return listing except Exception as e: verbose_logger.exception(f"Error getting tools from managed MCP servers: {str(e)}") - # Continue with empty managed tools list instead of failing completely - - return managed_tools + # Continue with an empty listing instead of failing completely + return AggregateToolListing(tools=[], outcomes={}) async def _list_mcp_prompts( - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - mcp_auth_header: Optional[str] = None, - mcp_servers: Optional[List[str]] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - ) -> List[Prompt]: + user_api_key_auth: UserAPIKeyAuth | None = None, + mcp_auth_header: str | None = None, + mcp_servers: list[str] | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + ) -> list[Prompt]: """ List all available MCP prompts. @@ -2310,19 +2412,19 @@ if MCP_AVAILABLE: return managed_prompts async def _list_mcp_resources( - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - mcp_auth_header: Optional[str] = None, - mcp_servers: Optional[List[str]] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - ) -> List[Resource]: + user_api_key_auth: UserAPIKeyAuth | None = None, + mcp_auth_header: str | None = None, + mcp_servers: list[str] | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + ) -> list[Resource]: """List all available MCP resources.""" if not MCP_AVAILABLE: return [] - managed_resources: List[Resource] = [] + managed_resources: list[Resource] = [] try: managed_resources = await _get_resources_from_mcp_servers( user_api_key_auth=user_api_key_auth, @@ -2339,19 +2441,19 @@ if MCP_AVAILABLE: return managed_resources async def _list_mcp_resource_templates( - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - mcp_auth_header: Optional[str] = None, - mcp_servers: Optional[List[str]] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - ) -> List[ResourceTemplate]: + user_api_key_auth: UserAPIKeyAuth | None = None, + mcp_auth_header: str | None = None, + mcp_servers: list[str] | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + ) -> list[ResourceTemplate]: """List all available MCP resource templates.""" if not MCP_AVAILABLE: return [] - managed_resource_templates: List[ResourceTemplate] = [] + managed_resource_templates: list[ResourceTemplate] = [] try: managed_resource_templates = await _get_resource_templates_from_mcp_servers( user_api_key_auth=user_api_key_auth, @@ -2375,7 +2477,7 @@ if MCP_AVAILABLE: def _resolve_display_name_to_original( name: str, - allowed_mcp_servers: List[MCPServer], + allowed_mcp_servers: list[MCPServer], ) -> str: """Translate a display-name override back to the original prefixed tool name. @@ -2393,8 +2495,8 @@ if MCP_AVAILABLE: async def _get_byok_credential( mcp_server: MCPServer, - user_api_key_auth: Optional[UserAPIKeyAuth], - ) -> Optional[str]: + user_api_key_auth: UserAPIKeyAuth | None, + ) -> str | None: """Retrieve the stored BYOK credential for a user+server pair. Uses the shared _byok_cred_cache to avoid a DB round-trip on every @@ -2428,7 +2530,7 @@ if MCP_AVAILABLE: async def _check_byok_credential( mcp_server: MCPServer, - user_api_key_auth: Optional[UserAPIKeyAuth], + user_api_key_auth: UserAPIKeyAuth | None, ) -> None: """ If the MCP server is BYOK-enabled, verify that the requesting user has a @@ -2516,15 +2618,15 @@ if MCP_AVAILABLE: async def execute_mcp_tool( name: str, - arguments: Dict[str, Any], - allowed_mcp_servers: List[MCPServer], + arguments: dict[str, Any], + allowed_mcp_servers: list[MCPServer], start_time: datetime, - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - mcp_auth_header: Optional[str] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - host_progress_callback: Optional[Callable] = None, + user_api_key_auth: UserAPIKeyAuth | None = None, + mcp_auth_header: str | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + host_progress_callback: Callable | None = None, **kwargs: Any, ) -> CallToolResult: """ @@ -2548,8 +2650,8 @@ if MCP_AVAILABLE: CallToolResult: Tool execution result """ # Track resolved MCP server for both permission checks and dispatch - mcp_server: Optional[MCPServer] = None - requested_server_id: Optional[str] = kwargs.get("requested_server_id") + mcp_server: MCPServer | None = None + requested_server_id: str | None = kwargs.get("requested_server_id") # If the client called with a display-name override (e.g. "Get Pet"), # translate it back to the original prefixed name before any routing. @@ -2558,7 +2660,7 @@ if MCP_AVAILABLE: # Remove prefix from tool name for logging and processing original_tool_name, server_name = split_server_prefix_from_name(name) - requested_server: Optional[MCPServer] = None + requested_server: MCPServer | None = None if requested_server_id: requested_server = next( (s for s in allowed_mcp_servers if s.server_id == requested_server_id), @@ -2567,7 +2669,7 @@ if MCP_AVAILABLE: name_is_prefixed = False if requested_server is not None and MCP_TOOL_PREFIX_SEPARATOR in name: - all_registry_prefixes: Set[str] = set() + all_registry_prefixes: set[str] = set() for registry_server in global_mcp_server_manager.get_registry().values(): for known_prefix in iter_known_server_prefixes(registry_server): all_registry_prefixes.add(normalize_server_name(known_prefix)) @@ -2621,7 +2723,7 @@ if MCP_AVAILABLE: ): raise HTTPException( status_code=403, - detail=f"User not allowed to call this tool. Allowed MCP servers: {allowed_mcp_servers}", + detail="User not allowed to call this tool.", ) standard_logging_mcp_tool_call: StandardLoggingMCPToolCall = _get_standard_logging_mcp_tool_call( @@ -2630,7 +2732,7 @@ if MCP_AVAILABLE: server_name=server_name, session_id=_mcp_session_id_from_headers(raw_headers), ) - litellm_logging_obj: Optional[LiteLLMLoggingObj] = kwargs.get("litellm_logging_obj", None) + litellm_logging_obj: LiteLLMLoggingObj | None = kwargs.get("litellm_logging_obj", None) if litellm_logging_obj: litellm_logging_obj.model_call_details["mcp_tool_call_metadata"] = standard_logging_mcp_tool_call litellm_logging_obj.model = f"MCP: {name}" @@ -2723,7 +2825,7 @@ if MCP_AVAILABLE: # because the tool function has headers baked into its closure. # Pre-format the full Authorization header value using the server's # configured auth_type so the generator doesn't need to know the prefix. - auth_header_value: Optional[str] = None + auth_header_value: str | None = None if mcp_auth_header: server_auth_type = getattr(mcp_server, "auth_type", None) if mcp_server else None if server_auth_type == MCPAuth.api_key: @@ -2739,7 +2841,7 @@ if MCP_AVAILABLE: # OpenAPI/local path agrees with the managed paths: M2M and the resolver-owned modes # (token_exchange's raw subject token, authorization_code's stored token) must never # have the caller's Authorization forwarded verbatim upstream. - forwarded_headers: Optional[Dict[str, str]] = None + forwarded_headers: dict[str, str] | None = None if mcp_server and mcp_server.extra_headers and raw_headers: normalized_raw = {str(k).lower(): v for k, v in raw_headers.items() if isinstance(k, str)} skip_caller_authorization = _should_strip_caller_authorization( @@ -2758,13 +2860,29 @@ if MCP_AVAILABLE: forwarded_headers = {} forwarded_headers[header_name] = value + resolved_auth_headers: dict[str, str] | None = None + if mcp_server: + ( + resolved_auth_headers, + forwarded_headers, + ) = await global_mcp_server_manager.resolve_openapi_upstream_auth( + mcp_server=mcp_server, + oauth2_headers=oauth2_headers, + raw_headers=raw_headers, + mcp_auth_header=mcp_auth_header, + user_api_key_auth=user_api_key_auth, + forwarded_headers=forwarded_headers, + ) + _auth_token = _request_auth_header.set(auth_header_value) _extra_token = _request_extra_headers.set(forwarded_headers) + _resolved_token = _request_resolved_auth_headers.set(resolved_auth_headers) try: local_content = await _handle_local_mcp_tool(name, arguments) finally: _request_auth_header.reset(_auth_token) _request_extra_headers.reset(_extra_token) + _request_resolved_auth_headers.reset(_resolved_token) response = CallToolResult(content=cast(Any, local_content), isError=False) # Try managed MCP server tool (pass the full prefixed name) @@ -2809,8 +2927,8 @@ if MCP_AVAILABLE: result: Any, start_time: datetime, end_time: datetime, - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - request_data: Optional[Mapping[str, object]] = None, + user_api_key_auth: UserAPIKeyAuth | None = None, + request_data: Mapping[str, object] | None = None, ) -> None: """Fire post-call logging for an executed MCP tool call. @@ -2865,20 +2983,20 @@ if MCP_AVAILABLE: @client async def call_mcp_tool( name: str, - arguments: Optional[Dict[str, Any]] = None, - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - mcp_auth_header: Optional[str] = None, - mcp_servers: Optional[List[str]] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, + arguments: dict[str, Any] | None = None, + user_api_key_auth: UserAPIKeyAuth | None = None, + mcp_auth_header: str | None = None, + mcp_servers: list[str] | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, **kwargs: Any, ) -> CallToolResult: """ Call a specific tool with the provided arguments (handles prefixed tool names). """ start_time = datetime.now() - litellm_logging_obj: Optional[LiteLLMLoggingObj] = kwargs.get("litellm_logging_obj", None) + litellm_logging_obj: LiteLLMLoggingObj | None = kwargs.get("litellm_logging_obj", None) try: if arguments is None: @@ -2889,7 +3007,7 @@ if MCP_AVAILABLE: user_api_key_auth=user_api_key_auth, ) - allowed_mcp_servers: List[MCPServer] = [] + allowed_mcp_servers: list[MCPServer] = [] for allowed_mcp_server_id in allowed_mcp_server_ids: allowed_server = global_mcp_server_manager.get_mcp_server_by_id(allowed_mcp_server_id) if allowed_server is not None: @@ -2921,6 +3039,14 @@ if MCP_AVAILABLE: raw_headers=raw_headers, **kwargs, ) + except MCPUpstreamAuthError: + # A client-forwarded pass-through upstream 401 is an expected caller-must-reauth signal, so + # re-raise it without post_call_failure_hook, which fires the proxy's llm_exceptions alert. + # mcp_server_tool_call then downgrades it to an informational isError result for the + # streamable client. Note: this function is @client-decorated, so the decorator's standard + # failure logging still records the event (spend log / OTel); only the extra alert sink is + # skipped here. + raise except Exception as e: traceback_str = traceback.format_exc(limit=MAXIMUM_TRACEBACK_LINES_TO_LOG) from litellm.proxy.proxy_server import proxy_logging_obj @@ -2948,13 +3074,13 @@ if MCP_AVAILABLE: async def mcp_get_prompt( name: str, - arguments: Optional[Dict[str, Any]] = None, - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - mcp_auth_header: Optional[str] = None, - mcp_servers: Optional[List[str]] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, + arguments: dict[str, Any] | None = None, + user_api_key_auth: UserAPIKeyAuth | None = None, + mcp_auth_header: str | None = None, + mcp_servers: list[str] | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, ) -> GetPromptResult: """ Fetch a specific MCP prompt, handling both prefixed and unprefixed names. @@ -3000,12 +3126,12 @@ if MCP_AVAILABLE: async def mcp_read_resource( url: AnyUrl, - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - mcp_auth_header: Optional[str] = None, - mcp_servers: Optional[List[str]] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, + user_api_key_auth: UserAPIKeyAuth | None = None, + mcp_auth_header: str | None = None, + mcp_servers: list[str] | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, ) -> ReadResourceResult: """Read resource contents from upstream MCP servers.""" @@ -3049,9 +3175,9 @@ if MCP_AVAILABLE: def _get_standard_logging_mcp_tool_call( name: str, - arguments: Dict[str, Any], - server_name: Optional[str], - session_id: Optional[str] = None, + arguments: dict[str, Any], + server_name: str | None, + session_id: str | None = None, ) -> StandardLoggingMCPToolCall: mcp_server = global_mcp_server_manager._get_mcp_server_from_tool_name(name) namespaced_tool_name = f"{server_name}/{name}" if server_name else name @@ -3064,6 +3190,8 @@ if MCP_AVAILABLE: mcp_server_logo_url=mcp_info.get("logo_url"), namespaced_tool_name=namespaced_tool_name, mcp_session_id=session_id, + mcp_auth_mode=mcp_server.auth_type, + mcp_server_resource=_redact_mcp_resource_url(mcp_server.url), ) else: return StandardLoggingMCPToolCall( @@ -3076,14 +3204,14 @@ if MCP_AVAILABLE: async def _handle_managed_mcp_tool( server_name: str, name: str, - arguments: Dict[str, Any], - user_api_key_auth: Optional[UserAPIKeyAuth] = None, - mcp_auth_header: Optional[str] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - litellm_logging_obj: Optional[Any] = None, - host_progress_callback: Optional[Callable] = None, + arguments: dict[str, Any], + user_api_key_auth: UserAPIKeyAuth | None = None, + mcp_auth_header: str | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + litellm_logging_obj: Any | None = None, + host_progress_callback: Callable | None = None, ) -> CallToolResult: """Handle tool execution for managed server tools""" # Import here to avoid circular import @@ -3105,8 +3233,8 @@ if MCP_AVAILABLE: return call_tool_result async def _handle_local_mcp_tool( - name: str, arguments: Dict[str, Any] - ) -> List[Union[TextContent, ImageContent, EmbeddedResource]]: + name: str, arguments: dict[str, Any] + ) -> list[TextContent | ImageContent | EmbeddedResource]: """ Handle tool execution for local registry tools Note: Local tools don't use prefixes, so we use the original name @@ -3128,13 +3256,13 @@ if MCP_AVAILABLE: verbose_logger.exception(f"Error executing local tool {name}: {str(e)}") return [TextContent(text=f"Error: {str(e)}", type="text")] - def _get_mcp_servers_in_path(path: str) -> Optional[List[str]]: + def _get_mcp_servers_in_path(path: str) -> list[str] | None: """ Get the MCP servers from the path """ import re - mcp_servers_from_path: Optional[List[str]] = None + mcp_servers_from_path: list[str] | None = None segments = [s for s in path.split("/") if s] if len(segments) >= 2 and segments[1] == "mcp" and segments[0] != "mcp": return [segments[0]] @@ -3206,7 +3334,7 @@ if MCP_AVAILABLE: raw_headers, ) - def _get_session_id_from_scope(scope: Scope) -> Optional[str]: + def _get_session_id_from_scope(scope: Scope) -> str | None: """ Extract mcp-session-id from ASGI scope headers. Returns None if not present. @@ -3218,9 +3346,9 @@ if MCP_AVAILABLE: return None def _owner_fingerprint_for( - user_api_key_auth: Optional[UserAPIKeyAuth], - oauth2_headers: Optional[Dict[str, str]] = None, - client_ip: Optional[str] = None, + user_api_key_auth: UserAPIKeyAuth | None, + oauth2_headers: dict[str, str] | None = None, + client_ip: str | None = None, ) -> str: """ Stable, non-reversible identifier for the caller used to bind an @@ -3245,7 +3373,7 @@ if MCP_AVAILABLE: is best-effort in that mode. """ - def _bytes_for_hash(value: Any) -> Optional[bytes]: + def _bytes_for_hash(value: Any) -> bytes | None: """Only hash str/bytes secrets; skip mocks and other unexpected types.""" if value is None: return None @@ -3288,7 +3416,7 @@ if MCP_AVAILABLE: async def _read_request_body_for_routing( receive: Receive, - ) -> Tuple[List[Message], bytes]: + ) -> tuple[list[Message], bytes]: """ Read just enough of the request body to decide whether this is a JSON-RPC ``initialize`` call. Returns the consumed ASGI messages so @@ -3302,8 +3430,8 @@ if MCP_AVAILABLE: force the proxy to buffer an arbitrarily large payload just to make a routing decision. """ - consumed_messages: List[Message] = [] - body_chunks: List[bytes] = [] + consumed_messages: list[Message] = [] + body_chunks: list[bytes] = [] peeked_bytes = 0 while True: @@ -3358,14 +3486,14 @@ if MCP_AVAILABLE: _mcp_session_header = b"mcp-session-id" _headers = scope.get("headers", []) - def _normalize_header_name(header_name: Any) -> Optional[bytes]: + def _normalize_header_name(header_name: Any) -> bytes | None: if isinstance(header_name, bytes): return header_name.lower() if isinstance(header_name, str): return header_name.lower().encode("utf-8", errors="replace") return None - _session_id: Optional[str] = None + _session_id: str | None = None for header_name, header_value in _headers: if _normalize_header_name(header_name) == _mcp_session_header: if isinstance(header_value, bytes): @@ -3509,12 +3637,12 @@ if MCP_AVAILABLE: async def _raise_preemptive_401_for_unauthenticated_servers( scope: Scope, - mcp_servers: Optional[List[str]], - oauth2_headers: Optional[Dict[str, str]], - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]], - user_api_key_auth: Optional[UserAPIKeyAuth], - client_ip: Optional[str], - allowed_server_ids: Optional[Set[str]] = None, + mcp_servers: list[str] | None, + oauth2_headers: dict[str, str] | None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None, + user_api_key_auth: UserAPIKeyAuth | None, + client_ip: str | None, + allowed_server_ids: set[str] | None = None, ) -> None: """Fail fast with HTTP 401 for MCP servers that need user auth but didn't receive it on this request. Covers both gateway-managed OAuth2 @@ -3534,48 +3662,70 @@ if MCP_AVAILABLE: # preemptive challenge and let downstream authorization # return 403. continue - if server and server.auth_type == MCPAuth.oauth2 and not oauth2_headers: - # For per-user OAuth servers, only skip the pre-emptive 401 when - # a stored token actually exists for this user+server pair. - # If no stored token exists, fail fast with 401 so clients can - # kick off PKCE/interactive OAuth flow immediately. - if server.needs_user_oauth_token: - if getattr(server, "delegate_auth_to_upstream", False) is True: - # Delegate-auth servers run upstream PKCE: challenge with - # the proxied resource_metadata (RFC 9728), not the - # gateway authorization_uri below which would authorize - # against the gateway instead of the upstream IdP. - www_authenticate = _get_passthrough_www_authenticate( - scope=scope, - server_name=server_name, - ) - raise HTTPException( - status_code=401, - detail="Unauthorized", - headers={"www-authenticate": www_authenticate}, - ) - # The v2 resolver owns the existence check, so every authorization_code - # resolution (egress and this discovery challenge) runs through it. + if server and server.auth_type == MCPAuth.oauth2: + # The challenge decision is per oauth2 sub-mode, not per header: + # gateway-managed modes (M2M and interactive authorization_code) + # never receive a client-supplied upstream token, so a bearer in + # Authorization is a LiteLLM key (surfaced here as oauth2_headers) + # and must not suppress the challenge. Only the delegate mode + # treats a present bearer as the upstream token. The sub-mode is + # resolved the same way egress resolves it, via + # effective_oauth2_flow: an unstamped (null oauth2_flow) row with + # the M2M shape resolves to client_credentials, so the bare + # has_client_credentials column is never trusted here. + if MCPServerManager.effective_oauth2_flow(server) == "client_credentials": + # M2M: the gateway mints its own token at egress from the + # stored client credentials, so there is nothing to challenge. + continue + + if getattr(server, "delegate_auth_to_upstream", False) is not True: + # Gateway-managed interactive (authorization_code): the only + # thing that authorizes egress is a stored per-user token, so + # challenge whenever one is absent, regardless of any bearer. + # The v2 resolver owns the existence check, so every + # authorization_code resolution (egress and this discovery + # challenge) runs through it. if await global_mcp_server_manager.has_user_oauth_token(server, user_api_key_auth): continue - request = StarletteRequest(scope) - base_url = get_request_base_url(request) - _path = scope.get("_original_path") or scope.get("path", "") or "" + request = StarletteRequest(scope) + base_url = get_request_base_url(request) + _path = scope.get("_original_path") or scope.get("path", "") or "" - # Pick the well-known AS-metadata form that matches the inbound route - # so strict RFC 9728 §3.2 clients can resolve it correctly. - if _path.startswith(f"/mcp/{server_name}"): - _as_url = f"{base_url}/.well-known/oauth-authorization-server/mcp/{server_name}" - else: - _as_url = f"{base_url}/.well-known/oauth-authorization-server/{server_name}" - authorization_uri = f'Bearer authorization_uri="{_as_url}"' + # Pick the well-known AS-metadata form that matches the inbound route + # so strict RFC 9728 §3.2 clients can resolve it correctly. + if _path.startswith(f"/mcp/{server_name}"): + _as_url = f"{base_url}/.well-known/oauth-authorization-server/mcp/{server_name}" + else: + _as_url = f"{base_url}/.well-known/oauth-authorization-server/{server_name}" + authorization_uri = f'Bearer authorization_uri="{_as_url}"' - raise HTTPException( - status_code=401, - detail="Unauthorized", - headers={"www-authenticate": authorization_uri}, - ) + raise HTTPException( + status_code=401, + detail="Unauthorized", + headers={"www-authenticate": authorization_uri}, + ) + + if not oauth2_headers: + # Delegate-auth servers run upstream PKCE: a present bearer is + # the upstream token, so only challenge when it is absent, with + # the proxied resource_metadata (RFC 9728), not the gateway + # authorization_uri above which would authorize against the + # gateway instead of the upstream IdP. + www_authenticate = _get_passthrough_www_authenticate( + scope=scope, + server_name=server_name, + ) + raise HTTPException( + status_code=401, + detail="Unauthorized", + headers={"www-authenticate": www_authenticate}, + ) + # Delegate server with a bearer present: it is the upstream token, + # so admit the session and move to the next target. Every oauth2 + # sub-mode is terminal here (continue or raise) so no oauth2 server + # reaches the token_exchange / pass-through blocks below. + continue # token_exchange (OBO): the caller supplied no subject token. Challenge at connect # (transport level, where WWW-Authenticate survives) with the RFC 9728 resource_metadata @@ -3652,6 +3802,17 @@ if MCP_AVAILABLE: and not _scope_has_authorization_header(scope) and not _client_has_per_server_auth_header(server, mcp_server_auth_headers) ): + if server.is_dcr_bridge: + raise HTTPException( + status_code=401, + detail="Unauthorized", + headers={ + "www-authenticate": _get_passthrough_www_authenticate( + scope=scope, + server_name=server_name, + ) + }, + ) upstream_status, upstream_www_authenticate = await _probe_upstream_auth(server.url or "", "") if upstream_status == 401 and upstream_www_authenticate: raise HTTPException( @@ -3660,10 +3821,17 @@ if MCP_AVAILABLE: headers={"www-authenticate": upstream_www_authenticate}, ) - def _scope_has_authorization_header(scope: Scope) -> bool: - return any(key.lower() == b"authorization" for key, _ in scope.get("headers", [])) + def _get_authorization_header_from_scope(scope: Scope) -> str | None: + """First ``Authorization`` header value in the ASGI scope, or None.""" + for key, value in scope.get("headers", []): + if key.lower() == b"authorization": + return value.decode("latin-1") + return None - def _get_forwarded_auth_from_scope(scope: Scope) -> Optional[str]: + def _scope_has_authorization_header(scope: Scope) -> bool: + return _get_authorization_header_from_scope(scope) is not None + + def _get_forwarded_auth_from_scope(scope: Scope) -> str | None: """Return the upstream-bound ``Authorization`` header value, or None. Only returns the ``Authorization`` header when ``x-litellm-api-key`` is @@ -3674,23 +3842,30 @@ if MCP_AVAILABLE: ``MCPRequestHandler.process_mcp_request``), and forwarding it upstream would leak the proxy key to a third-party MCP server. """ - authorization = None - has_litellm_key_header = False - for key, value in scope.get("headers", []): - key_lower = key.lower() - if key_lower == b"authorization": - authorization = value.decode("latin-1") - elif key_lower == b"x-litellm-api-key": - has_litellm_key_header = True + has_litellm_key_header = any(key.lower() == b"x-litellm-api-key" for key, _ in scope.get("headers", [])) if not has_litellm_key_header: return None - return authorization + return _get_authorization_header_from_scope(scope) + + def _is_delegate_upstream_probe_target(server: MCPServer) -> bool: + """Whether ``server`` is an interactive delegate-auth server whose client-supplied + token should be preflighted upstream. + + Mirrors the anonymous-delegate gate in ``get_allowed_mcp_servers``: the flow is + resolved via ``effective_oauth2_flow`` so an unstamped M2M-shape row fails closed + (its stored client credentials drive egress; the caller's bearer is irrelevant). + """ + return ( + server.auth_type == MCPAuth.oauth2 + and server.delegate_auth_to_upstream is True + and MCPServerManager.effective_oauth2_flow(server) != "client_credentials" + ) async def _probe_upstream_auth( url: str, auth_header: str, timeout: float = 5.0, - ) -> tuple[int, Optional[str]]: + ) -> tuple[int, str | None]: """JSON-RPC initialize-probe the upstream URL to check whether the token is accepted. Uses POST so StreamableHTTP MCP servers run the same auth path as a @@ -3742,11 +3917,11 @@ if MCP_AVAILABLE: async def _check_passthrough_upstream_auth( scope: Scope, - user_api_key_auth: Optional[UserAPIKeyAuth], - mcp_servers: Optional[List[str]], - client_ip: Optional[str], + user_api_key_auth: UserAPIKeyAuth | None, + mcp_servers: list[str] | None, + client_ip: str | None, ) -> None: - """Probe pass-through upstream servers in parallel before the MCP session starts. + """Probe pass-through and delegate-auth upstream servers in parallel before the MCP session starts. Only servers the caller's key is already authorized to reach are probed — the list is derived from _get_allowed_mcp_servers so that a user cannot @@ -3754,11 +3929,42 @@ if MCP_AVAILABLE: The MCP SDK commits HTTP 200 headers before invoking handlers, so a 401 can only be returned before that point. This function raises HTTPException(401) - with a WWW-Authenticate header if any upstream rejects the client token. + with a WWW-Authenticate header if any upstream rejects the client token, or 403 + if the upstream accepts it but forbids the caller. Fails-open: network errors are logged and the request is allowed through. + + Delegate-auth servers (``auth_type=oauth2`` + ``delegate_auth_to_upstream``) + are probed with the caller's bare ``Authorization`` bearer. That bearer is only + an upstream token (never a LiteLLM key) when admission took the delegate bypass, + so the delegate target is resolved through ``get_mcp_server_by_name`` -- the same + resolver admission used -- rather than the wider allowed-server prefix/access-group + matching. A name that only reaches a delegate server via server_id or an access + group would have been admitted as a real LiteLLM key, so probing it would leak that + key upstream; requiring the admission-resolver match closes that gap. Without the + probe a rejected token is absorbed by the tools/list handler and masked as an empty + tool list. Gated to single-server routes so one rejected token cannot 401 a + multi-server aggregate connect, matching the OBO preflight gating; the challenge + echoes the requested name so aliased routes get the same resource_metadata URL as + the tokenless preemptive challenge. """ forwarded_auth = _get_forwarded_auth_from_scope(scope) - if not forwarded_auth: + requested_single_target = mcp_servers[0] if mcp_servers is not None and len(mcp_servers) == 1 else None + # The bare Authorization header (no x-litellm-api-key) is a valid upstream token + # only when admission classified it as one, i.e. the single requested name resolves + # to a delegate server under admission's own resolver. Resolve it the same way here + # so a server_id- or access-group-named delegate (which admission would have treated + # as a LiteLLM key) is never probed with that key. + delegate_server = ( + global_mcp_server_manager.get_mcp_server_by_name(requested_single_target, client_ip=client_ip) + if requested_single_target + else None + ) + delegate_auth = ( + _get_authorization_header_from_scope(scope) + if delegate_server is not None and _is_delegate_upstream_probe_target(delegate_server) + else None + ) + if not forwarded_auth and not delegate_auth: return # Use the authorized server set, not the raw user-supplied names, so that @@ -3768,33 +3974,49 @@ if MCP_AVAILABLE: mcp_servers=mcp_servers, client_ip=client_ip, ) - passthrough_servers = [ - srv - for srv in allowed_servers - # Restrict to genuine OAuth pass-through servers (auth_type none + - # Authorization in extra_headers). Gateway-managed OAuth2 servers - # must not receive the ``resource_metadata=`` challenge emitted - # below — they require ``authorization_uri=`` pointing at the - # gateway AS metadata. ``is_oauth_passthrough`` already requires - # ``auth_type in (None, MCPAuth.none)``, which is mutually - # exclusive with ``has_client_credentials`` (oauth2 + M2M flow), - # so M2M servers are implicitly excluded here. - if srv.is_oauth_passthrough - ] - if not passthrough_servers: + passthrough_targets: tuple[tuple[MCPServer, str, str], ...] = ( + tuple( + (srv, forwarded_auth, srv.name) + for srv in allowed_servers + # Restrict to genuine OAuth pass-through servers (auth_type none + + # Authorization in extra_headers). Gateway-managed OAuth2 servers + # must not receive the ``resource_metadata=`` challenge emitted + # below — they require ``authorization_uri=`` pointing at the + # gateway AS metadata. ``is_oauth_passthrough`` already requires + # ``auth_type in (None, MCPAuth.none)``, which is mutually + # exclusive with ``has_client_credentials`` (oauth2 + M2M flow), + # so M2M servers are implicitly excluded here. + if srv.is_oauth_passthrough + ) + if forwarded_auth + else () + ) + # Probe the admission-resolved delegate server only when the caller is actually + # authorized for it (present in the IP-filtered allowed set), keyed by server_id. + delegate_targets: tuple[tuple[MCPServer, str, str], ...] = ( + tuple( + (srv, delegate_auth, requested_single_target) + for srv in allowed_servers + if delegate_server is not None and srv.server_id == delegate_server.server_id + ) + if delegate_auth and requested_single_target + else () + ) + probe_targets = passthrough_targets + delegate_targets + if not probe_targets: return probe_results = await asyncio.gather( - *[_probe_upstream_auth(srv.url or "", forwarded_auth) for srv in passthrough_servers] + *[_probe_upstream_auth(srv.url or "", auth_header) for srv, auth_header, _ in probe_targets] ) - for srv, (probe_status, _) in zip(passthrough_servers, probe_results): + for (srv, _, challenge_server_name), (probe_status, _) in zip(probe_targets, probe_results): if probe_status == 401: # Token is missing or expired: keep pass-through clients on the # protected-resource discovery flow so they re-authorize against # the upstream IdP metadata proxied by LiteLLM. www_authenticate = _get_passthrough_www_authenticate( scope=scope, - server_name=srv.name, + server_name=challenge_server_name, invalid_token=True, ) raise HTTPException( @@ -3839,7 +4061,7 @@ if MCP_AVAILABLE: # Apply toolset scope if set server-side via ContextVar (set by # /toolset/{name}/mcp and /{name}/mcp route handlers in proxy_server.py). active_toolset_id = _mcp_active_toolset_id.get() - toolset_allowed_server_ids: Optional[Set[str]] = None + toolset_allowed_server_ids: set[str] | None = None if active_toolset_id and user_api_key_auth is not None: user_api_key_auth = await _apply_toolset_scope(user_api_key_auth, active_toolset_id) op = user_api_key_auth.object_permission @@ -3890,7 +4112,7 @@ if MCP_AVAILABLE: # - No session ID + other → stateless (curl, Inspector, Notion) session_id = _get_session_id_from_scope(scope) is_initialize = False - consumed_messages: List[Message] = [] + consumed_messages: list[Message] = [] # Owner-binding: a live stateful session may only be driven by the # caller that created it. Reject mismatches with 403 so a leaked @@ -4024,11 +4246,11 @@ if MCP_AVAILABLE: "top-level key scan, skipping session lock to avoid deadlock" ) - session_lock: Optional[asyncio.Lock] = None + session_lock: asyncio.Lock | None = None if use_stateful and session_id and request_method in ("POST", "DELETE") and not is_jsonrpc_response: session_lock = _stateful_session_locks.setdefault(session_id, asyncio.Lock()) - active_request_session_ids: List[str] = [] + active_request_session_ids: list[str] = [] def _increment_active_request_session(session_id_to_track: str) -> None: if session_id_to_track in active_request_session_ids: @@ -4047,6 +4269,7 @@ if MCP_AVAILABLE: _increment_active_request_session(initialized_session_id) async def _dispatch() -> None: + _otel_publish_transport_span_on_scope(scope) auth_user = _set_or_update_auth_context( user_api_key_auth=user_api_key_auth, mcp_auth_header=mcp_auth_header, @@ -4160,7 +4383,7 @@ if MCP_AVAILABLE: # downstream probe list matches the fully-authorized server set # (mirrors the streamable HTTP handler). active_toolset_id = _mcp_active_toolset_id.get() - toolset_allowed_server_ids: Optional[Set[str]] = None + toolset_allowed_server_ids: set[str] | None = None if active_toolset_id and user_api_key_auth is not None: user_api_key_auth = await _apply_toolset_scope(user_api_key_auth, active_toolset_id) op = user_api_key_auth.object_permission @@ -4256,7 +4479,7 @@ if MCP_AVAILABLE: "/enabled", description="Returns if the MCP server is enabled", ) - def get_mcp_server_enabled() -> Dict[str, bool]: + def get_mcp_server_enabled() -> dict[str, bool]: """ Returns if the MCP server is enabled """ @@ -4275,13 +4498,13 @@ if MCP_AVAILABLE: def _update_auth_context( auth_user: MCPAuthenticatedUser, - user_api_key_auth: Optional[UserAPIKeyAuth], - mcp_auth_header: Optional[str] = None, - mcp_servers: Optional[List[str]] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - client_ip: Optional[str] = None, + user_api_key_auth: UserAPIKeyAuth | None, + mcp_auth_header: str | None = None, + mcp_servers: list[str] | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + client_ip: str | None = None, ) -> None: auth_user.user_api_key_auth = user_api_key_auth auth_user.mcp_auth_header = mcp_auth_header @@ -4292,13 +4515,13 @@ if MCP_AVAILABLE: auth_user.client_ip = client_ip def set_auth_context( - user_api_key_auth: Optional[UserAPIKeyAuth], - mcp_auth_header: Optional[str] = None, - mcp_servers: Optional[List[str]] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - client_ip: Optional[str] = None, + user_api_key_auth: UserAPIKeyAuth | None, + mcp_auth_header: str | None = None, + mcp_servers: list[str] | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + client_ip: str | None = None, ) -> MCPAuthenticatedUser: """ Set the UserAPIKeyAuth in the auth context variable. @@ -4323,14 +4546,14 @@ if MCP_AVAILABLE: return auth_user def _set_or_update_auth_context( - user_api_key_auth: Optional[UserAPIKeyAuth], - mcp_auth_header: Optional[str] = None, - mcp_servers: Optional[List[str]] = None, - mcp_server_auth_headers: Optional[Dict[str, Dict[str, str]]] = None, - oauth2_headers: Optional[Dict[str, str]] = None, - raw_headers: Optional[Dict[str, str]] = None, - client_ip: Optional[str] = None, - session_id: Optional[str] = None, + user_api_key_auth: UserAPIKeyAuth | None, + mcp_auth_header: str | None = None, + mcp_servers: list[str] | None = None, + mcp_server_auth_headers: dict[str, dict[str, str]] | None = None, + oauth2_headers: dict[str, str] | None = None, + raw_headers: dict[str, str] | None = None, + client_ip: str | None = None, + session_id: str | None = None, touch_last_seen: bool = True, copy_existing_session_auth_context: bool = False, ) -> MCPAuthenticatedUser: @@ -4374,7 +4597,7 @@ if MCP_AVAILABLE: send: Send, auth_user: MCPAuthenticatedUser, owner_fingerprint: str, - on_session_registered: Optional[Callable[[str], None]] = None, + on_session_registered: Callable[[str], None] | None = None, ) -> Send: async def wrapped_send(message: Message) -> None: if message.get("type") == "http.response.start": @@ -4393,14 +4616,14 @@ if MCP_AVAILABLE: return wrapped_send - def get_auth_context() -> Tuple[ - Optional[UserAPIKeyAuth], - Optional[str], - Optional[List[str]], - Optional[Dict[str, Dict[str, str]]], - Optional[Dict[str, str]], - Optional[Dict[str, str]], - Optional[str], + def get_auth_context() -> tuple[ + UserAPIKeyAuth | None, + str | None, + list[str] | None, + dict[str, dict[str, str]] | None, + dict[str, str] | None, + dict[str, str] | None, + str | None, ]: """ Get the UserAPIKeyAuth from the auth context variable. @@ -4454,12 +4677,12 @@ if MCP_AVAILABLE: "session identity — session object is unhashable" ) - def _recover_auth_from_session() -> Optional[MCPAuthenticatedUser]: + def _recover_auth_from_session() -> MCPAuthenticatedUser | None: session = _get_current_session() if session is None: return None - stored: Optional[MCPAuthenticatedUser] = None + stored: MCPAuthenticatedUser | None = None try: stored = _session_obj_auth_storage.get(session) except TypeError: @@ -4471,14 +4694,14 @@ if MCP_AVAILABLE: return stored - async def get_or_extract_auth_context() -> Tuple[ - Optional[UserAPIKeyAuth], - Optional[str], - Optional[List[str]], - Optional[Dict[str, Dict[str, str]]], - Optional[Dict[str, str]], - Optional[Dict[str, str]], - Optional[str], + async def get_or_extract_auth_context() -> tuple[ + UserAPIKeyAuth | None, + str | None, + list[str] | None, + dict[str, dict[str, str]] | None, + dict[str, str] | None, + dict[str, str] | None, + str | None, ]: """ Get auth context from ContextVar first, then fall back to session @@ -4517,14 +4740,14 @@ if MCP_AVAILABLE: _client_ip, ) - def get_active_mcp_session() -> Optional[_McpServerSession]: + def get_active_mcp_session() -> _McpServerSession | None: """Return the active MCP session captured during handler execution.""" session = active_mcp_session_var.get() if session is not None: return session return _get_current_session() - def get_active_auth_context() -> Optional[MCPAuthenticatedUser]: + def get_active_auth_context() -> MCPAuthenticatedUser | None: """Return auth context from ContextVar or session storage.""" auth = auth_context_var.get() if auth and isinstance(auth, MCPAuthenticatedUser): diff --git a/litellm/proxy/_experimental/mcp_server/tool_search.py b/litellm/proxy/_experimental/mcp_server/tool_search.py index fa57a2b3eb2..2f6b54a264a 100644 --- a/litellm/proxy/_experimental/mcp_server/tool_search.py +++ b/litellm/proxy/_experimental/mcp_server/tool_search.py @@ -91,7 +91,7 @@ async def handle_mcp_tool_search( from litellm.proxy._experimental.mcp_server.server import _list_mcp_tools - mcp_tools = await _list_mcp_tools( + mcp_listing = await _list_mcp_tools( user_api_key_auth=user_api_key_dict, mcp_servers=mcp_servers, client_ip=client_ip, @@ -100,6 +100,7 @@ async def handle_mcp_tool_search( oauth2_headers=oauth2_headers, raw_headers=raw_headers, ) + mcp_tools = mcp_listing.tools tools = [ { "name": t.name, diff --git a/litellm/proxy/_experimental/out/404.html b/litellm/proxy/_experimental/out/404.html index 4009a7f4b95..0a164642dab 100644 --- a/litellm/proxy/_experimental/out/404.html +++ b/litellm/proxy/_experimental/out/404.html @@ -1 +1 @@ -404: This page could not be found.LiteLLM Dashboard

404

This page could not be found.

\ No newline at end of file +404: This page could not be found.LiteLLM Dashboard

404

This page could not be found.

\ No newline at end of file diff --git a/litellm/proxy/_experimental/out/404/index.html b/litellm/proxy/_experimental/out/404/index.html index 4009a7f4b95..0a164642dab 100644 --- a/litellm/proxy/_experimental/out/404/index.html +++ b/litellm/proxy/_experimental/out/404/index.html @@ -1 +1 @@ -404: This page could not be found.LiteLLM Dashboard

404

This page could not be found.

\ No newline at end of file +404: This page could not be found.LiteLLM Dashboard

404

This page could not be found.

\ No newline at end of file diff --git a/litellm/proxy/_experimental/out/__next.!KGRhc2hib2FyZCk.__PAGE__.txt b/litellm/proxy/_experimental/out/__next.!KGRhc2hib2FyZCk.__PAGE__.txt index 6aa34991087..c10ced8b6bc 100644 --- a/litellm/proxy/_experimental/out/__next.!KGRhc2hib2FyZCk.__PAGE__.txt +++ b/litellm/proxy/_experimental/out/__next.!KGRhc2hib2FyZCk.__PAGE__.txt @@ -1,9 +1,9 @@ 1:"$Sreact.fragment" -2:I[347257,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"ClientPageRoot"] -3:I[871135,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js","/litellm-asset-prefix/_next/static/chunks/0uuigwiz-in3~.js","/litellm-asset-prefix/_next/static/chunks/0-0c4mv4-mc9n.js","/litellm-asset-prefix/_next/static/chunks/0lg.6rbfsd-l9.js","/litellm-asset-prefix/_next/static/chunks/0p3v32gvsxp6h.js","/litellm-asset-prefix/_next/static/chunks/0x09ws363q4_0.js","/litellm-asset-prefix/_next/static/chunks/08o64zaid_juv.js","/litellm-asset-prefix/_next/static/chunks/043q3g5-5-aju.js","/litellm-asset-prefix/_next/static/chunks/0g9k1~ppf2hw3.js","/litellm-asset-prefix/_next/static/chunks/151r-5htw45m~.js","/litellm-asset-prefix/_next/static/chunks/0v85l0arelm41.js","/litellm-asset-prefix/_next/static/chunks/0zbgu4ogb6mba.js","/litellm-asset-prefix/_next/static/chunks/0ae3np_qb52e-.js","/litellm-asset-prefix/_next/static/chunks/0zam.8alu6_vj.js","/litellm-asset-prefix/_next/static/chunks/0uu6lckpr0s15.js","/litellm-asset-prefix/_next/static/chunks/0.bx44y-6~tug.js","/litellm-asset-prefix/_next/static/chunks/0l7em-5kjv49e.js","/litellm-asset-prefix/_next/static/chunks/0el08tticy_20.js","/litellm-asset-prefix/_next/static/chunks/0-s2am3eulbyd.js","/litellm-asset-prefix/_next/static/chunks/0sx3mu2_l9g_y.js","/litellm-asset-prefix/_next/static/chunks/0.w8~sa9q0n_s.js","/litellm-asset-prefix/_next/static/chunks/00q4mtjboprhm.js","/litellm-asset-prefix/_next/static/chunks/0zrbitbm~0koh.js","/litellm-asset-prefix/_next/static/chunks/0c4pfjjue0uc-.js","/litellm-asset-prefix/_next/static/chunks/0efmbzvj03niy.js","/litellm-asset-prefix/_next/static/chunks/055egae-ggkjh.js","/litellm-asset-prefix/_next/static/chunks/0hwip5a7qsmis.js","/litellm-asset-prefix/_next/static/chunks/0q6~n4y84cejn.js","/litellm-asset-prefix/_next/static/chunks/0mh1wnrvmv_y7.js"],"default"] -6:I[897367,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"OutletBoundary"] +2:I[347257,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"ClientPageRoot"] +3:I[871135,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js","/litellm-asset-prefix/_next/static/chunks/1ioy8obpggx93.js","/litellm-asset-prefix/_next/static/chunks/3_3dj4vdy-3xy.js","/litellm-asset-prefix/_next/static/chunks/1zr7rrk4wkmju.js","/litellm-asset-prefix/_next/static/chunks/2cngn5bal3278.js","/litellm-asset-prefix/_next/static/chunks/2up3bks93iqds.js","/litellm-asset-prefix/_next/static/chunks/0fk0i3e2aixp7.js","/litellm-asset-prefix/_next/static/chunks/0zduf1gntl_f8.js","/litellm-asset-prefix/_next/static/chunks/0dbvgsc7ha049.js","/litellm-asset-prefix/_next/static/chunks/0g_w4tf2inv3i.js","/litellm-asset-prefix/_next/static/chunks/1vquuz09jxl5_.js","/litellm-asset-prefix/_next/static/chunks/17-6zku8f68gf.js","/litellm-asset-prefix/_next/static/chunks/1iakmimqrlpn0.js","/litellm-asset-prefix/_next/static/chunks/1a0bgy7kzrj91.js","/litellm-asset-prefix/_next/static/chunks/0f5fel02jwglw.js","/litellm-asset-prefix/_next/static/chunks/0g8wwba6umbim.js","/litellm-asset-prefix/_next/static/chunks/1di-caw05k3tq.js","/litellm-asset-prefix/_next/static/chunks/00g6xfr4yow7h.js","/litellm-asset-prefix/_next/static/chunks/2kcxwg1mpncp6.js","/litellm-asset-prefix/_next/static/chunks/1fmx49l6q8v39.js","/litellm-asset-prefix/_next/static/chunks/0ww76lz_0cphv.js","/litellm-asset-prefix/_next/static/chunks/2uc2pi4ob086w.js","/litellm-asset-prefix/_next/static/chunks/2hu1vyy-5pv13.js","/litellm-asset-prefix/_next/static/chunks/2l25bmiiw9ixp.js","/litellm-asset-prefix/_next/static/chunks/1uz3jt-tj9lkf.js","/litellm-asset-prefix/_next/static/chunks/3drq2_k-jeio2.js","/litellm-asset-prefix/_next/static/chunks/0dsiq_ok1yngk.js","/litellm-asset-prefix/_next/static/chunks/3srzg1la93pwv.js","/litellm-asset-prefix/_next/static/chunks/17nqbxvhztf3k.js","/litellm-asset-prefix/_next/static/chunks/2c90xukbd3il6.js","/litellm-asset-prefix/_next/static/chunks/0kap_rdm2-lem.js","/litellm-asset-prefix/_next/static/chunks/09l_m9l1emin2.js","/litellm-asset-prefix/_next/static/chunks/1cea03gg5a_c7.js","/litellm-asset-prefix/_next/static/chunks/323l6h8s7ahat.js","/litellm-asset-prefix/_next/static/chunks/112n0hv3cc2rg.js","/litellm-asset-prefix/_next/static/chunks/199uwr871eene.js","/litellm-asset-prefix/_next/static/chunks/105643dvf00hu.js","/litellm-asset-prefix/_next/static/chunks/12wsfsljxg4xv.js","/litellm-asset-prefix/_next/static/chunks/22iools_e0k44.js","/litellm-asset-prefix/_next/static/chunks/0am68mi9t9cb6.js","/litellm-asset-prefix/_next/static/chunks/23-g73xaw3kap.js"],"default"] +6:I[897367,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"OutletBoundary"] 7:"$Sreact.suspense" -0:{"rsc":["$","$1","c",{"children":[["$","$L2",null,{"Component":"$3","serverProvidedParams":{"searchParams":{},"params":{},"promises":["$@4","$@5"]}}],[["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/0ae3np_qb52e-.js","async":true}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/0zam.8alu6_vj.js","async":true}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/0uu6lckpr0s15.js","async":true}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/0.bx44y-6~tug.js","async":true}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/0l7em-5kjv49e.js","async":true}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/0el08tticy_20.js","async":true}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/0-s2am3eulbyd.js","async":true}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/0sx3mu2_l9g_y.js","async":true}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/0.w8~sa9q0n_s.js","async":true}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/00q4mtjboprhm.js","async":true}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/0zrbitbm~0koh.js","async":true}],["$","script","script-11",{"src":"/litellm-asset-prefix/_next/static/chunks/0c4pfjjue0uc-.js","async":true}],["$","script","script-12",{"src":"/litellm-asset-prefix/_next/static/chunks/0efmbzvj03niy.js","async":true}],["$","script","script-13",{"src":"/litellm-asset-prefix/_next/static/chunks/055egae-ggkjh.js","async":true}],["$","script","script-14",{"src":"/litellm-asset-prefix/_next/static/chunks/0hwip5a7qsmis.js","async":true}],["$","script","script-15",{"src":"/litellm-asset-prefix/_next/static/chunks/0q6~n4y84cejn.js","async":true}],["$","script","script-16",{"src":"/litellm-asset-prefix/_next/static/chunks/0mh1wnrvmv_y7.js","async":true}]],["$","$L6",null,{"children":["$","$7",null,{"name":"Next.MetadataOutlet","children":"$@8"}]}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"KYqiq5stbD-H4YcZ-6OuP"} +0:{"rsc":["$","$1","c",{"children":[["$","$L2",null,{"Component":"$3","serverProvidedParams":{"searchParams":{},"params":{},"promises":["$@4","$@5"]}}],[["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/00g6xfr4yow7h.js","async":true}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/2kcxwg1mpncp6.js","async":true}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/1fmx49l6q8v39.js","async":true}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/0ww76lz_0cphv.js","async":true}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/2uc2pi4ob086w.js","async":true}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/2hu1vyy-5pv13.js","async":true}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/2l25bmiiw9ixp.js","async":true}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/1uz3jt-tj9lkf.js","async":true}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/3drq2_k-jeio2.js","async":true}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/0dsiq_ok1yngk.js","async":true}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/3srzg1la93pwv.js","async":true}],["$","script","script-11",{"src":"/litellm-asset-prefix/_next/static/chunks/17nqbxvhztf3k.js","async":true}],["$","script","script-12",{"src":"/litellm-asset-prefix/_next/static/chunks/2c90xukbd3il6.js","async":true}],["$","script","script-13",{"src":"/litellm-asset-prefix/_next/static/chunks/0kap_rdm2-lem.js","async":true}],["$","script","script-14",{"src":"/litellm-asset-prefix/_next/static/chunks/09l_m9l1emin2.js","async":true}],["$","script","script-15",{"src":"/litellm-asset-prefix/_next/static/chunks/1cea03gg5a_c7.js","async":true}],["$","script","script-16",{"src":"/litellm-asset-prefix/_next/static/chunks/323l6h8s7ahat.js","async":true}],["$","script","script-17",{"src":"/litellm-asset-prefix/_next/static/chunks/112n0hv3cc2rg.js","async":true}],["$","script","script-18",{"src":"/litellm-asset-prefix/_next/static/chunks/199uwr871eene.js","async":true}],["$","script","script-19",{"src":"/litellm-asset-prefix/_next/static/chunks/105643dvf00hu.js","async":true}],["$","script","script-20",{"src":"/litellm-asset-prefix/_next/static/chunks/12wsfsljxg4xv.js","async":true}],["$","script","script-21",{"src":"/litellm-asset-prefix/_next/static/chunks/22iools_e0k44.js","async":true}],["$","script","script-22",{"src":"/litellm-asset-prefix/_next/static/chunks/0am68mi9t9cb6.js","async":true}],["$","script","script-23",{"src":"/litellm-asset-prefix/_next/static/chunks/23-g73xaw3kap.js","async":true}]],["$","$L6",null,{"children":["$","$7",null,{"name":"Next.MetadataOutlet","children":"$@8"}]}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"qXutWsQW5C1Pf62WxTkEI"} 4:{} 5:"$0:rsc:props:children:0:props:serverProvidedParams:params" 8:null diff --git a/litellm/proxy/_experimental/out/__next.!KGRhc2hib2FyZCk.txt b/litellm/proxy/_experimental/out/__next.!KGRhc2hib2FyZCk.txt index b52b61e168b..ef8a75b27ce 100644 --- a/litellm/proxy/_experimental/out/__next.!KGRhc2hib2FyZCk.txt +++ b/litellm/proxy/_experimental/out/__next.!KGRhc2hib2FyZCk.txt @@ -1,7 +1,7 @@ 1:"$Sreact.fragment" -2:I[92825,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"ClientSegmentRoot"] -3:I[216370,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js","/litellm-asset-prefix/_next/static/chunks/0uuigwiz-in3~.js","/litellm-asset-prefix/_next/static/chunks/0-0c4mv4-mc9n.js","/litellm-asset-prefix/_next/static/chunks/0lg.6rbfsd-l9.js","/litellm-asset-prefix/_next/static/chunks/0p3v32gvsxp6h.js","/litellm-asset-prefix/_next/static/chunks/0x09ws363q4_0.js","/litellm-asset-prefix/_next/static/chunks/08o64zaid_juv.js","/litellm-asset-prefix/_next/static/chunks/043q3g5-5-aju.js","/litellm-asset-prefix/_next/static/chunks/0g9k1~ppf2hw3.js","/litellm-asset-prefix/_next/static/chunks/151r-5htw45m~.js","/litellm-asset-prefix/_next/static/chunks/0v85l0arelm41.js","/litellm-asset-prefix/_next/static/chunks/0zbgu4ogb6mba.js"],"default"] -4:I[339756,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default"] -5:I[837457,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default"] -0:{"rsc":["$","$1","c",{"children":[[["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/0uuigwiz-in3~.js","async":true}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/0-0c4mv4-mc9n.js","async":true}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/0lg.6rbfsd-l9.js","async":true}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/0p3v32gvsxp6h.js","async":true}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/0x09ws363q4_0.js","async":true}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/08o64zaid_juv.js","async":true}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/043q3g5-5-aju.js","async":true}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/0g9k1~ppf2hw3.js","async":true}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/151r-5htw45m~.js","async":true}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/0v85l0arelm41.js","async":true}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/0zbgu4ogb6mba.js","async":true}]],["$","$L2",null,{"Component":"$3","slots":{"children":["$","$L4",null,{"parallelRouterKey":"children","template":["$","$L5",null,{}],"notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]]}]},"serverProvidedParams":{"params":{},"promises":["$@6"]}}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"KYqiq5stbD-H4YcZ-6OuP"} +2:I[92825,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"ClientSegmentRoot"] +3:I[216370,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js","/litellm-asset-prefix/_next/static/chunks/1ioy8obpggx93.js","/litellm-asset-prefix/_next/static/chunks/3_3dj4vdy-3xy.js","/litellm-asset-prefix/_next/static/chunks/1zr7rrk4wkmju.js","/litellm-asset-prefix/_next/static/chunks/2cngn5bal3278.js","/litellm-asset-prefix/_next/static/chunks/2up3bks93iqds.js","/litellm-asset-prefix/_next/static/chunks/0fk0i3e2aixp7.js","/litellm-asset-prefix/_next/static/chunks/0zduf1gntl_f8.js","/litellm-asset-prefix/_next/static/chunks/0dbvgsc7ha049.js","/litellm-asset-prefix/_next/static/chunks/0g_w4tf2inv3i.js","/litellm-asset-prefix/_next/static/chunks/1vquuz09jxl5_.js","/litellm-asset-prefix/_next/static/chunks/17-6zku8f68gf.js","/litellm-asset-prefix/_next/static/chunks/1iakmimqrlpn0.js","/litellm-asset-prefix/_next/static/chunks/1a0bgy7kzrj91.js","/litellm-asset-prefix/_next/static/chunks/0f5fel02jwglw.js","/litellm-asset-prefix/_next/static/chunks/0g8wwba6umbim.js","/litellm-asset-prefix/_next/static/chunks/1di-caw05k3tq.js"],"default"] +4:I[339756,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default"] +5:I[837457,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default"] +0:{"rsc":["$","$1","c",{"children":[[["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/1ioy8obpggx93.js","async":true}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/3_3dj4vdy-3xy.js","async":true}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/1zr7rrk4wkmju.js","async":true}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/2cngn5bal3278.js","async":true}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/2up3bks93iqds.js","async":true}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/0fk0i3e2aixp7.js","async":true}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/0zduf1gntl_f8.js","async":true}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/0dbvgsc7ha049.js","async":true}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/0g_w4tf2inv3i.js","async":true}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/1vquuz09jxl5_.js","async":true}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/17-6zku8f68gf.js","async":true}],["$","script","script-11",{"src":"/litellm-asset-prefix/_next/static/chunks/1iakmimqrlpn0.js","async":true}],["$","script","script-12",{"src":"/litellm-asset-prefix/_next/static/chunks/1a0bgy7kzrj91.js","async":true}],["$","script","script-13",{"src":"/litellm-asset-prefix/_next/static/chunks/0f5fel02jwglw.js","async":true}],["$","script","script-14",{"src":"/litellm-asset-prefix/_next/static/chunks/0g8wwba6umbim.js","async":true}],["$","script","script-15",{"src":"/litellm-asset-prefix/_next/static/chunks/1di-caw05k3tq.js","async":true}]],["$","$L2",null,{"Component":"$3","slots":{"children":["$","$L4",null,{"parallelRouterKey":"children","template":["$","$L5",null,{}],"notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]]}]},"serverProvidedParams":{"params":{},"promises":["$@6"]}}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"qXutWsQW5C1Pf62WxTkEI"} 6:"$0:rsc:props:children:1:props:serverProvidedParams:params" diff --git a/litellm/proxy/_experimental/out/__next._full.txt b/litellm/proxy/_experimental/out/__next._full.txt index bb67fb01bc2..3ee486db39b 100644 --- a/litellm/proxy/_experimental/out/__next._full.txt +++ b/litellm/proxy/_experimental/out/__next._full.txt @@ -1,30 +1,32 @@ 1:"$Sreact.fragment" -2:I[867271,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default"] -3:I[71195,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default"] -4:I[557951,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"AuthProvider"] -5:I[339756,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default"] -6:I[837457,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default"] -7:I[92825,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"ClientSegmentRoot"] -8:I[216370,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js","/litellm-asset-prefix/_next/static/chunks/0uuigwiz-in3~.js","/litellm-asset-prefix/_next/static/chunks/0-0c4mv4-mc9n.js","/litellm-asset-prefix/_next/static/chunks/0lg.6rbfsd-l9.js","/litellm-asset-prefix/_next/static/chunks/0p3v32gvsxp6h.js","/litellm-asset-prefix/_next/static/chunks/0x09ws363q4_0.js","/litellm-asset-prefix/_next/static/chunks/08o64zaid_juv.js","/litellm-asset-prefix/_next/static/chunks/043q3g5-5-aju.js","/litellm-asset-prefix/_next/static/chunks/0g9k1~ppf2hw3.js","/litellm-asset-prefix/_next/static/chunks/151r-5htw45m~.js","/litellm-asset-prefix/_next/static/chunks/0v85l0arelm41.js","/litellm-asset-prefix/_next/static/chunks/0zbgu4ogb6mba.js"],"default"] -c:I[168027,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default",1] -:HL["/litellm-asset-prefix/_next/static/chunks/05qmwjqau64bz.css","style"] -:HL["/litellm-asset-prefix/_next/static/chunks/075sund.-mh4~.css","style"] -:HL["/litellm-asset-prefix/_next/static/media/83afe278b6a6bb3c-s.p.0q-301v4kxxnr.woff2","font",{"crossOrigin":"","type":"font/woff2"}] -0:{"P":null,"c":["",""],"q":"","i":false,"f":[[["",{"children":["(dashboard)",{"children":["__PAGE__",{}]}]},"$undefined","$undefined",16],[["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/05qmwjqau64bz.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","link","1",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/075sund.-mh4~.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","async":true,"nonce":"$undefined"}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js","async":true,"nonce":"$undefined"}]],["$","html",null,{"lang":"en","children":["$","body",null,{"className":"inter_5972bc34-module__OU16Qa__className","children":["$","$L2",null,{"children":["$","$L3",null,{"children":["$","$L4",null,{"children":["$","$L5",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L6",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]],"forbidden":"$undefined","unauthorized":"$undefined"}]}]}]}]}]}]]}],{"children":[["$","$1","c",{"children":[[["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/0uuigwiz-in3~.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/0-0c4mv4-mc9n.js","async":true,"nonce":"$undefined"}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/0lg.6rbfsd-l9.js","async":true,"nonce":"$undefined"}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/0p3v32gvsxp6h.js","async":true,"nonce":"$undefined"}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/0x09ws363q4_0.js","async":true,"nonce":"$undefined"}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/08o64zaid_juv.js","async":true,"nonce":"$undefined"}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/043q3g5-5-aju.js","async":true,"nonce":"$undefined"}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/0g9k1~ppf2hw3.js","async":true,"nonce":"$undefined"}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/151r-5htw45m~.js","async":true,"nonce":"$undefined"}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/0v85l0arelm41.js","async":true,"nonce":"$undefined"}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/0zbgu4ogb6mba.js","async":true,"nonce":"$undefined"}]],["$","$L7",null,{"Component":"$8","slots":{"children":["$","$L5",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L6",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:children:props:notFound:0:1:props:style","children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:1:props:style","children":404}],["$","div",null,{"style":"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:2:props:style","children":["$","h2",null,{"style":"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:2:props:children:props:style","children":"This page could not be found."}]}]]}]}]],[]],"forbidden":"$undefined","unauthorized":"$undefined"}]},"serverProvidedParams":{"params":{},"promises":["$@9"]}}]]}],{"children":["$La",{},null,false,null]},null,false,null]},null,false,null],"$Lb",false]],"m":"$undefined","G":["$c",["$Ld","$Le"]],"S":true,"h":null,"s":"$undefined","l":"$undefined","p":"$undefined","d":"$undefined","b":"KYqiq5stbD-H4YcZ-6OuP"} -f:I[347257,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"ClientPageRoot"] -10:I[871135,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js","/litellm-asset-prefix/_next/static/chunks/0uuigwiz-in3~.js","/litellm-asset-prefix/_next/static/chunks/0-0c4mv4-mc9n.js","/litellm-asset-prefix/_next/static/chunks/0lg.6rbfsd-l9.js","/litellm-asset-prefix/_next/static/chunks/0p3v32gvsxp6h.js","/litellm-asset-prefix/_next/static/chunks/0x09ws363q4_0.js","/litellm-asset-prefix/_next/static/chunks/08o64zaid_juv.js","/litellm-asset-prefix/_next/static/chunks/043q3g5-5-aju.js","/litellm-asset-prefix/_next/static/chunks/0g9k1~ppf2hw3.js","/litellm-asset-prefix/_next/static/chunks/151r-5htw45m~.js","/litellm-asset-prefix/_next/static/chunks/0v85l0arelm41.js","/litellm-asset-prefix/_next/static/chunks/0zbgu4ogb6mba.js","/litellm-asset-prefix/_next/static/chunks/0ae3np_qb52e-.js","/litellm-asset-prefix/_next/static/chunks/0zam.8alu6_vj.js","/litellm-asset-prefix/_next/static/chunks/0uu6lckpr0s15.js","/litellm-asset-prefix/_next/static/chunks/0.bx44y-6~tug.js","/litellm-asset-prefix/_next/static/chunks/0l7em-5kjv49e.js","/litellm-asset-prefix/_next/static/chunks/0el08tticy_20.js","/litellm-asset-prefix/_next/static/chunks/0-s2am3eulbyd.js","/litellm-asset-prefix/_next/static/chunks/0sx3mu2_l9g_y.js","/litellm-asset-prefix/_next/static/chunks/0.w8~sa9q0n_s.js","/litellm-asset-prefix/_next/static/chunks/00q4mtjboprhm.js","/litellm-asset-prefix/_next/static/chunks/0zrbitbm~0koh.js","/litellm-asset-prefix/_next/static/chunks/0c4pfjjue0uc-.js","/litellm-asset-prefix/_next/static/chunks/0efmbzvj03niy.js","/litellm-asset-prefix/_next/static/chunks/055egae-ggkjh.js","/litellm-asset-prefix/_next/static/chunks/0hwip5a7qsmis.js","/litellm-asset-prefix/_next/static/chunks/0q6~n4y84cejn.js","/litellm-asset-prefix/_next/static/chunks/0mh1wnrvmv_y7.js"],"default"] -13:I[897367,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"OutletBoundary"] -14:"$Sreact.suspense" -16:I[897367,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"ViewportBoundary"] -18:I[897367,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"MetadataBoundary"] -a:["$","$1","c",{"children":[["$","$Lf",null,{"Component":"$10","serverProvidedParams":{"searchParams":{},"params":"$0:f:0:1:1:children:0:props:children:1:props:serverProvidedParams:params","promises":["$@11","$@12"]}}],[["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/0ae3np_qb52e-.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/0zam.8alu6_vj.js","async":true,"nonce":"$undefined"}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/0uu6lckpr0s15.js","async":true,"nonce":"$undefined"}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/0.bx44y-6~tug.js","async":true,"nonce":"$undefined"}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/0l7em-5kjv49e.js","async":true,"nonce":"$undefined"}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/0el08tticy_20.js","async":true,"nonce":"$undefined"}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/0-s2am3eulbyd.js","async":true,"nonce":"$undefined"}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/0sx3mu2_l9g_y.js","async":true,"nonce":"$undefined"}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/0.w8~sa9q0n_s.js","async":true,"nonce":"$undefined"}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/00q4mtjboprhm.js","async":true,"nonce":"$undefined"}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/0zrbitbm~0koh.js","async":true,"nonce":"$undefined"}],["$","script","script-11",{"src":"/litellm-asset-prefix/_next/static/chunks/0c4pfjjue0uc-.js","async":true,"nonce":"$undefined"}],["$","script","script-12",{"src":"/litellm-asset-prefix/_next/static/chunks/0efmbzvj03niy.js","async":true,"nonce":"$undefined"}],["$","script","script-13",{"src":"/litellm-asset-prefix/_next/static/chunks/055egae-ggkjh.js","async":true,"nonce":"$undefined"}],["$","script","script-14",{"src":"/litellm-asset-prefix/_next/static/chunks/0hwip5a7qsmis.js","async":true,"nonce":"$undefined"}],["$","script","script-15",{"src":"/litellm-asset-prefix/_next/static/chunks/0q6~n4y84cejn.js","async":true,"nonce":"$undefined"}],["$","script","script-16",{"src":"/litellm-asset-prefix/_next/static/chunks/0mh1wnrvmv_y7.js","async":true,"nonce":"$undefined"}]],["$","$L13",null,{"children":["$","$14",null,{"name":"Next.MetadataOutlet","children":"$@15"}]}]]}] -b:["$","$1","h",{"children":[null,["$","$L16",null,{"children":"$L17"}],["$","div",null,{"hidden":true,"children":["$","$L18",null,{"children":["$","$14",null,{"name":"Next.Metadata","children":"$L19"}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}] -d:["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/05qmwjqau64bz.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}] -e:["$","link","1",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/075sund.-mh4~.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}] -9:"$0:f:0:1:1:children:0:props:children:1:props:serverProvidedParams:params" -11:{} -12:"$0:f:0:1:1:children:0:props:children:1:props:serverProvidedParams:params" -17:[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]] -1a:I[27201,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"IconMark"] -15:null -19:[["$","title","0",{"children":"LiteLLM Dashboard"}],["$","meta","1",{"name":"description","content":"LiteLLM Proxy Admin UI"}],["$","link","2",{"rel":"icon","href":"/favicon.ico?favicon.0~dgapwhi~75y.ico","sizes":"48x48","type":"image/x-icon"}],["$","link","3",{"rel":"icon","href":"/get_favicon"}],["$","$L1a","4",{}]] +2:I[867271,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default"] +3:I[71195,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default"] +4:I[557951,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"AuthProvider"] +5:I[339756,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default"] +6:I[837457,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default"] +7:I[92825,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"ClientSegmentRoot"] +8:I[216370,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js","/litellm-asset-prefix/_next/static/chunks/1ioy8obpggx93.js","/litellm-asset-prefix/_next/static/chunks/3_3dj4vdy-3xy.js","/litellm-asset-prefix/_next/static/chunks/1zr7rrk4wkmju.js","/litellm-asset-prefix/_next/static/chunks/2cngn5bal3278.js","/litellm-asset-prefix/_next/static/chunks/2up3bks93iqds.js","/litellm-asset-prefix/_next/static/chunks/0fk0i3e2aixp7.js","/litellm-asset-prefix/_next/static/chunks/0zduf1gntl_f8.js","/litellm-asset-prefix/_next/static/chunks/0dbvgsc7ha049.js","/litellm-asset-prefix/_next/static/chunks/0g_w4tf2inv3i.js","/litellm-asset-prefix/_next/static/chunks/1vquuz09jxl5_.js","/litellm-asset-prefix/_next/static/chunks/17-6zku8f68gf.js","/litellm-asset-prefix/_next/static/chunks/1iakmimqrlpn0.js","/litellm-asset-prefix/_next/static/chunks/1a0bgy7kzrj91.js","/litellm-asset-prefix/_next/static/chunks/0f5fel02jwglw.js","/litellm-asset-prefix/_next/static/chunks/0g8wwba6umbim.js","/litellm-asset-prefix/_next/static/chunks/1di-caw05k3tq.js"],"default"] +e:I[168027,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default",1] +:HL["/litellm-asset-prefix/_next/static/chunks/1kid9zr1--h6y.css","style"] +:HL["/litellm-asset-prefix/_next/static/chunks/3254j4ut19q6_.css","style"] +:HL["/litellm-asset-prefix/_next/static/media/83afe278b6a6bb3c-s.p.2bn3s6zvc0dyp.woff2","font",{"crossOrigin":"","type":"font/woff2"}] +0:{"P":null,"c":["",""],"q":"","i":false,"f":[[["",{"children":["(dashboard)",{"children":["__PAGE__",{}]}]},"$undefined","$undefined",16],[["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/1kid9zr1--h6y.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","link","1",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/3254j4ut19q6_.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","async":true,"nonce":"$undefined"}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js","async":true,"nonce":"$undefined"}]],["$","html",null,{"lang":"en","children":["$","body",null,{"className":"inter_5972bc34-module__OU16Qa__className","children":["$","$L2",null,{"children":["$","$L3",null,{"children":["$","$L4",null,{"children":["$","$L5",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L6",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]],"forbidden":"$undefined","unauthorized":"$undefined"}]}]}]}]}]}]]}],{"children":[["$","$1","c",{"children":[[["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/1ioy8obpggx93.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/3_3dj4vdy-3xy.js","async":true,"nonce":"$undefined"}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/1zr7rrk4wkmju.js","async":true,"nonce":"$undefined"}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/2cngn5bal3278.js","async":true,"nonce":"$undefined"}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/2up3bks93iqds.js","async":true,"nonce":"$undefined"}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/0fk0i3e2aixp7.js","async":true,"nonce":"$undefined"}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/0zduf1gntl_f8.js","async":true,"nonce":"$undefined"}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/0dbvgsc7ha049.js","async":true,"nonce":"$undefined"}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/0g_w4tf2inv3i.js","async":true,"nonce":"$undefined"}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/1vquuz09jxl5_.js","async":true,"nonce":"$undefined"}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/17-6zku8f68gf.js","async":true,"nonce":"$undefined"}],["$","script","script-11",{"src":"/litellm-asset-prefix/_next/static/chunks/1iakmimqrlpn0.js","async":true,"nonce":"$undefined"}],["$","script","script-12",{"src":"/litellm-asset-prefix/_next/static/chunks/1a0bgy7kzrj91.js","async":true,"nonce":"$undefined"}],["$","script","script-13",{"src":"/litellm-asset-prefix/_next/static/chunks/0f5fel02jwglw.js","async":true,"nonce":"$undefined"}],["$","script","script-14",{"src":"/litellm-asset-prefix/_next/static/chunks/0g8wwba6umbim.js","async":true,"nonce":"$undefined"}],["$","script","script-15",{"src":"/litellm-asset-prefix/_next/static/chunks/1di-caw05k3tq.js","async":true,"nonce":"$undefined"}]],["$","$L7",null,{"Component":"$8","slots":{"children":["$","$L5",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":"$L9","templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$La","forbidden":"$undefined","unauthorized":"$undefined"}]},"serverProvidedParams":{"params":{},"promises":["$@b"]}}]]}],{"children":["$Lc",{},null,false,null]},null,false,null]},null,false,null],"$Ld",false]],"m":"$undefined","G":["$e",["$Lf","$L10"]],"S":true,"h":null,"s":"$undefined","l":"$undefined","p":"$undefined","d":"$undefined","b":"qXutWsQW5C1Pf62WxTkEI"} +11:I[347257,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"ClientPageRoot"] +12:I[871135,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js","/litellm-asset-prefix/_next/static/chunks/1ioy8obpggx93.js","/litellm-asset-prefix/_next/static/chunks/3_3dj4vdy-3xy.js","/litellm-asset-prefix/_next/static/chunks/1zr7rrk4wkmju.js","/litellm-asset-prefix/_next/static/chunks/2cngn5bal3278.js","/litellm-asset-prefix/_next/static/chunks/2up3bks93iqds.js","/litellm-asset-prefix/_next/static/chunks/0fk0i3e2aixp7.js","/litellm-asset-prefix/_next/static/chunks/0zduf1gntl_f8.js","/litellm-asset-prefix/_next/static/chunks/0dbvgsc7ha049.js","/litellm-asset-prefix/_next/static/chunks/0g_w4tf2inv3i.js","/litellm-asset-prefix/_next/static/chunks/1vquuz09jxl5_.js","/litellm-asset-prefix/_next/static/chunks/17-6zku8f68gf.js","/litellm-asset-prefix/_next/static/chunks/1iakmimqrlpn0.js","/litellm-asset-prefix/_next/static/chunks/1a0bgy7kzrj91.js","/litellm-asset-prefix/_next/static/chunks/0f5fel02jwglw.js","/litellm-asset-prefix/_next/static/chunks/0g8wwba6umbim.js","/litellm-asset-prefix/_next/static/chunks/1di-caw05k3tq.js","/litellm-asset-prefix/_next/static/chunks/00g6xfr4yow7h.js","/litellm-asset-prefix/_next/static/chunks/2kcxwg1mpncp6.js","/litellm-asset-prefix/_next/static/chunks/1fmx49l6q8v39.js","/litellm-asset-prefix/_next/static/chunks/0ww76lz_0cphv.js","/litellm-asset-prefix/_next/static/chunks/2uc2pi4ob086w.js","/litellm-asset-prefix/_next/static/chunks/2hu1vyy-5pv13.js","/litellm-asset-prefix/_next/static/chunks/2l25bmiiw9ixp.js","/litellm-asset-prefix/_next/static/chunks/1uz3jt-tj9lkf.js","/litellm-asset-prefix/_next/static/chunks/3drq2_k-jeio2.js","/litellm-asset-prefix/_next/static/chunks/0dsiq_ok1yngk.js","/litellm-asset-prefix/_next/static/chunks/3srzg1la93pwv.js","/litellm-asset-prefix/_next/static/chunks/17nqbxvhztf3k.js","/litellm-asset-prefix/_next/static/chunks/2c90xukbd3il6.js","/litellm-asset-prefix/_next/static/chunks/0kap_rdm2-lem.js","/litellm-asset-prefix/_next/static/chunks/09l_m9l1emin2.js","/litellm-asset-prefix/_next/static/chunks/1cea03gg5a_c7.js","/litellm-asset-prefix/_next/static/chunks/323l6h8s7ahat.js","/litellm-asset-prefix/_next/static/chunks/112n0hv3cc2rg.js","/litellm-asset-prefix/_next/static/chunks/199uwr871eene.js","/litellm-asset-prefix/_next/static/chunks/105643dvf00hu.js","/litellm-asset-prefix/_next/static/chunks/12wsfsljxg4xv.js","/litellm-asset-prefix/_next/static/chunks/22iools_e0k44.js","/litellm-asset-prefix/_next/static/chunks/0am68mi9t9cb6.js","/litellm-asset-prefix/_next/static/chunks/23-g73xaw3kap.js"],"default"] +15:I[897367,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"OutletBoundary"] +16:"$Sreact.suspense" +18:I[897367,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"ViewportBoundary"] +1a:I[897367,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"MetadataBoundary"] +9:["$","$L6",null,{}] +a:[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:children:props:notFound:0:1:props:style","children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:1:props:style","children":404}],["$","div",null,{"style":"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:2:props:style","children":["$","h2",null,{"style":"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:2:props:children:props:style","children":"This page could not be found."}]}]]}]}]],[]] +c:["$","$1","c",{"children":[["$","$L11",null,{"Component":"$12","serverProvidedParams":{"searchParams":{},"params":"$0:f:0:1:1:children:0:props:children:1:props:serverProvidedParams:params","promises":["$@13","$@14"]}}],[["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/00g6xfr4yow7h.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/2kcxwg1mpncp6.js","async":true,"nonce":"$undefined"}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/1fmx49l6q8v39.js","async":true,"nonce":"$undefined"}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/0ww76lz_0cphv.js","async":true,"nonce":"$undefined"}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/2uc2pi4ob086w.js","async":true,"nonce":"$undefined"}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/2hu1vyy-5pv13.js","async":true,"nonce":"$undefined"}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/2l25bmiiw9ixp.js","async":true,"nonce":"$undefined"}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/1uz3jt-tj9lkf.js","async":true,"nonce":"$undefined"}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/3drq2_k-jeio2.js","async":true,"nonce":"$undefined"}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/0dsiq_ok1yngk.js","async":true,"nonce":"$undefined"}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/3srzg1la93pwv.js","async":true,"nonce":"$undefined"}],["$","script","script-11",{"src":"/litellm-asset-prefix/_next/static/chunks/17nqbxvhztf3k.js","async":true,"nonce":"$undefined"}],["$","script","script-12",{"src":"/litellm-asset-prefix/_next/static/chunks/2c90xukbd3il6.js","async":true,"nonce":"$undefined"}],["$","script","script-13",{"src":"/litellm-asset-prefix/_next/static/chunks/0kap_rdm2-lem.js","async":true,"nonce":"$undefined"}],["$","script","script-14",{"src":"/litellm-asset-prefix/_next/static/chunks/09l_m9l1emin2.js","async":true,"nonce":"$undefined"}],["$","script","script-15",{"src":"/litellm-asset-prefix/_next/static/chunks/1cea03gg5a_c7.js","async":true,"nonce":"$undefined"}],["$","script","script-16",{"src":"/litellm-asset-prefix/_next/static/chunks/323l6h8s7ahat.js","async":true,"nonce":"$undefined"}],["$","script","script-17",{"src":"/litellm-asset-prefix/_next/static/chunks/112n0hv3cc2rg.js","async":true,"nonce":"$undefined"}],["$","script","script-18",{"src":"/litellm-asset-prefix/_next/static/chunks/199uwr871eene.js","async":true,"nonce":"$undefined"}],["$","script","script-19",{"src":"/litellm-asset-prefix/_next/static/chunks/105643dvf00hu.js","async":true,"nonce":"$undefined"}],["$","script","script-20",{"src":"/litellm-asset-prefix/_next/static/chunks/12wsfsljxg4xv.js","async":true,"nonce":"$undefined"}],["$","script","script-21",{"src":"/litellm-asset-prefix/_next/static/chunks/22iools_e0k44.js","async":true,"nonce":"$undefined"}],["$","script","script-22",{"src":"/litellm-asset-prefix/_next/static/chunks/0am68mi9t9cb6.js","async":true,"nonce":"$undefined"}],["$","script","script-23",{"src":"/litellm-asset-prefix/_next/static/chunks/23-g73xaw3kap.js","async":true,"nonce":"$undefined"}]],["$","$L15",null,{"children":["$","$16",null,{"name":"Next.MetadataOutlet","children":"$@17"}]}]]}] +d:["$","$1","h",{"children":[null,["$","$L18",null,{"children":"$L19"}],["$","div",null,{"hidden":true,"children":["$","$L1a",null,{"children":["$","$16",null,{"name":"Next.Metadata","children":"$L1b"}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}] +f:["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/1kid9zr1--h6y.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}] +10:["$","link","1",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/3254j4ut19q6_.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}] +b:"$0:f:0:1:1:children:0:props:children:1:props:serverProvidedParams:params" +13:{} +14:"$0:f:0:1:1:children:0:props:children:1:props:serverProvidedParams:params" +19:[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]] +1c:I[27201,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"IconMark"] +17:null +1b:[["$","title","0",{"children":"LiteLLM Dashboard"}],["$","meta","1",{"name":"description","content":"LiteLLM Proxy Admin UI"}],["$","link","2",{"rel":"icon","href":"/favicon.ico?favicon.3arlap5n8tyzg.ico","sizes":"48x48","type":"image/x-icon"}],["$","link","3",{"rel":"icon","href":"/get_favicon"}],["$","$L1c","4",{}]] diff --git a/litellm/proxy/_experimental/out/__next._head.txt b/litellm/proxy/_experimental/out/__next._head.txt index c896283665a..9b12cf54d0c 100644 --- a/litellm/proxy/_experimental/out/__next._head.txt +++ b/litellm/proxy/_experimental/out/__next._head.txt @@ -1,6 +1,6 @@ 1:"$Sreact.fragment" -2:I[897367,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"ViewportBoundary"] -3:I[897367,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"MetadataBoundary"] +2:I[897367,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"ViewportBoundary"] +3:I[897367,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"MetadataBoundary"] 4:"$Sreact.suspense" -5:I[27201,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"IconMark"] -0:{"rsc":["$","$1","h",{"children":[null,["$","$L2",null,{"children":[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]]}],["$","div",null,{"hidden":true,"children":["$","$L3",null,{"children":["$","$4",null,{"name":"Next.Metadata","children":[["$","title","0",{"children":"LiteLLM Dashboard"}],["$","meta","1",{"name":"description","content":"LiteLLM Proxy Admin UI"}],["$","link","2",{"rel":"icon","href":"/favicon.ico?favicon.0~dgapwhi~75y.ico","sizes":"48x48","type":"image/x-icon"}],["$","link","3",{"rel":"icon","href":"/get_favicon"}],["$","$L5","4",{}]]}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"KYqiq5stbD-H4YcZ-6OuP"} +5:I[27201,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"IconMark"] +0:{"rsc":["$","$1","h",{"children":[null,["$","$L2",null,{"children":[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]]}],["$","div",null,{"hidden":true,"children":["$","$L3",null,{"children":["$","$4",null,{"name":"Next.Metadata","children":[["$","title","0",{"children":"LiteLLM Dashboard"}],["$","meta","1",{"name":"description","content":"LiteLLM Proxy Admin UI"}],["$","link","2",{"rel":"icon","href":"/favicon.ico?favicon.3arlap5n8tyzg.ico","sizes":"48x48","type":"image/x-icon"}],["$","link","3",{"rel":"icon","href":"/get_favicon"}],["$","$L5","4",{}]]}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"qXutWsQW5C1Pf62WxTkEI"} diff --git a/litellm/proxy/_experimental/out/__next._index.txt b/litellm/proxy/_experimental/out/__next._index.txt index e21c0fe74b8..8649901b01b 100644 --- a/litellm/proxy/_experimental/out/__next._index.txt +++ b/litellm/proxy/_experimental/out/__next._index.txt @@ -1,9 +1,9 @@ 1:"$Sreact.fragment" -2:I[867271,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default"] -3:I[71195,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default"] -4:I[557951,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"AuthProvider"] -5:I[339756,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default"] -6:I[837457,["/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js"],"default"] -:HL["/litellm-asset-prefix/_next/static/chunks/05qmwjqau64bz.css","style"] -:HL["/litellm-asset-prefix/_next/static/chunks/075sund.-mh4~.css","style"] -0:{"rsc":["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/05qmwjqau64bz.css","precedence":"next"}],["$","link","1",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/075sund.-mh4~.css","precedence":"next"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/08yy42xvwaak6.js","async":true}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/0e9hs7onyj28m.js","async":true}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/0pidya1qvuvx8.js","async":true}]],["$","html",null,{"lang":"en","children":["$","body",null,{"className":"inter_5972bc34-module__OU16Qa__className","children":["$","$L2",null,{"children":["$","$L3",null,{"children":["$","$L4",null,{"children":["$","$L5",null,{"parallelRouterKey":"children","template":["$","$L6",null,{}],"notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]]}]}]}]}]}]}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"KYqiq5stbD-H4YcZ-6OuP"} +2:I[867271,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default"] +3:I[71195,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default"] +4:I[557951,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"AuthProvider"] +5:I[339756,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default"] +6:I[837457,["/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js"],"default"] +:HL["/litellm-asset-prefix/_next/static/chunks/1kid9zr1--h6y.css","style"] +:HL["/litellm-asset-prefix/_next/static/chunks/3254j4ut19q6_.css","style"] +0:{"rsc":["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/1kid9zr1--h6y.css","precedence":"next"}],["$","link","1",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/3254j4ut19q6_.css","precedence":"next"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/0vggytdohwe7o.js","async":true}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/3c02m_kr-u94p.js","async":true}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/1jfookxfajkeo.js","async":true}]],["$","html",null,{"lang":"en","children":["$","body",null,{"className":"inter_5972bc34-module__OU16Qa__className","children":["$","$L2",null,{"children":["$","$L3",null,{"children":["$","$L4",null,{"children":["$","$L5",null,{"parallelRouterKey":"children","template":["$","$L6",null,{}],"notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]]}]}]}]}]}]}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"qXutWsQW5C1Pf62WxTkEI"} diff --git a/litellm/proxy/_experimental/out/__next._tree.txt b/litellm/proxy/_experimental/out/__next._tree.txt index 843f0806214..db0015f1f41 100644 --- a/litellm/proxy/_experimental/out/__next._tree.txt +++ b/litellm/proxy/_experimental/out/__next._tree.txt @@ -1,4 +1,4 @@ -:HL["/litellm-asset-prefix/_next/static/chunks/05qmwjqau64bz.css","style"] -:HL["/litellm-asset-prefix/_next/static/chunks/075sund.-mh4~.css","style"] -:HL["/litellm-asset-prefix/_next/static/media/83afe278b6a6bb3c-s.p.0q-301v4kxxnr.woff2","font",{"crossOrigin":"","type":"font/woff2"}] -0:{"tree":{"name":"","param":null,"prefetchHints":16,"slots":{"children":{"name":"(dashboard)","param":null,"prefetchHints":0,"slots":{"children":{"name":"__PAGE__","param":null,"prefetchHints":0,"slots":null}}}}},"staleTime":300,"buildId":"KYqiq5stbD-H4YcZ-6OuP"} +:HL["/litellm-asset-prefix/_next/static/chunks/1kid9zr1--h6y.css","style"] +:HL["/litellm-asset-prefix/_next/static/chunks/3254j4ut19q6_.css","style"] +:HL["/litellm-asset-prefix/_next/static/media/83afe278b6a6bb3c-s.p.2bn3s6zvc0dyp.woff2","font",{"crossOrigin":"","type":"font/woff2"}] +0:{"tree":{"name":"","param":null,"prefetchHints":16,"slots":{"children":{"name":"(dashboard)","param":null,"prefetchHints":0,"slots":{"children":{"name":"__PAGE__","param":null,"prefetchHints":0,"slots":null}}}}},"staleTime":300,"buildId":"qXutWsQW5C1Pf62WxTkEI"} diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/0-.xiiczht-vh.js b/litellm/proxy/_experimental/out/_next/static/chunks/0-.xiiczht-vh.js deleted file mode 100644 index 9d2f975ff66..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/0-.xiiczht-vh.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,728889,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(829087),o=e.i(480731),l=e.i(444755),d=e.i(673706),s=e.i(95779);let n={xs:{paddingX:"px-1.5",paddingY:"py-1.5"},sm:{paddingX:"px-1.5",paddingY:"py-1.5"},md:{paddingX:"px-2",paddingY:"py-2"},lg:{paddingX:"px-2",paddingY:"py-2"},xl:{paddingX:"px-2.5",paddingY:"py-2.5"}},i={xs:{height:"h-3",width:"w-3"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-7",width:"w-7"},xl:{height:"h-9",width:"w-9"}},m={simple:{rounded:"",border:"",ring:"",shadow:""},light:{rounded:"rounded-tremor-default",border:"",ring:"",shadow:""},shadow:{rounded:"rounded-tremor-default",border:"border",ring:"",shadow:"shadow-tremor-card dark:shadow-dark-tremor-card"},solid:{rounded:"rounded-tremor-default",border:"border-2",ring:"ring-1",shadow:""},outlined:{rounded:"rounded-tremor-default",border:"border",ring:"ring-2",shadow:""}},c=(0,d.makeClassName)("Icon"),g=t.default.forwardRef((e,g)=>{let{icon:u,variant:b="simple",tooltip:f,size:h=o.Sizes.SM,color:w,className:C}=e,k=(0,r.__rest)(e,["icon","variant","tooltip","size","color","className"]),p=((e,r)=>{switch(e){case"simple":return{textColor:r?(0,d.getColorClassNames)(r,s.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:"",borderColor:"",ringColor:""};case"light":return{textColor:r?(0,d.getColorClassNames)(r,s.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:r?(0,l.tremorTwMerge)((0,d.getColorClassNames)(r,s.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand-muted dark:bg-dark-tremor-brand-muted",borderColor:"",ringColor:""};case"shadow":return{textColor:r?(0,d.getColorClassNames)(r,s.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:r?(0,l.tremorTwMerge)((0,d.getColorClassNames)(r,s.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:"border-tremor-border dark:border-dark-tremor-border",ringColor:""};case"solid":return{textColor:r?(0,d.getColorClassNames)(r,s.colorPalette.text).textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:r?(0,l.tremorTwMerge)((0,d.getColorClassNames)(r,s.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand dark:bg-dark-tremor-brand",borderColor:"border-tremor-brand-inverted dark:border-dark-tremor-brand-inverted",ringColor:"ring-tremor-ring dark:ring-dark-tremor-ring"};case"outlined":return{textColor:r?(0,d.getColorClassNames)(r,s.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:r?(0,l.tremorTwMerge)((0,d.getColorClassNames)(r,s.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:r?(0,d.getColorClassNames)(r,s.colorPalette.ring).borderColor:"border-tremor-brand-subtle dark:border-dark-tremor-brand-subtle",ringColor:r?(0,l.tremorTwMerge)((0,d.getColorClassNames)(r,s.colorPalette.ring).ringColor,"ring-opacity-40"):"ring-tremor-brand-muted dark:ring-dark-tremor-brand-muted"}}})(b,w),{tooltipProps:x,getReferenceProps:N}=(0,a.useTooltip)();return t.default.createElement("span",Object.assign({ref:(0,d.mergeRefs)([g,x.refs.setReference]),className:(0,l.tremorTwMerge)(c("root"),"inline-flex shrink-0 items-center justify-center",p.bgColor,p.textColor,p.borderColor,p.ringColor,m[b].rounded,m[b].border,m[b].shadow,m[b].ring,n[h].paddingX,n[h].paddingY,C)},N,k),t.default.createElement(a.default,Object.assign({text:f},x)),t.default.createElement(u,{className:(0,l.tremorTwMerge)(c("icon"),"shrink-0",i[h].height,i[h].width)}))});g.displayName="Icon",e.s(["default",0,g],728889)},752978,e=>{"use strict";var r=e.i(728889);e.s(["Icon",()=>r.default])},871943,e=>{"use strict";var r=e.i(271645);let t=r.forwardRef(function(e,t){return r.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),r.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 9l-7 7-7-7"}))});e.s(["ChevronDownIcon",0,t],871943)},360820,e=>{"use strict";var r=e.i(271645);let t=r.forwardRef(function(e,t){return r.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),r.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M5 15l7-7 7 7"}))});e.s(["ChevronUpIcon",0,t],360820)},269200,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("Table"),l=t.default.forwardRef((e,l)=>{let{children:d,className:s}=e,n=(0,r.__rest)(e,["children","className"]);return t.default.createElement("div",{className:(0,a.tremorTwMerge)(o("root"),"overflow-auto",s)},t.default.createElement("table",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("table"),"w-full text-tremor-default","text-tremor-content","dark:text-dark-tremor-content")},n),d))});l.displayName="Table",e.s(["Table",0,l],269200)},427612,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableHead"),l=t.default.forwardRef((e,l)=>{let{children:d,className:s}=e,n=(0,r.__rest)(e,["children","className"]);return t.default.createElement(t.default.Fragment,null,t.default.createElement("thead",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("root"),"text-left","text-tremor-content","dark:text-dark-tremor-content",s)},n),d))});l.displayName="TableHead",e.s(["TableHead",0,l],427612)},64848,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableHeaderCell"),l=t.default.forwardRef((e,l)=>{let{children:d,className:s}=e,n=(0,r.__rest)(e,["children","className"]);return t.default.createElement(t.default.Fragment,null,t.default.createElement("th",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("root"),"whitespace-nowrap text-left font-semibold top-0 px-4 py-3.5","text-tremor-content-strong","dark:text-dark-tremor-content-strong",s)},n),d))});l.displayName="TableHeaderCell",e.s(["TableHeaderCell",0,l],64848)},942232,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableBody"),l=t.default.forwardRef((e,l)=>{let{children:d,className:s}=e,n=(0,r.__rest)(e,["children","className"]);return t.default.createElement(t.default.Fragment,null,t.default.createElement("tbody",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("root"),"align-top divide-y","divide-tremor-border","dark:divide-dark-tremor-border",s)},n),d))});l.displayName="TableBody",e.s(["TableBody",0,l],942232)},496020,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableRow"),l=t.default.forwardRef((e,l)=>{let{children:d,className:s}=e,n=(0,r.__rest)(e,["children","className"]);return t.default.createElement(t.default.Fragment,null,t.default.createElement("tr",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("row"),s)},n),d))});l.displayName="TableRow",e.s(["TableRow",0,l],496020)},977572,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableCell"),l=t.default.forwardRef((e,l)=>{let{children:d,className:s}=e,n=(0,r.__rest)(e,["children","className"]);return t.default.createElement(t.default.Fragment,null,t.default.createElement("td",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("root"),"align-middle whitespace-nowrap text-left p-4",s)},n),d))});l.displayName="TableCell",e.s(["TableCell",0,l],977572)},68155,e=>{"use strict";var r=e.i(271645);let t=r.forwardRef(function(e,t){return r.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),r.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"}))});e.s(["TrashIcon",0,t],68155)},278587,e=>{"use strict";var r=e.i(271645);let t=r.forwardRef(function(e,t){return r.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),r.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"}))});e.s(["RefreshIcon",0,t],278587)},973095,e=>{"use strict";var r=e.i(843476),t=e.i(502501),a=e.i(135214),o=e.i(936578),l=e.i(271645);function d(){let{isLoading:e,isAuthorized:l}=(0,a.default)();return e||!l?(0,r.jsx)(o.default,{}):(0,r.jsx)(t.default,{})}e.s(["default",0,function(){return(0,r.jsx)(l.Suspense,{fallback:(0,r.jsx)(o.default,{}),children:(0,r.jsx)(d,{})})}])}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/0-0c4mv4-mc9n.js b/litellm/proxy/_experimental/out/_next/static/chunks/0-0c4mv4-mc9n.js deleted file mode 100644 index 8f16e50edb1..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/0-0c4mv4-mc9n.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,186312,e=>{"use strict";var t=new WeakMap,r=new WeakMap,n={},s=0,o=function(e){return e&&(e.host||o(e.parentNode))},i=function(e,i,a,l){var u=(Array.isArray(e)?e:[e]).map(function(e){if(i.contains(e))return e;var t=o(e);return t&&i.contains(t)?t:(console.error("aria-hidden",e,"in not contained inside",i,". Doing nothing"),null)}).filter(function(e){return!!e});n[a]||(n[a]=new WeakMap);var c=n[a],d=[],h=new Set,p=new Set(u),f=function(e){!e||h.has(e)||(h.add(e),f(e.parentNode))};u.forEach(f);var m=function(e){!e||p.has(e)||Array.prototype.forEach.call(e.children,function(e){if(h.has(e))m(e);else try{var n=e.getAttribute(l),s=null!==n&&"false"!==n,o=(t.get(e)||0)+1,i=(c.get(e)||0)+1;t.set(e,o),c.set(e,i),d.push(e),1===o&&s&&r.set(e,!0),1===i&&e.setAttribute(a,"true"),s||e.setAttribute(l,"true")}catch(t){console.error("aria-hidden: cannot operate on ",e,t)}})};return m(i),h.clear(),s++,function(){d.forEach(function(e){var n=t.get(e)-1,s=c.get(e)-1;t.set(e,n),c.set(e,s),n||(r.has(e)||e.removeAttribute(l),r.delete(e)),s||e.removeAttribute(a)}),--s||(t=new WeakMap,t=new WeakMap,r=new WeakMap,n={})}};e.s(["hideOthers",0,function(e,t,r){void 0===r&&(r="data-aria-hidden");var n=Array.from(Array.isArray(e)?e:[e]),s=t||("u"{t.exports=e.r(976562)},266027,869230,469637,e=>{"use strict";let t;var r=e.i(175555),n=e.i(273911),s=e.i(540143),o=e.i(286491),i=e.i(915823),a=e.i(793803),l=e.i(619273),u=e.i(180166),c=class extends i.Subscribable{constructor(e,t){super(),this.options=t,this.#e=e,this.#t=null,this.#r=(0,a.pendingThenable)(),this.bindMethods(),this.setOptions(t)}#e;#n=void 0;#s=void 0;#o=void 0;#i;#a;#r;#t;#l;#u;#c;#d;#h;#p;#f=new Set;bindMethods(){this.refetch=this.refetch.bind(this)}onSubscribe(){1===this.listeners.size&&(this.#n.addObserver(this),d(this.#n,this.options)?this.#m():this.updateResult(),this.#g())}onUnsubscribe(){this.hasListeners()||this.destroy()}shouldFetchOnReconnect(){return h(this.#n,this.options,this.options.refetchOnReconnect)}shouldFetchOnWindowFocus(){return h(this.#n,this.options,this.options.refetchOnWindowFocus)}destroy(){this.listeners=new Set,this.#y(),this.#b(),this.#n.removeObserver(this)}setOptions(e){let t=this.options,r=this.#n;if(this.options=this.#e.defaultQueryOptions(e),void 0!==this.options.enabled&&"boolean"!=typeof this.options.enabled&&"function"!=typeof this.options.enabled&&"boolean"!=typeof(0,l.resolveQueryBoolean)(this.options.enabled,this.#n))throw Error("Expected enabled to be a boolean or a callback that returns a boolean");this.#v(),this.#n.setOptions(this.options),t._defaulted&&!(0,l.shallowEqualObjects)(this.options,t)&&this.#e.getQueryCache().notify({type:"observerOptionsUpdated",query:this.#n,observer:this});let n=this.hasListeners();n&&p(this.#n,r,this.options,t)&&this.#m(),this.updateResult(),n&&(this.#n!==r||(0,l.resolveQueryBoolean)(this.options.enabled,this.#n)!==(0,l.resolveQueryBoolean)(t.enabled,this.#n)||(0,l.resolveStaleTime)(this.options.staleTime,this.#n)!==(0,l.resolveStaleTime)(t.staleTime,this.#n))&&this.#C();let s=this.#R();n&&(this.#n!==r||(0,l.resolveQueryBoolean)(this.options.enabled,this.#n)!==(0,l.resolveQueryBoolean)(t.enabled,this.#n)||s!==this.#p)&&this.#S(s)}getOptimisticResult(e){var t,r;let n=this.#e.getQueryCache().build(this.#e,e),s=this.createResult(n,e);return t=this,r=s,(0,l.shallowEqualObjects)(t.getCurrentResult(),r)||(this.#o=s,this.#a=this.options,this.#i=this.#n.state),s}getCurrentResult(){return this.#o}trackResult(e,t){return new Proxy(e,{get:(e,r)=>(this.trackProp(r),t?.(r),"promise"===r&&(this.trackProp("data"),this.options.experimental_prefetchInRender||"pending"!==this.#r.status||this.#r.reject(Error("experimental_prefetchInRender feature flag is not enabled"))),Reflect.get(e,r))})}trackProp(e){this.#f.add(e)}getCurrentQuery(){return this.#n}refetch({...e}={}){return this.fetch({...e})}fetchOptimistic(e){let t=this.#e.defaultQueryOptions(e),r=this.#e.getQueryCache().build(this.#e,t);return r.fetch().then(()=>this.createResult(r,t))}fetch(e){return this.#m({...e,cancelRefetch:e.cancelRefetch??!0}).then(()=>(this.updateResult(),this.#o))}#m(e){this.#v();let t=this.#n.fetch(this.options,e);return e?.throwOnError||(t=t.catch(l.noop)),t}#C(){this.#y();let e=(0,l.resolveStaleTime)(this.options.staleTime,this.#n);if(n.environmentManager.isServer()||this.#o.isStale||!(0,l.isValidTimeout)(e))return;let t=(0,l.timeUntilStale)(this.#o.dataUpdatedAt,e);this.#d=u.timeoutManager.setTimeout(()=>{this.#o.isStale||this.updateResult()},t+1)}#R(){return("function"==typeof this.options.refetchInterval?this.options.refetchInterval(this.#n):this.options.refetchInterval)??!1}#S(e){this.#b(),this.#p=e,!n.environmentManager.isServer()&&!1!==(0,l.resolveQueryBoolean)(this.options.enabled,this.#n)&&(0,l.isValidTimeout)(this.#p)&&0!==this.#p&&(this.#h=u.timeoutManager.setInterval(()=>{(this.options.refetchIntervalInBackground||r.focusManager.isFocused())&&this.#m()},this.#p))}#g(){this.#C(),this.#S(this.#R())}#y(){void 0!==this.#d&&(u.timeoutManager.clearTimeout(this.#d),this.#d=void 0)}#b(){void 0!==this.#h&&(u.timeoutManager.clearInterval(this.#h),this.#h=void 0)}createResult(e,t){let r,n=this.#n,s=this.options,i=this.#o,u=this.#i,c=this.#a,h=e!==n?e.state:this.#s,{state:m}=e,g={...m},y=!1;if(t._optimisticResults){let r=this.hasListeners(),i=!r&&d(e,t),a=r&&p(e,n,t,s);(i||a)&&(g={...g,...(0,o.fetchState)(m.data,e.options)}),"isRestoring"===t._optimisticResults&&(g.fetchStatus="idle")}let{error:b,errorUpdatedAt:v,status:C}=g;r=g.data;let R=!1;if(void 0!==t.placeholderData&&void 0===r&&"pending"===C){let e;i?.isPlaceholderData&&t.placeholderData===c?.placeholderData?(e=i.data,R=!0):e="function"==typeof t.placeholderData?t.placeholderData(this.#c?.state.data,this.#c):t.placeholderData,void 0!==e&&(C="success",r=(0,l.replaceData)(i?.data,e,t),y=!0)}if(t.select&&void 0!==r&&!R)if(i&&r===u?.data&&t.select===this.#l)r=this.#u;else try{this.#l=t.select,r=t.select(r),r=(0,l.replaceData)(i?.data,r,t),this.#u=r,this.#t=null}catch(e){this.#t=e}this.#t&&(b=this.#t,r=this.#u,v=Date.now(),C="error");let S="fetching"===g.fetchStatus,O="pending"===C,w="error"===C,k=O&&S,I=void 0!==r,x={status:C,fetchStatus:g.fetchStatus,isPending:O,isSuccess:"success"===C,isError:w,isInitialLoading:k,isLoading:k,data:r,dataUpdatedAt:g.dataUpdatedAt,error:b,errorUpdatedAt:v,failureCount:g.fetchFailureCount,failureReason:g.fetchFailureReason,errorUpdateCount:g.errorUpdateCount,isFetched:e.isFetched(),isFetchedAfterMount:g.dataUpdateCount>h.dataUpdateCount||g.errorUpdateCount>h.errorUpdateCount,isFetching:S,isRefetching:S&&!O,isLoadingError:w&&!I,isPaused:"paused"===g.fetchStatus,isPlaceholderData:y,isRefetchError:w&&I,isStale:f(e,t),refetch:this.refetch,promise:this.#r,isEnabled:!1!==(0,l.resolveQueryBoolean)(t.enabled,e)};if(this.options.experimental_prefetchInRender){let t=void 0!==x.data,r="error"===x.status&&!t,s=e=>{r?e.reject(x.error):t&&e.resolve(x.data)},o=()=>{s(this.#r=x.promise=(0,a.pendingThenable)())},i=this.#r;switch(i.status){case"pending":e.queryHash===n.queryHash&&s(i);break;case"fulfilled":(r||x.data!==i.value)&&o();break;case"rejected":r&&x.error===i.reason||o()}}return x}updateResult(){let e=this.#o,t=this.createResult(this.#n,this.options);if(this.#i=this.#n.state,this.#a=this.options,void 0!==this.#i.data&&(this.#c=this.#n),(0,l.shallowEqualObjects)(t,e))return;this.#o=t;let r=()=>{if(!e)return!0;let{notifyOnChangeProps:t}=this.options,r="function"==typeof t?t():t;if("all"===r||!r&&!this.#f.size)return!0;let n=new Set(r??this.#f);return this.options.throwOnError&&n.add("error"),Object.keys(this.#o).some(t=>this.#o[t]!==e[t]&&n.has(t))};this.#O({listeners:r()})}#v(){let e=this.#e.getQueryCache().build(this.#e,this.options);if(e===this.#n)return;let t=this.#n;this.#n=e,this.#s=e.state,this.hasListeners()&&(t?.removeObserver(this),e.addObserver(this))}onQueryUpdate(){this.updateResult(),this.hasListeners()&&this.#g()}#O(e){s.notifyManager.batch(()=>{e.listeners&&this.listeners.forEach(e=>{e(this.#o)}),this.#e.getQueryCache().notify({query:this.#n,type:"observerResultsUpdated"})})}};function d(e,t){return!1!==(0,l.resolveQueryBoolean)(t.enabled,e)&&void 0===e.state.data&&("error"!==e.state.status||!1!==(0,l.resolveQueryBoolean)(t.retryOnMount,e))||void 0!==e.state.data&&h(e,t,t.refetchOnMount)}function h(e,t,r){if(!1!==(0,l.resolveQueryBoolean)(t.enabled,e)&&"static"!==(0,l.resolveStaleTime)(t.staleTime,e)){let n="function"==typeof r?r(e):r;return"always"===n||!1!==n&&f(e,t)}return!1}function p(e,t,r,n){return(e!==t||!1===(0,l.resolveQueryBoolean)(n.enabled,e))&&(!r.suspense||"error"!==e.state.status)&&f(e,r)}function f(e,t){return!1!==(0,l.resolveQueryBoolean)(t.enabled,e)&&e.isStaleByTime((0,l.resolveStaleTime)(t.staleTime,e))}e.s(["QueryObserver",0,c],869230),e.i(247167);var m=e.i(271645),g=e.i(912598);e.i(843476);var y=m.createContext((t=!1,{clearReset:()=>{t=!1},reset:()=>{t=!0},isReset:()=>t})),b=m.createContext(!1);b.Provider;var v=(e,t,r)=>t.fetchOptimistic(e).catch(()=>{r.clearReset()});function C(e,t,r){let o,i=m.useContext(b),a=m.useContext(y),u=(0,g.useQueryClient)(r),c=u.defaultQueryOptions(e);u.getDefaultOptions().queries?._experimental_beforeQuery?.(c);let d=u.getQueryCache().get(c.queryHash);if(c._optimisticResults=i?"isRestoring":"optimistic",c.suspense){let e=e=>"static"===e?e:Math.max(e??1e3,1e3),t=c.staleTime;c.staleTime="function"==typeof t?(...r)=>e(t(...r)):e(t),"number"==typeof c.gcTime&&(c.gcTime=Math.max(c.gcTime,1e3))}o=d?.state.error&&"function"==typeof c.throwOnError?(0,l.shouldThrowError)(c.throwOnError,[d.state.error,d]):c.throwOnError,(c.suspense||c.experimental_prefetchInRender||o)&&!a.isReset()&&(c.retryOnMount=!1),m.useEffect(()=>{a.clearReset()},[a]);let h=!u.getQueryCache().get(c.queryHash),[p]=m.useState(()=>new t(u,c)),f=p.getOptimisticResult(c),C=!i&&!1!==e.subscribed;if(m.useSyncExternalStore(m.useCallback(e=>{let t=C?p.subscribe(s.notifyManager.batchCalls(e)):l.noop;return p.updateResult(),t},[p,C]),()=>p.getCurrentResult(),()=>p.getCurrentResult()),m.useEffect(()=>{p.setOptions(c)},[c,p]),c?.suspense&&f.isPending)throw v(c,p,a);if((({result:e,errorResetBoundary:t,throwOnError:r,query:n,suspense:s})=>e.isError&&!t.isReset()&&!e.isFetching&&n&&(s&&void 0===e.data||(0,l.shouldThrowError)(r,[e.error,n])))({result:f,errorResetBoundary:a,throwOnError:c.throwOnError,query:d,suspense:c.suspense}))throw f.error;if(u.getDefaultOptions().queries?._experimental_afterQuery?.(c,f),c.experimental_prefetchInRender&&!n.environmentManager.isServer()&&f.isLoading&&f.isFetching&&!i){let e=h?v(c,p,a):d?.promise;e?.catch(l.noop).finally(()=>{p.updateResult()})}return c.notifyOnChangeProps?f:p.trackResult(f)}e.s(["useBaseQuery",0,C],469637),e.s(["useQuery",0,function(e,t){return C(e,c,t)}],266027)},612256,243652,e=>{"use strict";var t=e.i(602869),r=e.i(266027);function n(e){let t=[e];return{all:t,lists:()=>[...t,"list"],list:e=>[...t,"list",{params:e}],details:()=>[...t,"detail"],detail:e=>[...t,"detail",e]}}e.s(["createQueryKeys",0,n],243652);let s=n("uiConfig");e.s(["useUIConfig",0,()=>(0,r.useQuery)({queryKey:s.list({}),queryFn:async()=>await (0,t.getUiConfig)(),staleTime:864e5,gcTime:864e5})],612256)},321836,e=>{"use strict";let t="litellm_return_url",r="redirect_to";function n(){return window.location.href}function s(){if("u"typeof document&&(document.cookie=`${t}=; path=/; max-age=0`)}catch(e){console.error("Failed to clear return URL cookie:",e)}}function i(){return new URLSearchParams(window.location.search).get(r)}function a(){let e=window.location.hostname;return"localhost"===e||"127.0.0.1"===e||"::1"===e||e.startsWith("127.")||e.endsWith(".local")}function l(e){if(!e)return!1;if(e.startsWith("/")&&!e.startsWith("//"))return!0;try{let t=new URL(e),r=window.location.hostname;if(t.hostname!==r)return!1;if(a())return!0;return t.origin===window.location.origin}catch{return!1}}e.s(["buildLoginUrlWithReturn",0,function(e,t){let s=t||n();if(!s||s.includes("/login"))return e;let o=e.includes("?")?"&":"?";return`${e}${o}${r}=${encodeURIComponent(s)}`},"clearStoredReturnUrl",0,o,"consumeReturnUrl",0,function(){let e=i();if(e){if(l(e))return o(),e;a()&&console.warn("[returnUrlUtils] Invalid return URL in params rejected:",e)}let t=s();if(t){if(l(t))return o(),t;a()&&console.warn("[returnUrlUtils] Invalid return URL in cookie rejected:",t)}return null},"getReturnUrl",0,function(){let e=i();if(e)return e;let t=s();return t||null},"isValidReturnUrl",0,l,"normalizeUrlForCompare",0,function(e){try{let t=new URL(e,window.location.origin),r=t.pathname;r.length>1&&r.endsWith("/")&&(r=r.slice(0,-1));let n=new URLSearchParams(t.search),s=new URLSearchParams;Array.from(n.entries()).sort(([e],[t])=>e.localeCompare(t)).forEach(([e,t])=>{s.append(e,t)});let o=s.toString(),i=t.hash||"";return`${t.origin}${r}${o?`?${o}`:""}${i}`}catch{return e}},"storeReturnUrl",0,function(){let e=n();e&&function(e,t,r=300){if("u"{"use strict";var t=e.i(602869),r=e.i(268004),n=e.i(161281),s=e.i(321836),o=e.i(618566),i=e.i(271645),a=e.i(708347),l=e.i(612256);e.s(["default",0,()=>{let e=(0,o.useRouter)(),{data:u,isLoading:c}=(0,l.useUIConfig)(),d="u">typeof document?(0,r.getCookie)("token"):null,h=(0,i.useMemo)(()=>(0,n.decodeToken)(d),[d]),p=(0,i.useMemo)(()=>(0,n.checkTokenValidity)(d),[d])&&!u?.admin_ui_disabled,f=(0,i.useCallback)(()=>{(0,s.storeReturnUrl)();let r=`${(0,t.getProxyBaseUrl)()}/ui/login`,n=(0,s.buildLoginUrlWithReturn)(r);e.replace(n)},[e]);return(0,i.useEffect)(()=>{!c&&(p||(d&&(0,r.clearTokenCookies)(),f()))},[c,p,d,f]),{isLoading:c,isAuthorized:p,token:p?d:null,accessToken:h?.key??null,userId:h?.user_id??null,userEmail:h?.user_email??null,userRole:(0,a.formatUserRole)(h?.user_role),premiumUser:h?.premium_user??null,disabledPersonalKeyCreation:h?.disabled_non_admin_personal_key_creation??null,showSSOBanner:h?.login_method==="username_password"}}])},95779,e=>{"use strict";var t=e.i(480731);let r=[t.BaseColors.Blue,t.BaseColors.Cyan,t.BaseColors.Sky,t.BaseColors.Indigo,t.BaseColors.Violet,t.BaseColors.Purple,t.BaseColors.Fuchsia,t.BaseColors.Slate,t.BaseColors.Gray,t.BaseColors.Zinc,t.BaseColors.Neutral,t.BaseColors.Stone,t.BaseColors.Red,t.BaseColors.Orange,t.BaseColors.Amber,t.BaseColors.Yellow,t.BaseColors.Lime,t.BaseColors.Green,t.BaseColors.Emerald,t.BaseColors.Teal,t.BaseColors.Pink,t.BaseColors.Rose];e.s(["colorPalette",0,{canvasBackground:50,lightBackground:100,background:500,darkBackground:600,darkestBackground:800,lightBorder:200,border:500,darkBorder:700,lightRing:200,ring:300,iconRing:500,lightText:400,text:500,iconText:600,darkText:700,darkestText:900,icon:500},"themeColorRange",0,r])},563113,887719,e=>{"use strict";var t=e.i(271645),r=e.i(864517),n=e.i(244009),s=e.i(408850),o=e.i(87414);let i=function(...e){let t={};return e.forEach(e=>{e&&Object.keys(e).forEach(r=>{void 0!==e[r]&&(t[r]=e[r])})}),t};function a(e){let{closable:r,closeIcon:n}=e||{};return t.default.useMemo(()=>{if(!r&&(!1===r||!1===n||null===n))return!1;if(void 0===r&&void 0===n)return null;let e={closeIcon:"boolean"!=typeof n&&null!==n?n:void 0};return r&&"object"==typeof r&&(e=Object.assign(Object.assign({},e),r)),e},[r,n])}e.s(["default",0,i],887719);let l={};e.s(["pickClosable",0,function(e){if(!e)return;let{closable:t,closeIcon:r}=e;return{closable:t,closeIcon:r}},"useClosable",0,(e,u,c=l)=>{let d=a(e),h=a(u),[p]=(0,s.useLocale)("global",o.default.global),f="boolean"!=typeof d&&!!(null==d?void 0:d.disabled),m=t.default.useMemo(()=>Object.assign({closeIcon:t.default.createElement(r.default,null)},c),[c]),g=t.default.useMemo(()=>!1!==d&&(d?i(m,h,d):!1!==h&&(h?i(m,h):!!m.closable&&m)),[d,h,m]);return t.default.useMemo(()=>{var e,r;if(!1===g)return[!1,null,f,{}];let{closeIconRender:s}=m,{closeIcon:o}=g,i=o,a=(0,n.default)(g,!0);return null!=i&&(s&&(i=s(o)),i=t.default.isValidElement(i)?t.default.cloneElement(i,Object.assign(Object.assign(Object.assign({},i.props),{"aria-label":null!=(r=null==(e=i.props)?void 0:e["aria-label"])?r:p.close}),a)):t.default.createElement("span",Object.assign({"aria-label":p.close},a),i)),[!0,i,f,a]},[f,p.close,g,m])}],563113)},801312,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let n={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M724 218.3V141c0-6.7-7.7-10.4-12.9-6.3L260.3 486.8a31.86 31.86 0 000 50.3l450.8 352.1c5.3 4.1 12.9.4 12.9-6.3v-77.3c0-4.9-2.3-9.6-6.1-12.6l-360-281 360-281.1c3.8-3 6.1-7.7 6.1-12.6z"}}]},name:"left",theme:"outlined"};var s=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(s.default,(0,t.default)({},e,{ref:o,icon:n}))});e.s(["default",0,o],801312)},38243,908286,e=>{"use strict";e.i(247167);var t=e.i(271645),r=e.i(343794),n=e.i(876556);function s(e){return["small","middle","large"].includes(e)}function o(e){return!!e&&"number"==typeof e&&!Number.isNaN(e)}e.s(["isPresetSize",0,s,"isValidGapNumber",0,o],908286);var i=e.i(242064),a=e.i(249616),l=e.i(372409),u=e.i(246422);let c=(0,u.genStyleHooks)(["Space","Addon"],e=>[(e=>{let{componentCls:t,borderRadius:r,paddingSM:n,colorBorder:s,paddingXS:o,fontSizeLG:i,fontSizeSM:a,borderRadiusLG:u,borderRadiusSM:c,colorBgContainerDisabled:d,lineWidth:h}=e;return{[t]:[{display:"inline-flex",alignItems:"center",gap:0,paddingInline:n,margin:0,background:d,borderWidth:h,borderStyle:"solid",borderColor:s,borderRadius:r,"&-large":{fontSize:i,borderRadius:u},"&-small":{paddingInline:o,borderRadius:c,fontSize:a},"&-compact-last-item":{borderEndStartRadius:0,borderStartStartRadius:0},"&-compact-first-item":{borderEndEndRadius:0,borderStartEndRadius:0},"&-compact-item:not(:first-child):not(:last-child)":{borderRadius:0},"&-compact-item:not(:last-child)":{borderInlineEndWidth:0}},(0,l.genCompactItemStyle)(e,{focus:!1})]}})(e)]);var d=function(e,t){var r={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(r[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var s=0,n=Object.getOwnPropertySymbols(e);st.indexOf(n[s])&&Object.prototype.propertyIsEnumerable.call(e,n[s])&&(r[n[s]]=e[n[s]]);return r};let h=t.default.forwardRef((e,n)=>{let{className:s,children:o,style:l,prefixCls:u}=e,h=d(e,["className","children","style","prefixCls"]),{getPrefixCls:p,direction:f}=t.default.useContext(i.ConfigContext),m=p("space-addon",u),[g,y,b]=c(m),{compactItemClassnames:v,compactSize:C}=(0,a.useCompactItemContext)(m,f),R=(0,r.default)(m,y,v,b,{[`${m}-${C}`]:C},s);return g(t.default.createElement("div",Object.assign({ref:n,className:R,style:l},h),o))}),p=t.default.createContext({latestIndex:0}),f=p.Provider,m=({className:e,index:r,children:n,split:s,style:o})=>{let{latestIndex:i}=t.useContext(p);return null==n?null:t.createElement(t.Fragment,null,t.createElement("div",{className:e,style:o},n),r{let t=(0,g.mergeToken)(e,{spaceGapSmallSize:e.paddingXS,spaceGapMiddleSize:e.padding,spaceGapLargeSize:e.paddingLG});return[(e=>{let{componentCls:t,antCls:r}=e;return{[t]:{display:"inline-flex","&-rtl":{direction:"rtl"},"&-vertical":{flexDirection:"column"},"&-align":{flexDirection:"column","&-center":{alignItems:"center"},"&-start":{alignItems:"flex-start"},"&-end":{alignItems:"flex-end"},"&-baseline":{alignItems:"baseline"}},[`${t}-item:empty`]:{display:"none"},[`${t}-item > ${r}-badge-not-a-wrapper:only-child`]:{display:"block"}}}})(t),(e=>{let{componentCls:t}=e;return{[t]:{"&-gap-row-small":{rowGap:e.spaceGapSmallSize},"&-gap-row-middle":{rowGap:e.spaceGapMiddleSize},"&-gap-row-large":{rowGap:e.spaceGapLargeSize},"&-gap-col-small":{columnGap:e.spaceGapSmallSize},"&-gap-col-middle":{columnGap:e.spaceGapMiddleSize},"&-gap-col-large":{columnGap:e.spaceGapLargeSize}}}})(t)]},()=>({}),{resetStyle:!1});var b=function(e,t){var r={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(r[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var s=0,n=Object.getOwnPropertySymbols(e);st.indexOf(n[s])&&Object.prototype.propertyIsEnumerable.call(e,n[s])&&(r[n[s]]=e[n[s]]);return r};let v=t.forwardRef((e,a)=>{var l;let{getPrefixCls:u,direction:c,size:d,className:h,style:p,classNames:g,styles:v}=(0,i.useComponentConfig)("space"),{size:C=null!=d?d:"small",align:R,className:S,rootClassName:O,children:w,direction:k="horizontal",prefixCls:I,split:x,style:E,wrap:Q=!1,classNames:T,styles:$}=e,B=b(e,["size","align","className","rootClassName","children","direction","prefixCls","split","style","wrap","classNames","styles"]),[j,U]=Array.isArray(C)?C:[C,C],P=s(U),M=s(j),L=o(U),A=o(j),N=(0,n.default)(w,{keepEmpty:!0}),F=void 0===R&&"horizontal"===k?"center":R,_=u("space",I),[z,W,D]=y(_),G=(0,r.default)(_,h,W,`${_}-${k}`,{[`${_}-rtl`]:"rtl"===c,[`${_}-align-${F}`]:F,[`${_}-gap-row-${U}`]:P,[`${_}-gap-col-${j}`]:M},S,O,D),q=(0,r.default)(`${_}-item`,null!=(l=null==T?void 0:T.item)?l:g.item),H=Object.assign(Object.assign({},v.item),null==$?void 0:$.item),V=N.map((e,r)=>{let n=(null==e?void 0:e.key)||`${q}-${r}`;return t.createElement(m,{className:q,key:n,index:r,split:x,style:H},e)}),K=t.useMemo(()=>({latestIndex:N.reduce((e,t,r)=>null!=t?r:e,0)}),[N]);if(0===N.length)return null;let Z={};return Q&&(Z.flexWrap="wrap"),!M&&A&&(Z.columnGap=j),!P&&L&&(Z.rowGap=U),z(t.createElement("div",Object.assign({ref:a,className:G,style:Object.assign(Object.assign(Object.assign({},Z),p),E)},B),t.createElement(f,{value:K},V)))});v.Compact=a.default,v.Addon=h,e.s(["default",0,v],38243)},475254,e=>{"use strict";var t=e.i(271645);let r=e=>{let t=e.replace(/^([A-Z])|[\s-_]+(\w)/g,(e,t,r)=>r?r.toUpperCase():t.toLowerCase());return t.charAt(0).toUpperCase()+t.slice(1)},n=(...e)=>e.filter((e,t,r)=>!!e&&""!==e.trim()&&r.indexOf(e)===t).join(" ").trim();var s={xmlns:"http://www.w3.org/2000/svg",width:24,height:24,viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:2,strokeLinecap:"round",strokeLinejoin:"round"};let o=(0,t.forwardRef)(({color:e="currentColor",size:r=24,strokeWidth:o=2,absoluteStrokeWidth:i,className:a="",children:l,iconNode:u,...c},d)=>(0,t.createElement)("svg",{ref:d,...s,width:r,height:r,stroke:e,strokeWidth:i?24*Number(o)/Number(r):o,className:n("lucide",a),...!l&&!(e=>{for(let t in e)if(t.startsWith("aria-")||"role"===t||"title"===t)return!0})(c)&&{"aria-hidden":"true"},...c},[...u.map(([e,r])=>(0,t.createElement)(e,r)),...Array.isArray(l)?l:[l]]));e.s(["default",0,(e,s)=>{let i=(0,t.forwardRef)(({className:i,...a},l)=>(0,t.createElement)(o,{ref:l,iconNode:s,className:n(`lucide-${r(e).replace(/([a-z0-9])([A-Z])/g,"$1-$2").toLowerCase()}`,`lucide-${e}`,i),...a}));return i.displayName=r(e),i}],475254)},262218,e=>{"use strict";e.i(247167);var t=e.i(271645),r=e.i(343794),n=e.i(529681),s=e.i(702779),o=e.i(563113),i=e.i(763731),a=e.i(121872),l=e.i(242064);e.i(296059);var u=e.i(915654),c=e.i(135551),d=e.i(183293),h=e.i(246422),p=e.i(838378);let f=e=>{let{lineWidth:t,fontSizeIcon:r,calc:n}=e,s=e.fontSizeSM;return(0,p.mergeToken)(e,{tagFontSize:s,tagLineHeight:(0,u.unit)(n(e.lineHeightSM).mul(s).equal()),tagIconSize:n(r).sub(n(t).mul(2)).equal(),tagPaddingHorizontal:8,tagBorderlessBg:e.defaultBg})},m=e=>({defaultBg:new c.FastColor(e.colorFillQuaternary).onBackground(e.colorBgContainer).toHexString(),defaultColor:e.colorText}),g=(0,h.genStyleHooks)("Tag",e=>(e=>{let{paddingXXS:t,lineWidth:r,tagPaddingHorizontal:n,componentCls:s,calc:o}=e,i=o(n).sub(r).equal(),a=o(t).sub(r).equal();return{[s]:Object.assign(Object.assign({},(0,d.resetComponent)(e)),{display:"inline-block",height:"auto",marginInlineEnd:e.marginXS,paddingInline:i,fontSize:e.tagFontSize,lineHeight:e.tagLineHeight,whiteSpace:"nowrap",background:e.defaultBg,border:`${(0,u.unit)(e.lineWidth)} ${e.lineType} ${e.colorBorder}`,borderRadius:e.borderRadiusSM,opacity:1,transition:`all ${e.motionDurationMid}`,textAlign:"start",position:"relative",[`&${s}-rtl`]:{direction:"rtl"},"&, a, a:hover":{color:e.defaultColor},[`${s}-close-icon`]:{marginInlineStart:a,fontSize:e.tagIconSize,color:e.colorIcon,cursor:"pointer",transition:`all ${e.motionDurationMid}`,"&:hover":{color:e.colorTextHeading}},[`&${s}-has-color`]:{borderColor:"transparent",[`&, a, a:hover, ${e.iconCls}-close, ${e.iconCls}-close:hover`]:{color:e.colorTextLightSolid}},"&-checkable":{backgroundColor:"transparent",borderColor:"transparent",cursor:"pointer",[`&:not(${s}-checkable-checked):hover`]:{color:e.colorPrimary,backgroundColor:e.colorFillSecondary},"&:active, &-checked":{color:e.colorTextLightSolid},"&-checked":{backgroundColor:e.colorPrimary,"&:hover":{backgroundColor:e.colorPrimaryHover}},"&:active":{backgroundColor:e.colorPrimaryActive}},"&-hidden":{display:"none"},[`> ${e.iconCls} + span, > span + ${e.iconCls}`]:{marginInlineStart:i}}),[`${s}-borderless`]:{borderColor:"transparent",background:e.tagBorderlessBg}}})(f(e)),m);var y=function(e,t){var r={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(r[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var s=0,n=Object.getOwnPropertySymbols(e);st.indexOf(n[s])&&Object.prototype.propertyIsEnumerable.call(e,n[s])&&(r[n[s]]=e[n[s]]);return r};let b=t.forwardRef((e,n)=>{let{prefixCls:s,style:o,className:i,checked:a,children:u,icon:c,onChange:d,onClick:h}=e,p=y(e,["prefixCls","style","className","checked","children","icon","onChange","onClick"]),{getPrefixCls:f,tag:m}=t.useContext(l.ConfigContext),b=f("tag",s),[v,C,R]=g(b),S=(0,r.default)(b,`${b}-checkable`,{[`${b}-checkable-checked`]:a},null==m?void 0:m.className,i,C,R);return v(t.createElement("span",Object.assign({},p,{ref:n,style:Object.assign(Object.assign({},o),null==m?void 0:m.style),className:S,onClick:e=>{null==d||d(!a),null==h||h(e)}}),c,t.createElement("span",null,u)))});var v=e.i(403541);let C=(0,h.genSubStyleComponent)(["Tag","preset"],e=>{let t;return t=f(e),(0,v.genPresetColor)(t,(e,{textColor:r,lightBorderColor:n,lightColor:s,darkColor:o})=>({[`${t.componentCls}${t.componentCls}-${e}`]:{color:r,background:s,borderColor:n,"&-inverse":{color:t.colorTextLightSolid,background:o,borderColor:o},[`&${t.componentCls}-borderless`]:{borderColor:"transparent"}}}))},m),R=(e,t,r)=>{let n="string"!=typeof r?r:r.charAt(0).toUpperCase()+r.slice(1);return{[`${e.componentCls}${e.componentCls}-${t}`]:{color:e[`color${r}`],background:e[`color${n}Bg`],borderColor:e[`color${n}Border`],[`&${e.componentCls}-borderless`]:{borderColor:"transparent"}}}},S=(0,h.genSubStyleComponent)(["Tag","status"],e=>{let t=f(e);return[R(t,"success","Success"),R(t,"processing","Info"),R(t,"error","Error"),R(t,"warning","Warning")]},m);var O=function(e,t){var r={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(r[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var s=0,n=Object.getOwnPropertySymbols(e);st.indexOf(n[s])&&Object.prototype.propertyIsEnumerable.call(e,n[s])&&(r[n[s]]=e[n[s]]);return r};let w=t.forwardRef((e,u)=>{let{prefixCls:c,className:d,rootClassName:h,style:p,children:f,icon:m,color:y,onClose:b,bordered:v=!0,visible:R}=e,w=O(e,["prefixCls","className","rootClassName","style","children","icon","color","onClose","bordered","visible"]),{getPrefixCls:k,direction:I,tag:x}=t.useContext(l.ConfigContext),[E,Q]=t.useState(!0),T=(0,n.default)(w,["closeIcon","closable"]);t.useEffect(()=>{void 0!==R&&Q(R)},[R]);let $=(0,s.isPresetColor)(y),B=(0,s.isPresetStatusColor)(y),j=$||B,U=Object.assign(Object.assign({backgroundColor:y&&!j?y:void 0},null==x?void 0:x.style),p),P=k("tag",c),[M,L,A]=g(P),N=(0,r.default)(P,null==x?void 0:x.className,{[`${P}-${y}`]:j,[`${P}-has-color`]:y&&!j,[`${P}-hidden`]:!E,[`${P}-rtl`]:"rtl"===I,[`${P}-borderless`]:!v},d,h,L,A),F=e=>{e.stopPropagation(),null==b||b(e),e.defaultPrevented||Q(!1)},[,_]=(0,o.useClosable)((0,o.pickClosable)(e),(0,o.pickClosable)(x),{closable:!1,closeIconRender:e=>{let n=t.createElement("span",{className:`${P}-close-icon`,onClick:F},e);return(0,i.replaceElement)(e,n,e=>({onClick:t=>{var r;null==(r=null==e?void 0:e.onClick)||r.call(e,t),F(t)},className:(0,r.default)(null==e?void 0:e.className,`${P}-close-icon`)}))}}),z="function"==typeof w.onClick||f&&"a"===f.type,W=m||null,D=W?t.createElement(t.Fragment,null,W,f&&t.createElement("span",null,f)):f,G=t.createElement("span",Object.assign({},T,{ref:u,className:N,style:U}),D,_,$&&t.createElement(C,{key:"preset",prefixCls:P}),B&&t.createElement(S,{key:"status",prefixCls:P}));return M(z?t.createElement(a.default,{component:"Tag"},G):G)});w.CheckableTag=b,e.s(["Tag",0,w],262218)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/0-s2am3eulbyd.js b/litellm/proxy/_experimental/out/_next/static/chunks/0-s2am3eulbyd.js deleted file mode 100644 index d5b9e0099b9..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/0-s2am3eulbyd.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,250980,e=>{"use strict";var t=e.i(271645);let l=t.forwardRef(function(e,l){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:l},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M12 9v3m0 0v3m0-3h3m-3 0H9m12 0a9 9 0 11-18 0 9 9 0 0118 0z"}))});e.s(["PlusCircleIcon",0,l],250980)},309426,e=>{"use strict";var t=e.i(290571),l=e.i(444755),s=e.i(673706),r=e.i(271645),a=e.i(46757);let n=(0,s.makeClassName)("Col"),i=r.default.forwardRef((e,s)=>{let i,o,c,d,{numColSpan:u=1,numColSpanSm:m,numColSpanMd:g,numColSpanLg:p,children:h,className:x}=e,f=(0,t.__rest)(e,["numColSpan","numColSpanSm","numColSpanMd","numColSpanLg","children","className"]),y=(e,t)=>e&&Object.keys(t).includes(String(e))?t[e]:"";return r.default.createElement("div",Object.assign({ref:s,className:(0,l.tremorTwMerge)(n("root"),(i=y(u,a.colSpan),o=y(m,a.colSpanSm),c=y(g,a.colSpanMd),d=y(p,a.colSpanLg),(0,l.tremorTwMerge)(i,o,c,d)),x)},f),h)});i.displayName="Col",e.s(["Col",0,i],309426)},435451,e=>{"use strict";var t=e.i(843476),l=e.i(290571),s=e.i(271645);let r=e=>{var t=(0,l.__rest)(e,[]);return s.default.createElement("svg",Object.assign({},t,{xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",strokeWidth:"2.5"}),s.default.createElement("path",{d:"M12 4v16m8-8H4"}))},a=e=>{var t=(0,l.__rest)(e,[]);return s.default.createElement("svg",Object.assign({},t,{xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",strokeWidth:"2.5"}),s.default.createElement("path",{d:"M20 12H4"}))};var n=e.i(444755),i=e.i(673706),o=e.i(677955);let c="flex mx-auto text-tremor-content-subtle dark:text-dark-tremor-content-subtle",d="cursor-pointer hover:text-tremor-content dark:hover:text-dark-tremor-content",u=s.default.forwardRef((e,t)=>{let{onSubmit:u,enableStepper:m=!0,disabled:g,onValueChange:p,onChange:h}=e,x=(0,l.__rest)(e,["onSubmit","enableStepper","disabled","onValueChange","onChange"]),f=(0,s.useRef)(null),[y,b]=s.default.useState(!1),v=s.default.useCallback(()=>{b(!0)},[]),w=s.default.useCallback(()=>{b(!1)},[]),[j,N]=s.default.useState(!1),S=s.default.useCallback(()=>{N(!0)},[]),k=s.default.useCallback(()=>{N(!1)},[]);return s.default.createElement(o.default,Object.assign({type:"number",ref:(0,i.mergeRefs)([f,t]),disabled:g,makeInputClassName:(0,i.makeClassName)("NumberInput"),onKeyDown:e=>{var t;if("Enter"===e.key&&!e.ctrlKey&&!e.altKey&&!e.shiftKey){let e=null==(t=f.current)?void 0:t.value;null==u||u(parseFloat(null!=e?e:""))}"ArrowDown"===e.key&&v(),"ArrowUp"===e.key&&S()},onKeyUp:e=>{"ArrowDown"===e.key&&w(),"ArrowUp"===e.key&&k()},onChange:e=>{g||(null==p||p(parseFloat(e.target.value)),null==h||h(e))},stepper:m?s.default.createElement("div",{className:(0,n.tremorTwMerge)("flex justify-center align-middle")},s.default.createElement("div",{tabIndex:-1,onClick:e=>e.preventDefault(),onMouseDown:e=>e.preventDefault(),onTouchStart:e=>{e.cancelable&&e.preventDefault()},onMouseUp:()=>{var e,t;g||(null==(e=f.current)||e.stepDown(),null==(t=f.current)||t.dispatchEvent(new Event("input",{bubbles:!0})))},className:(0,n.tremorTwMerge)(!g&&d,c,"group py-[10px] px-2.5 border-l border-tremor-border dark:border-dark-tremor-border")},s.default.createElement(a,{"data-testid":"step-down",className:(y?"scale-95":"")+" h-4 w-4 duration-75 transition group-active:scale-95"})),s.default.createElement("div",{tabIndex:-1,onClick:e=>e.preventDefault(),onMouseDown:e=>e.preventDefault(),onTouchStart:e=>{e.cancelable&&e.preventDefault()},onMouseUp:()=>{var e,t;g||(null==(e=f.current)||e.stepUp(),null==(t=f.current)||t.dispatchEvent(new Event("input",{bubbles:!0})))},className:(0,n.tremorTwMerge)(!g&&d,c,"group py-[10px] px-2.5 border-l border-tremor-border dark:border-dark-tremor-border")},s.default.createElement(r,{"data-testid":"step-up",className:(j?"scale-95":"")+" h-4 w-4 duration-75 transition group-active:scale-95"}))):null},x))});u.displayName="NumberInput",e.s(["default",0,({step:e=.01,style:l={width:"100%"},placeholder:s="Enter a numerical value",min:r,max:a,onChange:n,...i})=>(0,t.jsx)(u,{onWheel:e=>e.currentTarget.blur(),step:e,style:l,placeholder:s,min:r,max:a,onChange:n,...i})],435451)},860585,e=>{"use strict";var t=e.i(843476),l=e.i(199133);let{Option:s}=l.Select;e.s(["default",0,({value:e,onChange:r,className:a="",style:n={}})=>(0,t.jsxs)(l.Select,{style:{width:"100%",...n},value:e||void 0,onChange:r,className:a,placeholder:"n/a",allowClear:!0,children:[(0,t.jsx)(s,{value:"1h",children:"hourly"}),(0,t.jsx)(s,{value:"24h",children:"daily"}),(0,t.jsx)(s,{value:"7d",children:"weekly"}),(0,t.jsx)(s,{value:"30d",children:"monthly"})]}),"getBudgetDurationLabel",0,e=>e?({"1h":"hourly","24h":"daily","7d":"weekly","30d":"monthly"})[e]||e:"Not set"])},213205,e=>{"use strict";e.i(247167);var t=e.i(931067),l=e.i(271645);let s={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M678.3 642.4c24.2-13 51.9-20.4 81.4-20.4h.1c3 0 4.4-3.6 2.2-5.6a371.67 371.67 0 00-103.7-65.8c-.4-.2-.8-.3-1.2-.5C719.2 505 759.6 431.7 759.6 349c0-137-110.8-248-247.5-248S264.7 212 264.7 349c0 82.7 40.4 156 102.6 201.1-.4.2-.8.3-1.2.5-44.7 18.9-84.8 46-119.3 80.6a373.42 373.42 0 00-80.4 119.5A373.6 373.6 0 00137 888.8a8 8 0 008 8.2h59.9c4.3 0 7.9-3.5 8-7.8 2-77.2 32.9-149.5 87.6-204.3C357 628.2 432.2 597 512.2 597c56.7 0 111.1 15.7 158 45.1a8.1 8.1 0 008.1.3zM512.2 521c-45.8 0-88.9-17.9-121.4-50.4A171.2 171.2 0 01340.5 349c0-45.9 17.9-89.1 50.3-121.6S466.3 177 512.2 177s88.9 17.9 121.4 50.4A171.2 171.2 0 01683.9 349c0 45.9-17.9 89.1-50.3 121.6C601.1 503.1 558 521 512.2 521zM880 759h-84v-84c0-4.4-3.6-8-8-8h-56c-4.4 0-8 3.6-8 8v84h-84c-4.4 0-8 3.6-8 8v56c0 4.4 3.6 8 8 8h84v84c0 4.4 3.6 8 8 8h56c4.4 0 8-3.6 8-8v-84h84c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8z"}}]},name:"user-add",theme:"outlined"};var r=e.i(9583),a=l.forwardRef(function(e,a){return l.createElement(r.default,(0,t.default)({},e,{ref:a,icon:s}))});e.s(["UserAddOutlined",0,a],213205)},355619,e=>{"use strict";var t=e.i(602869);let l=async(e,l,s)=>{try{if(null===e||null===l)return;if(null!==s){let r=(await (0,t.modelAvailableCall)(s,e,l,!0,null,!0)).data.map(e=>e.id),a=[],n=[];return r.forEach(e=>{e.endsWith("/*")?a.push(e):n.push(e)}),[...a,...n]}}catch(e){console.error("Error fetching user models:",e)}};e.s(["fetchAvailableModelsForTeamOrKey",0,l,"getModelDisplayName",0,e=>{if("all-proxy-models"===e)return"All Proxy Models";if(e.endsWith("/*")){let t=e.replace("/*","");return`All ${t} models`}return e},"unfurlWildcardModelsInList",0,(e,t)=>{let l=[],s=[];return e.forEach(e=>{if(e.endsWith("/*")){let r=e.replace("/*",""),a=t.filter(e=>e.startsWith(r+"/"));s.push(...a),l.push(e)}else s.push(e)}),[...l,...s].filter((e,t,l)=>l.indexOf(e)===t)}])},350967,46757,e=>{"use strict";var t=e.i(290571),l=e.i(444755),s=e.i(673706),r=e.i(271645);let a={0:"grid-cols-none",1:"grid-cols-1",2:"grid-cols-2",3:"grid-cols-3",4:"grid-cols-4",5:"grid-cols-5",6:"grid-cols-6",7:"grid-cols-7",8:"grid-cols-8",9:"grid-cols-9",10:"grid-cols-10",11:"grid-cols-11",12:"grid-cols-12"},n={0:"sm:grid-cols-none",1:"sm:grid-cols-1",2:"sm:grid-cols-2",3:"sm:grid-cols-3",4:"sm:grid-cols-4",5:"sm:grid-cols-5",6:"sm:grid-cols-6",7:"sm:grid-cols-7",8:"sm:grid-cols-8",9:"sm:grid-cols-9",10:"sm:grid-cols-10",11:"sm:grid-cols-11",12:"sm:grid-cols-12"},i={0:"md:grid-cols-none",1:"md:grid-cols-1",2:"md:grid-cols-2",3:"md:grid-cols-3",4:"md:grid-cols-4",5:"md:grid-cols-5",6:"md:grid-cols-6",7:"md:grid-cols-7",8:"md:grid-cols-8",9:"md:grid-cols-9",10:"md:grid-cols-10",11:"md:grid-cols-11",12:"md:grid-cols-12"},o={0:"lg:grid-cols-none",1:"lg:grid-cols-1",2:"lg:grid-cols-2",3:"lg:grid-cols-3",4:"lg:grid-cols-4",5:"lg:grid-cols-5",6:"lg:grid-cols-6",7:"lg:grid-cols-7",8:"lg:grid-cols-8",9:"lg:grid-cols-9",10:"lg:grid-cols-10",11:"lg:grid-cols-11",12:"lg:grid-cols-12"};e.s(["colSpan",0,{1:"col-span-1",2:"col-span-2",3:"col-span-3",4:"col-span-4",5:"col-span-5",6:"col-span-6",7:"col-span-7",8:"col-span-8",9:"col-span-9",10:"col-span-10",11:"col-span-11",12:"col-span-12",13:"col-span-13"},"colSpanLg",0,{1:"lg:col-span-1",2:"lg:col-span-2",3:"lg:col-span-3",4:"lg:col-span-4",5:"lg:col-span-5",6:"lg:col-span-6",7:"lg:col-span-7",8:"lg:col-span-8",9:"lg:col-span-9",10:"lg:col-span-10",11:"lg:col-span-11",12:"lg:col-span-12",13:"lg:col-span-13"},"colSpanMd",0,{1:"md:col-span-1",2:"md:col-span-2",3:"md:col-span-3",4:"md:col-span-4",5:"md:col-span-5",6:"md:col-span-6",7:"md:col-span-7",8:"md:col-span-8",9:"md:col-span-9",10:"md:col-span-10",11:"md:col-span-11",12:"md:col-span-12",13:"md:col-span-13"},"colSpanSm",0,{1:"sm:col-span-1",2:"sm:col-span-2",3:"sm:col-span-3",4:"sm:col-span-4",5:"sm:col-span-5",6:"sm:col-span-6",7:"sm:col-span-7",8:"sm:col-span-8",9:"sm:col-span-9",10:"sm:col-span-10",11:"sm:col-span-11",12:"sm:col-span-12",13:"sm:col-span-13"},"gridCols",0,a,"gridColsLg",0,o,"gridColsMd",0,i,"gridColsSm",0,n],46757);let c=(0,s.makeClassName)("Grid"),d=(e,t)=>e&&Object.keys(t).includes(String(e))?t[e]:"",u=r.default.forwardRef((e,s)=>{let{numItems:u=1,numItemsSm:m,numItemsMd:g,numItemsLg:p,children:h,className:x}=e,f=(0,t.__rest)(e,["numItems","numItemsSm","numItemsMd","numItemsLg","children","className"]),y=d(u,a),b=d(m,n),v=d(g,i),w=d(p,o),j=(0,l.tremorTwMerge)(y,b,v,w);return r.default.createElement("div",Object.assign({ref:s,className:(0,l.tremorTwMerge)(c("root"),"grid",j,x)},f),h)});u.displayName="Grid",e.s(["Grid",0,u],350967)},981339,e=>{"use strict";var t=e.i(185793);e.s(["Skeleton",()=>t.default])},500727,e=>{"use strict";var t=e.i(266027),l=e.i(243652),s=e.i(602869),r=e.i(135214);let a=(0,l.createQueryKeys)("mcpServers");e.s(["useMCPServers",0,e=>{let{accessToken:l}=(0,r.default)();return(0,t.useQuery)({queryKey:a.list(e?{filters:{teamId:e}}:void 0),queryFn:async()=>await (0,s.fetchMCPServers)(l,e),enabled:!!l})}])},699857,e=>{"use strict";var t=e.i(266027),l=e.i(243652),s=e.i(602869),r=e.i(135214);let a=(0,l.createQueryKeys)("mcpToolsets");e.s(["useMCPToolsets",0,()=>{let{accessToken:e}=(0,r.default)();return(0,t.useQuery)({queryKey:a.list(),queryFn:async()=>await (0,s.fetchMCPToolsets)(e),enabled:!!e})}])},916940,e=>{"use strict";var t=e.i(843476),l=e.i(271645),s=e.i(199133),r=e.i(602869);e.s(["default",0,({onChange:e,value:a,className:n,accessToken:i,placeholder:o="Select vector stores",disabled:c=!1})=>{let[d,u]=(0,l.useState)([]),[m,g]=(0,l.useState)(!1);return(0,l.useEffect)(()=>{(async()=>{if(i){g(!0);try{let e=await (0,r.vectorStoreListCall)(i);e.data&&u(e.data)}catch(e){console.error("Error fetching vector stores:",e)}finally{g(!1)}}})()},[i]),(0,t.jsx)("div",{children:(0,t.jsx)(s.Select,{mode:"multiple",placeholder:o,onChange:e,value:a,loading:m,className:n,allowClear:!0,options:d.map(e=>({label:`${e.vector_store_name||e.vector_store_id} (${e.vector_store_id})`,value:e.vector_store_id,title:e.vector_store_description||e.vector_store_id})),optionFilterProp:"label",showSearch:!0,style:{width:"100%"},disabled:c})})}])},75921,e=>{"use strict";var t=e.i(843476),l=e.i(266027),s=e.i(243652),r=e.i(602869),a=e.i(135214);let n=(0,s.createQueryKeys)("mcpAccessGroups");var i=e.i(500727),o=e.i(699857),c=e.i(199133),d=e.i(234713);let u="toolset:";e.s(["default",0,({onChange:e,value:s,className:m,accessToken:g,placeholder:p="Select MCP servers",disabled:h=!1,teamId:x,allowNoMcpServers:f=!1,allowAllProxyMcpServers:y=!1})=>{let{data:b=[],isLoading:v}=(0,i.useMCPServers)(x),{data:w=[],isLoading:j}=(()=>{let{accessToken:e}=(0,a.default)();return(0,l.useQuery)({queryKey:n.list({}),queryFn:async()=>await (0,r.fetchMCPAccessGroups)(e),enabled:!!e})})(),{data:N=[],isLoading:S}=(0,o.useMCPToolsets)(),k=new Set(w),C=[...w.map(e=>({label:e,value:e,type:"accessGroup",searchText:`${e} Access Group`})),...b.map(e=>({label:`${e.server_name||e.server_id} (${e.server_id})`,value:e.server_id,type:"server",searchText:`${e.server_name||e.server_id} ${e.server_id} MCP Server`})),...N.map(e=>({label:e.toolset_name,value:`${u}${e.toolset_id}`,type:"toolset",searchText:`${e.toolset_name} ${e.toolset_id} Toolset`}))],_={accessGroup:"#52c41a",server:"#1890ff",toolset:"#722ed1"},M={accessGroup:"Access Group",server:"MCP Server",toolset:"Toolset"},E=[...s?.servers||[],...s?.accessGroups||[],...(s?.toolsets||[]).map(e=>`${u}${e}`)],L=f&&E.includes(d.NO_MCP_SERVERS_SENTINEL),R=E.includes(d.ALL_PROXY_MCP_SERVERS_SENTINEL);return(0,t.jsx)("div",{children:(0,t.jsxs)(c.Select,{mode:"multiple",placeholder:p,onChange:t=>{if(y&&t.includes(d.ALL_PROXY_MCP_SERVERS_SENTINEL))return void e({servers:[d.ALL_PROXY_MCP_SERVERS_SENTINEL],accessGroups:[],toolsets:[]});if(f&&t.includes(d.NO_MCP_SERVERS_SENTINEL))return void e({servers:[d.NO_MCP_SERVERS_SENTINEL],accessGroups:[],toolsets:[]});let l=t.filter(e=>e.startsWith(u)).map(e=>e.slice(u.length)),s=t.filter(e=>!e.startsWith(u));e({servers:s.filter(e=>!k.has(e)),accessGroups:s.filter(e=>k.has(e)),toolsets:l})},value:E,loading:v||j||S,className:m,allowClear:!0,showSearch:!0,style:{width:"100%"},disabled:h,filterOption:(e,t)=>t?.value===d.NO_MCP_SERVERS_SENTINEL||t?.value===d.ALL_PROXY_MCP_SERVERS_SENTINEL||(C.find(e=>e.value===t?.value)?.searchText||"").toLowerCase().includes(e.toLowerCase()),children:[(y||R)&&(0,t.jsx)(c.Select.Option,{value:d.ALL_PROXY_MCP_SERVERS_SENTINEL,label:"All Proxy MCP Servers",children:(0,t.jsx)("span",{style:{color:"#1890ff",fontWeight:500},children:"All Proxy MCP Servers"})},d.ALL_PROXY_MCP_SERVERS_SENTINEL),f&&(0,t.jsx)(c.Select.Option,{value:d.NO_MCP_SERVERS_SENTINEL,label:"No MCP Servers",children:(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,t.jsx)("span",{style:{flex:1},children:"No MCP Servers"}),(0,t.jsx)("span",{style:{color:"#8c8c8c",fontSize:"12px",fontWeight:500,opacity:.8},children:"Block all"})]})},d.NO_MCP_SERVERS_SENTINEL),C.map(e=>(0,t.jsx)(c.Select.Option,{value:e.value,label:e.label,disabled:L||R,children:(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,t.jsx)("span",{style:{display:"inline-block",width:8,height:8,borderRadius:"50%",background:_[e.type],flexShrink:0}}),(0,t.jsx)("span",{style:{flex:1},children:e.label}),(0,t.jsx)("span",{style:{color:_[e.type],fontSize:"12px",fontWeight:500,opacity:.8},children:M[e.type]})]})},e.value))]})})}],75921)},988297,e=>{"use strict";var t=e.i(271645);let l=t.forwardRef(function(e,l){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:l},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M12 4v16m8-8H4"}))});e.s(["PlusIcon",0,l],988297)},246349,e=>{"use strict";let t=(0,e.i(475254).default)("chevron-right",[["path",{d:"m9 18 6-6-6-6",key:"mthhwq"}]]);e.s(["default",0,t])},797672,e=>{"use strict";var t=e.i(271645);let l=t.forwardRef(function(e,l){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:l},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z"}))});e.s(["PencilIcon",0,l],797672)},992619,e=>{"use strict";var t=e.i(843476),l=e.i(271645),s=e.i(779241),r=e.i(599724),a=e.i(199133),n=e.i(983561),i=e.i(695411);e.s(["default",0,({accessToken:e,value:o,placeholder:c="Select a Model",onChange:d,disabled:u=!1,style:m,className:g,showLabel:p=!0,labelText:h="Select Model"})=>{let[x,f]=(0,l.useState)(o),[y,b]=(0,l.useState)(!1),[v,w]=(0,l.useState)([]),j=(0,l.useRef)(null);return(0,l.useEffect)(()=>{f(o)},[o]),(0,l.useEffect)(()=>{e&&(async()=>{try{let t=await (0,i.fetchAvailableModels)(e);t.length>0&&w(t)}catch(e){console.error("Error fetching model info:",e)}})()},[e]),(0,t.jsxs)("div",{children:[p&&(0,t.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(n.RobotOutlined,{className:"mr-2"})," ",h]}),(0,t.jsx)(a.Select,{value:x,placeholder:c,onChange:e=>{"custom"===e?(b(!0),f(void 0)):(b(!1),f(e),d&&d(e))},options:[...Array.from(new Set(v.map(e=>e.model_group))).map((e,t)=>({value:e,label:e,key:t})),{value:"custom",label:"Enter custom model",key:"custom"}],style:{width:"100%",...m},showSearch:!0,className:`rounded-md ${g||""}`,disabled:u}),y&&(0,t.jsx)(s.TextInput,{className:"mt-2",placeholder:"Enter custom model name",onValueChange:e=>{j.current&&clearTimeout(j.current),j.current=setTimeout(()=>{f(e),d&&d(e)},500)},disabled:u})]})}])},361653,e=>{"use strict";let t=(0,e.i(475254).default)("circle-alert",[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["line",{x1:"12",x2:"12",y1:"8",y2:"12",key:"1pkeuh"}],["line",{x1:"12",x2:"12.01",y1:"16",y2:"16",key:"4dfq90"}]]);e.s(["default",0,t])},409797,e=>{"use strict";var t=e.i(631171);e.s(["ChevronDownIcon",()=>t.default])},531516,696609,e=>{"use strict";var t=e.i(843476),l=e.i(271645),s=e.i(536916),r=e.i(599724),a=e.i(409797),n=e.i(246349),n=n;let i=/\b(delete|remove|destroy|purge|drop|erase|unlink)\b/i,o=/\b(create|add|insert|new|post|submit|register|make|generate|write|upload)\b/i,c=/\b(update|edit|modify|change|patch|put|set|rename|move|transform)\b/i,d=/\b(get|read|list|fetch|search|find|query|retrieve|show|view|check|describe|info)\b/i;function u(e,t=""){let l=e.toLowerCase();if(d.test(l))return"read";if(i.test(l))return"delete";if(c.test(l))return"update";if(o.test(l))return"create";if(t){let e=t.toLowerCase();if(d.test(e))return"read";if(i.test(e))return"delete";if(c.test(e))return"update";if(o.test(e))return"create"}return"unknown"}function m(e){let t={read:[],create:[],update:[],delete:[],unknown:[]};for(let l of e)t[u(l.name,l.description)].push(l);return t}let g={read:{label:"Read",description:"Safe operations — fetch, list, search. No side effects.",risk:"low"},create:{label:"Create",description:"Add new resources — insert, upload, register.",risk:"medium"},update:{label:"Update",description:"Modify existing resources — edit, patch, rename.",risk:"medium"},delete:{label:"Delete",description:"Destructive operations — remove, purge, destroy.",risk:"high"},unknown:{label:"Other",description:"Operations that could not be automatically classified.",risk:"unknown"}};e.s(["CRUD_GROUP_META",0,g,"classifyToolOp",0,u,"groupToolsByCrud",0,m],696609);let p=["read","create","update","delete","unknown"],h={low:"bg-green-100 text-green-800",medium:"bg-yellow-100 text-yellow-800",high:"bg-red-100 text-red-800 font-semibold",unknown:"bg-gray-100 text-gray-700"},x={read:"border-green-200",create:"border-blue-200",update:"border-yellow-200",delete:"border-red-300",unknown:"border-gray-200"},f={read:"bg-green-50",create:"bg-blue-50",update:"bg-yellow-50",delete:"bg-red-50",unknown:"bg-gray-50"};e.s(["default",0,({tools:e,value:i,onChange:o,readOnly:c=!1,searchFilter:d=""})=>{let[u,y]=(0,l.useState)({read:!1,create:!1,update:!1,delete:!1,unknown:!0}),b=(0,l.useMemo)(()=>m(e),[e]),v=(0,l.useMemo)(()=>new Set(void 0===i?e.map(e=>e.name):i),[i,e]),w=e=>{if(c)return;let t=new Set(v);t.has(e)?t.delete(e):t.add(e),o(Array.from(t))};return 0===e.length?null:(0,t.jsx)("div",{className:"space-y-3",children:p.map(e=>{let l,i=b[e];if(0===i.length)return null;if(d){let e=d.toLowerCase();if(!i.some(t=>t.name.toLowerCase().includes(e)||(t.description??"").toLowerCase().includes(e)))return null}let m=g[e],p=(l=b[e]).length>0&&l.every(e=>v.has(e.name)),j=(e=>{let t=b[e];if(0===t.length)return!1;let l=t.filter(e=>v.has(e.name)).length;return l>0&&l{y(t=>({...t,[e]:!t[e]}))},children:[N?(0,t.jsx)(n.default,{className:"w-4 h-4 text-gray-500 shrink-0"}):(0,t.jsx)(a.ChevronDownIcon,{className:"w-4 h-4 text-gray-500 shrink-0"}),(0,t.jsx)("span",{className:"font-semibold text-gray-900 text-sm",children:m.label}),(0,t.jsx)("span",{className:`text-xs px-2 py-0.5 rounded-full ${h[m.risk]}`,children:"high"===m.risk?"High Risk":"medium"===m.risk?"Medium Risk":"low"===m.risk?"Safe":"Unclassified"}),(0,t.jsxs)("span",{className:"text-xs text-gray-500 ml-1",children:[i.filter(e=>v.has(e.name)).length,"/",i.length," allowed"]})]}),!c&&(0,t.jsxs)("div",{className:"flex items-center gap-2 ml-4",children:[(0,t.jsx)(r.Text,{className:"text-xs text-gray-500",children:p?"All on":j?"Partial":"All off"}),(0,t.jsx)(s.Checkbox,{checked:p,indeterminate:j,onChange:t=>((e,t)=>{if(c)return;let l=new Set(v);for(let s of b[e])t?l.add(s.name):l.delete(s.name);o(Array.from(l))})(e,t.target.checked),onClick:e=>e.stopPropagation()})]})]}),!N&&(0,t.jsx)("div",{className:"px-4 pt-2 pb-1 text-xs text-gray-500 bg-white border-b border-gray-100",children:m.description}),!N&&(0,t.jsx)("div",{className:"bg-white divide-y divide-gray-50",children:i.filter(e=>!d||e.name.toLowerCase().includes(d.toLowerCase())||(e.description??"").toLowerCase().includes(d.toLowerCase())).map(e=>{let l,a=(l=e.name,v.has(l));return(0,t.jsxs)("div",{className:`flex items-start gap-3 px-4 py-2.5 transition-colors hover:bg-gray-50 ${!c?"cursor-pointer":""} ${a?"":"opacity-60"}`,onClick:()=>w(e.name),children:[(0,t.jsx)(s.Checkbox,{checked:a,onChange:()=>w(e.name),disabled:c,onClick:e=>e.stopPropagation()}),(0,t.jsxs)("div",{className:"flex-1 min-w-0",children:[(0,t.jsx)(r.Text,{className:"font-medium text-gray-900 text-sm",children:e.name}),e.description&&(0,t.jsx)(r.Text,{className:"text-xs text-gray-500 mt-0.5 leading-snug",children:e.description})]}),(0,t.jsx)("span",{className:`text-xs px-1.5 py-0.5 rounded shrink-0 ${a?"bg-green-100 text-green-700":"bg-gray-100 text-gray-500"}`,children:a?"on":"off"})]},e.name)})})]},e)})})}],531516)},695411,e=>{"use strict";var t=e.i(602869);let l=async e=>{try{let l=await (0,t.modelHubCall)(e);if(l?.data.length>0){let e=l.data.map(e=>({model_group:e.model_group,mode:e?.mode}));return e.sort((e,t)=>e.model_group.localeCompare(t.model_group)),e}return[]}catch(e){throw console.error("Error fetching model info:",e),e}};e.s(["fetchAvailableModels",0,l])},841947,e=>{"use strict";let t=(0,e.i(475254).default)("x",[["path",{d:"M18 6 6 18",key:"1bl5f8"}],["path",{d:"m6 6 12 12",key:"d8bk6v"}]]);e.s(["default",0,t])},603908,e=>{"use strict";let t=(0,e.i(475254).default)("plus",[["path",{d:"M5 12h14",key:"1ays0h"}],["path",{d:"M12 5v14",key:"s699le"}]]);e.s(["default",0,t])},107233,e=>{"use strict";var t=e.i(603908);e.s(["Plus",()=>t.default])},37727,e=>{"use strict";var t=e.i(841947);e.s(["X",()=>t.default])},158392,63209,e=>{"use strict";var t=e.i(843476),l=e.i(311451);let s={ttl:3600,lowest_latency_buffer:0},r=({routingStrategyArgs:e})=>{let r={ttl:"Sliding window to look back over when calculating the average latency of a deployment. Default - 1 hour (in seconds).",lowest_latency_buffer:"Shuffle between deployments within this % of the lowest latency. Default - 0 (i.e. always pick lowest latency)."};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"max-w-3xl",children:[(0,t.jsx)("h3",{className:"text-sm font-medium text-gray-900",children:"Latency-Based Configuration"}),(0,t.jsx)("p",{className:"text-xs text-gray-500 mt-1",children:"Fine-tune latency-based routing behavior"})]}),(0,t.jsx)("div",{className:"grid grid-cols-1 gap-6 lg:grid-cols-2 xl:grid-cols-3",children:Object.entries(e||s).map(([e,s])=>(0,t.jsx)("div",{className:"space-y-2",children:(0,t.jsxs)("label",{className:"block",children:[(0,t.jsx)("span",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:e.replace(/_/g," ")}),(0,t.jsx)("p",{className:"text-xs text-gray-500 mt-0.5 mb-2",children:r[e]||""}),(0,t.jsx)(l.Input,{name:e,defaultValue:"object"==typeof s?JSON.stringify(s,null,2):s?.toString(),className:"font-mono text-sm w-full"})]})},e))})]}),(0,t.jsx)("div",{className:"border-t border-gray-200"})]})},a=({routerSettings:e,routerFieldsMetadata:s})=>(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"max-w-3xl",children:[(0,t.jsx)("h3",{className:"text-sm font-medium text-gray-900",children:"Reliability & Retries"}),(0,t.jsx)("p",{className:"text-xs text-gray-500 mt-1",children:"Configure retry logic and failure handling"})]}),(0,t.jsx)("div",{className:"grid grid-cols-1 gap-6 lg:grid-cols-2 xl:grid-cols-3",children:Object.entries(e).filter(([e])=>"fallbacks"!=e&&"context_window_fallbacks"!=e&&"routing_strategy_args"!=e&&"routing_strategy"!=e&&"enable_tag_filtering"!=e&&"retry_policy"!=e&&"model_group_retry_policy"!=e&&"routing_groups"!=e).map(([e,r])=>(0,t.jsx)("div",{className:"space-y-2",children:(0,t.jsxs)("label",{className:"block",children:[(0,t.jsx)("span",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:s[e]?.ui_field_name||e}),(0,t.jsx)("p",{className:"text-xs text-gray-500 mt-0.5 mb-2",children:s[e]?.field_description||""}),(0,t.jsx)(l.Input,{name:e,defaultValue:null==r||"null"===r?"":"object"==typeof r?JSON.stringify(r,null,2):r?.toString()||"",placeholder:"—",className:"font-mono text-sm w-full"})]})},e))})]});var n=e.i(199133);let i=({selectedStrategy:e,availableStrategies:l,routingStrategyDescriptions:s,routerFieldsMetadata:r,onStrategyChange:a})=>(0,t.jsxs)("div",{className:"space-y-2 max-w-3xl",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:r.routing_strategy?.ui_field_name||"Routing Strategy"}),(0,t.jsx)("p",{className:"text-xs text-gray-500 mt-0.5 mb-2",children:r.routing_strategy?.field_description||""})]}),(0,t.jsx)("div",{className:"routing-strategy-select max-w-3xl",children:(0,t.jsx)(n.Select,{value:e,onChange:a,style:{width:"100%"},size:"large",children:l.map(e=>(0,t.jsx)(n.Select.Option,{value:e,label:e,children:(0,t.jsxs)("div",{className:"flex flex-col gap-0.5 py-1",children:[(0,t.jsx)("span",{className:"font-mono text-sm font-medium",children:e}),s[e]&&(0,t.jsx)("span",{className:"text-xs text-gray-500 font-normal",children:s[e]})]})},e))})})]});var o=e.i(790848);let c=({enabled:e,routerFieldsMetadata:l,onToggle:s})=>(0,t.jsx)("div",{className:"space-y-3 max-w-3xl",children:(0,t.jsxs)("div",{className:"flex items-start justify-between",children:[(0,t.jsxs)("div",{className:"flex-1",children:[(0,t.jsx)("label",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:l.enable_tag_filtering?.ui_field_name||"Enable Tag Filtering"}),(0,t.jsxs)("p",{className:"text-xs text-gray-500 mt-0.5",children:[l.enable_tag_filtering?.field_description||"",l.enable_tag_filtering?.link&&(0,t.jsxs)(t.Fragment,{children:[" ",(0,t.jsx)("a",{href:l.enable_tag_filtering.link,target:"_blank",rel:"noopener noreferrer",className:"text-blue-600 hover:text-blue-800 underline",children:"Learn more"})]})]})]}),(0,t.jsx)(o.Switch,{checked:e,onChange:s,className:"ml-4"})]})});e.s(["default",0,({value:e,onChange:l,routerFieldsMetadata:s,availableRoutingStrategies:n,routingStrategyDescriptions:o})=>(0,t.jsxs)("div",{className:"w-full space-y-8 py-2",children:[(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"max-w-3xl",children:[(0,t.jsx)("h3",{className:"text-sm font-medium text-gray-900",children:"Routing Settings"}),(0,t.jsx)("p",{className:"text-xs text-gray-500 mt-1",children:"Configure how requests are routed to deployments"})]}),n.length>0&&(0,t.jsx)(i,{selectedStrategy:e.selectedStrategy||e.routerSettings.routing_strategy||null,availableStrategies:n,routingStrategyDescriptions:o,routerFieldsMetadata:s,onStrategyChange:t=>{l({...e,selectedStrategy:t})}}),(0,t.jsx)(c,{enabled:e.enableTagFiltering,routerFieldsMetadata:s,onToggle:t=>{l({...e,enableTagFiltering:t})}})]}),(0,t.jsx)("div",{className:"border-t border-gray-200"}),"latency-based-routing"===e.selectedStrategy&&(0,t.jsx)(r,{routingStrategyArgs:e.routerSettings.routing_strategy_args}),(0,t.jsx)(a,{routerSettings:e.routerSettings,routerFieldsMetadata:s})]})],158392);var d=e.i(361653);e.s(["AlertCircle",()=>d.default],63209)},425063,e=>{"use strict";let t=(0,e.i(475254).default)("arrow-down",[["path",{d:"M12 5v14",key:"s699le"}],["path",{d:"m19 12-7 7-7-7",key:"1idqje"}]]);e.s(["ArrowDown",0,t],425063)},419470,e=>{"use strict";var t=e.i(843476),l=e.i(994388),s=e.i(653496),r=e.i(107233),a=e.i(271645),n=e.i(888259),i=e.i(199133),o=e.i(592968),c=e.i(63209),d=e.i(425063),u=e.i(37727);function m({group:e,onChange:l,availableModels:s,maxFallbacks:r}){let a=s.filter(t=>t!==e.primaryModel),n=e.fallbackModels.length{let s=[...e.fallbackModels];s.includes(t)&&(s=s.filter(e=>e!==t)),l({...e,primaryModel:t,fallbackModels:s})},showSearch:!0,getPopupContainer:e=>e.parentElement||document.body,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:s.map(e=>({label:e,value:e}))}),!e.primaryModel&&(0,t.jsxs)("div",{className:"mt-2 flex items-center gap-2 text-amber-600 text-xs bg-amber-50 p-2 rounded-sm",children:[(0,t.jsx)(c.AlertCircle,{className:"w-4 h-4"}),(0,t.jsx)("span",{children:"Select a model to begin configuring fallbacks"})]})]}),(0,t.jsx)("div",{className:"flex items-center justify-center -my-4 z-10",children:(0,t.jsxs)("div",{className:"bg-indigo-50 text-indigo-500 px-4 py-1 rounded-full text-xs font-bold border border-indigo-100 flex items-center gap-2 shadow-xs",children:[(0,t.jsx)(d.ArrowDown,{className:"w-4 h-4"}),"IF FAILS, TRY..."]})}),(0,t.jsxs)("div",{className:`transition-opacity duration-300 ${!e.primaryModel?"opacity-50 pointer-events-none":"opacity-100"}`,children:[(0,t.jsxs)("label",{className:"block text-sm font-semibold text-gray-700 mb-2",children:["Fallback Chain ",(0,t.jsx)("span",{className:"text-red-500",children:"*"}),(0,t.jsxs)("span",{className:"text-xs text-gray-500 font-normal ml-2",children:["(Max ",r," fallbacks at a time)"]})]}),(0,t.jsxs)("div",{className:"bg-gray-50 rounded-xl p-4 border border-gray-200",children:[(0,t.jsxs)("div",{className:"mb-4",children:[(0,t.jsx)(i.Select,{mode:"multiple",className:"w-full",size:"large",placeholder:n?"Select fallback models to add...":`Maximum ${r} fallbacks reached`,value:e.fallbackModels,onChange:t=>{let s=t.slice(0,r);l({...e,fallbackModels:s})},disabled:!e.primaryModel,getPopupContainer:e=>e.parentElement||document.body,options:a.map(e=>({label:e,value:e})),optionRender:(l,s)=>{let r=e.fallbackModels.includes(l.value),a=r?e.fallbackModels.indexOf(l.value)+1:null;return(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[r&&null!==a&&(0,t.jsx)("span",{className:"flex items-center justify-center w-5 h-5 rounded-sm bg-indigo-100 text-indigo-600 text-xs font-bold",children:a}),(0,t.jsx)("span",{children:l.label})]})},maxTagCount:"responsive",maxTagPlaceholder:e=>(0,t.jsx)(o.Tooltip,{styles:{root:{pointerEvents:"none"}},title:e.map(({value:e})=>e).join(", "),children:(0,t.jsxs)("span",{children:["+",e.length," more"]})}),showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase())}),(0,t.jsx)("p",{className:"text-xs text-gray-500 mt-1 ml-1",children:n?`Search and select multiple models. Selected models will appear below in order. (${e.fallbackModels.length}/${r} used)`:`Maximum ${r} fallbacks reached. Remove some to add more.`})]}),(0,t.jsx)("div",{className:"space-y-2 min-h-[100px]",children:0===e.fallbackModels.length?(0,t.jsxs)("div",{className:"h-32 border-2 border-dashed border-gray-300 rounded-lg flex flex-col items-center justify-center text-gray-400",children:[(0,t.jsx)("span",{className:"text-sm",children:"No fallback models selected"}),(0,t.jsx)("span",{className:"text-xs mt-1",children:"Add models from the dropdown above"})]}):e.fallbackModels.map((s,r)=>(0,t.jsxs)("div",{className:"group flex items-center justify-between p-3 bg-white rounded-lg border border-gray-200 hover:border-indigo-300 hover:shadow-xs transition-all",children:[(0,t.jsxs)("div",{className:"flex items-center gap-3",children:[(0,t.jsx)("div",{className:"flex items-center justify-center w-6 h-6 rounded-sm bg-gray-100 text-gray-400 group-hover:text-indigo-500 group-hover:bg-indigo-50",children:(0,t.jsx)("span",{className:"text-xs font-bold",children:r+1})}),(0,t.jsx)("div",{children:(0,t.jsx)("span",{className:"font-medium text-gray-800",children:s})})]}),(0,t.jsx)("button",{type:"button",onClick:()=>{let t;return t=e.fallbackModels.filter((e,t)=>t!==r),void l({...e,fallbackModels:t})},className:"opacity-0 group-hover:opacity-100 transition-opacity text-gray-400 hover:text-red-500 p-1",children:(0,t.jsx)(u.X,{className:"w-4 h-4"})})]},`${s}-${r}`))})]})]})]})}e.s(["FallbackSelectionForm",0,function({groups:e,onGroupsChange:i,availableModels:o,maxFallbacks:c=10,maxGroups:d=5}){let[u,g]=(0,a.useState)(e.length>0?e[0].id:"1");(0,a.useEffect)(()=>{e.length>0?e.some(e=>e.id===u)||g(e[0].id):g("1")},[e]);let p=()=>{if(e.length>=d)return;let t=Date.now().toString();i([...e,{id:t,primaryModel:null,fallbackModels:[]}]),g(t)},h=t=>{i(e.map(e=>e.id===t.id?t:e))},x=e.map((l,s)=>{let r=l.primaryModel?l.primaryModel:`Group ${s+1}`;return{key:l.id,label:r,closable:e.length>1,children:(0,t.jsx)(m,{group:l,onChange:h,availableModels:o,maxFallbacks:c})}});return 0===e.length?(0,t.jsxs)("div",{className:"text-center py-12 bg-gray-50 rounded-lg border border-dashed border-gray-300",children:[(0,t.jsx)("p",{className:"text-gray-500 mb-4",children:"No fallback groups configured"}),(0,t.jsx)(l.Button,{variant:"primary",onClick:p,icon:()=>(0,t.jsx)(r.Plus,{className:"w-4 h-4"}),children:"Create First Group"})]}):(0,t.jsx)(s.Tabs,{type:"editable-card",activeKey:u,onChange:g,onEdit:(t,l)=>{"add"===l?p():"remove"===l&&e.length>1&&(t=>{if(1===e.length)return n.default.warning("At least one group is required");let l=e.filter(e=>e.id!==t);i(l),u===t&&l.length>0&&g(l[l.length-1].id)})(t)},items:x,className:"fallback-tabs",tabBarStyle:{marginBottom:0},hideAdd:e.length>=d})}],419470)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/0.1o3m2oaq6je.js b/litellm/proxy/_experimental/out/_next/static/chunks/0.1o3m2oaq6je.js deleted file mode 100644 index 2eeed6a6c76..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/0.1o3m2oaq6je.js +++ /dev/null @@ -1,86 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,509345,e=>{"use strict";var t,a,l=e.i(843476),r=e.i(271645),i=e.i(464571),s=e.i(326373),n=e.i(653496),o=e.i(755151),d=e.i(646563),c=e.i(245094),m=e.i(602869),u=e.i(808613),p=e.i(311451),g=e.i(212931),x=e.i(199133),h=e.i(262218),f=e.i(898586),y=e.i(727749),j=e.i(770914),_=e.i(515831),b=e.i(175712),v=e.i(519756);let{Text:w}=f.Typography,{Option:N}=x.Select,C=({visible:e,prebuiltPatterns:t,categories:a,selectedPatternName:r,patternAction:s,onPatternNameChange:n,onActionChange:o,onAdd:d,onCancel:c})=>(0,l.jsxs)(g.Modal,{title:"Add prebuilt pattern",open:e,onCancel:c,footer:null,width:800,children:[(0,l.jsxs)(j.Space,{direction:"vertical",style:{width:"100%"},size:"large",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)(w,{strong:!0,children:"Pattern type"}),(0,l.jsx)(x.Select,{placeholder:"Choose pattern type",value:r,onChange:n,style:{width:"100%",marginTop:8},showSearch:!0,filterOption:(e,a)=>{let l=t.find(e=>e.name===a?.value);return!!l&&(l.display_name.toLowerCase().includes(e.toLowerCase())||l.name.toLowerCase().includes(e.toLowerCase()))},children:a.map(e=>{let a=t.filter(t=>t.category===e);return 0===a.length?null:(0,l.jsx)(x.Select.OptGroup,{label:e,children:a.map(e=>(0,l.jsx)(N,{value:e.name,children:e.display_name},e.name))},e)})})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(w,{strong:!0,children:"Action"}),(0,l.jsx)(w,{type:"secondary",style:{display:"block",marginTop:4,marginBottom:8},children:"Choose what action the guardrail should take when this pattern is detected"}),(0,l.jsxs)(x.Select,{value:s,onChange:o,style:{width:"100%"},children:[(0,l.jsx)(N,{value:"BLOCK",children:"Block"}),(0,l.jsx)(N,{value:"MASK",children:"Mask"})]})]})]}),(0,l.jsxs)("div",{style:{display:"flex",justifyContent:"flex-end",gap:"8px",marginTop:"24px"},children:[(0,l.jsx)(i.Button,{onClick:c,children:"Cancel"}),(0,l.jsx)(i.Button,{type:"primary",onClick:d,children:"Add"})]})]}),{Text:S}=f.Typography,{Option:k}=x.Select,I=({visible:e,patternName:t,patternRegex:a,patternAction:r,onNameChange:s,onRegexChange:n,onActionChange:o,onAdd:d,onCancel:c})=>(0,l.jsxs)(g.Modal,{title:"Add custom regex pattern",open:e,onCancel:c,footer:null,width:800,children:[(0,l.jsxs)(j.Space,{direction:"vertical",style:{width:"100%"},size:"large",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)(S,{strong:!0,children:"Pattern name"}),(0,l.jsx)(p.Input,{placeholder:"e.g., internal_id, employee_code",value:t,onChange:e=>s(e.target.value),style:{marginTop:8}})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(S,{strong:!0,children:"Regex pattern"}),(0,l.jsx)(p.Input,{placeholder:"e.g., ID-[0-9]{6}",value:a,onChange:e=>n(e.target.value),style:{marginTop:8}}),(0,l.jsx)(S,{type:"secondary",style:{fontSize:12},children:"Enter a valid regular expression to match sensitive data"})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(S,{strong:!0,children:"Action"}),(0,l.jsx)(S,{type:"secondary",style:{display:"block",marginTop:4,marginBottom:8},children:"Choose what action the guardrail should take when this pattern is detected"}),(0,l.jsxs)(x.Select,{value:r,onChange:o,style:{width:"100%"},children:[(0,l.jsx)(k,{value:"BLOCK",children:"Block"}),(0,l.jsx)(k,{value:"MASK",children:"Mask"})]})]})]}),(0,l.jsxs)("div",{style:{display:"flex",justifyContent:"flex-end",gap:"8px",marginTop:"24px"},children:[(0,l.jsx)(i.Button,{onClick:c,children:"Cancel"}),(0,l.jsx)(i.Button,{type:"primary",onClick:d,children:"Add"})]})]}),{Text:A}=f.Typography,{Option:O}=x.Select,T=({visible:e,keyword:t,action:a,description:r,onKeywordChange:s,onActionChange:n,onDescriptionChange:o,onAdd:d,onCancel:c})=>(0,l.jsxs)(g.Modal,{title:"Add blocked keyword",open:e,onCancel:c,footer:null,width:800,children:[(0,l.jsxs)(j.Space,{direction:"vertical",style:{width:"100%"},size:"large",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)(A,{strong:!0,children:"Keyword"}),(0,l.jsx)(p.Input,{placeholder:"Enter sensitive keyword or phrase",value:t,onChange:e=>s(e.target.value),style:{marginTop:8}})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(A,{strong:!0,children:"Action"}),(0,l.jsx)(A,{type:"secondary",style:{display:"block",marginTop:4,marginBottom:8},children:"Choose what action the guardrail should take when this keyword is detected"}),(0,l.jsxs)(x.Select,{value:a,onChange:n,style:{width:"100%"},children:[(0,l.jsx)(O,{value:"BLOCK",children:"Block"}),(0,l.jsx)(O,{value:"MASK",children:"Mask"})]})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(A,{strong:!0,children:"Description (optional)"}),(0,l.jsx)(p.Input.TextArea,{placeholder:"Explain why this keyword is sensitive",value:r,onChange:e=>o(e.target.value),rows:3,style:{marginTop:8}})]})]}),(0,l.jsxs)("div",{style:{display:"flex",justifyContent:"flex-end",gap:"8px",marginTop:"24px"},children:[(0,l.jsx)(i.Button,{onClick:c,children:"Cancel"}),(0,l.jsx)(i.Button,{type:"primary",onClick:d,children:"Add"})]})]});var P=e.i(291542),L=e.i(955135);let{Text:B}=f.Typography,{Option:F}=x.Select,$=({patterns:e,onActionChange:t,onRemove:a})=>{let r=[{title:"Type",dataIndex:"type",key:"type",width:100,render:e=>(0,l.jsx)(h.Tag,{color:"prebuilt"===e?"blue":"green",children:"prebuilt"===e?"Prebuilt":"Custom"})},{title:"Pattern name",dataIndex:"name",key:"name",render:(e,t)=>t.display_name||t.name},{title:"Regex pattern",dataIndex:"pattern",key:"pattern",render:e=>e?(0,l.jsxs)(B,{code:!0,style:{fontSize:12},children:[e.substring(0,40),"..."]}):"-"},{title:"Action",dataIndex:"action",key:"action",width:150,render:(e,a)=>(0,l.jsxs)(x.Select,{value:e,onChange:e=>t(a.id,e),style:{width:120},size:"small",children:[(0,l.jsx)(F,{value:"BLOCK",children:"Block"}),(0,l.jsx)(F,{value:"MASK",children:"Mask"})]})},{title:"",key:"actions",width:100,render:(e,t)=>(0,l.jsx)(i.Button,{type:"text",danger:!0,size:"small",icon:(0,l.jsx)(L.DeleteOutlined,{}),onClick:()=>a(t.id),children:"Delete"})}];return 0===e.length?(0,l.jsx)("div",{style:{textAlign:"center",padding:"40px 0",color:"#999"},children:"No patterns added."}):(0,l.jsx)(P.Table,{dataSource:e,columns:r,rowKey:"id",pagination:!1,size:"small"})},{Text:E}=f.Typography,{Option:M}=x.Select,R=({keywords:e,onActionChange:t,onRemove:a})=>{let r=[{title:"Keyword",dataIndex:"keyword",key:"keyword"},{title:"Action",dataIndex:"action",key:"action",width:150,render:(e,a)=>(0,l.jsxs)(x.Select,{value:e,onChange:e=>t(a.id,"action",e),style:{width:120},size:"small",children:[(0,l.jsx)(M,{value:"BLOCK",children:"Block"}),(0,l.jsx)(M,{value:"MASK",children:"Mask"})]})},{title:"Description",dataIndex:"description",key:"description",render:e=>e||"-"},{title:"",key:"actions",width:100,render:(e,t)=>(0,l.jsx)(i.Button,{type:"text",danger:!0,size:"small",icon:(0,l.jsx)(L.DeleteOutlined,{}),onClick:()=>a(t.id),children:"Delete"})}];return 0===e.length?(0,l.jsx)("div",{style:{textAlign:"center",padding:"40px 0",color:"#999"},children:"No keywords added."}):(0,l.jsx)(P.Table,{dataSource:e,columns:r,rowKey:"id",pagination:!1,size:"small"})};var G=e.i(362024),z=e.i(993914);let{Title:D,Text:K}=f.Typography,{Option:q}=x.Select,H=({availableCategories:e,selectedCategories:t,onCategoryAdd:a,onCategoryRemove:s,onCategoryUpdate:n,accessToken:o,pendingSelection:c,onPendingSelectionChange:u})=>{let[p,g]=r.default.useState(""),f=void 0!==c?c:p,y=u||g,[j,_]=r.default.useState({}),[v,w]=r.default.useState({}),[N,C]=r.default.useState({}),[S,k]=r.default.useState([]),[I,A]=r.default.useState(""),[O,T]=r.default.useState(!1),B=async e=>{if(o&&!j[e]){C(t=>({...t,[e]:!0}));try{let t=await (0,m.getCategoryYaml)(o,e),a=t.yaml_content;if("json"===t.file_type)try{let e=JSON.parse(a);a=JSON.stringify(e,null,2)}catch(t){console.warn(`Failed to format JSON for ${e}:`,t)}_(t=>({...t,[e]:a})),w(a=>({...a,[e]:t.file_type||"yaml"}))}catch(t){console.error(`Failed to fetch content for category ${e}:`,t)}finally{C(t=>({...t,[e]:!1}))}}};r.default.useEffect(()=>{if(f&&o){let e=j[f];if(e)return void A(e);T(!0),(0,m.getCategoryYaml)(o,f).then(e=>{let t=e.yaml_content;if("json"===e.file_type)try{let e=JSON.parse(t);t=JSON.stringify(e,null,2)}catch(e){console.warn(`Failed to format JSON for ${f}:`,e)}A(t),_(e=>({...e,[f]:t})),w(t=>({...t,[f]:e.file_type||"yaml"}))}).catch(e=>{console.error(`Failed to fetch preview content for category ${f}:`,e),A("")}).finally(()=>{T(!1)})}else A(""),T(!1)},[f,o]);let F=[{title:"Category",dataIndex:"display_name",key:"display_name",render:(t,a)=>{let r=e.find(e=>e.name===a.category);return(0,l.jsxs)("div",{children:[(0,l.jsx)("div",{style:{fontWeight:500},children:t}),r?.description&&(0,l.jsx)("div",{style:{fontSize:"12px",color:"#888",marginTop:"4px"},children:r.description})]})}},{title:"Action",dataIndex:"action",key:"action",width:150,render:(e,t)=>(0,l.jsxs)(x.Select,{value:e,onChange:e=>n(t.id,"action",e),style:{width:"100%"},children:[(0,l.jsx)(q,{value:"BLOCK",children:(0,l.jsx)(h.Tag,{color:"red",children:"BLOCK"})}),(0,l.jsx)(q,{value:"MASK",children:(0,l.jsx)(h.Tag,{color:"orange",children:"MASK"})})]})},{title:"Severity Threshold",dataIndex:"severity_threshold",key:"severity_threshold",width:180,render:(e,t)=>(0,l.jsxs)(x.Select,{value:e,onChange:e=>n(t.id,"severity_threshold",e),style:{width:"100%"},children:[(0,l.jsx)(q,{value:"low",children:"Low"}),(0,l.jsx)(q,{value:"medium",children:"Medium"}),(0,l.jsx)(q,{value:"high",children:"High"})]})},{title:"",key:"actions",width:80,render:(e,t)=>(0,l.jsx)(i.Button,{icon:(0,l.jsx)(L.DeleteOutlined,{}),onClick:()=>s(t.id),size:"small",children:"Remove"})}],$=e.filter(e=>!t.some(t=>t.category===e.name));return(0,l.jsxs)(b.Card,{title:(0,l.jsxs)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"center",flexWrap:"wrap",gap:8},children:[(0,l.jsx)(D,{level:5,style:{margin:0},children:"Blocked topics"}),(0,l.jsx)(K,{type:"secondary",style:{fontSize:12,fontWeight:400},children:"Select topics to block using keyword and semantic analysis"})]}),size:"small",children:[(0,l.jsxs)("div",{style:{marginBottom:16,display:"flex",gap:8},children:[(0,l.jsx)(x.Select,{placeholder:"Select a content category",value:f||void 0,onChange:y,style:{flex:1},showSearch:!0,optionLabelProp:"label",filterOption:(e,t)=>(t?.label?.toString().toLowerCase()??"").includes(e.toLowerCase()),children:$.map(e=>(0,l.jsx)(q,{value:e.name,label:e.display_name,children:(0,l.jsxs)("div",{children:[(0,l.jsx)("div",{style:{fontWeight:500},children:e.display_name}),(0,l.jsx)("div",{style:{fontSize:"12px",color:"#666",marginTop:"2px"},children:e.description})]})},e.name))}),(0,l.jsx)(i.Button,{type:"primary",onClick:()=>{if(!f)return;let l=e.find(e=>e.name===f);!l||t.some(e=>e.category===f)||(a({id:`category-${Date.now()}`,category:l.name,display_name:l.display_name,action:l.default_action,severity_threshold:"medium"}),y(""),A(""))},disabled:!f,icon:(0,l.jsx)(d.PlusOutlined,{}),children:"Add"})]}),f&&(0,l.jsxs)("div",{style:{marginBottom:16,padding:"12px",background:"#f9f9f9",border:"1px solid #e0e0e0",borderRadius:"4px"},children:[(0,l.jsxs)("div",{style:{marginBottom:8,fontWeight:500,fontSize:"14px"},children:["Preview: ",e.find(e=>e.name===f)?.display_name,v[f]&&(0,l.jsxs)("span",{style:{marginLeft:8,fontSize:"12px",color:"#888",fontWeight:400},children:["(",v[f]?.toUpperCase(),")"]})]}),O?(0,l.jsx)("div",{style:{padding:"16px",textAlign:"center",color:"#888"},children:"Loading content..."}):I?(0,l.jsx)("pre",{style:{background:"#fff",padding:"12px",borderRadius:"4px",overflow:"auto",maxHeight:"300px",maxWidth:"100%",fontSize:"12px",lineHeight:"1.5",margin:0,border:"1px solid #e0e0e0",whiteSpace:"pre-wrap",wordBreak:"break-word"},children:(0,l.jsx)("code",{children:I})}):(0,l.jsx)("div",{style:{padding:"8px",textAlign:"center",color:"#888",fontSize:"12px"},children:"Unable to load category content"})]}),t.length>0?(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(P.Table,{dataSource:t,columns:F,pagination:!1,size:"small",rowKey:"id"}),(0,l.jsx)("div",{style:{marginTop:16},children:(0,l.jsx)(G.Collapse,{activeKey:S,onChange:e=>{let t=Array.isArray(e)?e:e?[e]:[],a=new Set(S);t.forEach(e=>{a.has(e)||j[e]||B(e)}),k(t)},ghost:!0,items:t.map(e=>{let t=(v[e.category]||"yaml").toUpperCase();return{key:e.category,label:(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:8},children:[(0,l.jsx)(z.FileTextOutlined,{}),(0,l.jsxs)("span",{children:["View ",t," for ",e.display_name]})]}),children:N[e.category]?(0,l.jsx)("div",{style:{padding:"16px",textAlign:"center",color:"#888"},children:"Loading content..."}):j[e.category]?(0,l.jsx)("pre",{style:{background:"#f5f5f5",padding:"16px",borderRadius:"4px",overflow:"auto",maxHeight:"400px",fontSize:"12px",lineHeight:"1.5",margin:0},children:(0,l.jsx)("code",{children:j[e.category]})}):(0,l.jsx)("div",{style:{padding:"16px",textAlign:"center",color:"#888"},children:"Content will load when expanded"})}})})})]}):(0,l.jsx)("div",{style:{textAlign:"center",padding:"24px",color:"#888",border:"1px dashed #d9d9d9",borderRadius:"4px"},children:"No blocked topics selected. Add topics to detect and block harmful content."})]})};var U=e.i(790848),J=e.i(28651);let{Title:W,Text:V}=f.Typography,{Option:Y}=x.Select,Q={competitor_intent_type:"airline",brand_self:[],locations:[],policy:{competitor_comparison:"refuse",possible_competitor_comparison:"reframe"},threshold_high:.7,threshold_medium:.45,threshold_low:.3},X=({enabled:e,config:t,onChange:a,accessToken:i})=>{let s=t??Q,[n,o]=(0,r.useState)([]),[d,c]=(0,r.useState)(!1);(0,r.useEffect)(()=>{"airline"===s.competitor_intent_type&&i&&0===n.length&&(c(!0),(0,m.getMajorAirlines)(i).then(e=>o(e.airlines??[])).catch(()=>o([])).finally(()=>c(!1)))},[s.competitor_intent_type,i,n.length]);let p=e=>{a(e,e?{...Q}:null)},g=(t,l)=>{a(e,{...s,[t]:l})},h=(t,l)=>{a(e,{...s,policy:{...s.policy,[t]:l}})},f=(t,l)=>{a(e,{...s,[t]:l.filter(Boolean)})};return e?(0,l.jsxs)(b.Card,{title:(0,l.jsxs)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"center"},children:[(0,l.jsx)(W,{level:5,style:{margin:0},children:"Competitor Intent Filter"}),(0,l.jsx)(U.Switch,{checked:e,onChange:p})]}),size:"small",children:[(0,l.jsx)(V,{type:"secondary",style:{display:"block",marginBottom:16},children:"Block or reframe competitor comparison questions. Airline type uses major airlines (excluding your brand); generic requires manual competitor list."}),(0,l.jsxs)(u.Form,{layout:"vertical",size:"small",children:[(0,l.jsx)(u.Form.Item,{label:"Type",children:(0,l.jsxs)(x.Select,{value:s.competitor_intent_type,onChange:e=>g("competitor_intent_type",e),style:{width:"100%"},children:[(0,l.jsx)(Y,{value:"airline",children:"Airline (auto-load competitors from IATA)"}),(0,l.jsx)(Y,{value:"generic",children:"Generic (specify competitors manually)"})]})}),(0,l.jsx)(u.Form.Item,{label:"Your Brand (brand_self)",required:!0,help:"airline"===s.competitor_intent_type?"Select your airline from the list (excluded from competitors) or type to add a custom term":"Names/codes users use for your brand",children:(0,l.jsx)(x.Select,{mode:"tags",style:{width:"100%"},placeholder:d?"Loading airlines...":"airline"===s.competitor_intent_type?"Search or select airline, or type to add custom":"Type and press Enter to add",value:s.brand_self,onChange:t=>"airline"===s.competitor_intent_type&&n.length>0?(t=>{let l=t.filter(Boolean),r=[],i=new Set;for(let e of l){let t=n.find(t=>t.match.split("|")[0]?.trim().toLowerCase()===e.toLowerCase());if(t)for(let e of t.match.split("|").map(e=>e.trim().toLowerCase()).filter(Boolean))i.has(e)||(i.add(e),r.push(e));else i.has(e.toLowerCase())||(i.add(e.toLowerCase()),r.push(e))}a(e,{...s,brand_self:r})})(t??[]):f("brand_self",t??[]),tokenSeparators:[","],loading:d,showSearch:!0,filterOption:(e,t)=>(t?.label?.toString().toLowerCase()??"").includes(e.toLowerCase()),optionFilterProp:"label",options:"airline"===s.competitor_intent_type&&n.length>0?n.map(e=>{let t=e.match.split("|")[0]?.trim()??e.id,a=e.match.split("|").map(e=>e.trim().toLowerCase()).filter(Boolean);return{value:t.toLowerCase(),label:`${t}${a.length>1?` (${a.slice(1).join(", ")})`:""}`}}):void 0})}),"airline"===s.competitor_intent_type&&(0,l.jsx)(u.Form.Item,{label:"Locations (optional)",help:"Countries, cities, airports for disambiguation (e.g. qatar, doha)",children:(0,l.jsx)(x.Select,{mode:"tags",style:{width:"100%"},placeholder:"Type and press Enter to add",value:s.locations??[],onChange:e=>f("locations",e??[]),tokenSeparators:[","]})}),"generic"===s.competitor_intent_type&&(0,l.jsx)(u.Form.Item,{label:"Competitors",required:!0,help:"Competitor names to detect (required for generic type)",children:(0,l.jsx)(x.Select,{mode:"tags",style:{width:"100%"},placeholder:"Type and press Enter to add",value:s.competitors??[],onChange:e=>f("competitors",e??[]),tokenSeparators:[","]})}),(0,l.jsx)(u.Form.Item,{label:"Policy: Competitor comparison",children:(0,l.jsxs)(x.Select,{value:s.policy?.competitor_comparison??"refuse",onChange:e=>h("competitor_comparison",e),style:{width:"100%"},children:[(0,l.jsx)(Y,{value:"refuse",children:"Refuse (block request)"}),(0,l.jsx)(Y,{value:"reframe",children:"Reframe (suggest alternative)"})]})}),(0,l.jsx)(u.Form.Item,{label:"Policy: Possible competitor comparison",children:(0,l.jsxs)(x.Select,{value:s.policy?.possible_competitor_comparison??"reframe",onChange:e=>h("possible_competitor_comparison",e),style:{width:"100%"},children:[(0,l.jsx)(Y,{value:"refuse",children:"Refuse (block request)"}),(0,l.jsx)(Y,{value:"reframe",children:"Reframe (suggest alternative to backend LLM)"})]})}),(0,l.jsx)(u.Form.Item,{label:"Confidence thresholds",help:(0,l.jsxs)(l.Fragment,{children:["Classify competitor intent by confidence (0–1). Higher confidence → stronger intent.",(0,l.jsxs)("ul",{style:{marginBottom:0,marginTop:4,paddingLeft:20},children:[(0,l.jsxs)("li",{children:[(0,l.jsx)("strong",{children:"High (≥)"}),': Treat as full competitor comparison → uses "Competitor comparison" policy']}),(0,l.jsxs)("li",{children:[(0,l.jsx)("strong",{children:"Medium (≥)"}),': Treat as possible comparison → uses "Possible competitor comparison" policy']}),(0,l.jsxs)("li",{children:[(0,l.jsx)("strong",{children:"Low (≥)"}),": Log only; allow request. Below Low → allow with no action"]})]}),"Raise thresholds to be more permissive; lower them to be stricter."]}),children:(0,l.jsxs)(j.Space,{wrap:!0,children:[(0,l.jsx)(u.Form.Item,{label:"High",style:{marginBottom:0},help:"e.g. 0.7",children:(0,l.jsx)(J.InputNumber,{min:0,max:1,step:.05,value:s.threshold_high??.7,onChange:e=>g("threshold_high",e??.7),style:{width:80}})}),(0,l.jsx)(u.Form.Item,{label:"Medium",style:{marginBottom:0},help:"e.g. 0.45",children:(0,l.jsx)(J.InputNumber,{min:0,max:1,step:.05,value:s.threshold_medium??.45,onChange:e=>g("threshold_medium",e??.45),style:{width:80}})}),(0,l.jsx)(u.Form.Item,{label:"Low",style:{marginBottom:0},help:"e.g. 0.3",children:(0,l.jsx)(J.InputNumber,{min:0,max:1,step:.05,value:s.threshold_low??.3,onChange:e=>g("threshold_low",e??.3),style:{width:80}})})]})})]})]}):(0,l.jsx)(b.Card,{title:(0,l.jsxs)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"center"},children:[(0,l.jsx)(W,{level:5,style:{margin:0},children:"Competitor Intent Filter"}),(0,l.jsx)(U.Switch,{checked:!1,onChange:p})]}),size:"small",children:(0,l.jsx)(V,{type:"secondary",children:"Block or reframe competitor comparison questions. When enabled, airline type auto-loads competitors from IATA; generic type requires manual competitor list."})})},{Title:Z,Text:ee}=f.Typography,et=({prebuiltPatterns:e,categories:t,selectedPatterns:a,blockedWords:s,onPatternAdd:n,onPatternRemove:o,onPatternActionChange:c,onBlockedWordAdd:u,onBlockedWordRemove:p,onBlockedWordUpdate:g,onFileUpload:x,accessToken:h,showStep:f,contentCategories:w=[],selectedContentCategories:N=[],onContentCategoryAdd:S,onContentCategoryRemove:k,onContentCategoryUpdate:A,pendingCategorySelection:O,onPendingCategorySelectionChange:P,competitorIntentEnabled:L=!1,competitorIntentConfig:B=null,onCompetitorIntentChange:F})=>{let[E,M]=(0,r.useState)(!1),[G,z]=(0,r.useState)(!1),[D,K]=(0,r.useState)(!1),[q,U]=(0,r.useState)(""),[J,W]=(0,r.useState)("BLOCK"),[V,Y]=(0,r.useState)(""),[Q,et]=(0,r.useState)(""),[ea,el]=(0,r.useState)("BLOCK"),[er,ei]=(0,r.useState)(""),[es,en]=(0,r.useState)("BLOCK"),[eo,ed]=(0,r.useState)(""),[ec,em]=(0,r.useState)(!1),eu=async e=>{em(!0);try{let t=await e.text();if(h){let e=await (0,m.validateBlockedWordsFile)(h,t);if(e.valid)x&&x(t),y.default.success(e.message||"File uploaded successfully");else{let t=e.error||e.errors&&e.errors.join(", ")||"Invalid file";y.default.error(`Validation failed: ${t}`)}}}catch(e){y.default.error(`Failed to upload file: ${e}`)}finally{em(!1)}return!1};return(0,l.jsxs)("div",{className:"space-y-6",children:[!f&&(0,l.jsx)("div",{children:(0,l.jsx)(ee,{type:"secondary",children:"Configure patterns, keywords, and content categories to detect and filter sensitive information in requests and responses."})}),(!f||"patterns"===f)&&(0,l.jsxs)(b.Card,{title:(0,l.jsxs)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"center"},children:[(0,l.jsx)(Z,{level:5,style:{margin:0},children:"Pattern Detection"}),(0,l.jsx)(ee,{type:"secondary",style:{fontSize:14,fontWeight:400},children:"Detect sensitive information using regex patterns (SSN, credit cards, API keys, etc.)"})]}),size:"small",children:[(0,l.jsx)("div",{style:{marginBottom:16},children:(0,l.jsxs)(j.Space,{children:[(0,l.jsx)(i.Button,{type:"primary",onClick:()=>M(!0),icon:(0,l.jsx)(d.PlusOutlined,{}),children:"Add prebuilt pattern"}),(0,l.jsx)(i.Button,{onClick:()=>K(!0),icon:(0,l.jsx)(d.PlusOutlined,{}),children:"Add custom regex"})]})}),(0,l.jsx)($,{patterns:a,onActionChange:c,onRemove:o})]}),(!f||"keywords"===f)&&(0,l.jsxs)(b.Card,{title:(0,l.jsxs)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"center"},children:[(0,l.jsx)(Z,{level:5,style:{margin:0},children:"Blocked Keywords"}),(0,l.jsx)(ee,{type:"secondary",style:{fontSize:14,fontWeight:400},children:"Block or mask specific sensitive terms and phrases"})]}),size:"small",children:[(0,l.jsx)("div",{style:{marginBottom:16},children:(0,l.jsxs)(j.Space,{children:[(0,l.jsx)(i.Button,{type:"primary",onClick:()=>z(!0),icon:(0,l.jsx)(d.PlusOutlined,{}),children:"Add keyword"}),(0,l.jsx)(_.Upload,{beforeUpload:eu,accept:".yaml,.yml",showUploadList:!1,children:(0,l.jsx)(i.Button,{icon:(0,l.jsx)(v.UploadOutlined,{}),loading:ec,children:"Upload YAML file"})})]})}),(0,l.jsx)(R,{keywords:s,onActionChange:g,onRemove:p})]}),(!f||"competitor_intent"===f||"categories"===f)&&F&&(0,l.jsx)(X,{enabled:L,config:B,onChange:F,accessToken:h}),(!f||"categories"===f)&&w.length>0&&S&&k&&A&&(0,l.jsx)(H,{availableCategories:w,selectedCategories:N,onCategoryAdd:S,onCategoryRemove:k,onCategoryUpdate:A,accessToken:h,pendingSelection:O,onPendingSelectionChange:P}),(0,l.jsx)(C,{visible:E,prebuiltPatterns:e,categories:t,selectedPatternName:q,patternAction:J,onPatternNameChange:U,onActionChange:e=>W(e),onAdd:()=>{if(!q)return void y.default.error("Please select a pattern");let t=e.find(e=>e.name===q);n({id:`pattern-${Date.now()}`,type:"prebuilt",name:q,display_name:t?.display_name,action:J}),M(!1),U(""),W("BLOCK")},onCancel:()=>{M(!1),U(""),W("BLOCK")}}),(0,l.jsx)(I,{visible:D,patternName:V,patternRegex:Q,patternAction:ea,onNameChange:Y,onRegexChange:et,onActionChange:e=>el(e),onAdd:()=>{V&&Q?(n({id:`custom-${Date.now()}`,type:"custom",name:V,pattern:Q,action:ea}),K(!1),Y(""),et(""),el("BLOCK")):y.default.error("Please provide pattern name and regex")},onCancel:()=>{K(!1),Y(""),et(""),el("BLOCK")}}),(0,l.jsx)(T,{visible:G,keyword:er,action:es,description:eo,onKeywordChange:ei,onActionChange:e=>en(e),onDescriptionChange:ed,onAdd:()=>{er?(u({id:`word-${Date.now()}`,keyword:er,action:es,description:eo||void 0}),z(!1),ei(""),ed(""),en("BLOCK")):y.default.error("Please enter a keyword")},onCancel:()=>{z(!1),ei(""),ed(""),en("BLOCK")}})]})};var ea=e.i(555987),el=((t={}).PresidioPII="Presidio PII",t.Bedrock="Bedrock Guardrail",t.Lakera="Lakera",t);let er={},ei=e=>{let t={};return t.PresidioPII="Presidio PII",t.Bedrock="Bedrock Guardrail",t.Lakera="Lakera",t.LlmAsAJudge="LiteLLM LLM as a Judge",Object.entries(e).forEach(([e,a])=>{a&&"object"==typeof a&&"ui_friendly_name"in a&&(t[e.split("_").map((e,t)=>e.charAt(0).toUpperCase()+e.slice(1)).join("")]=a.ui_friendly_name)}),er=t,t},es=()=>Object.keys(er).length>0?er:el,en={PresidioPII:"presidio",Bedrock:"bedrock",Lakera:"lakera_v2",LitellmContentFilter:"litellm_content_filter",ToolPermission:"tool_permission",BlockCodeExecution:"block_code_execution",Promptguard:"promptguard",LlmAsAJudge:"llm_as_a_judge",Xecguard:"xecguard",QostodianNexus:"qostodian_nexus",Repelloai:"repelloai"},eo=e=>{Object.entries(e).forEach(([e,t])=>{t&&"object"==typeof t&&"ui_friendly_name"in t&&(en[e.split("_").map((e,t)=>e.charAt(0).toUpperCase()+e.slice(1)).join("")]=e)})},ed=e=>!!e&&"Presidio PII"===es()[e],ec=e=>!!e&&"LiteLLM Content Filter"===es()[e],em=e=>!!e&&"llm_as_a_judge"===en[e],eu="/ui/assets/logos/",ep={"Zscaler AI Guard":`${eu}zscaler.svg`,"Presidio PII":`${eu}microsoft_azure.svg`,"Bedrock Guardrail":`${eu}bedrock.svg`,Lakera:`${eu}lakeraai.jpeg`,"Azure Content Safety Prompt Shield":`${eu}microsoft_azure.svg`,"Azure Content Safety Text Moderation":`${eu}microsoft_azure.svg`,"Aporia AI":`${eu}aporia.png`,"PANW Prisma AIRS":`${eu}palo_alto_networks.jpeg`,"Cisco AI Defense":`${eu}cisco.png`,"Noma Security":`${eu}noma_security.png`,"Javelin Guardrails":`${eu}javelin.png`,"Pillar Guardrail":`${eu}pillar.jpeg`,"Google Cloud Model Armor":`${eu}google.svg`,"Guardrails AI":`${eu}guardrails_ai.jpeg`,"Lasso Guardrail":`${eu}lasso.png`,"Pangea Guardrail":`${eu}pangea.png`,"AIM Guardrail":`${eu}aim_security.jpeg`,"Cato Networks Guardrail":`${eu}cato_networks.svg`,"OpenAI Moderation":`${eu}openai_small.svg`,EnkryptAI:`${eu}enkrypt_ai.avif`,"Prompt Security":`${eu}prompt_security.png`,PromptGuard:`${eu}promptguard.svg`,XecGuard:`${eu}xecguard.svg`,"LiteLLM Content Filter":`${eu}litellm_logo.jpg`,"LiteLLM LLM as a Judge":`${eu}litellm_logo.jpg`,Akto:`${eu}akto.svg`,"Qostodian Nexus":`${eu}qohash.jpg`,"RepelloAI Argus":`${eu}repelloai.png`},eg=e=>{if(!e)return{logo:"",displayName:"-"};let t=Object.keys(en).find(t=>en[t].toLowerCase()===e.toLowerCase());if(!t)return{logo:"",displayName:e};let a=es()[t];return{logo:(0,ea.resolveLogoSrc)(ep[a])??"",displayName:a||e}};function ex(e){return!0===e?"yes":!1===e?"no":"inherit"}function eh(e){return!0===e?"yes":!1===e?"no":"inherit"}var ef=e.i(435451);let{Title:ey}=f.Typography,ej=({field:e,fieldKey:t,fullFieldKey:a,value:s})=>{let[n,o]=r.default.useState([]),[d,c]=r.default.useState(e.dict_key_options||[]);return r.default.useEffect(()=>{if(s&&"object"==typeof s){let t=Object.keys(s);o(t.map(e=>({key:e,id:`${e}_${Date.now()}_${Math.random()}`}))),c((e.dict_key_options||[]).filter(e=>!t.includes(e)))}},[s,e.dict_key_options]),(0,l.jsxs)("div",{className:"space-y-3",children:[n.map(t=>(0,l.jsxs)("div",{className:"flex items-center space-x-3 p-3 border rounded-lg",children:[(0,l.jsx)("div",{className:"w-24 font-medium text-sm",children:t.key}),(0,l.jsx)("div",{className:"flex-1",children:(0,l.jsx)(u.Form.Item,{name:Array.isArray(a)?[...a,t.key]:[a,t.key],style:{marginBottom:0},initialValue:s&&"object"==typeof s?s[t.key]:void 0,normalize:"number"===e.dict_value_type?e=>{if(null==e||""===e)return;let t=Number(e);return isNaN(t)?e:t}:void 0,children:"number"===e.dict_value_type?(0,l.jsx)(ef.default,{step:1,width:200,placeholder:`Enter ${t.key} value`}):"boolean"===e.dict_value_type?(0,l.jsxs)(x.Select,{placeholder:`Select ${t.key} value`,children:[(0,l.jsx)(x.Select.Option,{value:!0,children:"True"}),(0,l.jsx)(x.Select.Option,{value:!1,children:"False"})]}):(0,l.jsx)(p.Input,{placeholder:`Enter ${t.key} value`})})}),(0,l.jsx)(i.Button,{type:"text",danger:!0,size:"small",onClick:()=>{var e,a;return e=t.id,a=t.key,void(o(n.filter(t=>t.id!==e)),c([...d,a].sort()))},children:"Remove"})]},t.id)),d.length>0&&(0,l.jsxs)("div",{className:"flex items-center space-x-3 mt-2",children:[(0,l.jsx)(x.Select,{placeholder:"Select category to configure",style:{width:200},onSelect:e=>e&&void(!e||(o([...n,{key:e,id:`${e}_${Date.now()}`}]),c(d.filter(t=>t!==e)))),value:void 0,children:d.map(e=>(0,l.jsx)(x.Select.Option,{value:e,children:e},e))}),(0,l.jsx)("span",{className:"text-sm text-gray-500",children:"Select a category to add threshold configuration"})]})]})},e_=({optionalParams:e,parentFieldKey:t,values:a})=>e.fields&&0!==Object.keys(e.fields).length?(0,l.jsxs)("div",{className:"guardrail-optional-params",children:[(0,l.jsxs)("div",{className:"mb-8 pb-4 border-b border-gray-100",children:[(0,l.jsx)(ey,{level:3,className:"mb-2 font-semibold text-gray-900",children:"Optional Parameters"}),(0,l.jsx)("p",{className:"text-gray-600 text-sm",children:e.description||"Configure additional settings for this guardrail provider"})]}),(0,l.jsx)("div",{className:"space-y-8",children:Object.entries(e.fields).map(([e,r])=>{let i,s;return i=`${t}.${e}`,s=a?.[e],"dict"===r.type&&r.dict_key_options?(0,l.jsxs)("div",{className:"mb-8 p-6 bg-gray-50 rounded-lg border border-gray-200",children:[(0,l.jsx)("div",{className:"mb-4 font-medium text-gray-900 text-base",children:e}),(0,l.jsx)("p",{className:"text-sm text-gray-600 mb-4",children:r.description}),(0,l.jsx)(ej,{field:r,fieldKey:e,fullFieldKey:[t,e],value:s})]},i):(0,l.jsx)("div",{className:"mb-8 p-6 bg-white rounded-lg border border-gray-200 shadow-xs",children:(0,l.jsx)(u.Form.Item,{name:[t,e],label:(0,l.jsxs)("div",{className:"mb-2",children:[(0,l.jsx)("div",{className:"font-medium text-gray-900 text-base",children:e}),(0,l.jsx)("p",{className:"text-sm text-gray-600 mt-1",children:r.description})]}),rules:r.required?[{required:!0,message:`${e} is required`}]:void 0,className:"mb-0",initialValue:void 0!==s?s:r.default_value,normalize:"number"===r.type?e=>{if(null==e||""===e)return;let t=Number(e);return isNaN(t)?e:t}:void 0,children:"select"===r.type&&r.options?(0,l.jsx)(x.Select,{placeholder:r.description,children:r.options.map(e=>(0,l.jsx)(x.Select.Option,{value:e,children:e},e))}):"multiselect"===r.type&&r.options?(0,l.jsx)(x.Select,{mode:"multiple",placeholder:r.description,children:r.options.map(e=>(0,l.jsx)(x.Select.Option,{value:e,children:e},e))}):"bool"===r.type||"boolean"===r.type?(0,l.jsxs)(x.Select,{placeholder:r.description,children:[(0,l.jsx)(x.Select.Option,{value:!0,children:"True"}),(0,l.jsx)(x.Select.Option,{value:!1,children:"False"})]}):"number"===r.type?(0,l.jsx)(ef.default,{step:1,width:400,placeholder:r.description}):e.includes("password")||e.includes("secret")||e.includes("key")?(0,l.jsx)(p.Input.Password,{placeholder:r.description}):(0,l.jsx)(p.Input,{placeholder:r.description})})},i)})})]}):null;var eb=e.i(482725),ev=e.i(850627);let ew=({selectedProvider:e,accessToken:t,providerParams:a=null,value:i=null})=>{let[s,n]=(0,r.useState)(!1),[o,d]=(0,r.useState)(a),[c,g]=(0,r.useState)(null);if((0,r.useEffect)(()=>{if(a)return void d(a);let e=async()=>{if(t){n(!0),g(null);try{let e=await (0,m.getGuardrailProviderSpecificParams)(t);d(e),ei(e),eo(e)}catch(e){console.error("Error fetching provider params:",e),g("Failed to load provider parameters")}finally{n(!1)}}};a||e()},[t,a]),!e)return null;if(s)return(0,l.jsx)(eb.Spin,{tip:"Loading provider parameters..."});if(c)return(0,l.jsx)("div",{className:"text-red-500",children:c});let h=en[e]?.toLowerCase(),f=o&&o[h];if(!f||0===Object.keys(f).length)return(0,l.jsx)("div",{children:"No configuration fields available for this provider."});let y=new Set(["patterns","blocked_words","blocked_words_file","categories","severity_threshold","pattern_redaction_format","keyword_redaction_tag"]),j=ec(e),_=(e,t="",a)=>Object.entries(e).map(([e,r])=>{let s=t?`${t}.${e}`:e,n=a?a[e]:i?.[e];if("ui_friendly_name"===e||"optional_params"===e&&"nested"===r.type&&r.fields||j&&y.has(e))return null;if("nested"===r.type&&r.fields)return(0,l.jsxs)("div",{children:[(0,l.jsx)("div",{className:"mb-2 font-medium",children:e}),(0,l.jsx)("div",{className:"ml-4 border-l-2 border-gray-200 pl-4",children:_(r.fields,s,n)})]},s);let o=void 0!==n?n:r.default_value??("percentage"===r.type?.5:void 0);return(0,l.jsx)(u.Form.Item,{name:s,label:e,tooltip:r.description,rules:r.required?[{required:!0,message:`${e} is required`}]:void 0,initialValue:o,children:"select"===r.type&&r.options?(0,l.jsx)(x.Select,{placeholder:r.description,defaultValue:n||r.default_value,children:r.options.map(e=>(0,l.jsx)(x.Select.Option,{value:e,children:e},e))}):"multiselect"===r.type&&r.options?(0,l.jsx)(x.Select,{mode:"multiple",placeholder:r.description,defaultValue:n||r.default_value,children:r.options.map(e=>(0,l.jsx)(x.Select.Option,{value:e,children:e},e))}):"bool"===r.type||"boolean"===r.type?(0,l.jsxs)(x.Select,{placeholder:r.description,children:[(0,l.jsx)(x.Select.Option,{value:!0,children:"True"}),(0,l.jsx)(x.Select.Option,{value:!1,children:"False"})]}):"percentage"===r.type&&null!=r.min&&null!=r.max?(0,l.jsx)(ev.Slider,{min:r.min,max:r.max,step:r.step??.1,marks:{[r.min]:"0%",[(r.min+r.max)/2]:"50%",[r.max]:"100%"}}):"number"===r.type?(0,l.jsx)(ef.default,{step:1,width:400,placeholder:r.description,defaultValue:void 0!==n?Number(n):void 0}):e.includes("password")||e.includes("secret")||e.includes("key")?(0,l.jsx)(p.Input.Password,{placeholder:r.description,defaultValue:n||""}):(0,l.jsx)(p.Input,{placeholder:r.description,defaultValue:n||""})},s)});return(0,l.jsx)(l.Fragment,{children:_(f)})};var eN=e.i(592968),eC=e.i(750113);let eS=({availableModels:e,form:t})=>(0,l.jsxs)(l.Fragment,{children:[(0,l.jsxs)("div",{style:{background:"#f6ffed",border:"1px solid #b7eb8f",borderRadius:6,padding:"10px 14px",marginBottom:16,fontSize:13,color:"#389e0d"},children:["After each LLM response, the ",(0,l.jsx)("strong",{children:"Judge Model"})," scores it 0–100 against your criteria. If the weighted average falls below the threshold, the response is blocked (or logged)."]}),(0,l.jsx)(u.Form.Item,{name:"judge_model",label:(0,l.jsxs)("span",{children:["Judge Model ",(0,l.jsx)(eN.Tooltip,{title:"The LLM that reads each response and grades it. Pick a capable model — it never sees end-user data beyond what the LLM returned.",children:(0,l.jsx)(eC.QuestionCircleOutlined,{style:{color:"#8c8c8c"}})})]}),rules:[{required:!0,message:"Select a judge model"}],children:(0,l.jsx)(x.Select,{showSearch:!0,placeholder:"Select a model",options:e.map(e=>({label:e,value:e}))})}),(0,l.jsx)(u.Form.Item,{name:"overall_threshold",label:(0,l.jsxs)("span",{children:["Minimum Score to Pass ",(0,l.jsx)(eN.Tooltip,{title:"0–100. If the weighted average of criterion scores falls below this, the guardrail triggers. 80 is a good default.",children:(0,l.jsx)(eC.QuestionCircleOutlined,{style:{color:"#8c8c8c"}})})]}),initialValue:80,children:(0,l.jsx)(J.InputNumber,{min:0,max:100,addonAfter:"/ 100",style:{width:"100%"}})}),(0,l.jsx)(u.Form.Item,{name:"on_failure",label:(0,l.jsxs)("span",{children:["On Failure ",(0,l.jsx)(eN.Tooltip,{title:"Block: return HTTP 422 when the score is too low. Log: record the result but let the response through.",children:(0,l.jsx)(eC.QuestionCircleOutlined,{style:{color:"#8c8c8c"}})})]}),initialValue:"block",children:(0,l.jsxs)(x.Select,{children:[(0,l.jsx)(x.Select.Option,{value:"block",children:"Block (return 422)"}),(0,l.jsx)(x.Select.Option,{value:"log",children:"Log only"})]})}),(0,l.jsx)(u.Form.Item,{label:(0,l.jsxs)("span",{children:["Evaluation Criteria ",(0,l.jsx)(eN.Tooltip,{title:"Each criterion is something the judge checks. Weights must add up to 100%.",children:(0,l.jsx)(eC.QuestionCircleOutlined,{style:{color:"#8c8c8c"}})})]}),children:(0,l.jsx)(u.Form.List,{name:"criteria",initialValue:[{name:"",weight:100,description:""}],children:(e,{add:a,remove:r})=>(0,l.jsxs)(l.Fragment,{children:[e.map(({key:e,name:t,...a})=>(0,l.jsxs)("div",{style:{border:"1px solid #f0f0f0",borderRadius:6,padding:"12px 12px 0",marginBottom:8},children:[(0,l.jsxs)("div",{style:{display:"flex",gap:8,alignItems:"flex-end"},children:[(0,l.jsx)(u.Form.Item,{...a,name:[t,"name"],rules:[{required:!0,message:"Enter criterion name"}],style:{flex:2,marginBottom:8},children:(0,l.jsx)(p.Input,{placeholder:"Criterion name (e.g. Policy accuracy)"})}),(0,l.jsx)(u.Form.Item,{...a,name:[t,"weight"],label:(0,l.jsx)(eN.Tooltip,{title:"How much this criterion counts toward the final score. All weights must add up to 100%.",children:(0,l.jsxs)("span",{style:{fontSize:12,color:"#595959"},children:["Weight ",(0,l.jsx)(eC.QuestionCircleOutlined,{style:{color:"#bfbfbf"}})]})}),rules:[{required:!0,message:"Enter weight"}],style:{flex:1,marginBottom:8},children:(0,l.jsx)(J.InputNumber,{min:0,max:100,addonAfter:"%",style:{width:"100%"},placeholder:"e.g. 50"})}),(0,l.jsx)("div",{style:{marginBottom:8},children:(0,l.jsx)(i.Button,{type:"text",danger:!0,size:"small",onClick:()=>r(t),children:"×"})})]}),(0,l.jsx)(u.Form.Item,{...a,name:[t,"description"],rules:[{required:!0,message:"Describe what to check"}],style:{marginBottom:8},children:(0,l.jsx)(p.Input,{placeholder:"What should the judge check for this criterion?"})})]},e)),(0,l.jsx)(i.Button,{type:"dashed",block:!0,style:{marginTop:4},onClick:()=>a({name:"",weight:0,description:""}),icon:(0,l.jsx)(d.PlusOutlined,{}),children:"Add Criterion"}),e.length>0&&(0,l.jsx)(u.Form.Item,{shouldUpdate:!0,noStyle:!0,children:()=>{let e=(t.getFieldValue("criteria")||[]).reduce((e,t)=>e+(Number(t?.weight)||0),0),a=100===e;return(0,l.jsxs)("div",{style:{marginTop:6,fontSize:12,color:a?"#52c41a":"#faad14"},children:["Weights total: ",e,"%",a?" ✓":" — must add up to 100%"]})}})]})})})]});var ek=e.i(536916),eI=e.i(149192),eA=e.i(741585),eA=eA,eO=e.i(724154);e.i(247167);var eT=e.i(931067);let eP={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M880.1 154H143.9c-24.5 0-39.8 26.7-27.5 48L349 597.4V838c0 17.7 14.2 32 31.8 32h262.4c17.6 0 31.8-14.3 31.8-32V597.4L907.7 202c12.2-21.3-3.1-48-27.6-48zM603.4 798H420.6V642h182.9v156zm9.6-236.6l-9.5 16.6h-183l-9.5-16.6L212.7 226h598.6L613 561.4z"}}]},name:"filter",theme:"outlined"};var eL=e.i(9583),eB=r.forwardRef(function(e,t){return r.createElement(eL.default,(0,eT.default)({},e,{ref:t,icon:eP}))});let{Text:eF}=f.Typography,{Option:e$}=x.Select,eE=({categories:e,selectedCategories:t,onChange:a})=>(0,l.jsxs)("div",{children:[(0,l.jsxs)("div",{className:"flex items-center mb-2",children:[(0,l.jsx)(eB,{className:"text-gray-500 mr-1"}),(0,l.jsx)(eF,{className:"text-gray-500 font-medium",children:"Filter by category"})]}),(0,l.jsx)(x.Select,{mode:"multiple",placeholder:"Select categories to filter by",style:{width:"100%"},onChange:a,value:t,allowClear:!0,showSearch:!0,optionFilterProp:"children",className:"mb-4",tagRender:e=>(0,l.jsx)(h.Tag,{color:"blue",closable:e.closable,onClose:e.onClose,className:"mr-2 mb-2",children:e.label}),children:e.map(e=>(0,l.jsx)(e$,{value:e.category,children:e.category},e.category))})]}),eM=({onSelectAll:e,onUnselectAll:t,hasSelectedEntities:a})=>(0,l.jsxs)("div",{className:"bg-gray-50 p-5 rounded-lg mb-6 border border-gray-200 shadow-xs",children:[(0,l.jsxs)("div",{className:"flex items-center justify-between mb-4",children:[(0,l.jsxs)("div",{className:"flex items-center",children:[(0,l.jsx)(eF,{strong:!0,className:"text-gray-700 text-base",children:"Quick Actions"}),(0,l.jsx)(eN.Tooltip,{title:"Apply action to all PII types at once",children:(0,l.jsx)("div",{className:"ml-2 text-gray-400 cursor-help text-xs",children:"ⓘ"})})]}),(0,l.jsx)(i.Button,{color:"danger",variant:"outlined",onClick:t,disabled:!a,icon:(0,l.jsx)(eI.CloseOutlined,{}),children:"Unselect All"})]}),(0,l.jsxs)("div",{className:"grid grid-cols-2 gap-4",children:[(0,l.jsx)(i.Button,{color:"primary",variant:"outlined",onClick:()=>e("MASK"),className:"h-10",block:!0,icon:(0,l.jsx)(eA.default,{}),children:"Select All & Mask"}),(0,l.jsx)(i.Button,{color:"danger",variant:"outlined",onClick:()=>e("BLOCK"),className:"h-10 hover:bg-red-100",block:!0,icon:(0,l.jsx)(eO.StopOutlined,{}),children:"Select All & Block"})]})]}),eR=({entities:e,selectedEntities:t,selectedActions:a,actions:r,onEntitySelect:i,onActionSelect:s,entityToCategoryMap:n})=>(0,l.jsxs)("div",{className:"border rounded-lg overflow-hidden shadow-xs",children:[(0,l.jsxs)("div",{className:"bg-gray-50 px-5 py-3 border-b flex",children:[(0,l.jsx)(eF,{strong:!0,className:"flex-1 text-gray-700",children:"PII Type"}),(0,l.jsx)(eF,{strong:!0,className:"w-32 text-right text-gray-700",children:"Action"})]}),(0,l.jsx)("div",{className:"max-h-[400px] overflow-y-auto",children:0===e.length?(0,l.jsx)("div",{className:"py-10 text-center text-gray-500",children:"No PII types match your filter criteria"}):e.map(e=>(0,l.jsxs)("div",{className:`px-5 py-3 flex items-center justify-between hover:bg-gray-50 border-b ${t.includes(e)?"bg-blue-50":""}`,children:[(0,l.jsxs)("div",{className:"flex items-center flex-1",children:[(0,l.jsx)(ek.Checkbox,{checked:t.includes(e),onChange:()=>i(e),className:"mr-3"}),(0,l.jsx)(eF,{className:t.includes(e)?"font-medium text-gray-900":"text-gray-700",children:e.replace(/_/g," ")}),n.get(e)&&(0,l.jsx)(h.Tag,{className:"ml-2 text-xs",color:"blue",children:n.get(e)})]}),(0,l.jsx)("div",{className:"w-32",children:(0,l.jsx)(x.Select,{value:t.includes(e)&&a[e]||"MASK",onChange:t=>s(e,t),style:{width:120},disabled:!t.includes(e),className:`${!t.includes(e)?"opacity-50":""}`,dropdownMatchSelectWidth:!1,children:r.map(e=>(0,l.jsx)(e$,{value:e,children:(0,l.jsxs)("div",{className:"flex items-center",children:[(e=>{switch(e){case"MASK":return(0,l.jsx)(eA.default,{style:{marginRight:4}});case"BLOCK":return(0,l.jsx)(eO.StopOutlined,{style:{marginRight:4}});default:return null}})(e),e]})},e))})})]},e))})]}),{Title:eG,Text:ez}=f.Typography,eD=({entities:e,actions:t,selectedEntities:a,selectedActions:i,onEntitySelect:s,onActionSelect:n,entityCategories:o=[]})=>{let[d,c]=(0,r.useState)([]),m=new Map;o.forEach(e=>{e.entities.forEach(t=>{m.set(t,e.category)})});let u=e.filter(e=>0===d.length||d.includes(m.get(e)||""));return(0,l.jsxs)("div",{className:"pii-configuration",children:[(0,l.jsxs)("div",{className:"flex justify-between items-center mb-5",children:[(0,l.jsx)("div",{className:"flex items-center",children:(0,l.jsx)(eG,{level:4,className:"m-0! font-semibold text-gray-800",children:"Configure PII Protection"})}),(0,l.jsxs)(ez,{className:"text-gray-500",children:[a.length," items selected"]})]}),(0,l.jsxs)("div",{className:"mb-6",children:[(0,l.jsx)(eE,{categories:o,selectedCategories:d,onChange:c}),(0,l.jsx)(eM,{onSelectAll:t=>{e.forEach(e=>{a.includes(e)||s(e),n(e,t)})},onUnselectAll:()=>{a.forEach(e=>{s(e)})},hasSelectedEntities:a.length>0})]}),(0,l.jsx)(eR,{entities:u,selectedEntities:a,selectedActions:i,actions:t,onEntitySelect:s,onActionSelect:n,entityToCategoryMap:m})]})};var eK=e.i(304967),eq=e.i(599724),eH=e.i(312361),eU=e.i(21548),eJ=e.i(827252);let eW={rules:[],default_action:"deny",on_disallowed_action:"block",violation_message_template:""},eV=({value:e,onChange:t,disabled:a=!1})=>{let r={...eW,...e||{},rules:e?.rules?[...e.rules]:[]},s=e=>{let a={...r,...e};t?.(a)},n=(e,t)=>{s({rules:r.rules.map((a,l)=>l===e?{...a,...t}:a)})},o=(e,t)=>{let a=r.rules[e];if(!a)return;let l=Object.entries(a.allowed_param_patterns||{});t(l);let i={};l.forEach(([e,t])=>{i[e]=t}),n(e,{allowed_param_patterns:Object.keys(i).length>0?i:void 0})};return(0,l.jsxs)(eK.Card,{children:[(0,l.jsxs)("div",{className:"flex items-center justify-between",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"text-lg font-semibold",children:"LiteLLM Tool Permission Guardrail"}),(0,l.jsx)(eq.Text,{className:"text-sm text-gray-500",children:"Provide regex patterns (e.g., ^mcp__github_.*$) for tool names or types and optionally constrain payload fields."})]}),!a&&(0,l.jsx)(i.Button,{icon:(0,l.jsx)(d.PlusOutlined,{}),type:"primary",onClick:()=>{s({rules:[...r.rules,{id:`rule_${Math.random().toString(36).slice(2,8)}`,decision:"allow",allowed_param_patterns:void 0}]})},className:"bg-blue-600! text-white! hover:bg-blue-500!",children:"Add Rule"})]}),(0,l.jsx)(eH.Divider,{}),0===r.rules.length?(0,l.jsx)(eU.Empty,{description:"No tool rules added yet"}):(0,l.jsx)("div",{className:"space-y-4",children:r.rules.map((e,t)=>{let d;return(0,l.jsxs)(eK.Card,{className:"bg-gray-50",children:[(0,l.jsxs)("div",{className:"flex items-center justify-between mb-3",children:[(0,l.jsxs)(eq.Text,{className:"font-semibold",children:["Rule ",t+1]}),(0,l.jsx)(i.Button,{icon:(0,l.jsx)(L.DeleteOutlined,{}),danger:!0,type:"text",disabled:a,onClick:()=>{s({rules:r.rules.filter((e,a)=>a!==t)})},children:"Remove"})]}),(0,l.jsxs)("div",{className:"grid grid-cols-1 gap-4 md:grid-cols-2",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"text-sm font-medium",children:"Rule ID"}),(0,l.jsx)(p.Input,{disabled:a,placeholder:"unique_rule_id",value:e.id,onChange:e=>n(t,{id:e.target.value})})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"text-sm font-medium",children:"Tool Name (optional)"}),(0,l.jsx)(p.Input,{disabled:a,placeholder:"^mcp__github_.*$",value:e.tool_name??"",onChange:e=>n(t,{tool_name:""===e.target.value.trim()?void 0:e.target.value})})]})]}),(0,l.jsx)("div",{className:"grid grid-cols-1 gap-4 md:grid-cols-2 mt-4",children:(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"text-sm font-medium",children:"Tool Type (optional)"}),(0,l.jsx)(p.Input,{disabled:a,placeholder:"^function$",value:e.tool_type??"",onChange:e=>n(t,{tool_type:""===e.target.value.trim()?void 0:e.target.value})})]})}),(0,l.jsxs)("div",{className:"mt-4 flex flex-col gap-2",children:[(0,l.jsx)(eq.Text,{className:"text-sm font-medium",children:"Decision"}),(0,l.jsxs)(x.Select,{disabled:a,value:e.decision,style:{width:200},onChange:e=>n(t,{decision:e}),children:[(0,l.jsx)(x.Select.Option,{value:"allow",children:"Allow"}),(0,l.jsx)(x.Select.Option,{value:"deny",children:"Deny"})]})]}),(0,l.jsx)("div",{className:"mt-4",children:0===(d=Object.entries(e.allowed_param_patterns||{})).length?(0,l.jsx)(i.Button,{disabled:a,size:"small",onClick:()=>n(t,{allowed_param_patterns:{"":""}}),children:"+ Restrict tool arguments (optional)"}):(0,l.jsxs)("div",{className:"space-y-2",children:[(0,l.jsx)(eq.Text,{className:"text-sm text-gray-600",children:"Argument constraints (dot or array paths)"}),d.map(([r,s],n)=>(0,l.jsxs)(j.Space,{align:"start",children:[(0,l.jsx)(p.Input,{disabled:a,placeholder:"messages[0].content",value:r,onChange:e=>{var a;return a=e.target.value,void o(t,e=>{if(!e[n])return;let[,t]=e[n];e[n]=[a,t]})}}),(0,l.jsx)(p.Input,{disabled:a,placeholder:"^email@.*$",value:s,onChange:e=>{var a;return a=e.target.value,void o(t,e=>{if(!e[n])return;let[t]=e[n];e[n]=[t,a]})}}),(0,l.jsx)(i.Button,{disabled:a,icon:(0,l.jsx)(L.DeleteOutlined,{}),danger:!0,onClick:()=>o(t,e=>{e.splice(n,1)})})]},`${e.id||t}-${n}`)),(0,l.jsx)(i.Button,{disabled:a,size:"small",onClick:()=>n(t,{allowed_param_patterns:{...e.allowed_param_patterns||{},"":""}}),children:"+ Add another constraint"})]})})]},e.id||t)})}),(0,l.jsx)(eH.Divider,{}),(0,l.jsxs)("div",{className:"grid gap-4 md:grid-cols-2",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"text-sm font-medium",children:"Default action"}),(0,l.jsxs)(x.Select,{disabled:a,value:r.default_action,onChange:e=>s({default_action:e}),children:[(0,l.jsx)(x.Select.Option,{value:"allow",children:"Allow"}),(0,l.jsx)(x.Select.Option,{value:"deny",children:"Deny"})]})]}),(0,l.jsxs)("div",{children:[(0,l.jsxs)(eq.Text,{className:"text-sm font-medium flex items-center gap-1",children:["On disallowed action",(0,l.jsx)(eN.Tooltip,{title:"Block returns an error when a forbidden tool is invoked. Rewrite strips the tool call but lets the rest of the response continue.",children:(0,l.jsx)(eJ.InfoCircleOutlined,{})})]}),(0,l.jsxs)(x.Select,{disabled:a,value:r.on_disallowed_action,onChange:e=>s({on_disallowed_action:e}),children:[(0,l.jsx)(x.Select.Option,{value:"block",children:"Block"}),(0,l.jsx)(x.Select.Option,{value:"rewrite",children:"Rewrite"})]})]})]}),(0,l.jsxs)("div",{className:"mt-4",children:[(0,l.jsx)(eq.Text,{className:"text-sm font-medium",children:"Violation message (optional)"}),(0,l.jsx)(p.Input.TextArea,{disabled:a,rows:3,placeholder:"This violates our org policy...",value:r.violation_message_template,onChange:e=>s({violation_message_template:e.target.value})})]})]})},{Title:eY,Text:eQ,Link:eX}=f.Typography,{Option:eZ}=x.Select,e0={pre_call:"Before LLM Call - Runs before the LLM call and checks the input (Recommended)",during_call:"During LLM Call - Runs in parallel with the LLM call, with response held until check completes",post_call:"After LLM Call - Runs after the LLM call and checks only the output",logging_only:"Logging Only - Only runs on logging callbacks without affecting the LLM call",pre_mcp_call:"Before MCP Tool Call - Runs before MCP tool execution and validates tool calls",during_mcp_call:"During MCP Tool Call - Runs in parallel with MCP tool execution for monitoring"},e1=({visible:e,onClose:t,accessToken:a,onSuccess:s,preset:n})=>{let[o]=u.Form.useForm(),[d,c]=(0,r.useState)(!1),[f,j]=(0,r.useState)(null),[_,b]=(0,r.useState)(null),[v,w]=(0,r.useState)([]),[N,C]=(0,r.useState)({}),[S,k]=(0,r.useState)(0),[I,A]=(0,r.useState)(null),[O,T]=(0,r.useState)([]),[P,L]=(0,r.useState)(2),[B,F]=(0,r.useState)({}),[$,E]=(0,r.useState)([]),[M,R]=(0,r.useState)([]),[G,z]=(0,r.useState)([]),[D,K]=(0,r.useState)(""),[q,H]=(0,r.useState)(!1),[U,J]=(0,r.useState)(null),[W,V]=(0,r.useState)(""),[Y,Q]=(0,r.useState)(void 0),[X,Z]=(0,r.useState)("warn"),[ee,el]=(0,r.useState)(""),[er,eu]=(0,r.useState)(!1),[eg,ex]=(0,r.useState)([]),[eh,ef]=(0,r.useState)({rules:[],default_action:"deny",on_disallowed_action:"block",violation_message_template:""}),ey=(0,r.useMemo)(()=>!!f&&"tool_permission"===(en[f]||"").toLowerCase(),[f]);(0,r.useEffect)(()=>{a&&(async()=>{try{let[e,t,l]=await Promise.all([(0,m.getGuardrailUISettings)(a),(0,m.getGuardrailProviderSpecificParams)(a),(0,m.modelAvailableCall)(a,"","").catch(()=>null)]);b(e),A(t),l?.data&&ex(l.data.map(e=>e.id)),ei(t),eo(t)}catch(e){console.error("Error fetching guardrail data:",e),y.default.fromBackend("Failed to load guardrail configuration")}})()},[a]),(0,r.useEffect)(()=>{if(!n||!e||!_)return;j(n.provider);let t={provider:n.provider,guardrail_name:n.guardrailNameSuggestion,mode:n.mode,default_on:n.defaultOn,skip_system_message_choice:"inherit",skip_tool_message_choice:"inherit"};if("BlockCodeExecution"===n.provider&&(t.confidence_threshold=.5),o.setFieldsValue(t),n.categoryName&&_.content_filter_settings?.content_categories){let e=_.content_filter_settings.content_categories.find(e=>e.name===n.categoryName);e&&z([{id:`category-${Date.now()}`,category:e.name,display_name:e.display_name,action:e.default_action,severity_threshold:"medium"}])}},[n,e,_]);let ej=e=>{j(e);let t={config:void 0,presidio_analyzer_api_base:void 0,presidio_anonymizer_api_base:void 0};"BlockCodeExecution"===e&&(t.confidence_threshold=.5),o.setFieldsValue(t),w([]),C({}),T([]),L(2),F({}),E([]),R([]),z([]),K(""),H(!1),J(null),ef({rules:[],default_action:"deny",on_disallowed_action:"block",violation_message_template:""}),"LlmAsAJudge"===e&&o.setFieldsValue({mode:"post_call"})},eb=e=>{w(t=>t.includes(e)?t.filter(t=>t!==e):[...t,e])},ev=(e,t)=>{C(a=>({...a,[e]:t}))},eN=async()=>{try{if(0===S&&(await o.validateFields(["guardrail_name","provider","mode","default_on"]),f)){let e=["guardrail_name","provider","mode","default_on"];"PresidioPII"===f&&e.push("presidio_analyzer_api_base","presidio_anonymizer_api_base"),await o.validateFields(e)}if(1===S&&ed(f)&&0===v.length)return void y.default.fromBackend("Please select at least one PII entity to continue");k(S+1)}catch(e){console.error("Form validation failed:",e)}},eC=()=>{o.resetFields(),j(null),w([]),C({}),T([]),L(2),F({}),E([]),R([]),z([]),K(""),ef({rules:[],default_action:"deny",on_disallowed_action:"block",violation_message_template:""}),V(""),Q(void 0),Z("warn"),el(""),eu(!1),k(0)},ek=()=>{eC(),t()},eI=async()=>{try{var e,l;c(!0),await o.validateFields();let r=o.getFieldsValue(!0),i=en[r.provider],n={guardrail_name:r.guardrail_name,litellm_params:{guardrail:i,mode:r.mode,default_on:r.default_on},guardrail_info:{}},d=(e=r.skip_system_message_choice,"yes"===e||"no"!==e&&void 0);void 0!==d&&(n.litellm_params.skip_system_message_in_guardrail=d);let u=(l=r.skip_tool_message_choice,"yes"===l||"no"!==l&&void 0);if(void 0!==u&&(n.litellm_params.skip_tool_message_in_guardrail=u),"PresidioPII"===r.provider&&v.length>0){let e={};v.forEach(t=>{e[t]=N[t]||"MASK"}),n.litellm_params.pii_entities_config=e,r.presidio_analyzer_api_base&&(n.litellm_params.presidio_analyzer_api_base=r.presidio_analyzer_api_base),r.presidio_anonymizer_api_base&&(n.litellm_params.presidio_anonymizer_api_base=r.presidio_anonymizer_api_base)}if(ec(r.provider)){let e=q&&U?.brand_self?.length>0;if(0===$.length&&0===M.length&&0===G.length&&!e){y.default.fromBackend("Please configure at least one content filter setting (category, pattern, keyword, or competitor intent)"),c(!1);return}$.length>0&&(n.litellm_params.patterns=$.map(e=>({pattern_type:"prebuilt"===e.type?"prebuilt":"regex",pattern_name:"prebuilt"===e.type?e.name:void 0,pattern:"custom"===e.type?e.pattern:void 0,name:e.name,action:e.action}))),M.length>0&&(n.litellm_params.blocked_words=M.map(e=>({keyword:e.keyword,action:e.action,description:e.description}))),G.length>0&&(n.litellm_params.categories=G.map(e=>({category:e.category,enabled:!0,action:e.action,severity_threshold:e.severity_threshold||"medium"}))),q&&U?.brand_self?.length>0&&(n.litellm_params.competitor_intent_config={competitor_intent_type:U.competitor_intent_type??"airline",brand_self:U.brand_self,locations:U.locations?.length>0?U.locations:void 0,competitors:"generic"===U.competitor_intent_type&&U.competitors?.length>0?U.competitors:void 0,policy:U.policy,threshold_high:U.threshold_high,threshold_medium:U.threshold_medium,threshold_low:U.threshold_low})}else if(r.config)try{n.guardrail_info=JSON.parse(r.config)}catch(e){y.default.fromBackend("Invalid JSON in configuration"),c(!1);return}if("llm_as_a_judge"===i){let e=r.criteria||[];if(0===e.length){y.default.fromBackend("Add at least one evaluation criterion"),c(!1);return}let t=e.reduce((e,t)=>e+(Number(t?.weight)||0),0);if(100!==t){y.default.fromBackend(`Criterion weights must sum to 100% (currently ${t}%)`),c(!1);return}n.litellm_params.judge_model=r.judge_model,n.litellm_params.overall_threshold=r.overall_threshold??80,n.litellm_params.on_failure=r.on_failure??"block",n.litellm_params.criteria=e.map(e=>({name:e.name,weight:Number(e.weight),description:e.description||""}))}if("tool_permission"===i){if(0===eh.rules.length){y.default.fromBackend("Add at least one tool permission rule"),c(!1);return}n.litellm_params.rules=eh.rules,n.litellm_params.default_action=eh.default_action,n.litellm_params.on_disallowed_action=eh.on_disallowed_action,eh.violation_message_template&&(n.litellm_params.violation_message_template=eh.violation_message_template)}if(ec(r.provider)&&(void 0!==Y&&Y>0&&(n.litellm_params.end_session_after_n_fails=Y),X&&"realtime"===W&&(n.litellm_params.on_violation=X),ee.trim()&&(n.litellm_params.realtime_violation_message=ee.trim())),I&&f&&"llm_as_a_judge"!==i){let e=I[en[f]?.toLowerCase()]||{},t=new Set;Object.keys(e).forEach(e=>{"optional_params"!==e&&t.add(e)}),e.optional_params&&e.optional_params.fields&&Object.keys(e.optional_params.fields).forEach(e=>{t.add(e)}),t.forEach(e=>{let t=r[e];(null==t||""===t)&&(t=r.optional_params?.[e]),null!=t&&""!==t&&(n.litellm_params[e]=t)})}if(!a)throw Error("No access token available");await (0,m.createGuardrailCall)(a,n),y.default.success("Guardrail created successfully"),eC(),s(),t()}catch(e){console.error("Failed to create guardrail:",e),y.default.fromBackend("Failed to create guardrail: "+(e instanceof Error?e.message:String(e)))}finally{c(!1)}},eA=e=>{if(!_||!ec(f))return null;let t=_.content_filter_settings;return t?(0,l.jsx)(et,{prebuiltPatterns:t.prebuilt_patterns||[],categories:t.pattern_categories||[],selectedPatterns:$,blockedWords:M,onPatternAdd:e=>E([...$,e]),onPatternRemove:e=>E($.filter(t=>t.id!==e)),onPatternActionChange:(e,t)=>{E($.map(a=>a.id===e?{...a,action:t}:a))},onBlockedWordAdd:e=>R([...M,e]),onBlockedWordRemove:e=>R(M.filter(t=>t.id!==e)),onBlockedWordUpdate:(e,t,a)=>{R(M.map(l=>l.id===e?{...l,[t]:a}:l))},contentCategories:t.content_categories||[],selectedContentCategories:G,onContentCategoryAdd:e=>z([...G,e]),onContentCategoryRemove:e=>z(G.filter(t=>t.id!==e)),onContentCategoryUpdate:(e,t,a)=>{z(G.map(l=>l.id===e?{...l,[t]:a}:l))},pendingCategorySelection:D,onPendingCategorySelectionChange:K,accessToken:a,showStep:e,competitorIntentEnabled:q,competitorIntentConfig:U,onCompetitorIntentChange:(e,t)=>{H(e),J(t)}}):null},eO=ec(f)?[{title:"Basic Info",optional:!1},{title:"Topics",optional:!1},{title:"Patterns",optional:!1},{title:"Keywords",optional:!1},{title:"Endpoint Settings (Optional)",optional:!0}]:ed(f)?[{title:"Basic Info",optional:!1},{title:"PII Configuration",optional:!1}]:[{title:"Basic Info",optional:!1},{title:"Provider Configuration",optional:!1}];return(0,l.jsx)(g.Modal,{title:null,open:e,onCancel:ek,maskClosable:!1,footer:null,width:1e3,closable:!1,className:"top-8",styles:{body:{padding:0}},children:(0,l.jsxs)("div",{className:"flex flex-col",children:[(0,l.jsxs)("div",{className:"flex items-center justify-between px-6 py-4 border-b border-gray-200",children:[(0,l.jsx)("h3",{className:"text-base font-semibold text-gray-900 m-0",children:"Create guardrail"}),(0,l.jsx)("button",{onClick:ek,className:"text-gray-400 hover:text-gray-600 bg-transparent border-none cursor-pointer text-base leading-none p-1",children:"✕"})]}),(0,l.jsx)("div",{className:"overflow-auto px-6 py-4",style:{maxHeight:"calc(80vh - 120px)"},children:(0,l.jsx)(u.Form,{form:o,layout:"vertical",initialValues:{mode:"pre_call",default_on:!1,skip_system_message_choice:"inherit",skip_tool_message_choice:"inherit"},children:eO.map((e,t)=>{let r=t{r&&k(t)},style:{minHeight:24},children:[(0,l.jsx)("span",{className:"text-sm",style:{fontWeight:i?600:500,color:i?"#1e293b":r?"#4f46e5":"#94a3b8"},children:e.title}),e.optional&&!i&&(0,l.jsx)("span",{className:"text-[11px] text-slate-400",children:"optional"}),r&&(0,l.jsx)("span",{className:"text-[11px] text-indigo-500 hover:underline",children:"Edit"})]}),i&&(0,l.jsx)("div",{className:"mt-3",children:(()=>{switch(S){case 0:return(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(u.Form.Item,{name:"guardrail_name",label:"Guardrail Name",rules:[{required:!0,message:"Please enter a guardrail name"}],children:(0,l.jsx)(p.Input,{placeholder:"Enter a name for this guardrail"})}),(0,l.jsx)(u.Form.Item,{name:"provider",label:"Guardrail Provider",rules:[{required:!0,message:"Please select a provider"}],children:(0,l.jsx)(x.Select,{placeholder:"Select a guardrail provider",onChange:ej,labelInValue:!1,optionLabelProp:"label",dropdownRender:e=>e,showSearch:!0,children:Object.entries(es()).map(([e,t])=>(0,l.jsx)(eZ,{value:e,label:(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center"},children:[ep[t]&&(0,l.jsx)("img",{src:(0,ea.resolveLogoSrc)(ep[t]),alt:"",style:{height:"20px",width:"20px",marginRight:"8px",objectFit:"contain"},onError:e=>{e.currentTarget.style.display="none"}}),(0,l.jsx)("span",{children:t})]}),children:(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center"},children:[ep[t]&&(0,l.jsx)("img",{src:(0,ea.resolveLogoSrc)(ep[t]),alt:"",style:{height:"20px",width:"20px",marginRight:"8px",objectFit:"contain"},onError:e=>{e.currentTarget.style.display="none"}}),(0,l.jsx)("span",{children:t})]})},e))})}),(0,l.jsx)(u.Form.Item,{name:"mode",label:"Mode",tooltip:"How the guardrail should be applied",rules:[{required:!0,message:"Please select a mode"}],children:(0,l.jsx)(x.Select,{optionLabelProp:"label",mode:"multiple",children:_?.supported_modes?.map(e=>(0,l.jsx)(eZ,{value:e,label:e,children:(0,l.jsxs)("div",{children:[(0,l.jsxs)("div",{children:[(0,l.jsx)("strong",{children:e}),"pre_call"===e&&(0,l.jsx)(h.Tag,{color:"green",style:{marginLeft:"8px"},children:"Recommended"})]}),(0,l.jsx)("div",{style:{fontSize:"12px",color:"#888"},children:e0[e]})]})},e))||(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(eZ,{value:"pre_call",label:"pre_call",children:(0,l.jsxs)("div",{children:[(0,l.jsxs)("div",{children:[(0,l.jsx)("strong",{children:"pre_call"})," ",(0,l.jsx)(h.Tag,{color:"green",children:"Recommended"})]}),(0,l.jsx)("div",{style:{fontSize:"12px",color:"#888"},children:e0.pre_call})]})}),(0,l.jsx)(eZ,{value:"during_call",label:"during_call",children:(0,l.jsxs)("div",{children:[(0,l.jsx)("div",{children:(0,l.jsx)("strong",{children:"during_call"})}),(0,l.jsx)("div",{style:{fontSize:"12px",color:"#888"},children:e0.during_call})]})}),(0,l.jsx)(eZ,{value:"post_call",label:"post_call",children:(0,l.jsxs)("div",{children:[(0,l.jsx)("div",{children:(0,l.jsx)("strong",{children:"post_call"})}),(0,l.jsx)("div",{style:{fontSize:"12px",color:"#888"},children:e0.post_call})]})}),(0,l.jsx)(eZ,{value:"logging_only",label:"logging_only",children:(0,l.jsxs)("div",{children:[(0,l.jsx)("div",{children:(0,l.jsx)("strong",{children:"logging_only"})}),(0,l.jsx)("div",{style:{fontSize:"12px",color:"#888"},children:e0.logging_only})]})})]})})}),(0,l.jsx)(u.Form.Item,{name:"default_on",label:"Always On",tooltip:"If enabled, this guardrail will be applied to all requests by default.",children:(0,l.jsxs)(x.Select,{children:[(0,l.jsx)(x.Select.Option,{value:!0,children:"Yes"}),(0,l.jsx)(x.Select.Option,{value:!1,children:"No"})]})}),(0,l.jsx)(u.Form.Item,{name:"skip_system_message_choice",label:"Skip system messages in guardrail",tooltip:"Unified guardrails only: omit role: system from guardrail evaluation input (OpenAI chat + Anthropic messages). The model still receives full messages. Use global default follows litellm_settings.skip_system_message_in_guardrail.",children:(0,l.jsxs)(x.Select,{children:[(0,l.jsx)(x.Select.Option,{value:"inherit",children:"Use global default"}),(0,l.jsx)(x.Select.Option,{value:"yes",children:"Yes — exclude from guardrail scan"}),(0,l.jsx)(x.Select.Option,{value:"no",children:"No — always include in scan"})]})}),(0,l.jsx)(u.Form.Item,{name:"skip_tool_message_choice",label:"Skip tool messages in guardrail",tooltip:"Unified guardrails only: omit role: tool from guardrail evaluation input (OpenAI chat + Anthropic messages). The model still receives full messages. Use global default follows litellm_settings.skip_tool_message_in_guardrail.",children:(0,l.jsxs)(x.Select,{children:[(0,l.jsx)(x.Select.Option,{value:"inherit",children:"Use global default"}),(0,l.jsx)(x.Select.Option,{value:"yes",children:"Yes — exclude from guardrail scan"}),(0,l.jsx)(x.Select.Option,{value:"no",children:"No — always include in scan"})]})}),!ey&&!ec(f)&&!em(f)&&(0,l.jsx)(ew,{selectedProvider:f,accessToken:a,providerParams:I})]});case 1:if(ed(f))return _&&"PresidioPII"===f?(0,l.jsx)(eD,{entities:_.supported_entities,actions:_.supported_actions,selectedEntities:v,selectedActions:N,onEntitySelect:eb,onActionSelect:ev,entityCategories:_.pii_entity_categories}):null;if(ec(f))return eA("categories");if(em(f))return(0,l.jsx)(eS,{availableModels:eg,form:o});if(!f)return null;if(ey)return(0,l.jsx)(eV,{value:eh,onChange:ef});if(!I)return null;let e=en[f]?.toLowerCase(),t=I&&I[e];return t&&t.optional_params?(0,l.jsx)(e_,{optionalParams:t.optional_params,parentFieldKey:"optional_params"}):null;case 2:if(ec(f))return eA("patterns");return null;case 3:if(ec(f))return eA("keywords");return null;case 4:return(0,l.jsxs)("div",{className:"space-y-6",children:[(0,l.jsx)("div",{children:(0,l.jsxs)("p",{className:"text-sm text-gray-500",children:["Configure settings for a specific call type. Most guardrails don't need this — skip it unless you're using a specific endpoint like ",(0,l.jsx)("code",{children:"/v1/realtime"}),"."]})}),(0,l.jsxs)("div",{children:[(0,l.jsx)("label",{className:"block text-sm font-medium text-gray-700 mb-1",children:"Call type"}),(0,l.jsx)(x.Select,{placeholder:"Select a call type",value:W||void 0,onChange:e=>{V(e),eu(!1)},style:{width:260},allowClear:!0,options:[{value:"realtime",label:"/v1/realtime"}]}),(0,l.jsx)("p",{className:"text-xs text-gray-400 mt-1",children:"More call types coming soon."})]}),"realtime"===W&&(0,l.jsxs)("div",{className:"border border-gray-200 rounded-lg overflow-hidden",children:[(0,l.jsxs)("button",{type:"button",onClick:()=>eu(e=>!e),className:"w-full flex items-center justify-between px-4 py-3 bg-gray-50 hover:bg-gray-100 text-sm font-medium text-gray-700",children:[(0,l.jsx)("span",{children:"/v1/realtime settings"}),(0,l.jsx)("svg",{className:`w-4 h-4 text-gray-500 transition-transform ${er?"rotate-180":""}`,fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",strokeWidth:2,children:(0,l.jsx)("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 9l-7 7-7-7"})})]}),er&&(0,l.jsxs)("div",{className:"space-y-5 px-4 py-4 border-t border-gray-200",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)("label",{className:"block text-sm font-medium text-gray-700 mb-1",children:"End session after X violations"}),(0,l.jsx)("p",{className:"text-xs text-gray-400 mb-2",children:"Automatically close the session after this many guardrail violations. Leave empty to never auto-close."}),(0,l.jsx)("input",{type:"number",min:1,placeholder:"e.g. 3",value:Y??"",onChange:e=>Q(e.target.value?parseInt(e.target.value,10):void 0),className:"border border-gray-300 rounded-sm px-3 py-1.5 text-sm w-32"})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)("label",{className:"block text-sm font-medium text-gray-700 mb-2",children:"On violation"}),(0,l.jsx)("div",{className:"space-y-2",children:["warn","end_session"].map(e=>(0,l.jsxs)("label",{className:"flex items-start gap-2 cursor-pointer",children:[(0,l.jsx)("input",{type:"radio",name:"on_violation",value:e,checked:X===e,onChange:()=>Z(e),className:"mt-0.5"}),(0,l.jsxs)("div",{children:[(0,l.jsx)("span",{className:"text-sm font-medium text-gray-800",children:"warn"===e?"Warn":"End session"}),(0,l.jsx)("p",{className:"text-xs text-gray-400 m-0",children:"warn"===e?"Bot speaks the message, session continues":"Bot speaks the message, connection closes immediately"})]})]},e))})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)("label",{className:"block text-sm font-medium text-gray-700 mb-1",children:"Message the user hears"}),(0,l.jsx)("p",{className:"text-xs text-gray-400 mb-2",children:"What the bot says aloud when this guardrail fires. Falls back to the default violation message if empty."}),(0,l.jsx)("textarea",{rows:3,placeholder:"e.g. I'm not able to continue this conversation. Please contact us at 1-800-774-2678.",value:ee,onChange:e=>el(e.target.value),className:"border border-gray-300 rounded-sm px-3 py-2 text-sm w-full resize-none"})]})]})]})]});default:return null}})()})]})]},t)})})}),(0,l.jsxs)("div",{className:"flex items-center justify-end space-x-3 px-6 py-3 border-t border-gray-200",children:[(0,l.jsx)(i.Button,{onClick:ek,children:"Cancel"}),S>0&&(0,l.jsx)(i.Button,{onClick:()=>{k(S-1)},children:"Previous"}),S{let[d]=u.Form.useForm(),[c,h]=(0,r.useState)(!1),[f,j]=(0,r.useState)(o?.provider||null),[_,b]=(0,r.useState)(null),[v,w]=(0,r.useState)([]),[N,C]=(0,r.useState)({});(0,r.useEffect)(()=>{(async()=>{try{if(!a)return;let e=await (0,m.getGuardrailUISettings)(a);b(e)}catch(e){console.error("Error fetching guardrail settings:",e),y.default.fromBackend("Failed to load guardrail settings")}})()},[a]),(0,r.useEffect)(()=>{o?.pii_entities_config&&Object.keys(o.pii_entities_config).length>0&&(w(Object.keys(o.pii_entities_config)),C(o.pii_entities_config))},[o]);let S=e=>{w(t=>t.includes(e)?t.filter(t=>t!==e):[...t,e])},k=(e,t)=>{C(a=>({...a,[e]:t}))},I=async()=>{try{h(!0);let e=await d.validateFields(),l=en[e.provider],r=n&&"object"==typeof n?{...n}:{};r.guardrail=l,r.mode=e.mode,r.default_on=e.default_on;let o=e.skip_system_message_choice;"yes"===o?r.skip_system_message_in_guardrail=!0:"no"===o?r.skip_system_message_in_guardrail=!1:delete r.skip_system_message_in_guardrail;let c=e.skip_tool_message_choice;"yes"===c?r.skip_tool_message_in_guardrail=!0:"no"===c?r.skip_tool_message_in_guardrail=!1:delete r.skip_tool_message_in_guardrail;let u={};if("PresidioPII"===e.provider&&v.length>0){let e={};v.forEach(t=>{e[t]=N[t]||"MASK"}),r.pii_entities_config=e}else if(e.config)try{let t=JSON.parse(e.config);"Bedrock"===e.provider&&t?(t.guardrail_id&&(r.guardrailIdentifier=t.guardrail_id),t.guardrail_version&&(r.guardrailVersion=t.guardrail_version)):u=t}catch(e){y.default.fromBackend("Invalid JSON in configuration"),h(!1);return}let p={guardrail_id:s,guardrail:{guardrail_name:e.guardrail_name,litellm_params:r,guardrail_info:u}};if(!a)throw Error("No access token available");let g=`/guardrails/${s}`,x=await fetch(g,{method:"PUT",headers:{[(0,m.getGlobalLitellmHeaderName)()]:`Bearer ${a}`,"Content-Type":"application/json"},body:JSON.stringify(p)});if(!x.ok){let e=await x.text();throw Error(e||"Failed to update guardrail")}y.default.success("Guardrail updated successfully"),i(),t()}catch(e){console.error("Failed to update guardrail:",e),y.default.fromBackend("Failed to update guardrail: "+(e instanceof Error?e.message:String(e)))}finally{h(!1)}};return(0,l.jsx)(g.Modal,{title:"Edit Guardrail",open:e,onCancel:t,footer:null,width:700,children:(0,l.jsxs)(u.Form,{form:d,layout:"vertical",initialValues:o,children:[(0,l.jsx)(u.Form.Item,{name:"guardrail_name",label:"Guardrail Name",rules:[{required:!0,message:"Please enter a guardrail name"}],children:(0,l.jsx)(tn.TextInput,{placeholder:"Enter a name for this guardrail"})}),(0,l.jsx)(u.Form.Item,{name:"provider",label:"Guardrail Provider",rules:[{required:!0,message:"Please select a provider"}],children:(0,l.jsx)(x.Select,{placeholder:"Select a guardrail provider",onChange:e=>{j(e),d.setFieldsValue({config:void 0}),w([]),C({})},disabled:!0,optionLabelProp:"label",children:Object.entries(es()).map(([e,t])=>(0,l.jsx)(tc,{value:e,label:t,children:(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center"},children:[ep[t]&&(0,l.jsx)("img",{src:(0,ea.resolveLogoSrc)(ep[t]),alt:"",style:{height:"20px",width:"20px",marginRight:"8px",objectFit:"contain"},onError:e=>{e.currentTarget.style.display="none"}}),(0,l.jsx)("span",{children:t})]})},e))})}),(0,l.jsx)(u.Form.Item,{name:"mode",label:"Mode",tooltip:"How the guardrail should be applied",rules:[{required:!0,message:"Please select a mode"}],children:(0,l.jsx)(x.Select,{children:_?.supported_modes?.map(e=>(0,l.jsx)(tc,{value:e,children:e},e))||(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(tc,{value:"pre_call",children:"pre_call"}),(0,l.jsx)(tc,{value:"post_call",children:"post_call"})]})})}),(0,l.jsx)(u.Form.Item,{name:"default_on",label:"Always On",tooltip:"If enabled, this guardrail will be applied to all requests by default",valuePropName:"checked",children:(0,l.jsx)(U.Switch,{})}),(0,l.jsx)(u.Form.Item,{name:"skip_system_message_choice",label:"Skip system messages in guardrail",tooltip:"Unified guardrails only: whether role: system content is omitted from guardrail input (LLM still receives full messages). Use global default follows litellm_settings.skip_system_message_in_guardrail.",children:(0,l.jsxs)(x.Select,{children:[(0,l.jsx)(tc,{value:"inherit",children:"Use global default"}),(0,l.jsx)(tc,{value:"yes",children:"Yes — exclude from guardrail scan"}),(0,l.jsx)(tc,{value:"no",children:"No — always include in scan"})]})}),(0,l.jsx)(u.Form.Item,{name:"skip_tool_message_choice",label:"Skip tool messages in guardrail",tooltip:"Unified guardrails only: whether role: tool content is omitted from guardrail input (LLM still receives full messages). Use global default follows litellm_settings.skip_tool_message_in_guardrail.",children:(0,l.jsxs)(x.Select,{children:[(0,l.jsx)(tc,{value:"inherit",children:"Use global default"}),(0,l.jsx)(tc,{value:"yes",children:"Yes — exclude from guardrail scan"}),(0,l.jsx)(tc,{value:"no",children:"No — always include in scan"})]})}),(()=>{if(!f)return null;if("PresidioPII"===f)return _&&f&&"PresidioPII"===f?(0,l.jsx)(eD,{entities:_.supported_entities,actions:_.supported_actions,selectedEntities:v,selectedActions:N,onEntitySelect:S,onActionSelect:k,entityCategories:_.pii_entity_categories}):null;switch(f){case"Aporia":return(0,l.jsx)(u.Form.Item,{label:"Aporia Configuration",name:"config",tooltip:"JSON configuration for Aporia",children:(0,l.jsx)(p.Input.TextArea,{rows:4,placeholder:`{ - "api_key": "your_aporia_api_key", - "project_name": "your_project_name" -}`})});case"AimSecurity":return(0,l.jsx)(u.Form.Item,{label:"Aim Security Configuration",name:"config",tooltip:"JSON configuration for Aim Security",children:(0,l.jsx)(p.Input.TextArea,{rows:4,placeholder:`{ - "api_key": "your_aim_api_key" -}`})});case"Bedrock":return(0,l.jsx)(u.Form.Item,{label:"Amazon Bedrock Configuration",name:"config",tooltip:"JSON configuration for Amazon Bedrock guardrails",children:(0,l.jsx)(p.Input.TextArea,{rows:4,placeholder:`{ - "guardrail_id": "your_guardrail_id", - "guardrail_version": "your_guardrail_version" -}`})});case"CatoNetworks":return(0,l.jsx)(u.Form.Item,{label:"Cato Networks Configuration",name:"config",tooltip:"JSON configuration for Cato Networks",children:(0,l.jsx)(p.Input.TextArea,{rows:4,placeholder:`{ - "api_key": "your_cato_api_key" -}`})});case"GuardrailsAI":return(0,l.jsx)(u.Form.Item,{label:"Guardrails.ai Configuration",name:"config",tooltip:"JSON configuration for Guardrails.ai",children:(0,l.jsx)(p.Input.TextArea,{rows:4,placeholder:`{ - "api_key": "your_guardrails_api_key", - "guardrail_id": "your_guardrail_id" -}`})});case"LakeraAI":return(0,l.jsx)(u.Form.Item,{label:"Lakera AI Configuration",name:"config",tooltip:"JSON configuration for Lakera AI",children:(0,l.jsx)(p.Input.TextArea,{rows:4,placeholder:`{ - "api_key": "your_lakera_api_key" -}`})});case"PromptInjection":return(0,l.jsx)(u.Form.Item,{label:"Prompt Injection Configuration",name:"config",tooltip:"JSON configuration for prompt injection detection",children:(0,l.jsx)(p.Input.TextArea,{rows:4,placeholder:`{ - "threshold": 0.8 -}`})});default:return(0,l.jsx)(u.Form.Item,{label:"Custom Configuration",name:"config",tooltip:"JSON configuration for your custom guardrail",children:(0,l.jsx)(p.Input.TextArea,{rows:4,placeholder:`{ - "key1": "value1", - "key2": "value2" -}`})})}})(),(0,l.jsxs)("div",{className:"flex justify-end space-x-2 mt-4",children:[(0,l.jsx)(e9.Button,{variant:"secondary",onClick:t,children:"Cancel"}),(0,l.jsx)(e9.Button,{onClick:I,loading:c,children:"Update Guardrail"})]})]})})};var tu=((a={}).DB="db",a.CONFIG="config",a);let tp=({guardrailsList:e,isLoading:t,onDeleteClick:a,accessToken:i,onGuardrailUpdated:s,isAdmin:n=!1,onGuardrailClick:o})=>{let[d,c]=(0,r.useState)([{id:"created_at",desc:!0}]),[m,u]=(0,r.useState)(!1),[p,g]=(0,r.useState)(null),x=e=>e?new Date(e).toLocaleString():"-",h=[{header:"Guardrail ID",accessorKey:"guardrail_id",cell:e=>(0,l.jsx)(eN.Tooltip,{title:String(e.getValue()||""),children:(0,l.jsx)(e9.Button,{size:"xs",variant:"light",className:"font-mono text-blue-500 bg-blue-50 hover:bg-blue-100 text-xs font-normal px-2 py-0.5 text-left overflow-hidden truncate max-w-[200px]",onClick:()=>e.getValue()&&o(e.getValue()),children:e.getValue()?`${String(e.getValue()).slice(0,7)}...`:""})})},{header:"Name",accessorKey:"guardrail_name",cell:({row:e})=>{let t=e.original;return(0,l.jsx)(eN.Tooltip,{title:t.guardrail_name,children:(0,l.jsx)("span",{className:"text-xs font-medium",children:t.guardrail_name||"-"})})}},{header:"Provider",accessorKey:"litellm_params.guardrail",cell:({row:e})=>{let{logo:t,displayName:a}=eg(e.original.litellm_params.guardrail);return(0,l.jsxs)("div",{className:"flex items-center space-x-2",children:[t&&(0,l.jsx)("img",{src:t,alt:`${a} logo`,className:"w-4 h-4",onError:e=>{e.target.style.display="none"}}),(0,l.jsx)("span",{className:"text-xs",children:a})]})}},{header:"Mode",accessorKey:"litellm_params.mode",cell:({row:e})=>{let t=e.original;return(0,l.jsx)("span",{className:"text-xs",children:t.litellm_params.mode})}},{header:"Default On",accessorKey:"litellm_params.default_on",cell:({row:e})=>{let t=e.original;return(0,l.jsx)(tr.Badge,{color:t.litellm_params?.default_on?"green":"gray",className:"text-xs font-normal",size:"xs",children:t.litellm_params?.default_on?"Default On":"Default Off"})}},{header:"Created At",accessorKey:"created_at",cell:({row:e})=>{let t=e.original;return(0,l.jsx)(eN.Tooltip,{title:t.created_at,children:(0,l.jsx)("span",{className:"text-xs",children:x(t.created_at)})})}},{header:"Updated At",accessorKey:"updated_at",cell:({row:e})=>{let t=e.original;return(0,l.jsx)(eN.Tooltip,{title:t.updated_at,children:(0,l.jsx)("span",{className:"text-xs",children:x(t.updated_at)})})}},{id:"actions",header:"Actions",cell:({row:e})=>{let t=e.original,r=t.guardrail_definition_location===tu.CONFIG;return(0,l.jsx)("div",{className:"flex space-x-2",children:r?(0,l.jsx)(eN.Tooltip,{title:"Config guardrail cannot be deleted on the dashboard. Please delete it from the config file.",children:(0,l.jsx)(e7.Icon,{"data-testid":"config-delete-icon",icon:te.TrashIcon,size:"sm",className:"cursor-not-allowed text-gray-400",title:"Config guardrail cannot be deleted on the dashboard. Please delete it from the config file.","aria-label":"Delete guardrail (config)"})}):(0,l.jsx)(eN.Tooltip,{title:"Delete guardrail",children:(0,l.jsx)(e7.Icon,{icon:te.TrashIcon,size:"sm",onClick:()=>t.guardrail_id&&a(t.guardrail_id,t.guardrail_name||"Unnamed Guardrail"),className:"cursor-pointer hover:text-red-500"})})})}}],f=(0,ti.useReactTable)({data:e,columns:h,state:{sorting:d},onSortingChange:c,getCoreRowModel:(0,ts.getCoreRowModel)(),getSortedRowModel:(0,ts.getSortedRowModel)(),enableSorting:!0});return(0,l.jsxs)("div",{className:"rounded-lg custom-border relative",children:[(0,l.jsx)("div",{className:"overflow-x-auto",children:(0,l.jsxs)(e2.Table,{className:"[&_td]:py-0.5 [&_th]:py-1",children:[(0,l.jsx)(e8.TableHead,{children:f.getHeaderGroups().map(e=>(0,l.jsx)(e3.TableRow,{children:e.headers.map(e=>(0,l.jsx)(e6.TableHeaderCell,{className:`py-1 h-8 ${"actions"===e.id?"sticky right-0 bg-white shadow-[-4px_0_8px_-6px_rgba(0,0,0,0.1)]":""}`,onClick:e.column.getToggleSortingHandler(),children:(0,l.jsxs)("div",{className:"flex items-center justify-between gap-2",children:[(0,l.jsx)("div",{className:"flex items-center",children:e.isPlaceholder?null:(0,ti.flexRender)(e.column.columnDef.header,e.getContext())}),"actions"!==e.id&&(0,l.jsx)("div",{className:"w-4",children:e.column.getIsSorted()?({asc:(0,l.jsx)(ta.ChevronUpIcon,{className:"h-4 w-4 text-blue-500"}),desc:(0,l.jsx)(tl.ChevronDownIcon,{className:"h-4 w-4 text-blue-500"})})[e.column.getIsSorted()]:(0,l.jsx)(tt.SwitchVerticalIcon,{className:"h-4 w-4 text-gray-400"})})]})},e.id))},e.id))}),(0,l.jsx)(e4.TableBody,{children:t?(0,l.jsx)(e3.TableRow,{children:(0,l.jsx)(e5.TableCell,{colSpan:h.length,className:"h-8 text-center",children:(0,l.jsx)("div",{className:"text-center text-gray-500",children:(0,l.jsx)("p",{children:"Loading..."})})})}):e.length>0?f.getRowModel().rows.map(e=>(0,l.jsx)(e3.TableRow,{className:"h-8",children:e.getVisibleCells().map(e=>(0,l.jsx)(e5.TableCell,{className:`py-0.5 max-h-8 overflow-hidden text-ellipsis whitespace-nowrap ${"actions"===e.column.id?"sticky right-0 bg-white shadow-[-4px_0_8px_-6px_rgba(0,0,0,0.1)]":""}`,children:(0,ti.flexRender)(e.column.columnDef.cell,e.getContext())},e.id))},e.id)):(0,l.jsx)(e3.TableRow,{children:(0,l.jsx)(e5.TableCell,{colSpan:h.length,className:"h-8 text-center",children:(0,l.jsx)("div",{className:"text-center text-gray-500",children:(0,l.jsx)("p",{children:"No guardrails found"})})})})})]})}),p&&(0,l.jsx)(tm,{visible:m,onClose:()=>u(!1),accessToken:i,onSuccess:()=>{u(!1),g(null),s()},guardrailId:p.guardrail_id||"",fullLitellmParams:p.litellm_params,initialValues:{guardrail_name:p.guardrail_name||"",provider:Object.keys(en).find(e=>en[e]===p?.litellm_params.guardrail)||"",mode:p.litellm_params.mode,default_on:p.litellm_params.default_on,pii_entities_config:p.litellm_params.pii_entities_config,skip_system_message_choice:ex(p.litellm_params?.skip_system_message_in_guardrail),skip_tool_message_choice:eh(p.litellm_params?.skip_tool_message_in_guardrail),...p.guardrail_info}})]})};var tg=e.i(708347),tx=e.i(500330),eA=eA,th=e.i(530212),tf=e.i(350967),ty=e.i(197647),tj=e.i(653824),t_=e.i(881073),tb=e.i(404206),tv=e.i(723731),tw=e.i(629569),tN=e.i(678784),tC=e.i(118366),tS=e.i(560445);let{Text:tk}=f.Typography,{Option:tI}=x.Select,tA=({categories:e,onActionChange:t,onSeverityChange:a,onRemove:r,readOnly:s=!1})=>{let n=[{title:"Category",dataIndex:"display_name",key:"display_name",render:(e,t)=>(0,l.jsxs)("div",{children:[(0,l.jsx)(tk,{strong:!0,children:e}),e!==t.category&&(0,l.jsx)("div",{children:(0,l.jsx)(tk,{type:"secondary",style:{fontSize:12},children:t.category})})]})},{title:"Severity Threshold",dataIndex:"severity_threshold",key:"severity_threshold",width:180,render:(e,t)=>s?(0,l.jsx)(h.Tag,{color:{high:"red",medium:"orange",low:"yellow"}[e],children:e.toUpperCase()}):(0,l.jsxs)(x.Select,{value:e,onChange:e=>a?.(t.id,e),style:{width:150},size:"small",children:[(0,l.jsx)(tI,{value:"high",children:"High"}),(0,l.jsx)(tI,{value:"medium",children:"Medium"}),(0,l.jsx)(tI,{value:"low",children:"Low"})]})},{title:"Action",dataIndex:"action",key:"action",width:150,render:(e,a)=>s?(0,l.jsx)(h.Tag,{color:"BLOCK"===e?"red":"blue",children:e}):(0,l.jsxs)(x.Select,{value:e,onChange:e=>t?.(a.id,e),style:{width:120},size:"small",children:[(0,l.jsx)(tI,{value:"BLOCK",children:"Block"}),(0,l.jsx)(tI,{value:"MASK",children:"Mask"})]})}];return(s||n.push({title:"",key:"actions",width:100,render:(e,t)=>(0,l.jsx)(i.Button,{type:"text",danger:!0,size:"small",icon:(0,l.jsx)(L.DeleteOutlined,{}),onClick:()=>r?.(t.id),children:"Delete"})}),0===e.length)?(0,l.jsx)("div",{style:{textAlign:"center",padding:"40px 0",color:"#999"},children:"No categories configured."}):(0,l.jsx)(P.Table,{dataSource:e,columns:n,rowKey:"id",pagination:!1,size:"small"})},tO=({patterns:e,blockedWords:t,categories:a=[],readOnly:r=!0,onPatternActionChange:i,onPatternRemove:s,onBlockedWordUpdate:n,onBlockedWordRemove:o,onCategoryActionChange:d,onCategorySeverityChange:c,onCategoryRemove:m})=>{if(0===e.length&&0===t.length&&0===a.length)return null;let u=()=>{};return(0,l.jsxs)(l.Fragment,{children:[a.length>0&&(0,l.jsxs)(eK.Card,{className:"mt-6",children:[(0,l.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,l.jsx)(eq.Text,{className:"text-lg font-semibold",children:"Content Categories"}),(0,l.jsxs)(tr.Badge,{color:"blue",children:[a.length," categories configured"]})]}),(0,l.jsx)(tA,{categories:a,onActionChange:r?void 0:d,onSeverityChange:r?void 0:c,onRemove:r?void 0:m,readOnly:r})]}),e.length>0&&(0,l.jsxs)(eK.Card,{className:"mt-6",children:[(0,l.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,l.jsx)(eq.Text,{className:"text-lg font-semibold",children:"Pattern Detection"}),(0,l.jsxs)(tr.Badge,{color:"blue",children:[e.length," patterns configured"]})]}),(0,l.jsx)($,{patterns:e,onActionChange:r?u:i||u,onRemove:r?u:s||u})]}),t.length>0&&(0,l.jsxs)(eK.Card,{className:"mt-6",children:[(0,l.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,l.jsx)(eq.Text,{className:"text-lg font-semibold",children:"Blocked Keywords"}),(0,l.jsxs)(tr.Badge,{color:"blue",children:[t.length," keywords configured"]})]}),(0,l.jsx)(R,{keywords:t,onActionChange:r?u:n||u,onRemove:r?u:o||u})]})]})},{Text:tT}=f.Typography,tP=({guardrailData:e,guardrailSettings:t,isEditing:a,accessToken:i,onDataChange:s,onUnsavedChanges:n})=>{let[o,d]=(0,r.useState)([]),[c,m]=(0,r.useState)([]),[u,p]=(0,r.useState)([]),[g,x]=(0,r.useState)([]),[h,f]=(0,r.useState)([]),[y,j]=(0,r.useState)([]),[_,b]=(0,r.useState)(!1),[v,w]=(0,r.useState)(null),[N,C]=(0,r.useState)(!1),[S,k]=(0,r.useState)(null);(0,r.useEffect)(()=>{if(e?.litellm_params?.patterns){let t=e.litellm_params.patterns.map((e,t)=>({id:`pattern-${t}`,type:"prebuilt"===e.pattern_type?"prebuilt":"custom",name:e.pattern_name||e.name,display_name:e.display_name,pattern:e.pattern,action:e.action||"BLOCK"}));d(t),x(t)}else d([]),x([]);if(e?.litellm_params?.blocked_words){let t=e.litellm_params.blocked_words.map((e,t)=>({id:`word-${t}`,keyword:e.keyword,action:e.action||"BLOCK",description:e.description}));m(t),f(t)}else m([]),f([]);if(e?.litellm_params?.categories?.length>0){let a=t?.content_filter_settings?.content_categories?Object.fromEntries(t.content_filter_settings.content_categories.map(e=>[e.name,e])):{},l=e.litellm_params.categories.map((e,t)=>{let l=a[e.category];return{id:`category-${t}`,category:e.category,display_name:l?.display_name??e.category,action:e.action||"BLOCK",severity_threshold:e.severity_threshold||"medium"}});p(l),j(l)}else p([]),j([]);let a=e?.litellm_params?.competitor_intent_config;if(a&&"object"==typeof a){let e=!!(a.brand_self&&Array.isArray(a.brand_self)&&a.brand_self.length>0),t={competitor_intent_type:a.competitor_intent_type??"airline",brand_self:Array.isArray(a.brand_self)?a.brand_self:[],locations:Array.isArray(a.locations)?a.locations:[],competitors:Array.isArray(a.competitors)?a.competitors:[],policy:a.policy??{competitor_comparison:"refuse",possible_competitor_comparison:"reframe"},threshold_high:"number"==typeof a.threshold_high?a.threshold_high:.7,threshold_medium:"number"==typeof a.threshold_medium?a.threshold_medium:.45,threshold_low:"number"==typeof a.threshold_low?a.threshold_low:.3};b(e),w(t),C(e),k(t)}else b(!1),w(null),C(!1),k(null)},[e,t?.content_filter_settings?.content_categories]),(0,r.useEffect)(()=>{s&&s(o,c,u,_,v)},[o,c,u,_,v,s]);let I=r.default.useMemo(()=>{let e=JSON.stringify(o)!==JSON.stringify(g),t=JSON.stringify(c)!==JSON.stringify(h),a=JSON.stringify(u)!==JSON.stringify(y),l=_!==N||JSON.stringify(v)!==JSON.stringify(S);return e||t||a||l},[o,c,u,_,v,g,h,y,N,S]);return((0,r.useEffect)(()=>{a&&n&&n(I)},[I,a,n]),e?.litellm_params?.guardrail!=="litellm_content_filter")?null:a?(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(eH.Divider,{orientation:"left",children:"Content Filter Configuration"}),I&&(0,l.jsx)(tS.Alert,{type:"warning",showIcon:!0,className:"mb-4",message:(0,l.jsx)(tT,{children:'You have unsaved changes to patterns or keywords. Remember to click "Save Changes" at the bottom.'})}),(0,l.jsx)("div",{className:"mb-6",children:t&&t.content_filter_settings&&(0,l.jsx)(et,{prebuiltPatterns:t.content_filter_settings.prebuilt_patterns||[],categories:t.content_filter_settings.pattern_categories||[],selectedPatterns:o,blockedWords:c,onPatternAdd:e=>d([...o,e]),onPatternRemove:e=>d(o.filter(t=>t.id!==e)),onPatternActionChange:(e,t)=>d(o.map(a=>a.id===e?{...a,action:t}:a)),onBlockedWordAdd:e=>m([...c,e]),onBlockedWordRemove:e=>m(c.filter(t=>t.id!==e)),onBlockedWordUpdate:(e,t,a)=>m(c.map(l=>l.id===e?{...l,[t]:a}:l)),onFileUpload:e=>{},accessToken:i,contentCategories:t.content_filter_settings.content_categories||[],selectedContentCategories:u,onContentCategoryAdd:e=>p([...u,e]),onContentCategoryRemove:e=>p(u.filter(t=>t.id!==e)),onContentCategoryUpdate:(e,t,a)=>p(u.map(l=>l.id===e?{...l,[t]:a}:l)),competitorIntentEnabled:_,competitorIntentConfig:v,onCompetitorIntentChange:(e,t)=>{b(e),w(t)}})})]}):(0,l.jsx)(tO,{patterns:o,blockedWords:c,categories:u,readOnly:!0})};var tL=e.i(788191),tB=e.i(245704),tF=e.i(518617);let t$={icon:{tag:"svg",attrs:{viewBox:"0 0 1024 1024",focusable:"false"},children:[{tag:"path",attrs:{d:"M715.8 493.5L335 165.1c-14.2-12.2-35-1.2-35 18.5v656.8c0 19.7 20.8 30.7 35 18.5l380.8-328.4c10.9-9.4 10.9-27.6 0-37z"}}]},name:"caret-right",theme:"outlined"};var tE=r.forwardRef(function(e,t){return r.createElement(eL.default,(0,eT.default)({},e,{ref:t,icon:t$}))}),tM=e.i(987432);let tR={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M892 772h-80v-80c0-4.4-3.6-8-8-8h-48c-4.4 0-8 3.6-8 8v80h-80c-4.4 0-8 3.6-8 8v48c0 4.4 3.6 8 8 8h80v80c0 4.4 3.6 8 8 8h48c4.4 0 8-3.6 8-8v-80h80c4.4 0 8-3.6 8-8v-48c0-4.4-3.6-8-8-8zM373.5 498.4c-.9-8.7-1.4-17.5-1.4-26.4 0-15.9 1.5-31.4 4.3-46.5.7-3.6-1.2-7.3-4.5-8.8-13.6-6.1-26.1-14.5-36.9-25.1a127.54 127.54 0 01-38.7-95.4c.9-32.1 13.8-62.6 36.3-85.6 24.7-25.3 57.9-39.1 93.2-38.7 31.9.3 62.7 12.6 86 34.4 7.9 7.4 14.7 15.6 20.4 24.4 2 3.1 5.9 4.4 9.3 3.2 17.6-6.1 36.2-10.4 55.3-12.4 5.6-.6 8.8-6.6 6.3-11.6-32.5-64.3-98.9-108.7-175.7-109.9-110.8-1.7-203.2 89.2-203.2 200 0 62.8 28.9 118.8 74.2 155.5-31.8 14.7-61.1 35-86.5 60.4-54.8 54.7-85.8 126.9-87.8 204a8 8 0 008 8.2h56.1c4.3 0 7.9-3.4 8-7.7 1.9-58 25.4-112.3 66.7-153.5 29.4-29.4 65.4-49.8 104.7-59.7 3.8-1.1 6.4-4.8 5.9-8.8zM824 472c0-109.4-87.9-198.3-196.9-200C516.3 270.3 424 361.2 424 472c0 62.8 29 118.8 74.2 155.5a300.95 300.95 0 00-86.4 60.4C357 742.6 326 814.8 324 891.8a8 8 0 008 8.2h56c4.3 0 7.9-3.4 8-7.7 1.9-58 25.4-112.3 66.7-153.5C505.8 695.7 563 672 624 672c110.4 0 200-89.5 200-200zm-109.5 90.5C690.3 586.7 658.2 600 624 600s-66.3-13.3-90.5-37.5a127.26 127.26 0 01-37.5-91.8c.3-32.8 13.4-64.5 36.3-88 24-24.6 56.1-38.3 90.4-38.7 33.9-.3 66.8 12.9 91 36.6 24.8 24.3 38.4 56.8 38.4 91.4-.1 34.2-13.4 66.3-37.6 90.5z"}}]},name:"usergroup-add",theme:"outlined"};var tG=r.forwardRef(function(e,t){return r.createElement(eL.default,(0,eT.default)({},e,{ref:t,icon:tR}))}),tz=e.i(872934);let{Panel:tD}=G.Collapse,{TextArea:tK}=p.Input,tq={empty:{name:"Empty Template",code:`async def apply_guardrail(inputs, request_data, input_type): - # inputs: {texts, images, tools, tool_calls, structured_messages, model} - # request_data: {model, user_id, team_id, end_user_id, metadata} - # input_type: "request" or "response" - return allow()`},blockSSN:{name:"Block SSN",code:`def apply_guardrail(inputs, request_data, input_type): - for text in inputs["texts"]: - if regex_match(text, r"\\d{3}-\\d{2}-\\d{4}"): - return block("SSN detected") - return allow()`},redactEmail:{name:"Redact Emails",code:`def apply_guardrail(inputs, request_data, input_type): - pattern = r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}" - modified = [] - for text in inputs["texts"]: - modified.append(regex_replace(text, pattern, "[EMAIL REDACTED]")) - return modify(texts=modified)`},blockSQL:{name:"Block SQL Injection",code:`def apply_guardrail(inputs, request_data, input_type): - if input_type != "request": - return allow() - for text in inputs["texts"]: - if contains_code_language(text, ["sql"]): - return block("SQL code not allowed") - return allow()`},validateJSON:{name:"Validate JSON",code:`def apply_guardrail(inputs, request_data, input_type): - if input_type != "response": - return allow() - - schema = {"type": "object", "required": ["name", "value"]} - - for text in inputs["texts"]: - obj = json_parse(text) - if obj is None: - return block("Invalid JSON response") - if not json_schema_valid(obj, schema): - return block("Response missing required fields") - return allow()`},externalAPI:{name:"External API Check (async)",code:`async def apply_guardrail(inputs, request_data, input_type): - # Call an external moderation API (async for non-blocking) - for text in inputs["texts"]: - response = await http_post( - "https://api.example.com/moderate", - body={"text": text, "user_id": request_data["user_id"]}, - headers={"Authorization": "Bearer YOUR_API_KEY"}, - timeout=10 - ) - - if not response["success"]: - # API call failed, allow by default or block - return allow() - - if response["body"].get("flagged"): - return block(response["body"].get("reason", "Content flagged")) - - return allow()`}},tH={"Return Values":[{name:"allow()",desc:"Let request/response through"},{name:"block(reason)",desc:"Reject with message"},{name:"modify(texts=[], images=[], tool_calls=[])",desc:"Transform content"}],"HTTP Requests (async)":[{name:"await http_request(url, method, headers, body)",desc:"Make async HTTP request"},{name:"await http_get(url, headers)",desc:"Async GET request"},{name:"await http_post(url, body, headers)",desc:"Async POST request"}],"Regex Functions":[{name:"regex_match(text, pattern)",desc:"Returns True if pattern found"},{name:"regex_replace(text, pattern, replacement)",desc:"Replace all matches"},{name:"regex_find_all(text, pattern)",desc:"Return list of matches"}],"JSON Functions":[{name:"json_parse(text)",desc:"Parse JSON string, returns None on error"},{name:"json_stringify(obj)",desc:"Convert to JSON string"},{name:"json_schema_valid(obj, schema)",desc:"Validate against JSON schema"}],"URL Functions":[{name:"extract_urls(text)",desc:"Extract all URLs from text"},{name:"is_valid_url(url)",desc:"Check if URL is valid"},{name:"all_urls_valid(text)",desc:"Check all URLs in text are valid"}],"Code Detection":[{name:"detect_code(text)",desc:"Returns True if code detected"},{name:"detect_code_languages(text)",desc:"Returns list of detected languages"},{name:'contains_code_language(text, ["sql"])',desc:"Check for specific languages"}],"Text Utilities":[{name:"contains(text, substring)",desc:"Check if substring exists"},{name:"contains_any(text, [substr1, substr2])",desc:"Check if any substring exists"},{name:"word_count(text)",desc:"Count words"},{name:"char_count(text)",desc:"Count characters"},{name:"lower(text) / upper(text) / trim(text)",desc:"String transforms"}]},tU=[{value:"pre_call",label:"pre_call (Request)"},{value:"post_call",label:"post_call (Response)"},{value:"during_call",label:"during_call (Parallel)"},{value:"logging_only",label:"logging_only"},{value:"pre_mcp_call",label:"pre_mcp_call (Before MCP Tool Call)"},{value:"post_mcp_call",label:"post_mcp_call (After MCP Tool Call)"},{value:"during_mcp_call",label:"during_mcp_call (During MCP Tool Call)"}],tJ=({visible:e,onClose:t,onSuccess:a,accessToken:i,editData:s})=>{let n=!!s,[o,d]=(0,r.useState)(""),[u,p]=(0,r.useState)(["pre_call"]),[h,f]=(0,r.useState)(!1),[j,_]=(0,r.useState)("empty"),[b,v]=(0,r.useState)(tq.empty.code),[w,N]=(0,r.useState)(!1),[C,S]=(0,r.useState)(!1),[k,I]=(0,r.useState)(!1),A={texts:["Hello, my SSN is 123-45-6789"],images:[],tools:[{type:"function",function:{name:"get_weather",description:"Get the current weather in a location",parameters:{type:"object",properties:{location:{type:"string",description:"City name"}},required:["location"]}}}],tool_calls:[],structured_messages:[{role:"system",content:"You are a helpful assistant."},{role:"user",content:"Hello, my SSN is 123-45-6789"}],model:"gpt-4"},O={texts:["The weather in San Francisco is 72°F and sunny."],images:[],tools:[],tool_calls:[{id:"call_abc123",type:"function",function:{name:"get_weather",arguments:'{"location": "San Francisco"}'}}],structured_messages:[],model:"gpt-4"},T={texts:['Tool: read_wiki_structure\nArguments: {"repoName": "BerriAI/litellm"}'],images:[],tools:[{type:"function",function:{name:"read_wiki_structure",description:"Read the structure of a GitHub repository (MCP tool passed as OpenAI tool)",parameters:{type:"object",properties:{repoName:{type:"string",description:"Repository name, e.g. BerriAI/litellm"}},required:["repoName"]}}}],tool_calls:[{id:"call_mcp_001",type:"function",function:{name:"read_wiki_structure",arguments:'{"repoName": "BerriAI/litellm"}'}}],structured_messages:[{role:"user",content:'Tool: read_wiki_structure\nArguments: {"repoName": "BerriAI/litellm"}'}],model:"mcp-tool-call"},[P,L]=(0,r.useState)(JSON.stringify(A,null,2)),[B,F]=(0,r.useState)(null),[$,E]=(0,r.useState)(null),M=(0,r.useRef)(null),R=e=>null==e?["pre_call"]:Array.isArray(e)?e.length?e:["pre_call"]:[e];(0,r.useEffect)(()=>{e&&(s?(d(s.guardrail_name||""),p(R(s.litellm_params?.mode)),f(s.litellm_params?.default_on||!1),v(s.litellm_params?.custom_code||tq.empty.code),_("")):(d(""),p(["pre_call"]),f(!1),_("empty"),v(tq.empty.code)),F(null),I(!1))},[e,s]);let z=async e=>{try{await navigator.clipboard.writeText(e),E(e),setTimeout(()=>E(null),2e3)}catch(e){console.error("Failed to copy:",e)}},D=async()=>{if(!o.trim())return void y.default.fromBackend("Please enter a guardrail name");if(!b.trim())return void y.default.fromBackend("Please enter custom code");if(!i)return void y.default.fromBackend("No access token available");N(!0);try{if(n&&s){let e={litellm_params:{custom_code:b}};o!==s.guardrail_name&&(e.guardrail_name=o);let t=R(s.litellm_params?.mode);(u.length!==t.length||u.some((e,a)=>e!==t[a]))&&(e.litellm_params.mode=u),h!==s.litellm_params?.default_on&&(e.litellm_params.default_on=h),await (0,m.updateGuardrailCall)(i,s.guardrail_id,e),y.default.success("Custom code guardrail updated successfully")}else await (0,m.createGuardrailCall)(i,{guardrail_name:o,litellm_params:{guardrail:"custom_code",mode:u,default_on:h,custom_code:b},guardrail_info:{}}),y.default.success("Custom code guardrail created successfully");a(),t()}catch(e){console.error("Failed to save guardrail:",e),y.default.fromBackend(`Failed to ${n?"update":"create"} guardrail: `+(e instanceof Error?e.message:String(e)))}finally{N(!1)}},K=async()=>{if(!i)return void F({error:"No access token available"});S(!0),F(null);try{let e;try{e=JSON.parse(P)}catch(e){F({error:"Invalid test input JSON"}),S(!1);return}e.texts||(e.texts=[]);let t=["pre_call","pre_mcp_call"],a=["post_call","post_mcp_call"],l=u.some(e=>t.includes(e))?"request":u.some(e=>a.includes(e))?"response":"request",r=await (0,m.testCustomCodeGuardrail)(i,{custom_code:b,test_input:e,input_type:l,request_data:{model:"test-model",metadata:{}}});r.success&&r.result?F(r.result):r.error?F({error:r.error,error_type:r.error_type}):F({error:"Unknown error occurred"})}catch(e){console.error("Failed to test custom code:",e),F({error:e instanceof Error?e.message:"Failed to test custom code"})}finally{S(!1)}},q=b.split("\n").length;return(0,l.jsxs)(g.Modal,{open:e,onCancel:t,footer:null,width:1400,className:"custom-code-modal",closable:!0,destroyOnClose:!0,children:[(0,l.jsxs)("div",{className:"flex flex-col h-[80vh]",children:[(0,l.jsxs)("div",{className:"pb-4 border-b border-gray-200",children:[(0,l.jsx)("h2",{className:"text-xl font-semibold text-gray-900",children:n?"Edit Custom Guardrail":"Create Custom Guardrail"}),(0,l.jsx)("p",{className:"text-sm text-gray-500 mt-1",children:"Define custom logic using Python-like syntax"})]}),(0,l.jsxs)("div",{className:"flex items-center gap-4 py-4 border-b border-gray-100",children:[(0,l.jsxs)("div",{className:"flex-1 max-w-[200px]",children:[(0,l.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Guardrail Name"}),(0,l.jsx)(tn.TextInput,{value:o,onValueChange:d,placeholder:"e.g., block-pii-custom"})]}),(0,l.jsxs)("div",{className:"w-[280px]",children:[(0,l.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Mode (can select multiple)"}),(0,l.jsx)(x.Select,{mode:"multiple",value:u,onChange:p,options:tU,className:"w-full",size:"middle",placeholder:"Select modes"})]}),(0,l.jsxs)("div",{className:"w-[180px]",children:[(0,l.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Template"}),(0,l.jsx)(x.Select,{value:j,onChange:e=>{_(e),v(tq[e].code)},className:"w-full",size:"middle",dropdownRender:e=>(0,l.jsxs)(l.Fragment,{children:[e,(0,l.jsx)(eH.Divider,{style:{margin:"8px 0"}}),(0,l.jsxs)("div",{style:{padding:"8px 12px",cursor:"pointer",color:"#1890ff",fontSize:"12px",display:"flex",alignItems:"center",gap:"4px"},onClick:e=>{e.preventDefault(),window.open("https://models.litellm.ai/guardrails","_blank")},onMouseEnter:e=>{e.currentTarget.style.backgroundColor="#f0f0f0"},onMouseLeave:e=>{e.currentTarget.style.backgroundColor="transparent"},children:[(0,l.jsx)(tG,{}),(0,l.jsx)("span",{children:"Browse Community templates"}),(0,l.jsx)(tz.ExportOutlined,{style:{fontSize:"10px"}})]})]}),children:(0,l.jsx)(x.Select.OptGroup,{label:"STANDARD",children:Object.entries(tq).map(([e,t])=>(0,l.jsx)(x.Select.Option,{value:e,children:t.name},e))})})]}),(0,l.jsxs)("div",{className:"flex items-center gap-2 pt-5",children:[(0,l.jsx)("span",{className:"text-sm text-gray-600",children:"Default On"}),(0,l.jsx)(U.Switch,{checked:h,onChange:f})]})]}),(0,l.jsxs)("div",{className:"flex flex-1 overflow-hidden mt-4 gap-6",children:[(0,l.jsxs)("div",{className:"flex-2 flex flex-col min-w-0 overflow-y-auto",children:[(0,l.jsxs)("div",{className:"flex items-center justify-between mb-2 shrink-0",children:[(0,l.jsx)("span",{className:"text-xs font-semibold text-gray-500 uppercase tracking-wide",children:"Python Logic"}),(0,l.jsx)("span",{className:"text-xs text-gray-400",children:"Restricted environment (no imports)"})]}),(0,l.jsxs)("div",{className:"relative rounded-lg overflow-hidden border border-gray-700 bg-[#1e1e1e] shrink-0",style:{minHeight:"300px",maxHeight:"400px"},children:[(0,l.jsx)("div",{className:"absolute left-0 top-0 bottom-0 w-12 bg-[#1e1e1e] border-r border-gray-700 text-right pr-3 pt-3 select-none overflow-hidden",style:{fontFamily:"'Fira Code', 'Monaco', 'Consolas', monospace",fontSize:"14px",lineHeight:"1.6"},children:Array.from({length:Math.max(q,20)},(e,t)=>(0,l.jsx)("div",{className:"text-gray-500 h-[22.4px]",children:t+1},t+1))}),(0,l.jsx)("textarea",{ref:M,value:b,onChange:e=>v(e.target.value),onKeyDown:e=>{if("Tab"===e.key){e.preventDefault();let t=e.currentTarget,a=t.selectionStart,l=t.selectionEnd;v(b.substring(0,a)+" "+b.substring(l)),setTimeout(()=>{t.selectionStart=t.selectionEnd=a+4},0)}},spellCheck:!1,className:"w-full h-full pl-14 pr-4 pt-3 pb-3 resize-none focus:outline-hidden bg-transparent text-gray-200",style:{fontFamily:"'Fira Code', 'Monaco', 'Consolas', monospace",fontSize:"14px",lineHeight:"1.6",tabSize:4}})]}),(0,l.jsx)(G.Collapse,{activeKey:k?["test"]:[],onChange:e=>I(e.includes("test")),className:"mt-3 bg-white border border-gray-200 rounded-lg shrink-0",expandIcon:({isActive:e})=>(0,l.jsx)(tE,{rotate:90*!!e}),children:(0,l.jsx)(tD,{header:(0,l.jsxs)("span",{className:"flex items-center gap-2 text-sm font-medium",children:[(0,l.jsx)(tL.PlayCircleOutlined,{className:"text-blue-500"}),"Test Your Guardrail"]}),children:(0,l.jsxs)("div",{className:"space-y-3",children:[(0,l.jsxs)("div",{children:[(0,l.jsxs)("div",{className:"flex items-center justify-between mb-2",children:[(0,l.jsx)("label",{className:"block text-xs font-medium text-gray-600",children:"Test Input (JSON)"}),(0,l.jsxs)("div",{className:"flex items-center gap-2",children:[(0,l.jsx)("span",{className:"text-xs text-gray-500",children:"Load example:"}),(0,l.jsx)("button",{type:"button",onClick:()=>L(JSON.stringify(A,null,2)),className:"px-2 py-1 text-xs rounded-sm border border-orange-200 bg-orange-50 text-orange-700 hover:bg-orange-100 transition-colors",children:"Pre-call"}),(0,l.jsx)("button",{type:"button",onClick:()=>L(JSON.stringify(T,null,2)),className:"px-2 py-1 text-xs rounded-sm border border-purple-200 bg-purple-50 text-purple-700 hover:bg-purple-100 transition-colors",children:"Pre MCP"}),(0,l.jsx)("button",{type:"button",onClick:()=>L(JSON.stringify(O,null,2)),className:"px-2 py-1 text-xs rounded-sm border border-green-200 bg-green-50 text-green-700 hover:bg-green-100 transition-colors",children:"Post-call"})]})]}),(0,l.jsx)("div",{className:"mb-2 p-2 bg-gray-50 rounded-sm text-xs text-gray-600 border border-gray-200",children:(0,l.jsxs)("div",{className:"grid grid-cols-2 gap-x-4 gap-y-1",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)("strong",{children:"texts"}),": Message content (always)"]}),(0,l.jsxs)("div",{children:[(0,l.jsx)("strong",{children:"images"}),": Base64 images (vision)"]}),(0,l.jsxs)("div",{children:[(0,l.jsx)("strong",{children:"tools"}),": Tool definitions ",(0,l.jsx)("span",{className:"text-orange-600",children:"(pre_call)"}),", MCP as OpenAI tool ",(0,l.jsx)("span",{className:"text-purple-600",children:"(pre_mcp_call)"})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)("strong",{children:"tool_calls"}),": LLM tool calls"," ",(0,l.jsx)("span",{className:"text-green-600",children:"(post_call)"})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)("strong",{children:"structured_messages"}),": Full messages"," ",(0,l.jsx)("span",{className:"text-orange-600",children:"(pre_call)"})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)("strong",{children:"model"}),": Model name (always)"]})]})}),(0,l.jsx)(tK,{value:P,onChange:e=>L(e.target.value),rows:8,className:"font-mono text-xs",placeholder:'{"texts": ["test message"], ...}'})]}),(0,l.jsxs)("div",{className:"flex items-center gap-3",children:[(0,l.jsx)(e9.Button,{size:"xs",onClick:K,disabled:C,icon:tL.PlayCircleOutlined,children:C?"Running...":"Run Test"}),B&&(0,l.jsx)("div",{className:`flex items-center gap-2 text-sm ${B.error?"text-red-600":"allow"===B.action?"text-green-600":"block"===B.action?"text-orange-600":"text-blue-600"}`,children:B.error?(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(tF.CloseCircleOutlined,{}),(0,l.jsxs)("span",{children:[B.error_type&&(0,l.jsxs)("span",{className:"font-medium",children:["[",B.error_type,"] "]}),B.error]})]}):"allow"===B.action?(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(tB.CheckCircleOutlined,{})," Allowed"]}):"block"===B.action?(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(tF.CloseCircleOutlined,{})," Blocked: ",B.reason]}):"modify"===B.action?(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(tB.CheckCircleOutlined,{})," Modified",B.texts&&B.texts.length>0&&(0,l.jsxs)("span",{className:"text-xs text-gray-500 ml-1",children:["→ ",B.texts[0].substring(0,50),B.texts[0].length>50?"...":""]})]}):(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(tB.CheckCircleOutlined,{})," ",B.action||"Unknown"]})})]})]})},"test")}),(0,l.jsxs)("div",{className:"mt-3 p-4 bg-linear-to-r from-blue-50 to-indigo-50 border border-blue-200 rounded-lg flex items-center justify-between shrink-0",children:[(0,l.jsxs)("div",{className:"flex items-center gap-3",children:[(0,l.jsx)("div",{className:"bg-blue-100 rounded-full p-2",children:(0,l.jsx)(tG,{className:"text-blue-600 text-lg"})}),(0,l.jsxs)("div",{children:[(0,l.jsx)("div",{className:"text-sm font-medium text-gray-900",children:"Built a useful guardrail?"}),(0,l.jsx)("div",{className:"text-xs text-gray-600",children:"Share it with the community and help others build faster"})]})]}),(0,l.jsx)(e9.Button,{size:"xs",onClick:()=>window.open("https://github.com/BerriAI/litellm-guardrails","_blank"),icon:tz.ExportOutlined,className:"bg-blue-600 hover:bg-blue-700 text-white border-0",children:"Contribute Template"})]})]}),(0,l.jsxs)("div",{className:"w-[300px] shrink-0 overflow-auto border-l border-gray-200 pl-6",children:[(0,l.jsxs)("div",{className:"flex items-center gap-2 mb-3",children:[(0,l.jsx)(c.CodeOutlined,{className:"text-blue-500"}),(0,l.jsx)("span",{className:"font-semibold text-gray-700",children:"Available Primitives"})]}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mb-3",children:"Click to copy functions to clipboard"}),(0,l.jsx)(G.Collapse,{defaultActiveKey:["Return Values"],className:"primitives-collapse bg-transparent border-0",expandIconPosition:"end",children:Object.entries(tH).map(([e,t])=>(0,l.jsx)(tD,{header:(0,l.jsx)("span",{className:"text-sm font-medium text-gray-700",children:e}),className:"bg-white mb-2 rounded-lg border border-gray-200",children:(0,l.jsx)("div",{className:"space-y-2",children:t.map(e=>(0,l.jsx)("button",{onClick:()=>z(e.name),className:`w-full text-left px-2 py-2 rounded transition-colors ${$===e.name?"bg-green-100":"bg-gray-50 hover:bg-blue-50"}`,children:$===e.name?(0,l.jsxs)("span",{className:"flex items-center gap-1 text-xs font-mono text-green-700",children:[(0,l.jsx)(tB.CheckCircleOutlined,{})," Copied!"]}):(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)("div",{className:"text-xs font-mono text-gray-800",children:e.name}),(0,l.jsx)("div",{className:"text-[10px] text-gray-500 mt-0.5",children:e.desc})]})},e.name))})},e))})]})]}),(0,l.jsxs)("div",{className:"flex items-center justify-between pt-4 mt-4 border-t border-gray-200",children:[(0,l.jsx)("span",{className:"text-xs text-gray-400",children:"Changes are auto-saved to local draft"}),(0,l.jsxs)("div",{className:"flex items-center gap-3",children:[(0,l.jsx)(e9.Button,{variant:"secondary",onClick:t,children:"Cancel"}),(0,l.jsx)(e9.Button,{onClick:D,loading:w,disabled:w||!o.trim(),icon:tM.SaveOutlined,children:n?"Update Guardrail":"Save Guardrail"})]})]})]}),(0,l.jsx)("style",{children:` - .custom-code-modal .ant-modal-content { - padding: 24px; - } - .custom-code-modal .ant-modal-close { - top: 20px; - right: 20px; - } - .primitives-collapse .ant-collapse-item { - border: none !important; - } - .primitives-collapse .ant-collapse-header { - padding: 8px 12px !important; - } - .primitives-collapse .ant-collapse-content-box { - padding: 8px 12px !important; - } - `})]})},tW=({guardrailId:e,onClose:t,accessToken:a,isAdmin:s})=>{let n,[o,d]=(0,r.useState)(null),[g,h]=(0,r.useState)(null),[f,j]=(0,r.useState)(!0),[_,b]=(0,r.useState)(!1),[v]=u.Form.useForm(),[w,N]=(0,r.useState)([]),[C,S]=(0,r.useState)({}),[k,I]=(0,r.useState)(null),[A,O]=(0,r.useState)({}),[T,P]=(0,r.useState)(!1),L={rules:[],default_action:"deny",on_disallowed_action:"block",violation_message_template:""},[B,F]=(0,r.useState)(L),[$,E]=(0,r.useState)(!1),[M,R]=(0,r.useState)(!1),G=r.default.useRef({patterns:[],blockedWords:[],categories:[]}),z=(0,r.useCallback)((e,t,a,l,r)=>{G.current={patterns:e,blockedWords:t,categories:a||[],competitorIntentEnabled:l,competitorIntentConfig:r}},[]),D=async()=>{try{if(j(!0),!a)return;let t=await (0,m.getGuardrailInfo)(a,e);if(d(t),t.litellm_params?.pii_entities_config){let e=t.litellm_params.pii_entities_config;if(N([]),S({}),Object.keys(e).length>0){let t=[],a={};Object.entries(e).forEach(([e,l])=>{t.push(e),a[e]="string"==typeof l?l:"MASK"}),N(t),S(a)}}else N([]),S({})}catch(e){y.default.fromBackend("Failed to load guardrail information"),console.error("Error fetching guardrail info:",e)}finally{j(!1)}},K=async()=>{try{if(!a)return;let e=await (0,m.getGuardrailProviderSpecificParams)(a);h(e)}catch(e){console.error("Error fetching guardrail provider specific params:",e)}},q=async()=>{try{if(!a)return;let e=await (0,m.getGuardrailUISettings)(a);I(e)}catch(e){console.error("Error fetching guardrail UI settings:",e)}};(0,r.useEffect)(()=>{K()},[a]),(0,r.useEffect)(()=>{D(),q()},[e,a]),(0,r.useEffect)(()=>{if(o&&v){let e={...o.litellm_params||{}};delete e.skip_system_message_in_guardrail,delete e.skip_tool_message_in_guardrail,v.setFieldsValue({guardrail_name:o.guardrail_name,...e,skip_system_message_choice:ex(o.litellm_params?.skip_system_message_in_guardrail),skip_tool_message_choice:eh(o.litellm_params?.skip_tool_message_in_guardrail),guardrail_info:o.guardrail_info?JSON.stringify(o.guardrail_info,null,2):"",...o.litellm_params?.optional_params&&{optional_params:o.litellm_params.optional_params}})}},[o,g,v]);let H=(0,r.useCallback)(()=>{o?.litellm_params?.guardrail==="tool_permission"?F({rules:o.litellm_params?.rules||[],default_action:(o.litellm_params?.default_action||"deny").toLowerCase(),on_disallowed_action:(o.litellm_params?.on_disallowed_action||"block").toLowerCase(),violation_message_template:o.litellm_params?.violation_message_template||""}):F(L),E(!1)},[o]);(0,r.useEffect)(()=>{H()},[H]);let U=async t=>{try{if(!a)return;let d={litellm_params:{}};t.guardrail_name!==o.guardrail_name&&(d.guardrail_name=t.guardrail_name),t.default_on!==o.litellm_params?.default_on&&(d.litellm_params.default_on=t.default_on);let c=ex(o.litellm_params?.skip_system_message_in_guardrail),u=t.skip_system_message_choice;void 0!==u&&u!==c&&("inherit"===u?d.litellm_params.skip_system_message_in_guardrail=null:"yes"===u?d.litellm_params.skip_system_message_in_guardrail=!0:d.litellm_params.skip_system_message_in_guardrail=!1);let p=eh(o.litellm_params?.skip_tool_message_in_guardrail),x=t.skip_tool_message_choice;void 0!==x&&x!==p&&("inherit"===x?d.litellm_params.skip_tool_message_in_guardrail=null:"yes"===x?d.litellm_params.skip_tool_message_in_guardrail=!0:d.litellm_params.skip_tool_message_in_guardrail=!1);let h=o.guardrail_info,f=t.guardrail_info?JSON.parse(t.guardrail_info):void 0;JSON.stringify(h)!==JSON.stringify(f)&&(d.guardrail_info=f);let j=o.litellm_params?.pii_entities_config||{},_={};if(w.forEach(e=>{_[e]=C[e]||"MASK"}),JSON.stringify(j)!==JSON.stringify(_)&&(d.litellm_params.pii_entities_config=_),o.litellm_params?.guardrail==="litellm_content_filter"&&T){var l,r,i,s,n;let e,t=(l=G.current.patterns||[],r=G.current.blockedWords||[],i=G.current.categories||[],s=G.current.competitorIntentEnabled,n=G.current.competitorIntentConfig,e={patterns:l.map(e=>({pattern_type:"prebuilt"===e.type?"prebuilt":"regex",pattern_name:"prebuilt"===e.type?e.name:void 0,pattern:"custom"===e.type?e.pattern:void 0,name:e.name,action:e.action})),blocked_words:r.map(e=>({keyword:e.keyword,action:e.action,description:e.description}))},void 0!==i&&(e.categories=i.map(e=>({category:e.category,enabled:!0,action:e.action,severity_threshold:e.severity_threshold||"medium"}))),s&&n&&n.brand_self.length>0&&(e.competitor_intent_config={competitor_intent_type:n.competitor_intent_type,brand_self:n.brand_self,locations:n.locations?.length?n.locations:void 0,competitors:"generic"===n.competitor_intent_type&&n.competitors?.length?n.competitors:void 0,policy:n.policy,threshold_high:n.threshold_high,threshold_medium:n.threshold_medium,threshold_low:n.threshold_low}),e);d.litellm_params.patterns=t.patterns,d.litellm_params.blocked_words=t.blocked_words,d.litellm_params.categories=t.categories,d.litellm_params.competitor_intent_config=t.competitor_intent_config??null}if(o.litellm_params?.guardrail==="tool_permission"){let e=o.litellm_params?.rules||[],t=B.rules||[],a=JSON.stringify(e)!==JSON.stringify(t),l=(o.litellm_params?.default_action||"deny").toLowerCase(),r=(B.default_action||"deny").toLowerCase(),i=l!==r,s=(o.litellm_params?.on_disallowed_action||"block").toLowerCase(),n=(B.on_disallowed_action||"block").toLowerCase(),c=s!==n,m=o.litellm_params?.violation_message_template||"",u=B.violation_message_template||"",p=m!==u;($||a||i||c||p)&&(d.litellm_params.rules=t,d.litellm_params.default_action=r,d.litellm_params.on_disallowed_action=n,d.litellm_params.violation_message_template=u||null)}let v=Object.keys(en).find(e=>en[e]===o.litellm_params?.guardrail),N=o.litellm_params?.guardrail==="tool_permission";if(g&&v&&!N){let e=g[en[v]?.toLowerCase()]||{},a=new Set;Object.keys(e).forEach(e=>{"optional_params"!==e&&a.add(e)}),e.optional_params&&e.optional_params.fields&&Object.keys(e.optional_params.fields).forEach(e=>{a.add(e)}),a.forEach(e=>{if("patterns"===e||"blocked_words"===e||"categories"===e)return;let a=t[e];(null==a||""===a)&&(a=t.optional_params?.[e]);let l=o.litellm_params?.[e];JSON.stringify(a)!==JSON.stringify(l)&&(null!=a&&""!==a?d.litellm_params[e]=a:null!=l&&""!==l&&(d.litellm_params[e]=null))})}if(0===Object.keys(d.litellm_params).length&&delete d.litellm_params,0===Object.keys(d).length){y.default.info("No changes detected"),b(!1);return}await (0,m.updateGuardrailCall)(a,e,d),y.default.success("Guardrail updated successfully"),P(!1),D(),b(!1)}catch(e){console.error("Error updating guardrail:",e),y.default.fromBackend("Failed to update guardrail")}};if(f)return(0,l.jsx)("div",{className:"p-4",children:"Loading..."});if(!o)return(0,l.jsx)("div",{className:"p-4",children:"Guardrail not found"});let J=e=>e?new Date(e).toLocaleString():"-",{logo:W,displayName:V}=eg(o.litellm_params?.guardrail||""),Y=async(e,t)=>{await (0,tx.copyToClipboard)(e)&&(O(e=>({...e,[t]:!0})),setTimeout(()=>{O(e=>({...e,[t]:!1}))},2e3))},Q="config"===o.guardrail_definition_location;return(0,l.jsxs)("div",{className:"p-4",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)(i.Button,{type:"text",icon:(0,l.jsx)(th.ArrowLeftIcon,{className:"w-4 h-4"}),onClick:t,className:"mb-4",children:"Back to Guardrails"}),(0,l.jsx)(tw.Title,{children:o.guardrail_name||"Unnamed Guardrail"}),(0,l.jsxs)("div",{className:"flex items-center cursor-pointer",children:[(0,l.jsx)(eq.Text,{className:"text-gray-500 font-mono",children:o.guardrail_id}),(0,l.jsx)(i.Button,{type:"text",size:"small",icon:A["guardrail-id"]?(0,l.jsx)(tN.CheckIcon,{size:12}):(0,l.jsx)(tC.CopyIcon,{size:12}),onClick:()=>Y(o.guardrail_id,"guardrail-id"),className:`left-2 z-10 transition-all duration-200 ${A["guardrail-id"]?"text-green-600 bg-green-50 border-green-200":"text-gray-500 hover:text-gray-700 hover:bg-gray-100"}`})]})]}),(0,l.jsxs)(tj.TabGroup,{children:[(0,l.jsxs)(t_.TabList,{className:"mb-4",children:[(0,l.jsx)(ty.Tab,{children:"Overview"},"overview"),s?(0,l.jsx)(ty.Tab,{children:"Settings"},"settings"):(0,l.jsx)(l.Fragment,{})]}),(0,l.jsxs)(tv.TabPanels,{children:[(0,l.jsxs)(tb.TabPanel,{children:[(0,l.jsxs)(tf.Grid,{numItems:1,numItemsSm:2,numItemsLg:3,className:"gap-6",children:[(0,l.jsxs)(eK.Card,{children:[(0,l.jsx)(eq.Text,{children:"Provider"}),(0,l.jsxs)("div",{className:"mt-2 flex items-center space-x-2",children:[W&&(0,l.jsx)("img",{src:W,alt:`${V} logo`,className:"w-6 h-6",onError:e=>{e.target.style.display="none"}}),(0,l.jsx)(tw.Title,{children:V})]})]}),(0,l.jsxs)(eK.Card,{children:[(0,l.jsx)(eq.Text,{children:"Mode"}),(0,l.jsxs)("div",{className:"mt-2",children:[(0,l.jsx)(tw.Title,{children:o.litellm_params?.mode||"-"}),(0,l.jsx)(tr.Badge,{color:o.litellm_params?.default_on?"green":"gray",children:o.litellm_params?.default_on?"Default On":"Default Off"})]})]}),(0,l.jsxs)(eK.Card,{children:[(0,l.jsx)(eq.Text,{children:"Created At"}),(0,l.jsxs)("div",{className:"mt-2",children:[(0,l.jsx)(tw.Title,{children:J(o.created_at)}),(0,l.jsxs)(eq.Text,{children:["Last Updated: ",J(o.updated_at)]})]})]})]}),o.litellm_params?.pii_entities_config&&Object.keys(o.litellm_params.pii_entities_config).length>0&&(0,l.jsx)(eK.Card,{className:"mt-6",children:(0,l.jsxs)("div",{className:"flex justify-between items-center",children:[(0,l.jsx)(eq.Text,{className:"font-medium",children:"PII Protection"}),(0,l.jsxs)(tr.Badge,{color:"blue",children:[Object.keys(o.litellm_params.pii_entities_config).length," PII entities configured"]})]})}),o.litellm_params?.pii_entities_config&&Object.keys(o.litellm_params.pii_entities_config).length>0&&(0,l.jsxs)(eK.Card,{className:"mt-6",children:[(0,l.jsx)(eq.Text,{className:"mb-4 text-lg font-semibold",children:"PII Entity Configuration"}),(0,l.jsxs)("div",{className:"border rounded-lg overflow-hidden shadow-xs",children:[(0,l.jsxs)("div",{className:"bg-gray-50 px-5 py-3 border-b flex",children:[(0,l.jsx)(eq.Text,{className:"flex-1 font-semibold text-gray-700",children:"Entity Type"}),(0,l.jsx)(eq.Text,{className:"flex-1 font-semibold text-gray-700",children:"Configuration"})]}),(0,l.jsx)("div",{className:"max-h-[400px] overflow-y-auto",children:Object.entries(o.litellm_params?.pii_entities_config).map(([e,t])=>(0,l.jsxs)("div",{className:"px-5 py-3 flex border-b hover:bg-gray-50 transition-colors",children:[(0,l.jsx)(eq.Text,{className:"flex-1 font-medium text-gray-900",children:e}),(0,l.jsx)(eq.Text,{className:"flex-1",children:(0,l.jsxs)("span",{className:`inline-flex items-center gap-1.5 ${"MASK"===t?"text-blue-600":"text-red-600"}`,children:["MASK"===t?(0,l.jsx)(eA.default,{}):(0,l.jsx)(eO.StopOutlined,{}),String(t)]})})]},e))})]})]}),o.litellm_params?.guardrail==="tool_permission"&&(0,l.jsx)(eK.Card,{className:"mt-6",children:(0,l.jsx)(eV,{value:B,disabled:!0})}),o.litellm_params?.guardrail==="custom_code"&&o.litellm_params?.custom_code&&(0,l.jsxs)(eK.Card,{className:"mt-6",children:[(0,l.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,l.jsxs)("div",{className:"flex items-center gap-2",children:[(0,l.jsx)(c.CodeOutlined,{className:"text-blue-500"}),(0,l.jsx)(eq.Text,{className:"font-medium text-lg",children:"Custom Code"})]}),s&&!Q&&(0,l.jsx)(i.Button,{size:"small",icon:(0,l.jsx)(c.CodeOutlined,{}),onClick:()=>R(!0),children:"Edit Code"})]}),(0,l.jsx)("div",{className:"relative rounded-lg overflow-hidden border border-gray-700 bg-[#1e1e1e]",children:(0,l.jsx)("pre",{className:"p-4 text-sm text-gray-200 overflow-x-auto",style:{fontFamily:"'Fira Code', 'Monaco', 'Consolas', monospace"},children:(0,l.jsx)("code",{children:o.litellm_params.custom_code})})})]}),(0,l.jsx)(tP,{guardrailData:o,guardrailSettings:k,isEditing:!1,accessToken:a})]}),s&&(0,l.jsx)(tb.TabPanel,{children:(0,l.jsxs)(eK.Card,{children:[(0,l.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,l.jsx)(tw.Title,{children:"Guardrail Settings"}),Q&&(0,l.jsx)(eN.Tooltip,{title:"Guardrail is defined in the config file and cannot be edited.",children:(0,l.jsx)(eJ.InfoCircleOutlined,{})}),!_&&!Q&&(o.litellm_params?.guardrail==="custom_code"?(0,l.jsx)(i.Button,{icon:(0,l.jsx)(c.CodeOutlined,{}),onClick:()=>R(!0),children:"Edit Code"}):(0,l.jsx)(i.Button,{onClick:()=>b(!0),children:"Edit Settings"}))]}),_?(0,l.jsxs)(u.Form,{form:v,onFinish:U,initialValues:{guardrail_name:o.guardrail_name,...(n={...o.litellm_params||{}},delete n.skip_system_message_in_guardrail,delete n.skip_tool_message_in_guardrail,n),skip_system_message_choice:ex(o.litellm_params?.skip_system_message_in_guardrail),skip_tool_message_choice:eh(o.litellm_params?.skip_tool_message_in_guardrail),guardrail_info:o.guardrail_info?JSON.stringify(o.guardrail_info,null,2):"",...o.litellm_params?.optional_params&&{optional_params:o.litellm_params.optional_params}},layout:"vertical",children:[(0,l.jsx)(u.Form.Item,{label:"Guardrail Name",name:"guardrail_name",rules:[{required:!0,message:"Please input a guardrail name"}],children:(0,l.jsx)(p.Input,{placeholder:"Enter guardrail name"})}),(0,l.jsx)(u.Form.Item,{label:"Default On",name:"default_on",children:(0,l.jsxs)(x.Select,{children:[(0,l.jsx)(x.Select.Option,{value:!0,children:"Yes"}),(0,l.jsx)(x.Select.Option,{value:!1,children:"No"})]})}),(0,l.jsx)(u.Form.Item,{label:"Skip system messages in guardrail",name:"skip_system_message_choice",tooltip:"Unified guardrails: omit role: system from guardrail input (LLM still gets full messages). Use global default follows litellm_settings.skip_system_message_in_guardrail.",children:(0,l.jsxs)(x.Select,{children:[(0,l.jsx)(x.Select.Option,{value:"inherit",children:"Use global default"}),(0,l.jsx)(x.Select.Option,{value:"yes",children:"Yes — exclude from guardrail scan"}),(0,l.jsx)(x.Select.Option,{value:"no",children:"No — always include in scan"})]})}),(0,l.jsx)(u.Form.Item,{label:"Skip tool messages in guardrail",name:"skip_tool_message_choice",tooltip:"Unified guardrails: omit role: tool from guardrail input (LLM still gets full messages). Use global default follows litellm_settings.skip_tool_message_in_guardrail.",children:(0,l.jsxs)(x.Select,{children:[(0,l.jsx)(x.Select.Option,{value:"inherit",children:"Use global default"}),(0,l.jsx)(x.Select.Option,{value:"yes",children:"Yes — exclude from guardrail scan"}),(0,l.jsx)(x.Select.Option,{value:"no",children:"No — always include in scan"})]})}),o.litellm_params?.guardrail==="presidio"&&(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(eH.Divider,{orientation:"left",children:"PII Protection"}),(0,l.jsx)("div",{className:"mb-6",children:k&&(0,l.jsx)(eD,{entities:k.supported_entities,actions:k.supported_actions,selectedEntities:w,selectedActions:C,onEntitySelect:e=>{N(t=>t.includes(e)?t.filter(t=>t!==e):[...t,e])},onActionSelect:(e,t)=>{S(a=>({...a,[e]:t}))},entityCategories:k.pii_entity_categories})})]}),(0,l.jsx)(tP,{guardrailData:o,guardrailSettings:k,isEditing:!0,accessToken:a,onDataChange:z,onUnsavedChanges:P}),(o.litellm_params?.guardrail==="tool_permission"||g)&&(0,l.jsx)(eH.Divider,{orientation:"left",children:"Provider Settings"}),o.litellm_params?.guardrail==="tool_permission"?(0,l.jsx)(eV,{value:B,onChange:F}):(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(ew,{selectedProvider:Object.keys(en).find(e=>en[e]===o.litellm_params?.guardrail)||null,accessToken:a,providerParams:g,value:o.litellm_params}),g&&(()=>{let e=Object.keys(en).find(e=>en[e]===o.litellm_params?.guardrail);if(!e)return null;let t=g[en[e]?.toLowerCase()];return t&&t.optional_params?(0,l.jsx)(e_,{optionalParams:t.optional_params,parentFieldKey:"optional_params",values:o.litellm_params}):null})()]}),(0,l.jsx)(eH.Divider,{orientation:"left",children:"Advanced Settings"}),(0,l.jsx)(u.Form.Item,{label:"Guardrail Information",name:"guardrail_info",children:(0,l.jsx)(p.Input.TextArea,{rows:5})}),(0,l.jsxs)("div",{className:"flex justify-end gap-2 mt-6",children:[(0,l.jsx)(i.Button,{onClick:()=>{b(!1),P(!1),H()},children:"Cancel"}),(0,l.jsx)(i.Button,{type:"primary",htmlType:"submit",children:"Save Changes"})]})]}):(0,l.jsxs)("div",{className:"space-y-4",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"font-medium",children:"Guardrail ID"}),(0,l.jsx)("div",{className:"font-mono",children:o.guardrail_id})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"font-medium",children:"Guardrail Name"}),(0,l.jsx)("div",{children:o.guardrail_name||"Unnamed Guardrail"})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"font-medium",children:"Provider"}),(0,l.jsx)("div",{children:V})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"font-medium",children:"Mode"}),(0,l.jsx)("div",{children:o.litellm_params?.mode||"-"})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"font-medium",children:"Default On"}),(0,l.jsx)(tr.Badge,{color:o.litellm_params?.default_on?"green":"gray",children:o.litellm_params?.default_on?"Yes":"No"})]}),o.litellm_params?.pii_entities_config&&Object.keys(o.litellm_params.pii_entities_config).length>0&&(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"font-medium",children:"PII Protection"}),(0,l.jsx)("div",{className:"mt-2",children:(0,l.jsxs)(tr.Badge,{color:"blue",children:[Object.keys(o.litellm_params.pii_entities_config).length," PII entities configured"]})})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"font-medium",children:"Created At"}),(0,l.jsx)("div",{children:J(o.created_at)})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)(eq.Text,{className:"font-medium",children:"Last Updated"}),(0,l.jsx)("div",{children:J(o.updated_at)})]}),o.litellm_params?.guardrail==="tool_permission"&&(0,l.jsx)(eV,{value:B,disabled:!0})]})]})})]})]}),(0,l.jsx)(tJ,{visible:M,onClose:()=>R(!1),onSuccess:()=>{R(!1),D()},accessToken:a,editData:o?{guardrail_id:o.guardrail_id,guardrail_name:o.guardrail_name,litellm_params:o.litellm_params}:null})]})};var tV=e.i(573421),tY=e.i(19732),tQ=e.i(928685),tX=e.i(166406),tZ=e.i(637235),t0=e.i(240647);let{Text:t1}=f.Typography,t2=function({results:e,errors:t}){let[a,i]=(0,r.useState)(new Set),s=e=>{let t=new Set(a);t.has(e)?t.delete(e):t.add(e),i(t)},n=async e=>{try{if(navigator.clipboard&&window.isSecureContext)return await navigator.clipboard.writeText(e),!0;{let t=document.createElement("textarea");t.value=e,t.style.position="fixed",t.style.opacity="0",document.body.appendChild(t),t.focus(),t.select();let a=document.execCommand("copy");if(document.body.removeChild(t),!a)throw Error("execCommand failed");return!0}}catch(e){return console.error("Copy failed:",e),!1}};return e||t?(0,l.jsxs)("div",{className:"space-y-3 pt-4 border-t border-gray-200",children:[(0,l.jsx)("h3",{className:"text-sm font-semibold text-gray-900",children:"Results"}),e&&e.map(e=>{let t=a.has(e.guardrailName);return(0,l.jsx)(eK.Card,{className:"bg-green-50 border-green-200",children:(0,l.jsxs)("div",{className:"space-y-3",children:[(0,l.jsxs)("div",{className:"flex items-center justify-between",children:[(0,l.jsxs)("div",{className:"flex items-center space-x-2 cursor-pointer flex-1",onClick:()=>s(e.guardrailName),children:[t?(0,l.jsx)(t0.RightOutlined,{className:"text-gray-500 text-xs"}):(0,l.jsx)(o.DownOutlined,{className:"text-gray-500 text-xs"}),(0,l.jsx)(tB.CheckCircleOutlined,{className:"text-green-600 text-lg"}),(0,l.jsx)("span",{className:"text-sm font-medium text-green-800",children:e.guardrailName})]}),(0,l.jsxs)("div",{className:"flex items-center gap-3",children:[(0,l.jsxs)("div",{className:"flex items-center space-x-1 text-xs text-gray-600",children:[(0,l.jsx)(tZ.ClockCircleOutlined,{}),(0,l.jsxs)("span",{className:"font-medium",children:[e.latency,"ms"]})]}),!t&&(0,l.jsx)(e9.Button,{size:"xs",variant:"secondary",icon:tX.CopyOutlined,onClick:async()=>{await n(e.response_text)?y.default.success("Result copied to clipboard"):y.default.fromBackend("Failed to copy result")},children:"Copy"})]})]}),!t&&(0,l.jsxs)(l.Fragment,{children:[(0,l.jsxs)("div",{className:"bg-white border border-green-200 rounded-sm p-3",children:[(0,l.jsx)("label",{className:"text-xs font-medium text-gray-600 mb-2 block",children:"Output Text"}),(0,l.jsx)("div",{className:"font-mono text-sm text-gray-900 whitespace-pre-wrap wrap-break-word",children:e.response_text})]}),(0,l.jsxs)("div",{className:"text-xs text-gray-600",children:[(0,l.jsx)("span",{className:"font-medium",children:"Characters:"})," ",e.response_text.length]})]})]})},e.guardrailName)}),t&&t.map(e=>{let t=a.has(e.guardrailName);return(0,l.jsx)(eK.Card,{className:"bg-red-50 border-red-200",children:(0,l.jsxs)("div",{className:"flex items-start space-x-2",children:[(0,l.jsx)("div",{className:"cursor-pointer mt-0.5",onClick:()=>s(e.guardrailName),children:t?(0,l.jsx)(t0.RightOutlined,{className:"text-gray-500 text-xs"}):(0,l.jsx)(o.DownOutlined,{className:"text-gray-500 text-xs"})}),(0,l.jsx)("div",{className:"text-red-600 mt-0.5",children:(0,l.jsx)("svg",{className:"w-5 h-5",fill:"currentColor",viewBox:"0 0 20 20",children:(0,l.jsx)("path",{fillRule:"evenodd",d:"M10 18a8 8 0 100-16 8 8 0 000 16zM8.707 7.293a1 1 0 00-1.414 1.414L8.586 10l-1.293 1.293a1 1 0 101.414 1.414L10 11.414l1.293 1.293a1 1 0 001.414-1.414L11.414 10l1.293-1.293a1 1 0 00-1.414-1.414L10 8.586 8.707 7.293z",clipRule:"evenodd"})})}),(0,l.jsxs)("div",{className:"flex-1",children:[(0,l.jsxs)("div",{className:"flex items-center justify-between mb-1",children:[(0,l.jsxs)("p",{className:"text-sm font-medium text-red-800 cursor-pointer",onClick:()=>s(e.guardrailName),children:[e.guardrailName," - Error"]}),(0,l.jsxs)("div",{className:"flex items-center space-x-1 text-xs text-gray-600",children:[(0,l.jsx)(tZ.ClockCircleOutlined,{}),(0,l.jsxs)("span",{className:"font-medium",children:[e.latency,"ms"]})]})]}),!t&&(0,l.jsx)("p",{className:"text-sm text-red-700 mt-1",children:e.error.message})]})]})},e.guardrailName)})]}):null},{TextArea:t4}=p.Input,{Text:t5}=f.Typography,t8=function({guardrailNames:e,onSubmit:t,isLoading:a,results:i,errors:s,onClose:n}){let[o,d]=(0,r.useState)(""),c=()=>{o.trim()?t(o):y.default.fromBackend("Please enter text to test")},m=async e=>{try{if(navigator.clipboard&&window.isSecureContext)return await navigator.clipboard.writeText(e),!0;{let t=document.createElement("textarea");t.value=e,t.style.position="fixed",t.style.opacity="0",document.body.appendChild(t),t.focus(),t.select();let a=document.execCommand("copy");if(document.body.removeChild(t),!a)throw Error("execCommand failed");return!0}}catch(e){return console.error("Copy failed:",e),!1}},u=async()=>{await m(o)?y.default.success("Input copied to clipboard"):y.default.fromBackend("Failed to copy input")};return(0,l.jsxs)("div",{className:"space-y-4 h-full flex flex-col",children:[(0,l.jsx)("div",{className:"flex items-center justify-between pb-3 border-b border-gray-200",children:(0,l.jsx)("div",{className:"flex items-center space-x-3",children:(0,l.jsxs)("div",{className:"flex-1 min-w-0",children:[(0,l.jsxs)("div",{className:"flex items-center space-x-2 mb-1",children:[(0,l.jsx)("h2",{className:"text-lg font-semibold text-gray-900",children:"Test Guardrails:"}),(0,l.jsx)("div",{className:"flex flex-wrap gap-2",children:e.map(e=>(0,l.jsx)("div",{className:"inline-flex items-center space-x-1 bg-blue-50 px-3 py-1 rounded-md border border-blue-200",children:(0,l.jsx)("span",{className:"font-mono text-blue-700 font-medium text-sm",children:e})},e))})]}),(0,l.jsxs)("p",{className:"text-sm text-gray-500",children:["Test ",e.length>1?"guardrails":"guardrail"," and compare results"]})]})})}),(0,l.jsxs)("div",{className:"flex-1 overflow-auto space-y-4",children:[(0,l.jsxs)("div",{className:"space-y-3",children:[(0,l.jsxs)("div",{children:[(0,l.jsxs)("div",{className:"flex justify-between items-center mb-2",children:[(0,l.jsxs)("div",{className:"flex items-center gap-2",children:[(0,l.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Input Text"}),(0,l.jsx)(eN.Tooltip,{title:"Press Enter to submit. Use Shift+Enter for new line.",children:(0,l.jsx)(eJ.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),o&&(0,l.jsx)(e9.Button,{size:"xs",variant:"secondary",icon:tX.CopyOutlined,onClick:u,children:"Copy Input"})]}),(0,l.jsx)(t4,{value:o,onChange:e=>d(e.target.value),onKeyDown:e=>{"Enter"!==e.key||e.shiftKey||e.ctrlKey||e.metaKey||(e.preventDefault(),c())},placeholder:"Enter text to test with guardrails...",rows:8,className:"font-mono text-sm"}),(0,l.jsxs)("div",{className:"flex justify-between items-center mt-1",children:[(0,l.jsxs)(t5,{className:"text-xs text-gray-500",children:["Press ",(0,l.jsx)("kbd",{className:"px-1 py-0.5 bg-gray-100 border border-gray-300 rounded-sm text-xs",children:"Enter"})," to submit •"," ",(0,l.jsx)("kbd",{className:"px-1 py-0.5 bg-gray-100 border border-gray-300 rounded-sm text-xs",children:"Shift+Enter"})," for new line"]}),(0,l.jsxs)(t5,{className:"text-xs text-gray-500",children:["Characters: ",o.length]})]})]}),(0,l.jsx)("div",{className:"pt-2",children:(0,l.jsx)(e9.Button,{onClick:c,loading:a,disabled:!o.trim(),className:"w-full",children:a?`Testing ${e.length} guardrail${e.length>1?"s":""}...`:`Test ${e.length} guardrail${e.length>1?"s":""}`})})]}),(0,l.jsx)(t2,{results:i,errors:s})]})]})},t6=({guardrailsList:e,isLoading:t,accessToken:a,onClose:i})=>{let[s,n]=(0,r.useState)(new Set),[o,d]=(0,r.useState)(""),[c,u]=(0,r.useState)([]),[g,x]=(0,r.useState)([]),[h,j]=(0,r.useState)(!1),_=e.filter(e=>e.guardrail_name?.toLowerCase().includes(o.toLowerCase())),v=async e=>{if(0===s.size||!a)return;j(!0),u([]),x([]);let t=[],l=[];await Promise.all(Array.from(s).map(async r=>{let i=Date.now();try{let l=await (0,m.applyGuardrail)(a,r,e,null,null),s=Date.now()-i;t.push({guardrailName:r,response_text:l.response_text,latency:s})}catch(t){let e=Date.now()-i;console.error(`Error testing guardrail ${r}:`,t),l.push({guardrailName:r,error:t,latency:e})}})),u(t),x(l),j(!1),t.length>0&&y.default.success(`${t.length} guardrail${t.length>1?"s":""} applied successfully`),l.length>0&&y.default.fromBackend(`${l.length} guardrail${l.length>1?"s":""} failed`)};return(0,l.jsx)("div",{className:"w-full h-[calc(100vh-200px)]",children:(0,l.jsx)(b.Card,{className:"h-full",styles:{body:{padding:0,height:"100%"}},children:(0,l.jsxs)("div",{className:"flex h-full",children:[(0,l.jsxs)("div",{className:"w-1/4 border-r border-gray-200 flex flex-col overflow-hidden",children:[(0,l.jsx)("div",{className:"p-4 border-b border-gray-200",children:(0,l.jsxs)("div",{className:"mb-3",children:[(0,l.jsx)("h3",{className:"text-lg font-semibold mb-3",children:"Guardrails"}),(0,l.jsx)(p.Input,{prefix:(0,l.jsx)(tQ.SearchOutlined,{}),placeholder:"Search guardrails...",value:o,onChange:e=>d(e.target.value)})]})}),(0,l.jsx)("div",{className:"flex-1 overflow-auto",children:t?(0,l.jsx)("div",{className:"flex items-center justify-center h-32",children:(0,l.jsx)(eb.Spin,{})}):0===_.length?(0,l.jsx)("div",{className:"p-4",children:(0,l.jsx)(eU.Empty,{description:o?"No guardrails match your search":"No guardrails available"})}):(0,l.jsx)(tV.List,{dataSource:_,renderItem:e=>(0,l.jsx)(tV.List.Item,{onClick:()=>{var t;let a;e.guardrail_name&&(t=e.guardrail_name,(a=new Set(s)).has(t)?a.delete(t):a.add(t),n(a))},style:{paddingLeft:24,paddingRight:16},className:`cursor-pointer hover:bg-gray-50 transition-colors ${s.has(e.guardrail_name||"")?"bg-blue-50 border-l-4 border-l-blue-500":"border-l-4 border-l-transparent"}`,children:(0,l.jsx)(tV.List.Item.Meta,{title:(0,l.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,l.jsx)(tY.ExperimentOutlined,{className:"text-gray-400"}),(0,l.jsx)("span",{className:"font-medium text-gray-900",children:e.guardrail_name})]}),description:(0,l.jsxs)("div",{className:"text-xs space-y-1 mt-1",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)("span",{className:"font-medium",children:"Type: "}),(0,l.jsx)("span",{className:"text-gray-600",children:e.litellm_params.guardrail})]}),(0,l.jsxs)("div",{children:[(0,l.jsx)("span",{className:"font-medium",children:"Mode: "}),(0,l.jsx)("span",{className:"text-gray-600",children:e.litellm_params.mode})]})]})})})})}),(0,l.jsx)("div",{className:"p-3 border-t border-gray-200 bg-gray-50",children:(0,l.jsxs)(f.Typography.Text,{className:"text-xs text-gray-600",children:[s.size," of ",_.length," selected"]})})]}),(0,l.jsxs)("div",{className:"w-3/4 flex flex-col bg-white",children:[(0,l.jsx)("div",{className:"p-4 border-b border-gray-200 flex justify-between items-center",children:(0,l.jsx)(f.Typography.Title,{level:2,className:"text-xl font-semibold mb-0",children:"Guardrail Testing Playground"})}),(0,l.jsx)("div",{className:"flex-1 overflow-auto p-4",children:0===s.size?(0,l.jsxs)("div",{className:"h-full flex flex-col items-center justify-center text-gray-400",children:[(0,l.jsx)(tY.ExperimentOutlined,{style:{fontSize:"48px",marginBottom:"16px"}}),(0,l.jsx)(f.Typography.Paragraph,{className:"text-lg font-medium text-gray-600 mb-2",children:"Select Guardrails to Test"}),(0,l.jsx)(f.Typography.Paragraph,{className:"text-center text-gray-500 max-w-md",children:"Choose one or more guardrails from the left sidebar to start testing and comparing results."})]}):(0,l.jsx)("div",{className:"h-full",children:(0,l.jsx)(t8,{guardrailNames:Array.from(s),onSubmit:v,results:c.length>0?c:null,errors:g.length>0?g:null,isLoading:h,onClose:()=>n(new Set)})})})]})]})})})};var t3=e.i(127952),t7=e.i(266537);let t9="/ui/assets/logos/",ae=[{id:"cf_denied_financial",name:"Denied Financial Advice",description:"Detects requests for personalized financial advice, investment recommendations, or financial planning.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Topic Blocker"],eval:{f1:100,precision:100,recall:100,testCases:207,latency:"<0.1ms"}},{id:"cf_denied_insults",name:"Insults & Personal Attacks",description:"Detects insults, name-calling, and personal attacks directed at the chatbot, staff, or other people.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Topic Blocker"],eval:{f1:100,precision:100,recall:100,testCases:299,latency:"<0.1ms"}},{id:"cf_denied_legal",name:"Denied Legal Advice",description:"Detects requests for unauthorized legal advice, case analysis, or legal recommendations.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Topic Blocker"]},{id:"cf_denied_medical",name:"Denied Medical Advice",description:"Detects requests for medical diagnosis, treatment recommendations, or health advice.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Topic Blocker"]},{id:"cf_harmful_violence",name:"Harmful Violence",description:"Detects content related to violence, criminal planning, attacks, and violent threats.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Safety"]},{id:"cf_harmful_self_harm",name:"Harmful Self-Harm",description:"Detects content related to self-harm, suicide, and dangerous self-destructive behavior.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Safety"]},{id:"cf_harmful_child_safety",name:"Harmful Child Safety",description:"Detects content that could endanger child safety or exploit minors.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Safety"]},{id:"cf_harmful_illegal_weapons",name:"Harmful Illegal Weapons",description:"Detects content related to illegal weapons manufacturing, distribution, or acquisition.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Safety"]},{id:"cf_bias_gender",name:"Bias: Gender",description:"Detects gender-based discrimination, stereotypes, and biased language.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Bias"]},{id:"cf_bias_racial",name:"Bias: Racial",description:"Detects racial discrimination, stereotypes, and racially biased content.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Bias"]},{id:"cf_bias_religious",name:"Bias: Religious",description:"Detects religious discrimination, intolerance, and religiously biased content.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Bias"]},{id:"cf_bias_sexual_orientation",name:"Bias: Sexual Orientation",description:"Detects discrimination based on sexual orientation and related biased content.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Bias"]},{id:"cf_prompt_injection_jailbreak",name:"Prompt Injection: Jailbreak",description:"Detects jailbreak attempts designed to bypass AI safety guidelines and restrictions.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Prompt Injection"]},{id:"cf_prompt_injection_data_exfil",name:"Prompt Injection: Data Exfiltration",description:"Detects attempts to extract sensitive data through prompt manipulation.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Prompt Injection"]},{id:"cf_prompt_injection_sql",name:"Prompt Injection: SQL",description:"Detects SQL injection attempts embedded in prompts.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Prompt Injection"]},{id:"cf_prompt_injection_malicious_code",name:"Prompt Injection: Malicious Code",description:"Detects attempts to inject malicious code through prompts.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Prompt Injection"]},{id:"cf_prompt_injection_system_prompt",name:"Prompt Injection: System Prompt",description:"Detects attempts to extract or override system prompts.",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Prompt Injection"]},{id:"cf_toxic_abuse",name:"Toxic & Abusive Language",description:"Detects toxic, abusive, and hateful language across multiple languages (EN, AU, DE, ES, FR).",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Toxicity"]},{id:"cf_patterns",name:"Pattern Matching",description:"Detect and block sensitive data patterns like SSNs, credit card numbers, API keys, and custom regex patterns.",category:"litellm",subcategory:"Patterns",logo:`${t9}litellm_logo.jpg`,tags:["PII","Regex","Data Protection"]},{id:"cf_keywords",name:"Keyword Blocking",description:"Block or mask content containing specific keywords or phrases. Upload custom word lists or add individual terms.",category:"litellm",subcategory:"Keywords",logo:`${t9}litellm_logo.jpg`,tags:["Keywords","Blocklist"]},{id:"block_code_execution",name:"Block Code Execution",description:"Detects markdown fenced code blocks in requests and responses. Block or mask executable code (e.g. Python, JavaScript, Bash) by language with configurable confidence.",category:"litellm",subcategory:"Code Safety",logo:`${t9}litellm_logo.jpg`,tags:["Code","Safety","Prompt Injection"]},{id:"cf_competitor_intent",name:"Competitor Name Blocking",description:"Block or reframe competitor comparison and ranking intent. Detect when users ask to compare or recommend competitors (airline or generic competitor lists).",category:"litellm",subcategory:"Content Category",logo:`${t9}litellm_logo.jpg`,tags:["Content Category","Competitor","Topic Blocker"]},{id:"presidio",name:"Presidio PII",description:"Microsoft Presidio for PII detection and anonymization. Supports 30+ entity types with configurable actions.",category:"partner",logo:`${t9}microsoft_azure.svg`,tags:["PII","Microsoft"],providerKey:"PresidioPII"},{id:"bedrock",name:"Bedrock Guardrail",description:"AWS Bedrock Guardrails for content filtering, topic avoidance, and sensitive information detection.",category:"partner",logo:`${t9}bedrock.svg`,tags:["AWS","Content Safety"],providerKey:"Bedrock"},{id:"lakera",name:"Lakera",description:"AI security platform protecting against prompt injections, data leakage, and harmful content.",category:"partner",logo:`${t9}lakeraai.jpeg`,tags:["Security","Prompt Injection"],providerKey:"Lakera"},{id:"openai_moderation",name:"OpenAI Moderation",description:"OpenAI's content moderation API for detecting harmful content across multiple categories.",category:"partner",logo:`${t9}openai_small.svg`,tags:["Content Moderation","OpenAI"]},{id:"google_model_armor",name:"Google Cloud Model Armor",description:"Google Cloud's model protection service for safe and responsible AI deployments.",category:"partner",logo:`${t9}google.svg`,tags:["Google Cloud","Safety"]},{id:"guardrails_ai",name:"Guardrails AI",description:"Open-source framework for adding structural, type, and quality guarantees to LLM outputs.",category:"partner",logo:`${t9}guardrails_ai.jpeg`,tags:["Open Source","Validation"]},{id:"zscaler",name:"Zscaler AI Guard",description:"Enterprise AI security from Zscaler for monitoring and protecting AI/ML workloads.",category:"partner",logo:`${t9}zscaler.svg`,tags:["Enterprise","Security"]},{id:"panw",name:"PANW Prisma AIRS",description:"Palo Alto Networks Prisma AI Runtime Security for securing AI applications in production.",category:"partner",logo:`${t9}palo_alto_networks.jpeg`,tags:["Enterprise","Security"]},{id:"cisco_ai_defense",name:"Cisco AI Defense",description:"Cisco AI Defense Inspection API for runtime protection: prompt injection, PII/PCI/PHI, harassment, hate speech, profanity, violence, and code detection.",category:"partner",logo:`${t9}cisco.png`,tags:["Enterprise","Security","Prompt Injection","PII"],providerKey:"CiscoAiDefense"},{id:"noma",name:"Noma Security",description:"AI security platform for detecting and preventing AI-specific threats and vulnerabilities.",category:"partner",logo:`${t9}noma_security.png`,tags:["Security","Threat Detection"]},{id:"aporia",name:"Aporia AI",description:"Real-time AI guardrails for hallucination detection, topic control, and policy enforcement.",category:"partner",logo:`${t9}aporia.png`,tags:["Hallucination","Policy"]},{id:"aim",name:"AIM Guardrail",description:"AIM Security guardrails for comprehensive AI threat detection and mitigation.",category:"partner",logo:`${t9}aim_security.jpeg`,tags:["Security","Threat Detection"]},{id:"cato_networks",name:"Cato Networks Guardrail",description:"Cato Networks guardrails for comprehensive AI threat detection and mitigation.",category:"partner",logo:`${t9}cato_networks.svg`,tags:["Security","Threat Detection"]},{id:"prompt_security",name:"Prompt Security",description:"Protect against prompt injection attacks, data leakage, and other LLM security threats.",category:"partner",logo:`${t9}prompt_security.png`,tags:["Prompt Injection","Security"]},{id:"lasso",name:"Lasso Guardrail",description:"Content moderation and safety guardrails for responsible AI deployments.",category:"partner",logo:`${t9}lasso.png`,tags:["Content Moderation"]},{id:"pangea",name:"Pangea Guardrail",description:"Pangea's AI guardrails for secure, compliant, and trustworthy AI applications.",category:"partner",logo:`${t9}pangea.png`,tags:["Compliance","Security"]},{id:"enkryptai",name:"EnkryptAI",description:"AI security and governance platform for enterprise AI safety and compliance.",category:"partner",logo:`${t9}enkrypt_ai.avif`,tags:["Enterprise","Governance"]},{id:"javelin",name:"Javelin Guardrails",description:"AI gateway with built-in guardrails for secure and compliant AI operations.",category:"partner",logo:`${t9}javelin.png`,tags:["Gateway","Security"]},{id:"pillar",name:"Pillar Guardrail",description:"AI safety platform for monitoring, testing, and securing AI systems.",category:"partner",logo:`${t9}pillar.jpeg`,tags:["Monitoring","Safety"]},{id:"akto",name:"Akto Guardrail",description:"AI security platform from Akto.io with automatic monitoring and guardrails for AI/ML applications.",category:"partner",logo:`${t9}akto.svg`,tags:["Security","Safety","Monitoring"]},{id:"promptguard",name:"PromptGuard",description:"AI security gateway with prompt injection detection, PII redaction, topic filtering, entity blocklists, and hallucination detection. Self-hostable with drop-in proxy integration.",category:"partner",logo:`${t9}promptguard.svg`,tags:["Security","Prompt Injection","PII"],providerKey:"Promptguard",eval:{f1:94.9,precision:100,recall:90.4,testCases:5384,latency:"~150ms"}},{id:"xecguard",name:"XecGuard",description:"CyCraft XecGuard AI security gateway. Multi-policy scanning (prompt injection, harmful content, PII, system-prompt enforcement) plus RAG context grounding.",category:"partner",logo:`${t9}xecguard.svg`,tags:["Security","Policy","Grounding","RAG"],providerKey:"Xecguard"},{id:"repelloai",name:"RepelloAI Argus",description:"RepelloAI Argus scans prompts and responses against policies configured per asset in the Repello dashboard.",category:"partner",logo:`${t9}repelloai.png`,tags:["Security","Policy","Prompt Injection"],providerKey:"Repelloai"}];var at=e.i(826910);let aa=({src:e,name:t})=>{let[a,i]=(0,r.useState)(!1);return a||!e?(0,l.jsx)("div",{style:{width:28,height:28,borderRadius:6,backgroundColor:"#e5e7eb",display:"flex",alignItems:"center",justifyContent:"center",fontSize:13,fontWeight:600,color:"#6b7280",flexShrink:0},children:t?.charAt(0)||"?"}):(0,l.jsx)("img",{src:(0,ea.resolveLogoSrc)(e),alt:"",style:{width:28,height:28,borderRadius:6,objectFit:"contain",flexShrink:0},onError:()=>i(!0)})},al=({card:e,onClick:t})=>{let[a,i]=(0,r.useState)(!1);return(0,l.jsxs)("div",{onClick:t,onMouseEnter:()=>i(!0),onMouseLeave:()=>i(!1),style:{borderRadius:12,border:a?"1px solid #93c5fd":"1px solid #e5e7eb",backgroundColor:"#ffffff",padding:"20px 20px 16px 20px",cursor:"pointer",transition:"border-color 0.15s, box-shadow 0.15s",display:"flex",flexDirection:"column",minHeight:170,boxShadow:a?"0 1px 6px rgba(59,130,246,0.08)":"none"},children:[(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:10,marginBottom:10},children:[(0,l.jsx)(aa,{src:e.logo,name:e.name}),(0,l.jsx)("span",{style:{fontSize:14,fontWeight:600,color:"#111827",lineHeight:1.3},children:e.name})]}),(0,l.jsx)("p",{className:"line-clamp-3",style:{fontSize:12,color:"#6b7280",lineHeight:1.6,margin:0,flex:1},children:e.description}),e.eval&&(0,l.jsxs)("div",{style:{marginTop:10,display:"flex",alignItems:"center",gap:4},children:[(0,l.jsx)(at.CheckCircleFilled,{style:{color:"#16a34a",fontSize:12}}),(0,l.jsxs)("span",{style:{fontSize:11,color:"#16a34a",fontWeight:500},children:["F1: ",e.eval.f1,"% · ",e.eval.testCases," test cases"]})]})]})};var ar=e.i(447566);let ai={cf_denied_financial:{provider:"LitellmContentFilter",categoryName:"denied_financial_advice",guardrailNameSuggestion:"Denied Financial Advice",mode:"pre_call",defaultOn:!1},cf_denied_legal:{provider:"LitellmContentFilter",categoryName:"denied_legal_advice",guardrailNameSuggestion:"Denied Legal Advice",mode:"pre_call",defaultOn:!1},cf_denied_medical:{provider:"LitellmContentFilter",categoryName:"denied_medical_advice",guardrailNameSuggestion:"Denied Medical Advice",mode:"pre_call",defaultOn:!1},cf_denied_insults:{provider:"LitellmContentFilter",categoryName:"denied_insults",guardrailNameSuggestion:"Insults & Personal Attacks",mode:"pre_call",defaultOn:!1},cf_harmful_violence:{provider:"LitellmContentFilter",categoryName:"harmful_violence",guardrailNameSuggestion:"Harmful Violence",mode:"pre_call",defaultOn:!1},cf_harmful_self_harm:{provider:"LitellmContentFilter",categoryName:"harmful_self_harm",guardrailNameSuggestion:"Harmful Self-Harm",mode:"pre_call",defaultOn:!1},cf_harmful_child_safety:{provider:"LitellmContentFilter",categoryName:"harmful_child_safety",guardrailNameSuggestion:"Harmful Child Safety",mode:"pre_call",defaultOn:!1},cf_harmful_illegal_weapons:{provider:"LitellmContentFilter",categoryName:"harmful_illegal_weapons",guardrailNameSuggestion:"Harmful Illegal Weapons",mode:"pre_call",defaultOn:!1},cf_bias_gender:{provider:"LitellmContentFilter",categoryName:"bias_gender",guardrailNameSuggestion:"Bias: Gender",mode:"pre_call",defaultOn:!1},cf_bias_racial:{provider:"LitellmContentFilter",categoryName:"bias_racial",guardrailNameSuggestion:"Bias: Racial",mode:"pre_call",defaultOn:!1},cf_bias_religious:{provider:"LitellmContentFilter",categoryName:"bias_religious",guardrailNameSuggestion:"Bias: Religious",mode:"pre_call",defaultOn:!1},cf_bias_sexual_orientation:{provider:"LitellmContentFilter",categoryName:"bias_sexual_orientation",guardrailNameSuggestion:"Bias: Sexual Orientation",mode:"pre_call",defaultOn:!1},cf_prompt_injection_jailbreak:{provider:"LitellmContentFilter",categoryName:"prompt_injection_jailbreak",guardrailNameSuggestion:"Prompt Injection: Jailbreak",mode:"pre_call",defaultOn:!1},cf_prompt_injection_data_exfil:{provider:"LitellmContentFilter",categoryName:"prompt_injection_data_exfiltration",guardrailNameSuggestion:"Prompt Injection: Data Exfiltration",mode:"pre_call",defaultOn:!1},cf_prompt_injection_sql:{provider:"LitellmContentFilter",categoryName:"prompt_injection_sql",guardrailNameSuggestion:"Prompt Injection: SQL",mode:"pre_call",defaultOn:!1},cf_prompt_injection_malicious_code:{provider:"LitellmContentFilter",categoryName:"prompt_injection_malicious_code",guardrailNameSuggestion:"Prompt Injection: Malicious Code",mode:"pre_call",defaultOn:!1},cf_prompt_injection_system_prompt:{provider:"LitellmContentFilter",categoryName:"prompt_injection_system_prompt",guardrailNameSuggestion:"Prompt Injection: System Prompt",mode:"pre_call",defaultOn:!1},cf_toxic_abuse:{provider:"LitellmContentFilter",categoryName:"harm_toxic_abuse",guardrailNameSuggestion:"Toxic & Abusive Language",mode:"pre_call",defaultOn:!1},cf_patterns:{provider:"LitellmContentFilter",guardrailNameSuggestion:"Pattern Matching",mode:"pre_call",defaultOn:!1},cf_keywords:{provider:"LitellmContentFilter",guardrailNameSuggestion:"Keyword Blocking",mode:"pre_call",defaultOn:!1},block_code_execution:{provider:"BlockCodeExecution",guardrailNameSuggestion:"Block Code Execution",mode:"pre_call",defaultOn:!1},cf_competitor_intent:{provider:"LitellmContentFilter",guardrailNameSuggestion:"Competitor Name Blocking",mode:"pre_call",defaultOn:!1},presidio:{provider:"PresidioPII",guardrailNameSuggestion:"Presidio PII",mode:"pre_call",defaultOn:!1},bedrock:{provider:"Bedrock",guardrailNameSuggestion:"Bedrock Guardrail",mode:"pre_call",defaultOn:!1},lakera:{provider:"Lakera",guardrailNameSuggestion:"Lakera",mode:"pre_call",defaultOn:!1},openai_moderation:{provider:"OpenaiModeration",guardrailNameSuggestion:"OpenAI Moderation",mode:"pre_call",defaultOn:!1},google_model_armor:{provider:"ModelArmor",guardrailNameSuggestion:"Google Cloud Model Armor",mode:"pre_call",defaultOn:!1},guardrails_ai:{provider:"GuardrailsAi",guardrailNameSuggestion:"Guardrails AI",mode:"pre_call",defaultOn:!1},zscaler:{provider:"ZscalerAiGuard",guardrailNameSuggestion:"Zscaler AI Guard",mode:"pre_call",defaultOn:!1},panw:{provider:"PanwPrismaAirs",guardrailNameSuggestion:"PANW Prisma AIRS",mode:"pre_call",defaultOn:!1},cisco_ai_defense:{provider:"CiscoAiDefense",guardrailNameSuggestion:"Cisco AI Defense",mode:"pre_call",defaultOn:!1},noma:{provider:"Noma",guardrailNameSuggestion:"Noma Security",mode:"pre_call",defaultOn:!1},aporia:{provider:"AporiaAi",guardrailNameSuggestion:"Aporia AI",mode:"pre_call",defaultOn:!1},aim:{provider:"Aim",guardrailNameSuggestion:"AIM Guardrail",mode:"pre_call",defaultOn:!1},cato_networks:{provider:"Cato Networks",guardrailNameSuggestion:"Cato Networks Guardrail",mode:"pre_call",defaultOn:!1},prompt_security:{provider:"PromptSecurity",guardrailNameSuggestion:"Prompt Security",mode:"pre_call",defaultOn:!1},lasso:{provider:"Lasso",guardrailNameSuggestion:"Lasso Guardrail",mode:"pre_call",defaultOn:!1},pangea:{provider:"Pangea",guardrailNameSuggestion:"Pangea Guardrail",mode:"pre_call",defaultOn:!1},enkryptai:{provider:"Enkryptai",guardrailNameSuggestion:"EnkryptAI",mode:"pre_call",defaultOn:!1},javelin:{provider:"Javelin",guardrailNameSuggestion:"Javelin Guardrails",mode:"pre_call",defaultOn:!1},pillar:{provider:"Pillar",guardrailNameSuggestion:"Pillar Guardrail",mode:"pre_call",defaultOn:!1},akto:{provider:"Akto",guardrailNameSuggestion:"Akto Guardrail",mode:"pre_call",defaultOn:!1},promptguard:{provider:"Promptguard",guardrailNameSuggestion:"PromptGuard",mode:"pre_call",defaultOn:!1},xecguard:{provider:"Xecguard",guardrailNameSuggestion:"XecGuard",mode:"pre_call",defaultOn:!1},repelloai:{provider:"Repelloai",guardrailNameSuggestion:"RepelloAI Argus",mode:"pre_call",defaultOn:!1}},as=({card:e,onBack:t,accessToken:a,onGuardrailCreated:s})=>{let[n,o]=(0,r.useState)(!1),[d,c]=(0,r.useState)("overview"),m=[{property:"Provider",value:"litellm"===e.category?"LiteLLM Content Filter":"Partner Guardrail"},...e.subcategory?[{property:"Subcategory",value:e.subcategory}]:[],..."litellm"===e.category?[{property:"Cost",value:"$0 / request"}]:[],..."litellm"===e.category?[{property:"External Dependencies",value:"None"}]:[],..."litellm"===e.category?[{property:"Latency",value:e.eval?.latency||"<1ms"}]:[]],u=e.eval?[{metric:"Precision",value:`${e.eval.precision}%`},{metric:"Recall",value:`${e.eval.recall}%`},{metric:"F1 Score",value:`${e.eval.f1}%`},{metric:"Test Cases",value:String(e.eval.testCases)},{metric:"False Positives",value:"0"},{metric:"False Negatives",value:"0"},{metric:"Latency (p50)",value:e.eval.latency}]:[],p=[{key:"overview",label:"Overview"},...e.eval?[{key:"eval",label:"Eval Results"}]:[]];return(0,l.jsxs)("div",{style:{maxWidth:960,margin:"0 auto"},children:[(0,l.jsxs)("div",{onClick:t,style:{display:"inline-flex",alignItems:"center",gap:6,color:"#5f6368",cursor:"pointer",fontSize:14,marginBottom:24},children:[(0,l.jsx)(ar.ArrowLeftOutlined,{style:{fontSize:11}}),(0,l.jsx)("span",{children:e.name})]}),(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:16,marginBottom:8},children:[(0,l.jsx)("img",{src:(0,ea.resolveLogoSrc)(e.logo),alt:"",style:{width:40,height:40,borderRadius:8,objectFit:"contain"},onError:e=>{e.target.style.display="none"}}),(0,l.jsx)("h1",{style:{fontSize:28,fontWeight:400,color:"#202124",margin:0,lineHeight:1.2},children:e.name})]}),(0,l.jsx)("p",{style:{fontSize:14,color:"#5f6368",margin:"0 0 20px 0",lineHeight:1.6},children:e.description}),(0,l.jsx)("div",{style:{display:"flex",gap:10,marginBottom:32},children:(0,l.jsx)(i.Button,{onClick:()=>o(!0),style:{borderRadius:20,padding:"4px 20px",height:36,borderColor:"#dadce0",color:"#1a73e8",fontWeight:500,fontSize:14},children:"Create Guardrail"})}),(0,l.jsx)("div",{style:{borderBottom:"1px solid #dadce0",marginBottom:28},children:(0,l.jsx)("div",{style:{display:"flex",gap:0},children:p.map(e=>(0,l.jsx)("div",{onClick:()=>c(e.key),style:{padding:"12px 20px",fontSize:14,color:d===e.key?"#1a73e8":"#5f6368",borderBottom:d===e.key?"3px solid #1a73e8":"3px solid transparent",cursor:"pointer",fontWeight:d===e.key?500:400,marginBottom:-1},children:e.label},e.key))})}),"overview"===d&&(0,l.jsxs)("div",{style:{display:"flex",gap:64},children:[(0,l.jsxs)("div",{style:{flex:1,minWidth:0},children:[(0,l.jsx)("h2",{style:{fontSize:18,fontWeight:400,color:"#202124",margin:"0 0 12px 0"},children:"Overview"}),(0,l.jsx)("p",{style:{fontSize:14,color:"#3c4043",lineHeight:1.7,margin:"0 0 32px 0"},children:e.description}),(0,l.jsx)("h2",{style:{fontSize:18,fontWeight:400,color:"#202124",margin:"0 0 4px 0"},children:"Guardrail Details"}),(0,l.jsx)("p",{style:{fontSize:13,color:"#5f6368",margin:"0 0 16px 0"},children:"Details are as follows"}),(0,l.jsxs)("table",{style:{width:"100%",borderCollapse:"collapse",fontSize:14},children:[(0,l.jsx)("thead",{children:(0,l.jsxs)("tr",{style:{borderBottom:"1px solid #dadce0"},children:[(0,l.jsx)("th",{style:{textAlign:"left",padding:"12px 0",color:"#5f6368",fontWeight:500,width:200},children:"Property"}),(0,l.jsx)("th",{style:{textAlign:"left",padding:"12px 0",color:"#5f6368",fontWeight:500},children:e.name})]})}),(0,l.jsx)("tbody",{children:m.map((e,t)=>(0,l.jsxs)("tr",{style:{borderBottom:"1px solid #f1f3f4"},children:[(0,l.jsx)("td",{style:{padding:"12px 0",color:"#3c4043"},children:e.property}),(0,l.jsx)("td",{style:{padding:"12px 0",color:"#202124"},children:e.value})]},t))})]})]}),(0,l.jsxs)("div",{style:{width:240,flexShrink:0},children:[(0,l.jsxs)("div",{style:{marginBottom:28},children:[(0,l.jsx)("div",{style:{fontSize:12,color:"#5f6368",marginBottom:4},children:"Guardrail ID"}),(0,l.jsxs)("div",{style:{fontSize:13,color:"#202124",wordBreak:"break-all"},children:["litellm/",e.id]})]}),(0,l.jsxs)("div",{style:{marginBottom:28},children:[(0,l.jsx)("div",{style:{fontSize:12,color:"#5f6368",marginBottom:4},children:"Type"}),(0,l.jsx)("div",{style:{fontSize:13,color:"#202124"},children:"litellm"===e.category?"Content Filter":"Partner"})]}),e.tags.length>0&&(0,l.jsxs)("div",{style:{marginBottom:28},children:[(0,l.jsx)("div",{style:{fontSize:12,color:"#5f6368",marginBottom:8},children:"Tags"}),(0,l.jsx)("div",{style:{display:"flex",flexWrap:"wrap",gap:6},children:e.tags.map(e=>(0,l.jsx)("span",{style:{fontSize:12,padding:"4px 12px",borderRadius:16,border:"1px solid #dadce0",color:"#3c4043",backgroundColor:"#fff"},children:e},e))})]})]})]}),"eval"===d&&(0,l.jsxs)("div",{children:[(0,l.jsx)("h2",{style:{fontSize:18,fontWeight:400,color:"#202124",margin:"0 0 16px 0"},children:"Eval Results"}),(0,l.jsxs)("table",{style:{width:"100%",maxWidth:560,borderCollapse:"collapse",fontSize:14},children:[(0,l.jsx)("thead",{children:(0,l.jsxs)("tr",{style:{backgroundColor:"#f8f9fa",borderBottom:"1px solid #dadce0"},children:[(0,l.jsx)("th",{style:{textAlign:"left",padding:"12px 16px",color:"#5f6368",fontWeight:500},children:"Metric"}),(0,l.jsx)("th",{style:{textAlign:"left",padding:"12px 16px",color:"#5f6368",fontWeight:500},children:"Value"})]})}),(0,l.jsx)("tbody",{children:u.map((e,t)=>(0,l.jsxs)("tr",{style:{borderBottom:"1px solid #f1f3f4"},children:[(0,l.jsx)("td",{style:{padding:"12px 16px",color:"#3c4043"},children:e.metric}),(0,l.jsx)("td",{style:{padding:"12px 16px",color:"#202124",fontWeight:500},children:e.value})]},t))})]})]}),(0,l.jsx)(e1,{visible:n,onClose:()=>o(!1),accessToken:a,onSuccess:()=>{o(!1),s()},preset:ai[e.id]})]})},an=({accessToken:e,onGuardrailCreated:t})=>{let[a,i]=(0,r.useState)(""),[s,n]=(0,r.useState)(null),[o,d]=(0,r.useState)(!1),c=ae.filter(e=>{if(!a)return!0;let t=a.toLowerCase();return e.name.toLowerCase().includes(t)||e.description.toLowerCase().includes(t)||e.tags.some(e=>e.toLowerCase().includes(t))}),m=c.filter(e=>"litellm"===e.category),u=c.filter(e=>"partner"===e.category);return s?(0,l.jsx)(as,{card:s,onBack:()=>n(null),accessToken:e,onGuardrailCreated:t}):(0,l.jsxs)("div",{children:[(0,l.jsx)("div",{style:{marginBottom:24},children:(0,l.jsx)(p.Input,{size:"large",placeholder:"Search guardrails",prefix:(0,l.jsx)(tQ.SearchOutlined,{style:{color:"#9ca3af"}}),value:a,onChange:e=>i(e.target.value),style:{borderRadius:8}})}),(0,l.jsxs)("div",{style:{marginBottom:40},children:[(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center",justifyContent:"space-between",marginBottom:4},children:[(0,l.jsx)("h2",{style:{fontSize:20,fontWeight:600,color:"#111827",margin:0},children:"LiteLLM Content Filter"}),(0,l.jsx)("span",{style:{display:"inline-flex",alignItems:"center",gap:6,fontSize:14,color:"#1a73e8",cursor:"pointer"},onClick:()=>d(!o),children:o?(0,l.jsx)(l.Fragment,{children:"Show less"}):(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(t7.ArrowRightOutlined,{style:{fontSize:12}}),`Show all (${m.length})`]})})]}),(0,l.jsx)("p",{style:{fontSize:13,color:"#6b7280",margin:"4px 0 20px 0"},children:"Built-in guardrails powered by LiteLLM. Zero latency, no external dependencies, no additional cost."}),(0,l.jsx)("div",{style:{display:"grid",gridTemplateColumns:"repeat(auto-fill, minmax(220px, 1fr))",gap:16},children:(o?m:m.slice(0,10)).map(e=>(0,l.jsx)(al,{card:e,onClick:()=>n(e)},e.id))})]}),(0,l.jsxs)("div",{style:{marginBottom:40},children:[(0,l.jsx)("h2",{style:{fontSize:20,fontWeight:600,color:"#111827",margin:"0 0 4px 0"},children:"Partner Guardrails"}),(0,l.jsx)("p",{style:{fontSize:13,color:"#6b7280",margin:"4px 0 20px 0"},children:"Third-party guardrail integrations from leading AI security providers."}),(0,l.jsx)("div",{style:{display:"grid",gridTemplateColumns:"repeat(auto-fill, minmax(220px, 1fr))",gap:16},children:u.map(e=>(0,l.jsx)(al,{card:e,onClick:()=>n(e)},e.id))})]})]})};var ao=e.i(988846),ad=e.i(837007),ac=e.i(409797),am=e.i(54131),au=e.i(995926),ap=e.i(634831),ag=e.i(438100),ax=e.i(302202),ah=e.i(328196),af=e.i(168118),ay=e.i(663435),aj=e.i(954616),a_=e.i(912598),ab=e.i(431703),av=e.i(135214),aw=e.i(243652);let aN=async(e,t)=>{let a=(0,m.getProxyBaseUrl)(),l=`${a}/guardrails/register`,r=await fetch(l,{method:"POST",headers:{[(0,m.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"},body:JSON.stringify(t)});if(!r.ok){let e=await r.json().catch(()=>({})),t=(0,ab.deriveErrorMessage)(e);throw(0,m.handleError)(t),Error(t)}return r.json()},aC=(0,aw.createQueryKeys)("guardrails");function aS(e){var t;let a=e.litellm_params??{},l=e.guardrail_info??{},r=a.headers,i=Array.isArray(r)?r.map(e=>({key:(e.key??e.name??"").toString(),value:String(e.value??"")})):"object"==typeof r&&null!==r?Object.entries(r).map(([e,t])=>({key:e,value:String(t??"")})):[],s=a.api_base??a.url??"",n=l.model??a.model??"—",o=a.forward_api_key??!0,d=Array.isArray(a.extra_headers)?a.extra_headers.filter(e=>"string"==typeof e):[];return{id:e.guardrail_id,team:e.team_id??"—",name:e.guardrail_name,endpoint:s,status:"pending_review"===(t=e.status)?"pending":"active"===t||"rejected"===t?t:"active",model:n,forwardKey:o,description:l.description??"",method:a.method??"POST",customHeaders:i,extraHeaders:d,submittedAt:function(e){if(!e)return"—";try{let t=new Date(e);return isNaN(t.getTime())?e:t.toISOString().slice(0,10)}catch{return e}}(e.submitted_at),submittedBy:e.submitted_by_email??e.submitted_by_user_id??"—",mode:a.mode,unreachable_fallback:a.unreachable_fallback,additionalProviderParams:a.additional_provider_specific_params,guardrailType:a.guardrail}}let ak={active:{label:"Active",bg:"bg-green-50",text:"text-green-700",dot:"bg-green-500"},pending:{label:"Pending Review",bg:"bg-yellow-50",text:"text-yellow-700",dot:"bg-yellow-500"},rejected:{label:"Rejected",bg:"bg-red-50",text:"text-red-700",dot:"bg-red-500"}},aI={"ML Platform":"bg-purple-100 text-purple-700","Data Science":"bg-blue-100 text-blue-700",Security:"bg-red-100 text-red-700","Customer Success":"bg-orange-100 text-orange-700",Legal:"bg-gray-100 text-gray-700",Finance:"bg-green-100 text-green-700"};function aA({label:e,value:t,color:a}){return(0,l.jsxs)("div",{className:"bg-white border border-gray-200 rounded-lg px-4 py-3",children:[(0,l.jsx)("div",{className:`text-2xl font-bold ${a}`,children:t}),(0,l.jsx)("div",{className:"text-xs text-gray-500 mt-0.5",children:e})]})}function aO({enabled:e,onToggle:t}){return(0,l.jsx)("button",{type:"button",onClick:t,role:"switch","aria-checked":e,className:`relative inline-flex h-5 w-9 items-center rounded-full transition-colors focus:outline-hidden focus:ring-2 focus:ring-blue-500 focus:ring-offset-1 ${e?"bg-blue-500":"bg-gray-200"}`,children:(0,l.jsx)("span",{className:`inline-block h-3.5 w-3.5 transform rounded-full bg-white shadow transition-transform ${e?"translate-x-4":"translate-x-0.5"}`})})}function aT({guardrail:e,isSelected:t,isHeadersExpanded:a,onSelect:r,onToggleForwardKey:i,onToggleHeaders:s,onApprove:n,onReject:o}){let d=ak[e.status],c=aI[e.team]??"bg-gray-100 text-gray-700";return(0,l.jsxs)("div",{className:`bg-white border rounded-lg p-4 transition-all ${t?"border-blue-400 ring-1 ring-blue-200":"border-gray-200"}`,children:[(0,l.jsxs)("div",{className:"flex items-start justify-between gap-4",children:[(0,l.jsxs)("div",{className:"flex-1 min-w-0",children:[(0,l.jsxs)("div",{className:"flex items-center gap-2 mb-1.5 flex-wrap",children:[(0,l.jsxs)("span",{className:`text-xs font-medium px-2 py-0.5 rounded-full ${c}`,children:["Team: ",e.team]}),(0,l.jsxs)("span",{className:`inline-flex items-center gap-1.5 text-xs font-medium px-2 py-0.5 rounded-full ${d.bg} ${d.text}`,children:[(0,l.jsx)("span",{className:`w-1.5 h-1.5 rounded-full ${d.dot}`}),d.label]})]}),(0,l.jsx)("h3",{className:"text-sm font-semibold text-gray-900 mb-1",children:e.name}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mb-2 line-clamp-1",children:e.description}),(0,l.jsxs)("div",{className:"flex items-center gap-1.5 mb-2",children:[(0,l.jsx)(ax.ServerIcon,{className:"h-3.5 w-3.5 text-gray-400 shrink-0"}),(0,l.jsx)("code",{className:"text-xs text-gray-500 font-mono truncate",children:e.endpoint})]}),(0,l.jsxs)("div",{className:"flex items-center gap-4 text-xs text-gray-500",children:[(0,l.jsxs)("span",{children:["Model: ",(0,l.jsx)("span",{className:"font-medium text-gray-700",children:e.model})]}),(0,l.jsxs)("span",{children:["Submitted: ",(0,l.jsx)("span",{className:"font-medium text-gray-700",children:e.submittedAt})]})]})]}),(0,l.jsxs)("div",{className:"flex flex-col items-end gap-2 shrink-0",children:[(0,l.jsxs)("div",{className:"flex items-center gap-2",children:[(0,l.jsx)("span",{className:"text-xs text-gray-500 whitespace-nowrap",children:"Forward API Key"}),(0,l.jsx)(aO,{enabled:e.forwardKey,onToggle:i})]}),(0,l.jsxs)("div",{className:"flex items-center gap-2 mt-1",children:[(0,l.jsx)("button",{type:"button",onClick:r,className:"text-xs border border-gray-300 text-gray-600 hover:bg-gray-50 px-3 py-1.5 rounded-md transition-colors font-medium",children:t?"Close":"Review"}),"pending"===e.status&&(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)("button",{type:"button",onClick:n,className:"text-xs bg-green-500 hover:bg-green-600 text-white px-3 py-1.5 rounded-md transition-colors font-medium",children:"Approve"}),(0,l.jsx)("button",{type:"button",onClick:o,className:"text-xs border border-red-300 text-red-600 hover:bg-red-50 px-3 py-1.5 rounded-md transition-colors font-medium",children:"Reject"})]})]})]})]}),(0,l.jsxs)("div",{className:"mt-3 pt-3 border-t border-gray-100",children:[(0,l.jsxs)("button",{type:"button",onClick:s,className:"flex items-center gap-1.5 text-xs text-gray-500 hover:text-gray-700 transition-colors",children:[a?(0,l.jsx)(am.ChevronUpIcon,{className:"h-3.5 w-3.5"}):(0,l.jsx)(ac.ChevronDownIcon,{className:"h-3.5 w-3.5"}),"Static headers",e.customHeaders.length>0&&(0,l.jsx)("span",{className:"ml-1 bg-gray-100 text-gray-600 rounded-full px-1.5 py-0.5 text-xs",children:e.customHeaders.length})]}),a&&(0,l.jsx)("div",{className:"mt-2",children:0===e.customHeaders.length?(0,l.jsx)("p",{className:"text-xs text-gray-400 italic",children:"No static headers configured."}):(0,l.jsx)("div",{className:"space-y-1",children:e.customHeaders.map((e,t)=>(0,l.jsxs)("div",{className:"flex items-center gap-2 text-xs font-mono",children:[(0,l.jsx)("span",{className:"text-gray-500 bg-gray-50 border border-gray-200 rounded-sm px-2 py-0.5",children:e.key}),(0,l.jsx)("span",{className:"text-gray-400",children:":"}),(0,l.jsx)("span",{className:"text-gray-700 bg-gray-50 border border-gray-200 rounded-sm px-2 py-0.5",children:e.value})]},`${e.key}-${t}`))})})]})]})}function aP({label:e,children:t}){return(0,l.jsxs)("div",{children:[(0,l.jsx)("div",{className:"text-xs font-semibold text-gray-500 mb-1",children:e}),(0,l.jsx)("div",{children:t})]})}function aL({guardrail:e,onClose:t,onApprove:a,onReject:i,onToggleForwardKey:s,onUpdateCustomHeaders:n,onUpdateExtraHeaders:o}){let[d,c]=(0,r.useState)(!1),[m,u]=(0,r.useState)(""),[p,g]=(0,r.useState)(""),[x,h]=(0,r.useState)(""),f=ak[e.status],y=aI[e.team]??"bg-gray-100 text-gray-700";return(0,l.jsx)("div",{className:"w-96 shrink-0 bg-white overflow-auto",children:(0,l.jsxs)("div",{className:"p-5",children:[(0,l.jsxs)("div",{className:"flex items-start justify-between mb-4",children:[(0,l.jsxs)("div",{children:[(0,l.jsxs)("div",{className:"flex items-center gap-2 mb-1",children:[(0,l.jsxs)("span",{className:`text-xs font-medium px-2 py-0.5 rounded-full ${y}`,children:["Team: ",e.team]}),(0,l.jsxs)("span",{className:`inline-flex items-center gap-1.5 text-xs font-medium px-2 py-0.5 rounded-full ${f.bg} ${f.text}`,children:[(0,l.jsx)("span",{className:`w-1.5 h-1.5 rounded-full ${f.dot}`}),f.label]})]}),(0,l.jsx)("h2",{className:"text-base font-semibold text-gray-900",children:e.name}),(0,l.jsxs)("p",{className:"text-xs text-gray-500 mt-0.5",children:["Submitted by ",e.submittedBy," on ",e.submittedAt]})]}),(0,l.jsx)("button",{type:"button",onClick:t,className:"text-gray-400 hover:text-gray-600 transition-colors","aria-label":"Close detail panel",children:(0,l.jsx)(au.XIcon,{className:"h-4 w-4"})})]}),(0,l.jsx)("p",{className:"text-sm text-gray-600 mb-5",children:e.description}),(0,l.jsxs)("div",{className:"space-y-4",children:[(0,l.jsx)(aP,{label:"Endpoint",children:(0,l.jsxs)("div",{className:"flex items-center gap-1.5",children:[(0,l.jsx)("code",{className:"text-xs font-mono text-gray-700 break-all",children:e.endpoint}),(0,l.jsx)("a",{href:e.endpoint,target:"_blank",rel:"noopener noreferrer",className:"text-gray-400 hover:text-blue-500 shrink-0",children:(0,l.jsx)(ap.ExternalLinkIcon,{className:"h-3.5 w-3.5"})})]})}),(0,l.jsx)(aP,{label:"Method",children:(0,l.jsx)("span",{className:"text-xs font-mono font-medium text-gray-700 bg-gray-100 px-2 py-0.5 rounded-sm",children:e.method})}),(0,l.jsxs)("div",{className:"border border-blue-100 bg-blue-50 rounded-lg p-3",children:[(0,l.jsxs)("div",{className:"flex items-center justify-between mb-2",children:[(0,l.jsxs)("div",{className:"flex items-center gap-1.5",children:[(0,l.jsx)(ag.KeyIcon,{className:"h-3.5 w-3.5 text-blue-500"}),(0,l.jsx)("span",{className:"text-xs font-semibold text-blue-800",children:"Forward LiteLLM API Key"})]}),(0,l.jsx)(aO,{enabled:e.forwardKey,onToggle:s})]}),(0,l.jsxs)("p",{className:"text-xs text-blue-700 leading-relaxed",children:["When enabled, the caller's LiteLLM API key is forwarded as an"," ",(0,l.jsx)("code",{className:"font-mono bg-blue-100 px-1 rounded-sm",children:"Authorization"}),"header to your guardrail endpoint. This allows your guardrail to authenticate model calls using the original caller's credentials."]})]}),(0,l.jsxs)("div",{children:[(0,l.jsxs)("div",{className:"flex items-center gap-1.5 mb-2",children:[(0,l.jsx)("span",{className:"text-xs font-semibold text-gray-700",children:"Static headers"}),e.customHeaders.length>0&&(0,l.jsx)("span",{className:"bg-gray-100 text-gray-600 rounded-full px-1.5 py-0.5 text-xs",children:e.customHeaders.length})]}),(0,l.jsx)("p",{className:"text-xs text-gray-400 mb-2",children:"Sent with every request to the guardrail."}),0===e.customHeaders.length?(0,l.jsx)("p",{className:"text-xs text-gray-400 italic mb-2",children:"No static headers configured."}):(0,l.jsx)("ul",{className:"list-none space-y-1 mb-2",children:e.customHeaders.map((t,a)=>(0,l.jsxs)("li",{className:"flex items-center justify-between gap-2 text-xs font-mono bg-gray-50 border border-gray-200 rounded-sm px-2 py-1.5",children:[(0,l.jsxs)("span",{className:"text-gray-700 truncate",children:[t.key,": ",t.value]}),(0,l.jsx)("button",{type:"button",onClick:()=>n(e.customHeaders.filter((e,t)=>t!==a)),className:"text-gray-400 hover:text-red-600 shrink-0","aria-label":`Remove ${t.key}`,children:(0,l.jsx)(au.XIcon,{className:"h-3.5 w-3.5"})})]},`${t.key}-${a}`))}),(0,l.jsxs)("div",{className:"flex flex-col gap-2 sm:flex-row sm:items-end",children:[(0,l.jsx)("input",{type:"text",value:p,onChange:e=>g(e.target.value),placeholder:"Header name (e.g. X-API-Key)",className:"flex-1 min-w-0 text-xs font-mono border border-gray-200 rounded-sm px-2 py-1.5 text-gray-700 placeholder-gray-400 focus:outline-hidden focus:ring-1 focus:ring-blue-500",onKeyDown:t=>{if("Enter"===t.key){t.preventDefault();let a=p.trim(),l=x.trim();a&&!e.customHeaders.some(e=>e.key.toLowerCase()===a.toLowerCase())&&(n([...e.customHeaders,{key:a,value:l}]),g(""),h(""))}}}),(0,l.jsx)("input",{type:"text",value:x,onChange:e=>h(e.target.value),placeholder:"Value",className:"flex-1 min-w-0 text-xs font-mono border border-gray-200 rounded-sm px-2 py-1.5 text-gray-700 placeholder-gray-400 focus:outline-hidden focus:ring-1 focus:ring-blue-500",onKeyDown:t=>{if("Enter"===t.key){t.preventDefault();let a=p.trim(),l=x.trim();a&&!e.customHeaders.some(e=>e.key.toLowerCase()===a.toLowerCase())&&(n([...e.customHeaders,{key:a,value:l}]),g(""),h(""))}}}),(0,l.jsx)("button",{type:"button",onClick:()=>{let t=p.trim(),a=x.trim();t&&!e.customHeaders.some(e=>e.key.toLowerCase()===t.toLowerCase())&&(n([...e.customHeaders,{key:t,value:a}]),g(""),h(""))},className:"text-xs font-medium text-blue-600 hover:text-blue-700 border border-blue-200 bg-blue-50 hover:bg-blue-100 px-2 py-1.5 rounded-sm transition-colors shrink-0",children:"Add"})]})]}),(0,l.jsxs)("div",{children:[(0,l.jsxs)("div",{className:"flex items-center gap-1.5 mb-2",children:[(0,l.jsx)("span",{className:"text-xs font-semibold text-gray-700",children:"Forward client headers"}),e.extraHeaders.length>0&&(0,l.jsx)("span",{className:"bg-gray-100 text-gray-600 rounded-full px-1.5 py-0.5 text-xs",children:e.extraHeaders.length})]}),(0,l.jsx)("p",{className:"text-xs text-gray-400 mb-2",children:"Allowed header names to forward from the client request to the guardrail (e.g. x-request-id)."}),0===e.extraHeaders.length?(0,l.jsx)("p",{className:"text-xs text-gray-400 italic mb-2",children:"No forward client headers configured."}):(0,l.jsx)("ul",{className:"list-none space-y-1 mb-2",children:e.extraHeaders.map((t,a)=>(0,l.jsxs)("li",{className:"flex items-center justify-between gap-2 text-xs font-mono bg-gray-50 border border-gray-200 rounded-sm px-2 py-1.5",children:[(0,l.jsx)("span",{className:"text-gray-700 truncate",children:t}),(0,l.jsx)("button",{type:"button",onClick:()=>o(e.extraHeaders.filter((e,t)=>t!==a)),className:"text-gray-400 hover:text-red-600 shrink-0","aria-label":`Remove ${t}`,children:(0,l.jsx)(au.XIcon,{className:"h-3.5 w-3.5"})})]},`${t}-${a}`))}),(0,l.jsxs)("div",{className:"flex gap-2",children:[(0,l.jsx)("input",{type:"text",value:m,onChange:e=>u(e.target.value),placeholder:"e.g. x-request-id",className:"flex-1 min-w-0 text-xs font-mono border border-gray-200 rounded-sm px-2 py-1.5 text-gray-700 placeholder-gray-400 focus:outline-hidden focus:ring-1 focus:ring-blue-500",onKeyDown:t=>{if("Enter"===t.key){t.preventDefault();let a=m.trim().toLowerCase();a&&!e.extraHeaders.map(e=>e.toLowerCase()).includes(a)&&(o([...e.extraHeaders,a]),u(""))}}}),(0,l.jsx)("button",{type:"button",onClick:()=>{let t=m.trim().toLowerCase();t&&!e.extraHeaders.map(e=>e.toLowerCase()).includes(t)&&(o([...e.extraHeaders,t]),u(""))},className:"text-xs font-medium text-blue-600 hover:text-blue-700 border border-blue-200 bg-blue-50 hover:bg-blue-100 px-2 py-1.5 rounded-sm transition-colors",children:"Add"})]})]}),(0,l.jsxs)("div",{className:"border border-gray-200 rounded-lg overflow-hidden",children:[(0,l.jsxs)("button",{type:"button",onClick:()=>c(!d),className:"w-full flex items-center justify-between px-3 py-2 text-left text-xs font-semibold text-gray-700 bg-gray-50 hover:bg-gray-100 transition-colors",children:[(0,l.jsx)("span",{children:"Equivalent config"}),d?(0,l.jsx)(am.ChevronUpIcon,{className:"h-3.5 w-3.5 text-gray-500"}):(0,l.jsx)(ac.ChevronDownIcon,{className:"h-3.5 w-3.5 text-gray-500"})]}),d&&(0,l.jsx)("pre",{className:"p-3 text-xs font-mono text-gray-700 bg-white border-t border-gray-200 overflow-x-auto whitespace-pre-wrap break-all",children:function(e){let t=["litellm_settings:"," guardrails:",` - guardrail_name: "${e.name.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`," litellm_params:",` guardrail: ${e.guardrailType??"generic_guardrail_api"}`,` mode: ${e.mode??"pre_call"} # or post_call, during_call`,` api_base: ${e.endpoint||"https://your-guardrail-api.com"}`," api_key: os.environ/YOUR_GUARDRAIL_API_KEY # optional",` unreachable_fallback: ${e.unreachable_fallback??"fail_closed"} # default: fail_closed. Set to fail_open to proceed if the guardrail endpoint is unreachable.`,` forward_api_key: ${e.forwardKey}`];if(e.model&&"—"!==e.model&&t.push(` model: "${e.model}" # LLM model name sent to the guardrail for context`),e.customHeaders.length>0)for(let a of(t.push(" headers: # static headers (sent with every request)"),e.customHeaders))t.push(` ${a.key}: "${String(a.value).replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`);if(e.extraHeaders.length>0)for(let a of(t.push(" extra_headers: # forward these client request headers to the guardrail"),e.extraHeaders))t.push(` - ${a}`);if(e.additionalProviderParams&&Object.keys(e.additionalProviderParams).length>0)for(let[a,l]of(t.push(" additional_provider_specific_params:"),Object.entries(e.additionalProviderParams))){let e="string"==typeof l?`"${l}"`:String(l);t.push(` ${a}: ${e}`)}return t.join("\n")}(e)})]}),(0,l.jsxs)("div",{className:"flex items-start gap-2 bg-gray-50 border border-gray-200 rounded-lg p-3",children:[(0,l.jsx)(af.InfoIcon,{className:"h-3.5 w-3.5 text-gray-400 shrink-0 mt-0.5"}),(0,l.jsxs)("p",{className:"text-xs text-gray-500 leading-relaxed",children:["This guardrail runs on a separate instance. It receives the user request and forwards the result to the next step in the pipeline. See"," ",(0,l.jsx)("a",{href:"https://docs.litellm.ai/docs/adding_provider/generic_guardrail_api",target:"_blank",rel:"noopener noreferrer",className:"text-blue-500 hover:underline",children:"LiteLLM Generic Guardrail API docs"})," ","for configuration details."]})]})]}),(0,l.jsxs)("div",{className:"mt-5 pt-4 border-t border-gray-100 space-y-2",children:[(0,l.jsxs)("button",{type:"button",className:"w-full flex items-center justify-center gap-2 border border-gray-300 text-gray-700 hover:bg-gray-50 text-sm font-medium py-2 rounded-md transition-colors",children:[(0,l.jsx)(ap.ExternalLinkIcon,{className:"h-4 w-4"}),"Test Endpoint"]}),"pending"===e.status&&(0,l.jsxs)("div",{className:"flex gap-2",children:[(0,l.jsxs)("button",{type:"button",onClick:a,className:"flex-1 flex items-center justify-center gap-1.5 bg-green-500 hover:bg-green-600 text-white text-sm font-medium py-2 rounded-md transition-colors",children:[(0,l.jsx)(tN.CheckIcon,{className:"h-4 w-4"}),"Approve"]}),(0,l.jsxs)("button",{type:"button",onClick:i,className:"flex-1 flex items-center justify-center gap-1.5 border border-red-300 text-red-600 hover:bg-red-50 text-sm font-medium py-2 rounded-md transition-colors",children:[(0,l.jsx)(au.XIcon,{className:"h-4 w-4"}),"Reject"]})]})]})]})})}function aB({action:e,guardrailName:t,onConfirm:a,onCancel:r}){let i="approve"===e;return(0,l.jsx)("div",{className:"fixed inset-0 bg-black/30 flex items-center justify-center z-50",children:(0,l.jsxs)("div",{className:"bg-white rounded-xl shadow-xl p-6 max-w-sm w-full mx-4",children:[(0,l.jsx)("div",{className:`w-10 h-10 rounded-full flex items-center justify-center mb-4 ${i?"bg-green-100":"bg-red-100"}`,children:i?(0,l.jsx)(tN.CheckIcon,{className:"h-5 w-5 text-green-600"}):(0,l.jsx)(ah.AlertCircleIcon,{className:"h-5 w-5 text-red-600"})}),(0,l.jsx)("h3",{className:"text-base font-semibold text-gray-900 mb-1",children:i?"Approve Guardrail":"Reject Guardrail"}),(0,l.jsxs)("p",{className:"text-sm text-gray-500 mb-5",children:["Are you sure you want to ",e," ",(0,l.jsxs)("span",{className:"font-medium text-gray-700",children:['"',t,'"']}),"?"," ",i?"This will make it active and available for use.":"This will mark it as rejected and notify the team."]}),(0,l.jsxs)("div",{className:"flex gap-3",children:[(0,l.jsx)("button",{type:"button",onClick:r,className:"flex-1 border border-gray-300 text-gray-700 hover:bg-gray-50 text-sm font-medium py-2 rounded-md transition-colors",children:"Cancel"}),(0,l.jsx)("button",{type:"button",onClick:a,className:`flex-1 text-white text-sm font-medium py-2 rounded-md transition-colors ${i?"bg-green-500 hover:bg-green-600":"bg-red-500 hover:bg-red-600"}`,children:i?"Approve":"Reject"})]})]})})}function aF({accessToken:e}){let[t,a]=(0,r.useState)([]),[i,s]=(0,r.useState)({total:0,pending_review:0,active:0,rejected:0}),[n,o]=(0,r.useState)(""),[d,c]=(0,r.useState)("all"),[h,f]=(0,r.useState)(null),[j,_]=(0,r.useState)(new Set),[b,v]=(0,r.useState)(null),[w,N]=(0,r.useState)(!0),[C,S]=(0,r.useState)(null),[k,I]=(0,r.useState)(""),[A,O]=(0,r.useState)(!1),[T]=u.Form.useForm(),P=(()=>{let{accessToken:e}=(0,av.default)(),t=(0,a_.useQueryClient)();return(0,aj.useMutation)({mutationFn:async t=>{if(!e)throw Error("Access token is required");return aN(e,t)},onSuccess:()=>{t.invalidateQueries({queryKey:aC.all})}})})();(0,r.useEffect)(()=>{let e=setTimeout(()=>I(n),300);return()=>clearTimeout(e)},[n]);let L=(0,r.useCallback)(async()=>{if(!e)return void N(!1);N(!0),S(null);try{let t="all"===d?void 0:"pending"===d?"pending_review":d,l=await (0,m.listGuardrailSubmissions)(e,{status:t,search:k.trim()||void 0});a(l.submissions.map(aS)),s(l.summary)}catch(e){S(e instanceof Error?e.message:"Failed to load submissions"),a([])}finally{N(!1)}},[e,d,k]);(0,r.useEffect)(()=>{L()},[L]);let B=t.find(e=>e.id===h)??null,F=i.total,$=i.pending_review,E=i.active,M=i.rejected;async function R(l){if(!e)return;let r=t.find(e=>e.id===l);if(!r)return;let i=!r.forwardKey;try{await (0,m.updateGuardrailCall)(e,l,{litellm_params:{forward_api_key:i}}),a(e=>e.map(e=>e.id===l?{...e,forwardKey:i}:e)),y.default.success(i?"Forward API key enabled":"Forward API key disabled")}catch{y.default.fromBackend("Failed to update forward API key")}}async function G(t,l){if(!e)return;let r={};for(let{key:e,value:t}of l)e.trim()&&(r[e.trim()]=t);try{await (0,m.updateGuardrailCall)(e,t,{litellm_params:{headers:r}}),a(e=>e.map(e=>e.id===t?{...e,customHeaders:l.filter(e=>e.key.trim())}:e)),y.default.success("Static headers updated")}catch{y.default.fromBackend("Failed to update static headers")}}async function z(t,l){if(e)try{await (0,m.updateGuardrailCall)(e,t,{litellm_params:{extra_headers:l}}),a(e=>e.map(e=>e.id===t?{...e,extraHeaders:l}:e)),y.default.success("Forward client headers updated")}catch{y.default.fromBackend("Failed to update forward client headers")}}async function D(t){if(e)try{await (0,m.approveGuardrailSubmission)(e,t),v(null),h===t&&f(null),await L(),y.default.success("Guardrail approved")}catch{y.default.fromBackend("Failed to approve guardrail")}}async function K(t){if(e)try{await (0,m.rejectGuardrailSubmission)(e,t),v(null),h===t&&f(null),await L(),y.default.success("Guardrail rejected")}catch{y.default.fromBackend("Failed to reject guardrail")}}return(0,l.jsxs)("div",{className:"flex h-full",children:[(0,l.jsxs)("div",{className:`flex-1 min-w-0 p-6 overflow-auto ${B?"border-r border-gray-200":""}`,children:[(0,l.jsxs)("div",{className:"grid grid-cols-4 gap-4 mb-6",children:[(0,l.jsx)(aA,{label:"Total Submitted",value:F,color:"text-gray-900"}),(0,l.jsx)(aA,{label:"Pending Review",value:$,color:"text-yellow-600"}),(0,l.jsx)(aA,{label:"Active",value:E,color:"text-green-600"}),(0,l.jsx)(aA,{label:"Rejected",value:M,color:"text-red-600"})]}),(0,l.jsxs)("div",{className:"flex items-center gap-3 mb-5",children:[(0,l.jsxs)("div",{className:"relative flex-1 max-w-xs",children:[(0,l.jsx)(ao.SearchIcon,{className:"absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-gray-400"}),(0,l.jsx)("input",{type:"text",placeholder:"Search guardrails...",value:n,onChange:e=>o(e.target.value),className:"w-full pl-9 pr-4 py-2 border border-gray-200 rounded-md text-sm text-gray-700 placeholder-gray-400 focus:outline-hidden focus:ring-1 focus:ring-blue-500 focus:border-blue-500"})]}),(0,l.jsxs)("select",{value:d,onChange:e=>c(e.target.value),className:"border border-gray-200 rounded-md px-3 py-2 text-sm text-gray-700 focus:outline-hidden focus:ring-1 focus:ring-blue-500 focus:border-blue-500 bg-white",children:[(0,l.jsx)("option",{value:"all",children:"All Status"}),(0,l.jsx)("option",{value:"pending",children:"Pending Review"}),(0,l.jsx)("option",{value:"active",children:"Active"}),(0,l.jsx)("option",{value:"rejected",children:"Rejected"})]}),(0,l.jsxs)("button",{type:"button",onClick:()=>O(!0),className:"ml-auto flex items-center gap-2 bg-blue-500 hover:bg-blue-600 text-white text-sm font-medium px-4 py-2 rounded-md transition-colors",children:[(0,l.jsx)(ad.PlusIcon,{className:"h-4 w-4"}),"Add Guardrail"]})]}),(0,l.jsxs)("div",{className:"space-y-3",children:[w&&(0,l.jsx)("div",{className:"text-center py-12 text-gray-500 text-sm",children:"Loading submissions…"}),C&&(0,l.jsx)("div",{className:"text-center py-12 text-red-600 text-sm",children:C}),!w&&!C&&0===t.length&&(0,l.jsx)("div",{className:"text-center py-12 text-gray-400 text-sm",children:"No guardrails match your filters."}),!w&&!C&&t.map(e=>(0,l.jsx)(aT,{guardrail:e,isSelected:h===e.id,isHeadersExpanded:j.has(e.id),onSelect:()=>f(h===e.id?null:e.id),onToggleForwardKey:()=>R(e.id),onToggleHeaders:()=>{var t;return t=e.id,void _(e=>{let a=new Set(e);return a.has(t)?a.delete(t):a.add(t),a})},onApprove:()=>v({id:e.id,action:"approve"}),onReject:()=>v({id:e.id,action:"reject"})},e.id))]})]}),B&&(0,l.jsx)(aL,{guardrail:B,onClose:()=>f(null),onApprove:()=>v({id:B.id,action:"approve"}),onReject:()=>v({id:B.id,action:"reject"}),onToggleForwardKey:()=>R(B.id),onUpdateCustomHeaders:e=>G(B.id,e),onUpdateExtraHeaders:e=>z(B.id,e)}),b&&(0,l.jsx)(aB,{action:b.action,guardrailName:t.find(e=>e.id===b.id)?.name??"",onConfirm:()=>"approve"===b.action?D(b.id):K(b.id),onCancel:()=>v(null)}),(0,l.jsxs)(g.Modal,{title:"Submit Guardrail for Review",open:A,onCancel:()=>{O(!1),T.resetFields()},onOk:()=>T.submit(),okText:"Submit for Review",children:[(0,l.jsx)("div",{className:"rounded-md bg-blue-50 border border-blue-200 px-4 py-3 text-sm text-blue-800 mb-4",children:"Your guardrail will be sent for admin review before it becomes active."}),(0,l.jsxs)(u.Form,{form:T,layout:"vertical",initialValues:{mode:"pre_call"},onFinish:async e=>{let t={...e.extra_litellm_params?JSON.parse(e.extra_litellm_params):{},guardrail:"generic_guardrail_api",mode:e.mode,api_base:e.api_base};try{await P.mutateAsync({team_id:e.team_id,guardrail_name:e.guardrail_name,litellm_params:t,guardrail_info:e.guardrail_info?JSON.parse(e.guardrail_info):void 0}),y.default.success("Guardrail submitted for review"),O(!1),T.resetFields(),L()}catch{}},children:[(0,l.jsx)(u.Form.Item,{label:"Team",name:"team_id",rules:[{required:!0,message:"Select a team"}],children:(0,l.jsx)(ay.default,{})}),(0,l.jsx)(u.Form.Item,{label:"Guardrail Name",name:"guardrail_name",rules:[{required:!0,message:"Enter a guardrail name"}],children:(0,l.jsx)(p.Input,{placeholder:"e.g. pii-detection"})}),(0,l.jsx)(u.Form.Item,{label:"Mode",name:"mode",rules:[{required:!0,message:"Select a mode"}],children:(0,l.jsxs)(x.Select,{children:[(0,l.jsx)(x.Select.Option,{value:"pre_call",children:"Pre Call"}),(0,l.jsx)(x.Select.Option,{value:"post_call",children:"Post Call"}),(0,l.jsx)(x.Select.Option,{value:"during_call",children:"During Call"})]})}),(0,l.jsx)(u.Form.Item,{label:"API Base URL",name:"api_base",rules:[{required:!0,message:"Enter the API base URL"},{type:"url",message:"Must be a valid URL"}],children:(0,l.jsx)(p.Input,{placeholder:"https://your-guardrail-api.com/v1/check",className:"font-mono"})}),(0,l.jsx)(u.Form.Item,{label:"Additional litellm_params (optional)",name:"extra_litellm_params",tooltip:"JSON object merged into litellm_params. e.g. forward_api_key, headers, model, unreachable_fallback",rules:[{validator:(e,t)=>{if(!t)return Promise.resolve();try{let e=JSON.parse(t);if("object"!=typeof e||Array.isArray(e))return Promise.reject("Must be a JSON object");return Promise.resolve()}catch{return Promise.reject("Invalid JSON")}}}],children:(0,l.jsx)(p.Input.TextArea,{rows:3,className:"font-mono text-xs",placeholder:'{"forward_api_key": true, "headers": {"X-Custom": "value"}}'})}),(0,l.jsx)(u.Form.Item,{label:"Guardrail Info (optional)",name:"guardrail_info",rules:[{validator:(e,t)=>{if(!t)return Promise.resolve();try{return JSON.parse(t),Promise.resolve()}catch{return Promise.reject("Invalid JSON")}}}],children:(0,l.jsx)(p.Input.TextArea,{rows:3,className:"font-mono text-xs",placeholder:'{"description": "Detects PII in requests"}'})})]})]})]})}let a$=({accessToken:e,userRole:t})=>{let[a,u]=(0,r.useState)([]),[p,g]=(0,r.useState)(!1),[x,h]=(0,r.useState)(!1),[f,j]=(0,r.useState)(!1),[_,b]=(0,r.useState)(!1),[v,w]=(0,r.useState)(null),[N,C]=(0,r.useState)(!1),[S,k]=(0,r.useState)(null),I=!!t&&(0,tg.isAdminRole)(t),A=async()=>{if(e){j(!0);try{let t=await (0,m.getGuardrailsList)(e);u(t.guardrails)}catch(e){console.error("Error fetching guardrails:",e)}finally{j(!1)}}};(0,r.useEffect)(()=>{A()},[e]);let O=()=>{A()},T=async()=>{if(v&&e){b(!0);try{await (0,m.deleteGuardrailCall)(e,v.guardrail_id),y.default.success(`Guardrail "${v.guardrail_name}" deleted successfully`),await A()}catch(e){console.error("Error deleting guardrail:",e),y.default.fromBackend("Failed to delete guardrail")}finally{b(!1),C(!1),w(null)}}},P=v&&v.litellm_params?eg(v.litellm_params.guardrail).displayName:void 0;return(0,l.jsx)("div",{className:"w-full mx-auto flex-auto overflow-y-auto m-8 p-2",children:(0,l.jsx)(n.Tabs,{defaultActiveKey:"guardrails",items:[...I?[{key:"garden",label:"Guardrail Garden",children:(0,l.jsx)(an,{accessToken:e,onGuardrailCreated:O})},{key:"guardrails",label:"Guardrails",children:(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)("div",{className:"flex justify-between items-center mb-4",children:(0,l.jsx)(s.Dropdown,{menu:{items:[{key:"provider",icon:(0,l.jsx)(d.PlusOutlined,{}),label:"Add Provider Guardrail",onClick:()=>{S&&k(null),g(!0)}},{key:"custom_code",icon:(0,l.jsx)(c.CodeOutlined,{}),label:"Create Custom Code Guardrail",onClick:()=>{S&&k(null),h(!0)}}]},trigger:["click"],disabled:!e,children:(0,l.jsxs)(i.Button,{disabled:!e,children:["+ Add New Guardrail ",(0,l.jsx)(o.DownOutlined,{className:"ml-2"})]})})}),S?(0,l.jsx)(tW,{guardrailId:S,onClose:()=>k(null),accessToken:e,isAdmin:I}):(0,l.jsx)(tp,{guardrailsList:a,isLoading:f,onDeleteClick:(e,t)=>{w(a.find(t=>t.guardrail_id===e)||null),C(!0)},accessToken:e,onGuardrailUpdated:A,isAdmin:I,onGuardrailClick:e=>k(e)}),(0,l.jsx)(e1,{visible:p,onClose:()=>{g(!1)},accessToken:e,onSuccess:O}),(0,l.jsx)(tJ,{visible:x,onClose:()=>{h(!1)},accessToken:e,onSuccess:O}),(0,l.jsx)(t3.default,{isOpen:N,title:"Delete Guardrail",message:`Are you sure you want to delete guardrail: ${v?.guardrail_name}? This action cannot be undone.`,resourceInformationTitle:"Guardrail Information",resourceInformation:[{label:"Name",value:v?.guardrail_name},{label:"ID",value:v?.guardrail_id,code:!0},{label:"Provider",value:P},{label:"Mode",value:v?.litellm_params.mode},{label:"Default On",value:v?.litellm_params.default_on?"Yes":"No"}],onCancel:()=>{C(!1),w(null)},onOk:T,confirmLoading:_})]})},{key:"playground",label:"Test Playground",disabled:!e,children:(0,l.jsx)(t6,{guardrailsList:a,isLoading:f,accessToken:e,onClose:()=>{}})}]:[],{key:"submitted",label:"Submitted Guardrails",children:(0,l.jsx)(aF,{accessToken:e})}]})})};e.s(["default",0,function(){let{accessToken:e,userRole:t}=(0,av.default)();return(0,l.jsx)(a$,{accessToken:e,userRole:t})}],509345)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/0.bx44y-6~tug.js b/litellm/proxy/_experimental/out/_next/static/chunks/0.bx44y-6~tug.js deleted file mode 100644 index 343688035a1..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/0.bx44y-6~tug.js +++ /dev/null @@ -1,10 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,954616,e=>{"use strict";var t=e.i(271645),n=e.i(114272),i=e.i(540143),l=e.i(915823),r=e.i(619273),a=class extends l.Subscribable{#e;#t=void 0;#n;#i;constructor(e,t){super(),this.#e=e,this.setOptions(t),this.bindMethods(),this.#l()}bindMethods(){this.mutate=this.mutate.bind(this),this.reset=this.reset.bind(this)}setOptions(e){let t=this.options;this.options=this.#e.defaultMutationOptions(e),(0,r.shallowEqualObjects)(this.options,t)||this.#e.getMutationCache().notify({type:"observerOptionsUpdated",mutation:this.#n,observer:this}),t?.mutationKey&&this.options.mutationKey&&(0,r.hashKey)(t.mutationKey)!==(0,r.hashKey)(this.options.mutationKey)?this.reset():this.#n?.state.status==="pending"&&this.#n.setOptions(this.options)}onUnsubscribe(){this.hasListeners()||this.#n?.removeObserver(this)}onMutationUpdate(e){this.#l(),this.#r(e)}getCurrentResult(){return this.#t}reset(){this.#n?.removeObserver(this),this.#n=void 0,this.#l(),this.#r()}mutate(e,t){return this.#i=t,this.#n?.removeObserver(this),this.#n=this.#e.getMutationCache().build(this.#e,this.options),this.#n.addObserver(this),this.#n.execute(e)}#l(){let e=this.#n?.state??(0,n.getDefaultState)();this.#t={...e,isPending:"pending"===e.status,isSuccess:"success"===e.status,isError:"error"===e.status,isIdle:"idle"===e.status,mutate:this.mutate,reset:this.reset}}#r(e){i.notifyManager.batch(()=>{if(this.#i&&this.hasListeners()){let t=this.#t.variables,n=this.#t.context,i={client:this.#e,meta:this.options.meta,mutationKey:this.options.mutationKey};if(e?.type==="success"){try{this.#i.onSuccess?.(e.data,t,n,i)}catch(e){Promise.reject(e)}try{this.#i.onSettled?.(e.data,null,t,n,i)}catch(e){Promise.reject(e)}}else if(e?.type==="error"){try{this.#i.onError?.(e.error,t,n,i)}catch(e){Promise.reject(e)}try{this.#i.onSettled?.(void 0,e.error,t,n,i)}catch(e){Promise.reject(e)}}}this.listeners.forEach(e=>{e(this.#t)})})}},o=e.i(912598);e.s(["useMutation",0,function(e,n){let l=(0,o.useQueryClient)(n),[s]=t.useState(()=>new a(l,e));t.useEffect(()=>{s.setOptions(e)},[s,e]);let c=t.useSyncExternalStore(t.useCallback(e=>s.subscribe(i.notifyManager.batchCalls(e)),[s]),()=>s.getCurrentResult(),()=>s.getCurrentResult()),d=t.useCallback((e,t)=>{s.mutate(e,t).catch(r.noop)},[s]);if(c.error&&(0,r.shouldThrowError)(s.options.throwOnError,[c.error]))throw c.error;return{...c,mutate:d,mutateAsync:c.mutate}}],954616)},270377,e=>{"use strict";e.i(247167);var t=e.i(931067),n=e.i(271645);let i={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M512 64C264.6 64 64 264.6 64 512s200.6 448 448 448 448-200.6 448-448S759.4 64 512 64zm0 820c-205.4 0-372-166.6-372-372s166.6-372 372-372 372 166.6 372 372-166.6 372-372 372z"}},{tag:"path",attrs:{d:"M464 688a48 48 0 1096 0 48 48 0 10-96 0zm24-112h48c4.4 0 8-3.6 8-8V296c0-4.4-3.6-8-8-8h-48c-4.4 0-8 3.6-8 8v272c0 4.4 3.6 8 8 8z"}}]},name:"exclamation-circle",theme:"outlined"};var l=e.i(9583),r=n.forwardRef(function(e,r){return n.createElement(l.default,(0,t.default)({},e,{ref:r,icon:i}))});e.s(["ExclamationCircleOutlined",0,r],270377)},175712,e=>{"use strict";e.i(247167);var t=e.i(271645),n=e.i(343794),i=e.i(529681),l=e.i(242064),r=e.i(517455),a=e.i(185793),o=e.i(721369),s=function(e,t){var n={};for(var i in e)Object.prototype.hasOwnProperty.call(e,i)&&0>t.indexOf(i)&&(n[i]=e[i]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var l=0,i=Object.getOwnPropertySymbols(e);lt.indexOf(i[l])&&Object.prototype.propertyIsEnumerable.call(e,i[l])&&(n[i[l]]=e[i[l]]);return n};let c=e=>{var{prefixCls:i,className:r,hoverable:a=!0}=e,o=s(e,["prefixCls","className","hoverable"]);let{getPrefixCls:c}=t.useContext(l.ConfigContext),d=c("card",i),u=(0,n.default)(`${d}-grid`,r,{[`${d}-grid-hoverable`]:a});return t.createElement("div",Object.assign({},o,{className:u}))};e.i(296059);var d=e.i(915654),u=e.i(183293),g=e.i(246422),b=e.i(838378);let p=(0,g.genStyleHooks)("Card",e=>{let t=(0,b.mergeToken)(e,{cardShadow:e.boxShadowCard,cardHeadPadding:e.padding,cardPaddingBase:e.paddingLG,cardActionsIconSize:e.fontSize});return[(e=>{let{componentCls:t,cardShadow:n,cardHeadPadding:i,colorBorderSecondary:l,boxShadowTertiary:r,bodyPadding:a,extraColor:o}=e;return{[t]:Object.assign(Object.assign({},(0,u.resetComponent)(e)),{position:"relative",background:e.colorBgContainer,borderRadius:e.borderRadiusLG,[`&:not(${t}-bordered)`]:{boxShadow:r},[`${t}-head`]:(e=>{let{antCls:t,componentCls:n,headerHeight:i,headerPadding:l,tabsMarginBottom:r}=e;return Object.assign(Object.assign({display:"flex",justifyContent:"center",flexDirection:"column",minHeight:i,marginBottom:-1,padding:`0 ${(0,d.unit)(l)}`,color:e.colorTextHeading,fontWeight:e.fontWeightStrong,fontSize:e.headerFontSize,background:e.headerBg,borderBottom:`${(0,d.unit)(e.lineWidth)} ${e.lineType} ${e.colorBorderSecondary}`,borderRadius:`${(0,d.unit)(e.borderRadiusLG)} ${(0,d.unit)(e.borderRadiusLG)} 0 0`},(0,u.clearFix)()),{"&-wrapper":{width:"100%",display:"flex",alignItems:"center"},"&-title":Object.assign(Object.assign({display:"inline-block",flex:1},u.textEllipsis),{[` - > ${n}-typography, - > ${n}-typography-edit-content - `]:{insetInlineStart:0,marginTop:0,marginBottom:0}}),[`${t}-tabs-top`]:{clear:"both",marginBottom:r,color:e.colorText,fontWeight:"normal",fontSize:e.fontSize,"&-bar":{borderBottom:`${(0,d.unit)(e.lineWidth)} ${e.lineType} ${e.colorBorderSecondary}`}}})})(e),[`${t}-extra`]:{marginInlineStart:"auto",color:o,fontWeight:"normal",fontSize:e.fontSize},[`${t}-body`]:{padding:a,borderRadius:`0 0 ${(0,d.unit)(e.borderRadiusLG)} ${(0,d.unit)(e.borderRadiusLG)}`},[`${t}-grid`]:(e=>{let{cardPaddingBase:t,colorBorderSecondary:n,cardShadow:i,lineWidth:l}=e;return{width:"33.33%",padding:t,border:0,borderRadius:0,boxShadow:` - ${(0,d.unit)(l)} 0 0 0 ${n}, - 0 ${(0,d.unit)(l)} 0 0 ${n}, - ${(0,d.unit)(l)} ${(0,d.unit)(l)} 0 0 ${n}, - ${(0,d.unit)(l)} 0 0 0 ${n} inset, - 0 ${(0,d.unit)(l)} 0 0 ${n} inset; - `,transition:`all ${e.motionDurationMid}`,"&-hoverable:hover":{position:"relative",zIndex:1,boxShadow:i}}})(e),[`${t}-cover`]:{"> *":{display:"block",width:"100%",borderRadius:`${(0,d.unit)(e.borderRadiusLG)} ${(0,d.unit)(e.borderRadiusLG)} 0 0`}},[`${t}-actions`]:(e=>{let{componentCls:t,iconCls:n,actionsLiMargin:i,cardActionsIconSize:l,colorBorderSecondary:r,actionsBg:a}=e;return Object.assign(Object.assign({margin:0,padding:0,listStyle:"none",background:a,borderTop:`${(0,d.unit)(e.lineWidth)} ${e.lineType} ${r}`,display:"flex",borderRadius:`0 0 ${(0,d.unit)(e.borderRadiusLG)} ${(0,d.unit)(e.borderRadiusLG)}`},(0,u.clearFix)()),{"& > li":{margin:i,color:e.colorTextDescription,textAlign:"center","> span":{position:"relative",display:"block",minWidth:e.calc(e.cardActionsIconSize).mul(2).equal(),fontSize:e.fontSize,lineHeight:e.lineHeight,cursor:"pointer","&:hover":{color:e.colorPrimary,transition:`color ${e.motionDurationMid}`},[`a:not(${t}-btn), > ${n}`]:{display:"inline-block",width:"100%",color:e.colorIcon,lineHeight:(0,d.unit)(e.fontHeight),transition:`color ${e.motionDurationMid}`,"&:hover":{color:e.colorPrimary}},[`> ${n}`]:{fontSize:l,lineHeight:(0,d.unit)(e.calc(l).mul(e.lineHeight).equal())}},"&:not(:last-child)":{borderInlineEnd:`${(0,d.unit)(e.lineWidth)} ${e.lineType} ${r}`}}})})(e),[`${t}-meta`]:Object.assign(Object.assign({margin:`${(0,d.unit)(e.calc(e.marginXXS).mul(-1).equal())} 0`,display:"flex"},(0,u.clearFix)()),{"&-avatar":{paddingInlineEnd:e.padding},"&-detail":{overflow:"hidden",flex:1,"> div:not(:last-child)":{marginBottom:e.marginXS}},"&-title":Object.assign({color:e.colorTextHeading,fontWeight:e.fontWeightStrong,fontSize:e.fontSizeLG},u.textEllipsis),"&-description":{color:e.colorTextDescription}})}),[`${t}-bordered`]:{border:`${(0,d.unit)(e.lineWidth)} ${e.lineType} ${l}`,[`${t}-cover`]:{marginTop:-1,marginInlineStart:-1,marginInlineEnd:-1}},[`${t}-hoverable`]:{cursor:"pointer",transition:`box-shadow ${e.motionDurationMid}, border-color ${e.motionDurationMid}`,"&:hover":{borderColor:"transparent",boxShadow:n}},[`${t}-contain-grid`]:{borderRadius:`${(0,d.unit)(e.borderRadiusLG)} ${(0,d.unit)(e.borderRadiusLG)} 0 0 `,[`${t}-body`]:{display:"flex",flexWrap:"wrap"},[`&:not(${t}-loading) ${t}-body`]:{marginBlockStart:e.calc(e.lineWidth).mul(-1).equal(),marginInlineStart:e.calc(e.lineWidth).mul(-1).equal(),padding:0}},[`${t}-contain-tabs`]:{[`> div${t}-head`]:{minHeight:0,[`${t}-head-title, ${t}-extra`]:{paddingTop:i}}},[`${t}-type-inner`]:(e=>{let{componentCls:t,colorFillAlter:n,headerPadding:i,bodyPadding:l}=e;return{[`${t}-head`]:{padding:`0 ${(0,d.unit)(i)}`,background:n,"&-title":{fontSize:e.fontSize}},[`${t}-body`]:{padding:`${(0,d.unit)(e.padding)} ${(0,d.unit)(l)}`}}})(e),[`${t}-loading`]:(e=>{let{componentCls:t}=e;return{overflow:"hidden",[`${t}-body`]:{userSelect:"none"}}})(e),[`${t}-rtl`]:{direction:"rtl"}}})(t),(e=>{let{componentCls:t,bodyPaddingSM:n,headerPaddingSM:i,headerHeightSM:l,headerFontSizeSM:r}=e;return{[`${t}-small`]:{[`> ${t}-head`]:{minHeight:l,padding:`0 ${(0,d.unit)(i)}`,fontSize:r,[`> ${t}-head-wrapper`]:{[`> ${t}-extra`]:{fontSize:e.fontSize}}},[`> ${t}-body`]:{padding:n}},[`${t}-small${t}-contain-tabs`]:{[`> ${t}-head`]:{[`${t}-head-title, ${t}-extra`]:{paddingTop:0,display:"flex",alignItems:"center"}}}}})(t)]},e=>{var t,n;return{headerBg:"transparent",headerFontSize:e.fontSizeLG,headerFontSizeSM:e.fontSize,headerHeight:e.fontSizeLG*e.lineHeightLG+2*e.padding,headerHeightSM:e.fontSize*e.lineHeight+2*e.paddingXS,actionsBg:e.colorBgContainer,actionsLiMargin:`${e.paddingSM}px 0`,tabsMarginBottom:-e.padding-e.lineWidth,extraColor:e.colorText,bodyPaddingSM:12,headerPaddingSM:12,bodyPadding:null!=(t=e.bodyPadding)?t:e.paddingLG,headerPadding:null!=(n=e.headerPadding)?n:e.paddingLG}});var m=e.i(792812),h=function(e,t){var n={};for(var i in e)Object.prototype.hasOwnProperty.call(e,i)&&0>t.indexOf(i)&&(n[i]=e[i]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var l=0,i=Object.getOwnPropertySymbols(e);lt.indexOf(i[l])&&Object.prototype.propertyIsEnumerable.call(e,i[l])&&(n[i[l]]=e[i[l]]);return n};let f=e=>{let{actionClasses:n,actions:i=[],actionStyle:l}=e;return t.createElement("ul",{className:n,style:l},i.map((e,n)=>{let l=`action-${n}`;return t.createElement("li",{style:{width:`${100/i.length}%`},key:l},t.createElement("span",null,e))}))},y=t.forwardRef((e,s)=>{let d,{prefixCls:u,className:g,rootClassName:b,style:y,extra:$,headStyle:v={},bodyStyle:O={},title:x,loading:j,bordered:S,variant:C,size:E,type:w,cover:N,actions:z,tabList:M,children:P,activeTabKey:B,defaultActiveTabKey:T,tabBarExtraContent:k,hoverable:R,tabProps:L={},classNames:G,styles:I}=e,H=h(e,["prefixCls","className","rootClassName","style","extra","headStyle","bodyStyle","title","loading","bordered","variant","size","type","cover","actions","tabList","children","activeTabKey","defaultActiveTabKey","tabBarExtraContent","hoverable","tabProps","classNames","styles"]),{getPrefixCls:W,direction:D,card:A}=t.useContext(l.ConfigContext),[F]=(0,m.default)("card",C,S),X=e=>{var t;return(0,n.default)(null==(t=null==A?void 0:A.classNames)?void 0:t[e],null==G?void 0:G[e])},K=e=>{var t;return Object.assign(Object.assign({},null==(t=null==A?void 0:A.styles)?void 0:t[e]),null==I?void 0:I[e])},q=t.useMemo(()=>{let e=!1;return t.Children.forEach(P,t=>{(null==t?void 0:t.type)===c&&(e=!0)}),e},[P]),U=W("card",u),[Q,V,_]=p(U),J=t.createElement(a.default,{loading:!0,active:!0,paragraph:{rows:4},title:!1},P),Y=void 0!==B,Z=Object.assign(Object.assign({},L),{[Y?"activeKey":"defaultActiveKey"]:Y?B:T,tabBarExtraContent:k}),ee=(0,r.default)(E),et=ee&&"default"!==ee?ee:"large",en=M?t.createElement(o.default,Object.assign({size:et},Z,{className:`${U}-head-tabs`,onChange:t=>{var n;null==(n=e.onTabChange)||n.call(e,t)},items:M.map(e=>{var{tab:t}=e;return Object.assign({label:t},h(e,["tab"]))})})):null;if(x||$||en){let e=(0,n.default)(`${U}-head`,X("header")),i=(0,n.default)(`${U}-head-title`,X("title")),l=(0,n.default)(`${U}-extra`,X("extra")),r=Object.assign(Object.assign({},v),K("header"));d=t.createElement("div",{className:e,style:r},t.createElement("div",{className:`${U}-head-wrapper`},x&&t.createElement("div",{className:i,style:K("title")},x),$&&t.createElement("div",{className:l,style:K("extra")},$)),en)}let ei=(0,n.default)(`${U}-cover`,X("cover")),el=N?t.createElement("div",{className:ei,style:K("cover")},N):null,er=(0,n.default)(`${U}-body`,X("body")),ea=Object.assign(Object.assign({},O),K("body")),eo=t.createElement("div",{className:er,style:ea},j?J:P),es=(0,n.default)(`${U}-actions`,X("actions")),ec=(null==z?void 0:z.length)?t.createElement(f,{actionClasses:es,actionStyle:K("actions"),actions:z}):null,ed=(0,i.default)(H,["onTabChange"]),eu=(0,n.default)(U,null==A?void 0:A.className,{[`${U}-loading`]:j,[`${U}-bordered`]:"borderless"!==F,[`${U}-hoverable`]:R,[`${U}-contain-grid`]:q,[`${U}-contain-tabs`]:null==M?void 0:M.length,[`${U}-${ee}`]:ee,[`${U}-type-${w}`]:!!w,[`${U}-rtl`]:"rtl"===D},g,b,V,_),eg=Object.assign(Object.assign({},null==A?void 0:A.style),y);return Q(t.createElement("div",Object.assign({ref:s},ed,{className:eu,style:eg}),d,el,eo,ec))});var $=function(e,t){var n={};for(var i in e)Object.prototype.hasOwnProperty.call(e,i)&&0>t.indexOf(i)&&(n[i]=e[i]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var l=0,i=Object.getOwnPropertySymbols(e);lt.indexOf(i[l])&&Object.prototype.propertyIsEnumerable.call(e,i[l])&&(n[i[l]]=e[i[l]]);return n};y.Grid=c,y.Meta=e=>{let{prefixCls:i,className:r,avatar:a,title:o,description:s}=e,c=$(e,["prefixCls","className","avatar","title","description"]),{getPrefixCls:d}=t.useContext(l.ConfigContext),u=d("card",i),g=(0,n.default)(`${u}-meta`,r),b=a?t.createElement("div",{className:`${u}-meta-avatar`},a):null,p=o?t.createElement("div",{className:`${u}-meta-title`},o):null,m=s?t.createElement("div",{className:`${u}-meta-description`},s):null,h=p||m?t.createElement("div",{className:`${u}-meta-detail`},p,m):null;return t.createElement("div",Object.assign({},c,{className:g}),b,h)},e.s(["Card",0,y],175712)},869216,e=>{"use strict";e.i(247167);var t=e.i(271645),n=e.i(343794),i=e.i(908206),l=e.i(242064),r=e.i(517455),a=e.i(150073);let o={xxl:3,xl:3,lg:3,md:3,sm:2,xs:1},s=t.default.createContext({});var c=e.i(876556),d=function(e,t){var n={};for(var i in e)Object.prototype.hasOwnProperty.call(e,i)&&0>t.indexOf(i)&&(n[i]=e[i]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var l=0,i=Object.getOwnPropertySymbols(e);lt.indexOf(i[l])&&Object.prototype.propertyIsEnumerable.call(e,i[l])&&(n[i[l]]=e[i[l]]);return n},u=function(e,t){var n={};for(var i in e)Object.prototype.hasOwnProperty.call(e,i)&&0>t.indexOf(i)&&(n[i]=e[i]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var l=0,i=Object.getOwnPropertySymbols(e);lt.indexOf(i[l])&&Object.prototype.propertyIsEnumerable.call(e,i[l])&&(n[i[l]]=e[i[l]]);return n};let g=e=>{let{itemPrefixCls:i,component:l,span:r,className:a,style:o,labelStyle:c,contentStyle:d,bordered:u,label:g,content:b,colon:p,type:m,styles:h}=e,{classNames:f}=t.useContext(s),y=Object.assign(Object.assign({},c),null==h?void 0:h.label),$=Object.assign(Object.assign({},d),null==h?void 0:h.content);if(u)return t.createElement(l,{colSpan:r,style:o,className:(0,n.default)(a,{[`${i}-item-${m}`]:"label"===m||"content"===m,[null==f?void 0:f.label]:(null==f?void 0:f.label)&&"label"===m,[null==f?void 0:f.content]:(null==f?void 0:f.content)&&"content"===m})},null!=g&&t.createElement("span",{style:y},g),null!=b&&t.createElement("span",{style:$},b));return t.createElement(l,{colSpan:r,style:o,className:(0,n.default)(`${i}-item`,a)},t.createElement("div",{className:`${i}-item-container`},null!=g&&t.createElement("span",{style:y,className:(0,n.default)(`${i}-item-label`,null==f?void 0:f.label,{[`${i}-item-no-colon`]:!p})},g),null!=b&&t.createElement("span",{style:$,className:(0,n.default)(`${i}-item-content`,null==f?void 0:f.content)},b)))};function b(e,{colon:n,prefixCls:i,bordered:l},{component:r,type:a,showLabel:o,showContent:s,labelStyle:c,contentStyle:d,styles:u}){return e.map(({label:e,children:b,prefixCls:p=i,className:m,style:h,labelStyle:f,contentStyle:y,span:$=1,key:v,styles:O},x)=>"string"==typeof r?t.createElement(g,{key:`${a}-${v||x}`,className:m,style:h,styles:{label:Object.assign(Object.assign(Object.assign(Object.assign({},c),null==u?void 0:u.label),f),null==O?void 0:O.label),content:Object.assign(Object.assign(Object.assign(Object.assign({},d),null==u?void 0:u.content),y),null==O?void 0:O.content)},span:$,colon:n,component:r,itemPrefixCls:p,bordered:l,label:o?e:null,content:s?b:null,type:a}):[t.createElement(g,{key:`label-${v||x}`,className:m,style:Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},c),null==u?void 0:u.label),h),f),null==O?void 0:O.label),span:1,colon:n,component:r[0],itemPrefixCls:p,bordered:l,label:e,type:"label"}),t.createElement(g,{key:`content-${v||x}`,className:m,style:Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},d),null==u?void 0:u.content),h),y),null==O?void 0:O.content),span:2*$-1,component:r[1],itemPrefixCls:p,bordered:l,content:b,type:"content"})])}let p=e=>{let n=t.useContext(s),{prefixCls:i,vertical:l,row:r,index:a,bordered:o}=e;return l?t.createElement(t.Fragment,null,t.createElement("tr",{key:`label-${a}`,className:`${i}-row`},b(r,e,Object.assign({component:"th",type:"label",showLabel:!0},n))),t.createElement("tr",{key:`content-${a}`,className:`${i}-row`},b(r,e,Object.assign({component:"td",type:"content",showContent:!0},n)))):t.createElement("tr",{key:a,className:`${i}-row`},b(r,e,Object.assign({component:o?["th","td"]:"td",type:"item",showLabel:!0,showContent:!0},n)))};e.i(296059);var m=e.i(915654),h=e.i(183293),f=e.i(246422),y=e.i(838378);let $=(0,f.genStyleHooks)("Descriptions",e=>(e=>{let{componentCls:t,extraColor:n,itemPaddingBottom:i,itemPaddingEnd:l,colonMarginRight:r,colonMarginLeft:a,titleMarginBottom:o}=e;return{[t]:Object.assign(Object.assign(Object.assign({},(0,h.resetComponent)(e)),(e=>{let{componentCls:t,labelBg:n}=e;return{[`&${t}-bordered`]:{[`> ${t}-view`]:{border:`${(0,m.unit)(e.lineWidth)} ${e.lineType} ${e.colorSplit}`,"> table":{tableLayout:"auto"},[`${t}-row`]:{borderBottom:`${(0,m.unit)(e.lineWidth)} ${e.lineType} ${e.colorSplit}`,"&:first-child":{"> th:first-child, > td:first-child":{borderStartStartRadius:e.borderRadiusLG}},"&:last-child":{borderBottom:"none","> th:first-child, > td:first-child":{borderEndStartRadius:e.borderRadiusLG}},[`> ${t}-item-label, > ${t}-item-content`]:{padding:`${(0,m.unit)(e.padding)} ${(0,m.unit)(e.paddingLG)}`,borderInlineEnd:`${(0,m.unit)(e.lineWidth)} ${e.lineType} ${e.colorSplit}`,"&:last-child":{borderInlineEnd:"none"}},[`> ${t}-item-label`]:{color:e.colorTextSecondary,backgroundColor:n,"&::after":{display:"none"}}}},[`&${t}-middle`]:{[`${t}-row`]:{[`> ${t}-item-label, > ${t}-item-content`]:{padding:`${(0,m.unit)(e.paddingSM)} ${(0,m.unit)(e.paddingLG)}`}}},[`&${t}-small`]:{[`${t}-row`]:{[`> ${t}-item-label, > ${t}-item-content`]:{padding:`${(0,m.unit)(e.paddingXS)} ${(0,m.unit)(e.padding)}`}}}}}})(e)),{"&-rtl":{direction:"rtl"},[`${t}-header`]:{display:"flex",alignItems:"center",marginBottom:o},[`${t}-title`]:Object.assign(Object.assign({},h.textEllipsis),{flex:"auto",color:e.titleColor,fontWeight:e.fontWeightStrong,fontSize:e.fontSizeLG,lineHeight:e.lineHeightLG}),[`${t}-extra`]:{marginInlineStart:"auto",color:n,fontSize:e.fontSize},[`${t}-view`]:{width:"100%",borderRadius:e.borderRadiusLG,table:{width:"100%",tableLayout:"fixed",borderCollapse:"collapse"}},[`${t}-row`]:{"> th, > td":{paddingBottom:i,paddingInlineEnd:l},"> th:last-child, > td:last-child":{paddingInlineEnd:0},"&:last-child":{borderBottom:"none","> th, > td":{paddingBottom:0}}},[`${t}-item-label`]:{color:e.labelColor,fontWeight:"normal",fontSize:e.fontSize,lineHeight:e.lineHeight,textAlign:"start","&::after":{content:'":"',position:"relative",top:-.5,marginInline:`${(0,m.unit)(a)} ${(0,m.unit)(r)}`},[`&${t}-item-no-colon::after`]:{content:'""'}},[`${t}-item-no-label`]:{"&::after":{margin:0,content:'""'}},[`${t}-item-content`]:{display:"table-cell",flex:1,color:e.contentColor,fontSize:e.fontSize,lineHeight:e.lineHeight,wordBreak:"break-word",overflowWrap:"break-word"},[`${t}-item`]:{paddingBottom:0,verticalAlign:"top","&-container":{display:"flex",[`${t}-item-label`]:{display:"inline-flex",alignItems:"baseline"},[`${t}-item-content`]:{display:"inline-flex",alignItems:"baseline",minWidth:"1em"}}},"&-middle":{[`${t}-row`]:{"> th, > td":{paddingBottom:e.paddingSM}}},"&-small":{[`${t}-row`]:{"> th, > td":{paddingBottom:e.paddingXS}}}})}})((0,y.mergeToken)(e,{})),e=>({labelBg:e.colorFillAlter,labelColor:e.colorTextTertiary,titleColor:e.colorText,titleMarginBottom:e.fontSizeSM*e.lineHeightSM,itemPaddingBottom:e.padding,itemPaddingEnd:e.padding,colonMarginRight:e.marginXS,colonMarginLeft:e.marginXXS/2,contentColor:e.colorText,extraColor:e.colorText}));var v=function(e,t){var n={};for(var i in e)Object.prototype.hasOwnProperty.call(e,i)&&0>t.indexOf(i)&&(n[i]=e[i]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var l=0,i=Object.getOwnPropertySymbols(e);lt.indexOf(i[l])&&Object.prototype.propertyIsEnumerable.call(e,i[l])&&(n[i[l]]=e[i[l]]);return n};let O=e=>{let g,{prefixCls:b,title:m,extra:h,column:f,colon:y=!0,bordered:O,layout:x,children:j,className:S,rootClassName:C,style:E,size:w,labelStyle:N,contentStyle:z,styles:M,items:P,classNames:B}=e,T=v(e,["prefixCls","title","extra","column","colon","bordered","layout","children","className","rootClassName","style","size","labelStyle","contentStyle","styles","items","classNames"]),{getPrefixCls:k,direction:R,className:L,style:G,classNames:I,styles:H}=(0,l.useComponentConfig)("descriptions"),W=k("descriptions",b),D=(0,a.default)(),A=t.useMemo(()=>{var e;return"number"==typeof f?f:null!=(e=(0,i.matchScreen)(D,Object.assign(Object.assign({},o),f)))?e:3},[D,f]),F=(g=t.useMemo(()=>P||(0,c.default)(j).map(e=>Object.assign(Object.assign({},null==e?void 0:e.props),{key:e.key})),[P,j]),t.useMemo(()=>g.map(e=>{var{span:t}=e,n=d(e,["span"]);return"filled"===t?Object.assign(Object.assign({},n),{filled:!0}):Object.assign(Object.assign({},n),{span:"number"==typeof t?t:(0,i.matchScreen)(D,t)})}),[g,D])),X=(0,r.default)(w),K=((e,n)=>{let[i,l]=(0,t.useMemo)(()=>{let t,i,l,r;return t=[],i=[],l=!1,r=0,n.filter(e=>e).forEach(n=>{let{filled:a}=n,o=u(n,["filled"]);if(a){i.push(o),t.push(i),i=[],r=0;return}let s=e-r;(r+=n.span||1)>=e?(r>e?(l=!0,i.push(Object.assign(Object.assign({},o),{span:s}))):i.push(o),t.push(i),i=[],r=0):i.push(o)}),i.length>0&&t.push(i),[t=t.map(t=>{let n=t.reduce((e,t)=>e+(t.span||1),0);if(n({labelStyle:N,contentStyle:z,styles:{content:Object.assign(Object.assign({},H.content),null==M?void 0:M.content),label:Object.assign(Object.assign({},H.label),null==M?void 0:M.label)},classNames:{label:(0,n.default)(I.label,null==B?void 0:B.label),content:(0,n.default)(I.content,null==B?void 0:B.content)}}),[N,z,M,B,I,H]);return q(t.createElement(s.Provider,{value:V},t.createElement("div",Object.assign({className:(0,n.default)(W,L,I.root,null==B?void 0:B.root,{[`${W}-${X}`]:X&&"default"!==X,[`${W}-bordered`]:!!O,[`${W}-rtl`]:"rtl"===R},S,C,U,Q),style:Object.assign(Object.assign(Object.assign(Object.assign({},G),H.root),null==M?void 0:M.root),E)},T),(m||h)&&t.createElement("div",{className:(0,n.default)(`${W}-header`,I.header,null==B?void 0:B.header),style:Object.assign(Object.assign({},H.header),null==M?void 0:M.header)},m&&t.createElement("div",{className:(0,n.default)(`${W}-title`,I.title,null==B?void 0:B.title),style:Object.assign(Object.assign({},H.title),null==M?void 0:M.title)},m),h&&t.createElement("div",{className:(0,n.default)(`${W}-extra`,I.extra,null==B?void 0:B.extra),style:Object.assign(Object.assign({},H.extra),null==M?void 0:M.extra)},h)),t.createElement("div",{className:`${W}-view`},t.createElement("table",null,t.createElement("tbody",null,K.map((e,n)=>t.createElement(p,{key:n,index:n,colon:y,prefixCls:W,vertical:"vertical"===x,bordered:O,row:e}))))))))};O.Item=({children:e})=>e,e.s(["Descriptions",0,O],869216)},368869,e=>{"use strict";e.i(296059);var t=e.i(868297),n=e.i(732961),i=e.i(289882),l=e.i(170517),r=e.i(628882),a=e.i(320890),o=e.i(104458),s=e.i(722319),c=e.i(8398),d=e.i(279728);e.i(765846);var u=e.i(602716),g=e.i(328052),b=e.i(135551);let p=(e,t)=>new b.FastColor(e).setA(t).toRgbString(),m=(e,t)=>new b.FastColor(e).lighten(t).toHexString(),h=e=>{let t=(0,u.generate)(e,{theme:"dark"});return{1:t[0],2:t[1],3:t[2],4:t[3],5:t[6],6:t[5],7:t[4],8:t[6],9:t[5],10:t[4]}},f=(e,t)=>{let n=e||"#000",i=t||"#fff";return{colorBgBase:n,colorTextBase:i,colorText:p(i,.85),colorTextSecondary:p(i,.65),colorTextTertiary:p(i,.45),colorTextQuaternary:p(i,.25),colorFill:p(i,.18),colorFillSecondary:p(i,.12),colorFillTertiary:p(i,.08),colorFillQuaternary:p(i,.04),colorBgSolid:p(i,.95),colorBgSolidHover:p(i,1),colorBgSolidActive:p(i,.9),colorBgElevated:m(n,12),colorBgContainer:m(n,8),colorBgLayout:m(n,0),colorBgSpotlight:m(n,26),colorBgBlur:p(i,.04),colorBorder:m(n,26),colorBorderSecondary:m(n,19)}},y={defaultSeed:a.defaultConfig.token,useToken:function(){let[e,t,n]=(0,o.useToken)();return{theme:e,token:t,hashId:n}},defaultAlgorithm:s.default,darkAlgorithm:(e,t)=>{let n=Object.keys(l.defaultPresetColors).map(t=>{let n=(0,u.generate)(e[t],{theme:"dark"});return Array.from({length:10},()=>1).reduce((e,i,l)=>(e[`${t}-${l+1}`]=n[l],e[`${t}${l+1}`]=n[l],e),{})}).reduce((e,t)=>e=Object.assign(Object.assign({},e),t),{}),i=null!=t?t:(0,s.default)(e),r=(0,g.default)(e,{generateColorPalettes:h,generateNeutralColorPalettes:f});return Object.assign(Object.assign(Object.assign(Object.assign({},i),n),r),{colorPrimaryBg:r.colorPrimaryBorder,colorPrimaryBgHover:r.colorPrimaryBorderHover})},compactAlgorithm:(e,t)=>{let n=null!=t?t:(0,s.default)(e),i=n.fontSizeSM,l=n.controlHeight-4;return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},n),function(e){let{sizeUnit:t,sizeStep:n}=e,i=n-2;return{sizeXXL:t*(i+10),sizeXL:t*(i+6),sizeLG:t*(i+2),sizeMD:t*(i+2),sizeMS:t*(i+1),size:t*i,sizeSM:t*i,sizeXS:t*(i-1),sizeXXS:t*(i-1)}}(null!=t?t:e)),(0,d.default)(i)),{controlHeight:l}),(0,c.default)(Object.assign(Object.assign({},n),{controlHeight:l})))},getDesignToken:e=>{let a=(null==e?void 0:e.algorithm)?(0,t.createTheme)(e.algorithm):i.default,o=Object.assign(Object.assign({},l.default),null==e?void 0:e.token);return(0,n.getComputedToken)(o,{override:null==e?void 0:e.token},a,r.default)},defaultConfig:a.defaultConfig,_internalContext:a.DesignTokenContext};e.s(["theme",0,y],368869)},127952,e=>{"use strict";var t=e.i(843476),n=e.i(560445),i=e.i(175712),l=e.i(869216),r=e.i(311451),a=e.i(212931),o=e.i(898586),s=e.i(368869),c=e.i(270377),d=e.i(271645);e.s(["default",0,function({isOpen:e,title:u,alertMessage:g,message:b,resourceInformationTitle:p,resourceInformation:m,onCancel:h,onOk:f,confirmLoading:y,requiredConfirmation:$}){let{Title:v,Text:O}=o.Typography,{token:x}=s.theme.useToken(),[j,S]=(0,d.useState)("");return(0,d.useEffect)(()=>{e&&S("")},[e]),(0,t.jsx)(a.Modal,{title:u,open:e,onOk:f,onCancel:h,confirmLoading:y,okText:y?"Deleting...":"Delete",cancelText:"Cancel",okButtonProps:{danger:!0,disabled:!!$&&j!==$||y},cancelButtonProps:{disabled:y},children:(0,t.jsxs)("div",{className:"space-y-4",children:[g&&(0,t.jsx)(n.Alert,{message:g,type:"warning"}),(0,t.jsx)(i.Card,{title:p,className:"mt-4",styles:{body:{padding:"16px"},header:{backgroundColor:x.colorErrorBg,borderColor:x.colorErrorBorder}},style:{backgroundColor:x.colorErrorBg,borderColor:x.colorErrorBorder},children:(0,t.jsx)(l.Descriptions,{column:1,size:"small",children:m&&m.map(({label:e,value:n,...i})=>(0,t.jsx)(l.Descriptions.Item,{label:(0,t.jsx)("span",{className:"font-semibold",children:e}),children:(0,t.jsx)(O,{...i,children:n??"-"})},e))})}),(0,t.jsx)("div",{children:(0,t.jsx)(O,{children:b})}),$&&(0,t.jsxs)("div",{className:"mb-6 mt-4 pt-4 border-t border-gray-200 dark:border-gray-700",children:[(0,t.jsxs)(O,{className:"block text-base font-medium text-gray-700 dark:text-gray-300 mb-2",children:[(0,t.jsx)(O,{children:"Type "}),(0,t.jsx)(O,{strong:!0,type:"danger",children:$}),(0,t.jsx)(O,{children:" to confirm deletion:"})]}),(0,t.jsx)(r.Input,{value:j,onChange:e=>S(e.target.value),placeholder:$,className:"rounded-md",prefix:(0,t.jsx)(c.ExclamationCircleOutlined,{style:{color:x.colorError}}),autoFocus:!0})]})]})})}])},525720,e=>{"use strict";e.i(247167);var t=e.i(271645),n=e.i(343794),i=e.i(529681),l=e.i(908286),r=e.i(242064),a=e.i(246422),o=e.i(838378);let s=["wrap","nowrap","wrap-reverse"],c=["flex-start","flex-end","start","end","center","space-between","space-around","space-evenly","stretch","normal","left","right"],d=["center","start","end","flex-start","flex-end","self-start","self-end","baseline","normal","stretch"],u=function(e,t){let i,l,r;return(0,n.default)(Object.assign(Object.assign(Object.assign({},(i=!0===t.wrap?"wrap":t.wrap,{[`${e}-wrap-${i}`]:i&&s.includes(i)})),(l={},d.forEach(n=>{l[`${e}-align-${n}`]=t.align===n}),l[`${e}-align-stretch`]=!t.align&&!!t.vertical,l)),(r={},c.forEach(n=>{r[`${e}-justify-${n}`]=t.justify===n}),r)))},g=(0,a.genStyleHooks)("Flex",e=>{let{paddingXS:t,padding:n,paddingLG:i}=e,l=(0,o.mergeToken)(e,{flexGapSM:t,flexGap:n,flexGapLG:i});return[(e=>{let{componentCls:t}=e;return{[t]:{display:"flex",margin:0,padding:0,"&-vertical":{flexDirection:"column"},"&-rtl":{direction:"rtl"},"&:empty":{display:"none"}}}})(l),(e=>{let{componentCls:t}=e;return{[t]:{"&-gap-small":{gap:e.flexGapSM},"&-gap-middle":{gap:e.flexGap},"&-gap-large":{gap:e.flexGapLG}}}})(l),(e=>{let{componentCls:t}=e,n={};return s.forEach(e=>{n[`${t}-wrap-${e}`]={flexWrap:e}}),n})(l),(e=>{let{componentCls:t}=e,n={};return d.forEach(e=>{n[`${t}-align-${e}`]={alignItems:e}}),n})(l),(e=>{let{componentCls:t}=e,n={};return c.forEach(e=>{n[`${t}-justify-${e}`]={justifyContent:e}}),n})(l)]},()=>({}),{resetStyle:!1});var b=function(e,t){var n={};for(var i in e)Object.prototype.hasOwnProperty.call(e,i)&&0>t.indexOf(i)&&(n[i]=e[i]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var l=0,i=Object.getOwnPropertySymbols(e);lt.indexOf(i[l])&&Object.prototype.propertyIsEnumerable.call(e,i[l])&&(n[i[l]]=e[i[l]]);return n};let p=t.default.forwardRef((e,a)=>{let{prefixCls:o,rootClassName:s,className:c,style:d,flex:p,gap:m,vertical:h=!1,component:f="div",children:y}=e,$=b(e,["prefixCls","rootClassName","className","style","flex","gap","vertical","component","children"]),{flex:v,direction:O,getPrefixCls:x}=t.default.useContext(r.ConfigContext),j=x("flex",o),[S,C,E]=g(j),w=null!=h?h:null==v?void 0:v.vertical,N=(0,n.default)(c,s,null==v?void 0:v.className,j,C,E,u(j,e),{[`${j}-rtl`]:"rtl"===O,[`${j}-gap-${m}`]:(0,l.isPresetSize)(m),[`${j}-vertical`]:w}),z=Object.assign(Object.assign({},null==v?void 0:v.style),d);return p&&(z.flex=p),m&&!(0,l.isPresetSize)(m)&&(z.gap=m),S(t.default.createElement(f,Object.assign({ref:a,className:N,style:z},(0,i.default)($,["justify","wrap","align"])),y))});e.s(["Flex",0,p],525720)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/0.w8~sa9q0n_s.js b/litellm/proxy/_experimental/out/_next/static/chunks/0.w8~sa9q0n_s.js deleted file mode 100644 index 6994bde5e6d..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/0.w8~sa9q0n_s.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,207082,e=>{"use strict";var t=e.i(619273),s=e.i(266027),l=e.i(243652),a=e.i(602869),r=e.i(431703),i=e.i(135214);let n=(0,l.createQueryKeys)("keys"),o=async(e,t,s,l={})=>{try{let i=(0,a.getProxyBaseUrl)(),n=new URLSearchParams(Object.entries({team_id:l.teamID,project_id:l.projectID,agent_id:l.agentID,organization_id:l.organizationID,key_alias:l.selectedKeyAlias,key_hash:l.keyHash,user_id:l.userID,page:t,size:s,sort_by:l.sortBy,sort_order:l.sortOrder,expand:l.expand,status:l.status,return_full_object:"true",include_team_keys:"true",include_created_by_keys:"true",substring_matching:"true"}).filter(([,e])=>null!=e).map(([e,t])=>[e,String(t)])),o=`${i?`${i}/key/list`:"/key/list"}?${n}`,d=await fetch(o,{method:"GET",headers:{[(0,a.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!d.ok){let e=await d.json(),t=(0,r.deriveErrorMessage)(e);throw(0,a.handleError)(t),Error(t)}return await d.json()}catch(e){throw console.error("Failed to list keys:",e),e}},d=(0,l.createQueryKeys)("deletedKeys");e.s(["keyKeys",0,n,"useDeletedKeys",0,(e,l,a={})=>{let{accessToken:r}=(0,i.default)();return(0,s.useQuery)({queryKey:d.list({page:e,limit:l,...a}),queryFn:async()=>await o(r,e,l,{...a,status:"deleted"}),enabled:!!r,staleTime:3e4,placeholderData:t.keepPreviousData})},"useKeys",0,(e,l,a={})=>{let{accessToken:r}=(0,i.default)();return(0,s.useQuery)({queryKey:n.list({page:e,limit:l,...a}),queryFn:async()=>await o(r,e,l,a),enabled:!!r,staleTime:3e4,placeholderData:t.keepPreviousData})}])},510674,e=>{"use strict";var t=e.i(266027),s=e.i(243652),l=e.i(602869),a=e.i(431703),r=e.i(135214),i=e.i(708347);let n=(0,s.createQueryKeys)("projects"),o=[...i.all_admin_roles,...i.internalUserRoles],d=async e=>{let t=(0,l.getProxyBaseUrl)(),s=`${t}/project/list`,r=await fetch(s,{method:"GET",headers:{[(0,l.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!r.ok){let e=await r.json(),t=(0,a.deriveErrorMessage)(e);throw(0,l.handleError)(t),Error(t)}return r.json()};e.s(["projectKeys",0,n,"useProjects",0,()=>{let{accessToken:e,userRole:s}=(0,r.default)();return(0,t.useQuery)({queryKey:n.list({}),queryFn:async()=>d(e),enabled:!!e&&o.includes(s)})}])},109034,e=>{"use strict";var t=e.i(266027),s=e.i(243652),l=e.i(602869),a=e.i(135214);let r=(0,s.createQueryKeys)("tags");e.s(["useTags",0,()=>{let{accessToken:e,userId:s,userRole:i}=(0,a.default)();return(0,t.useQuery)({queryKey:r.list({}),queryFn:async()=>await (0,l.tagListCall)(e),enabled:!!(e&&s&&i)})}])},552130,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(602869);e.s(["default",0,({onChange:e,value:r,className:i,accessToken:n,placeholder:o="Select agents",disabled:d=!1})=>{let[c,u]=(0,s.useState)([]),[m,p]=(0,s.useState)([]),[g,h]=(0,s.useState)(!1);(0,s.useEffect)(()=>{(async()=>{if(n){h(!0);try{let e=await (0,a.getAgentsList)(n),t=e?.agents||[];u(t);let s=new Set;t.forEach(e=>{let t=e.agent_access_groups;t&&Array.isArray(t)&&t.forEach(e=>s.add(e))}),p(Array.from(s))}catch(e){console.error("Error fetching agents:",e)}finally{h(!1)}}})()},[n]);let x=[...m.map(e=>({label:e,value:`group:${e}`,isAccessGroup:!0,searchText:`${e} Access Group`})),...c.map(e=>({label:`${e.agent_name||e.agent_id}`,value:e.agent_id,isAccessGroup:!1,searchText:`${e.agent_name||e.agent_id} ${e.agent_id} Agent`}))],y=[...r?.agents||[],...(r?.accessGroups||[]).map(e=>`group:${e}`)];return(0,t.jsx)("div",{children:(0,t.jsx)(l.Select,{mode:"multiple",placeholder:o,onChange:t=>{e({agents:t.filter(e=>!e.startsWith("group:")),accessGroups:t.filter(e=>e.startsWith("group:")).map(e=>e.replace("group:",""))})},value:y,loading:g,className:i,allowClear:!0,showSearch:!0,style:{width:"100%"},disabled:d,filterOption:(e,t)=>(x.find(e=>e.value===t?.value)?.searchText||"").toLowerCase().includes(e.toLowerCase()),children:x.map(e=>(0,t.jsx)(l.Select.Option,{value:e.value,label:e.label,children:(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,t.jsx)("span",{style:{display:"inline-block",width:8,height:8,borderRadius:"50%",background:e.isAccessGroup?"#52c41a":"#722ed1",flexShrink:0}}),(0,t.jsx)("span",{style:{flex:1},children:e.label}),(0,t.jsx)("span",{style:{color:e.isAccessGroup?"#52c41a":"#722ed1",fontSize:"12px",fontWeight:500,opacity:.8},children:e.isAccessGroup?"Access Group":"Agent"})]})},e.value))})})}])},557662,e=>{"use strict";let t="/ui/assets/logos/",s=[{id:"arize",displayName:"Arize",logo:`${t}arize.png`,supports_key_team_logging:!0,dynamic_params:{arize_api_key:"password",arize_space_id:"password"},description:"Arize Logging Integration"},{id:"braintrust",displayName:"Braintrust",logo:`${t}braintrust.png`,supports_key_team_logging:!1,dynamic_params:{braintrust_api_key:"password",braintrust_project_name:"text"},description:"Braintrust Logging Integration"},{id:"custom_callback_api",displayName:"Custom Callback API",logo:`${t}custom.svg`,supports_key_team_logging:!0,dynamic_params:{custom_callback_api_url:"text",custom_callback_api_headers:"text"},description:"Custom Callback API Logging Integration"},{id:"galileo",displayName:"Galileo",logo:`${t}galileo.ico`,supports_key_team_logging:!1,dynamic_params:{GALILEO_API_KEY:"password",GALILEO_PROJECT_ID:"text",GALILEO_LOG_STREAM_ID:"text",GALILEO_BASE_URL:"text",GALILEO_USERNAME:"text",GALILEO_PASSWORD:"password"},description:"Galileo AI Observability Integration"},{id:"datadog",displayName:"Datadog",logo:`${t}datadog.png`,supports_key_team_logging:!1,dynamic_params:{dd_api_key:"password",dd_site:"text"},description:"Datadog Logging Integration"},{id:"lago",displayName:"Lago",logo:`${t}lago.svg`,supports_key_team_logging:!1,dynamic_params:{lago_api_url:"text",lago_api_key:"password"},description:"Lago Billing Logging Integration"},{id:"langfuse",displayName:"Langfuse",logo:`${t}langfuse.png`,supports_key_team_logging:!0,dynamic_params:{langfuse_public_key:"text",langfuse_secret_key:"password",langfuse_host:"text"},description:"Langfuse v2 Logging Integration"},{id:"langfuse_otel",displayName:"Langfuse OTEL",logo:`${t}langfuse.png`,supports_key_team_logging:!0,dynamic_params:{langfuse_public_key:"text",langfuse_secret_key:"password",langfuse_host:"text"},description:"Langfuse v3 OTEL Logging Integration"},{id:"langsmith",displayName:"LangSmith",logo:`${t}langsmith.png`,supports_key_team_logging:!0,dynamic_params:{langsmith_api_key:"password",langsmith_project:"text",langsmith_base_url:"text",langsmith_sampling_rate:"number"},description:"Langsmith Logging Integration"},{id:"openmeter",displayName:"OpenMeter",logo:`${t}openmeter.png`,supports_key_team_logging:!1,dynamic_params:{openmeter_api_key:"password",openmeter_base_url:"text"},description:"OpenMeter Logging Integration"},{id:"otel",displayName:"Open Telemetry",logo:`${t}otel.png`,supports_key_team_logging:!1,dynamic_params:{otel_endpoint:"text",otel_headers:"text"},description:"OpenTelemetry Logging Integration"},{id:"s3",displayName:"S3",logo:`${t}aws.svg`,supports_key_team_logging:!1,dynamic_params:{s3_bucket_name:"text",aws_access_key_id:"password",aws_secret_access_key:"password",aws_region:"text"},description:"S3 Bucket (AWS) Logging Integration"},{id:"SQS",displayName:"SQS",logo:`${t}aws.svg`,supports_key_team_logging:!1,dynamic_params:{sqs_queue_url:"text",aws_access_key_id:"password",aws_secret_access_key:"password",aws_region:"text"},description:"SQS Queue (AWS) Logging Integration"}],l=s.reduce((e,t)=>(e[t.displayName]=t,e),{}),a=s.reduce((e,t)=>(e[t.displayName]=t.id,e),{}),r=s.reduce((e,t)=>(e[t.id]=t.displayName,e),{});e.s(["callbackInfo",0,l,"callback_map",0,a,"mapDisplayToInternalNames",0,e=>e.map(e=>a[e]||e),"mapInternalToDisplayNames",0,e=>e.map(e=>r[e]||e),"reverse_callback_map",0,r])},9314,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(981339),a=e.i(645526),r=e.i(599724),i=e.i(263147);e.s(["default",0,({value:e,onChange:n,placeholder:o="Select access groups",disabled:d=!1,style:c,className:u,showLabel:m=!1,labelText:p="Access Group",allowClear:g=!0})=>{let{data:h,isLoading:x,isError:y}=(0,i.useAccessGroups)();if(x)return(0,t.jsxs)("div",{children:[m&&(0,t.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(a.TeamOutlined,{className:"mr-2"})," ",p]}),(0,t.jsx)(l.Skeleton.Input,{active:!0,block:!0,style:{height:32,...c}})]});let f=(h??[]).map(e=>({label:(0,t.jsxs)("span",{children:[(0,t.jsx)("span",{className:"font-medium",children:e.access_group_name})," ",(0,t.jsxs)("span",{className:"text-gray-400 text-xs",children:["(",e.access_group_id,")"]})]}),value:e.access_group_id,selectedLabel:e.access_group_name,searchText:`${e.access_group_name} ${e.access_group_id}`}));return(0,t.jsxs)("div",{children:[m&&(0,t.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(a.TeamOutlined,{className:"mr-2"})," ",p]}),(0,t.jsx)(s.Select,{mode:"multiple",value:e,placeholder:o,onChange:n,disabled:d,allowClear:g,showSearch:!0,style:{width:"100%",...c},className:`rounded-md ${u??""}`,notFoundContent:y?(0,t.jsx)("span",{className:"text-red-500",children:"Failed to load access groups"}):"No access groups found",filterOption:(e,t)=>(f.find(e=>e.value===t?.value)?.searchText??"").toLowerCase().includes(e.toLowerCase()),optionLabelProp:"selectedLabel",options:f.map(e=>({label:e.label,value:e.value,selectedLabel:e.selectedLabel}))})]})}])},392110,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(592968),r=e.i(312361),i=e.i(790848),n=e.i(536916),o=e.i(827252),d=e.i(779241);let{Option:c}=l.Select;e.s(["default",0,({form:e,autoRotationEnabled:u,onAutoRotationChange:m,rotationInterval:p,onRotationIntervalChange:g,isCreateMode:h=!1,neverExpire:x=!1,onNeverExpireChange:y})=>{let f=p&&!["7d","30d","90d","180d","365d"].includes(p),[b,_]=(0,s.useState)(f),[j,v]=(0,s.useState)(f?p:""),[w,N]=(0,s.useState)(e?.getFieldValue?.("duration")||"");return(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Key Expiry Settings"}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Expire Key"}),(0,t.jsx)(a.Tooltip,{title:"Set when this key should expire. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days). Leave empty to keep the current expiry unchanged.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})}),!h&&y&&(0,t.jsx)(n.Checkbox,{checked:x,onChange:t=>{let s=t.target.checked;y(s),s&&(N(""),e&&"function"==typeof e.setFieldValue?e.setFieldValue("duration",""):e&&"function"==typeof e.setFieldsValue&&e.setFieldsValue({duration:""}))},className:"ml-2 text-sm font-normal text-gray-600",children:"Never Expire"})]}),(0,t.jsx)(d.TextInput,{name:"duration",placeholder:h?"e.g., 30d or leave empty to never expire":"e.g., 30d",className:"w-full",value:w,onValueChange:t=>{N(t),e&&"function"==typeof e.setFieldValue?e.setFieldValue("duration",t):e&&"function"==typeof e.setFieldsValue&&e.setFieldsValue({duration:t})},disabled:!h&&x})]})]}),(0,t.jsx)(r.Divider,{}),(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Auto-Rotation Settings"}),(0,t.jsxs)("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Enable Auto-Rotation"}),(0,t.jsx)(a.Tooltip,{title:"Key will automatically regenerate at the specified interval for enhanced security.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})})]}),(0,t.jsx)(i.Switch,{checked:u,onChange:m,size:"default",className:u?"":"bg-gray-400"})]}),u&&(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Rotation Interval"}),(0,t.jsx)(a.Tooltip,{title:"How often the key should be automatically rotated. Choose the interval that best fits your security requirements.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)(l.Select,{value:b?"custom":p,onChange:e=>{"custom"===e?_(!0):(_(!1),v(""),g(e))},className:"w-full",placeholder:"Select interval",children:[(0,t.jsx)(c,{value:"7d",children:"7 days"}),(0,t.jsx)(c,{value:"30d",children:"30 days"}),(0,t.jsx)(c,{value:"90d",children:"90 days"}),(0,t.jsx)(c,{value:"180d",children:"180 days"}),(0,t.jsx)(c,{value:"365d",children:"365 days"}),(0,t.jsx)(c,{value:"custom",children:"Custom interval"})]}),b&&(0,t.jsxs)("div",{className:"space-y-1",children:[(0,t.jsx)(d.TextInput,{value:j,onChange:e=>{let t=e.target.value;v(t),g(t)},placeholder:"e.g., 1s, 5m, 2h, 14d"}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Supported formats: seconds (s), minutes (m), hours (h), days (d)"})]})]})]})]}),u&&(0,t.jsx)("div",{className:"bg-blue-50 p-3 rounded-md text-sm text-blue-700",children:"When rotation occurs, you'll receive a notification with the new key. The old key will be deactivated after a brief grace period."})]})]})}])},533882,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(250980),a=e.i(797672),r=e.i(68155),i=e.i(304967),n=e.i(629569),o=e.i(599724),d=e.i(269200),c=e.i(427612),u=e.i(64848),m=e.i(942232),p=e.i(496020),g=e.i(977572),h=e.i(992619),x=e.i(727749);e.s(["default",0,({accessToken:e,initialModelAliases:y={},onAliasUpdate:f,showExampleConfig:b=!0})=>{let[_,j]=(0,s.useState)([]),[v,w]=(0,s.useState)({aliasName:"",targetModel:""}),[N,k]=(0,s.useState)(null);(0,s.useEffect)(()=>{j(Object.entries(y).map(([e,t],s)=>({id:`${s}-${e}`,aliasName:e,targetModel:t})))},[y]);let S=()=>{if(!N)return;if(!N.aliasName||!N.targetModel)return void x.default.fromBackend("Please provide both alias name and target model");if(_.some(e=>e.id!==N.id&&e.aliasName===N.aliasName))return void x.default.fromBackend("An alias with this name already exists");let e=_.map(e=>e.id===N.id?N:e);j(e),k(null);let t={};e.forEach(e=>{t[e.aliasName]=e.targetModel}),f&&f(t),x.default.success("Alias updated successfully")},C=()=>{k(null)},T=_.reduce((e,t)=>(e[t.aliasName]=t.targetModel,e),{});return(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsxs)("div",{className:"mb-6",children:[(0,t.jsx)(o.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Add New Alias"}),(0,t.jsxs)("div",{className:"grid grid-cols-3 gap-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Alias Name"}),(0,t.jsx)("input",{type:"text",value:v.aliasName,onChange:e=>w({...v,aliasName:e.target.value}),placeholder:"e.g., gpt-4o",className:"w-full px-3 py-2 border border-gray-300 rounded-md text-sm"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Target Model"}),(0,t.jsx)(h.default,{accessToken:e,value:v.targetModel,placeholder:"Select target model",onChange:e=>w({...v,targetModel:e}),showLabel:!1})]}),(0,t.jsx)("div",{className:"flex items-end",children:(0,t.jsxs)("button",{onClick:()=>{if(!v.aliasName||!v.targetModel)return void x.default.fromBackend("Please provide both alias name and target model");if(_.some(e=>e.aliasName===v.aliasName))return void x.default.fromBackend("An alias with this name already exists");let e=[..._,{id:`${Date.now()}-${v.aliasName}`,aliasName:v.aliasName,targetModel:v.targetModel}];j(e),w({aliasName:"",targetModel:""});let t={};e.forEach(e=>{t[e.aliasName]=e.targetModel}),f&&f(t),x.default.success("Alias added successfully")},disabled:!v.aliasName||!v.targetModel,className:`flex items-center px-4 py-2 rounded-md text-sm ${!v.aliasName||!v.targetModel?"bg-gray-300 text-gray-500 cursor-not-allowed":"bg-green-600 text-white hover:bg-green-700"}`,children:[(0,t.jsx)(l.PlusCircleIcon,{className:"w-4 h-4 mr-1"}),"Add Alias"]})})]})]}),(0,t.jsx)(o.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Manage Existing Aliases"}),(0,t.jsx)("div",{className:"rounded-lg custom-border relative mb-6",children:(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(d.Table,{className:"[&_td]:py-0.5 [&_th]:py-1",children:[(0,t.jsx)(c.TableHead,{children:(0,t.jsxs)(p.TableRow,{children:[(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Alias Name"}),(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Target Model"}),(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Actions"})]})}),(0,t.jsxs)(m.TableBody,{children:[_.map(s=>(0,t.jsx)(p.TableRow,{className:"h-8",children:N&&N.id===s.id?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(g.TableCell,{className:"py-0.5",children:(0,t.jsx)("input",{type:"text",value:N.aliasName,onChange:e=>k({...N,aliasName:e.target.value}),className:"w-full px-2 py-1 border border-gray-300 rounded-md text-sm"})}),(0,t.jsx)(g.TableCell,{className:"py-0.5",children:(0,t.jsx)(h.default,{accessToken:e,value:N.targetModel,onChange:e=>k({...N,targetModel:e}),showLabel:!1,style:{height:"32px"}})}),(0,t.jsx)(g.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:S,className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:"Save"}),(0,t.jsx)("button",{onClick:C,className:"text-xs bg-gray-50 text-gray-600 px-2 py-1 rounded-sm hover:bg-gray-100",children:"Cancel"})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(g.TableCell,{className:"py-0.5 text-sm text-gray-900",children:s.aliasName}),(0,t.jsx)(g.TableCell,{className:"py-0.5 text-sm text-gray-500",children:s.targetModel}),(0,t.jsx)(g.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:()=>{k({...s})},className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:(0,t.jsx)(a.PencilIcon,{className:"w-3 h-3"})}),(0,t.jsx)("button",{onClick:()=>{var e;let t,l;return e=s.id,j(t=_.filter(t=>t.id!==e)),l={},void(t.forEach(e=>{l[e.aliasName]=e.targetModel}),f&&f(l),x.default.success("Alias deleted successfully"))},className:"text-xs bg-red-50 text-red-600 px-2 py-1 rounded-sm hover:bg-red-100",children:(0,t.jsx)(r.TrashIcon,{className:"w-3 h-3"})})]})})]})},s.id)),0===_.length&&(0,t.jsx)(p.TableRow,{children:(0,t.jsx)(g.TableCell,{colSpan:3,className:"py-0.5 text-sm text-gray-500 text-center",children:"No aliases added yet. Add a new alias above."})})]})]})})}),b&&(0,t.jsxs)(i.Card,{children:[(0,t.jsx)(n.Title,{className:"mb-4",children:"Configuration Example"}),(0,t.jsx)(o.Text,{className:"text-gray-600 mb-4",children:"Here's how your current aliases would look in the config:"}),(0,t.jsx)("div",{className:"bg-gray-100 rounded-lg p-4 font-mono text-sm",children:(0,t.jsxs)("div",{className:"text-gray-700",children:["model_aliases:",0===Object.keys(T).length?(0,t.jsxs)("span",{className:"text-gray-500",children:[(0,t.jsx)("br",{}),"  # No aliases configured yet"]}):Object.entries(T).map(([e,s])=>(0,t.jsxs)("span",{children:[(0,t.jsx)("br",{}),'  "',e,'": "',s,'"']},e))]})})]})]})}])},844565,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(602869);e.s(["default",0,({onChange:e,value:r,className:i,accessToken:n,placeholder:o="Select pass through routes",disabled:d=!1,teamId:c})=>{let[u,m]=(0,s.useState)([]),[p,g]=(0,s.useState)(!1);return(0,s.useEffect)(()=>{(async()=>{if(n){g(!0);try{let e=await (0,a.getPassThroughEndpointsCall)(n,c);if(e.endpoints){let t=e.endpoints.flatMap(e=>{let t=e.path,s=e.methods;return s&&s.length>0?s.map(e=>({label:`${e} ${t}`,value:t})):[{label:t,value:t}]});m(t)}}catch(e){console.error("Error fetching pass through routes:",e)}finally{g(!1)}}})()},[n,c]),(0,t.jsx)(l.Select,{mode:"tags",placeholder:o,onChange:e,value:r,loading:p,className:i,allowClear:!0,options:u,optionFilterProp:"label",showSearch:!0,style:{width:"100%"},disabled:d})}])},810757,477386,e=>{"use strict";var t=e.i(271645);let s=t.forwardRef(function(e,s){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z"}),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15 12a3 3 0 11-6 0 3 3 0 016 0z"}))});e.s(["CogIcon",0,s],810757);let l=t.forwardRef(function(e,s){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M18.364 18.364A9 9 0 005.636 5.636m12.728 12.728A9 9 0 015.636 5.636m12.728 12.728L5.636 5.636"}))});e.s(["BanIcon",0,l],477386)},266484,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(592968),a=e.i(312361),r=e.i(827252),i=e.i(994388),n=e.i(304967),o=e.i(779241),d=e.i(988297),c=e.i(68155),u=e.i(810757),m=e.i(477386),p=e.i(557662),g=e.i(555987),h=e.i(435451);let{Option:x}=s.Select;e.s(["default",0,({value:e=[],onChange:y,disabledCallbacks:f=[],onDisabledCallbacksChange:b})=>{let _=Object.entries(p.callbackInfo).filter(([e,t])=>t.supports_key_team_logging).map(([e,t])=>e),j=Object.keys(p.callbackInfo),v=e=>{y?.(e)},w=(t,s,l)=>{let a=[...e];if("callback_name"===s){let e=p.callback_map[l]||l;a[t]={...a[t],[s]:e,callback_vars:{}}}else a[t]={...a[t],[s]:l};v(a)},N=(t,s,l)=>{let a=[...e];a[t]={...a[t],callback_vars:{...a[t].callback_vars,[s]:l}},v(a)};return(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(m.BanIcon,{className:"w-5 h-5 text-red-500"}),(0,t.jsx)("span",{className:"text-base font-semibold text-gray-800",children:"Disabled Callbacks"}),(0,t.jsx)(l.Tooltip,{title:"Select callbacks to disable for this key. Disabled callbacks will not receive any logging data.",children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Disabled Callbacks"}),(0,t.jsx)(s.Select,{mode:"multiple",placeholder:"Select callbacks to disable",value:f,onChange:e=>{let t=(0,p.mapDisplayToInternalNames)(e);b?.(t)},style:{width:"100%"},optionLabelProp:"label",children:j.map(e=>{let s=(0,g.resolveLogoSrc)(p.callbackInfo[e]?.logo),a=p.callbackInfo[e]?.description;return(0,t.jsx)(x,{value:e,label:e,children:(0,t.jsx)(l.Tooltip,{title:a,placement:"right",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[s&&(0,t.jsx)("img",{src:s,alt:e,className:"w-4 h-4 object-contain",onError:t=>{let s=t.target,l=s.parentElement;if(l){let t=document.createElement("div");t.className="w-4 h-4 rounded-full bg-gray-200 flex items-center justify-center text-xs",t.textContent=e.charAt(0),l.replaceChild(t,s)}}}),(0,t.jsx)("span",{children:e})]})})},e)})}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Select callbacks that should be disabled for this key. These callbacks will not receive any logging data."})]})]}),(0,t.jsx)(a.Divider,{}),(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(u.CogIcon,{className:"w-5 h-5 text-blue-500"}),(0,t.jsx)("span",{className:"text-base font-semibold text-gray-800",children:"Logging Integrations"}),(0,t.jsx)(l.Tooltip,{title:"Configure callback logging integrations for this team.",children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),(0,t.jsx)(i.Button,{variant:"secondary",onClick:()=>{v([...e,{callback_name:"",callback_type:"success",callback_vars:{}}])},icon:d.PlusIcon,size:"sm",className:"hover:border-blue-400 hover:text-blue-500",type:"button",children:"Add Integration"})]}),(0,t.jsx)("div",{className:"space-y-4",children:e.map((a,d)=>{let u=a.callback_name?Object.entries(p.callback_map).find(([e,t])=>t===a.callback_name)?.[0]:void 0,m=u?(0,g.resolveLogoSrc)(p.callbackInfo[u]?.logo):null;return(0,t.jsxs)(n.Card,{className:"border border-gray-200 shadow-xs hover:shadow-md transition-shadow duration-200",decoration:"top",decorationColor:"blue",children:[(0,t.jsxs)("div",{className:"flex justify-between items-start mb-4",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[m&&(0,t.jsx)("img",{src:m,alt:u,className:"w-5 h-5 object-contain"}),(0,t.jsxs)("span",{className:"text-sm font-medium",children:[u||"New Integration"," Configuration"]})]}),(0,t.jsx)(i.Button,{variant:"light",onClick:()=>{v(e.filter((e,t)=>t!==d))},icon:c.TrashIcon,size:"xs",color:"red",className:"hover:bg-red-50",type:"button",children:"Remove"})]}),(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Integration Type"}),(0,t.jsx)(s.Select,{value:u,placeholder:"Select integration",onChange:e=>w(d,"callback_name",e),className:"w-full",optionLabelProp:"label",children:_.map(e=>{let s=(0,g.resolveLogoSrc)(p.callbackInfo[e]?.logo),a=p.callbackInfo[e]?.description;return(0,t.jsx)(x,{value:e,label:e,children:(0,t.jsx)(l.Tooltip,{title:a,placement:"right",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[s&&(0,t.jsx)("img",{src:s,alt:e,className:"w-4 h-4 object-contain",onError:t=>{let s=t.target,l=s.parentElement;if(l){let t=document.createElement("div");t.className="w-4 h-4 rounded-full bg-gray-200 flex items-center justify-center text-xs",t.textContent=e.charAt(0),l.replaceChild(t,s)}}}),(0,t.jsx)("span",{children:e})]})})},e)})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Event Type"}),(0,t.jsxs)(s.Select,{value:a.callback_type,onChange:e=>w(d,"callback_type",e),className:"w-full",children:[(0,t.jsx)(x,{value:"success",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-green-500 rounded-full"}),(0,t.jsx)("span",{children:"Success Only"})]})}),(0,t.jsx)(x,{value:"failure",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-red-500 rounded-full"}),(0,t.jsx)("span",{children:"Failure Only"})]})}),(0,t.jsx)(x,{value:"success_and_failure",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-blue-500 rounded-full"}),(0,t.jsx)("span",{children:"Success & Failure"})]})})]})]})]}),((e,s)=>{if(!e.callback_name)return null;let a=Object.entries(p.callback_map).find(([t,s])=>s===e.callback_name)?.[0];if(!a)return null;let i=p.callbackInfo[a]?.dynamic_params||{};return 0===Object.keys(i).length?null:(0,t.jsxs)("div",{className:"mt-6 pt-4 border-t border-gray-100",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2 mb-4",children:[(0,t.jsx)("div",{className:"w-3 h-3 bg-blue-100 rounded-full flex items-center justify-center",children:(0,t.jsx)("div",{className:"w-1.5 h-1.5 bg-blue-500 rounded-full"})}),(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Integration Parameters"})]}),(0,t.jsx)("div",{className:"grid grid-cols-1 gap-4",children:Object.entries(i).map(([a,i])=>(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 capitalize flex items-center space-x-1",children:[(0,t.jsx)("span",{children:a.replace(/_/g," ")}),(0,t.jsx)(l.Tooltip,{title:`Environment variable reference recommended: os.environ/${a.toUpperCase()}`,children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})}),"password"===i&&(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800",children:"Sensitive"}),"number"===i&&(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800",children:"Number"})]}),"number"===i&&(0,t.jsx)("span",{className:"text-xs text-gray-500",children:"Value must be between 0 and 1"}),"number"===i?(0,t.jsx)(h.default,{step:.01,width:400,placeholder:`os.environ/${a.toUpperCase()}`,value:e.callback_vars[a]||"",onChange:e=>N(s,a,e.target.value)}):(0,t.jsx)(o.TextInput,{type:"password"===i?"password":"text",placeholder:`os.environ/${a.toUpperCase()}`,value:e.callback_vars[a]||"",onChange:e=>N(s,a,e.target.value)})]},a))})]})})(a,d)]})]},d)})}),0===e.length&&(0,t.jsxs)("div",{className:"text-center py-12 text-gray-500 border-2 border-dashed border-gray-200 rounded-lg bg-gray-50/50",children:[(0,t.jsx)(u.CogIcon,{className:"w-12 h-12 text-gray-300 mb-3 mx-auto"}),(0,t.jsx)("div",{className:"text-base font-medium mb-1",children:"No logging integrations configured"}),(0,t.jsx)("div",{className:"text-sm text-gray-400",children:'Click "Add Integration" to configure logging for this team'})]})]})}])},651904,e=>{"use strict";var t=e.i(843476),s=e.i(599724),l=e.i(266484);e.s(["default",0,function({value:e,onChange:a,premiumUser:r=!1,disabledCallbacks:i=[],onDisabledCallbacksChange:n}){return r?(0,t.jsx)(l.default,{value:e,onChange:a,disabledCallbacks:i,onDisabledCallbacksChange:n}):(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{className:"flex flex-wrap gap-2 mb-3",children:[(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50",children:"✨ langfuse-logging"}),(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50",children:"✨ datadog-logging"})]}),(0,t.jsx)("div",{className:"p-3 bg-yellow-50 border border-yellow-200 rounded-lg",children:(0,t.jsxs)(s.Text,{className:"text-sm text-yellow-800",children:["Setting Key/Team logging settings is a LiteLLM Enterprise feature. Global Logging Settings are available for all free users. Get a trial key"," ",(0,t.jsx)("a",{href:"https://www.litellm.ai/#pricing",target:"_blank",rel:"noopener noreferrer",className:"underline",children:"here"}),"."]})})]})}])},939510,e=>{"use strict";var t=e.i(843476),s=e.i(808613),l=e.i(199133),a=e.i(592968),r=e.i(827252);let{Option:i}=l.Select;e.s(["default",0,({type:e,name:n,showDetailedDescriptions:o=!0,className:d="",initialValue:c=null,form:u,onChange:m})=>{let p=e.toUpperCase(),g=e.toLowerCase(),h=`Select 'guaranteed_throughput' to prevent overallocating ${p} limit when the key belongs to a Team with specific ${p} limits.`;return(0,t.jsx)(s.Form.Item,{label:(0,t.jsxs)("span",{children:[p," Rate Limit Type"," ",(0,t.jsx)(a.Tooltip,{title:h,children:(0,t.jsx)(r.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:n,initialValue:c,className:d,children:(0,t.jsx)(l.Select,{defaultValue:o?"default":void 0,placeholder:"Select rate limit type",style:{width:"100%"},optionLabelProp:o?"label":void 0,onChange:e=>{u&&u.setFieldValue(n,e),m&&m(e)},children:o?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i,{value:"best_effort_throughput",label:"Default",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Default"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["Best effort throughput - no error if we're overallocating ",g," (Team/Key Limits checked at runtime)."]})]})}),(0,t.jsx)(i,{value:"guaranteed_throughput",label:"Guaranteed throughput",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Guaranteed throughput"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["Guaranteed throughput - raise an error if we're overallocating ",g," (also checks model-specific limits)"]})]})}),(0,t.jsx)(i,{value:"dynamic",label:"Dynamic",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Dynamic"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["If the key has a set ",p," (e.g. 2 ",p,") and there are no 429 errors, it can dynamically exceed the limit when the model being called is not erroring."]})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i,{value:"best_effort_throughput",children:"Best effort throughput"}),(0,t.jsx)(i,{value:"guaranteed_throughput",children:"Guaranteed throughput"}),(0,t.jsx)(i,{value:"dynamic",children:"Dynamic"})]})})})}])},460285,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(404206),a=e.i(723731),r=e.i(653824),i=e.i(881073),n=e.i(197647),o=e.i(602869),d=e.i(158392),c=e.i(419470),u=e.i(695411);let m=(0,s.forwardRef)(({accessToken:e,value:m,onChange:p,modelData:g},h)=>{let[x,y]=(0,s.useState)({routerSettings:{},selectedStrategy:null,enableTagFiltering:!1}),[f,b]=(0,s.useState)([]),[_,j]=(0,s.useState)([]),[v,w]=(0,s.useState)([]),[N,k]=(0,s.useState)([]),[S,C]=(0,s.useState)({}),[T,I]=(0,s.useState)({}),A=(0,s.useRef)(!1),L=(0,s.useRef)(null);(0,s.useEffect)(()=>{let e=m?.router_settings?JSON.stringify({routing_strategy:m.router_settings.routing_strategy,fallbacks:m.router_settings.fallbacks,enable_tag_filtering:m.router_settings.enable_tag_filtering}):null;if(A.current&&e===L.current){A.current=!1;return}if(A.current&&e!==L.current&&(A.current=!1),e!==L.current)if(L.current=e,m?.router_settings){let e=m.router_settings,{fallbacks:t,...s}=e;y({routerSettings:s,selectedStrategy:e.routing_strategy||null,enableTagFiltering:e.enable_tag_filtering??!1});let l=e.fallbacks||[];b(l),j(l&&0!==l.length?l.map((e,t)=>{let[s,l]=Object.entries(e)[0];return{id:(t+1).toString(),primaryModel:s||null,fallbackModels:l||[]}}):[{id:"1",primaryModel:null,fallbackModels:[]}])}else y({routerSettings:{},selectedStrategy:null,enableTagFiltering:!1}),b([]),j([{id:"1",primaryModel:null,fallbackModels:[]}])},[m]),(0,s.useEffect)(()=>{e&&(0,o.getRouterSettingsCall)(e).then(e=>{if(e.fields){let t={};e.fields.forEach(e=>{t[e.field_name]={ui_field_name:e.ui_field_name,field_description:e.field_description,options:e.options,link:e.link}}),C(t);let s=e.fields.find(e=>"routing_strategy"===e.field_name);s?.options&&k(s.options),e.routing_strategy_descriptions&&I(e.routing_strategy_descriptions)}})},[e]),(0,s.useEffect)(()=>{e&&(async()=>{try{let t=await (0,u.fetchAvailableModels)(e);w(t)}catch(e){console.error("Error fetching model info for fallbacks:",e)}})()},[e]);let F=()=>{let e=new Set(["allowed_fails","cooldown_time","num_retries","timeout","retry_after"]),t=new Set(["model_group_alias","retry_policy"]),s=Object.fromEntries(Object.entries({...x.routerSettings,enable_tag_filtering:x.enableTagFiltering,routing_strategy:x.selectedStrategy,fallbacks:f.length>0?f:null}).map(([s,l])=>{if("routing_strategy_args"!==s&&"routing_strategy"!==s&&"enable_tag_filtering"!==s&&"fallbacks"!==s){let a=document.querySelector(`input[name="${s}"]`);if(a){if(void 0!==a.value&&""!==a.value){let r=((s,l,a)=>{if(null==l)return a;let r=String(l).trim();if(""===r||"null"===r.toLowerCase())return null;if(e.has(s)){let e=Number(r);return Number.isNaN(e)?a:e}if(t.has(s)){if(""===r)return null;try{return JSON.parse(r)}catch{return a}}return"true"===r.toLowerCase()||"false"!==r.toLowerCase()&&r})(s,a.value,l);return[s,r]}return[s,null]}}else if("routing_strategy"===s)return[s,x.selectedStrategy];else if("enable_tag_filtering"===s)return[s,x.enableTagFiltering];else if("fallbacks"===s)return[s,f.length>0?f:null];else if("routing_strategy_args"===s&&"latency-based-routing"===x.selectedStrategy){let e=document.querySelector('input[name="lowest_latency_buffer"]'),t=document.querySelector('input[name="ttl"]'),s={};return e?.value&&(s.lowest_latency_buffer=Number(e.value)),t?.value&&(s.ttl=Number(t.value)),["routing_strategy_args",Object.keys(s).length>0?s:null]}return[s,l]}).filter(e=>null!=e)),l=(e,t=!1)=>null==e||"object"==typeof e&&!Array.isArray(e)&&0===Object.keys(e).length||t&&("number"!=typeof e||Number.isNaN(e))?null:e;return{routing_strategy:l(s.routing_strategy),allowed_fails:l(s.allowed_fails,!0),cooldown_time:l(s.cooldown_time,!0),num_retries:l(s.num_retries,!0),timeout:l(s.timeout,!0),retry_after:l(s.retry_after,!0),fallbacks:f.length>0?f:null,context_window_fallbacks:l(s.context_window_fallbacks),retry_policy:l(s.retry_policy),model_group_alias:l(s.model_group_alias),enable_tag_filtering:x.enableTagFiltering,routing_strategy_args:l(s.routing_strategy_args)}};(0,s.useEffect)(()=>{if(!p)return;let e=setTimeout(()=>{A.current=!0,p({router_settings:F()})},100);return()=>clearTimeout(e)},[x,f]);let M=Array.from(new Set(v.map(e=>e.model_group))).sort();return((0,s.useImperativeHandle)(h,()=>({getValue:()=>({router_settings:F()})})),e)?(0,t.jsx)("div",{className:"w-full",children:(0,t.jsxs)(r.TabGroup,{className:"w-full",children:[(0,t.jsxs)(i.TabList,{variant:"line",defaultValue:"1",className:"px-8 pt-4",children:[(0,t.jsx)(n.Tab,{value:"1",children:"Loadbalancing"}),(0,t.jsx)(n.Tab,{value:"2",children:"Fallbacks"})]}),(0,t.jsxs)(a.TabPanels,{className:"px-8 py-6",children:[(0,t.jsx)(l.TabPanel,{children:(0,t.jsx)(d.default,{value:x,onChange:y,routerFieldsMetadata:S,availableRoutingStrategies:N,routingStrategyDescriptions:T})}),(0,t.jsx)(l.TabPanel,{children:(0,t.jsx)(c.FallbackSelectionForm,{groups:_,onGroupsChange:e=>{j(e),b(e.filter(e=>e.primaryModel&&e.fallbackModels.length>0).map(e=>({[e.primaryModel]:e.fallbackModels})))},availableModels:M,maxGroups:5})})]})]})}):null});m.displayName="RouterSettingsAccordion",e.s(["default",0,m])},363256,e=>{"use strict";var t=e.i(843476),s=e.i(199133);let{Text:l}=e.i(898586).Typography;e.s(["default",0,({organizations:e,value:a,onChange:r,disabled:i,loading:n,style:o})=>(0,t.jsx)(s.Select,{showSearch:!0,placeholder:"All Organizations",value:a,onChange:r,disabled:i,loading:n,allowClear:!0,style:{minWidth:280,...o},filterOption:(t,s)=>{if(!s)return!1;let l=e?.find(e=>e.organization_id===s.key);if(!l)return!1;let a=t.toLowerCase().trim(),r=(l.organization_alias||"").toLowerCase(),i=(l.organization_id||"").toLowerCase();return r.includes(a)||i.includes(a)},children:e?.map(e=>(0,t.jsxs)(s.Select.Option,{value:e.organization_id,children:[(0,t.jsx)("span",{className:"font-medium",children:e.organization_alias})," ",(0,t.jsxs)(l,{type:"secondary",children:["(",e.organization_id,")"]})]},e.organization_id))})])},575260,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(482725),a=e.i(56456);e.s(["default",0,({projects:e,value:r,onChange:i,disabled:n,loading:o,teamId:d})=>{let c=d?e?.filter(e=>e.team_id===d):e;return(0,t.jsx)(s.Select,{showSearch:!0,placeholder:"Search or select a project",value:r,onChange:i,disabled:n,loading:o,allowClear:!0,notFoundContent:o?(0,t.jsx)(l.Spin,{indicator:(0,t.jsx)(a.LoadingOutlined,{spin:!0}),size:"small"}):void 0,filterOption:(e,t)=>{if(!t)return!1;let s=c?.find(e=>e.project_id===t.key);if(!s)return!1;let l=e.toLowerCase().trim(),a=(s.project_alias||"").toLowerCase(),r=(s.project_id||"").toLowerCase();return a.includes(l)||r.includes(l)},optionFilterProp:"children",children:!o&&c?.map(e=>(0,t.jsxs)(s.Select.Option,{value:e.project_id,children:[(0,t.jsx)("span",{className:"font-medium",children:e.project_alias||e.project_id})," ",(0,t.jsxs)("span",{className:"text-gray-500",children:["(",e.project_id,")"]})]},e.project_id))})}])},128233,319312,e=>{"use strict";var t=e.i(843476),s=e.i(464571),l=e.i(199133),a=e.i(592968),r=e.i(425063),i=e.i(107233),n=e.i(37727),o=e.i(271645);e.s(["BudgetFallbacksEditor",0,function({value:e,onChange:d,availableModels:c}){let[u,m]=(0,o.useState)(()=>{let t;return 0===(t=Object.keys(e)).length?[]:t.map((t,s)=>({id:String(s+1),primaryModel:t,fallbackModels:e[t]}))}),p=e=>{m(e),d(Object.fromEntries(e.filter(e=>null!==e.primaryModel&&e.fallbackModels.length>0).map(e=>[e.primaryModel,e.fallbackModels])))},g=()=>{p([...u,{id:Date.now().toString(),primaryModel:null,fallbackModels:[]}])},h=(e,t)=>{p(u.map(s=>s.id===e?{...s,...t}:s))},x=new Set(u.map(e=>e.primaryModel).filter(Boolean));return 0===u.length?(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"text-xs text-gray-500 mb-2",children:"When a model exceeds its per-model budget, requests automatically reroute to fallback models"}),(0,t.jsx)(s.Button,{size:"small",onClick:g,icon:(0,t.jsx)(i.Plus,{className:"w-3 h-3"}),children:"Add Budget Fallback"})]}):(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"When a model exceeds its per-model budget, requests automatically reroute to fallback models"}),u.map(e=>{let s=c.filter(t=>t===e.primaryModel||!x.has(t)),i=c.filter(t=>t!==e.primaryModel);return(0,t.jsxs)("div",{className:"relative rounded-lg border border-gray-200 bg-gray-50 p-4",children:[(0,t.jsx)("button",{type:"button",onClick:()=>{var t;return t=e.id,void p(u.filter(e=>e.id!==t))},className:"absolute top-2 right-2 text-gray-400 hover:text-red-500 transition-colors p-1",children:(0,t.jsx)(n.X,{className:"w-4 h-4"})}),(0,t.jsxs)("div",{className:"mb-3",children:[(0,t.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Primary Model"}),(0,t.jsx)(l.Select,{className:"w-full",placeholder:"Select model",value:e.primaryModel,onChange:t=>{let s=e.fallbackModels.filter(e=>e!==t);h(e.id,{primaryModel:t,fallbackModels:s})},showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:s.map(e=>({label:e,value:e})),getPopupContainer:e=>e.parentElement||document.body})]}),(0,t.jsx)("div",{className:"flex items-center justify-center -my-1 mb-2",children:(0,t.jsxs)("div",{className:"bg-amber-50 text-amber-600 px-3 py-0.5 rounded-full text-[10px] font-bold border border-amber-100 flex items-center gap-1",children:[(0,t.jsx)(r.ArrowDown,{className:"w-3 h-3"}),"IF BUDGET EXCEEDED, TRY"]})}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Fallback Models"}),(0,t.jsx)(l.Select,{mode:"multiple",className:"w-full",placeholder:e.primaryModel?"Select fallback models":"Select a primary model first",value:e.fallbackModels,onChange:t=>h(e.id,{fallbackModels:t}),disabled:!e.primaryModel,showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:i.map(e=>({label:e,value:e})),getPopupContainer:e=>e.parentElement||document.body,maxTagCount:"responsive",maxTagPlaceholder:e=>(0,t.jsx)(a.Tooltip,{styles:{root:{pointerEvents:"none"}},title:e.map(({value:e})=>e).join(", "),children:(0,t.jsxs)("span",{children:["+",e.length," more"]})})}),e.fallbackModels.length>1&&(0,t.jsx)("div",{className:"text-[10px] text-gray-400 mt-1 ml-1",children:"Tried in order; first model still within its own budget is used"})]})]},e.id)}),(0,t.jsx)(s.Button,{size:"small",onClick:g,icon:(0,t.jsx)(i.Plus,{className:"w-3 h-3"}),children:"Add Budget Fallback"})]})}],128233);var d=e.i(28651);let c=[{value:"1h",label:"Hourly",resetHint:"Resets every hour"},{value:"24h",label:"Daily",resetHint:"Resets daily at midnight UTC"},{value:"7d",label:"Weekly",resetHint:"Resets every Sunday at midnight UTC"},{value:"30d",label:"Monthly",resetHint:"Resets on the 1st of every month at midnight UTC"}];e.s(["BudgetWindowsEditor",0,function({value:e,onChange:a}){let r=(t,s,l)=>{a(e.map((e,a)=>a===t?{...e,[s]:l}:e))};return(0,t.jsxs)("div",{children:[e.map((i,n)=>{let o=c.find(e=>e.value===i.budget_duration)?.resetHint;return(0,t.jsxs)("div",{style:{marginBottom:12},children:[(0,t.jsxs)("div",{style:{display:"flex",gap:8,alignItems:"center"},children:[(0,t.jsx)(l.Select,{value:i.budget_duration,onChange:e=>r(n,"budget_duration",e),style:{width:130},options:c.map(e=>({value:e.value,label:e.label}))}),(0,t.jsx)(d.InputNumber,{step:.01,min:0,precision:2,value:i.max_budget??void 0,onChange:e=>r(n,"max_budget",e??null),placeholder:"Max spend ($)",style:{width:160},prefix:"$"}),(0,t.jsx)(s.Button,{type:"text",danger:!0,size:"small",onClick:()=>{a(e.filter((e,t)=>t!==n))},style:{padding:"0 4px"},children:"✕"})]}),o&&(0,t.jsxs)("div",{style:{fontSize:11,color:"#888",marginTop:3,marginLeft:2},children:["↻ ",o]})]},n)}),(0,t.jsx)(s.Button,{size:"small",onClick:t=>{t.preventDefault(),a([...e,{budget_duration:"24h",max_budget:null}])},children:"+ Add Budget Window"})]})}],319312)},390605,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(602869),a=e.i(599724),r=e.i(482725),i=e.i(91739),n=e.i(500727),o=e.i(531516),d=e.i(696609);e.s(["default",0,({accessToken:e,selectedServers:c,toolPermissions:u,onChange:m,disabled:p=!1})=>{let{data:g=[]}=(0,n.useMCPServers)(),[h,x]=(0,s.useState)({}),[y,f]=(0,s.useState)({}),[b,_]=(0,s.useState)({}),[j,v]=(0,s.useState)({}),w=(0,s.useRef)(u);(0,s.useEffect)(()=>{w.current=u},[u]);let N=(0,s.useMemo)(()=>0===c.length?[]:g.filter(e=>c.includes(e.server_id)),[g,c]),k=async(e,t)=>{f(t=>({...t,[e]:!0})),_(t=>({...t,[e]:""}));try{let s=await (0,l.listMCPTools)(t,e);if(s.error)_(t=>({...t,[e]:s.message||"Failed to fetch tools"})),x(t=>({...t,[e]:[]}));else{let t=s.tools||[];x(s=>({...s,[e]:t}));let l=w.current;if(!l[e]&&t.length>0){let s=t.filter(e=>"delete"!==(0,d.classifyToolOp)(e.name,e.description||"")).map(e=>e.name);m({...l,[e]:s})}}}catch(t){console.error(`Error fetching tools for server ${e}:`,t),_(t=>({...t,[e]:"Failed to fetch tools"})),x(t=>({...t,[e]:[]}))}finally{f(t=>({...t,[e]:!1}))}};(0,s.useEffect)(()=>{N.forEach(t=>{h[t.server_id]||y[t.server_id]||k(t.server_id,e)})},[N,e]);let S=(e,t)=>{m({...u,[e]:t})};return 0===c.length?null:(0,t.jsx)("div",{className:"space-y-4",children:N.map(e=>{let s=e.server_name||e.alias||e.server_id,l=h[e.server_id]||[],n=u[e.server_id]||[],d=y[e.server_id],c=b[e.server_id],g=j[e.server_id]??"crud";return(0,t.jsxs)("div",{className:"border rounded-lg bg-gray-50",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between p-4 border-b bg-white rounded-t-lg",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(a.Text,{className:"font-semibold text-gray-900",children:s}),e.description&&(0,t.jsx)(a.Text,{className:"text-sm text-gray-500",children:e.description})]}),(0,t.jsxs)("div",{className:"flex items-center gap-3",children:[!p&&l.length>0&&(0,t.jsx)(i.Radio.Group,{value:g,onChange:t=>v(s=>({...s,[e.server_id]:t.target.value})),size:"small",optionType:"button",buttonStyle:"solid",options:[{label:"Risk Groups",value:"crud"},{label:"Flat List",value:"flat"}]}),!p&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("button",{type:"button",className:"text-sm text-blue-600 hover:text-blue-700 font-medium",onClick:()=>{var t;let s;return s=h[t=e.server_id]||[],void m({...u,[t]:s.map(e=>e.name)})},disabled:d,children:"Select All"}),(0,t.jsx)("button",{type:"button",className:"text-sm text-blue-600 hover:text-blue-700 font-medium",onClick:()=>{var t;return t=e.server_id,void m({...u,[t]:[]})},disabled:d,children:"Deselect All"})]})]})]}),(0,t.jsxs)("div",{className:"p-4",children:[d&&(0,t.jsxs)("div",{className:"flex items-center justify-center py-8",children:[(0,t.jsx)(r.Spin,{size:"large"}),(0,t.jsx)(a.Text,{className:"ml-3 text-gray-500",children:"Loading tools..."})]}),c&&!d&&(0,t.jsxs)("div",{className:"p-4 bg-red-50 border border-red-200 rounded-lg text-center",children:[(0,t.jsx)(a.Text,{className:"text-red-600 font-medium",children:"Unable to load tools"}),(0,t.jsx)(a.Text,{className:"text-sm text-red-500 mt-1",children:c})]}),!d&&!c&&l.length>0&&"crud"===g&&(0,t.jsx)(o.default,{tools:l,value:u[e.server_id]?n:void 0,onChange:t=>S(e.server_id,t),readOnly:p}),!d&&!c&&l.length>0&&"flat"===g&&(0,t.jsx)("div",{className:"space-y-2",children:l.map(s=>{let l=n.includes(s.name);return(0,t.jsxs)("div",{className:"flex items-start gap-2",children:[(0,t.jsx)("input",{type:"checkbox",checked:l,onChange:()=>{if(p)return;let t=l?n.filter(e=>e!==s.name):[...n,s.name];S(e.server_id,t)},disabled:p,className:"mt-0.5"}),(0,t.jsx)("div",{className:"flex-1 min-w-0",children:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(a.Text,{className:"font-medium text-gray-900",children:s.name}),(0,t.jsxs)(a.Text,{className:"text-sm text-gray-500",children:["- ",s.description||"No description"]})]})})]},s.name)})}),!d&&!c&&0===l.length&&(0,t.jsx)("div",{className:"text-center py-6",children:(0,t.jsx)(a.Text,{className:"text-gray-500",children:"No tools available"})})]})]},e.server_id)})})}])},364769,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(237016),a=e.i(464571),r=e.i(888259);e.s(["default",0,({apiKey:e})=>{let[i,n]=(0,s.useState)(!1);return(0,t.jsxs)("div",{children:[(0,t.jsxs)("p",{className:"mb-2",children:["Please save this secret key somewhere safe and accessible. For security reasons,"," ",(0,t.jsx)("b",{children:"you will not be able to view it again"})," through your LiteLLM account. If you lose this secret key, you will need to generate a new one."]}),(0,t.jsx)("p",{className:"text-sm text-gray-600 mt-3 mb-1",children:"Virtual Key:"}),(0,t.jsx)("div",{style:{background:"#f8f8f8",padding:"10px",borderRadius:"5px",marginBottom:"10px"},children:(0,t.jsx)("pre",{style:{wordWrap:"break-word",whiteSpace:"normal",margin:0},children:e})}),(0,t.jsx)(l.CopyToClipboard,{text:e,onCopy:()=>{n(!0),r.default.success("Key copied to clipboard"),setTimeout(()=>n(!1),2e3)},children:(0,t.jsx)(a.Button,{type:"primary",style:{marginTop:12},children:i?"Copied!":"Copy Virtual Key"})})]})}])},702597,e=>{"use strict";var t=e.i(843476),s=e.i(207082),l=e.i(109799),a=e.i(510674),r=e.i(109034),i=e.i(292639),n=e.i(135214),o=e.i(500330),d=e.i(827252),c=e.i(912598),u=e.i(677667),m=e.i(130643),p=e.i(898667),g=e.i(994388),h=e.i(309426),x=e.i(350967),y=e.i(599724),f=e.i(779241),b=e.i(629569),_=e.i(464571),j=e.i(808613),v=e.i(311451),w=e.i(212931),N=e.i(91739),k=e.i(199133),S=e.i(790848),C=e.i(262218),T=e.i(592968),I=e.i(898586),A=e.i(374009),L=e.i(271645),F=e.i(708347),M=e.i(552130),O=e.i(557662),E=e.i(9314),P=e.i(860585),B=e.i(82946),$=e.i(392110),R=e.i(533882),D=e.i(844565),V=e.i(651904),z=e.i(939510),U=e.i(460285),G=e.i(663435),K=e.i(363256),q=e.i(575260),W=e.i(371455),H=e.i(128233),Q=e.i(319312),J=e.i(355619),Y=e.i(75921),X=e.i(234713),Z=e.i(390605),ee=e.i(727749),et=e.i(602869),es=e.i(364769),el=e.i(435451),ea=e.i(916940);let{Option:er}=k.Select,ei=async(e,t,s,l)=>{try{if(null===e||null===t)return[];if(null!==s)return(await (0,et.modelAvailableCall)(s,e,t,!0,l,!0)).data.map(e=>e.id);return[]}catch(e){return console.error("Error fetching user models:",e),[]}},en=async(e,t,s,l)=>{try{if(null===e||null===t)return;if(null!==s){let a=(await (0,et.modelAvailableCall)(s,e,t)).data.map(e=>e.id);l(a)}}catch(e){console.error("Error fetching user models:",e)}};e.s(["default",0,({team:e,teams:eo,data:ed,addKey:ec,autoOpenCreate:eu,prefillData:em})=>{let{accessToken:ep,userId:eg,userRole:eh,premiumUser:ex}=(0,n.default)(),ey=ex||null!=eh&&F.rolesWithWriteAccess.includes(eh),{data:ef,isLoading:eb}=(0,l.useOrganizations)(),{data:e_,isLoading:ej}=(0,a.useProjects)(),{data:ev}=(0,i.useUISettings)(),{data:ew}=(0,r.useTags)(),eN=!!ev?.values?.enable_projects_ui,ek=!!ev?.values?.disable_custom_api_keys,eS=ew?Object.values(ew).map(e=>({value:e.name,label:e.name})):[],eC=(0,c.useQueryClient)(),[eT]=j.Form.useForm(),[eI,eA]=(0,L.useState)(!1),[eL,eF]=(0,L.useState)(null),[eM,eO]=(0,L.useState)(null),[eE,eP]=(0,L.useState)([]),[eB,e$]=(0,L.useState)([]),[eR,eD]=(0,L.useState)("you"),[eV,ez]=(0,L.useState)(!1),[eU,eG]=(0,L.useState)(null),[eK,eq]=(0,L.useState)([]),[eW,eH]=(0,L.useState)([]),[eQ,eJ]=(0,L.useState)([]),[eY,eX]=(0,L.useState)([]),[eZ,e0]=(0,L.useState)(e),[e1,e2]=(0,L.useState)(null),[e4,e3]=(0,L.useState)(null),[e5,e6]=(0,L.useState)(!1),[e7,e9]=(0,L.useState)(null),[e8,te]=(0,L.useState)({}),[tt,ts]=(0,L.useState)([]),[tl,ta]=(0,L.useState)(!1),[tr,ti]=(0,L.useState)([]),[tn,to]=(0,L.useState)([]),[td,tc]=(0,L.useState)("llm_api"),[tu,tm]=(0,L.useState)({}),[tp,tg]=(0,L.useState)(!1),[th,tx]=(0,L.useState)("30d"),[ty,tf]=(0,L.useState)(null),[tb,t_]=(0,L.useState)([]),[tj,tv]=(0,L.useState)({}),[tw,tN]=(0,L.useState)(0),[tk,tS]=(0,L.useState)(0),[tC,tT]=(0,L.useState)([]),[tI,tA]=(0,L.useState)(null),tL=()=>{eA(!1),eT.resetFields(),eX([]),to([]),tc("llm_api"),tm({}),tg(!1),tx("30d"),tf(null),tS(e=>e+1),tA(null),e2(null),e3(null),t_([]),tv({}),tN(e=>e+1)},tF=()=>{eA(!1),eF(null),e0(null),eT.resetFields(),eX([]),to([]),tc("llm_api"),tm({}),tg(!1),tx("30d"),tf(null),tS(e=>e+1),tA(null),e2(null),e3(null),t_([]),tv({}),tN(e=>e+1)};(0,L.useEffect)(()=>{eg&&eh&&ep&&en(eg,eh,ep,eP)},[ep,eg,eh]),(0,L.useEffect)(()=>{ep&&(0,et.getAgentsList)(ep).then(e=>tT(e?.agents||[])).catch(()=>tT([]))},[ep]),(0,L.useEffect)(()=>{let e=async()=>{try{let e=(await (0,et.getPoliciesList)(ep)).policies.map(e=>e.policy_name);eH(e)}catch(e){console.error("Failed to fetch policies:",e)}},t=async()=>{try{let e=await (0,et.getPromptsList)(ep);eJ(e.prompts.map(e=>e.prompt_id))}catch(e){console.error("Failed to fetch prompts:",e)}};(async()=>{try{let e=(await (0,et.getGuardrailsList)(ep)).guardrails.map(e=>e.guardrail_name);eq(e)}catch(e){console.error("Failed to fetch guardrails:",e)}})(),e(),t()},[ep]),(0,L.useEffect)(()=>{(async()=>{try{if(ep){let e=sessionStorage.getItem("possibleUserRoles");if(e)te(JSON.parse(e));else{let e=await (0,et.getPossibleUserRoles)(ep);sessionStorage.setItem("possibleUserRoles",JSON.stringify(e)),te(e)}}}catch(e){console.error("Error fetching possible user roles:",e)}})()},[ep]),(0,L.useEffect)(()=>{if(eu&&!eV&&eo&&eh&&F.rolesWithWriteAccess.includes(eh)&&(eA(!0),ez(!0),em)){if(em.owned_by&&("another_user"===em.owned_by&&"Admin"!==eh?eD("you"):eD(em.owned_by)),em.team_id){let e=eo?.find(e=>e.team_id===em.team_id)||null;e&&(e0(e),eT.setFieldsValue({team_id:em.team_id}))}em.key_alias&&eT.setFieldsValue({key_alias:em.key_alias}),em.models&&em.models.length>0&&eG(em.models),em.key_type&&(tc(em.key_type),eT.setFieldsValue({key_type:em.key_type}))}},[eu,em,eo,eV,eT,eh]);let tM=eB.includes("no-default-models")&&!eZ,tO=async e=>{try{let t,l=e?.key_alias??"",a=e?.team_id??null;if((ed?.filter(e=>e.team_id===a).map(e=>e.key_alias)??[]).includes(l))throw Error(`Key alias ${l} already exists for team with ID ${a}, please provide another key alias`);if(ee.default.info("Making API Call"),eA(!0),"you"===eR)e.user_id=eg;else if("agent"===eR){if(!tI)return void ee.default.fromBackend("Please select an agent");e.agent_id=tI}let r={};try{r=JSON.parse(e.metadata||"{}")}catch(e){console.error("Error parsing metadata:",e)}if("service_account"===eR&&(r.service_account_id=e.key_alias),eY.length>0&&(r={...r,logging:eY.filter(e=>e.callback_name)}),tn.length>0){let e=(0,O.mapDisplayToInternalNames)(tn);r={...r,litellm_disabled_callbacks:e}}if(tp&&(e.auto_rotate=!0,e.rotation_interval=th),e.duration&&""!==e.duration.trim()||(e.duration=null),e.metadata=JSON.stringify(r),e.disable_global_guardrails||delete e.disable_global_guardrails,e.allowed_vector_store_ids&&e.allowed_vector_store_ids.length>0&&(e.object_permission={vector_stores:e.allowed_vector_store_ids},delete e.allowed_vector_store_ids),e.allowed_mcp_servers_and_groups&&(e.allowed_mcp_servers_and_groups.servers?.length>0||e.allowed_mcp_servers_and_groups.accessGroups?.length>0)){e.object_permission||(e.object_permission={});let{servers:t,accessGroups:s}=e.allowed_mcp_servers_and_groups;t&&t.length>0&&(e.object_permission.mcp_servers=t),s&&s.length>0&&(e.object_permission.mcp_access_groups=s),delete e.allowed_mcp_servers_and_groups}let i=e.mcp_tool_permissions||{};if(Object.keys(i).length>0&&(e.object_permission||(e.object_permission={}),e.object_permission.mcp_tool_permissions=i),delete e.mcp_tool_permissions,e.allowed_mcp_access_groups&&e.allowed_mcp_access_groups.length>0&&(e.object_permission||(e.object_permission={}),e.object_permission.mcp_access_groups=e.allowed_mcp_access_groups,delete e.allowed_mcp_access_groups),e.allowed_agents_and_groups&&(e.allowed_agents_and_groups.agents?.length>0||e.allowed_agents_and_groups.accessGroups?.length>0)){e.object_permission||(e.object_permission={});let{agents:t,accessGroups:s}=e.allowed_agents_and_groups;t&&t.length>0&&(e.object_permission.agents=t),s&&s.length>0&&(e.object_permission.agent_access_groups=s),delete e.allowed_agents_and_groups}Object.keys(tu).length>0&&(e.aliases=JSON.stringify(tu)),ty?.router_settings&&Object.values(ty.router_settings).some(e=>null!=e&&""!==e)&&(e.router_settings=ty.router_settings);let n=tb.filter(e=>e.budget_duration&&null!==e.max_budget&&void 0!==e.max_budget);n.length>0&&(e.budget_limits=n),Object.keys(tj).length>0&&(e.budget_fallbacks=tj),t="service_account"===eR?await (0,et.keyCreateServiceAccountCall)(ep,e):await (0,et.keyCreateCall)(ep,eg,e),ec(t),eC.invalidateQueries({queryKey:s.keyKeys.lists()}),eF(t.key),eO(t.soft_budget),ee.default.success("Virtual Key Created"),eT.resetFields(),t_([]),tv({}),tN(e=>e+1),localStorage.removeItem("userData"+eg)}catch(t){let e=(e=>{let t;if(!(t=!e||"object"!=typeof e||e instanceof Error?String(e):JSON.stringify(e)).includes("/key/generate")&&!t.includes("KeyManagementRoutes.KEY_GENERATE"))return`Error creating the key: ${e}`;let s=t;try{if(!e||"object"!=typeof e||e instanceof Error){let e=t.match(/\{[\s\S]*\}/);if(e){let t=JSON.parse(e[0]),l=t?.error||t;l?.message&&(s=l.message)}}else{let t=e?.error||e;t?.message&&(s=t.message)}}catch(e){}return t.includes("team_member_permission_error")||s.includes("Team member does not have permissions")?"Team member does not have permission to generate key for this team. Ask your proxy admin to configure the team member permission settings.":`Error creating the key: ${e}`})(t);ee.default.fromBackend(e)}};(0,L.useEffect)(()=>{if(e4){let e=e_?.find(e=>e.project_id===e4);e$(e?.models??[]),eT.setFieldValue("models",[]);return}eg&&eh&&ep&&ei(eg,eh,ep,eZ?.team_id??null).then(e=>{e$(Array.from(new Set([...eZ?.models??[],...e])))}),eU||eT.setFieldValue("models",[]),eT.setFieldValue("allowed_mcp_servers_and_groups",{servers:[],accessGroups:[]})},[eZ,e4,ep,eg,eh,eT]),(0,L.useEffect)(()=>{if(!eU||0===eU.length||!eB||0===eB.length)return;let e=eU.filter(e=>eB.includes(e));e.length>0&&eT.setFieldsValue({models:e}),eG(null)},[eU,eB,eT]),(0,L.useEffect)(()=>{if(!e4||!eo)return;let e=e_?.find(e=>e.project_id===e4);if(!e?.team_id||eZ?.team_id===e.team_id)return;let t=eo.find(t=>t.team_id===e.team_id)||null;t&&(e0(t),eT.setFieldValue("team_id",t.team_id))},[eo,e4,e_]);let tE=async e=>{if(!e)return void ts([]);ta(!0);try{let t=new URLSearchParams;if(t.append("user_email",e),null==ep)return;let s=(await (0,et.userFilterUICall)(ep,t)).map(e=>({label:`${e.user_email} (${e.user_id})`,value:e.user_id,user:e}));ts(s)}catch(e){console.error("Error fetching users:",e),ee.default.fromBackend("Failed to search for users")}finally{ta(!1)}},tP=(0,L.useCallback)((0,A.default)(e=>tE(e),300),[ep]);return(0,t.jsxs)("div",{children:[eh&&F.rolesWithWriteAccess.includes(eh)&&(0,t.jsx)(g.Button,{className:"mx-auto",onClick:()=>eA(!0),"data-testid":"create-key-button",children:"+ Create New Key"}),(0,t.jsx)(w.Modal,{open:eI,width:1e3,footer:null,onOk:tL,onCancel:tF,children:(0,t.jsxs)(j.Form,{form:eT,onFinish:tO,labelCol:{span:8},wrapperCol:{span:16},labelAlign:"left",children:[(0,t.jsxs)("div",{className:"mb-8",children:[(0,t.jsx)(b.Title,{className:"mb-4",children:"Key Ownership"}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Owned By"," ",(0,t.jsx)(T.Tooltip,{title:"Select who will own this Virtual Key",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),className:"mb-4",children:(0,t.jsxs)(N.Radio.Group,{onChange:e=>eD(e.target.value),value:eR,children:[(0,t.jsx)(N.Radio,{value:"you",children:"You"}),(0,t.jsx)(N.Radio,{value:"service_account",children:"Service Account"}),"Admin"===eh&&(0,t.jsx)(N.Radio,{value:"another_user",children:"Another User"}),(0,t.jsxs)(N.Radio,{value:"agent",children:["Agent ",(0,t.jsx)(C.Tag,{color:"purple",children:"New"})]})]})}),"another_user"===eR&&(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["User ID"," ",(0,t.jsx)(T.Tooltip,{title:"The user who will own this key and be responsible for its usage",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"user_id",className:"mt-4",rules:[{required:"another_user"===eR,message:"Please input the user ID of the user you are assigning the key to"}],children:(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{style:{display:"flex",marginBottom:"8px"},children:[(0,t.jsx)(k.Select,{showSearch:!0,placeholder:"Type email to search for users",filterOption:!1,onSearch:e=>{tP(e)},onSelect:(e,t)=>{let s;return s=t.user,void eT.setFieldsValue({user_id:s.user_id})},options:tt,loading:tl,allowClear:!0,style:{width:"100%"},notFoundContent:tl?"Searching...":"No users found"}),(0,t.jsx)(_.Button,{onClick:()=>e6(!0),style:{marginLeft:"8px"},children:"Create User"})]}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Search by email to find users"})]})}),"agent"===eR&&(0,t.jsxs)("div",{className:"mt-4 p-4 bg-purple-50 border border-purple-200 rounded-md",children:[(0,t.jsx)("div",{className:"mb-3",children:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700",children:["Select Agent ",(0,t.jsx)("span",{className:"text-red-500",children:"*"})]})}),(0,t.jsx)(k.Select,{showSearch:!0,placeholder:"Select an agent",style:{width:"100%"},value:tI,onChange:e=>tA(e),filterOption:(e,t)=>t?.label?.toLowerCase().includes(e.toLowerCase()),options:tC.map(e=>({label:e.agent_name||e.agent_id,value:e.agent_id}))}),(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-2",children:"This key will be used by the selected agent to make requests to LiteLLM"})]}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Organization"," ",(0,t.jsx)(T.Tooltip,{title:"The organization this key belongs to. Selecting an organization filters the available teams.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"organization_id",className:"mt-4",children:(0,t.jsx)(K.default,{organizations:ef,loading:eb,disabled:"Admin"!==eh,onChange:e=>{e2(e||null),e0(null),e3(null),eT.setFieldValue("team_id",void 0),eT.setFieldValue("project_id",void 0)}})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Team"," ",(0,t.jsx)(T.Tooltip,{title:"The team this key belongs to, which determines available models and budget limits",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"team_id",initialValue:e?e.team_id:null,className:"mt-4",rules:[{required:"service_account"===eR,message:"Please select a team for the service account"}],help:"service_account"===eR?"required":"",children:(0,t.jsx)(G.default,{disabled:null!==e4,organizationId:e1,onTeamSelect:e=>{e0(e),e3(null),eT.setFieldValue("project_id",void 0),e?.organization_id?(e2(e.organization_id),eT.setFieldValue("organization_id",e.organization_id)):e||(e2(null),eT.setFieldValue("organization_id",void 0))}})}),eN&&(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Project"," ",(0,t.jsx)(T.Tooltip,{title:"Assign this key to a project. Selecting a project will lock the team to the project's team.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"project_id",className:"mt-4",children:(0,t.jsx)(q.default,{projects:e_,teamId:eZ?.team_id,loading:ej||!eo,onChange:e=>{if(!e){e3(null),e0(null),eT.setFieldValue("team_id",void 0);return}e3(e)}})})]}),tM&&(0,t.jsx)("div",{className:"mb-8 p-4 bg-blue-50 border border-blue-200 rounded-md",children:(0,t.jsx)(y.Text,{className:"text-blue-800 text-sm",children:"Please select a team to continue configuring your Virtual Key. If you do not see any teams, please contact your Proxy Admin to either provide you with access to models or to add you to a team."})}),!tM&&(0,t.jsxs)("div",{className:"mb-8",children:[(0,t.jsx)(b.Title,{className:"mb-4",children:"Key Details"}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["you"===eR||"another_user"===eR?"Key Name":"Service Account ID"," ",(0,t.jsx)(T.Tooltip,{title:"you"===eR||"another_user"===eR?"A descriptive name to identify this key":"Unique identifier for this service account",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"key_alias",rules:[{required:!0,message:`Please input a ${"you"===eR?"key name":"service account ID"}`}],help:"required",children:(0,t.jsx)(f.TextInput,{placeholder:""})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Models"," ",(0,t.jsx)(T.Tooltip,{title:"Select which models this key can access. Choose 'All Team Models' to grant access to all models available to the team. Leave empty to allow access to all models.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"models",rules:[],help:"management"===td||"read_only"===td?"Models field is disabled for this key type":"optional - leave empty to allow access to all models",className:"mt-4",children:(0,t.jsxs)(k.Select,{mode:"multiple",placeholder:"Select models",style:{width:"100%"},disabled:"management"===td||"read_only"===td,onChange:e=>{e.includes("all-team-models")&&eT.setFieldsValue({models:["all-team-models"]})},children:[!e4&&(0,t.jsx)(er,{value:"all-team-models",children:"All Team Models"},"all-team-models"),eB.map(e=>(0,t.jsx)(er,{value:e,children:(0,J.getModelDisplayName)(e)},e))]})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Key Type"," ",(0,t.jsx)(T.Tooltip,{title:"Select the type of key to determine what routes and operations this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"key_type",initialValue:"llm_api",className:"mt-4",children:(0,t.jsxs)(k.Select,{defaultValue:"llm_api",placeholder:"Select key type",style:{width:"100%"},optionLabelProp:"label",onChange:e=>{tc(e),("management"===e||"read_only"===e)&&eT.setFieldsValue({models:[]})},children:[(0,t.jsx)(er,{value:"llm_api",label:"AI APIs",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"AI APIs"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call only AI API routes (chat/completions, embeddings, etc.)"})]})}),(0,t.jsx)(er,{value:"management",label:"Management",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"Management"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call only management routes (user/team/key management)"})]})}),(0,t.jsx)(er,{value:"default",label:"Full Access",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"Full Access"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call all routes (AI APIs, Management, and read-only)"})]})})]})})]}),!tM&&(0,t.jsx)("div",{className:"mb-8",children:(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)(b.Title,{className:"m-0",children:"Optional Settings"})}),(0,t.jsxs)(m.AccordionBody,{children:[(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Max Budget (USD)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum amount in USD this key can spend. When reached, the key will be blocked from making further requests",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"max_budget",help:`Budget cannot exceed team max budget: $${e?.max_budget!==null&&e?.max_budget!==void 0?e?.max_budget:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.max_budget&&s>e.max_budget)throw Error(`Budget cannot exceed team max budget: $${(0,o.formatNumberWithCommas)(e.max_budget,4)}`)}}],children:(0,t.jsx)(el.default,{step:.01,precision:2,width:200})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Reset Budget"," ",(0,t.jsx)(T.Tooltip,{title:"How often the budget should reset. For example, setting 'daily' will reset the budget every 24 hours",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"budget_duration",help:`Team Reset Budget: ${e?.budget_duration!==null&&e?.budget_duration!==void 0?e?.budget_duration:"None"}`,children:(0,t.jsx)(P.default,{onChange:e=>eT.setFieldValue("budget_duration",e)})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Budget Windows"," ",(0,t.jsx)(T.Tooltip,{title:"Set multiple independent budget windows (e.g., hourly $10 AND monthly $200). Each window tracks spend separately and resets on its own schedule.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)(Q.BudgetWindowsEditor,{value:tb,onChange:t_})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Budget Fallbacks"," ",(0,t.jsx)(T.Tooltip,{title:"When a model exceeds its per-model budget (model_max_budget), requests automatically reroute to fallback models instead of failing. Configure per-model budgets in Advanced Settings.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)(H.BudgetFallbacksEditor,{value:tj,onChange:tv,availableModels:eB},tw)}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Tokens per minute Limit (TPM)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum number of tokens this key can process per minute. Helps control usage and costs",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"tpm_limit",help:`TPM cannot exceed team TPM limit: ${e?.tpm_limit!==null&&e?.tpm_limit!==void 0?e?.tpm_limit:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.tpm_limit&&s>e.tpm_limit)throw Error(`TPM limit cannot exceed team TPM limit: ${e.tpm_limit}`)}}],children:(0,t.jsx)(el.default,{step:1,width:400})}),(0,t.jsx)(z.default,{type:"tpm",name:"tpm_limit_type",className:"mt-4",initialValue:null,form:eT,showDetailedDescriptions:!0}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Requests per minute Limit (RPM)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum number of API requests this key can make per minute. Helps prevent abuse and manage load",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"rpm_limit",help:`RPM cannot exceed team RPM limit: ${e?.rpm_limit!==null&&e?.rpm_limit!==void 0?e?.rpm_limit:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.rpm_limit&&s>e.rpm_limit)throw Error(`RPM limit cannot exceed team RPM limit: ${e.rpm_limit}`)}}],children:(0,t.jsx)(el.default,{step:1,width:400})}),(0,t.jsx)(z.default,{type:"rpm",name:"rpm_limit_type",className:"mt-4",initialValue:null,form:eT,showDetailedDescriptions:!0}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Guardrails"," ",(0,t.jsx)(T.Tooltip,{title:"Apply safety guardrails to this key to filter content or enforce policies",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"guardrails",className:"mt-4",help:ey?"Select existing guardrails or enter new ones":"Premium feature - Upgrade to set guardrails by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ey,placeholder:ey?"Select or enter guardrails":"Premium feature - Upgrade to set guardrails by key",options:eK.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Disable Global Guardrails"," ",(0,t.jsx)(T.Tooltip,{title:"When enabled, this key will bypass any guardrails configured to run on every request (global guardrails)",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"disable_global_guardrails",className:"mt-4",valuePropName:"checked",help:ey?"Bypass global guardrails for this key":"Premium feature - Upgrade to disable global guardrails by key",children:(0,t.jsx)(S.Switch,{disabled:!ey,checkedChildren:"Yes",unCheckedChildren:"No"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Policies"," ",(0,t.jsx)(T.Tooltip,{title:"Apply policies to this key to control guardrails and other settings",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"policies",className:"mt-4",help:ex?"Select existing policies or enter new ones":"Premium feature - Upgrade to set policies by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ex,placeholder:ex?"Select or enter policies":"Premium feature - Upgrade to set policies by key",options:eW.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Prompts"," ",(0,t.jsx)(T.Tooltip,{title:"Allow this key to use specific prompt templates",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/prompt_management",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"prompts",className:"mt-4",help:ex?"Select existing prompts or enter new ones":"Premium feature - Upgrade to set prompts by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ex,placeholder:ex?"Select or enter prompts":"Premium feature - Upgrade to set prompts by key",options:eQ.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Access Groups"," ",(0,t.jsx)(T.Tooltip,{title:"Assign access groups to this key. Access groups control which models, MCP servers, and agents this key can use",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"access_group_ids",className:"mt-4",help:"Select access groups to assign to this key",children:(0,t.jsx)(E.default,{placeholder:"Select access groups (optional)"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Pass Through Routes"," ",(0,t.jsx)(T.Tooltip,{title:"Allow this key to use specific pass through routes",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/pass_through",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"allowed_passthrough_routes",className:"mt-4",help:ex?"Select existing pass through routes or enter new ones":"Premium feature - Upgrade to set pass through routes by key",children:(0,t.jsx)(D.default,{onChange:e=>eT.setFieldValue("allowed_passthrough_routes",e),value:eT.getFieldValue("allowed_passthrough_routes"),accessToken:ep,placeholder:ex?"Select or enter pass through routes":"Premium feature - Upgrade to set pass through routes by key",disabled:!ex,teamId:eZ?eZ.team_id:null})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Vector Stores"," ",(0,t.jsx)(T.Tooltip,{title:"Select which vector stores this key can access. If none selected, the key will have access to all available vector stores",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_vector_store_ids",className:"mt-4",help:"Select vector stores this key can access. Leave empty for access to all vector stores",children:(0,t.jsx)(ea.default,{onChange:e=>eT.setFieldValue("allowed_vector_store_ids",e),value:eT.getFieldValue("allowed_vector_store_ids"),accessToken:ep,placeholder:"Select vector stores (optional)"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Metadata"," ",(0,t.jsx)(T.Tooltip,{title:"JSON object with additional information about this key. Used for tracking or custom logic",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"metadata",className:"mt-4",children:(0,t.jsx)(v.Input.TextArea,{rows:4,placeholder:"Enter metadata as JSON"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Tags"," ",(0,t.jsx)(T.Tooltip,{title:"Tags for tracking spend and/or doing tag-based routing. Used for analytics and filtering",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"tags",className:"mt-4",help:"Tags for tracking spend and/or doing tag-based routing.",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},placeholder:"Select or enter tags",tokenSeparators:[","],options:eS})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"MCP Settings"})}),(0,t.jsxs)(m.AccordionBody,{children:[(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed MCP Servers"," ",(0,t.jsx)(T.Tooltip,{title:"Select which MCP servers or access groups this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_mcp_servers_and_groups",help:"Select MCP servers or access groups this key can access",children:(0,t.jsx)(Y.default,{onChange:e=>eT.setFieldValue("allowed_mcp_servers_and_groups",e),value:eT.getFieldValue("allowed_mcp_servers_and_groups"),accessToken:ep,teamId:eZ?.team_id??null,placeholder:"Select MCP servers or access groups (optional)",allowNoMcpServers:!0})}),(0,t.jsx)(j.Form.Item,{name:"mcp_tool_permissions",initialValue:{},hidden:!0,children:(0,t.jsx)(v.Input,{type:"hidden"})}),(0,t.jsx)(j.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.allowed_mcp_servers_and_groups!==t.allowed_mcp_servers_and_groups||e.mcp_tool_permissions!==t.mcp_tool_permissions,children:()=>(0,t.jsx)("div",{className:"mt-6",children:(0,t.jsx)(Z.default,{accessToken:ep,selectedServers:(eT.getFieldValue("allowed_mcp_servers_and_groups")?.servers||[]).filter(e=>e!==X.NO_MCP_SERVERS_SENTINEL),toolPermissions:eT.getFieldValue("mcp_tool_permissions")||{},onChange:e=>eT.setFieldsValue({mcp_tool_permissions:e})})})})]})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Agent Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Agents"," ",(0,t.jsx)(T.Tooltip,{title:"Select which agents or access groups this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_agents_and_groups",help:"Select agents or access groups this key can access",children:(0,t.jsx)(M.default,{onChange:e=>eT.setFieldValue("allowed_agents_and_groups",e),value:eT.getFieldValue("allowed_agents_and_groups"),accessToken:ep,placeholder:"Select agents or access groups (optional)"})})})]}),ex?(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Logging Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(V.default,{value:eY,onChange:eX,premiumUser:!0,disabledCallbacks:tn,onDisabledCallbacksChange:to})})})]}):(0,t.jsx)(T.Tooltip,{title:(0,t.jsxs)("span",{children:["Key-level logging settings is an enterprise feature, get in touch -",(0,t.jsx)("a",{href:"https://www.litellm.ai/enterprise",target:"_blank",children:"https://www.litellm.ai/enterprise"})]}),placement:"top",children:(0,t.jsxs)("div",{style:{position:"relative"},children:[(0,t.jsx)("div",{style:{opacity:.5},children:(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Logging Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(V.default,{value:eY,onChange:eX,premiumUser:!1,disabledCallbacks:tn,onDisabledCallbacksChange:to})})})]})}),(0,t.jsx)("div",{style:{position:"absolute",inset:0,cursor:"not-allowed"}})]})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Router Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4 w-full",children:(0,t.jsx)(U.default,{accessToken:ep||"",value:ty||void 0,onChange:tf,modelData:eE.length>0?{data:eE.map(e=>({model_name:e}))}:void 0},tk)})})]},`router-settings-accordion-${tk}`),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Model Aliases"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsx)(y.Text,{className:"text-sm text-gray-600 mb-4",children:"Create custom aliases for models that can be used in API calls. This allows you to create shortcuts for specific models."}),(0,t.jsx)(R.default,{accessToken:ep,initialModelAliases:tu,onAliasUpdate:tm,showExampleConfig:!1})]})})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Key Lifecycle"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)($.default,{form:eT,autoRotationEnabled:tp,onAutoRotationChange:tg,rotationInterval:th,onRotationIntervalChange:tx,isCreateMode:!0})})}),(0,t.jsx)(j.Form.Item,{name:"duration",hidden:!0,initialValue:null,children:(0,t.jsx)(v.Input,{})})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)("b",{children:"Advanced Settings"}),(0,t.jsx)(T.Tooltip,{title:(0,t.jsxs)("span",{children:["Learn more about advanced settings in our"," ",(0,t.jsx)("a",{href:et.proxyBaseUrl?`${et.proxyBaseUrl}/#/key%20management/generate_key_fn_key_generate_post`:"/#/key%20management/generate_key_fn_key_generate_post",target:"_blank",rel:"noopener noreferrer",className:"text-blue-400 hover:text-blue-300",children:"documentation"})]}),children:(0,t.jsx)(d.InfoCircleOutlined,{className:"text-gray-400 hover:text-gray-300 cursor-help"})})]})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)(B.default,{schemaComponent:"GenerateKeyRequest",form:eT,excludedFields:["key_alias","team_id","organization_id","models","duration","metadata","tags","guardrails","max_budget","budget_duration","tpm_limit","rpm_limit",...ek?["key"]:[]]})})]})]})]})}),(0,t.jsx)("div",{style:{textAlign:"right",marginTop:"10px"},children:(0,t.jsx)(_.Button,{htmlType:"submit",disabled:tM,style:{opacity:tM?.5:1},children:"Create Key"})})]})}),e5&&(0,t.jsx)(w.Modal,{title:"Create New User",open:e5,onCancel:()=>e6(!1),footer:null,width:800,children:(0,t.jsx)(W.CreateUserButton,{userID:eg,accessToken:ep,teams:eo,possibleUIRoles:e8,onUserCreated:e=>{e9(e),eT.setFieldsValue({user_id:e}),e6(!1)},isEmbedded:!0})}),eL&&(0,t.jsx)(w.Modal,{open:eI,onOk:tL,onCancel:tF,footer:null,children:(0,t.jsxs)(x.Grid,{numItems:1,className:"gap-2 w-full",children:[(0,t.jsx)(b.Title,{children:"Save your Key"}),(0,t.jsx)(h.Col,{numColSpan:1,children:null!=eL?(0,t.jsx)(es.default,{apiKey:eL}):(0,t.jsx)(y.Text,{children:"Key being created, this might take 30s"})})]})})]})},"fetchTeamModels",0,ei,"fetchUserModels",0,en],702597)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/0.zblsr85hcyn.js b/litellm/proxy/_experimental/out/_next/static/chunks/0.zblsr85hcyn.js deleted file mode 100644 index db300569099..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/0.zblsr85hcyn.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,991124,e=>{"use strict";let t=(0,e.i(475254).default)("copy",[["rect",{width:"14",height:"14",x:"8",y:"8",rx:"2",ry:"2",key:"17jyea"}],["path",{d:"M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2",key:"zix9uf"}]]);e.s(["default",0,t])},269200,e=>{"use strict";var t=e.i(290571),i=e.i(271645),r=e.i(444755);let o=(0,e.i(673706).makeClassName)("Table"),a=i.default.forwardRef((e,a)=>{let{children:n,className:l}=e,s=(0,t.__rest)(e,["children","className"]);return i.default.createElement("div",{className:(0,r.tremorTwMerge)(o("root"),"overflow-auto",l)},i.default.createElement("table",Object.assign({ref:a,className:(0,r.tremorTwMerge)(o("table"),"w-full text-tremor-default","text-tremor-content","dark:text-dark-tremor-content")},s),n))});a.displayName="Table",e.s(["Table",0,a],269200)},942232,e=>{"use strict";var t=e.i(290571),i=e.i(271645),r=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableBody"),a=i.default.forwardRef((e,a)=>{let{children:n,className:l}=e,s=(0,t.__rest)(e,["children","className"]);return i.default.createElement(i.default.Fragment,null,i.default.createElement("tbody",Object.assign({ref:a,className:(0,r.tremorTwMerge)(o("root"),"align-top divide-y","divide-tremor-border","dark:divide-dark-tremor-border",l)},s),n))});a.displayName="TableBody",e.s(["TableBody",0,a],942232)},977572,e=>{"use strict";var t=e.i(290571),i=e.i(271645),r=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableCell"),a=i.default.forwardRef((e,a)=>{let{children:n,className:l}=e,s=(0,t.__rest)(e,["children","className"]);return i.default.createElement(i.default.Fragment,null,i.default.createElement("td",Object.assign({ref:a,className:(0,r.tremorTwMerge)(o("root"),"align-middle whitespace-nowrap text-left p-4",l)},s),n))});a.displayName="TableCell",e.s(["TableCell",0,a],977572)},427612,e=>{"use strict";var t=e.i(290571),i=e.i(271645),r=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableHead"),a=i.default.forwardRef((e,a)=>{let{children:n,className:l}=e,s=(0,t.__rest)(e,["children","className"]);return i.default.createElement(i.default.Fragment,null,i.default.createElement("thead",Object.assign({ref:a,className:(0,r.tremorTwMerge)(o("root"),"text-left","text-tremor-content","dark:text-dark-tremor-content",l)},s),n))});a.displayName="TableHead",e.s(["TableHead",0,a],427612)},64848,e=>{"use strict";var t=e.i(290571),i=e.i(271645),r=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableHeaderCell"),a=i.default.forwardRef((e,a)=>{let{children:n,className:l}=e,s=(0,t.__rest)(e,["children","className"]);return i.default.createElement(i.default.Fragment,null,i.default.createElement("th",Object.assign({ref:a,className:(0,r.tremorTwMerge)(o("root"),"whitespace-nowrap text-left font-semibold top-0 px-4 py-3.5","text-tremor-content-strong","dark:text-dark-tremor-content-strong",l)},s),n))});a.displayName="TableHeaderCell",e.s(["TableHeaderCell",0,a],64848)},496020,e=>{"use strict";var t=e.i(290571),i=e.i(271645),r=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableRow"),a=i.default.forwardRef((e,a)=>{let{children:n,className:l}=e,s=(0,t.__rest)(e,["children","className"]);return i.default.createElement(i.default.Fragment,null,i.default.createElement("tr",Object.assign({ref:a,className:(0,r.tremorTwMerge)(o("row"),l)},s),n))});a.displayName="TableRow",e.s(["TableRow",0,a],496020)},68155,e=>{"use strict";var t=e.i(271645);let i=t.forwardRef(function(e,i){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:i},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"}))});e.s(["TrashIcon",0,i],68155)},360820,e=>{"use strict";var t=e.i(271645);let i=t.forwardRef(function(e,i){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:i},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M5 15l7-7 7 7"}))});e.s(["ChevronUpIcon",0,i],360820)},871943,e=>{"use strict";var t=e.i(271645);let i=t.forwardRef(function(e,i){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:i},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 9l-7 7-7-7"}))});e.s(["ChevronDownIcon",0,i],871943)},389083,e=>{"use strict";var t=e.i(290571),i=e.i(271645),r=e.i(829087),o=e.i(480731),a=e.i(95779),n=e.i(444755),l=e.i(673706);let s={xs:{paddingX:"px-2",paddingY:"py-0.5",fontSize:"text-xs"},sm:{paddingX:"px-2.5",paddingY:"py-0.5",fontSize:"text-sm"},md:{paddingX:"px-3",paddingY:"py-0.5",fontSize:"text-md"},lg:{paddingX:"px-3.5",paddingY:"py-0.5",fontSize:"text-lg"},xl:{paddingX:"px-4",paddingY:"py-1",fontSize:"text-xl"}},c={xs:{height:"h-4",width:"w-4"},sm:{height:"h-4",width:"w-4"},md:{height:"h-4",width:"w-4"},lg:{height:"h-5",width:"w-5"},xl:{height:"h-6",width:"w-6"}},d=(0,l.makeClassName)("Badge"),m=i.default.forwardRef((e,m)=>{let{color:g,icon:u,size:p=o.Sizes.SM,tooltip:h,className:f,children:b}=e,v=(0,t.__rest)(e,["color","icon","size","tooltip","className","children"]),$=u||null,{tooltipProps:A,getReferenceProps:C}=(0,r.useTooltip)();return i.default.createElement("span",Object.assign({ref:(0,l.mergeRefs)([m,A.refs.setReference]),className:(0,n.tremorTwMerge)(d("root"),"w-max shrink-0 inline-flex justify-center items-center cursor-default rounded-tremor-small ring-1 ring-inset",g?(0,n.tremorTwMerge)((0,l.getColorClassNames)(g,a.colorPalette.background).bgColor,(0,l.getColorClassNames)(g,a.colorPalette.iconText).textColor,(0,l.getColorClassNames)(g,a.colorPalette.iconRing).ringColor,"bg-opacity-10 ring-opacity-20","dark:bg-opacity-5 dark:ring-opacity-60"):(0,n.tremorTwMerge)("bg-tremor-brand-faint text-tremor-brand-emphasis ring-tremor-brand/20","dark:bg-dark-tremor-brand-muted/50 dark:text-dark-tremor-brand dark:ring-dark-tremor-subtle/20"),s[p].paddingX,s[p].paddingY,s[p].fontSize,f)},C,v),i.default.createElement(r.default,Object.assign({text:h},A)),$?i.default.createElement($,{className:(0,n.tremorTwMerge)(d("icon"),"shrink-0 -ml-1 mr-1.5",c[p].height,c[p].width)}):null,i.default.createElement("span",{className:(0,n.tremorTwMerge)(d("text"),"whitespace-nowrap")},b))});m.displayName="Badge",e.s(["Badge",0,m],389083)},94629,e=>{"use strict";var t=e.i(271645);let i=t.forwardRef(function(e,i){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:i},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M7 16V4m0 0L3 8m4-4l4 4m6 0v12m0 0l4-4m-4 4l-4-4"}))});e.s(["SwitchVerticalIcon",0,i],94629)},591935,e=>{"use strict";var t=e.i(271645);let i=t.forwardRef(function(e,i){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:i},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"}))});e.s(["PencilAltIcon",0,i],591935)},728889,e=>{"use strict";var t=e.i(290571),i=e.i(271645),r=e.i(829087),o=e.i(480731),a=e.i(444755),n=e.i(673706),l=e.i(95779);let s={xs:{paddingX:"px-1.5",paddingY:"py-1.5"},sm:{paddingX:"px-1.5",paddingY:"py-1.5"},md:{paddingX:"px-2",paddingY:"py-2"},lg:{paddingX:"px-2",paddingY:"py-2"},xl:{paddingX:"px-2.5",paddingY:"py-2.5"}},c={xs:{height:"h-3",width:"w-3"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-7",width:"w-7"},xl:{height:"h-9",width:"w-9"}},d={simple:{rounded:"",border:"",ring:"",shadow:""},light:{rounded:"rounded-tremor-default",border:"",ring:"",shadow:""},shadow:{rounded:"rounded-tremor-default",border:"border",ring:"",shadow:"shadow-tremor-card dark:shadow-dark-tremor-card"},solid:{rounded:"rounded-tremor-default",border:"border-2",ring:"ring-1",shadow:""},outlined:{rounded:"rounded-tremor-default",border:"border",ring:"ring-2",shadow:""}},m=(0,n.makeClassName)("Icon"),g=i.default.forwardRef((e,g)=>{let{icon:u,variant:p="simple",tooltip:h,size:f=o.Sizes.SM,color:b,className:v}=e,$=(0,t.__rest)(e,["icon","variant","tooltip","size","color","className"]),A=((e,t)=>{switch(e){case"simple":return{textColor:t?(0,n.getColorClassNames)(t,l.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:"",borderColor:"",ringColor:""};case"light":return{textColor:t?(0,n.getColorClassNames)(t,l.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,a.tremorTwMerge)((0,n.getColorClassNames)(t,l.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand-muted dark:bg-dark-tremor-brand-muted",borderColor:"",ringColor:""};case"shadow":return{textColor:t?(0,n.getColorClassNames)(t,l.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,a.tremorTwMerge)((0,n.getColorClassNames)(t,l.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:"border-tremor-border dark:border-dark-tremor-border",ringColor:""};case"solid":return{textColor:t?(0,n.getColorClassNames)(t,l.colorPalette.text).textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:t?(0,a.tremorTwMerge)((0,n.getColorClassNames)(t,l.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand dark:bg-dark-tremor-brand",borderColor:"border-tremor-brand-inverted dark:border-dark-tremor-brand-inverted",ringColor:"ring-tremor-ring dark:ring-dark-tremor-ring"};case"outlined":return{textColor:t?(0,n.getColorClassNames)(t,l.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,a.tremorTwMerge)((0,n.getColorClassNames)(t,l.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:t?(0,n.getColorClassNames)(t,l.colorPalette.ring).borderColor:"border-tremor-brand-subtle dark:border-dark-tremor-brand-subtle",ringColor:t?(0,a.tremorTwMerge)((0,n.getColorClassNames)(t,l.colorPalette.ring).ringColor,"ring-opacity-40"):"ring-tremor-brand-muted dark:ring-dark-tremor-brand-muted"}}})(p,b),{tooltipProps:C,getReferenceProps:I}=(0,r.useTooltip)();return i.default.createElement("span",Object.assign({ref:(0,n.mergeRefs)([g,C.refs.setReference]),className:(0,a.tremorTwMerge)(m("root"),"inline-flex shrink-0 items-center justify-center",A.bgColor,A.textColor,A.borderColor,A.ringColor,d[p].rounded,d[p].border,d[p].shadow,d[p].ring,s[f].paddingX,s[f].paddingY,v)},I,$),i.default.createElement(r.default,Object.assign({text:h},C)),i.default.createElement(u,{className:(0,a.tremorTwMerge)(m("icon"),"shrink-0",c[f].height,c[f].width)}))});g.displayName="Icon",e.s(["default",0,g],728889)},752978,e=>{"use strict";var t=e.i(728889);e.s(["Icon",()=>t.default])},207670,e=>{"use strict";function t(){for(var e,t,i=0,r="",o=arguments.length;i{"use strict";var t=e.i(271645);let i=t.forwardRef(function(e,i){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:i},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"}))});e.s(["RefreshIcon",0,i],278587)},551332,e=>{"use strict";var t=e.i(271645);let i=t.forwardRef(function(e,i){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:i},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M8 5H6a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2v-1M8 5a2 2 0 002 2h2a2 2 0 002-2M8 5a2 2 0 012-2h2a2 2 0 012 2m0 0h2a2 2 0 012 2v3m2 4H10m0 0l3-3m-3 3l3 3"}))});e.s(["ClipboardCopyIcon",0,i],551332)},122577,e=>{"use strict";var t=e.i(271645);let i=t.forwardRef(function(e,i){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:i},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M14.752 11.168l-3.197-2.132A1 1 0 0010 9.87v4.263a1 1 0 001.555.832l3.197-2.132a1 1 0 000-1.664z"}),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M21 12a9 9 0 11-18 0 9 9 0 0118 0z"}))});e.s(["PlayIcon",0,i],122577)},434626,e=>{"use strict";var t=e.i(271645);let i=t.forwardRef(function(e,i){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:i},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"}))});e.s(["ExternalLinkIcon",0,i],434626)},902555,e=>{"use strict";var t=e.i(843476),i=e.i(591935),r=e.i(122577),o=e.i(278587),a=e.i(68155),n=e.i(360820),l=e.i(871943),s=e.i(434626),c=e.i(551332),d=e.i(592968),m=e.i(115504),g=e.i(752978);function u({icon:e,onClick:i,className:r,disabled:o,dataTestId:a}){return o?(0,t.jsx)(g.Icon,{icon:e,size:"sm",className:"opacity-50 cursor-not-allowed","data-testid":a}):(0,t.jsx)(g.Icon,{icon:e,size:"sm",onClick:i,className:(0,m.cx)("cursor-pointer",r),"data-testid":a})}let p={Edit:{icon:i.PencilAltIcon,className:"hover:text-blue-600"},Delete:{icon:a.TrashIcon,className:"hover:text-red-600"},Test:{icon:r.PlayIcon,className:"hover:text-blue-600"},Regenerate:{icon:o.RefreshIcon,className:"hover:text-green-600"},Up:{icon:n.ChevronUpIcon,className:"hover:text-blue-600"},Down:{icon:l.ChevronDownIcon,className:"hover:text-blue-600"},Open:{icon:s.ExternalLinkIcon,className:"hover:text-green-600"},Copy:{icon:c.ClipboardCopyIcon,className:"hover:text-blue-600"}};e.s(["default",0,function({onClick:e,tooltipText:i,disabled:r=!1,disabledTooltipText:o,dataTestId:a,variant:n}){let{icon:l,className:s}=p[n];return(0,t.jsx)(d.Tooltip,{title:r?o:i,children:(0,t.jsx)("span",{children:(0,t.jsx)(u,{icon:l,onClick:e,className:s,disabled:r,dataTestId:a})})})}],902555)},755151,e=>{"use strict";var t=e.i(247153);e.s(["DownOutlined",()=>t.default])},916925,e=>{"use strict";var t,i=e.i(555987),r=((t={}).A2A_Agent="A2A Agent",t.AI21="Ai21",t.AI21_CHAT="Ai21 Chat",t.AIML="AI/ML API",t.AIOHTTP_OPENAI="Aiohttp Openai",t.Anthropic="Anthropic",t.ANTHROPIC_TEXT="Anthropic Text",t.AssemblyAI="AssemblyAI",t.AUTO_ROUTER="Auto Router",t.Bedrock="Amazon Bedrock",t.BedrockMantle="Amazon Bedrock Mantle",t.SageMaker="AWS SageMaker",t.Azure="Azure",t.Azure_AI_Studio="Azure AI Foundry (Studio)",t.AZURE_TEXT="Azure Text",t.BASETEN="Baseten",t.BYTEZ="Bytez",t.Cerebras="Cerebras",t.CLARIFAI="Clarifai",t.CLOUDFLARE="Cloudflare",t.CODESTRAL="Codestral",t.Cohere="Cohere",t.COHERE_CHAT="Cohere Chat",t.COMETAPI="Cometapi",t.COMPACTIFAI="Compactifai",t.Cursor="Cursor",t.Dashscope="Dashscope",t.Databricks="Databricks (Qwen API)",t.DATAROBOT="Datarobot",t.DeepInfra="DeepInfra",t.Deepgram="Deepgram",t.Deepseek="Deepseek",t.DOCKER_MODEL_RUNNER="Docker Model Runner",t.DOTPROMPT="Dotprompt",t.ElevenLabs="ElevenLabs",t.EMPOWER="Empower",t.FalAI="Fal AI",t.FEATHERLESS_AI="Featherless Ai",t.FireworksAI="Fireworks AI",t.FRIENDLIAI="Friendliai",t.GALADRIEL="Galadriel",t.GITHUB_COPILOT="Github Copilot",t.Google_AI_Studio="Google AI Studio",t.GradientAI="GradientAI",t.Groq="Groq",t.HEROKU="Heroku",t.Hosted_Vllm="vllm",t.HUGGINGFACE="Huggingface",t.HYPERBOLIC="Hyperbolic",t.Infinity="Infinity",t.JinaAI="Jina AI",t.LAMBDA_AI="Lambda Ai",t.LEMONADE="Lemonade",t.LLAMAFILE="Llamafile",t.LM_STUDIO="Lm Studio",t.LLAMA="Meta Llama",t.MARITALK="Maritalk",t.MiniMax="MiniMax",t.MistralAI="Mistral AI",t.MOONSHOT="Moonshot",t.MORPH="Morph",t.NEBIUS="Nebius",t.NLP_CLOUD="Nlp Cloud",t.NOVITA="Novita",t.NSCALE="Nscale",t.NVIDIA_NIM="Nvidia Nim",t.Ollama="Ollama",t.OLLAMA_CHAT="Ollama Chat",t.OOBABOOGA="Oobabooga",t.OpenAI="OpenAI",t.OPENAI_LIKE="Openai Like",t.OpenAI_Compatible="OpenAI-Compatible Chat Completions (Together AI, vLLM, etc.)",t.OpenAI_Text="OpenAI Text Completion",t.OpenAI_Text_Compatible="OpenAI-Compatible Completions (legacy /v1/completions)",t.Openrouter="Openrouter",t.Oracle="Oracle Cloud Infrastructure (OCI)",t.OVHCLOUD="Ovhcloud",t.Perplexity="Perplexity",t.PETALS="Petals",t.PG_VECTOR="Pg Vector",t.PREDIBASE="Predibase",t.RECRAFT="Recraft",t.REPLICATE="Replicate",t.RunwayML="RunwayML",t.SAGEMAKER_LEGACY="Sagemaker",t.Sambanova="Sambanova",t.SAP="SAP Generative AI Hub",t.Snowflake="Snowflake",t.Soniox="Soniox",t.TEXT_COMPLETION_CODESTRAL="Text-Completion-Codestral",t.TogetherAI="TogetherAI",t.TOPAZ="Topaz",t.Triton="Triton",t.V0="V0",t.VERCEL_AI_GATEWAY="Vercel Ai Gateway",t.Vertex_AI="Vertex AI (Anthropic, Gemini, etc.)",t.VERTEX_AI_BETA="Vertex Ai Beta",t.VLLM="Vllm",t.VolcEngine="VolcEngine",t.Voyage="Voyage AI",t.WANDB="Wandb",t.WATSONX="Watsonx",t.WATSONX_TEXT="Watsonx Text",t.xAI="xAI",t.XINFERENCE="Xinference",t.ZAI="Z.AI (Zhipu AI)",t);let o={A2A_Agent:"a2a_agent",AI21:"ai21",AI21_CHAT:"ai21_chat",AIML:"aiml",AIOHTTP_OPENAI:"aiohttp_openai",Anthropic:"anthropic",ANTHROPIC_TEXT:"anthropic_text",AssemblyAI:"assemblyai",AUTO_ROUTER:"auto_router",Azure:"azure",Azure_AI_Studio:"azure_ai",AZURE_TEXT:"azure_text",BASETEN:"baseten",Bedrock:"bedrock",BedrockMantle:"bedrock_mantle",BYTEZ:"bytez",Cerebras:"cerebras",CLARIFAI:"clarifai",CLOUDFLARE:"cloudflare",CODESTRAL:"codestral",Cohere:"cohere",COHERE_CHAT:"cohere_chat",COMETAPI:"cometapi",COMPACTIFAI:"compactifai",Cursor:"cursor",Dashscope:"dashscope",Databricks:"databricks",DATAROBOT:"datarobot",DeepInfra:"deepinfra",Deepgram:"deepgram",Deepseek:"deepseek",DOCKER_MODEL_RUNNER:"docker_model_runner",DOTPROMPT:"dotprompt",ElevenLabs:"elevenlabs",EMPOWER:"empower",FalAI:"fal_ai",FEATHERLESS_AI:"featherless_ai",FireworksAI:"fireworks_ai",FRIENDLIAI:"friendliai",GALADRIEL:"galadriel",GITHUB_COPILOT:"github_copilot",Google_AI_Studio:"gemini",GradientAI:"gradient_ai",Groq:"groq",HEROKU:"heroku",Hosted_Vllm:"hosted_vllm",HUGGINGFACE:"huggingface",HYPERBOLIC:"hyperbolic",Infinity:"infinity",JinaAI:"jina_ai",LAMBDA_AI:"lambda_ai",LEMONADE:"lemonade",LLAMAFILE:"llamafile",LLAMA:"meta_llama",LM_STUDIO:"lm_studio",MARITALK:"maritalk",MiniMax:"minimax",MistralAI:"mistral",MOONSHOT:"moonshot",MORPH:"morph",NEBIUS:"nebius",NLP_CLOUD:"nlp_cloud",NOVITA:"novita",NSCALE:"nscale",NVIDIA_NIM:"nvidia_nim",Ollama:"ollama",OLLAMA_CHAT:"ollama_chat",OOBABOOGA:"oobabooga",OpenAI:"openai",OPENAI_LIKE:"openai_like",OpenAI_Compatible:"openai",OpenAI_Text:"text-completion-openai",OpenAI_Text_Compatible:"text-completion-openai",Openrouter:"openrouter",Oracle:"oci",OVHCLOUD:"ovhcloud",Perplexity:"perplexity",PETALS:"petals",PG_VECTOR:"pg_vector",PREDIBASE:"predibase",RECRAFT:"recraft",REPLICATE:"replicate",RunwayML:"runwayml",SAGEMAKER_LEGACY:"sagemaker",SageMaker:"sagemaker_chat",Sambanova:"sambanova",SAP:"sap",Snowflake:"snowflake",Soniox:"soniox",TEXT_COMPLETION_CODESTRAL:"text-completion-codestral",TogetherAI:"together_ai",TOPAZ:"topaz",Triton:"triton",V0:"v0",VERCEL_AI_GATEWAY:"vercel_ai_gateway",Vertex_AI:"vertex_ai",VERTEX_AI_BETA:"vertex_ai_beta",VLLM:"vllm",VolcEngine:"volcengine",Voyage:"voyage",WANDB:"wandb",WATSONX:"watsonx",WATSONX_TEXT:"watsonx_text",xAI:"xai",XINFERENCE:"xinference",ZAI:"zai"},a=new Set(["bedrock_mantle"]),n="/ui/assets/logos/",l={"A2A Agent":`${n}a2a_agent.png`,Ai21:`${n}ai21.svg`,"Ai21 Chat":`${n}ai21.svg`,"AI/ML API":`${n}aiml_api.svg`,"Aiohttp Openai":`${n}openai_small.svg`,Anthropic:`${n}anthropic.svg`,"Anthropic Text":`${n}anthropic.svg`,AssemblyAI:`${n}assemblyai_small.png`,Azure:`${n}microsoft_azure.svg`,"Azure AI Foundry (Studio)":`${n}microsoft_azure.svg`,"Azure Text":`${n}microsoft_azure.svg`,Baseten:`${n}baseten.svg`,"Amazon Bedrock":`${n}bedrock.svg`,"Amazon Bedrock Mantle":`${n}bedrock.svg`,"AWS SageMaker":`${n}bedrock.svg`,Cerebras:`${n}cerebras.svg`,Cloudflare:`${n}cloudflare.svg`,Codestral:`${n}mistral.svg`,Cohere:`${n}cohere.svg`,"Cohere Chat":`${n}cohere.svg`,Cometapi:`${n}cometapi.svg`,Cursor:`${n}cursor.svg`,"Databricks (Qwen API)":`${n}databricks.svg`,Dashscope:`${n}dashscope.svg`,Deepseek:`${n}deepseek.svg`,Deepgram:`${n}deepgram.png`,DeepInfra:`${n}deepinfra.png`,ElevenLabs:`${n}elevenlabs.png`,"Fal AI":`${n}fal_ai.jpg`,"Featherless Ai":`${n}featherless.svg`,"Fireworks AI":`${n}fireworks.svg`,Friendliai:`${n}friendli.svg`,"Github Copilot":`${n}github_copilot.svg`,"Google AI Studio":`${n}google.svg`,GradientAI:`${n}gradientai.svg`,Groq:`${n}groq.svg`,vllm:`${n}vllm.png`,Huggingface:`${n}huggingface.svg`,Hyperbolic:`${n}hyperbolic.svg`,Infinity:`${n}infinity.png`,"Jina AI":`${n}jina.png`,"Lambda Ai":`${n}lambda.svg`,"Lm Studio":`${n}lmstudio.svg`,"Meta Llama":`${n}meta_llama.svg`,MiniMax:`${n}minimax.svg`,"Mistral AI":`${n}mistral.svg`,Moonshot:`${n}moonshot.svg`,Morph:`${n}morph.svg`,Nebius:`${n}nebius.svg`,Novita:`${n}novita.svg`,"Nvidia Nim":`${n}nvidia_nim.svg`,Ollama:`${n}ollama.svg`,"Ollama Chat":`${n}ollama.svg`,Oobabooga:`${n}openai_small.svg`,OpenAI:`${n}openai_small.svg`,"Openai Like":`${n}openai_small.svg`,"OpenAI Text Completion":`${n}openai_small.svg`,"OpenAI-Compatible Completions (legacy /v1/completions)":`${n}openai_small.svg`,"OpenAI-Compatible Chat Completions (Together AI, vLLM, etc.)":`${n}openai_small.svg`,Openrouter:`${n}openrouter.svg`,"Oracle Cloud Infrastructure (OCI)":`${n}oracle.svg`,Perplexity:`${n}perplexity-ai.svg`,Recraft:`${n}recraft.svg`,Replicate:`${n}replicate.svg`,RunwayML:`${n}runwayml.png`,Sagemaker:`${n}bedrock.svg`,Sambanova:`${n}sambanova.svg`,"SAP Generative AI Hub":`${n}sap.png`,Snowflake:`${n}snowflake.svg`,Soniox:`${n}soniox.svg`,"Text-Completion-Codestral":`${n}mistral.svg`,TogetherAI:`${n}togetherai.svg`,Topaz:`${n}topaz.svg`,Triton:`${n}nvidia_triton.png`,V0:`${n}v0.svg`,"Vercel Ai Gateway":`${n}vercel.svg`,"Vertex AI (Anthropic, Gemini, etc.)":`${n}google.svg`,"Vertex Ai Beta":`${n}google.svg`,Vllm:`${n}vllm.png`,VolcEngine:`${n}volcengine.png`,"Voyage AI":`${n}voyage.webp`,Watsonx:`${n}watsonx.svg`,"Watsonx Text":`${n}watsonx.svg`,xAI:`${n}xai.svg`,Xinference:`${n}xinference.svg`};e.s(["Providers",()=>r,"getPlaceholder",0,e=>{if("AI/ML API"===e)return"aiml/flux-pro/v1.1";if("Vertex AI (Anthropic, Gemini, etc.)"===e)return"gemini-pro";if("Anthropic"==e)return"claude-3-opus";if("Amazon Bedrock"==e)return"claude-3-opus";if("AWS SageMaker"==e)return"sagemaker/jumpstart-dft-meta-textgeneration-llama-2-7b";else if("Google AI Studio"==e)return"gemini-pro";else if("Azure AI Foundry (Studio)"==e)return"azure_ai/command-r-plus";else if("Azure"==e)return"my-deployment";else if("Oracle Cloud Infrastructure (OCI)"==e)return"oci/xai.grok-4";else if("Snowflake"==e)return"snowflake/mistral-7b";else if("Voyage AI"==e)return"voyage/";else if("Jina AI"==e)return"jina_ai/";else if("VolcEngine"==e)return"volcengine/";else if("DeepInfra"==e)return"deepinfra/";else if("Fal AI"==e)return"fal_ai/fal-ai/flux-pro/v1.1-ultra";else if("RunwayML"==e)return"runwayml/gen4_turbo";else if("Watsonx"===e)return"watsonx/ibm/granite-3-3-8b-instruct";else if("Cursor"===e)return"cursor/claude-4-sonnet";else if("Z.AI (Zhipu AI)"===e)return"zai/glm-4.5";else return"gpt-3.5-turbo"},"getProviderLogoAndName",0,e=>{if(!e)return{logo:"",displayName:"-"};if("gemini"===e.toLowerCase()){let e="Google AI Studio";return{logo:(0,i.resolveLogoSrc)(l[e])??"",displayName:e}}let t=Object.keys(o).find(t=>o[t].toLowerCase()===e.toLowerCase())??Object.keys(o).find(t=>t.toLowerCase()===e.toLowerCase());if(!t)return{logo:"",displayName:e};let a=r[t];return{logo:(0,i.resolveLogoSrc)(l[a])??"",displayName:a}},"getProviderModels",0,(e,t)=>{let i=o[e],r=[];return e&&"object"==typeof t&&(Object.entries(t).forEach(([e,t])=>{if(null!==t&&"object"==typeof t&&"litellm_provider"in t){let o=t.litellm_provider,n="string"==typeof o&&(o.startsWith(`${i}_`)||o.startsWith(`${i}-`));(o===i||n&&!a.has(o))&&r.push(e)}}),"Cohere"==e&&Object.entries(t).forEach(([e,t])=>{null!==t&&"object"==typeof t&&"litellm_provider"in t&&"cohere_chat"===t.litellm_provider&&r.push(e)}),"AWS SageMaker"==e&&Object.entries(t).forEach(([e,t])=>{null!==t&&"object"==typeof t&&"litellm_provider"in t&&"sagemaker_chat"===t.litellm_provider&&r.push(e)})),r},"providerLogoMap",0,l,"provider_map",0,o])},928685,e=>{"use strict";var t=e.i(38953);e.s(["SearchOutlined",()=>t.default])},596239,e=>{"use strict";e.i(247167);var t=e.i(931067),i=e.i(271645);let r={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M574 665.4a8.03 8.03 0 00-11.3 0L446.5 781.6c-53.8 53.8-144.6 59.5-204 0-59.5-59.5-53.8-150.2 0-204l116.2-116.2c3.1-3.1 3.1-8.2 0-11.3l-39.8-39.8a8.03 8.03 0 00-11.3 0L191.4 526.5c-84.6 84.6-84.6 221.5 0 306s221.5 84.6 306 0l116.2-116.2c3.1-3.1 3.1-8.2 0-11.3L574 665.4zm258.6-474c-84.6-84.6-221.5-84.6-306 0L410.3 307.6a8.03 8.03 0 000 11.3l39.7 39.7c3.1 3.1 8.2 3.1 11.3 0l116.2-116.2c53.8-53.8 144.6-59.5 204 0 59.5 59.5 53.8 150.2 0 204L665.3 562.6a8.03 8.03 0 000 11.3l39.8 39.8c3.1 3.1 8.2 3.1 11.3 0l116.2-116.2c84.5-84.6 84.5-221.5 0-306.1zM610.1 372.3a8.03 8.03 0 00-11.3 0L372.3 598.7a8.03 8.03 0 000 11.3l39.6 39.6c3.1 3.1 8.2 3.1 11.3 0l226.4-226.4c3.1-3.1 3.1-8.2 0-11.3l-39.5-39.6z"}}]},name:"link",theme:"outlined"};var o=e.i(9583),a=i.forwardRef(function(e,a){return i.createElement(o.default,(0,t.default)({},e,{ref:a,icon:r}))});e.s(["LinkOutlined",0,a],596239)},280898,e=>{"use strict";e.i(247167);var t=e.i(271645),i=e.i(121229),r=e.i(864517),o=e.i(343794),a=e.i(931067),n=e.i(209428),l=e.i(211577),s=e.i(703923),c=e.i(404948),d=["className","prefixCls","style","active","status","iconPrefix","icon","wrapperStyle","stepNumber","disabled","description","title","subTitle","progressDot","stepIcon","tailContent","icons","stepIndex","onStepClick","onClick","render"];function m(e){return"string"==typeof e}let g=function(e){var i,r,g,u,p,h=e.className,f=e.prefixCls,b=e.style,v=e.active,$=e.status,A=e.iconPrefix,C=e.icon,I=(e.wrapperStyle,e.stepNumber),w=e.disabled,x=e.description,k=e.title,S=e.subTitle,E=e.progressDot,T=e.stepIcon,O=e.tailContent,y=e.icons,N=e.stepIndex,L=e.onStepClick,_=e.onClick,M=e.render,R=(0,s.default)(e,d),P={};L&&!w&&(P.role="button",P.tabIndex=0,P.onClick=function(e){null==_||_(e),L(N)},P.onKeyDown=function(e){var t=e.which;(t===c.default.ENTER||t===c.default.SPACE)&&L(N)});var z=$||"wait",H=(0,o.default)("".concat(f,"-item"),"".concat(f,"-item-").concat(z),h,(p={},(0,l.default)(p,"".concat(f,"-item-custom"),C),(0,l.default)(p,"".concat(f,"-item-active"),v),(0,l.default)(p,"".concat(f,"-item-disabled"),!0===w),p)),j=(0,n.default)({},b),D=t.createElement("div",(0,a.default)({},R,{className:H,style:j}),t.createElement("div",(0,a.default)({onClick:_},P,{className:"".concat(f,"-item-container")}),t.createElement("div",{className:"".concat(f,"-item-tail")},O),t.createElement("div",{className:"".concat(f,"-item-icon")},(g=(0,o.default)("".concat(f,"-icon"),"".concat(A,"icon"),(i={},(0,l.default)(i,"".concat(A,"icon-").concat(C),C&&m(C)),(0,l.default)(i,"".concat(A,"icon-check"),!C&&"finish"===$&&(y&&!y.finish||!y)),(0,l.default)(i,"".concat(A,"icon-cross"),!C&&"error"===$&&(y&&!y.error||!y)),i)),u=t.createElement("span",{className:"".concat(f,"-icon-dot")}),r=E?"function"==typeof E?t.createElement("span",{className:"".concat(f,"-icon")},E(u,{index:I-1,status:$,title:k,description:x})):t.createElement("span",{className:"".concat(f,"-icon")},u):C&&!m(C)?t.createElement("span",{className:"".concat(f,"-icon")},C):y&&y.finish&&"finish"===$?t.createElement("span",{className:"".concat(f,"-icon")},y.finish):y&&y.error&&"error"===$?t.createElement("span",{className:"".concat(f,"-icon")},y.error):C||"finish"===$||"error"===$?t.createElement("span",{className:g}):t.createElement("span",{className:"".concat(f,"-icon")},I),T&&(r=T({index:I-1,status:$,title:k,description:x,node:r})),r)),t.createElement("div",{className:"".concat(f,"-item-content")},t.createElement("div",{className:"".concat(f,"-item-title")},k,S&&t.createElement("div",{title:"string"==typeof S?S:void 0,className:"".concat(f,"-item-subtitle")},S)),x&&t.createElement("div",{className:"".concat(f,"-item-description")},x))));return M&&(D=M(D)||null),D};var u=["prefixCls","style","className","children","direction","type","labelPlacement","iconPrefix","status","size","current","progressDot","stepIcon","initial","icons","onChange","itemRender","items"];function p(e){var i,r=e.prefixCls,c=void 0===r?"rc-steps":r,d=e.style,m=void 0===d?{}:d,p=e.className,h=(e.children,e.direction),f=e.type,b=void 0===f?"default":f,v=e.labelPlacement,$=e.iconPrefix,A=void 0===$?"rc":$,C=e.status,I=void 0===C?"process":C,w=e.size,x=e.current,k=void 0===x?0:x,S=e.progressDot,E=e.stepIcon,T=e.initial,O=void 0===T?0:T,y=e.icons,N=e.onChange,L=e.itemRender,_=e.items,M=(0,s.default)(e,u),R="inline"===b,P=R||void 0!==S&&S,z=R||void 0===h?"horizontal":h,H=R?void 0:w,j=(0,o.default)(c,"".concat(c,"-").concat(z),p,(i={},(0,l.default)(i,"".concat(c,"-").concat(H),H),(0,l.default)(i,"".concat(c,"-label-").concat(P?"vertical":void 0===v?"horizontal":v),"horizontal"===z),(0,l.default)(i,"".concat(c,"-dot"),!!P),(0,l.default)(i,"".concat(c,"-navigation"),"navigation"===b),(0,l.default)(i,"".concat(c,"-inline"),R),i)),D=function(e){N&&k!==e&&N(e)};return t.default.createElement("div",(0,a.default)({className:j,style:m},M),(void 0===_?[]:_).filter(function(e){return e}).map(function(e,i){var r=(0,n.default)({},e),o=O+i;return"error"===I&&i===k-1&&(r.className="".concat(c,"-next-error")),r.status||(o===k?r.status=I:o{let i=`${t.componentCls}-item`,r=`${e}IconColor`,o=`${e}TitleColor`,a=`${e}DescriptionColor`,n=`${e}TailColor`,l=`${e}IconBgColor`,s=`${e}IconBorderColor`,c=`${e}DotColor`;return{[`${i}-${e} ${i}-icon`]:{backgroundColor:t[l],borderColor:t[s],[`> ${t.componentCls}-icon`]:{color:t[r],[`${t.componentCls}-icon-dot`]:{background:t[c]}}},[`${i}-${e}${i}-custom ${i}-icon`]:{[`> ${t.componentCls}-icon`]:{color:t[c]}},[`${i}-${e} > ${i}-container > ${i}-content > ${i}-title`]:{color:t[o],"&::after":{backgroundColor:t[n]}},[`${i}-${e} > ${i}-container > ${i}-content > ${i}-description`]:{color:t[a]},[`${i}-${e} > ${i}-container > ${i}-tail::after`]:{backgroundColor:t[n]}}},k=(0,I.genStyleHooks)("Steps",e=>{let{colorTextDisabled:t,controlHeightLG:i,colorTextLightSolid:r,colorText:o,colorPrimary:a,colorTextDescription:n,colorTextQuaternary:l,colorError:s,colorBorderSecondary:c,colorSplit:d}=e;return(e=>{let{componentCls:t}=e;return{[t]:Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},(0,C.resetComponent)(e)),{display:"flex",width:"100%",fontSize:0,textAlign:"initial"}),(e=>{let{componentCls:t,motionDurationSlow:i}=e,r=`${t}-item`,o=`${r}-icon`;return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({[r]:{position:"relative",display:"inline-block",flex:1,overflow:"hidden",verticalAlign:"top","&:last-child":{flex:"none",[`> ${r}-container > ${r}-tail, > ${r}-container > ${r}-content > ${r}-title::after`]:{display:"none"}}},[`${r}-container`]:{outline:"none",[`&:focus-visible ${o}`]:(0,C.genFocusOutline)(e)},[`${o}, ${r}-content`]:{display:"inline-block",verticalAlign:"top"},[o]:{width:e.iconSize,height:e.iconSize,marginTop:0,marginBottom:0,marginInlineStart:0,marginInlineEnd:e.marginXS,fontSize:e.iconFontSize,fontFamily:e.fontFamily,lineHeight:(0,A.unit)(e.iconSize),textAlign:"center",borderRadius:e.iconSize,border:`${(0,A.unit)(e.lineWidth)} ${e.lineType} transparent`,transition:`background-color ${i}, border-color ${i}`,[`${t}-icon`]:{position:"relative",top:e.iconTop,color:e.colorPrimary,lineHeight:1}},[`${r}-tail`]:{position:"absolute",top:e.calc(e.iconSize).div(2).equal(),insetInlineStart:0,width:"100%","&::after":{display:"inline-block",width:"100%",height:e.lineWidth,background:e.colorSplit,borderRadius:e.lineWidth,transition:`background ${i}`,content:'""'}},[`${r}-title`]:{position:"relative",display:"inline-block",paddingInlineEnd:e.padding,color:e.colorText,fontSize:e.fontSizeLG,lineHeight:(0,A.unit)(e.titleLineHeight),"&::after":{position:"absolute",top:e.calc(e.titleLineHeight).div(2).equal(),insetInlineStart:"100%",display:"block",width:9999,height:e.lineWidth,background:e.processTailColor,content:'""'}},[`${r}-subtitle`]:{display:"inline",marginInlineStart:e.marginXS,color:e.colorTextDescription,fontWeight:"normal",fontSize:e.fontSize},[`${r}-description`]:{color:e.colorTextDescription,fontSize:e.fontSize}},x("wait",e)),x("process",e)),{[`${r}-process > ${r}-container > ${r}-title`]:{fontWeight:e.fontWeightStrong}}),x("finish",e)),x("error",e)),{[`${r}${t}-next-error > ${t}-item-title::after`]:{background:e.colorError},[`${r}-disabled`]:{cursor:"not-allowed"}})})(e)),(e=>{let{componentCls:t,motionDurationSlow:i}=e;return{[`& ${t}-item`]:{[`&:not(${t}-item-active)`]:{[`& > ${t}-item-container[role='button']`]:{cursor:"pointer",[`${t}-item`]:{[`&-title, &-subtitle, &-description, &-icon ${t}-icon`]:{transition:`color ${i}`}},"&:hover":{[`${t}-item`]:{"&-title, &-subtitle, &-description":{color:e.colorPrimary}}}},[`&:not(${t}-item-process)`]:{[`& > ${t}-item-container[role='button']:hover`]:{[`${t}-item`]:{"&-icon":{borderColor:e.colorPrimary,[`${t}-icon`]:{color:e.colorPrimary}}}}}}},[`&${t}-horizontal:not(${t}-label-vertical)`]:{[`${t}-item`]:{paddingInlineStart:e.padding,whiteSpace:"nowrap","&:first-child":{paddingInlineStart:0},[`&:last-child ${t}-item-title`]:{paddingInlineEnd:0},"&-tail":{display:"none"},"&-description":{maxWidth:e.descriptionMaxWidth,whiteSpace:"normal"}}}}})(e)),(e=>{let{componentCls:t,customIconTop:i,customIconSize:r,customIconFontSize:o}=e;return{[`${t}-item-custom`]:{[`> ${t}-item-container > ${t}-item-icon`]:{height:"auto",background:"none",border:0,[`> ${t}-icon`]:{top:i,width:r,height:r,fontSize:o,lineHeight:(0,A.unit)(r)}}},[`&:not(${t}-vertical)`]:{[`${t}-item-custom`]:{[`${t}-item-icon`]:{width:"auto",background:"none"}}}}})(e)),(e=>{let{componentCls:t,iconSizeSM:i,fontSizeSM:r,fontSize:o,colorTextDescription:a}=e;return{[`&${t}-small`]:{[`&${t}-horizontal:not(${t}-label-vertical) ${t}-item`]:{paddingInlineStart:e.paddingSM,"&:first-child":{paddingInlineStart:0}},[`${t}-item-icon`]:{width:i,height:i,marginTop:0,marginBottom:0,marginInline:`0 ${(0,A.unit)(e.marginXS)}`,fontSize:r,lineHeight:(0,A.unit)(i),textAlign:"center",borderRadius:i},[`${t}-item-title`]:{paddingInlineEnd:e.paddingSM,fontSize:o,lineHeight:(0,A.unit)(i),"&::after":{top:e.calc(i).div(2).equal()}},[`${t}-item-description`]:{color:a,fontSize:o},[`${t}-item-tail`]:{top:e.calc(i).div(2).sub(e.paddingXXS).equal()},[`${t}-item-custom ${t}-item-icon`]:{width:"inherit",height:"inherit",lineHeight:"inherit",background:"none",border:0,borderRadius:0,[`> ${t}-icon`]:{fontSize:i,lineHeight:(0,A.unit)(i),transform:"none"}}}}})(e)),(e=>{let{componentCls:t,iconSizeSM:i,iconSize:r}=e;return{[`&${t}-vertical`]:{display:"flex",flexDirection:"column",[`> ${t}-item`]:{display:"block",flex:"1 0 auto",paddingInlineStart:0,overflow:"visible",[`${t}-item-icon`]:{float:"left",marginInlineEnd:e.margin},[`${t}-item-content`]:{display:"block",minHeight:e.calc(e.controlHeight).mul(1.5).equal(),overflow:"hidden"},[`${t}-item-title`]:{lineHeight:(0,A.unit)(r)},[`${t}-item-description`]:{paddingBottom:e.paddingSM}},[`> ${t}-item > ${t}-item-container > ${t}-item-tail`]:{position:"absolute",top:0,insetInlineStart:e.calc(r).div(2).sub(e.lineWidth).equal(),width:e.lineWidth,height:"100%",padding:`${(0,A.unit)(e.calc(e.marginXXS).mul(1.5).add(r).equal())} 0 ${(0,A.unit)(e.calc(e.marginXXS).mul(1.5).equal())}`,"&::after":{width:e.lineWidth,height:"100%"}},[`> ${t}-item:not(:last-child) > ${t}-item-container > ${t}-item-tail`]:{display:"block"},[` > ${t}-item > ${t}-item-container > ${t}-item-content > ${t}-item-title`]:{"&::after":{display:"none"}},[`&${t}-small ${t}-item-container`]:{[`${t}-item-tail`]:{position:"absolute",top:0,insetInlineStart:e.calc(i).div(2).sub(e.lineWidth).equal(),padding:`${(0,A.unit)(e.calc(e.marginXXS).mul(1.5).add(i).equal())} 0 ${(0,A.unit)(e.calc(e.marginXXS).mul(1.5).equal())}`},[`${t}-item-title`]:{lineHeight:(0,A.unit)(i)}}}}})(e)),(e=>{let{componentCls:t}=e,i=`${t}-item`;return{[`${t}-horizontal`]:{[`${i}-tail`]:{transform:"translateY(-50%)"}}}})(e)),(e=>{let{componentCls:t,iconSize:i,lineHeight:r,iconSizeSM:o}=e;return{[`&${t}-label-vertical`]:{[`${t}-item`]:{overflow:"visible","&-tail":{marginInlineStart:e.calc(i).div(2).add(e.controlHeightLG).equal(),padding:`0 ${(0,A.unit)(e.paddingLG)}`},"&-content":{display:"block",width:e.calc(i).div(2).add(e.controlHeightLG).mul(2).equal(),marginTop:e.marginSM,textAlign:"center"},"&-icon":{display:"inline-block",marginInlineStart:e.controlHeightLG},"&-title":{paddingInlineEnd:0,paddingInlineStart:0,"&::after":{display:"none"}},"&-subtitle":{display:"block",marginBottom:e.marginXXS,marginInlineStart:0,lineHeight:r}},[`&${t}-small:not(${t}-dot)`]:{[`${t}-item`]:{"&-icon":{marginInlineStart:e.calc(i).sub(o).div(2).add(e.controlHeightLG).equal()}}}}}})(e)),(e=>{let{componentCls:t,descriptionMaxWidth:i,lineHeight:r,dotCurrentSize:o,dotSize:a,motionDurationSlow:n}=e;return{[`&${t}-dot, &${t}-dot${t}-small`]:{[`${t}-item`]:{"&-title":{lineHeight:r},"&-tail":{top:e.calc(e.dotSize).sub(e.calc(e.lineWidth).mul(3).equal()).div(2).equal(),width:"100%",marginTop:0,marginBottom:0,marginInline:`${(0,A.unit)(e.calc(i).div(2).equal())} 0`,padding:0,"&::after":{width:`calc(100% - ${(0,A.unit)(e.calc(e.marginSM).mul(2).equal())})`,height:e.calc(e.lineWidth).mul(3).equal(),marginInlineStart:e.marginSM}},"&-icon":{width:a,height:a,marginInlineStart:e.calc(e.descriptionMaxWidth).sub(a).div(2).equal(),paddingInlineEnd:0,lineHeight:(0,A.unit)(a),background:"transparent",border:0,[`${t}-icon-dot`]:{position:"relative",float:"left",width:"100%",height:"100%",borderRadius:100,transition:`all ${n}`,"&::after":{position:"absolute",top:e.calc(e.marginSM).mul(-1).equal(),insetInlineStart:e.calc(a).sub(e.calc(e.controlHeightLG).mul(1.5).equal()).div(2).equal(),width:e.calc(e.controlHeightLG).mul(1.5).equal(),height:e.controlHeight,background:"transparent",content:'""'}}},"&-content":{width:i},[`&-process ${t}-item-icon`]:{position:"relative",top:e.calc(a).sub(o).div(2).equal(),width:o,height:o,lineHeight:(0,A.unit)(o),background:"none",marginInlineStart:e.calc(e.descriptionMaxWidth).sub(o).div(2).equal()},[`&-process ${t}-icon`]:{[`&:first-child ${t}-icon-dot`]:{insetInlineStart:0}}}},[`&${t}-vertical${t}-dot`]:{[`${t}-item-icon`]:{marginTop:e.calc(e.controlHeight).sub(a).div(2).equal(),marginInlineStart:0,background:"none"},[`${t}-item-process ${t}-item-icon`]:{marginTop:e.calc(e.controlHeight).sub(o).div(2).equal(),top:0,insetInlineStart:e.calc(a).sub(o).div(2).equal(),marginInlineStart:0},[`${t}-item > ${t}-item-container > ${t}-item-tail`]:{top:e.calc(e.controlHeight).sub(a).div(2).equal(),insetInlineStart:0,margin:0,padding:`${(0,A.unit)(e.calc(a).add(e.paddingXS).equal())} 0 ${(0,A.unit)(e.paddingXS)}`,"&::after":{marginInlineStart:e.calc(a).sub(e.lineWidth).div(2).equal()}},[`&${t}-small`]:{[`${t}-item-icon`]:{marginTop:e.calc(e.controlHeightSM).sub(a).div(2).equal()},[`${t}-item-process ${t}-item-icon`]:{marginTop:e.calc(e.controlHeightSM).sub(o).div(2).equal()},[`${t}-item > ${t}-item-container > ${t}-item-tail`]:{top:e.calc(e.controlHeightSM).sub(a).div(2).equal()}},[`${t}-item:first-child ${t}-icon-dot`]:{insetInlineStart:0},[`${t}-item-content`]:{width:"inherit"}}}})(e)),(e=>{let{componentCls:t,navContentMaxWidth:i,navArrowColor:r,stepsNavActiveColor:o,motionDurationSlow:a}=e;return{[`&${t}-navigation`]:{paddingTop:e.paddingSM,[`&${t}-small`]:{[`${t}-item`]:{"&-container":{marginInlineStart:e.calc(e.marginSM).mul(-1).equal()}}},[`${t}-item`]:{overflow:"visible",textAlign:"center","&-container":{display:"inline-block",height:"100%",marginInlineStart:e.calc(e.margin).mul(-1).equal(),paddingBottom:e.paddingSM,textAlign:"start",transition:`opacity ${a}`,[`${t}-item-content`]:{maxWidth:i},[`${t}-item-title`]:Object.assign(Object.assign({maxWidth:"100%",paddingInlineEnd:0},C.textEllipsis),{"&::after":{display:"none"}})},[`&:not(${t}-item-active)`]:{[`${t}-item-container[role='button']`]:{cursor:"pointer","&:hover":{opacity:.85}}},"&:last-child":{flex:1,"&::after":{display:"none"}},"&::after":{position:"absolute",top:`calc(50% - ${(0,A.unit)(e.calc(e.paddingSM).div(2).equal())})`,insetInlineStart:"100%",display:"inline-block",width:e.fontSizeIcon,height:e.fontSizeIcon,borderTop:`${(0,A.unit)(e.lineWidth)} ${e.lineType} ${r}`,borderBottom:"none",borderInlineStart:"none",borderInlineEnd:`${(0,A.unit)(e.lineWidth)} ${e.lineType} ${r}`,transform:"translateY(-50%) translateX(-50%) rotate(45deg)",content:'""'},"&::before":{position:"absolute",bottom:0,insetInlineStart:"50%",display:"inline-block",width:0,height:e.lineWidthBold,backgroundColor:o,transition:`width ${a}, inset-inline-start ${a}`,transitionTimingFunction:"ease-out",content:'""'}},[`${t}-item${t}-item-active::before`]:{insetInlineStart:0,width:"100%"}},[`&${t}-navigation${t}-vertical`]:{[`> ${t}-item`]:{marginInlineEnd:0,"&::before":{display:"none"},[`&${t}-item-active::before`]:{top:0,insetInlineEnd:0,insetInlineStart:"unset",display:"block",width:e.calc(e.lineWidth).mul(3).equal(),height:`calc(100% - ${(0,A.unit)(e.marginLG)})`},"&::after":{position:"relative",insetInlineStart:"50%",display:"block",width:e.calc(e.controlHeight).mul(.25).equal(),height:e.calc(e.controlHeight).mul(.25).equal(),marginBottom:e.marginXS,textAlign:"center",transform:"translateY(-50%) translateX(-50%) rotate(135deg)"},"&:last-child":{"&::after":{display:"none"}},[`> ${t}-item-container > ${t}-item-tail`]:{visibility:"hidden"}}},[`&${t}-navigation${t}-horizontal`]:{[`> ${t}-item > ${t}-item-container > ${t}-item-tail`]:{visibility:"hidden"}}}})(e)),(e=>{let{componentCls:t}=e;return{[`&${t}-rtl`]:{direction:"rtl",[`${t}-item`]:{"&-subtitle":{float:"left"}},[`&${t}-navigation`]:{[`${t}-item::after`]:{transform:"rotate(-45deg)"}},[`&${t}-vertical`]:{[`> ${t}-item`]:{"&::after":{transform:"rotate(225deg)"},[`${t}-item-icon`]:{float:"right"}}},[`&${t}-dot`]:{[`${t}-item-icon ${t}-icon-dot, &${t}-small ${t}-item-icon ${t}-icon-dot`]:{float:"right"}}}}})(e)),(e=>{let{antCls:t,componentCls:i,iconSize:r,iconSizeSM:o,processIconColor:a,marginXXS:n,lineWidthBold:l,lineWidth:s,paddingXXS:c}=e,d=e.calc(r).add(e.calc(l).mul(4).equal()).equal(),m=e.calc(o).add(e.calc(e.lineWidth).mul(4).equal()).equal();return{[`&${i}-with-progress`]:{[`${i}-item`]:{paddingTop:c,[`&-process ${i}-item-container ${i}-item-icon ${i}-icon`]:{color:a}},[`&${i}-vertical > ${i}-item `]:{paddingInlineStart:c,[`> ${i}-item-container > ${i}-item-tail`]:{top:n,insetInlineStart:e.calc(r).div(2).sub(s).add(c).equal()}},[`&, &${i}-small`]:{[`&${i}-horizontal ${i}-item:first-child`]:{paddingBottom:c,paddingInlineStart:c}},[`&${i}-small${i}-vertical > ${i}-item > ${i}-item-container > ${i}-item-tail`]:{insetInlineStart:e.calc(o).div(2).sub(s).add(c).equal()},[`&${i}-label-vertical ${i}-item ${i}-item-tail`]:{top:e.calc(r).div(2).add(c).equal()},[`${i}-item-icon`]:{position:"relative",[`${t}-progress`]:{position:"absolute",insetInlineStart:"50%",top:"50%",transform:"translate(-50%, -50%)","&-inner":{width:`${(0,A.unit)(d)} !important`,height:`${(0,A.unit)(d)} !important`}}},[`&${i}-small`]:{[`&${i}-label-vertical ${i}-item ${i}-item-tail`]:{top:e.calc(o).div(2).add(c).equal()},[`${i}-item-icon ${t}-progress-inner`]:{width:`${(0,A.unit)(m)} !important`,height:`${(0,A.unit)(m)} !important`}}}}})(e)),(e=>{let{componentCls:t,inlineDotSize:i,inlineTitleColor:r,inlineTailColor:o}=e,a=e.calc(e.paddingXS).add(e.lineWidth).equal(),n={[`${t}-item-container ${t}-item-content ${t}-item-title`]:{color:r}};return{[`&${t}-inline`]:{width:"auto",display:"inline-flex",[`${t}-item`]:{flex:"none","&-container":{padding:`${(0,A.unit)(a)} ${(0,A.unit)(e.paddingXXS)} 0`,margin:`0 ${(0,A.unit)(e.calc(e.marginXXS).div(2).equal())}`,borderRadius:e.borderRadiusSM,cursor:"pointer",transition:`background-color ${e.motionDurationMid}`,"&:hover":{background:e.controlItemBgHover},"&[role='button']:hover":{opacity:1}},"&-icon":{width:i,height:i,marginInlineStart:`calc(50% - ${(0,A.unit)(e.calc(i).div(2).equal())})`,[`> ${t}-icon`]:{top:0},[`${t}-icon-dot`]:{borderRadius:e.calc(e.fontSizeSM).div(4).equal(),"&::after":{display:"none"}}},"&-content":{width:"auto",marginTop:e.calc(e.marginXS).sub(e.lineWidth).equal()},"&-title":{color:r,fontSize:e.fontSizeSM,lineHeight:e.lineHeightSM,fontWeight:"normal",marginBottom:e.calc(e.marginXXS).div(2).equal()},"&-description":{display:"none"},"&-tail":{marginInlineStart:0,top:e.calc(i).div(2).add(a).equal(),transform:"translateY(-50%)","&:after":{width:"100%",height:e.lineWidth,borderRadius:0,marginInlineStart:0,background:o}},[`&:first-child ${t}-item-tail`]:{width:"50%",marginInlineStart:"50%"},[`&:last-child ${t}-item-tail`]:{display:"block",width:"50%"},"&-wait":Object.assign({[`${t}-item-icon ${t}-icon ${t}-icon-dot`]:{backgroundColor:e.colorBorderBg,border:`${(0,A.unit)(e.lineWidth)} ${e.lineType} ${o}`}},n),"&-finish":Object.assign({[`${t}-item-tail::after`]:{backgroundColor:o},[`${t}-item-icon ${t}-icon ${t}-icon-dot`]:{backgroundColor:o,border:`${(0,A.unit)(e.lineWidth)} ${e.lineType} ${o}`}},n),"&-error":n,"&-active, &-process":Object.assign({[`${t}-item-icon`]:{width:i,height:i,marginInlineStart:`calc(50% - ${(0,A.unit)(e.calc(i).div(2).equal())})`,top:0}},n),[`&:not(${t}-item-active) > ${t}-item-container[role='button']:hover`]:{[`${t}-item-title`]:{color:r}}}}}})(e))}})((0,w.mergeToken)(e,{processIconColor:r,processTitleColor:o,processDescriptionColor:o,processIconBgColor:a,processIconBorderColor:a,processDotColor:a,processTailColor:d,waitTitleColor:n,waitDescriptionColor:n,waitTailColor:d,waitDotColor:t,finishIconColor:a,finishTitleColor:o,finishDescriptionColor:n,finishTailColor:a,finishDotColor:a,errorIconColor:r,errorTitleColor:s,errorDescriptionColor:s,errorTailColor:d,errorIconBgColor:s,errorIconBorderColor:s,errorDotColor:s,stepsNavActiveColor:a,stepsProgressSize:i,inlineDotSize:6,inlineTitleColor:l,inlineTailColor:c}))},e=>({titleLineHeight:e.controlHeight,customIconSize:e.controlHeight,customIconTop:0,customIconFontSize:e.controlHeightSM,iconSize:e.controlHeight,iconTop:-.5,iconFontSize:e.fontSize,iconSizeSM:e.fontSizeHeading3,dotSize:e.controlHeight/4,dotCurrentSize:e.controlHeightLG/4,navArrowColor:e.colorTextDisabled,navContentMaxWidth:"unset",descriptionMaxWidth:140,waitIconColor:e.wireframe?e.colorTextDisabled:e.colorTextLabel,waitIconBgColor:e.wireframe?e.colorBgContainer:e.colorFillContent,waitIconBorderColor:e.wireframe?e.colorTextDisabled:"transparent",finishIconBgColor:e.wireframe?e.colorBgContainer:e.controlItemBgActive,finishIconBorderColor:e.wireframe?e.colorPrimary:e.controlItemBgActive}));var S=e.i(876556),E=function(e,t){var i={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&0>t.indexOf(r)&&(i[r]=e[r]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var o=0,r=Object.getOwnPropertySymbols(e);ot.indexOf(r[o])&&Object.prototype.propertyIsEnumerable.call(e,r[o])&&(i[r[o]]=e[r[o]]);return i};let T=e=>{var a,n;let{percent:l,size:s,className:c,rootClassName:d,direction:m,items:g,responsive:u=!0,current:A=0,children:C,style:I}=e,w=E(e,["percent","size","className","rootClassName","direction","items","responsive","current","children","style"]),{xs:x}=(0,b.default)(u),{getPrefixCls:T,direction:O,className:y,style:N}=(0,h.useComponentConfig)("steps"),L=t.useMemo(()=>u&&x?"vertical":m,[u,x,m]),_=(0,f.default)(s),M=T("steps",e.prefixCls),[R,P,z]=k(M),H="inline"===e.type,j=T("",e.iconPrefix),D=(a=g,n=C,a?a:(0,S.default)(n).map(e=>{if(t.isValidElement(e)){let{props:t}=e;return Object.assign({},t)}return null}).filter(e=>e)),B=H?void 0:l,W=Object.assign(Object.assign({},N),I),q=(0,o.default)(y,{[`${M}-rtl`]:"rtl"===O,[`${M}-with-progress`]:void 0!==B},c,d,P,z),X={finish:t.createElement(i.default,{className:`${M}-finish-icon`}),error:t.createElement(r.default,{className:`${M}-error-icon`})};return R(t.createElement(p,Object.assign({icons:X},w,{style:W,current:A,size:_,items:D,itemRender:H?(e,i)=>e.description?t.createElement($.default,{title:e.description},i):i:void 0,stepIcon:({node:e,status:i})=>"process"===i&&void 0!==B?t.createElement("div",{className:`${M}-progress-icon`},t.createElement(v.default,{type:"circle",percent:B,size:"small"===_?32:40,strokeWidth:4,format:()=>null}),e):e,direction:L,prefixCls:M,iconPrefix:j,className:q})))};T.Step=p.Step,e.s(["Steps",0,T],280898)},86408,e=>{"use strict";var t=e.i(843476),i=e.i(271645),r=e.i(618566),o=e.i(934879);function a(){let e=(0,r.useSearchParams)().get("key"),[a,n]=(0,i.useState)(null);return(0,i.useEffect)(()=>{e&&n(e)},[e]),(0,t.jsx)(o.default,{accessToken:a,publicPage:!0,premiumUser:!1,userRole:null})}e.s(["default",0,function(){return(0,t.jsx)(i.Suspense,{fallback:(0,t.jsx)("div",{className:"flex items-center justify-center min-h-screen",children:"Loading..."}),children:(0,t.jsx)(a,{})})}])}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/00-dyuivh_bf-.js b/litellm/proxy/_experimental/out/_next/static/chunks/00-dyuivh_bf-.js new file mode 100644 index 00000000000..ef1e3d6ad94 --- /dev/null +++ b/litellm/proxy/_experimental/out/_next/static/chunks/00-dyuivh_bf-.js @@ -0,0 +1 @@ +(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,95779,e=>{"use strict";var t=e.i(480731);t.BaseColors.Blue,t.BaseColors.Cyan,t.BaseColors.Sky,t.BaseColors.Indigo,t.BaseColors.Violet,t.BaseColors.Purple,t.BaseColors.Fuchsia,t.BaseColors.Slate,t.BaseColors.Gray,t.BaseColors.Zinc,t.BaseColors.Neutral,t.BaseColors.Stone,t.BaseColors.Red,t.BaseColors.Orange,t.BaseColors.Amber,t.BaseColors.Yellow,t.BaseColors.Lime,t.BaseColors.Green,t.BaseColors.Emerald,t.BaseColors.Teal,t.BaseColors.Pink,t.BaseColors.Rose,e.s(["colorPalette",0,{canvasBackground:50,lightBackground:100,background:500,darkBackground:600,darkestBackground:800,lightBorder:200,border:500,darkBorder:700,lightRing:200,ring:300,iconRing:500,lightText:400,text:500,iconText:600,darkText:700,darkestText:900,icon:500}])},599724,936325,e=>{"use strict";var t=e.i(95779),r=e.i(444755),o=e.i(673706),a=e.i(271645);let n=a.default.forwardRef((e,n)=>{let{color:s,className:l,children:i}=e;return a.default.createElement("p",{ref:n,className:(0,r.tremorTwMerge)("text-tremor-default",s?(0,o.getColorClassNames)(s,t.colorPalette.text).textColor:(0,r.tremorTwMerge)("text-tremor-content","dark:text-dark-tremor-content"),l)},i)});n.displayName="Text",e.s(["default",0,n],936325),e.s(["Text",0,n],599724)},994388,e=>{"use strict";var t=e.i(290571),r=e.i(829087),o=e.i(271645);let a=["preEnter","entering","entered","preExit","exiting","exited","unmounted"],n=e=>({_s:e,status:a[e],isEnter:e<3,isMounted:6!==e,isResolved:2===e||e>4}),s=e=>e?6:5,l=(e,t,r,o,a)=>{clearTimeout(o.current);let s=n(e);t(s),r.current=s,a&&a({current:s})};var i=e.i(480731),c=e.i(444755),d=e.i(673706);let u=e=>{var r=(0,t.__rest)(e,[]);return o.default.createElement("svg",Object.assign({},r,{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24",fill:"currentColor"}),o.default.createElement("path",{fill:"none",d:"M0 0h24v24H0z"}),o.default.createElement("path",{d:"M18.364 5.636L16.95 7.05A7 7 0 1 0 19 12h2a9 9 0 1 1-2.636-6.364z"}))};var m=e.i(95779);let f={xs:{height:"h-4",width:"w-4"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-6",width:"w-6"},xl:{height:"h-6",width:"w-6"}},p=(e,t)=>{switch(e){case"primary":return{textColor:t?(0,d.getColorClassNames)("white").textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",hoverTextColor:t?(0,d.getColorClassNames)("white").textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:t?(0,d.getColorClassNames)(t,m.colorPalette.background).bgColor:"bg-tremor-brand dark:bg-dark-tremor-brand",hoverBgColor:t?(0,d.getColorClassNames)(t,m.colorPalette.darkBackground).hoverBgColor:"hover:bg-tremor-brand-emphasis dark:hover:bg-dark-tremor-brand-emphasis",borderColor:t?(0,d.getColorClassNames)(t,m.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand",hoverBorderColor:t?(0,d.getColorClassNames)(t,m.colorPalette.darkBorder).hoverBorderColor:"hover:border-tremor-brand-emphasis dark:hover:border-dark-tremor-brand-emphasis"};case"secondary":return{textColor:t?(0,d.getColorClassNames)(t,m.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",hoverTextColor:t?(0,d.getColorClassNames)(t,m.colorPalette.text).textColor:"hover:text-tremor-brand-emphasis dark:hover:text-dark-tremor-brand-emphasis",bgColor:(0,d.getColorClassNames)("transparent").bgColor,hoverBgColor:t?(0,c.tremorTwMerge)((0,d.getColorClassNames)(t,m.colorPalette.background).hoverBgColor,"hover:bg-opacity-20 dark:hover:bg-opacity-20"):"hover:bg-tremor-brand-faint dark:hover:bg-dark-tremor-brand-faint",borderColor:t?(0,d.getColorClassNames)(t,m.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand"};case"light":return{textColor:t?(0,d.getColorClassNames)(t,m.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",hoverTextColor:t?(0,d.getColorClassNames)(t,m.colorPalette.darkText).hoverTextColor:"hover:text-tremor-brand-emphasis dark:hover:text-dark-tremor-brand-emphasis",bgColor:(0,d.getColorClassNames)("transparent").bgColor,borderColor:"",hoverBorderColor:""}}},g=(0,d.makeClassName)("Button"),b=({loading:e,iconSize:t,iconPosition:r,Icon:a,needMargin:n,transitionStatus:s})=>{let l=n?r===i.HorizontalPositions.Left?(0,c.tremorTwMerge)("-ml-1","mr-1.5"):(0,c.tremorTwMerge)("-mr-1","ml-1.5"):"",d=(0,c.tremorTwMerge)("w-0 h-0"),m={default:d,entering:d,entered:t,exiting:t,exited:d};return e?o.default.createElement(u,{className:(0,c.tremorTwMerge)(g("icon"),"animate-spin shrink-0",l,m.default,m[s]),style:{transition:"width 150ms"}}):o.default.createElement(a,{className:(0,c.tremorTwMerge)(g("icon"),"shrink-0",t,l)})},h=o.default.forwardRef((e,a)=>{let{icon:u,iconPosition:m=i.HorizontalPositions.Left,size:h=i.Sizes.SM,color:x,variant:v="primary",disabled:C,loading:y=!1,loadingText:k,children:w,tooltip:E,className:T}=e,N=(0,t.__rest)(e,["icon","iconPosition","size","color","variant","disabled","loading","loadingText","children","tooltip","className"]),S=y||C,$=void 0!==u||y,P=y&&k,I=!(!w&&!P),M=(0,c.tremorTwMerge)(f[h].height,f[h].width),F="light"!==v?(0,c.tremorTwMerge)("rounded-tremor-default border","shadow-tremor-input","dark:shadow-dark-tremor-input"):"",R=p(v,x),O=("light"!==v?{xs:{paddingX:"px-2.5",paddingY:"py-1.5",fontSize:"text-xs"},sm:{paddingX:"px-4",paddingY:"py-2",fontSize:"text-sm"},md:{paddingX:"px-4",paddingY:"py-2",fontSize:"text-md"},lg:{paddingX:"px-4",paddingY:"py-2.5",fontSize:"text-lg"},xl:{paddingX:"px-4",paddingY:"py-3",fontSize:"text-xl"}}:{xs:{paddingX:"",paddingY:"",fontSize:"text-xs"},sm:{paddingX:"",paddingY:"",fontSize:"text-sm"},md:{paddingX:"",paddingY:"",fontSize:"text-md"},lg:{paddingX:"",paddingY:"",fontSize:"text-lg"},xl:{paddingX:"",paddingY:"",fontSize:"text-xl"}})[h],{tooltipProps:A,getReferenceProps:B}=(0,r.useTooltip)(300),[j,D]=(({enter:e=!0,exit:t=!0,preEnter:r,preExit:a,timeout:i,initialEntered:c,mountOnEnter:d,unmountOnExit:u,onStateChange:m}={})=>{let[f,p]=(0,o.useState)(()=>n(c?2:s(d))),g=(0,o.useRef)(f),b=(0,o.useRef)(0),[h,x]="object"==typeof i?[i.enter,i.exit]:[i,i],v=(0,o.useCallback)(()=>{let e=((e,t)=>{switch(e){case 1:case 0:return 2;case 4:case 3:return s(t)}})(g.current._s,u);e&&l(e,p,g,b,m)},[m,u]);return[f,(0,o.useCallback)(o=>{let n=e=>{switch(l(e,p,g,b,m),e){case 1:h>=0&&(b.current=((...e)=>setTimeout(...e))(v,h));break;case 4:x>=0&&(b.current=((...e)=>setTimeout(...e))(v,x));break;case 0:case 3:b.current=((...e)=>setTimeout(...e))(()=>{isNaN(document.body.offsetTop)||n(e+1)},0)}},i=g.current.isEnter;"boolean"!=typeof o&&(o=!i),o?i||n(e?+!r:2):i&&n(t?a?3:4:s(u))},[v,m,e,t,r,a,h,x,u]),v]})({timeout:50});return(0,o.useEffect)(()=>{D(y)},[y]),o.default.createElement("button",Object.assign({ref:(0,d.mergeRefs)([a,A.refs.setReference]),className:(0,c.tremorTwMerge)(g("root"),"shrink-0 inline-flex justify-center items-center group font-medium outline-none",F,O.paddingX,O.paddingY,O.fontSize,R.textColor,R.bgColor,R.borderColor,R.hoverBorderColor,S?"opacity-50 cursor-not-allowed":(0,c.tremorTwMerge)(p(v,x).hoverTextColor,p(v,x).hoverBgColor,p(v,x).hoverBorderColor),T),disabled:S},B,N),o.default.createElement(r.default,Object.assign({text:E},A)),$&&m!==i.HorizontalPositions.Right?o.default.createElement(b,{loading:y,iconSize:M,iconPosition:m,Icon:u,transitionStatus:j.status,needMargin:I}):null,P||w?o.default.createElement("span",{className:(0,c.tremorTwMerge)(g("text"),"text-tremor-default whitespace-nowrap")},P?k:w):null,$&&m===i.HorizontalPositions.Right?o.default.createElement(b,{loading:y,iconSize:M,iconPosition:m,Icon:u,transitionStatus:j.status,needMargin:I}):null)});h.displayName="Button",e.s(["Button",0,h],994388)},553521,e=>{"use strict";var t=e.i(271645),r=e.i(835696);e.s(["useIsMounted",0,function(){let e=(0,t.useRef)(!1);return(0,r.useIsoMorphicEffect)(()=>(e.current=!0,()=>{e.current=!1}),[]),e}])},2788,e=>{"use strict";let t;var r=e.i(700020),o=((t=o||{})[t.None=1]="None",t[t.Focusable=2]="Focusable",t[t.Hidden=4]="Hidden",t);let a=(0,r.forwardRefWithAs)(function(e,t){var o;let{features:a=1,...n}=e,s={ref:t,"aria-hidden":(2&a)==2||(null!=(o=n["aria-hidden"])?o:void 0),hidden:(4&a)==4||void 0,style:{position:"fixed",top:1,left:1,width:1,height:0,padding:0,margin:-1,overflow:"hidden",clip:"rect(0, 0, 0, 0)",whiteSpace:"nowrap",borderWidth:"0",...(4&a)==4&&(2&a)!=2&&{display:"none"}}};return(0,r.useRender)()({ourProps:s,theirProps:n,slot:{},defaultTag:"span",name:"Hidden"})});e.s(["Hidden",0,a,"HiddenFeatures",0,o])},652265,e=>{"use strict";let t,r,o,a,n;e.i(544508);var s=e.i(397701),l=e.i(402155);let i=["[contentEditable=true]","[tabindex]","a[href]","area[href]","button:not([disabled])","iframe","input:not([disabled])","select:not([disabled])","textarea:not([disabled])"].map(e=>`${e}:not([tabindex='-1'])`).join(","),c=["[data-autofocus]"].map(e=>`${e}:not([tabindex='-1'])`).join(",");var d=((t=d||{})[t.First=1]="First",t[t.Previous=2]="Previous",t[t.Next=4]="Next",t[t.Last=8]="Last",t[t.WrapAround=16]="WrapAround",t[t.NoScroll=32]="NoScroll",t[t.AutoFocus=64]="AutoFocus",t),u=((r=u||{})[r.Error=0]="Error",r[r.Overflow=1]="Overflow",r[r.Success=2]="Success",r[r.Underflow=3]="Underflow",r),m=((o=m||{})[o.Previous=-1]="Previous",o[o.Next=1]="Next",o);function f(e=document.body){return null==e?[]:Array.from(e.querySelectorAll(i)).sort((e,t)=>Math.sign((e.tabIndex||Number.MAX_SAFE_INTEGER)-(t.tabIndex||Number.MAX_SAFE_INTEGER)))}var p=((a=p||{})[a.Strict=0]="Strict",a[a.Loose=1]="Loose",a),g=((n=g||{})[n.Keyboard=0]="Keyboard",n[n.Mouse=1]="Mouse",n);function b(e,t=e=>e){return e.slice().sort((e,r)=>{let o=t(e),a=t(r);if(null===o||null===a)return 0;let n=o.compareDocumentPosition(a);return n&Node.DOCUMENT_POSITION_FOLLOWING?-1:n&Node.DOCUMENT_POSITION_PRECEDING?1:0})}function h(e,t,{sorted:r=!0,relativeTo:o=null,skipElements:a=[]}={}){var n,s,l;let i=Array.isArray(e)?e.length>0?e[0].ownerDocument:document:e.ownerDocument,d=Array.isArray(e)?r?b(e):e:64&t?function(e=document.body){return null==e?[]:Array.from(e.querySelectorAll(c)).sort((e,t)=>Math.sign((e.tabIndex||Number.MAX_SAFE_INTEGER)-(t.tabIndex||Number.MAX_SAFE_INTEGER)))}(e):f(e);a.length>0&&d.length>1&&(d=d.filter(e=>!a.some(t=>null!=t&&"current"in t?(null==t?void 0:t.current)===e:t===e))),o=null!=o?o:i.activeElement;let u=(()=>{if(5&t)return 1;if(10&t)return -1;throw Error("Missing Focus.First, Focus.Previous, Focus.Next or Focus.Last")})(),m=(()=>{if(1&t)return 0;if(2&t)return Math.max(0,d.indexOf(o))-1;if(4&t)return Math.max(0,d.indexOf(o))+1;if(8&t)return d.length-1;throw Error("Missing Focus.First, Focus.Previous, Focus.Next or Focus.Last")})(),p=32&t?{preventScroll:!0}:{},g=0,x=d.length,v;do{if(g>=x||g+x<=0)return 0;let e=m+g;if(16&t)e=(e+x)%x;else{if(e<0)return 3;if(e>=x)return 1}null==(v=d[e])||v.focus(p),g+=u}while(v!==i.activeElement)return 6&t&&null!=(l=null==(s=null==(n=v)?void 0:n.matches)?void 0:s.call(n,"textarea,input"))&&l&&v.select(),2}"u">typeof window&&"u">typeof document&&(document.addEventListener("keydown",e=>{e.metaKey||e.altKey||e.ctrlKey||(document.documentElement.dataset.headlessuiFocusVisible="")},!0),document.addEventListener("click",e=>{1===e.detail?delete document.documentElement.dataset.headlessuiFocusVisible:0===e.detail&&(document.documentElement.dataset.headlessuiFocusVisible="")},!0)),e.s(["Focus",0,d,"FocusResult",0,u,"FocusableMode",0,p,"focusFrom",0,function(e,t){return h(f(),t,{relativeTo:e})},"focusIn",0,h,"getFocusableElements",0,f,"isFocusableElement",0,function(e,t=0){var r;return e!==(null==(r=(0,l.getOwnerDocument)(e))?void 0:r.body)&&(0,s.match)(t,{0:()=>e.matches(i),1(){let t=e;for(;null!==t;){if(t.matches(i))return!0;t=t.parentElement}return!1}})},"sortByDomNode",0,b])},970554,e=>{"use strict";let t,r,o;var a=e.i(783222),n=e.i(433336),s=e.i(271645),l=e.i(394487),i=e.i(914189),c=e.i(835696),d=e.i(941444),u=e.i(144279),m=e.i(294316),f=e.i(553521),p=e.i(2788);function g({onFocus:e}){let[t,r]=(0,s.useState)(!0),o=(0,f.useIsMounted)();return t?s.default.createElement(p.Hidden,{as:"button",type:"button",features:p.HiddenFeatures.Focusable,onFocus:t=>{t.preventDefault();let a,n=50;a=requestAnimationFrame(function t(){if(n--<=0){a&&cancelAnimationFrame(a);return}if(e()){if(cancelAnimationFrame(a),!o.current)return;r(!1);return}a=requestAnimationFrame(t)})}}):null}var b=e.i(652265),h=e.i(397701),x=e.i(368578),v=e.i(402155),C=e.i(700020);let y=s.createContext(null);function k({children:e}){let t=s.useRef({groups:new Map,get(e,t){var r;let o=this.groups.get(e);o||(o=new Map,this.groups.set(e,o));let a=null!=(r=o.get(t))?r:0;return o.set(t,a+1),[Array.from(o.keys()).indexOf(t),function(){let e=o.get(t);e>1?o.set(t,e-1):o.delete(t)}]}});return s.createElement(y.Provider,{value:t},e)}function w(e){let t=s.useContext(y);if(!t)throw Error("You must wrap your component in a ");let r=s.useId(),[o,a]=t.current.get(e,r);return s.useEffect(()=>a,[]),o}var E=e.i(998348),T=((t=T||{})[t.Forwards=0]="Forwards",t[t.Backwards=1]="Backwards",t),N=((r=N||{})[r.Less=-1]="Less",r[r.Equal=0]="Equal",r[r.Greater=1]="Greater",r),S=((o=S||{})[o.SetSelectedIndex=0]="SetSelectedIndex",o[o.RegisterTab=1]="RegisterTab",o[o.UnregisterTab=2]="UnregisterTab",o[o.RegisterPanel=3]="RegisterPanel",o[o.UnregisterPanel=4]="UnregisterPanel",o);let $={0(e,t){var r;let o=(0,b.sortByDomNode)(e.tabs,e=>e.current),a=(0,b.sortByDomNode)(e.panels,e=>e.current),n=o.filter(e=>{var t;return!(null!=(t=e.current)&&t.hasAttribute("disabled"))}),s={...e,tabs:o,panels:a};if(t.index<0||t.index>o.length-1){let r=(0,h.match)(Math.sign(t.index-e.selectedIndex),{[-1]:()=>1,0:()=>(0,h.match)(Math.sign(t.index),{[-1]:()=>0,0:()=>0,1:()=>1}),1:()=>0});if(0===n.length)return s;let a=(0,h.match)(r,{0:()=>o.indexOf(n[0]),1:()=>o.indexOf(n[n.length-1])});return{...s,selectedIndex:-1===a?e.selectedIndex:a}}let l=o.slice(0,t.index),i=[...o.slice(t.index),...l].find(e=>n.includes(e));if(!i)return s;let c=null!=(r=o.indexOf(i))?r:e.selectedIndex;return -1===c&&(c=e.selectedIndex),{...s,selectedIndex:c}},1(e,t){if(e.tabs.includes(t.tab))return e;let r=e.tabs[e.selectedIndex],o=(0,b.sortByDomNode)([...e.tabs,t.tab],e=>e.current),a=e.selectedIndex;return e.info.current.isControlled||-1===(a=o.indexOf(r))&&(a=e.selectedIndex),{...e,tabs:o,selectedIndex:a}},2:(e,t)=>({...e,tabs:e.tabs.filter(e=>e!==t.tab)}),3:(e,t)=>e.panels.includes(t.panel)?e:{...e,panels:(0,b.sortByDomNode)([...e.panels,t.panel],e=>e.current)},4:(e,t)=>({...e,panels:e.panels.filter(e=>e!==t.panel)})},P=(0,s.createContext)(null);function I(e){let t=(0,s.useContext)(P);if(null===t){let t=Error(`<${e} /> is missing a parent component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,I),t}return t}P.displayName="TabsDataContext";let M=(0,s.createContext)(null);function F(e){let t=(0,s.useContext)(M);if(null===t){let t=Error(`<${e} /> is missing a parent component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,F),t}return t}function R(e,t){return(0,h.match)(t.type,$,e,t)}M.displayName="TabsActionsContext";let O=C.RenderFeatures.RenderStrategy|C.RenderFeatures.Static,A=Object.assign((0,C.forwardRefWithAs)(function(e,t){var r,o;let d=(0,s.useId)(),{id:f=`headlessui-tabs-tab-${d}`,disabled:p=!1,autoFocus:g=!1,...y}=e,{orientation:k,activation:T,selectedIndex:N,tabs:S,panels:$}=I("Tab"),P=F("Tab"),M=I("Tab"),[R,O]=(0,s.useState)(null),A=(0,s.useRef)(null),B=(0,m.useSyncRefs)(A,t,O);(0,c.useIsoMorphicEffect)(()=>P.registerTab(A),[P,A]);let j=w("tabs"),D=S.indexOf(A);-1===D&&(D=j);let z=D===N,L=(0,i.useEvent)(e=>{var t;let r=e();if(r===b.FocusResult.Success&&"auto"===T){let e=null==(t=(0,v.getOwnerDocument)(A))?void 0:t.activeElement,r=M.tabs.findIndex(t=>t.current===e);-1!==r&&P.change(r)}return r}),W=(0,i.useEvent)(e=>{let t=S.map(e=>e.current).filter(Boolean);if(e.key===E.Keys.Space||e.key===E.Keys.Enter){e.preventDefault(),e.stopPropagation(),P.change(D);return}switch(e.key){case E.Keys.Home:case E.Keys.PageUp:return e.preventDefault(),e.stopPropagation(),L(()=>(0,b.focusIn)(t,b.Focus.First));case E.Keys.End:case E.Keys.PageDown:return e.preventDefault(),e.stopPropagation(),L(()=>(0,b.focusIn)(t,b.Focus.Last))}if(L(()=>(0,h.match)(k,{vertical:()=>e.key===E.Keys.ArrowUp?(0,b.focusIn)(t,b.Focus.Previous|b.Focus.WrapAround):e.key===E.Keys.ArrowDown?(0,b.focusIn)(t,b.Focus.Next|b.Focus.WrapAround):b.FocusResult.Error,horizontal:()=>e.key===E.Keys.ArrowLeft?(0,b.focusIn)(t,b.Focus.Previous|b.Focus.WrapAround):e.key===E.Keys.ArrowRight?(0,b.focusIn)(t,b.Focus.Next|b.Focus.WrapAround):b.FocusResult.Error}))===b.FocusResult.Success)return e.preventDefault()}),_=(0,s.useRef)(!1),X=(0,i.useEvent)(()=>{var e;_.current||(_.current=!0,null==(e=A.current)||e.focus({preventScroll:!0}),P.change(D),(0,x.microTask)(()=>{_.current=!1}))}),H=(0,i.useEvent)(e=>{e.preventDefault()}),{isFocusVisible:K,focusProps:G}=(0,a.useFocusRing)({autoFocus:g}),{isHovered:V,hoverProps:Y}=(0,n.useHover)({isDisabled:p}),{pressed:U,pressProps:q}=(0,l.useActivePress)({disabled:p}),Q=(0,s.useMemo)(()=>({selected:z,hover:V,active:U,focus:K,autofocus:g,disabled:p}),[z,V,K,U,g,p]),Z=(0,C.mergeProps)({ref:B,onKeyDown:W,onMouseDown:H,onClick:X,id:f,role:"tab",type:(0,u.useResolveButtonType)(e,R),"aria-controls":null==(o=null==(r=$[D])?void 0:r.current)?void 0:o.id,"aria-selected":z,tabIndex:z?0:-1,disabled:p||void 0,autoFocus:g},G,Y,q);return(0,C.useRender)()({ourProps:Z,theirProps:y,slot:Q,defaultTag:"button",name:"Tabs.Tab"})}),{Group:(0,C.forwardRefWithAs)(function(e,t){let{defaultIndex:r=0,vertical:o=!1,manual:a=!1,onChange:n,selectedIndex:l=null,...u}=e,f=o?"vertical":"horizontal",p=a?"manual":"auto",h=null!==l,x=(0,d.useLatestValue)({isControlled:h}),v=(0,m.useSyncRefs)(t),[y,w]=(0,s.useReducer)(R,{info:x,selectedIndex:null!=l?l:r,tabs:[],panels:[]}),E=(0,s.useMemo)(()=>({selectedIndex:y.selectedIndex}),[y.selectedIndex]),T=(0,d.useLatestValue)(n||(()=>{})),N=(0,d.useLatestValue)(y.tabs),S=(0,s.useMemo)(()=>({orientation:f,activation:p,...y}),[f,p,y]),$=(0,i.useEvent)(e=>(w({type:1,tab:e}),()=>w({type:2,tab:e}))),I=(0,i.useEvent)(e=>(w({type:3,panel:e}),()=>w({type:4,panel:e}))),F=(0,i.useEvent)(e=>{O.current!==e&&T.current(e),h||w({type:0,index:e})}),O=(0,d.useLatestValue)(h?e.selectedIndex:y.selectedIndex),A=(0,s.useMemo)(()=>({registerTab:$,registerPanel:I,change:F}),[]);(0,c.useIsoMorphicEffect)(()=>{w({type:0,index:null!=l?l:r})},[l]),(0,c.useIsoMorphicEffect)(()=>{if(void 0===O.current||y.tabs.length<=0)return;let e=(0,b.sortByDomNode)(y.tabs,e=>e.current);e.some((e,t)=>y.tabs[t]!==e)&&F(e.indexOf(y.tabs[O.current]))});let B=(0,C.useRender)();return s.default.createElement(k,null,s.default.createElement(M.Provider,{value:A},s.default.createElement(P.Provider,{value:S},S.tabs.length<=0&&s.default.createElement(g,{onFocus:()=>{var e,t;for(let r of N.current)if((null==(e=r.current)?void 0:e.tabIndex)===0)return null==(t=r.current)||t.focus(),!0;return!1}}),B({ourProps:{ref:v},theirProps:u,slot:E,defaultTag:"div",name:"Tabs"}))))}),List:(0,C.forwardRefWithAs)(function(e,t){let{orientation:r,selectedIndex:o}=I("Tab.List"),a=(0,m.useSyncRefs)(t),n=(0,s.useMemo)(()=>({selectedIndex:o}),[o]);return(0,C.useRender)()({ourProps:{ref:a,role:"tablist","aria-orientation":r},theirProps:e,slot:n,defaultTag:"div",name:"Tabs.List"})}),Panels:(0,C.forwardRefWithAs)(function(e,t){let{selectedIndex:r}=I("Tab.Panels"),o=(0,m.useSyncRefs)(t),a=(0,s.useMemo)(()=>({selectedIndex:r}),[r]);return(0,C.useRender)()({ourProps:{ref:o},theirProps:e,slot:a,defaultTag:"div",name:"Tabs.Panels"})}),Panel:(0,C.forwardRefWithAs)(function(e,t){var r,o,n,l;let i=(0,s.useId)(),{id:d=`headlessui-tabs-panel-${i}`,tabIndex:u=0,...f}=e,{selectedIndex:g,tabs:b,panels:h}=I("Tab.Panel"),x=F("Tab.Panel"),v=(0,s.useRef)(null),y=(0,m.useSyncRefs)(v,t);(0,c.useIsoMorphicEffect)(()=>x.registerPanel(v),[x,v]);let k=w("panels"),E=h.indexOf(v);-1===E&&(E=k);let T=E===g,{isFocusVisible:N,focusProps:S}=(0,a.useFocusRing)(),$=(0,s.useMemo)(()=>({selected:T,focus:N}),[T,N]),P=(0,C.mergeProps)({ref:y,id:d,role:"tabpanel","aria-labelledby":null==(o=null==(r=b[E])?void 0:r.current)?void 0:o.id,tabIndex:T?u:-1},S),M=(0,C.useRender)();return T||null!=(n=f.unmount)&&!n||null!=(l=f.static)&&l?M({ourProps:P,theirProps:f,slot:$,defaultTag:"div",features:O,visible:T,name:"Tabs.Panel"}):s.default.createElement(p.Hidden,{"aria-hidden":"true",...P})})});e.s(["Tab",0,A],970554)},653824,e=>{"use strict";var t=e.i(290571),r=e.i(970554),o=e.i(444755),a=e.i(673706),n=e.i(271645);let s=(0,a.makeClassName)("TabGroup"),l=n.default.forwardRef((e,a)=>{let{defaultIndex:l,index:i,onIndexChange:c,children:d,className:u}=e,m=(0,t.__rest)(e,["defaultIndex","index","onIndexChange","children","className"]);return n.default.createElement(r.Tab.Group,Object.assign({as:"div",ref:a,defaultIndex:l,selectedIndex:i,onChange:c,className:(0,o.tremorTwMerge)(s("root"),"w-full",u)},m),d)});l.displayName="TabGroup",e.s(["TabGroup",0,l],653824)},405371,910342,e=>{"use strict";var t=e.i(290571),r=e.i(271645),o=e.i(480731);let a=(0,r.createContext)(o.BaseColors.Blue);e.s(["default",0,a],910342);var n=e.i(970554),s=e.i(444755);let l=(0,e.i(673706).makeClassName)("TabList"),i=(0,r.createContext)("line"),c={line:(0,s.tremorTwMerge)("flex border-b space-x-4","border-tremor-border","dark:border-dark-tremor-border"),solid:(0,s.tremorTwMerge)("inline-flex p-0.5 rounded-tremor-default space-x-1.5","bg-tremor-background-subtle","dark:bg-dark-tremor-background-subtle")},d=r.default.forwardRef((e,o)=>{let{color:d,variant:u="line",children:m,className:f}=e,p=(0,t.__rest)(e,["color","variant","children","className"]);return r.default.createElement(n.Tab.List,Object.assign({ref:o,className:(0,s.tremorTwMerge)(l("root"),"justify-start overflow-x-clip",c[u],f)},p),r.default.createElement(i.Provider,{value:u},r.default.createElement(a.Provider,{value:d},m)))});d.displayName="TabList",e.s(["TabVariantContext",0,i,"default",0,d],405371)},881073,e=>{"use strict";var t=e.i(405371);e.s(["TabList",()=>t.default])},197647,e=>{"use strict";var t=e.i(290571),r=e.i(970554),o=e.i(95779),a=e.i(444755),n=e.i(673706),s=e.i(271645),l=e.i(405371),i=e.i(910342);let c=(0,n.makeClassName)("Tab"),d=s.default.forwardRef((e,d)=>{let{icon:u,className:m,children:f}=e,p=(0,t.__rest)(e,["icon","className","children"]),g=(0,s.useContext)(l.TabVariantContext),b=(0,s.useContext)(i.default);return s.default.createElement(r.Tab,Object.assign({ref:d,className:(0,a.tremorTwMerge)(c("root"),"flex whitespace-nowrap truncate max-w-xs outline-none data-focus-visible:ring text-tremor-default transition duration-100",function(e,t){switch(e){case"line":return(0,a.tremorTwMerge)("data-[selected]:border-b-2 hover:border-b-2 border-transparent transition duration-100 -mb-px px-2 py-2","hover:border-tremor-content hover:text-tremor-content-emphasis text-tremor-content","[&:not([data-selected])]:dark:hover:border-dark-tremor-content-emphasis [&:not([data-selected])]:dark:hover:text-dark-tremor-content-emphasis [&:not([data-selected])]:dark:text-dark-tremor-content",t?(0,n.getColorClassNames)(t,o.colorPalette.border).selectBorderColor:["data-[selected]:border-tremor-brand data-[selected]:text-tremor-brand","data-[selected]:dark:border-dark-tremor-brand data-[selected]:dark:text-dark-tremor-brand"]);case"solid":return(0,a.tremorTwMerge)("border-transparent border rounded-tremor-small px-2.5 py-1","data-[selected]:border-tremor-border data-[selected]:bg-tremor-background data-[selected]:shadow-tremor-input [&:not([data-selected])]:hover:text-tremor-content-emphasis data-[selected]:text-tremor-brand [&:not([data-selected])]:text-tremor-content","dark:data-[selected]:border-dark-tremor-border dark:data-[selected]:bg-dark-tremor-background dark:data-[selected]:shadow-dark-tremor-input dark:[&:not([data-selected])]:hover:text-dark-tremor-content-emphasis dark:data-[selected]:text-dark-tremor-brand dark:[&:not([data-selected])]:text-dark-tremor-content",t?(0,n.getColorClassNames)(t,o.colorPalette.text).selectTextColor:"text-tremor-content dark:text-dark-tremor-content")}}(g,b),m,b&&(0,n.getColorClassNames)(b,o.colorPalette.text).selectTextColor)},p),u?s.default.createElement(u,{className:(0,a.tremorTwMerge)(c("icon"),"flex-none h-5 w-5",f?"mr-2":"")}):null,f?s.default.createElement("span",null,f):null)});d.displayName="Tab",e.s(["Tab",0,d],197647)},751734,144582,e=>{"use strict";var t=e.i(271645);let r=(0,t.createContext)(0);e.s(["default",0,r],751734);let o=(0,t.createContext)({selectedValue:void 0,handleValueChange:void 0});e.s(["default",0,o],144582)},723731,e=>{"use strict";var t=e.i(290571),r=e.i(970554),o=e.i(751734),a=e.i(144582),n=e.i(444755),s=e.i(673706),l=e.i(271645);let i=(0,s.makeClassName)("TabPanels"),c=l.default.forwardRef((e,s)=>{let{children:c,className:d}=e,u=(0,t.__rest)(e,["children","className"]);return l.default.createElement(r.Tab.Panels,Object.assign({as:"div",ref:s,className:(0,n.tremorTwMerge)(i("root"),"w-full",d)},u),({selectedIndex:e})=>l.default.createElement(a.default.Provider,{value:{selectedValue:e}},l.default.Children.map(c,(e,t)=>l.default.createElement(o.default.Provider,{value:t},e))))});c.displayName="TabPanels",e.s(["TabPanels",0,c],723731)},404206,e=>{"use strict";var t=e.i(290571),r=e.i(751734),o=e.i(144582),a=e.i(444755),n=e.i(673706),s=e.i(271645);let l=(0,n.makeClassName)("TabPanel"),i=s.default.forwardRef((e,n)=>{let{children:i,className:c}=e,d=(0,t.__rest)(e,["children","className"]),{selectedValue:u}=(0,s.useContext)(o.default),m=u===(0,s.useContext)(r.default);return s.default.createElement("div",Object.assign({ref:n,className:(0,a.tremorTwMerge)(l("root"),"w-full mt-2",m?"":"hidden",c),"aria-selected":m?"true":"false"},d),i)});i.displayName="TabPanel",e.s(["TabPanel",0,i],404206)},309821,e=>{"use strict";e.i(247167);var t=e.i(271645),r=e.i(135551),o=e.i(201072),a=e.i(121229),n=e.i(726289),s=e.i(864517),l=e.i(343794),i=e.i(529681),c=e.i(242064),d=e.i(931067),u=e.i(209428),m=e.i(703923),f={percent:0,prefixCls:"rc-progress",strokeColor:"#2db7f5",strokeLinecap:"round",strokeWidth:1,trailColor:"#D9D9D9",trailWidth:1,gapPosition:"bottom"},p=function(){var e=(0,t.useRef)([]),r=(0,t.useRef)(null);return(0,t.useEffect)(function(){var t=Date.now(),o=!1;e.current.forEach(function(e){if(e){o=!0;var a=e.style;a.transitionDuration=".3s, .3s, .3s, .06s",r.current&&t-r.current<100&&(a.transitionDuration="0s, 0s")}}),o&&(r.current=Date.now())}),e.current},g=e.i(410160),b=e.i(392221),h=e.i(654310),x=0,v=(0,h.default)();let C=function(e){var r=t.useState(),o=(0,b.default)(r,2),a=o[0],n=o[1];return t.useEffect(function(){var e;n("rc_progress_".concat((v?(e=x,x+=1):e="TEST_OR_SSR",e)))},[]),e||a};var y=function(e){var r=e.bg,o=e.children;return t.createElement("div",{style:{width:"100%",height:"100%",background:r}},o)};function k(e,t){return Object.keys(e).map(function(r){var o=parseFloat(r),a="".concat(Math.floor(o*t),"%");return"".concat(e[r]," ").concat(a)})}var w=t.forwardRef(function(e,r){var o=e.prefixCls,a=e.color,n=e.gradientId,s=e.radius,l=e.style,i=e.ptg,c=e.strokeLinecap,d=e.strokeWidth,u=e.size,m=e.gapDegree,f=a&&"object"===(0,g.default)(a),p=u/2,b=t.createElement("circle",{className:"".concat(o,"-circle-path"),r:s,cx:p,cy:p,stroke:f?"#FFF":void 0,strokeLinecap:c,strokeWidth:d,opacity:+(0!==i),style:l,ref:r});if(!f)return b;var h="".concat(n,"-conic"),x=k(a,(360-m)/360),v=k(a,1),C="conic-gradient(from ".concat(m?"".concat(180+m/2,"deg"):"0deg",", ").concat(x.join(", "),")"),w="linear-gradient(to ".concat(m?"bottom":"top",", ").concat(v.join(", "),")");return t.createElement(t.Fragment,null,t.createElement("mask",{id:h},b),t.createElement("foreignObject",{x:0,y:0,width:u,height:u,mask:"url(#".concat(h,")")},t.createElement(y,{bg:w},t.createElement(y,{bg:C}))))}),E=function(e,t,r,o,a,n,s,l,i,c){var d=arguments.length>10&&void 0!==arguments[10]?arguments[10]:0,u=(100-o)/100*t;return"round"===i&&100!==o&&(u+=c/2)>=t&&(u=t-.01),{stroke:"string"==typeof l?l:void 0,strokeDasharray:"".concat(t,"px ").concat(e),strokeDashoffset:u+d,transform:"rotate(".concat(a+r/100*360*((360-n)/360)+(0===n?0:({bottom:0,top:180,left:90,right:-90})[s]),"deg)"),transformOrigin:"".concat(50,"px ").concat(50,"px"),transition:"stroke-dashoffset .3s ease 0s, stroke-dasharray .3s ease 0s, stroke .3s, stroke-width .06s ease .3s, opacity .3s ease 0s",fillOpacity:0}},T=["id","prefixCls","steps","strokeWidth","trailWidth","gapDegree","gapPosition","trailColor","strokeLinecap","style","className","strokeColor","percent"];function N(e){var t=null!=e?e:[];return Array.isArray(t)?t:[t]}let S=function(e){var r,o,a,n,s=(0,u.default)((0,u.default)({},f),e),i=s.id,c=s.prefixCls,b=s.steps,h=s.strokeWidth,x=s.trailWidth,v=s.gapDegree,y=void 0===v?0:v,k=s.gapPosition,S=s.trailColor,$=s.strokeLinecap,P=s.style,I=s.className,M=s.strokeColor,F=s.percent,R=(0,m.default)(s,T),O=C(i),A="".concat(O,"-gradient"),B=50-h/2,j=2*Math.PI*B,D=y>0?90+y/2:-90,z=(360-y)/360*j,L="object"===(0,g.default)(b)?b:{count:b,gap:2},W=L.count,_=L.gap,X=N(F),H=N(M),K=H.find(function(e){return e&&"object"===(0,g.default)(e)}),G=K&&"object"===(0,g.default)(K)?"butt":$,V=E(j,z,0,100,D,y,k,S,G,h),Y=p();return t.createElement("svg",(0,d.default)({className:(0,l.default)("".concat(c,"-circle"),I),viewBox:"0 0 ".concat(100," ").concat(100),style:P,id:i,role:"presentation"},R),!W&&t.createElement("circle",{className:"".concat(c,"-circle-trail"),r:B,cx:50,cy:50,stroke:S,strokeLinecap:G,strokeWidth:x||h,style:V}),W?(r=Math.round(W*(X[0]/100)),o=100/W,a=0,Array(W).fill(null).map(function(e,n){var s=n<=r-1?H[0]:S,l=s&&"object"===(0,g.default)(s)?"url(#".concat(A,")"):void 0,i=E(j,z,a,o,D,y,k,s,"butt",h,_);return a+=(z-i.strokeDashoffset+_)*100/z,t.createElement("circle",{key:n,className:"".concat(c,"-circle-path"),r:B,cx:50,cy:50,stroke:l,strokeWidth:h,opacity:1,style:i,ref:function(e){Y[n]=e}})})):(n=0,X.map(function(e,r){var o=H[r]||H[H.length-1],a=E(j,z,n,e,D,y,k,o,G,h);return n+=e,t.createElement(w,{key:r,color:o,ptg:e,radius:B,prefixCls:c,gradientId:A,style:a,strokeLinecap:G,strokeWidth:h,gapDegree:y,ref:function(e){Y[r]=e},size:100})}).reverse()))};var $=e.i(491816);e.i(765846);var P=e.i(896091);function I(e){return!e||e<0?0:e>100?100:e}function M({success:e,successPercent:t}){let r=t;return e&&"progress"in e&&(r=e.progress),e&&"percent"in e&&(r=e.percent),r}let F=(e,t,r)=>{var o,a,n,s;let l=-1,i=-1;if("step"===t){let t=r.steps,o=r.strokeWidth;"string"==typeof e||void 0===e?(l="small"===e?2:14,i=null!=o?o:8):"number"==typeof e?[l,i]=[e,e]:[l=14,i=8]=Array.isArray(e)?e:[e.width,e.height],l*=t}else if("line"===t){let t=null==r?void 0:r.strokeWidth;"string"==typeof e||void 0===e?i=t||("small"===e?6:8):"number"==typeof e?[l,i]=[e,e]:[l=-1,i=8]=Array.isArray(e)?e:[e.width,e.height]}else("circle"===t||"dashboard"===t)&&("string"==typeof e||void 0===e?[l,i]="small"===e?[60,60]:[120,120]:"number"==typeof e?[l,i]=[e,e]:Array.isArray(e)&&(l=null!=(a=null!=(o=e[0])?o:e[1])?a:120,i=null!=(s=null!=(n=e[0])?n:e[1])?s:120));return[l,i]},R=e=>{let{prefixCls:r,trailColor:o=null,strokeLinecap:a="round",gapPosition:n,gapDegree:s,width:i=120,type:c,children:d,success:u,size:m=i,steps:f}=e,[p,g]=F(m,"circle"),{strokeWidth:b}=e;void 0===b&&(b=Math.max(3/p*100,6));let h=t.useMemo(()=>s||0===s?s:"dashboard"===c?75:void 0,[s,c]),x=(({percent:e,success:t,successPercent:r})=>{let o=I(M({success:t,successPercent:r}));return[o,I(I(e)-o)]})(e),v="[object Object]"===Object.prototype.toString.call(e.strokeColor),C=(({success:e={},strokeColor:t})=>{let{strokeColor:r}=e;return[r||P.presetPrimaryColors.green,t||null]})({success:u,strokeColor:e.strokeColor}),y=(0,l.default)(`${r}-inner`,{[`${r}-circle-gradient`]:v}),k=t.createElement(S,{steps:f,percent:f?x[1]:x,strokeWidth:b,trailWidth:b,strokeColor:f?C[1]:C,strokeLinecap:a,trailColor:o,prefixCls:r,gapDegree:h,gapPosition:n||"dashboard"===c&&"bottom"||void 0}),w=p<=20,E=t.createElement("div",{className:y,style:{width:p,height:g,fontSize:.15*p+6}},k,!w&&d);return w?t.createElement($.default,{title:d},E):E};e.i(296059);var O=e.i(694758),A=e.i(915654),B=e.i(183293),j=e.i(246422),D=e.i(838378);let z="--progress-line-stroke-color",L="--progress-percent",W=e=>{let t=e?"100%":"-100%";return new O.Keyframes(`antProgress${e?"RTL":"LTR"}Active`,{"0%":{transform:`translateX(${t}) scaleX(0)`,opacity:.1},"20%":{transform:`translateX(${t}) scaleX(0)`,opacity:.5},to:{transform:"translateX(0) scaleX(1)",opacity:0}})},_=(0,j.genStyleHooks)("Progress",e=>{let t=e.calc(e.marginXXS).div(2).equal(),r=(0,D.mergeToken)(e,{progressStepMarginInlineEnd:t,progressStepMinWidth:t,progressActiveMotionDuration:"2.4s"});return[(e=>{let{componentCls:t,iconCls:r}=e;return{[t]:Object.assign(Object.assign({},(0,B.resetComponent)(e)),{display:"inline-block","&-rtl":{direction:"rtl"},"&-line":{position:"relative",width:"100%",fontSize:e.fontSize},[`${t}-outer`]:{display:"inline-flex",alignItems:"center",width:"100%"},[`${t}-inner`]:{position:"relative",display:"inline-block",width:"100%",flex:1,overflow:"hidden",verticalAlign:"middle",backgroundColor:e.remainingColor,borderRadius:e.lineBorderRadius},[`${t}-inner:not(${t}-circle-gradient)`]:{[`${t}-circle-path`]:{stroke:e.defaultColor}},[`${t}-success-bg, ${t}-bg`]:{position:"relative",background:e.defaultColor,borderRadius:e.lineBorderRadius,transition:`all ${e.motionDurationSlow} ${e.motionEaseInOutCirc}`},[`${t}-layout-bottom`]:{display:"flex",flexDirection:"column",alignItems:"center",justifyContent:"center",[`${t}-text`]:{width:"max-content",marginInlineStart:0,marginTop:e.marginXXS}},[`${t}-bg`]:{overflow:"hidden","&::after":{content:'""',background:{_multi_value_:!0,value:["inherit",`var(${z})`]},height:"100%",width:`calc(1 / var(${L}) * 100%)`,display:"block"},[`&${t}-bg-inner`]:{minWidth:"max-content","&::after":{content:"none"},[`${t}-text-inner`]:{color:e.colorWhite,[`&${t}-text-bright`]:{color:"rgba(0, 0, 0, 0.45)"}}}},[`${t}-success-bg`]:{position:"absolute",insetBlockStart:0,insetInlineStart:0,backgroundColor:e.colorSuccess},[`${t}-text`]:{display:"inline-block",marginInlineStart:e.marginXS,color:e.colorText,lineHeight:1,width:"2em",whiteSpace:"nowrap",textAlign:"start",verticalAlign:"middle",wordBreak:"normal",[r]:{fontSize:e.fontSize},[`&${t}-text-outer`]:{width:"max-content"},[`&${t}-text-outer${t}-text-start`]:{width:"max-content",marginInlineStart:0,marginInlineEnd:e.marginXS}},[`${t}-text-inner`]:{display:"flex",justifyContent:"center",alignItems:"center",width:"100%",height:"100%",marginInlineStart:0,padding:`0 ${(0,A.unit)(e.paddingXXS)}`,[`&${t}-text-start`]:{justifyContent:"start"},[`&${t}-text-end`]:{justifyContent:"end"}},[`&${t}-status-active`]:{[`${t}-bg::before`]:{position:"absolute",inset:0,backgroundColor:e.colorBgContainer,borderRadius:e.lineBorderRadius,opacity:0,animationName:W(),animationDuration:e.progressActiveMotionDuration,animationTimingFunction:e.motionEaseOutQuint,animationIterationCount:"infinite",content:'""'}},[`&${t}-rtl${t}-status-active`]:{[`${t}-bg::before`]:{animationName:W(!0)}},[`&${t}-status-exception`]:{[`${t}-bg`]:{backgroundColor:e.colorError},[`${t}-text`]:{color:e.colorError}},[`&${t}-status-exception ${t}-inner:not(${t}-circle-gradient)`]:{[`${t}-circle-path`]:{stroke:e.colorError}},[`&${t}-status-success`]:{[`${t}-bg`]:{backgroundColor:e.colorSuccess},[`${t}-text`]:{color:e.colorSuccess}},[`&${t}-status-success ${t}-inner:not(${t}-circle-gradient)`]:{[`${t}-circle-path`]:{stroke:e.colorSuccess}}})}})(r),(e=>{let{componentCls:t,iconCls:r}=e;return{[t]:{[`${t}-circle-trail`]:{stroke:e.remainingColor},[`&${t}-circle ${t}-inner`]:{position:"relative",lineHeight:1,backgroundColor:"transparent"},[`&${t}-circle ${t}-text`]:{position:"absolute",insetBlockStart:"50%",insetInlineStart:0,width:"100%",margin:0,padding:0,color:e.circleTextColor,fontSize:e.circleTextFontSize,lineHeight:1,whiteSpace:"normal",textAlign:"center",transform:"translateY(-50%)",[r]:{fontSize:e.circleIconFontSize}},[`${t}-circle&-status-exception`]:{[`${t}-text`]:{color:e.colorError}},[`${t}-circle&-status-success`]:{[`${t}-text`]:{color:e.colorSuccess}}},[`${t}-inline-circle`]:{lineHeight:1,[`${t}-inner`]:{verticalAlign:"bottom"}}}})(r),(e=>{let{componentCls:t}=e;return{[t]:{[`${t}-steps`]:{display:"inline-block","&-outer":{display:"flex",flexDirection:"row",alignItems:"center"},"&-item":{flexShrink:0,minWidth:e.progressStepMinWidth,marginInlineEnd:e.progressStepMarginInlineEnd,backgroundColor:e.remainingColor,transition:`all ${e.motionDurationSlow}`,"&-active":{backgroundColor:e.defaultColor}}}}}})(r),(e=>{let{componentCls:t,iconCls:r}=e;return{[t]:{[`${t}-small&-line, ${t}-small&-line ${t}-text ${r}`]:{fontSize:e.fontSizeSM}}}})(r)]},e=>({circleTextColor:e.colorText,defaultColor:e.colorInfo,remainingColor:e.colorFillSecondary,lineBorderRadius:100,circleTextFontSize:"1em",circleIconFontSize:`${e.fontSize/e.fontSizeSM}em`}));var X=function(e,t){var r={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&0>t.indexOf(o)&&(r[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var a=0,o=Object.getOwnPropertySymbols(e);at.indexOf(o[a])&&Object.prototype.propertyIsEnumerable.call(e,o[a])&&(r[o[a]]=e[o[a]]);return r};let H=e=>{let{prefixCls:r,direction:o,percent:a,size:n,strokeWidth:s,strokeColor:i,strokeLinecap:c="round",children:d,trailColor:u=null,percentPosition:m,success:f}=e,{align:p,type:g}=m,b=i&&"string"!=typeof i?((e,t)=>{let{from:r=P.presetPrimaryColors.blue,to:o=P.presetPrimaryColors.blue,direction:a="rtl"===t?"to left":"to right"}=e,n=X(e,["from","to","direction"]);if(0!==Object.keys(n).length){let e,t=(e=[],Object.keys(n).forEach(t=>{let r=Number.parseFloat(t.replace(/%/g,""));Number.isNaN(r)||e.push({key:r,value:n[t]})}),(e=e.sort((e,t)=>e.key-t.key)).map(({key:e,value:t})=>`${t} ${e}%`).join(", ")),r=`linear-gradient(${a}, ${t})`;return{background:r,[z]:r}}let s=`linear-gradient(${a}, ${r}, ${o})`;return{background:s,[z]:s}})(i,o):{[z]:i,background:i},h="square"===c||"butt"===c?0:void 0,[x,v]=F(null!=n?n:[-1,s||("small"===n?6:8)],"line",{strokeWidth:s}),C=Object.assign(Object.assign({width:`${I(a)}%`,height:v,borderRadius:h},b),{[L]:I(a)/100}),y=M(e),k={width:`${I(y)}%`,height:v,borderRadius:h,backgroundColor:null==f?void 0:f.strokeColor},w=t.createElement("div",{className:`${r}-inner`,style:{backgroundColor:u||void 0,borderRadius:h}},t.createElement("div",{className:(0,l.default)(`${r}-bg`,`${r}-bg-${g}`),style:C},"inner"===g&&d),void 0!==y&&t.createElement("div",{className:`${r}-success-bg`,style:k})),E="outer"===g&&"start"===p,T="outer"===g&&"end"===p;return"outer"===g&&"center"===p?t.createElement("div",{className:`${r}-layout-bottom`},w,d):t.createElement("div",{className:`${r}-outer`,style:{width:x<0?"100%":x}},E&&d,w,T&&d)},K=e=>{let{size:r,steps:o,rounding:a=Math.round,percent:n=0,strokeWidth:s=8,strokeColor:i,trailColor:c=null,prefixCls:d,children:u}=e,m=a(n/100*o),[f,p]=F(null!=r?r:["small"===r?2:14,s],"step",{steps:o,strokeWidth:s}),g=f/o,b=Array.from({length:o});for(let e=0;et.indexOf(o)&&(r[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var a=0,o=Object.getOwnPropertySymbols(e);at.indexOf(o[a])&&Object.prototype.propertyIsEnumerable.call(e,o[a])&&(r[o[a]]=e[o[a]]);return r};let V=["normal","exception","active","success"],Y=t.forwardRef((e,d)=>{let u,{prefixCls:m,className:f,rootClassName:p,steps:g,strokeColor:b,percent:h=0,size:x="default",showInfo:v=!0,type:C="line",status:y,format:k,style:w,percentPosition:E={}}=e,T=G(e,["prefixCls","className","rootClassName","steps","strokeColor","percent","size","showInfo","type","status","format","style","percentPosition"]),{align:N="end",type:S="outer"}=E,$=Array.isArray(b)?b[0]:b,P="string"==typeof b||Array.isArray(b)?b:void 0,O=t.useMemo(()=>{if($){let e="string"==typeof $?$:Object.values($)[0];return new r.FastColor(e).isLight()}return!1},[b]),A=t.useMemo(()=>{var t,r;let o=M(e);return Number.parseInt(void 0!==o?null==(t=null!=o?o:0)?void 0:t.toString():null==(r=null!=h?h:0)?void 0:r.toString(),10)},[h,e.success,e.successPercent]),B=t.useMemo(()=>!V.includes(y)&&A>=100?"success":y||"normal",[y,A]),{getPrefixCls:j,direction:D,progress:z}=t.useContext(c.ConfigContext),L=j("progress",m),[W,X,Y]=_(L),U="line"===C,q=U&&!g,Q=t.useMemo(()=>{let r;if(!v)return null;let i=M(e),c=k||(e=>`${e}%`),d=U&&O&&"inner"===S;return"inner"===S||k||"exception"!==B&&"success"!==B?r=c(I(h),I(i)):"exception"===B?r=U?t.createElement(n.default,null):t.createElement(s.default,null):"success"===B&&(r=U?t.createElement(o.default,null):t.createElement(a.default,null)),t.createElement("span",{className:(0,l.default)(`${L}-text`,{[`${L}-text-bright`]:d,[`${L}-text-${N}`]:q,[`${L}-text-${S}`]:q}),title:"string"==typeof r?r:void 0},r)},[v,h,A,B,C,L,k]);"line"===C?u=g?t.createElement(K,Object.assign({},e,{strokeColor:P,prefixCls:L,steps:"object"==typeof g?g.count:g}),Q):t.createElement(H,Object.assign({},e,{strokeColor:$,prefixCls:L,direction:D,percentPosition:{align:N,type:S}}),Q):("circle"===C||"dashboard"===C)&&(u=t.createElement(R,Object.assign({},e,{strokeColor:$,prefixCls:L,progressStatus:B}),Q));let Z=(0,l.default)(L,`${L}-status-${B}`,{[`${L}-${"dashboard"===C&&"circle"||C}`]:"line"!==C,[`${L}-inline-circle`]:"circle"===C&&F(x,"circle")[0]<=20,[`${L}-line`]:q,[`${L}-line-align-${N}`]:q,[`${L}-line-position-${S}`]:q,[`${L}-steps`]:g,[`${L}-show-info`]:v,[`${L}-${x}`]:"string"==typeof x,[`${L}-rtl`]:"rtl"===D},null==z?void 0:z.className,f,p,X,Y);return W(t.createElement("div",Object.assign({ref:d,style:Object.assign(Object.assign({},null==z?void 0:z.style),w),className:Z,role:"progressbar","aria-valuenow":A,"aria-valuemin":0,"aria-valuemax":100},(0,i.default)(T,["trailColor","strokeWidth","width","gapDegree","gapPosition","strokeLinecap","success","successPercent"])),u))});e.s(["default",0,Y],309821)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/007c8g8hmd9qz.js b/litellm/proxy/_experimental/out/_next/static/chunks/007c8g8hmd9qz.js new file mode 100644 index 00000000000..fe0f6e8e79a --- /dev/null +++ b/litellm/proxy/_experimental/out/_next/static/chunks/007c8g8hmd9qz.js @@ -0,0 +1 @@ +(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,510674,e=>{"use strict";var t=e.i(266027),l=e.i(243652),a=e.i(602869),s=e.i(431703),i=e.i(135214),r=e.i(708347);let n=(0,l.createQueryKeys)("projects"),o=[...r.all_admin_roles,...r.internalUserRoles],d=async e=>{let t=(0,a.getProxyBaseUrl)(),l=`${t}/project/list`,i=await fetch(l,{method:"GET",headers:{[(0,a.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!i.ok){let e=await i.json(),t=(0,s.deriveErrorMessage)(e);throw(0,a.handleError)(t),Error(t)}return i.json()};e.s(["projectKeys",0,n,"useProjects",0,()=>{let{accessToken:e,userRole:l}=(0,i.default)();return(0,t.useQuery)({queryKey:n.list({}),queryFn:async()=>d(e),enabled:!!e&&o.includes(l)})}])},207082,e=>{"use strict";var t=e.i(619273),l=e.i(266027),a=e.i(243652),s=e.i(602869),i=e.i(431703),r=e.i(135214);let n=(0,a.createQueryKeys)("keys"),o=async(e,t,l,a={})=>{try{let r=(0,s.getProxyBaseUrl)(),n=new URLSearchParams(Object.entries({team_id:a.teamID,project_id:a.projectID,agent_id:a.agentID,organization_id:a.organizationID,key_alias:a.selectedKeyAlias,key_hash:a.keyHash,user_id:a.userID,page:t,size:l,sort_by:a.sortBy,sort_order:a.sortOrder,expand:a.expand,status:a.status,return_full_object:"true",include_team_keys:"true",include_created_by_keys:"true",substring_matching:"true"}).filter(([,e])=>null!=e).map(([e,t])=>[e,String(t)])),o=`${r?`${r}/key/list`:"/key/list"}?${n}`,d=await fetch(o,{method:"GET",headers:{[(0,s.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!d.ok){let e=await d.json(),t=(0,i.deriveErrorMessage)(e);throw(0,s.handleError)(t),Error(t)}return await d.json()}catch(e){throw console.error("Failed to list keys:",e),e}},d=(0,a.createQueryKeys)("deletedKeys");e.s(["keyKeys",0,n,"useDeletedKeys",0,(e,a,s={})=>{let{accessToken:i}=(0,r.default)();return(0,l.useQuery)({queryKey:d.list({page:e,limit:a,...s}),queryFn:async()=>await o(i,e,a,{...s,status:"deleted"}),enabled:!!i,staleTime:3e4,placeholderData:t.keepPreviousData})},"useKeys",0,(e,a,s={},i=!0)=>{let{accessToken:d}=(0,r.default)();return(0,l.useQuery)({queryKey:n.list({page:e,limit:a,...s}),queryFn:async()=>await o(d,e,a,s),enabled:!!d&&i,staleTime:3e4,placeholderData:t.keepPreviousData})}])},109034,e=>{"use strict";var t=e.i(266027),l=e.i(243652),a=e.i(602869),s=e.i(135214);let i=(0,l.createQueryKeys)("tags");e.s(["useTags",0,()=>{let{accessToken:e,userId:l,userRole:r}=(0,s.default)();return(0,t.useQuery)({queryKey:i.list({}),queryFn:async()=>await (0,a.tagListCall)(e),enabled:!!(e&&l&&r)})}])},309426,e=>{"use strict";var t=e.i(290571),l=e.i(444755),a=e.i(673706),s=e.i(271645),i=e.i(46757);let r=(0,a.makeClassName)("Col"),n=s.default.forwardRef((e,a)=>{let n,o,d,c,{numColSpan:u=1,numColSpanSm:m,numColSpanMd:g,numColSpanLg:p,children:h,className:x}=e,y=(0,t.__rest)(e,["numColSpan","numColSpanSm","numColSpanMd","numColSpanLg","children","className"]),f=(e,t)=>e&&Object.keys(t).includes(String(e))?t[e]:"";return s.default.createElement("div",Object.assign({ref:a,className:(0,l.tremorTwMerge)(r("root"),(n=f(u,i.colSpan),o=f(m,i.colSpanSm),d=f(g,i.colSpanMd),c=f(p,i.colSpanLg),(0,l.tremorTwMerge)(n,o,d,c)),x)},y),h)});n.displayName="Col",e.s(["Col",0,n],309426)},552130,e=>{"use strict";var t=e.i(843476),l=e.i(271645),a=e.i(199133),s=e.i(602869);e.s(["default",0,({onChange:e,value:i,className:r,accessToken:n,placeholder:o="Select agents",disabled:d=!1})=>{let[c,u]=(0,l.useState)([]),[m,g]=(0,l.useState)([]),[p,h]=(0,l.useState)(!1);(0,l.useEffect)(()=>{(async()=>{if(n){h(!0);try{let e=await (0,s.getAgentsList)(n),t=e?.agents||[];u(t);let l=new Set;t.forEach(e=>{let t=e.agent_access_groups;t&&Array.isArray(t)&&t.forEach(e=>l.add(e))}),g(Array.from(l))}catch(e){console.error("Error fetching agents:",e)}finally{h(!1)}}})()},[n]);let x=[...m.map(e=>({label:e,value:`group:${e}`,isAccessGroup:!0,searchText:`${e} Access Group`})),...c.map(e=>({label:`${e.agent_name||e.agent_id}`,value:e.agent_id,isAccessGroup:!1,searchText:`${e.agent_name||e.agent_id} ${e.agent_id} Agent`}))],y=[...i?.agents||[],...(i?.accessGroups||[]).map(e=>`group:${e}`)];return(0,t.jsx)("div",{children:(0,t.jsx)(a.Select,{mode:"multiple",placeholder:o,onChange:t=>{e({agents:t.filter(e=>!e.startsWith("group:")),accessGroups:t.filter(e=>e.startsWith("group:")).map(e=>e.replace("group:",""))})},value:y,loading:p,className:r,allowClear:!0,showSearch:!0,style:{width:"100%"},disabled:d,filterOption:(e,t)=>(x.find(e=>e.value===t?.value)?.searchText||"").toLowerCase().includes(e.toLowerCase()),children:x.map(e=>(0,t.jsx)(a.Select.Option,{value:e.value,label:e.label,children:(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,t.jsx)("span",{style:{display:"inline-block",width:8,height:8,borderRadius:"50%",background:e.isAccessGroup?"#52c41a":"#722ed1",flexShrink:0}}),(0,t.jsx)("span",{style:{flex:1},children:e.label}),(0,t.jsx)("span",{style:{color:e.isAccessGroup?"#52c41a":"#722ed1",fontSize:"12px",fontWeight:500,opacity:.8},children:e.isAccessGroup?"Access Group":"Agent"})]})},e.value))})})}])},557662,e=>{"use strict";let t={src:e.i(196361).default,width:823,height:807,blurWidth:8,blurHeight:8,blurDataURL:"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAICAYAAADED76LAAABCUlEQVR42k2Ov0sCYRjH3/f09c68NOuiLg+NvMM6qIaIhgKDlgbBBiH7ARbkFAr+wEFwUBzUSRwUN3+Am4Kbg4sIIg4iOugiguDm5F/gvaLiF57l83yf5/sFYC0VQdJJnS0bObUkSCgnwa4ggPD94O57KkYX46vw/HVftECMNzKRJ2JL8A+KekelfO6s1Y3utl6hNayWahmlznIfhQbv6V4oGP6aOrvtCIFRnH1LKQmkBC7G7BtehmZWzY0NRxEAEo7Dhz/MvrT3P6BvCk5irDVJQURhAx5aKpzh7Pkm7+2BZ1p4YeT0MYIy5Dx6/P+UrvAXFml0TyqjeVtUytsrGX6rac6ew+YNXwKfsTPy4XOyEQAAAABJRU5ErkJggg=="},l={src:e.i(614148).default,width:600,height:450,blurWidth:0,blurHeight:0},a={src:e.i(858236).default,width:200,height:200,blurWidth:8,blurHeight:8,blurDataURL:"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAICAIAAABLbSncAAAAqklEQVR42mXOzQqCQBQF4NG8PVKLalNRrxW01EgUghZm4Tu0aV3gopBCaDDoh8LMyubaCzQzLj2c1fk2h/zwyZvjI8NTmtMXHj94yfBG5JqE0WrsDWyv70eLGOkbrwJotG316lDVeJvd2pouE3YW4M4nAEBkADTD1eOvBNPUFUUpQAMwplbK7gJsa6hWVG58bXTam0OAmAjYBT63kWk4Myeke2TiJynulvsHOZp6y2XrD90AAAAASUVORK5CYII="},s={src:e.i(508296).default,width:180,height:180,blurWidth:8,blurHeight:8,blurDataURL:"data:image/jpeg;base64,/9j/4AAQSkZJRgABAgAAAQABAAD/wAARCAAIAAgDAREAAhEBAxEB/9sAQwAKBwcIBwYKCAgICwoKCw4YEA4NDQ4dFRYRGCMfJSQiHyIhJis3LyYpNCkhIjBBMTQ5Oz4+PiUuRElDPEg3PT47/9sAQwEKCwsODQ4cEBAcOygiKDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDvXivVvITItyZVvSwKFmDRbjjPYDB/SutONn6fiaaH/9k="},i={src:e.i(324755).default,width:48,height:48,blurWidth:0,blurHeight:0},r={src:e.i(475151).default,width:14,height:16,blurWidth:0,blurHeight:0},n={src:e.i(274286).default,width:256,height:256,blurWidth:8,blurHeight:8,blurDataURL:"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAICAYAAADED76LAAAA/ElEQVR42m3Pz0vCUADA8ed7a3uBjb0sx5C1Ri1oIDJSKEdJgyEFtbwFgScpsGNR1CmyS0Ho0ZOggv+A4F3B30f9HwRRwYMICupNPPg5fa9fANazLQtCtC0jdGbSdFSmN6+Ry/tIHd/+w52jOwyRCDRZL+UJ6eREdXauR0dq8HtiBl7mD25r+MtyLfBO+Fpm19UXTsJ17LnPWhyf+rNvVWOiu38j+Zrgk/CNuHDYtfsiRUa1khYnpH9Y0viQtIGxf1oGfsVoFxzOYULR51f+p6lifo09wdjs0hvuvbKkAhDF7GkUFYpgnLhg8DPtOAghOfAGiWRs2KBz/dqKBVIdOzeF2+/ZAAAAAElFTkSuQmCC"},o={src:e.i(436494).default,width:200,height:200,blurWidth:8,blurHeight:8,blurDataURL:"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAICAIAAABLbSncAAAAnElEQVR42oXOsQqCUACF4ftWvUFbBFFzQSVRLQ5RmRDkUJFTIUFNEQgNDWFTNURjgyAiOgiiCF7FQRCcVFQQJ1H4t284B1gwzA0UAS/A2+N7pp8nmrne3yynJ6Cp3mBBoARZbfcqjVZ3tkSwlSw7QFHc5gitI+M1delM8LhafyhKNjCN4PPjsR2Fk8f59jDd7JnXHxp+Oh5zVsmrCGlHlzZm+jq8AAAAAElFTkSuQmCC"},d={src:e.i(204086).default,width:48,height:48,blurWidth:8,blurHeight:8,blurDataURL:"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAICAYAAADED76LAAAAhElEQVR42oWPuw0DIRBEr6g7aIGQAAQSEiTk1EAHVILogIQAQUPOxoKT5cSfYDbYedqdOc7zfFzXhU9a3vHNfGkDhBB472GMQQgB1lo45/Z+A4wx9N6Rc8acE7VWpJRuYI0YI1prW6UUjDHAOb9fLEAIAaXUPi2lhNYalNJ3hp8h/9V8AqCAe6iqrOaAAAAAAElFTkSuQmCC"},c={src:e.i(531150).default,width:48,height:48,blurWidth:8,blurHeight:8,blurDataURL:"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAICAYAAADED76LAAAA40lEQVR42lWOvesBcQDGz0/9VmUl/4lSyqaUic5gM0jKSBlISgaXwWCwGc7gFPKeIikUMXAldec9Wdx5uft+v3KFMzzL8/k89WAIIUweyLG6W9tRFNmKGUHw9wMfAvgfDBfWddWbv5aNE5Gtmr9LiBSNzgq3uQv7UKzY2tZ9uXvfl/4IxxOvyeZn/niyQkWJJkXTjB7ez2oJHk6cNpzo5ohUjeTHRICnSScEQPliGIKistef23FPYUNSo6CwJHGw6xgQggpJEBYZ12UQiY2njOnCPVSv528oCWDbNopMySIv5XkCtum3l9/HqzEAAAAASUVORK5CYII="},u=[{id:"arize",displayName:"Arize",logo:t.src,supports_key_team_logging:!0,dynamic_params:{arize_api_key:"password",arize_space_id:"password"},description:"Arize Logging Integration"},{id:"braintrust",displayName:"Braintrust",logo:a.src,supports_key_team_logging:!1,dynamic_params:{braintrust_api_key:"password",braintrust_project_name:"text"},description:"Braintrust Logging Integration"},{id:"custom_callback_api",displayName:"Custom Callback API",supports_key_team_logging:!0,dynamic_params:{custom_callback_api_url:"text",custom_callback_api_headers:"text"},description:"Custom Callback API Logging Integration"},{id:"galileo",displayName:"Galileo",logo:i.src,supports_key_team_logging:!1,dynamic_params:{GALILEO_API_KEY:"password",GALILEO_PROJECT_ID:"text",GALILEO_LOG_STREAM_ID:"text",GALILEO_BASE_URL:"text",GALILEO_USERNAME:"text",GALILEO_PASSWORD:"password"},description:"Galileo AI Observability Integration"},{id:"datadog",displayName:"Datadog",logo:s.src,supports_key_team_logging:!1,dynamic_params:{dd_api_key:"password",dd_site:"text"},description:"Datadog Logging Integration"},{id:"lago",displayName:"Lago",logo:r.src,supports_key_team_logging:!1,dynamic_params:{lago_api_url:"text",lago_api_key:"password"},description:"Lago Billing Logging Integration"},{id:"langfuse",displayName:"Langfuse",logo:n.src,supports_key_team_logging:!0,dynamic_params:{langfuse_public_key:"text",langfuse_secret_key:"password",langfuse_host:"text"},description:"Langfuse v2 Logging Integration"},{id:"langfuse_otel",displayName:"Langfuse OTEL",logo:n.src,supports_key_team_logging:!0,dynamic_params:{langfuse_public_key:"text",langfuse_secret_key:"password",langfuse_host:"text"},description:"Langfuse v3 OTEL Logging Integration"},{id:"langsmith",displayName:"LangSmith",logo:o.src,supports_key_team_logging:!0,dynamic_params:{langsmith_api_key:"password",langsmith_project:"text",langsmith_base_url:"text",langsmith_sampling_rate:"number"},description:"Langsmith Logging Integration"},{id:"openmeter",displayName:"OpenMeter",logo:d.src,supports_key_team_logging:!1,dynamic_params:{openmeter_api_key:"password",openmeter_base_url:"text"},description:"OpenMeter Logging Integration"},{id:"otel",displayName:"Open Telemetry",logo:c.src,supports_key_team_logging:!1,dynamic_params:{otel_endpoint:"text",otel_headers:"text"},description:"OpenTelemetry Logging Integration"},{id:"s3",displayName:"S3",logo:l.src,supports_key_team_logging:!1,dynamic_params:{s3_bucket_name:"text",aws_access_key_id:"password",aws_secret_access_key:"password",aws_region:"text"},description:"S3 Bucket (AWS) Logging Integration"},{id:"SQS",displayName:"SQS",logo:l.src,supports_key_team_logging:!1,dynamic_params:{sqs_queue_url:"text",aws_access_key_id:"password",aws_secret_access_key:"password",aws_region:"text"},description:"SQS Queue (AWS) Logging Integration"}],m=u.reduce((e,t)=>(e[t.displayName]=t,e),{}),g=u.reduce((e,t)=>(e[t.displayName]=t.id,e),{}),p=u.reduce((e,t)=>(e[t.id]=t.displayName,e),{});e.s(["callbackInfo",0,m,"callback_map",0,g,"mapDisplayToInternalNames",0,e=>e.map(e=>g[e]||e),"mapInternalToDisplayNames",0,e=>e.map(e=>p[e]||e),"reverse_callback_map",0,p],557662)},9314,645526,e=>{"use strict";var t=e.i(843476),l=e.i(199133),a=e.i(981339);e.i(247167);var s=e.i(931067),i=e.i(271645);let r={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M824.2 699.9a301.55 301.55 0 00-86.4-60.4C783.1 602.8 812 546.8 812 484c0-110.8-92.4-201.7-203.2-200-109.1 1.7-197 90.6-197 200 0 62.8 29 118.8 74.2 155.5a300.95 300.95 0 00-86.4 60.4C345 754.6 314 826.8 312 903.8a8 8 0 008 8.2h56c4.3 0 7.9-3.4 8-7.7 1.9-58 25.4-112.3 66.7-153.5A226.62 226.62 0 01612 684c60.9 0 118.2 23.7 161.3 66.8C814.5 792 838 846.3 840 904.3c.1 4.3 3.7 7.7 8 7.7h56a8 8 0 008-8.2c-2-77-33-149.2-87.8-203.9zM612 612c-34.2 0-66.4-13.3-90.5-37.5a126.86 126.86 0 01-37.5-91.8c.3-32.8 13.4-64.5 36.3-88 24-24.6 56.1-38.3 90.4-38.7 33.9-.3 66.8 12.9 91 36.6 24.8 24.3 38.4 56.8 38.4 91.4 0 34.2-13.3 66.3-37.5 90.5A127.3 127.3 0 01612 612zM361.5 510.4c-.9-8.7-1.4-17.5-1.4-26.4 0-15.9 1.5-31.4 4.3-46.5.7-3.6-1.2-7.3-4.5-8.8-13.6-6.1-26.1-14.5-36.9-25.1a127.54 127.54 0 01-38.7-95.4c.9-32.1 13.8-62.6 36.3-85.6 24.7-25.3 57.9-39.1 93.2-38.7 31.9.3 62.7 12.6 86 34.4 7.9 7.4 14.7 15.6 20.4 24.4 2 3.1 5.9 4.4 9.3 3.2 17.6-6.1 36.2-10.4 55.3-12.4 5.6-.6 8.8-6.6 6.3-11.6-32.5-64.3-98.9-108.7-175.7-109.9-110.9-1.7-203.3 89.2-203.3 199.9 0 62.8 28.9 118.8 74.2 155.5-31.8 14.7-61.1 35-86.5 60.4-54.8 54.7-85.8 126.9-87.8 204a8 8 0 008 8.2h56.1c4.3 0 7.9-3.4 8-7.7 1.9-58 25.4-112.3 66.7-153.5 29.4-29.4 65.4-49.8 104.7-59.7 3.9-1 6.5-4.7 6-8.7z"}}]},name:"team",theme:"outlined"};var n=e.i(9583),o=i.forwardRef(function(e,t){return i.createElement(n.default,(0,s.default)({},e,{ref:t,icon:r}))});e.s(["TeamOutlined",0,o],645526);var d=e.i(599724),c=e.i(263147);e.s(["default",0,({value:e,onChange:s,placeholder:i="Select access groups",disabled:r=!1,style:n,className:u,showLabel:m=!1,labelText:g="Access Group",allowClear:p=!0})=>{let{data:h,isLoading:x,isError:y}=(0,c.useAccessGroups)();if(x)return(0,t.jsxs)("div",{children:[m&&(0,t.jsxs)(d.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(o,{className:"mr-2"})," ",g]}),(0,t.jsx)(a.Skeleton.Input,{active:!0,block:!0,style:{height:32,...n}})]});let f=(h??[]).map(e=>({label:(0,t.jsxs)("span",{children:[(0,t.jsx)("span",{className:"font-medium",children:e.access_group_name})," ",(0,t.jsxs)("span",{className:"text-gray-400 text-xs",children:["(",e.access_group_id,")"]})]}),value:e.access_group_id,selectedLabel:e.access_group_name,searchText:`${e.access_group_name} ${e.access_group_id}`}));return(0,t.jsxs)("div",{children:[m&&(0,t.jsxs)(d.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(o,{className:"mr-2"})," ",g]}),(0,t.jsx)(l.Select,{mode:"multiple",value:e,placeholder:i,onChange:s,disabled:r,allowClear:p,showSearch:!0,style:{width:"100%",...n},className:`rounded-md ${u??""}`,notFoundContent:y?(0,t.jsx)("span",{className:"text-red-500",children:"Failed to load access groups"}):"No access groups found",filterOption:(e,t)=>(f.find(e=>e.value===t?.value)?.searchText??"").toLowerCase().includes(e.toLowerCase()),optionLabelProp:"selectedLabel",options:f.map(e=>({label:e.label,value:e.value,selectedLabel:e.selectedLabel}))})]})}],9314)},392110,e=>{"use strict";var t=e.i(843476),l=e.i(271645),a=e.i(199133),s=e.i(592968),i=e.i(312361),r=e.i(790848),n=e.i(536916),o=e.i(808613),d=e.i(827252),c=e.i(779241);let{Option:u}=a.Select;e.s(["default",0,({form:e,autoRotationEnabled:m,onAutoRotationChange:g,rotationInterval:p,onRotationIntervalChange:h,isCreateMode:x=!1,neverExpire:y=!1,onNeverExpireChange:f})=>{let b=p&&!["7d","30d","90d","180d","365d"].includes(p),[j,_]=(0,l.useState)(b),[v,A]=(0,l.useState)(b?p:"");return(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Key Expiry Settings"}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Expire Key"}),(0,t.jsx)(s.Tooltip,{title:"Set when this key should expire. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days). Leave empty to keep the current expiry unchanged.",children:(0,t.jsx)(d.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})}),!x&&f&&(0,t.jsx)(n.Checkbox,{checked:y,onChange:t=>{let l=t.target.checked;f(l),l&&(e&&"function"==typeof e.setFieldValue?e.setFieldValue("duration",""):e&&"function"==typeof e.setFieldsValue&&e.setFieldsValue({duration:""}))},className:"ml-2 text-sm font-normal text-gray-600",children:"Never Expire"})]}),(0,t.jsx)(o.Form.Item,{name:"duration",noStyle:!0,initialValue:"",children:(0,t.jsx)(c.TextInput,{placeholder:x?"e.g., 30d or leave empty to never expire":"e.g., 30d",className:"w-full",disabled:!x&&y})})]})]}),(0,t.jsx)(i.Divider,{}),(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Auto-Rotation Settings"}),(0,t.jsxs)("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Enable Auto-Rotation"}),(0,t.jsx)(s.Tooltip,{title:"Key will automatically regenerate at the specified interval for enhanced security.",children:(0,t.jsx)(d.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})})]}),(0,t.jsx)(r.Switch,{checked:m,onChange:g,size:"default",className:m?"":"bg-gray-400"})]}),m&&(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Rotation Interval"}),(0,t.jsx)(s.Tooltip,{title:"How often the key should be automatically rotated. Choose the interval that best fits your security requirements.",children:(0,t.jsx)(d.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)(a.Select,{value:j?"custom":p,onChange:e=>{"custom"===e?_(!0):(_(!1),A(""),h(e))},className:"w-full",placeholder:"Select interval",children:[(0,t.jsx)(u,{value:"7d",children:"7 days"}),(0,t.jsx)(u,{value:"30d",children:"30 days"}),(0,t.jsx)(u,{value:"90d",children:"90 days"}),(0,t.jsx)(u,{value:"180d",children:"180 days"}),(0,t.jsx)(u,{value:"365d",children:"365 days"}),(0,t.jsx)(u,{value:"custom",children:"Custom interval"})]}),j&&(0,t.jsxs)("div",{className:"space-y-1",children:[(0,t.jsx)(c.TextInput,{value:v,onChange:e=>{let t=e.target.value;A(t),h(t)},placeholder:"e.g., 1s, 5m, 2h, 14d"}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Supported formats: seconds (s), minutes (m), hours (h), days (d)"})]})]})]})]}),m&&(0,t.jsx)("div",{className:"bg-blue-50 p-3 rounded-md text-sm text-blue-700",children:"When rotation occurs, you'll receive a notification with the new key. The old key will be deactivated after a brief grace period."})]})]})}])},533882,e=>{"use strict";var t=e.i(843476),l=e.i(271645),a=e.i(250980),s=e.i(797672),i=e.i(68155),r=e.i(304967),n=e.i(629569),o=e.i(599724),d=e.i(269200),c=e.i(427612),u=e.i(64848),m=e.i(942232),g=e.i(496020),p=e.i(977572),h=e.i(992619),x=e.i(727749);e.s(["default",0,({accessToken:e,initialModelAliases:y={},onAliasUpdate:f,showExampleConfig:b=!0})=>{let[j,_]=(0,l.useState)([]),[v,A]=(0,l.useState)({aliasName:"",targetModel:""}),[w,k]=(0,l.useState)(null);(0,l.useEffect)(()=>{_(Object.entries(y).map(([e,t],l)=>({id:`${l}-${e}`,aliasName:e,targetModel:t})))},[y]);let N=()=>{if(!w)return;if(!w.aliasName||!w.targetModel)return void x.default.fromBackend("Please provide both alias name and target model");if(j.some(e=>e.id!==w.id&&e.aliasName===w.aliasName))return void x.default.fromBackend("An alias with this name already exists");let e=j.map(e=>e.id===w.id?w:e);_(e),k(null);let t={};e.forEach(e=>{t[e.aliasName]=e.targetModel}),f&&f(t),x.default.success("Alias updated successfully")},S=()=>{k(null)},C=j.reduce((e,t)=>(e[t.aliasName]=t.targetModel,e),{});return(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsxs)("div",{className:"mb-6",children:[(0,t.jsx)(o.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Add New Alias"}),(0,t.jsxs)("div",{className:"grid grid-cols-3 gap-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Alias Name"}),(0,t.jsx)("input",{type:"text",value:v.aliasName,onChange:e=>A({...v,aliasName:e.target.value}),placeholder:"e.g., gpt-4o",className:"w-full px-3 py-2 border border-gray-300 rounded-md text-sm"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Target Model"}),(0,t.jsx)(h.default,{accessToken:e,value:v.targetModel,placeholder:"Select target model",onChange:e=>A({...v,targetModel:e}),showLabel:!1})]}),(0,t.jsx)("div",{className:"flex items-end",children:(0,t.jsxs)("button",{onClick:()=>{if(!v.aliasName||!v.targetModel)return void x.default.fromBackend("Please provide both alias name and target model");if(j.some(e=>e.aliasName===v.aliasName))return void x.default.fromBackend("An alias with this name already exists");let e=[...j,{id:`${Date.now()}-${v.aliasName}`,aliasName:v.aliasName,targetModel:v.targetModel}];_(e),A({aliasName:"",targetModel:""});let t={};e.forEach(e=>{t[e.aliasName]=e.targetModel}),f&&f(t),x.default.success("Alias added successfully")},disabled:!v.aliasName||!v.targetModel,className:`flex items-center px-4 py-2 rounded-md text-sm ${!v.aliasName||!v.targetModel?"bg-gray-300 text-gray-500 cursor-not-allowed":"bg-green-600 text-white hover:bg-green-700"}`,children:[(0,t.jsx)(a.PlusCircleIcon,{className:"w-4 h-4 mr-1"}),"Add Alias"]})})]})]}),(0,t.jsx)(o.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Manage Existing Aliases"}),(0,t.jsx)("div",{className:"rounded-lg custom-border relative mb-6",children:(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(d.Table,{className:"[&_td]:py-0.5 [&_th]:py-1",children:[(0,t.jsx)(c.TableHead,{children:(0,t.jsxs)(g.TableRow,{children:[(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Alias Name"}),(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Target Model"}),(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Actions"})]})}),(0,t.jsxs)(m.TableBody,{children:[j.map(l=>(0,t.jsx)(g.TableRow,{className:"h-8",children:w&&w.id===l.id?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(p.TableCell,{className:"py-0.5",children:(0,t.jsx)("input",{type:"text",value:w.aliasName,onChange:e=>k({...w,aliasName:e.target.value}),className:"w-full px-2 py-1 border border-gray-300 rounded-md text-sm"})}),(0,t.jsx)(p.TableCell,{className:"py-0.5",children:(0,t.jsx)(h.default,{accessToken:e,value:w.targetModel,onChange:e=>k({...w,targetModel:e}),showLabel:!1,style:{height:"32px"}})}),(0,t.jsx)(p.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:N,className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:"Save"}),(0,t.jsx)("button",{onClick:S,className:"text-xs bg-gray-50 text-gray-600 px-2 py-1 rounded-sm hover:bg-gray-100",children:"Cancel"})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(p.TableCell,{className:"py-0.5 text-sm text-gray-900",children:l.aliasName}),(0,t.jsx)(p.TableCell,{className:"py-0.5 text-sm text-gray-500",children:l.targetModel}),(0,t.jsx)(p.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:()=>{k({...l})},className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:(0,t.jsx)(s.PencilIcon,{className:"w-3 h-3"})}),(0,t.jsx)("button",{onClick:()=>{var e;let t,a;return e=l.id,_(t=j.filter(t=>t.id!==e)),a={},void(t.forEach(e=>{a[e.aliasName]=e.targetModel}),f&&f(a),x.default.success("Alias deleted successfully"))},className:"text-xs bg-red-50 text-red-600 px-2 py-1 rounded-sm hover:bg-red-100",children:(0,t.jsx)(i.TrashIcon,{className:"w-3 h-3"})})]})})]})},l.id)),0===j.length&&(0,t.jsx)(g.TableRow,{children:(0,t.jsx)(p.TableCell,{colSpan:3,className:"py-0.5 text-sm text-gray-500 text-center",children:"No aliases added yet. Add a new alias above."})})]})]})})}),b&&(0,t.jsxs)(r.Card,{children:[(0,t.jsx)(n.Title,{className:"mb-4",children:"Configuration Example"}),(0,t.jsx)(o.Text,{className:"text-gray-600 mb-4",children:"Here's how your current aliases would look in the config:"}),(0,t.jsx)("div",{className:"bg-gray-100 rounded-lg p-4 font-mono text-sm",children:(0,t.jsxs)("div",{className:"text-gray-700",children:["model_aliases:",0===Object.keys(C).length?(0,t.jsxs)("span",{className:"text-gray-500",children:[(0,t.jsx)("br",{}),"  # No aliases configured yet"]}):Object.entries(C).map(([e,l])=>(0,t.jsxs)("span",{children:[(0,t.jsx)("br",{}),'  "',e,'": "',l,'"']},e))]})})]})]})}])},844565,e=>{"use strict";var t=e.i(843476),l=e.i(271645),a=e.i(199133),s=e.i(602869);e.s(["default",0,({onChange:e,value:i,className:r,accessToken:n,placeholder:o="Select pass through routes",disabled:d=!1,teamId:c})=>{let[u,m]=(0,l.useState)([]),[g,p]=(0,l.useState)(!1);return(0,l.useEffect)(()=>{(async()=>{if(n){p(!0);try{let e=await (0,s.getPassThroughEndpointsCall)(n,c);if(e.endpoints){let t=e.endpoints.flatMap(e=>{let t=e.path,l=e.methods;return l&&l.length>0?l.map(e=>({label:`${e} ${t}`,value:t})):[{label:t,value:t}]});m(t)}}catch(e){console.error("Error fetching pass through routes:",e)}finally{p(!1)}}})()},[n,c]),(0,t.jsx)(a.Select,{mode:"tags",placeholder:o,onChange:e,value:i,loading:g,className:r,allowClear:!0,options:u,optionFilterProp:"label",showSearch:!0,style:{width:"100%"},disabled:d})}])},810757,477386,e=>{"use strict";var t=e.i(271645);let l=t.forwardRef(function(e,l){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:l},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z"}),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15 12a3 3 0 11-6 0 3 3 0 016 0z"}))});e.s(["CogIcon",0,l],810757);let a=t.forwardRef(function(e,l){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:l},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M18.364 18.364A9 9 0 005.636 5.636m12.728 12.728A9 9 0 015.636 5.636m12.728 12.728L5.636 5.636"}))});e.s(["BanIcon",0,a],477386)},266484,e=>{"use strict";var t=e.i(843476),l=e.i(199133),a=e.i(592968),s=e.i(312361),i=e.i(827252),r=e.i(994388),n=e.i(304967),o=e.i(779241),d=e.i(988297),c=e.i(68155),u=e.i(810757),m=e.i(477386),g=e.i(557662),p=e.i(174553),h=e.i(435451);let{Option:x}=l.Select;e.s(["default",0,({value:e=[],onChange:y,disabledCallbacks:f=[],onDisabledCallbacksChange:b})=>{let j=Object.entries(g.callbackInfo).filter(([e,t])=>t.supports_key_team_logging).map(([e,t])=>e),_=Object.keys(g.callbackInfo),v=e=>{y?.(e)},A=(t,l,a)=>{let s=[...e];if("callback_name"===l){let e=g.callback_map[a]||a;s[t]={...s[t],[l]:e,callback_vars:{}}}else s[t]={...s[t],[l]:a};v(s)},w=(t,l,a)=>{let s=[...e];s[t]={...s[t],callback_vars:{...s[t].callback_vars,[l]:a}},v(s)};return(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(m.BanIcon,{className:"w-5 h-5 text-red-500"}),(0,t.jsx)("span",{className:"text-base font-semibold text-gray-800",children:"Disabled Callbacks"}),(0,t.jsx)(a.Tooltip,{title:"Select callbacks to disable for this key. Disabled callbacks will not receive any logging data.",children:(0,t.jsx)(i.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Disabled Callbacks"}),(0,t.jsx)(l.Select,{mode:"multiple",placeholder:"Select callbacks to disable",value:f,onChange:e=>{let t=(0,g.mapDisplayToInternalNames)(e);b?.(t)},style:{width:"100%"},optionLabelProp:"label",children:_.map(e=>{let l=g.callbackInfo[e]?.description;return(0,t.jsx)(x,{value:e,label:e,children:(0,t.jsx)(a.Tooltip,{title:l,placement:"right",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(p.Logo,{src:g.callbackInfo[e]?.logo,label:e,className:"w-4 h-4 object-contain"}),(0,t.jsx)("span",{children:e})]})})},e)})}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Select callbacks that should be disabled for this key. These callbacks will not receive any logging data."})]})]}),(0,t.jsx)(s.Divider,{}),(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(u.CogIcon,{className:"w-5 h-5 text-blue-500"}),(0,t.jsx)("span",{className:"text-base font-semibold text-gray-800",children:"Logging Integrations"}),(0,t.jsx)(a.Tooltip,{title:"Configure callback logging integrations for this team.",children:(0,t.jsx)(i.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),(0,t.jsx)(r.Button,{variant:"secondary",onClick:()=>{v([...e,{callback_name:"",callback_type:"success",callback_vars:{}}])},icon:d.PlusIcon,size:"sm",className:"hover:border-blue-400 hover:text-blue-500",type:"button",children:"Add Integration"})]}),(0,t.jsx)("div",{className:"space-y-4",children:e.map((s,i)=>{let d=s.callback_name?Object.entries(g.callback_map).find(([e,t])=>t===s.callback_name)?.[0]:void 0;return(0,t.jsxs)(n.Card,{className:"border border-gray-200 shadow-xs hover:shadow-md transition-shadow duration-200",decoration:"top",decorationColor:"blue",children:[(0,t.jsxs)("div",{className:"flex justify-between items-start mb-4",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[d&&(0,t.jsx)(p.Logo,{src:g.callbackInfo[d]?.logo,label:d,className:"w-5 h-5 object-contain"}),(0,t.jsxs)("span",{className:"text-sm font-medium",children:[d||"New Integration"," Configuration"]})]}),(0,t.jsx)(r.Button,{variant:"light",onClick:()=>{v(e.filter((e,t)=>t!==i))},icon:c.TrashIcon,size:"xs",color:"red",className:"hover:bg-red-50",type:"button",children:"Remove"})]}),(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Integration Type"}),(0,t.jsx)(l.Select,{value:d,placeholder:"Select integration",onChange:e=>A(i,"callback_name",e),className:"w-full",optionLabelProp:"label",children:j.map(e=>{let l=g.callbackInfo[e]?.description;return(0,t.jsx)(x,{value:e,label:e,children:(0,t.jsx)(a.Tooltip,{title:l,placement:"right",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(p.Logo,{src:g.callbackInfo[e]?.logo,label:e,className:"w-4 h-4 object-contain"}),(0,t.jsx)("span",{children:e})]})})},e)})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Event Type"}),(0,t.jsxs)(l.Select,{value:s.callback_type,onChange:e=>A(i,"callback_type",e),className:"w-full",children:[(0,t.jsx)(x,{value:"success",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-green-500 rounded-full"}),(0,t.jsx)("span",{children:"Success Only"})]})}),(0,t.jsx)(x,{value:"failure",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-red-500 rounded-full"}),(0,t.jsx)("span",{children:"Failure Only"})]})}),(0,t.jsx)(x,{value:"success_and_failure",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-blue-500 rounded-full"}),(0,t.jsx)("span",{children:"Success & Failure"})]})})]})]})]}),((e,l)=>{if(!e.callback_name)return null;let a=Object.entries(g.callback_map).find(([t,l])=>l===e.callback_name)?.[0];if(!a)return null;let s=g.callbackInfo[a]?.dynamic_params||{};return 0===Object.keys(s).length?null:(0,t.jsxs)("div",{className:"mt-6 pt-4 border-t border-gray-100",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2 mb-4",children:[(0,t.jsx)("div",{className:"w-3 h-3 bg-blue-100 rounded-full flex items-center justify-center",children:(0,t.jsx)("div",{className:"w-1.5 h-1.5 bg-blue-500 rounded-full"})}),(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Integration Parameters"})]}),(0,t.jsx)("div",{className:"grid grid-cols-1 gap-4",children:Object.entries(s).map(([a,s])=>(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 capitalize flex items-center space-x-1",children:[(0,t.jsx)("span",{children:a.replace(/_/g," ")}),"password"===s&&(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800",children:"Sensitive"}),"number"===s&&(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800",children:"Number"})]}),"number"===s&&(0,t.jsx)("span",{className:"text-xs text-gray-500",children:"Value must be between 0 and 1"}),"number"===s?(0,t.jsx)(h.default,{step:.01,width:400,placeholder:`os.environ/${a.toUpperCase()}`,value:e.callback_vars[a]||"",onChange:e=>w(l,a,e.target.value)}):(0,t.jsx)(o.TextInput,{type:"password"===s?"password":"text",placeholder:`os.environ/${a.toUpperCase()}`,value:e.callback_vars[a]||"",onChange:e=>w(l,a,e.target.value)})]},a))})]})})(s,i)]})]},i)})}),0===e.length&&(0,t.jsxs)("div",{className:"text-center py-12 text-gray-500 border-2 border-dashed border-gray-200 rounded-lg bg-gray-50/50",children:[(0,t.jsx)(u.CogIcon,{className:"w-12 h-12 text-gray-300 mb-3 mx-auto"}),(0,t.jsx)("div",{className:"text-base font-medium mb-1",children:"No logging integrations configured"}),(0,t.jsx)("div",{className:"text-sm text-gray-400",children:'Click "Add Integration" to configure logging for this team'})]})]})}])},651904,e=>{"use strict";var t=e.i(843476),l=e.i(599724),a=e.i(266484);e.s(["default",0,function({value:e,onChange:s,premiumUser:i=!1,disabledCallbacks:r=[],onDisabledCallbacksChange:n}){return i?(0,t.jsx)(a.default,{value:e,onChange:s,disabledCallbacks:r,onDisabledCallbacksChange:n}):(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{className:"flex flex-wrap gap-2 mb-3",children:[(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50",children:"✨ langfuse-logging"}),(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50",children:"✨ datadog-logging"})]}),(0,t.jsx)("div",{className:"p-3 bg-yellow-50 border border-yellow-200 rounded-lg",children:(0,t.jsxs)(l.Text,{className:"text-sm text-yellow-800",children:["Setting Key/Team logging settings is a LiteLLM Enterprise feature. Global Logging Settings are available for all free users. Get a trial key"," ",(0,t.jsx)("a",{href:"https://www.litellm.ai/#pricing",target:"_blank",rel:"noopener noreferrer",className:"underline",children:"here"}),"."]})})]})}])},939510,e=>{"use strict";var t=e.i(843476),l=e.i(808613),a=e.i(199133),s=e.i(592968),i=e.i(827252);let{Option:r}=a.Select;e.s(["default",0,({type:e,name:n,showDetailedDescriptions:o=!0,className:d="",initialValue:c=null,form:u,onChange:m})=>{let g=e.toUpperCase(),p=e.toLowerCase(),h=`Select 'guaranteed_throughput' to prevent overallocating ${g} limit when the key belongs to a Team with specific ${g} limits.`;return(0,t.jsx)(l.Form.Item,{label:(0,t.jsxs)("span",{children:[g," Rate Limit Type"," ",(0,t.jsx)(s.Tooltip,{title:h,children:(0,t.jsx)(i.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:n,initialValue:c,className:d,children:(0,t.jsx)(a.Select,{defaultValue:o?"default":void 0,placeholder:"Select rate limit type",style:{width:"100%"},optionLabelProp:o?"label":void 0,onChange:e=>{u&&u.setFieldValue(n,e),m&&m(e)},children:o?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r,{value:"best_effort_throughput",label:"Default",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Default"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["Best effort throughput - no error if we're overallocating ",p," (Team/Key Limits checked at runtime)."]})]})}),(0,t.jsx)(r,{value:"guaranteed_throughput",label:"Guaranteed throughput",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Guaranteed throughput"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["Guaranteed throughput - raise an error if we're overallocating ",p," (also checks model-specific limits)"]})]})}),(0,t.jsx)(r,{value:"dynamic",label:"Dynamic",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Dynamic"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["If the key has a set ",g," (e.g. 2 ",g,") and there are no 429 errors, it can dynamically exceed the limit when the model being called is not erroring."]})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r,{value:"best_effort_throughput",children:"Best effort throughput"}),(0,t.jsx)(r,{value:"guaranteed_throughput",children:"Guaranteed throughput"}),(0,t.jsx)(r,{value:"dynamic",children:"Dynamic"})]})})})}])},460285,e=>{"use strict";var t=e.i(843476),l=e.i(271645),a=e.i(404206),s=e.i(723731),i=e.i(653824),r=e.i(881073),n=e.i(197647),o=e.i(343488),d=e.i(602869),c=e.i(158392),u=e.i(419470),m=e.i(695411);let g=(0,l.forwardRef)(({accessToken:e,value:g,onChange:p,modelData:h},x)=>{let[y,f]=(0,l.useState)({routerSettings:{},selectedStrategy:null,enableTagFiltering:!1}),[b,j]=(0,l.useState)([]),[_,v]=(0,l.useState)([]),[A,w]=(0,l.useState)([]),[k,N]=(0,l.useState)([]),[S,C]=(0,l.useState)({}),[T,I]=(0,l.useState)({}),L=(0,l.useRef)(!1),E=(0,l.useRef)(null);(0,l.useEffect)(()=>{let e=g?.router_settings?JSON.stringify({routing_strategy:g.router_settings.routing_strategy,fallbacks:g.router_settings.fallbacks,enable_tag_filtering:g.router_settings.enable_tag_filtering}):null;if(L.current&&e===E.current){L.current=!1;return}if(L.current&&e!==E.current&&(L.current=!1),e!==E.current)if(E.current=e,g?.router_settings){let e=g.router_settings,{fallbacks:t,...l}=e;f({routerSettings:l,selectedStrategy:e.routing_strategy||null,enableTagFiltering:e.enable_tag_filtering??!1});let a=e.fallbacks||[];j(a),v(a&&0!==a.length?a.map((e,t)=>{let[l,a]=Object.entries(e)[0];return{id:(t+1).toString(),primaryModel:l||null,fallbackModels:a||[]}}):[{id:"1",primaryModel:null,fallbackModels:[]}])}else f({routerSettings:{},selectedStrategy:null,enableTagFiltering:!1}),j([]),v([{id:"1",primaryModel:null,fallbackModels:[]}])},[g]),(0,l.useEffect)(()=>{e&&(0,d.getRouterSettingsCall)(e).then(e=>{if(e.fields){let t={};e.fields.forEach(e=>{t[e.field_name]={ui_field_name:e.ui_field_name,field_description:e.field_description,options:e.options,link:e.link}}),C(t);let l=e.fields.find(e=>"routing_strategy"===e.field_name);l?.options&&N(l.options),e.routing_strategy_descriptions&&I(e.routing_strategy_descriptions)}})},[e]),(0,l.useEffect)(()=>{e&&(async()=>{try{let t=await (0,m.fetchAvailableModels)(e);w(t)}catch(e){console.error("Error fetching model info for fallbacks:",e)}})()},[e]);let O=()=>{let e=new Set(["allowed_fails","cooldown_time","num_retries","timeout","retry_after"]),t=new Set(["model_group_alias","retry_policy"]),l=Object.fromEntries(Object.entries({...y.routerSettings,enable_tag_filtering:y.enableTagFiltering,routing_strategy:y.selectedStrategy,fallbacks:b.length>0?b:null}).map(([l,a])=>{if("routing_strategy_args"!==l&&"routing_strategy"!==l&&"enable_tag_filtering"!==l&&"fallbacks"!==l){let s=document.querySelector(`input[name="${l}"]`);if(s){if(void 0!==s.value&&""!==s.value){let i=((l,a,s)=>{if(null==a)return s;let i=String(a).trim();if(""===i||"null"===i.toLowerCase())return null;if(e.has(l)){let e=Number(i);return Number.isNaN(e)?s:e}if(t.has(l)){if(""===i)return null;try{return JSON.parse(i)}catch{return s}}return"true"===i.toLowerCase()||"false"!==i.toLowerCase()&&i})(l,s.value,a);return[l,i]}return[l,null]}}else if("routing_strategy"===l)return[l,y.selectedStrategy];else if("enable_tag_filtering"===l)return[l,y.enableTagFiltering];else if("fallbacks"===l)return[l,b.length>0?b:null];else if("routing_strategy_args"===l&&"latency-based-routing"===y.selectedStrategy){let e=document.querySelector('input[name="lowest_latency_buffer"]'),t=document.querySelector('input[name="ttl"]'),l={};return e?.value&&(l.lowest_latency_buffer=Number(e.value)),t?.value&&(l.ttl=Number(t.value)),["routing_strategy_args",Object.keys(l).length>0?l:null]}return[l,a]}).filter(e=>null!=e)),a=(e,t=!1)=>null==e||"object"==typeof e&&!Array.isArray(e)&&0===Object.keys(e).length||t&&("number"!=typeof e||Number.isNaN(e))?null:e;return{routing_strategy:a(l.routing_strategy),allowed_fails:a(l.allowed_fails,!0),cooldown_time:a(l.cooldown_time,!0),num_retries:a(l.num_retries,!0),timeout:a(l.timeout,!0),retry_after:a(l.retry_after,!0),fallbacks:b.length>0?b:null,context_window_fallbacks:a(l.context_window_fallbacks),retry_policy:a(l.retry_policy),model_group_alias:a(l.model_group_alias),enable_tag_filtering:y.enableTagFiltering,routing_strategy_args:a(l.routing_strategy_args)}},F=(0,o.useDebouncedCallback)(()=>{p&&(L.current=!0,p({router_settings:O()}))},{wait:100});(0,l.useEffect)(()=>{p&&F()},[y,b]);let M=Array.from(new Set(A.map(e=>e.model_group))).sort();return((0,l.useImperativeHandle)(x,()=>({getValue:()=>({router_settings:O()})})),e)?(0,t.jsx)("div",{className:"w-full",children:(0,t.jsxs)(i.TabGroup,{className:"w-full",children:[(0,t.jsxs)(r.TabList,{variant:"line",defaultValue:"1",className:"px-8 pt-4",children:[(0,t.jsx)(n.Tab,{value:"1",children:"Loadbalancing"}),(0,t.jsx)(n.Tab,{value:"2",children:"Fallbacks"})]}),(0,t.jsxs)(s.TabPanels,{className:"px-8 py-6",children:[(0,t.jsx)(a.TabPanel,{children:(0,t.jsx)(c.default,{value:y,onChange:f,routerFieldsMetadata:S,availableRoutingStrategies:k,routingStrategyDescriptions:T})}),(0,t.jsx)(a.TabPanel,{children:(0,t.jsx)(u.FallbackSelectionForm,{groups:_,onGroupsChange:e=>{v(e),j(e.filter(e=>e.primaryModel&&e.fallbackModels.length>0).map(e=>({[e.primaryModel]:e.fallbackModels})))},availableModels:M,maxGroups:5})})]})]})}):null});g.displayName="RouterSettingsAccordion",e.s(["default",0,g])},363256,e=>{"use strict";var t=e.i(843476),l=e.i(199133);let{Text:a}=e.i(898586).Typography;e.s(["default",0,({organizations:e,value:s,onChange:i,disabled:r,loading:n,style:o})=>(0,t.jsx)(l.Select,{showSearch:!0,placeholder:"All Organizations",value:s,onChange:i,disabled:r,loading:n,allowClear:!0,style:{minWidth:280,...o},filterOption:(t,l)=>{if(!l)return!1;let a=e?.find(e=>e.organization_id===l.key);if(!a)return!1;let s=t.toLowerCase().trim(),i=(a.organization_alias||"").toLowerCase(),r=(a.organization_id||"").toLowerCase();return i.includes(s)||r.includes(s)},children:e?.map(e=>(0,t.jsxs)(l.Select.Option,{value:e.organization_id,children:[(0,t.jsx)("span",{className:"font-medium",children:e.organization_alias})," ",(0,t.jsxs)(a,{type:"secondary",children:["(",e.organization_id,")"]})]},e.organization_id))})])},575260,e=>{"use strict";var t=e.i(843476),l=e.i(199133),a=e.i(482725),s=e.i(56456);e.s(["default",0,({projects:e,value:i,onChange:r,disabled:n,loading:o,teamId:d})=>{let c=d?e?.filter(e=>e.team_id===d):e;return(0,t.jsx)(l.Select,{showSearch:!0,placeholder:"Search or select a project",value:i,onChange:r,disabled:n,loading:o,allowClear:!0,notFoundContent:o?(0,t.jsx)(a.Spin,{indicator:(0,t.jsx)(s.LoadingOutlined,{spin:!0}),size:"small"}):void 0,filterOption:(e,t)=>{if(!t)return!1;let l=c?.find(e=>e.project_id===t.key);if(!l)return!1;let a=e.toLowerCase().trim(),s=(l.project_alias||"").toLowerCase(),i=(l.project_id||"").toLowerCase();return s.includes(a)||i.includes(a)},optionFilterProp:"children",children:!o&&c?.map(e=>(0,t.jsxs)(l.Select.Option,{value:e.project_id,children:[(0,t.jsx)("span",{className:"font-medium",children:e.project_alias||e.project_id})," ",(0,t.jsxs)("span",{className:"text-gray-500",children:["(",e.project_id,")"]})]},e.project_id))})}])},128233,319312,833400,e=>{"use strict";var t=e.i(843476),l=e.i(464571),a=e.i(199133),s=e.i(592968),i=e.i(425063),r=e.i(107233),n=e.i(37727),o=e.i(271645);e.s(["BudgetFallbacksEditor",0,function({value:e,onChange:d,availableModels:c}){let[u,m]=(0,o.useState)(()=>{let t;return 0===(t=Object.keys(e)).length?[]:t.map((t,l)=>({id:String(l+1),primaryModel:t,fallbackModels:e[t]}))}),g=e=>{m(e),d(Object.fromEntries(e.filter(e=>null!==e.primaryModel&&e.fallbackModels.length>0).map(e=>[e.primaryModel,e.fallbackModels])))},p=()=>{g([...u,{id:Date.now().toString(),primaryModel:null,fallbackModels:[]}])},h=(e,t)=>{g(u.map(l=>l.id===e?{...l,...t}:l))},x=new Set(u.map(e=>e.primaryModel).filter(Boolean));return 0===u.length?(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"text-xs text-gray-500 mb-2",children:"When a model exceeds its per-model budget, requests automatically reroute to fallback models"}),(0,t.jsx)(l.Button,{size:"small",onClick:p,icon:(0,t.jsx)(r.Plus,{className:"w-3 h-3"}),children:"Add Budget Fallback"})]}):(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"When a model exceeds its per-model budget, requests automatically reroute to fallback models"}),u.map(e=>{let l=c.filter(t=>t===e.primaryModel||!x.has(t)),r=c.filter(t=>t!==e.primaryModel);return(0,t.jsxs)("div",{className:"relative rounded-lg border border-gray-200 bg-gray-50 p-4",children:[(0,t.jsx)("button",{type:"button",onClick:()=>{var t;return t=e.id,void g(u.filter(e=>e.id!==t))},className:"absolute top-2 right-2 text-gray-400 hover:text-red-500 transition-colors p-1",children:(0,t.jsx)(n.X,{className:"w-4 h-4"})}),(0,t.jsxs)("div",{className:"mb-3",children:[(0,t.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Primary Model"}),(0,t.jsx)(a.Select,{className:"w-full",placeholder:"Select model",value:e.primaryModel,onChange:t=>{let l=e.fallbackModels.filter(e=>e!==t);h(e.id,{primaryModel:t,fallbackModels:l})},showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:l.map(e=>({label:e,value:e})),getPopupContainer:e=>e.parentElement||document.body})]}),(0,t.jsx)("div",{className:"flex items-center justify-center -my-1 mb-2",children:(0,t.jsxs)("div",{className:"bg-amber-50 text-amber-600 px-3 py-0.5 rounded-full text-[10px] font-bold border border-amber-100 flex items-center gap-1",children:[(0,t.jsx)(i.ArrowDown,{className:"w-3 h-3"}),"IF BUDGET EXCEEDED, TRY"]})}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Fallback Models"}),(0,t.jsx)(a.Select,{mode:"multiple",className:"w-full",placeholder:e.primaryModel?"Select fallback models":"Select a primary model first",value:e.fallbackModels,onChange:t=>h(e.id,{fallbackModels:t}),disabled:!e.primaryModel,showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:r.map(e=>({label:e,value:e})),getPopupContainer:e=>e.parentElement||document.body,maxTagCount:"responsive",maxTagPlaceholder:e=>(0,t.jsx)(s.Tooltip,{styles:{root:{pointerEvents:"none"}},title:e.map(({value:e})=>e).join(", "),children:(0,t.jsxs)("span",{children:["+",e.length," more"]})})}),e.fallbackModels.length>1&&(0,t.jsx)("div",{className:"text-[10px] text-gray-400 mt-1 ml-1",children:"Tried in order; first model still within its own budget is used"})]})]},e.id)}),(0,t.jsx)(l.Button,{size:"small",onClick:p,icon:(0,t.jsx)(r.Plus,{className:"w-3 h-3"}),children:"Add Budget Fallback"})]})}],128233);var d=e.i(28651);let c=[{value:"1h",label:"Hourly",resetHint:"Resets every hour"},{value:"24h",label:"Daily",resetHint:"Resets daily at midnight UTC"},{value:"7d",label:"Weekly",resetHint:"Resets every Sunday at midnight UTC"},{value:"30d",label:"Monthly",resetHint:"Resets on the 1st of every month at midnight UTC"}];e.s(["BudgetWindowsEditor",0,function({value:e,onChange:s}){let i=(t,l,a)=>{s(e.map((e,s)=>s===t?{...e,[l]:a}:e))};return(0,t.jsxs)("div",{children:[e.map((r,n)=>{let o=c.find(e=>e.value===r.budget_duration)?.resetHint;return(0,t.jsxs)("div",{style:{marginBottom:12},children:[(0,t.jsxs)("div",{style:{display:"flex",gap:8,alignItems:"center"},children:[(0,t.jsx)(a.Select,{value:r.budget_duration,onChange:e=>i(n,"budget_duration",e),style:{width:130},options:c.map(e=>({value:e.value,label:e.label}))}),(0,t.jsx)(d.InputNumber,{step:.01,min:0,precision:2,value:r.max_budget??void 0,onChange:e=>i(n,"max_budget",e??null),placeholder:"Max spend ($)",style:{width:160},prefix:"$"}),(0,t.jsx)(l.Button,{type:"text",danger:!0,size:"small",onClick:()=>{s(e.filter((e,t)=>t!==n))},style:{padding:"0 4px"},children:"✕"})]}),o&&(0,t.jsxs)("div",{style:{fontSize:11,color:"#888",marginTop:3,marginLeft:2},children:["↻ ",o]})]},n)}),(0,t.jsx)(l.Button,{size:"small",onClick:t=>{t.preventDefault(),s([...e,{budget_duration:"24h",max_budget:null}])},children:"+ Add Budget Window"})]})}],319312);var u=e.i(311451);let m=0,g=()=>`tag-row-${m++}`;e.s(["TagRateLimitEditor",0,function({value:e,onChange:a}){let s=(t,l,s)=>{a(e.map((e,a)=>a===t?{...e,[l]:s}:e))};return(0,t.jsxs)("div",{children:[e.map((i,r)=>(0,t.jsxs)("div",{style:{display:"flex",gap:8,alignItems:"center",marginBottom:12},children:[(0,t.jsx)(u.Input,{value:i.tag,onChange:e=>s(r,"tag",e.target.value),placeholder:"Tag (e.g. cell-1)",style:{width:180}}),(0,t.jsx)(d.InputNumber,{min:0,value:i.rpm_limit??void 0,onChange:e=>s(r,"rpm_limit",e??null),placeholder:"RPM",style:{width:120}}),(0,t.jsx)(l.Button,{type:"text",danger:!0,size:"small",onClick:()=>{a(e.filter((e,t)=>t!==r))},style:{padding:"0 4px"},children:"✕"})]},i.id)),(0,t.jsx)(l.Button,{size:"small",onClick:t=>{t.preventDefault(),a([...e,{id:g(),tag:"",rpm_limit:null}])},children:"+ Add Tag Limit"})]})},"tagLimitsToRows",0,e=>{let t=(e=>{if(!e||"object"!=typeof e)return{};let t={};return Object.entries(e).forEach(([e,l])=>{"number"==typeof l&&(t[e]=l)}),t})(e);return Object.keys(t).map(e=>({id:g(),tag:e,rpm_limit:t[e]}))},"tagRowsToLimits",0,e=>{let t={};return e.forEach(({tag:e,rpm_limit:l})=>{let a=e.trim();a&&"number"==typeof l&&(t[a]=l)}),{tag_rpm_limit:t}}],833400)},390605,e=>{"use strict";var t=e.i(843476),l=e.i(271645),a=e.i(602869),s=e.i(599724),i=e.i(482725),r=e.i(91739),n=e.i(500727),o=e.i(531516),d=e.i(696609);e.s(["default",0,({accessToken:e,selectedServers:c,toolPermissions:u,onChange:m,disabled:g=!1})=>{let{data:p=[]}=(0,n.useMCPServers)(),[h,x]=(0,l.useState)({}),[y,f]=(0,l.useState)({}),[b,j]=(0,l.useState)({}),[_,v]=(0,l.useState)({}),A=(0,l.useRef)(u);(0,l.useEffect)(()=>{A.current=u},[u]);let w=(0,l.useMemo)(()=>0===c.length?[]:p.filter(e=>c.includes(e.server_id)),[p,c]),k=async(e,t)=>{f(t=>({...t,[e]:!0})),j(t=>({...t,[e]:""}));try{let l=await (0,a.listMCPTools)(t,e);if(l.error)j(t=>({...t,[e]:l.message||"Failed to fetch tools"})),x(t=>({...t,[e]:[]}));else{let t=l.tools||[];x(l=>({...l,[e]:t}));let a=A.current;if(!a[e]&&t.length>0){let l=t.filter(e=>"delete"!==(0,d.classifyToolOp)(e.name,e.description||"")).map(e=>e.name);m({...a,[e]:l})}}}catch(t){console.error(`Error fetching tools for server ${e}:`,t),j(t=>({...t,[e]:"Failed to fetch tools"})),x(t=>({...t,[e]:[]}))}finally{f(t=>({...t,[e]:!1}))}};(0,l.useEffect)(()=>{w.forEach(t=>{h[t.server_id]||y[t.server_id]||k(t.server_id,e)})},[w,e]);let N=(e,t)=>{m({...u,[e]:t})};return 0===c.length?null:(0,t.jsx)("div",{className:"space-y-4",children:w.map(e=>{let l=e.server_name||e.alias||e.server_id,a=h[e.server_id]||[],n=u[e.server_id]||[],d=y[e.server_id],c=b[e.server_id],p=_[e.server_id]??"crud";return(0,t.jsxs)("div",{className:"border rounded-lg bg-gray-50",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between p-4 border-b bg-white rounded-t-lg",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(s.Text,{className:"font-semibold text-gray-900",children:l}),e.description&&(0,t.jsx)(s.Text,{className:"text-sm text-gray-500",children:e.description})]}),(0,t.jsxs)("div",{className:"flex items-center gap-3",children:[!g&&a.length>0&&(0,t.jsx)(r.Radio.Group,{value:p,onChange:t=>v(l=>({...l,[e.server_id]:t.target.value})),size:"small",optionType:"button",buttonStyle:"solid",options:[{label:"Risk Groups",value:"crud"},{label:"Flat List",value:"flat"}]}),!g&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("button",{type:"button",className:"text-sm text-blue-600 hover:text-blue-700 font-medium",onClick:()=>{var t;let l;return l=h[t=e.server_id]||[],void m({...u,[t]:l.map(e=>e.name)})},disabled:d,children:"Select All"}),(0,t.jsx)("button",{type:"button",className:"text-sm text-blue-600 hover:text-blue-700 font-medium",onClick:()=>{var t;return t=e.server_id,void m({...u,[t]:[]})},disabled:d,children:"Deselect All"})]})]})]}),(0,t.jsxs)("div",{className:"p-4",children:[d&&(0,t.jsxs)("div",{className:"flex items-center justify-center py-8",children:[(0,t.jsx)(i.Spin,{size:"large"}),(0,t.jsx)(s.Text,{className:"ml-3 text-gray-500",children:"Loading tools..."})]}),c&&!d&&(0,t.jsxs)("div",{className:"p-4 bg-red-50 border border-red-200 rounded-lg text-center",children:[(0,t.jsx)(s.Text,{className:"text-red-600 font-medium",children:"Unable to load tools"}),(0,t.jsx)(s.Text,{className:"text-sm text-red-500 mt-1",children:c})]}),!d&&!c&&a.length>0&&"crud"===p&&(0,t.jsx)(o.default,{tools:a,value:u[e.server_id]?n:void 0,onChange:t=>N(e.server_id,t),readOnly:g}),!d&&!c&&a.length>0&&"flat"===p&&(0,t.jsx)("div",{className:"space-y-2",children:a.map(l=>{let a=n.includes(l.name);return(0,t.jsxs)("div",{className:"flex items-start gap-2",children:[(0,t.jsx)("input",{type:"checkbox",checked:a,onChange:()=>{if(g)return;let t=a?n.filter(e=>e!==l.name):[...n,l.name];N(e.server_id,t)},disabled:g,className:"mt-0.5"}),(0,t.jsx)("div",{className:"flex-1 min-w-0",children:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(s.Text,{className:"font-medium text-gray-900",children:l.name}),(0,t.jsxs)(s.Text,{className:"text-sm text-gray-500",children:["- ",l.description||"No description"]})]})})]},l.name)})}),!d&&!c&&0===a.length&&(0,t.jsx)("div",{className:"text-center py-6",children:(0,t.jsx)(s.Text,{className:"text-gray-500",children:"No tools available"})})]})]},e.server_id)})})}])},364769,e=>{"use strict";var t=e.i(843476),l=e.i(271645),a=e.i(237016),s=e.i(464571),i=e.i(888259);e.s(["default",0,({apiKey:e})=>{let[r,n]=(0,l.useState)(!1);return(0,t.jsxs)("div",{children:[(0,t.jsxs)("p",{className:"mb-2",children:["Please save this secret key somewhere safe and accessible. For security reasons,"," ",(0,t.jsx)("b",{children:"you will not be able to view it again"})," through your LiteLLM account. If you lose this secret key, you will need to generate a new one."]}),(0,t.jsx)("p",{className:"text-sm text-gray-600 mt-3 mb-1",children:"Virtual Key:"}),(0,t.jsx)("div",{style:{background:"#f8f8f8",padding:"10px",borderRadius:"5px",marginBottom:"10px"},children:(0,t.jsx)("pre",{style:{wordWrap:"break-word",whiteSpace:"normal",margin:0},children:e})}),(0,t.jsx)(a.CopyToClipboard,{text:e,onCopy:()=>{n(!0),i.default.success("Key copied to clipboard"),setTimeout(()=>n(!1),2e3)},children:(0,t.jsx)(s.Button,{type:"primary",style:{marginTop:12},children:r?"Copied!":"Copy Virtual Key"})})]})}])},702597,e=>{"use strict";var t=e.i(843476),l=e.i(207082),a=e.i(109799),s=e.i(510674),i=e.i(109034),r=e.i(292639),n=e.i(135214),o=e.i(500330),d=e.i(827252),c=e.i(912598),u=e.i(677667),m=e.i(130643),g=e.i(898667),p=e.i(994388),h=e.i(309426),x=e.i(350967),y=e.i(599724),f=e.i(779241),b=e.i(629569),j=e.i(464571),_=e.i(808613),v=e.i(311451),A=e.i(212931),w=e.i(91739),k=e.i(199133),N=e.i(790848),S=e.i(262218),C=e.i(592968),T=e.i(898586),I=e.i(343488),L=e.i(741466),E=e.i(271645),O=e.i(708347),F=e.i(552130),M=e.i(557662),R=e.i(9314),B=e.i(860585),P=e.i(82946),D=e.i(392110),U=e.i(533882),z=e.i(844565),V=e.i(651904),K=e.i(939510),G=e.i(460285),Q=e.i(663435),W=e.i(363256),H=e.i(575260),q=e.i(371455),J=e.i(128233),$=e.i(319312),Y=e.i(833400),X=e.i(355619),Z=e.i(75921),ee=e.i(234713),et=e.i(390605),el=e.i(727749),ea=e.i(602869),es=e.i(364769),ei=e.i(435451),er=e.i(916940);let{Option:en}=k.Select,eo=async(e,t,l,a)=>{try{if(null===e||null===t)return[];if(null!==l)return(await (0,ea.modelAvailableCall)(l,e,t,!0,a,!0)).data.map(e=>e.id);return[]}catch(e){return console.error("Error fetching user models:",e),[]}},ed=async(e,t,l,a)=>{try{if(null===e||null===t)return;if(null!==l){let s=(await (0,ea.modelAvailableCall)(l,e,t)).data.map(e=>e.id);a(s)}}catch(e){console.error("Error fetching user models:",e)}};e.s(["default",0,({team:e,teams:ec,data:eu,addKey:em,autoOpenCreate:eg,prefillData:ep})=>{let{accessToken:eh,userId:ex,userRole:ey,premiumUser:ef}=(0,n.default)(),eb=ef||null!=ey&&O.rolesWithWriteAccess.includes(ey),{data:ej,isLoading:e_}=(0,a.useOrganizations)(),{data:ev,isLoading:eA}=(0,s.useProjects)(),{data:ew}=(0,r.useUISettings)(),{data:ek}=(0,i.useTags)(),eN=!!ew?.values?.enable_projects_ui,eS=!!ew?.values?.disable_custom_api_keys,eC=ek?Object.values(ek).map(e=>({value:e.name,label:e.name})):[],eT=(0,c.useQueryClient)(),[eI]=_.Form.useForm(),[eL,eE]=(0,E.useState)(!1),[eO,eF]=(0,E.useState)(null),[eM,eR]=(0,E.useState)(null),[eB,eP]=(0,E.useState)([]),[eD,eU]=(0,E.useState)([]),[ez,eV]=(0,E.useState)("you"),[eK,eG]=(0,E.useState)(!1),[eQ,eW]=(0,E.useState)(null),[eH,eq]=(0,E.useState)([]),[eJ,e$]=(0,E.useState)([]),[eY,eX]=(0,E.useState)([]),[eZ,e0]=(0,E.useState)([]),[e1,e4]=(0,E.useState)(e),[e2,e3]=(0,E.useState)(null),[e6,e5]=(0,E.useState)(null),[e7,e8]=(0,E.useState)(!1),[e9,te]=(0,E.useState)(null),[tt,tl]=(0,E.useState)({}),[ta,ts]=(0,E.useState)([]),[ti,tr]=(0,E.useState)(!1),[tn,to]=(0,E.useState)([]),[td,tc]=(0,E.useState)([]),[tu,tm]=(0,E.useState)("llm_api"),[tg,tp]=(0,E.useState)({}),[th,tx]=(0,E.useState)(!1),[ty,tf]=(0,E.useState)("30d"),[tb,tj]=(0,E.useState)(null),[t_,tv]=(0,E.useState)([]),[tA,tw]=(0,E.useState)([]),[tk,tN]=(0,E.useState)({}),[tS,tC]=(0,E.useState)(0),[tT,tI]=(0,E.useState)(0),[tL,tE]=(0,E.useState)([]),[tO,tF]=(0,E.useState)(null),tM=_.Form.useWatch("models",eI)??[],tR=()=>{eE(!1),eI.resetFields(),e0([]),tc([]),tm("llm_api"),tp({}),tx(!1),tf("30d"),tj(null),tI(e=>e+1),tF(null),e3(null),e5(null),tv([]),tw([]),tN({}),tC(e=>e+1)},tB=()=>{eE(!1),eF(null),e4(null),eI.resetFields(),e0([]),tc([]),tm("llm_api"),tp({}),tx(!1),tf("30d"),tj(null),tI(e=>e+1),tF(null),e3(null),e5(null),tv([]),tw([]),tN({}),tC(e=>e+1)};(0,E.useEffect)(()=>{ex&&ey&&eh&&ed(ex,ey,eh,eP)},[eh,ex,ey]),(0,E.useEffect)(()=>{eh&&(0,ea.getAgentsList)(eh).then(e=>tE(e?.agents||[])).catch(()=>tE([]))},[eh]),(0,E.useEffect)(()=>{let e=async()=>{try{let e=(await (0,ea.getPoliciesList)(eh)).policies.map(e=>e.policy_name);e$(e)}catch(e){console.error("Failed to fetch policies:",e)}},t=async()=>{try{let e=await (0,ea.getPromptsList)(eh);eX(e.prompts.map(e=>e.prompt_id))}catch(e){console.error("Failed to fetch prompts:",e)}};(async()=>{try{let e=(await (0,ea.getGuardrailsList)(eh)).guardrails.map(e=>e.guardrail_name);eq(e)}catch(e){console.error("Failed to fetch guardrails:",e)}})(),e(),t()},[eh]),(0,E.useEffect)(()=>{(async()=>{try{if(eh){let e=sessionStorage.getItem("possibleUserRoles");if(e)tl(JSON.parse(e));else{let e=await (0,ea.getPossibleUserRoles)(eh);sessionStorage.setItem("possibleUserRoles",JSON.stringify(e)),tl(e)}}}catch(e){console.error("Error fetching possible user roles:",e)}})()},[eh]),(0,E.useEffect)(()=>{if(eg&&!eK&&ec&&ey&&O.rolesWithWriteAccess.includes(ey)&&(eE(!0),eG(!0),ep)){if(ep.owned_by&&("another_user"===ep.owned_by&&"Admin"!==ey?eV("you"):eV(ep.owned_by)),ep.team_id){let e=ec?.find(e=>e.team_id===ep.team_id)||null;e&&(e4(e),eI.setFieldsValue({team_id:ep.team_id}))}ep.key_alias&&eI.setFieldsValue({key_alias:ep.key_alias}),ep.models&&ep.models.length>0&&eW(ep.models),ep.key_type&&(tm(ep.key_type),eI.setFieldsValue({key_type:ep.key_type}))}},[eg,ep,ec,eK,eI,ey]);let tP=eD.includes("no-default-models")&&!e1,tD=async e=>{try{let t,a=e?.key_alias??"",s=e?.team_id??null;if((eu?.filter(e=>e.team_id===s).map(e=>e.key_alias)??[]).includes(a))throw Error(`Key alias ${a} already exists for team with ID ${s}, please provide another key alias`);if(el.default.info("Making API Call"),eE(!0),"you"===ez)e.user_id=ex;else if("agent"===ez){if(!tO)return void el.default.fromBackend("Please select an agent");e.agent_id=tO}let i={};try{i=JSON.parse(e.metadata||"{}")}catch(e){console.error("Error parsing metadata:",e)}if("service_account"===ez&&(i.service_account_id=e.key_alias),eZ.length>0&&(i={...i,logging:eZ.filter(e=>e.callback_name)}),td.length>0){let e=(0,M.mapDisplayToInternalNames)(td);i={...i,litellm_disabled_callbacks:e}}if(th&&(e.auto_rotate=!0,e.rotation_interval=ty),e.duration&&""!==e.duration.trim()||(e.duration=null),e.metadata=JSON.stringify(i),e.disable_global_guardrails||delete e.disable_global_guardrails,e.allowed_vector_store_ids&&e.allowed_vector_store_ids.length>0&&(e.object_permission={vector_stores:e.allowed_vector_store_ids},delete e.allowed_vector_store_ids),e.allowed_mcp_servers_and_groups&&(e.allowed_mcp_servers_and_groups.servers?.length>0||e.allowed_mcp_servers_and_groups.accessGroups?.length>0||e.allowed_mcp_servers_and_groups.toolsets?.length>0)){e.object_permission||(e.object_permission={});let{servers:t,accessGroups:l,toolsets:a}=e.allowed_mcp_servers_and_groups;t&&t.length>0&&(e.object_permission.mcp_servers=t),l&&l.length>0&&(e.object_permission.mcp_access_groups=l),a&&a.length>0&&(e.object_permission.mcp_toolsets=a),delete e.allowed_mcp_servers_and_groups}let r=e.mcp_tool_permissions||{};if(Object.keys(r).length>0&&(e.object_permission||(e.object_permission={}),e.object_permission.mcp_tool_permissions=r),delete e.mcp_tool_permissions,e.allowed_mcp_access_groups&&e.allowed_mcp_access_groups.length>0&&(e.object_permission||(e.object_permission={}),e.object_permission.mcp_access_groups=e.allowed_mcp_access_groups,delete e.allowed_mcp_access_groups),e.allowed_agents_and_groups&&(e.allowed_agents_and_groups.agents?.length>0||e.allowed_agents_and_groups.accessGroups?.length>0)){e.object_permission||(e.object_permission={});let{agents:t,accessGroups:l}=e.allowed_agents_and_groups;t&&t.length>0&&(e.object_permission.agents=t),l&&l.length>0&&(e.object_permission.agent_access_groups=l),delete e.allowed_agents_and_groups}Object.keys(tg).length>0&&(e.aliases=JSON.stringify(tg)),tb?.router_settings&&Object.values(tb.router_settings).some(e=>null!=e&&""!==e)&&(e.router_settings=tb.router_settings);let n=t_.filter(e=>e.budget_duration&&null!==e.max_budget&&void 0!==e.max_budget);n.length>0&&(e.budget_limits=n);let{tag_rpm_limit:o}=(0,Y.tagRowsToLimits)(tA);Object.keys(o).length>0&&(e.tag_rpm_limit=o),Object.keys(tk).length>0&&(e.budget_fallbacks=tk),t="service_account"===ez?await (0,ea.keyCreateServiceAccountCall)(eh,e):await (0,ea.keyCreateCall)(eh,ex,e),em(t),eT.invalidateQueries({queryKey:l.keyKeys.lists()}),eF(t.key),eR(t.soft_budget),el.default.success("Virtual Key Created"),eI.resetFields(),tv([]),tw([]),tN({}),tC(e=>e+1),localStorage.removeItem("userData"+ex)}catch(t){let e=(e=>{let t;if(!(t=!e||"object"!=typeof e||e instanceof Error?String(e):JSON.stringify(e)).includes("/key/generate")&&!t.includes("KeyManagementRoutes.KEY_GENERATE"))return`Error creating the key: ${e}`;let l=t;try{if(!e||"object"!=typeof e||e instanceof Error){let e=t.match(/\{[\s\S]*\}/);if(e){let t=JSON.parse(e[0]),a=t?.error||t;a?.message&&(l=a.message)}}else{let t=e?.error||e;t?.message&&(l=t.message)}}catch(e){}return t.includes("team_member_permission_error")||l.includes("Team member does not have permissions")?"Team member does not have permission to generate key for this team. Ask your proxy admin to configure the team member permission settings.":`Error creating the key: ${e}`})(t);el.default.fromBackend(e)}};(0,E.useEffect)(()=>{if(e6){let e=ev?.find(e=>e.project_id===e6);eU(e?.models??[]),eI.setFieldValue("models",[]);return}ex&&ey&&eh&&eo(ex,ey,eh,e1?.team_id??null).then(e=>{eU((0,X.excludeProxyWideSentinel)(Array.from(new Set([...e1?.models??[],...e]))))}),eQ||eI.setFieldValue("models",[]),eI.setFieldValue("allowed_mcp_servers_and_groups",{servers:[],accessGroups:[]})},[e1,e6,eh,ex,ey,eI]),(0,E.useEffect)(()=>{if(!eQ||0===eQ.length||!eD||0===eD.length)return;let e=eQ.filter(e=>eD.includes(e));e.length>0&&eI.setFieldsValue({models:e}),eW(null)},[eQ,eD,eI]),(0,E.useEffect)(()=>{if(!e6||!ec)return;let e=ev?.find(e=>e.project_id===e6);if(!e?.team_id||e1?.team_id===e.team_id)return;let t=ec.find(t=>t.team_id===e.team_id)||null;t&&(e4(t),eI.setFieldValue("team_id",t.team_id))},[ec,e6,ev]);let tU=async e=>{if(!e)return void ts([]);tr(!0);try{let t=new URLSearchParams;if(t.append("user_email",e),null==eh)return;let l=(await (0,ea.userFilterUICall)(eh,t)).map(e=>({label:`${e.user_email} (${e.user_id})`,value:e.user_id,user:e}));ts(l)}catch(e){console.error("Error fetching users:",e),el.default.fromBackend("Failed to search for users")}finally{tr(!1)}},tz=(0,I.useDebouncedCallback)(e=>tU(e),{wait:L.DEBOUNCE_WAIT_MS});return(0,t.jsxs)("div",{children:[ey&&O.rolesWithWriteAccess.includes(ey)&&(0,t.jsx)(p.Button,{className:"mx-auto",onClick:()=>eE(!0),"data-testid":"create-key-button",children:"+ Create New Key"}),(0,t.jsx)(A.Modal,{open:eL,width:1e3,footer:null,onOk:tR,onCancel:tB,children:(0,t.jsxs)(_.Form,{form:eI,onFinish:tD,labelCol:{span:8},wrapperCol:{span:16},labelAlign:"left",children:[(0,t.jsxs)("div",{className:"mb-8",children:[(0,t.jsx)(b.Title,{className:"mb-4",children:"Key Ownership"}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Owned By"," ",(0,t.jsx)(C.Tooltip,{title:"Select who will own this Virtual Key",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),className:"mb-4",children:(0,t.jsxs)(w.Radio.Group,{onChange:e=>eV(e.target.value),value:ez,children:[(0,t.jsx)(w.Radio,{value:"you",children:"You"}),(0,t.jsx)(w.Radio,{value:"service_account",children:"Service Account"}),"Admin"===ey&&(0,t.jsx)(w.Radio,{value:"another_user",children:"Another User"}),(0,t.jsxs)(w.Radio,{value:"agent",children:["Agent ",(0,t.jsx)(S.Tag,{color:"purple",children:"New"})]})]})}),"another_user"===ez&&(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["User ID"," ",(0,t.jsx)(C.Tooltip,{title:"The user who will own this key and be responsible for its usage",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"user_id",className:"mt-4",rules:[{required:"another_user"===ez,message:"Please input the user ID of the user you are assigning the key to"}],children:(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{style:{display:"flex",marginBottom:"8px"},children:[(0,t.jsx)(k.Select,{showSearch:!0,placeholder:"Type email to search for users",filterOption:!1,onSearch:tz,onSelect:(e,t)=>{let l;return l=t.user,void eI.setFieldsValue({user_id:l.user_id})},options:ta,loading:ti,allowClear:!0,style:{width:"100%"},notFoundContent:ti?"Searching...":"No users found"}),(0,t.jsx)(j.Button,{onClick:()=>e8(!0),style:{marginLeft:"8px"},children:"Create User"})]}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Search by email to find users"})]})}),"agent"===ez&&(0,t.jsxs)("div",{className:"mt-4 p-4 bg-purple-50 border border-purple-200 rounded-md",children:[(0,t.jsx)("div",{className:"mb-3",children:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700",children:["Select Agent ",(0,t.jsx)("span",{className:"text-red-500",children:"*"})]})}),(0,t.jsx)(k.Select,{showSearch:!0,placeholder:"Select an agent",style:{width:"100%"},value:tO,onChange:e=>tF(e),filterOption:(e,t)=>t?.label?.toLowerCase().includes(e.toLowerCase()),options:tL.map(e=>({label:e.agent_name||e.agent_id,value:e.agent_id}))}),(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-2",children:"This key will be used by the selected agent to make requests to LiteLLM"})]}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Organization"," ",(0,t.jsx)(C.Tooltip,{title:"The organization this key belongs to. Selecting an organization filters the available teams.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"organization_id",className:"mt-4",children:(0,t.jsx)(W.default,{organizations:ej,loading:e_,disabled:"Admin"!==ey,onChange:e=>{e3(e||null),e4(null),e5(null),eI.setFieldValue("team_id",void 0),eI.setFieldValue("project_id",void 0)}})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Team"," ",(0,t.jsx)(C.Tooltip,{title:"The team this key belongs to, which determines available models and budget limits",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"team_id",initialValue:e?e.team_id:null,className:"mt-4",rules:[{required:"service_account"===ez,message:"Please select a team for the service account"}],help:"service_account"===ez?"required":"",children:(0,t.jsx)(Q.default,{disabled:null!==e6,organizationId:e2,onTeamSelect:e=>{e4(e),e5(null),eI.setFieldValue("project_id",void 0),e?.organization_id?(e3(e.organization_id),eI.setFieldValue("organization_id",e.organization_id)):e||(e3(null),eI.setFieldValue("organization_id",void 0))}})}),eN&&(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Project"," ",(0,t.jsx)(C.Tooltip,{title:"Assign this key to a project. Selecting a project will lock the team to the project's team.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"project_id",className:"mt-4",children:(0,t.jsx)(H.default,{projects:ev,teamId:e1?.team_id,loading:eA||!ec,onChange:e=>{if(!e){e5(null),e4(null),eI.setFieldValue("team_id",void 0);return}e5(e)}})})]}),tP&&(0,t.jsx)("div",{className:"mb-8 p-4 bg-blue-50 border border-blue-200 rounded-md",children:(0,t.jsx)(y.Text,{className:"text-blue-800 text-sm",children:"Please select a team to continue configuring your Virtual Key. If you do not see any teams, please contact your Proxy Admin to either provide you with access to models or to add you to a team."})}),!tP&&(0,t.jsxs)("div",{className:"mb-8",children:[(0,t.jsx)(b.Title,{className:"mb-4",children:"Key Details"}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["you"===ez||"another_user"===ez?"Key Name":"Service Account ID"," ",(0,t.jsx)(C.Tooltip,{title:"you"===ez||"another_user"===ez?"A descriptive name to identify this key":"Unique identifier for this service account",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"key_alias",rules:[{required:!0,message:`Please input a ${"you"===ez?"key name":"service account ID"}`}],help:"required",children:(0,t.jsx)(f.TextInput,{placeholder:""})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Models"," ",(0,t.jsx)(C.Tooltip,{title:"Select which models this key can access. Choose 'All Team Models' to grant access to all models available to the team. Leave empty to allow access to all models.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"models",rules:[],help:"management"===tu||"read_only"===tu?"Models field is disabled for this key type":"optional - leave empty to allow access to all models",className:"mt-4",children:(0,t.jsxs)(k.Select,{mode:"multiple",placeholder:"Select models",style:{width:"100%"},disabled:"management"===tu||"read_only"===tu,onChange:e=>{e.includes("all-team-models")?eI.setFieldsValue({models:["all-team-models"]}):e.includes("all-proxy-models")&&eI.setFieldsValue({models:["all-proxy-models"]})},children:[!e6&&e1&&(0,t.jsx)(en,{value:"all-team-models",children:"All Team Models"},"all-team-models"),!e6&&!e1&&(0,t.jsx)(en,{value:"all-proxy-models",children:"All Proxy Models"},"all-proxy-models"),eD.map(e=>(0,t.jsx)(en,{value:e,disabled:(0,X.hasAllModelsSentinel)(tM),children:(0,X.getModelDisplayName)(e)},e))]})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Key Type"," ",(0,t.jsx)(C.Tooltip,{title:"Select the type of key to determine what routes and operations this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"key_type",initialValue:"llm_api",className:"mt-4",children:(0,t.jsxs)(k.Select,{defaultValue:"llm_api",placeholder:"Select key type",style:{width:"100%"},optionLabelProp:"label",onChange:e=>{tm(e),("management"===e||"read_only"===e)&&eI.setFieldsValue({models:[]})},children:[(0,t.jsx)(en,{value:"llm_api",label:"AI APIs",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(T.Typography.Text,{strong:!0,children:"AI APIs"}),(0,t.jsx)(T.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call only AI API routes (chat/completions, embeddings, etc.)"})]})}),(0,t.jsx)(en,{value:"management",label:"Management",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(T.Typography.Text,{strong:!0,children:"Management"}),(0,t.jsx)(T.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call only management routes (user/team/key management)"})]})}),(0,t.jsx)(en,{value:"default",label:"Full Access",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(T.Typography.Text,{strong:!0,children:"Full Access"}),(0,t.jsx)(T.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call all routes (AI APIs, Management, and read-only)"})]})})]})})]}),!tP&&(0,t.jsx)("div",{className:"mb-8",children:(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsx)(b.Title,{className:"m-0",children:"Optional Settings"})}),(0,t.jsxs)(m.AccordionBody,{children:[(0,t.jsx)(_.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Max Budget (USD)"," ",(0,t.jsx)(C.Tooltip,{title:"Maximum amount in USD this key can spend. When reached, the key will be blocked from making further requests",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"max_budget",help:`Budget cannot exceed team max budget: $${e?.max_budget!==null&&e?.max_budget!==void 0?e?.max_budget:"unlimited"}`,rules:[{validator:async(t,l)=>{if(l&&e&&null!==e.max_budget&&l>e.max_budget)throw Error(`Budget cannot exceed team max budget: $${(0,o.formatNumberWithCommas)(e.max_budget,4)}`)}}],children:(0,t.jsx)(ei.default,{step:.01,precision:2,width:200})}),(0,t.jsx)(_.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Reset Budget"," ",(0,t.jsx)(C.Tooltip,{title:"How often the budget should reset. For example, setting 'daily' will reset the budget every 24 hours",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"budget_duration",help:`Team Reset Budget: ${e?.budget_duration!==null&&e?.budget_duration!==void 0?e?.budget_duration:"None"}`,children:(0,t.jsx)(B.default,{onChange:e=>eI.setFieldValue("budget_duration",e)})}),(0,t.jsx)(_.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Budget Windows"," ",(0,t.jsx)(C.Tooltip,{title:"Set multiple independent budget windows (e.g., hourly $10 AND monthly $200). Each window tracks spend separately and resets on its own schedule.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)($.BudgetWindowsEditor,{value:t_,onChange:tv})}),(0,t.jsx)(_.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Budget Fallbacks"," ",(0,t.jsx)(C.Tooltip,{title:"When a model exceeds its per-model budget (model_max_budget), requests automatically reroute to fallback models instead of failing. Configure per-model budgets in Advanced Settings.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)(J.BudgetFallbacksEditor,{value:tk,onChange:tN,availableModels:eD},tS)}),(0,t.jsx)(_.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Tokens per minute Limit (TPM)"," ",(0,t.jsx)(C.Tooltip,{title:"Maximum number of tokens this key can process per minute. Helps control usage and costs",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"tpm_limit",help:`TPM cannot exceed team TPM limit: ${e?.tpm_limit!==null&&e?.tpm_limit!==void 0?e?.tpm_limit:"unlimited"}`,rules:[{validator:async(t,l)=>{if(l&&e&&null!==e.tpm_limit&&l>e.tpm_limit)throw Error(`TPM limit cannot exceed team TPM limit: ${e.tpm_limit}`)}}],children:(0,t.jsx)(ei.default,{step:1,width:400})}),(0,t.jsx)(K.default,{type:"tpm",name:"tpm_limit_type",className:"mt-4",initialValue:null,form:eI,showDetailedDescriptions:!0}),(0,t.jsx)(_.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Requests per minute Limit (RPM)"," ",(0,t.jsx)(C.Tooltip,{title:"Maximum number of API requests this key can make per minute. Helps prevent abuse and manage load",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"rpm_limit",help:`RPM cannot exceed team RPM limit: ${e?.rpm_limit!==null&&e?.rpm_limit!==void 0?e?.rpm_limit:"unlimited"}`,rules:[{validator:async(t,l)=>{if(l&&e&&null!==e.rpm_limit&&l>e.rpm_limit)throw Error(`RPM limit cannot exceed team RPM limit: ${e.rpm_limit}`)}}],children:(0,t.jsx)(ei.default,{step:1,width:400})}),(0,t.jsx)(K.default,{type:"rpm",name:"rpm_limit_type",className:"mt-4",initialValue:null,form:eI,showDetailedDescriptions:!0}),(0,t.jsx)(_.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Per-Tag Rate Limits"," ",(0,t.jsx)(C.Tooltip,{title:"Scope rate limits to a request tag so each tag (e.g. a cell or group) gets its own RPM counter. Requests without a matching tag fall back to the key-level limit.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)(Y.TagRateLimitEditor,{value:tA,onChange:tw})}),(0,t.jsx)(_.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Throttle on budget exceeded"," ",(0,t.jsx)(C.Tooltip,{title:"When this key exceeds its max budget, throttle its TPM/RPM to the globally configured percentage instead of blocking access entirely. Requires budget_exceeded_throttle_percentage in litellm_settings and a TPM/RPM limit on the key.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"throttle_on_budget_exceeded",valuePropName:"checked",children:(0,t.jsx)(N.Switch,{checkedChildren:"Yes",unCheckedChildren:"No"})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Guardrails"," ",(0,t.jsx)(C.Tooltip,{title:"Apply safety guardrails to this key to filter content or enforce policies",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"guardrails",className:"mt-4",help:eb?"Select existing guardrails or enter new ones":"Premium feature - Upgrade to set guardrails by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!eb,placeholder:eb?"Select or enter guardrails":"Premium feature - Upgrade to set guardrails by key",options:eH.map(e=>({value:e,label:e}))})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Disable Global Guardrails"," ",(0,t.jsx)(C.Tooltip,{title:"When enabled, this key will bypass any guardrails configured to run on every request (global guardrails)",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"disable_global_guardrails",className:"mt-4",valuePropName:"checked",help:eb?"Bypass global guardrails for this key":"Premium feature - Upgrade to disable global guardrails by key",children:(0,t.jsx)(N.Switch,{disabled:!eb,checkedChildren:"Yes",unCheckedChildren:"No"})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Policies"," ",(0,t.jsx)(C.Tooltip,{title:"Apply policies to this key to control guardrails and other settings",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"policies",className:"mt-4",help:ef?"Select existing policies or enter new ones":"Premium feature - Upgrade to set policies by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ef,placeholder:ef?"Select or enter policies":"Premium feature - Upgrade to set policies by key",options:eJ.map(e=>({value:e,label:e}))})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Prompts"," ",(0,t.jsx)(C.Tooltip,{title:"Allow this key to use specific prompt templates",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/prompt_management",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"prompts",className:"mt-4",help:ef?"Select existing prompts or enter new ones":"Premium feature - Upgrade to set prompts by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ef,placeholder:ef?"Select or enter prompts":"Premium feature - Upgrade to set prompts by key",options:eY.map(e=>({value:e,label:e}))})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Access Groups"," ",(0,t.jsx)(C.Tooltip,{title:"Assign access groups to this key. Access groups control which models, MCP servers, and agents this key can use",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"access_group_ids",className:"mt-4",help:"Select access groups to assign to this key",children:(0,t.jsx)(R.default,{placeholder:"Select access groups (optional)"})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Pass Through Routes"," ",(0,t.jsx)(C.Tooltip,{title:"Allow this key to use specific pass through routes",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/pass_through",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"allowed_passthrough_routes",className:"mt-4",help:ef?"Select existing pass through routes or enter new ones":"Premium feature - Upgrade to set pass through routes by key",children:(0,t.jsx)(z.default,{onChange:e=>eI.setFieldValue("allowed_passthrough_routes",e),value:eI.getFieldValue("allowed_passthrough_routes"),accessToken:eh,placeholder:ef?"Select or enter pass through routes":"Premium feature - Upgrade to set pass through routes by key",disabled:!ef,teamId:e1?e1.team_id:null})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Vector Stores"," ",(0,t.jsx)(C.Tooltip,{title:"Select which vector stores this key can access. If none selected, the key will have access to all available vector stores",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_vector_store_ids",className:"mt-4",help:"Select vector stores this key can access. Leave empty for access to all vector stores",children:(0,t.jsx)(er.default,{onChange:e=>eI.setFieldValue("allowed_vector_store_ids",e),value:eI.getFieldValue("allowed_vector_store_ids"),accessToken:eh,placeholder:"Select vector stores (optional)"})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Metadata"," ",(0,t.jsx)(C.Tooltip,{title:"JSON object with additional information about this key. Used for tracking or custom logic",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"metadata",className:"mt-4",children:(0,t.jsx)(v.Input.TextArea,{rows:4,placeholder:"Enter metadata as JSON"})}),(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Tags"," ",(0,t.jsx)(C.Tooltip,{title:"Tags for tracking spend and/or doing tag-based routing. Used for analytics and filtering",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"tags",className:"mt-4",help:"Tags for tracking spend and/or doing tag-based routing.",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},placeholder:"Select or enter tags",tokenSeparators:[","],options:eC})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsx)("b",{children:"MCP Settings"})}),(0,t.jsxs)(m.AccordionBody,{children:[(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed MCP Servers"," ",(0,t.jsx)(C.Tooltip,{title:"Select which MCP servers or access groups this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_mcp_servers_and_groups",help:"Select MCP servers or access groups this key can access",children:(0,t.jsx)(Z.default,{onChange:e=>eI.setFieldValue("allowed_mcp_servers_and_groups",e),value:eI.getFieldValue("allowed_mcp_servers_and_groups"),accessToken:eh,teamId:e1?.team_id??null,placeholder:"Select MCP servers or access groups (optional)",allowNoMcpServers:!0})}),(0,t.jsx)(_.Form.Item,{name:"mcp_tool_permissions",initialValue:{},hidden:!0,children:(0,t.jsx)(v.Input,{type:"hidden"})}),(0,t.jsx)(_.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.allowed_mcp_servers_and_groups!==t.allowed_mcp_servers_and_groups||e.mcp_tool_permissions!==t.mcp_tool_permissions,children:()=>(0,t.jsx)("div",{className:"mt-6",children:(0,t.jsx)(et.default,{accessToken:eh,selectedServers:(eI.getFieldValue("allowed_mcp_servers_and_groups")?.servers||[]).filter(e=>e!==ee.NO_MCP_SERVERS_SENTINEL),toolPermissions:eI.getFieldValue("mcp_tool_permissions")||{},onChange:e=>eI.setFieldsValue({mcp_tool_permissions:e})})})})]})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsx)("b",{children:"Agent Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)(_.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Agents"," ",(0,t.jsx)(C.Tooltip,{title:"Select which agents or access groups this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_agents_and_groups",help:"Select agents or access groups this key can access",children:(0,t.jsx)(F.default,{onChange:e=>eI.setFieldValue("allowed_agents_and_groups",e),value:eI.getFieldValue("allowed_agents_and_groups"),accessToken:eh,placeholder:"Select agents or access groups (optional)"})})})]}),ef?(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsx)("b",{children:"Logging Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(V.default,{value:eZ,onChange:e0,premiumUser:!0,disabledCallbacks:td,onDisabledCallbacksChange:tc})})})]}):(0,t.jsx)(C.Tooltip,{title:(0,t.jsxs)("span",{children:["Key-level logging settings is an enterprise feature, get in touch -",(0,t.jsx)("a",{href:"https://www.litellm.ai/enterprise",target:"_blank",children:"https://www.litellm.ai/enterprise"})]}),placement:"top",children:(0,t.jsxs)("div",{style:{position:"relative"},children:[(0,t.jsx)("div",{style:{opacity:.5},children:(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsx)("b",{children:"Logging Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(V.default,{value:eZ,onChange:e0,premiumUser:!1,disabledCallbacks:td,onDisabledCallbacksChange:tc})})})]})}),(0,t.jsx)("div",{style:{position:"absolute",inset:0,cursor:"not-allowed"}})]})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsx)("b",{children:"Router Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4 w-full",children:(0,t.jsx)(G.default,{accessToken:eh||"",value:tb||void 0,onChange:tj,modelData:eB.length>0?{data:eB.map(e=>({model_name:e}))}:void 0},tT)})})]},`router-settings-accordion-${tT}`),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsx)("b",{children:"Model Aliases"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsx)(y.Text,{className:"text-sm text-gray-600 mb-4",children:"Create custom aliases for models that can be used in API calls. This allows you to create shortcuts for specific models."}),(0,t.jsx)(U.default,{accessToken:eh,initialModelAliases:tg,onAliasUpdate:tp,showExampleConfig:!1})]})})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsx)("b",{children:"Key Lifecycle"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(D.default,{form:eI,autoRotationEnabled:th,onAutoRotationChange:tx,rotationInterval:ty,onRotationIntervalChange:tf,isCreateMode:!0})})})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)("b",{children:"Advanced Settings"}),(0,t.jsx)(C.Tooltip,{title:(0,t.jsxs)("span",{children:["Learn more about advanced settings in our"," ",(0,t.jsx)("a",{href:ea.proxyBaseUrl?`${ea.proxyBaseUrl}/#/key%20management/generate_key_fn_key_generate_post`:"/#/key%20management/generate_key_fn_key_generate_post",target:"_blank",rel:"noopener noreferrer",className:"text-blue-400 hover:text-blue-300",children:"documentation"})]}),children:(0,t.jsx)(d.InfoCircleOutlined,{className:"text-gray-400 hover:text-gray-300 cursor-help"})})]})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)(P.default,{schemaComponent:"GenerateKeyRequest",form:eI,excludedFields:["key_alias","team_id","organization_id","models","duration","metadata","tags","guardrails","max_budget","budget_duration","tpm_limit","rpm_limit",...eS?["key"]:[]]})})]})]})]})}),(0,t.jsx)("div",{style:{textAlign:"right",marginTop:"10px"},children:(0,t.jsx)(j.Button,{htmlType:"submit",disabled:tP,style:{opacity:tP?.5:1},children:"Create Key"})})]})}),e7&&(0,t.jsx)(A.Modal,{title:"Create New User",open:e7,onCancel:()=>e8(!1),footer:null,width:800,children:(0,t.jsx)(q.CreateUserButton,{userID:ex,accessToken:eh,teams:ec,possibleUIRoles:tt,onUserCreated:e=>{te(e),eI.setFieldsValue({user_id:e}),e8(!1)},isEmbedded:!0})}),eO&&(0,t.jsx)(A.Modal,{open:eL,onOk:tR,onCancel:tB,footer:null,children:(0,t.jsxs)(x.Grid,{numItems:1,className:"gap-2 w-full",children:[(0,t.jsx)(b.Title,{children:"Save your Key"}),(0,t.jsx)(h.Col,{numColSpan:1,children:null!=eO?(0,t.jsx)(es.default,{apiKey:eO}):(0,t.jsx)(y.Text,{children:"Key being created, this might take 30s"})})]})})]})},"fetchTeamModels",0,eo,"fetchUserModels",0,ed],702597)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/00fcsizkvc4hx.js b/litellm/proxy/_experimental/out/_next/static/chunks/00fcsizkvc4hx.js deleted file mode 100644 index 7875ab8fb17..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/00fcsizkvc4hx.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,728889,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(829087),s=e.i(480731),n=e.i(444755),l=e.i(673706),o=e.i(95779);let i={xs:{paddingX:"px-1.5",paddingY:"py-1.5"},sm:{paddingX:"px-1.5",paddingY:"py-1.5"},md:{paddingX:"px-2",paddingY:"py-2"},lg:{paddingX:"px-2",paddingY:"py-2"},xl:{paddingX:"px-2.5",paddingY:"py-2.5"}},c={xs:{height:"h-3",width:"w-3"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-7",width:"w-7"},xl:{height:"h-9",width:"w-9"}},d={simple:{rounded:"",border:"",ring:"",shadow:""},light:{rounded:"rounded-tremor-default",border:"",ring:"",shadow:""},shadow:{rounded:"rounded-tremor-default",border:"border",ring:"",shadow:"shadow-tremor-card dark:shadow-dark-tremor-card"},solid:{rounded:"rounded-tremor-default",border:"border-2",ring:"ring-1",shadow:""},outlined:{rounded:"rounded-tremor-default",border:"border",ring:"ring-2",shadow:""}},u=(0,l.makeClassName)("Icon"),m=r.default.forwardRef((e,m)=>{let{icon:h,variant:p="simple",tooltip:g,size:f=s.Sizes.SM,color:x,className:b}=e,v=(0,t.__rest)(e,["icon","variant","tooltip","size","color","className"]),y=((e,t)=>{switch(e){case"simple":return{textColor:t?(0,l.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:"",borderColor:"",ringColor:""};case"light":return{textColor:t?(0,l.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,n.tremorTwMerge)((0,l.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand-muted dark:bg-dark-tremor-brand-muted",borderColor:"",ringColor:""};case"shadow":return{textColor:t?(0,l.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,n.tremorTwMerge)((0,l.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:"border-tremor-border dark:border-dark-tremor-border",ringColor:""};case"solid":return{textColor:t?(0,l.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:t?(0,n.tremorTwMerge)((0,l.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand dark:bg-dark-tremor-brand",borderColor:"border-tremor-brand-inverted dark:border-dark-tremor-brand-inverted",ringColor:"ring-tremor-ring dark:ring-dark-tremor-ring"};case"outlined":return{textColor:t?(0,l.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,n.tremorTwMerge)((0,l.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:t?(0,l.getColorClassNames)(t,o.colorPalette.ring).borderColor:"border-tremor-brand-subtle dark:border-dark-tremor-brand-subtle",ringColor:t?(0,n.tremorTwMerge)((0,l.getColorClassNames)(t,o.colorPalette.ring).ringColor,"ring-opacity-40"):"ring-tremor-brand-muted dark:ring-dark-tremor-brand-muted"}}})(p,x),{tooltipProps:C,getReferenceProps:w}=(0,a.useTooltip)();return r.default.createElement("span",Object.assign({ref:(0,l.mergeRefs)([m,C.refs.setReference]),className:(0,n.tremorTwMerge)(u("root"),"inline-flex shrink-0 items-center justify-center",y.bgColor,y.textColor,y.borderColor,y.ringColor,d[p].rounded,d[p].border,d[p].shadow,d[p].ring,i[f].paddingX,i[f].paddingY,b)},w,v),r.default.createElement(a.default,Object.assign({text:g},C)),r.default.createElement(h,{className:(0,n.tremorTwMerge)(u("icon"),"shrink-0",c[f].height,c[f].width)}))});m.displayName="Icon",e.s(["default",0,m],728889)},752978,e=>{"use strict";var t=e.i(728889);e.s(["Icon",()=>t.default])},278587,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"}))});e.s(["RefreshIcon",0,r],278587)},551332,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M8 5H6a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2v-1M8 5a2 2 0 002 2h2a2 2 0 002-2M8 5a2 2 0 012-2h2a2 2 0 012 2m0 0h2a2 2 0 012 2v3m2 4H10m0 0l3-3m-3 3l3 3"}))});e.s(["ClipboardCopyIcon",0,r],551332)},439189,435684,96226,497245,e=>{"use strict";function t(e){let t=Object.prototype.toString.call(e);return e instanceof Date||"object"==typeof e&&"[object Date]"===t?new e.constructor(+e):new Date("number"==typeof e||"[object Number]"===t||"string"==typeof e||"[object String]"===t?e:NaN)}function r(e,t){return e instanceof Date?new e.constructor(t):new Date(t)}e.s(["toDate",0,t],435684),e.s(["constructFrom",0,r],96226),e.s(["addDays",0,function(e,a){let s=t(e);return isNaN(a)?r(e,NaN):(a&&s.setDate(s.getDate()+a),s)}],439189),e.s(["addMonths",0,function(e,a){let s=t(e);if(isNaN(a))return r(e,NaN);if(!a)return s;let n=s.getDate(),l=r(e,s.getTime());return(l.setMonth(s.getMonth()+a+1,0),n>=l.getDate())?l:(s.setFullYear(l.getFullYear(),l.getMonth(),n),s)}],497245)},888288,e=>{"use strict";var t=e.i(271645);e.s(["default",0,(e,r)=>{let a=void 0!==r,[s,n]=(0,t.useState)(e);return[a?r:s,e=>{a||n(e)}]}])},37091,e=>{"use strict";var t=e.i(290571),r=e.i(95779),a=e.i(444755),s=e.i(673706),n=e.i(271645);let l=n.default.forwardRef((e,l)=>{let{color:o,children:i,className:c}=e,d=(0,t.__rest)(e,["color","children","className"]);return n.default.createElement("p",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o?(0,s.getColorClassNames)(o,r.colorPalette.lightText).textColor:"text-tremor-content-emphasis dark:text-dark-tremor-content-emphasis",c)},d),i)});l.displayName="Subtitle",e.s(["Subtitle",0,l],37091)},757440,e=>{"use strict";var t=e.i(290571),r=e.i(271645);e.s(["default",0,e=>{var a=(0,t.__rest)(e,[]);return r.default.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24",fill:"currentColor"},a),r.default.createElement("path",{d:"M11.9999 13.1714L16.9497 8.22168L18.3639 9.63589L11.9999 15.9999L5.63599 9.63589L7.0502 8.22168L11.9999 13.1714Z"}))}])},446428,854056,e=>{"use strict";let t;var r=e.i(290571),a=e.i(271645);e.s(["default",0,e=>{var t=(0,r.__rest)(e,[]);return a.default.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24",fill:"currentColor"},t),a.default.createElement("path",{d:"M12 22C6.47715 22 2 17.5228 2 12C2 6.47715 6.47715 2 12 2C17.5228 2 22 6.47715 22 12C22 17.5228 17.5228 22 12 22ZM12 10.5858L9.17157 7.75736L7.75736 9.17157L10.5858 12L7.75736 14.8284L9.17157 16.2426L12 13.4142L14.8284 16.2426L16.2426 14.8284L13.4142 12L16.2426 9.17157L14.8284 7.75736L12 10.5858Z"}))}],446428);var s=e.i(746725),n=e.i(914189),l=e.i(553521),o=e.i(835696),i=e.i(941444),c=e.i(178677),d=e.i(294316),u=e.i(83733),m=e.i(233137),h=e.i(732607),p=e.i(397701),g=e.i(700020);function f(e){var t;return!!(e.enter||e.enterFrom||e.enterTo||e.leave||e.leaveFrom||e.leaveTo)||(null!=(t=e.as)?t:w)!==a.Fragment||1===a.default.Children.count(e.children)}let x=(0,a.createContext)(null);x.displayName="TransitionContext";var b=((t=b||{}).Visible="visible",t.Hidden="hidden",t);let v=(0,a.createContext)(null);function y(e){return"children"in e?y(e.children):e.current.filter(({el:e})=>null!==e.current).filter(({state:e})=>"visible"===e).length>0}function C(e,t){let r=(0,i.useLatestValue)(e),o=(0,a.useRef)([]),c=(0,l.useIsMounted)(),d=(0,s.useDisposables)(),u=(0,n.useEvent)((e,t=g.RenderStrategy.Hidden)=>{let a=o.current.findIndex(({el:t})=>t===e);-1!==a&&((0,p.match)(t,{[g.RenderStrategy.Unmount](){o.current.splice(a,1)},[g.RenderStrategy.Hidden](){o.current[a].state="hidden"}}),d.microTask(()=>{var e;!y(o)&&c.current&&(null==(e=r.current)||e.call(r))}))}),m=(0,n.useEvent)(e=>{let t=o.current.find(({el:t})=>t===e);return t?"visible"!==t.state&&(t.state="visible"):o.current.push({el:e,state:"visible"}),()=>u(e,g.RenderStrategy.Unmount)}),h=(0,a.useRef)([]),f=(0,a.useRef)(Promise.resolve()),x=(0,a.useRef)({enter:[],leave:[]}),b=(0,n.useEvent)((e,r,a)=>{h.current.splice(0),t&&(t.chains.current[r]=t.chains.current[r].filter(([t])=>t!==e)),null==t||t.chains.current[r].push([e,new Promise(e=>{h.current.push(e)})]),null==t||t.chains.current[r].push([e,new Promise(e=>{Promise.all(x.current[r].map(([e,t])=>t)).then(()=>e())})]),"enter"===r?f.current=f.current.then(()=>null==t?void 0:t.wait.current).then(()=>a(r)):a(r)}),v=(0,n.useEvent)((e,t,r)=>{Promise.all(x.current[t].splice(0).map(([e,t])=>t)).then(()=>{var e;null==(e=h.current.shift())||e()}).then(()=>r(t))});return(0,a.useMemo)(()=>({children:o,register:m,unregister:u,onStart:b,onStop:v,wait:f,chains:x}),[m,u,o,b,v,x,f])}v.displayName="NestingContext";let w=a.Fragment,N=g.RenderFeatures.RenderStrategy,k=(0,g.forwardRefWithAs)(function(e,t){let{show:r,appear:s=!1,unmount:l=!0,...i}=e,u=(0,a.useRef)(null),h=f(e),p=(0,d.useSyncRefs)(...h?[u,t]:null===t?[]:[t]);(0,c.useServerHandoffComplete)();let b=(0,m.useOpenClosed)();if(void 0===r&&null!==b&&(r=(b&m.State.Open)===m.State.Open),void 0===r)throw Error("A is used but it is missing a `show={true | false}` prop.");let[w,k]=(0,a.useState)(r?"visible":"hidden"),S=C(()=>{r||k("hidden")}),[T,_]=(0,a.useState)(!0),E=(0,a.useRef)([r]);(0,o.useIsoMorphicEffect)(()=>{!1!==T&&E.current[E.current.length-1]!==r&&(E.current.push(r),_(!1))},[E,r]);let M=(0,a.useMemo)(()=>({show:r,appear:s,initial:T}),[r,s,T]);(0,o.useIsoMorphicEffect)(()=>{r?k("visible"):y(S)||null===u.current||k("hidden")},[r,S]);let R={unmount:l},P=(0,n.useEvent)(()=>{var t;T&&_(!1),null==(t=e.beforeEnter)||t.call(e)}),L=(0,n.useEvent)(()=>{var t;T&&_(!1),null==(t=e.beforeLeave)||t.call(e)}),A=(0,g.useRender)();return a.default.createElement(v.Provider,{value:S},a.default.createElement(x.Provider,{value:M},A({ourProps:{...R,as:a.Fragment,children:a.default.createElement(j,{ref:p,...R,...i,beforeEnter:P,beforeLeave:L})},theirProps:{},defaultTag:a.Fragment,features:N,visible:"visible"===w,name:"Transition"})))}),j=(0,g.forwardRefWithAs)(function(e,t){var r,s;let{transition:l=!0,beforeEnter:i,afterEnter:b,beforeLeave:k,afterLeave:j,enter:S,enterFrom:T,enterTo:_,entered:E,leave:M,leaveFrom:R,leaveTo:P,...L}=e,[A,I]=(0,a.useState)(null),O=(0,a.useRef)(null),F=f(e),D=(0,d.useSyncRefs)(...F?[O,t,I]:null===t?[]:[t]),H=null==(r=L.unmount)||r?g.RenderStrategy.Unmount:g.RenderStrategy.Hidden,{show:V,appear:B,initial:J}=function(){let e=(0,a.useContext)(x);if(null===e)throw Error("A is used but it is missing a parent or .");return e}(),[U,q]=(0,a.useState)(V?"visible":"hidden"),G=function(){let e=(0,a.useContext)(v);if(null===e)throw Error("A is used but it is missing a parent or .");return e}(),{register:z,unregister:W}=G;(0,o.useIsoMorphicEffect)(()=>z(O),[z,O]),(0,o.useIsoMorphicEffect)(()=>{if(H===g.RenderStrategy.Hidden&&O.current)return V&&"visible"!==U?void q("visible"):(0,p.match)(U,{hidden:()=>W(O),visible:()=>z(O)})},[U,O,z,W,V,H]);let Y=(0,c.useServerHandoffComplete)();(0,o.useIsoMorphicEffect)(()=>{if(F&&Y&&"visible"===U&&null===O.current)throw Error("Did you forget to passthrough the `ref` to the actual DOM node?")},[O,U,Y,F]);let X=J&&!B,Z=B&&V&&J,$=(0,a.useRef)(!1),K=C(()=>{$.current||(q("hidden"),W(O))},G),Q=(0,n.useEvent)(e=>{$.current=!0,K.onStart(O,e?"enter":"leave",e=>{"enter"===e?null==i||i():"leave"===e&&(null==k||k())})}),ee=(0,n.useEvent)(e=>{let t=e?"enter":"leave";$.current=!1,K.onStop(O,t,e=>{"enter"===e?null==b||b():"leave"===e&&(null==j||j())}),"leave"!==t||y(K)||(q("hidden"),W(O))});(0,a.useEffect)(()=>{F&&l||(Q(V),ee(V))},[V,F,l]);let et=!(!l||!F||!Y||X),[,er]=(0,u.useTransition)(et,A,V,{start:Q,end:ee}),ea=(0,g.compact)({ref:D,className:(null==(s=(0,h.classNames)(L.className,Z&&S,Z&&T,er.enter&&S,er.enter&&er.closed&&T,er.enter&&!er.closed&&_,er.leave&&M,er.leave&&!er.closed&&R,er.leave&&er.closed&&P,!er.transition&&V&&E))?void 0:s.trim())||void 0,...(0,u.transitionDataAttributes)(er)}),es=0;"visible"===U&&(es|=m.State.Open),"hidden"===U&&(es|=m.State.Closed),er.enter&&(es|=m.State.Opening),er.leave&&(es|=m.State.Closing);let en=(0,g.useRender)();return a.default.createElement(v.Provider,{value:K},a.default.createElement(m.OpenClosedProvider,{value:es},en({ourProps:ea,theirProps:L,defaultTag:w,features:N,visible:"visible"===U,name:"Transition.Child"})))}),S=(0,g.forwardRefWithAs)(function(e,t){let r=null!==(0,a.useContext)(x),s=null!==(0,m.useOpenClosed)();return a.default.createElement(a.default.Fragment,null,!r&&s?a.default.createElement(k,{ref:t,...e}):a.default.createElement(j,{ref:t,...e}))}),T=Object.assign(k,{Child:S,Root:k});e.s(["Transition",0,T],854056)},206929,e=>{"use strict";var t=e.i(290571),r=e.i(757440),a=e.i(271645),s=e.i(446428),n=e.i(444755),l=e.i(673706),o=e.i(103471),i=e.i(495470),c=e.i(854056),d=e.i(888288);let u=(0,l.makeClassName)("Select"),m=a.default.forwardRef((e,l)=>{let{defaultValue:m="",value:h,onValueChange:p,placeholder:g="Select...",disabled:f=!1,icon:x,enableClear:b=!1,required:v,children:y,name:C,error:w=!1,errorMessage:N,className:k,id:j}=e,S=(0,t.__rest)(e,["defaultValue","value","onValueChange","placeholder","disabled","icon","enableClear","required","children","name","error","errorMessage","className","id"]),T=(0,a.useRef)(null),_=a.Children.toArray(y),[E,M]=(0,d.default)(m,h),R=(0,a.useMemo)(()=>{let e=a.default.Children.toArray(y).filter(a.isValidElement);return(0,o.constructValueToNameMapping)(e)},[y]);return a.default.createElement("div",{className:(0,n.tremorTwMerge)("w-full min-w-[10rem] text-tremor-default",k)},a.default.createElement("div",{className:"relative"},a.default.createElement("select",{title:"select-hidden",required:v,className:(0,n.tremorTwMerge)("h-full w-full absolute left-0 top-0 -z-10 opacity-0"),value:E,onChange:e=>{e.preventDefault()},name:C,disabled:f,id:j,onFocus:()=>{let e=T.current;e&&e.focus()}},a.default.createElement("option",{className:"hidden",value:"",disabled:!0,hidden:!0},g),_.map(e=>{let t=e.props.value,r=e.props.children;return a.default.createElement("option",{className:"hidden",key:t,value:t},r)})),a.default.createElement(i.Listbox,Object.assign({as:"div",ref:l,defaultValue:E,value:E,onChange:e=>{null==p||p(e),M(e)},disabled:f,id:j},S),({value:e})=>{var t;return a.default.createElement(a.default.Fragment,null,a.default.createElement(i.ListboxButton,{ref:T,className:(0,n.tremorTwMerge)("w-full outline-none text-left whitespace-nowrap truncate rounded-tremor-default focus:ring-2 transition duration-100 border pr-8 py-2","border-tremor-border shadow-tremor-input focus:border-tremor-brand-subtle focus:ring-tremor-brand-muted","dark:border-dark-tremor-border dark:shadow-dark-tremor-input dark:focus:border-dark-tremor-brand-subtle dark:focus:ring-dark-tremor-brand-muted",x?"pl-10":"pl-3",(0,o.getSelectButtonColors)((0,o.hasValue)(e),f,w))},x&&a.default.createElement("span",{className:(0,n.tremorTwMerge)("absolute inset-y-0 left-0 flex items-center ml-px pl-2.5")},a.default.createElement(x,{className:(0,n.tremorTwMerge)(u("Icon"),"flex-none h-5 w-5","text-tremor-content-subtle","dark:text-dark-tremor-content-subtle")})),a.default.createElement("span",{className:"w-[90%] block truncate"},e&&null!=(t=R.get(e))?t:g),a.default.createElement("span",{className:(0,n.tremorTwMerge)("absolute inset-y-0 right-0 flex items-center mr-3")},a.default.createElement(r.default,{className:(0,n.tremorTwMerge)(u("arrowDownIcon"),"flex-none h-5 w-5","text-tremor-content-subtle","dark:text-dark-tremor-content-subtle")}))),b&&E?a.default.createElement("button",{type:"button",className:(0,n.tremorTwMerge)("absolute inset-y-0 right-0 flex items-center mr-8"),onClick:e=>{e.preventDefault(),M(""),null==p||p("")}},a.default.createElement(s.default,{className:(0,n.tremorTwMerge)(u("clearIcon"),"flex-none h-4 w-4","text-tremor-content-subtle","dark:text-dark-tremor-content-subtle")})):null,a.default.createElement(c.Transition,{enter:"transition ease duration-100 transform",enterFrom:"opacity-0 -translate-y-4",enterTo:"opacity-100 translate-y-0",leave:"transition ease duration-100 transform",leaveFrom:"opacity-100 translate-y-0",leaveTo:"opacity-0 -translate-y-4"},a.default.createElement(i.ListboxOptions,{anchor:"bottom start",className:(0,n.tremorTwMerge)("z-10 w-[var(--button-width)] divide-y overflow-y-auto outline-none rounded-tremor-default max-h-[228px] border [--anchor-gap:4px]","bg-tremor-background border-tremor-border divide-tremor-border shadow-tremor-dropdown","dark:bg-dark-tremor-background dark:border-dark-tremor-border dark:divide-dark-tremor-border dark:shadow-dark-tremor-dropdown")},y)))})),w&&N?a.default.createElement("p",{className:(0,n.tremorTwMerge)("errorMessage","text-sm text-rose-500 mt-1")},N):null)});m.displayName="Select",e.s(["Select",0,m],206929)},254709,e=>{"use strict";var t=e.i(843476),r=e.i(584935),a=e.i(304967),s=e.i(309426),n=e.i(350967),l=e.i(752978),o=e.i(621642),i=e.i(25080),c=e.i(37091),d=e.i(197647),u=e.i(653824),m=e.i(881073),h=e.i(404206),p=e.i(723731),g=e.i(599724),f=e.i(271645),x=e.i(727749),b=e.i(144267),v=e.i(278587),y=e.i(602869),C=e.i(994388),w=e.i(220508),N=e.i(964306),k=e.i(551332);let j=({responseTimeMs:e})=>null==e?null:(0,t.jsxs)("div",{className:"flex items-center space-x-1 text-xs text-gray-500 font-mono",children:[(0,t.jsx)("svg",{className:"w-4 h-4",viewBox:"0 0 24 24",fill:"none",xmlns:"http://www.w3.org/2000/svg",children:(0,t.jsx)("path",{d:"M12 6V12L16 14M12 2C6.47715 2 2 6.47715 2 12C2 17.5228 6.47715 22 12 22C17.5228 22 22 17.5228 22 12C22 6.47715 17.5228 2 12 2Z",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})}),(0,t.jsxs)("span",{children:[e.toFixed(0),"ms"]})]}),S=e=>{let t=e;if("string"==typeof t)try{t=JSON.parse(t)}catch{}return t},T=({label:e,value:r})=>{let[a,s]=f.default.useState(!1),[n,l]=f.default.useState(!1),o=r?.toString()||"N/A",i=o.length>50?o.substring(0,50)+"...":o;return(0,t.jsx)("tr",{className:"hover:bg-gray-50",children:(0,t.jsx)("td",{className:"px-4 py-2 align-top",colSpan:2,children:(0,t.jsxs)("div",{className:"flex items-center justify-between group",children:[(0,t.jsxs)("div",{className:"flex items-center flex-1",children:[(0,t.jsx)("button",{onClick:()=>s(!a),className:"text-gray-400 hover:text-gray-600 mr-2",children:a?"▼":"▶"}),(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"text-sm text-gray-600",children:e}),(0,t.jsx)("pre",{className:"mt-1 text-sm font-mono text-gray-800 whitespace-pre-wrap",children:a?o:i})]})]}),(0,t.jsx)("button",{onClick:()=>{navigator.clipboard.writeText(o),l(!0),setTimeout(()=>l(!1),2e3)},className:"opacity-0 group-hover:opacity-100 text-gray-400 hover:text-gray-600",children:(0,t.jsx)(k.ClipboardCopyIcon,{className:"h-4 w-4"})})]})})})},_=({response:e})=>{let r=null,a={},s={};try{if(e?.error)try{let t="string"==typeof e.error.message?JSON.parse(e.error.message):e.error.message;r={message:t?.message||"Unknown error",traceback:t?.traceback||"No traceback available",litellm_params:t?.litellm_cache_params||{},health_check_cache_params:t?.health_check_cache_params||{}},a=S(r.litellm_params)||{},s=S(r.health_check_cache_params)||{}}catch(t){console.warn("Error parsing error details:",t),r={message:String(e.error.message||"Unknown error"),traceback:"Error parsing details",litellm_params:{},health_check_cache_params:{}}}else a=S(e?.litellm_cache_params)||{},s=S(e?.health_check_cache_params)||{}}catch(e){console.warn("Error in response parsing:",e),a={},s={}}let n={redis_host:s?.redis_client?.connection_pool?.connection_kwargs?.host||s?.redis_async_client?.connection_pool?.connection_kwargs?.host||s?.connection_kwargs?.host||s?.host||"N/A",redis_port:s?.redis_client?.connection_pool?.connection_kwargs?.port||s?.redis_async_client?.connection_pool?.connection_kwargs?.port||s?.connection_kwargs?.port||s?.port||"N/A",redis_version:s?.redis_version||"N/A",startup_nodes:(()=>{try{if(s?.redis_kwargs?.startup_nodes)return JSON.stringify(s.redis_kwargs.startup_nodes);let e=s?.redis_client?.connection_pool?.connection_kwargs?.host||s?.redis_async_client?.connection_pool?.connection_kwargs?.host,t=s?.redis_client?.connection_pool?.connection_kwargs?.port||s?.redis_async_client?.connection_pool?.connection_kwargs?.port;return e&&t?JSON.stringify([{host:e,port:t}]):"N/A"}catch(e){return"N/A"}})(),namespace:s?.namespace||"N/A"};return(0,t.jsx)("div",{className:"bg-white rounded-lg shadow-sm",children:(0,t.jsxs)(u.TabGroup,{children:[(0,t.jsxs)(m.TabList,{className:"border-b border-gray-200 px-4",children:[(0,t.jsx)(d.Tab,{className:"px-4 py-2 text-sm font-medium text-gray-600 hover:text-gray-800",children:"Summary"}),(0,t.jsx)(d.Tab,{className:"px-4 py-2 text-sm font-medium text-gray-600 hover:text-gray-800",children:"Raw Response"})]}),(0,t.jsxs)(p.TabPanels,{children:[(0,t.jsx)(h.TabPanel,{className:"p-4",children:(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{className:"flex items-center mb-6",children:[e?.status==="healthy"?(0,t.jsx)(w.CheckCircleIcon,{className:"h-5 w-5 text-green-500 mr-2"}):(0,t.jsx)(N.XCircleIcon,{className:"h-5 w-5 text-red-500 mr-2"}),(0,t.jsxs)(g.Text,{className:`text-sm font-medium ${e?.status==="healthy"?"text-green-500":"text-red-500"}`,children:["Cache Status: ",e?.status||"unhealthy"]})]}),(0,t.jsx)("table",{className:"w-full border-collapse",children:(0,t.jsxs)("tbody",{children:[r&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("tr",{children:(0,t.jsx)("td",{colSpan:2,className:"pt-4 pb-2 font-semibold text-red-600",children:"Error Details"})}),(0,t.jsx)(T,{label:"Error Message",value:r.message}),(0,t.jsx)(T,{label:"Traceback",value:r.traceback})]}),(0,t.jsx)("tr",{children:(0,t.jsx)("td",{colSpan:2,className:"pt-4 pb-2 font-semibold",children:"Cache Details"})}),(0,t.jsx)(T,{label:"Cache Configuration",value:String(a?.type)}),(0,t.jsx)(T,{label:"Ping Response",value:String(e.ping_response)}),(0,t.jsx)(T,{label:"Set Cache Response",value:e.set_cache_response||"N/A"}),(0,t.jsx)(T,{label:"litellm_settings.cache_params",value:JSON.stringify(a,null,2)}),a?.type==="redis"&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("tr",{children:(0,t.jsx)("td",{colSpan:2,className:"pt-4 pb-2 font-semibold",children:"Redis Details"})}),(0,t.jsx)(T,{label:"Redis Host",value:n.redis_host||"N/A"}),(0,t.jsx)(T,{label:"Redis Port",value:n.redis_port||"N/A"}),(0,t.jsx)(T,{label:"Redis Version",value:n.redis_version||"N/A"}),(0,t.jsx)(T,{label:"Startup Nodes",value:n.startup_nodes||"N/A"}),(0,t.jsx)(T,{label:"Namespace",value:n.namespace||"N/A"})]})]})})]})}),(0,t.jsx)(h.TabPanel,{className:"p-4",children:(0,t.jsx)("div",{className:"bg-gray-50 rounded-md p-4 font-mono text-sm",children:(0,t.jsx)("pre",{className:"whitespace-pre-wrap wrap-break-word overflow-auto max-h-[500px]",children:(()=>{try{let t={...e,litellm_cache_params:a,health_check_cache_params:s},r=JSON.parse(JSON.stringify(t,(e,t)=>{if("string"==typeof t)try{return JSON.parse(t)}catch{}return t}));return JSON.stringify(r,null,2)}catch(e){return"Error formatting JSON: "+e.message}})()})})})]})]})})},E=({accessToken:e,healthCheckResponse:r,runCachingHealthCheck:a,responseTimeMs:s})=>{let[n,l]=f.default.useState(null),[o,i]=f.default.useState(!1),c=async()=>{i(!0);let e=performance.now();await a(),l(performance.now()-e),i(!1)};return(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between",children:[(0,t.jsx)(C.Button,{onClick:c,disabled:o,className:"bg-indigo-600 hover:bg-indigo-700 disabled:bg-indigo-400 text-white text-sm px-4 py-2 rounded-md",children:o?"Running Health Check...":"Run Health Check"}),(0,t.jsx)(j,{responseTimeMs:n})]}),r&&(0,t.jsx)(_,{response:r})]})};var M=e.i(677667),R=e.i(898667),P=e.i(130643),L=e.i(808613),A=e.i(695411),I=e.i(206929),O=e.i(35983);let F=({redisType:e,redisTypeDescriptions:r,onTypeChange:a})=>(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Redis Type"}),(0,t.jsxs)(I.Select,{value:e,onValueChange:a,children:[(0,t.jsx)(O.SelectItem,{value:"node",children:"Node (Single Instance)"}),(0,t.jsx)(O.SelectItem,{value:"cluster",children:"Cluster"}),(0,t.jsx)(O.SelectItem,{value:"sentinel",children:"Sentinel"}),(0,t.jsx)(O.SelectItem,{value:"semantic",children:"Semantic"})]}),(0,t.jsx)("p",{className:"text-xs text-gray-500",children:r[e]||"Select the type of Redis deployment you're using"})]});var D=e.i(311451),H=e.i(199133),V=e.i(790848);let B=({field:e,embeddingModels:r})=>(0,t.jsx)(L.Form.Item,{name:e.name,label:e.label,extra:e.helpText,rules:e.rules,valuePropName:"boolean"===e.type?"checked":"value",children:((e,r)=>{switch(e.type){case"boolean":return(0,t.jsx)(V.Switch,{});case"password":return(0,t.jsx)(D.Input.Password,{placeholder:e.helpText,autoComplete:"new-password"});case"integer":case"float":return(0,t.jsx)(D.Input,{inputMode:"decimal",placeholder:e.helpText});case"list":return(0,t.jsx)(D.Input.TextArea,{rows:4,placeholder:e.helpText});case"model-select":return(0,t.jsx)(H.Select,{showSearch:!0,allowClear:!0,placeholder:"Search and select a model...",options:r,optionFilterProp:"label",style:{width:"100%"}});default:return(0,t.jsx)(D.Input,{placeholder:e.helpText})}})(e,r)}),J=["node","cluster","sentinel","semantic"],U={node:"Standard Redis node/single instance",cluster:"Redis Cluster mode for high availability and horizontal scaling",sentinel:"Redis Sentinel mode for high availability with automatic failover",semantic:"Semantic caching that reuses responses for similar prompts"},q={validator:(e,t)=>{let r;if(null==t||""===String(t).trim())return Promise.resolve();try{r=JSON.parse(String(t))}catch{return Promise.reject(Error("Must be a valid JSON array (use double quotes)"))}return Array.isArray(r)?Promise.resolve():Promise.reject(Error("Must be a JSON array"))}},G={validator:(e,t)=>{if(null==t||""===String(t).trim())return Promise.resolve();let r=Number(t);return!Number.isInteger(r)||r<0?Promise.reject(Error("Must be a non-negative integer")):Promise.resolve()}},z={validator:(e,t)=>null==t||""===String(t).trim()?Promise.resolve():Number.isNaN(Number(t))?Promise.reject(Error("Must be a number")):Promise.resolve()},W=[{name:"url",label:"Redis URL",type:"string",section:"connection",helpText:"Full Redis/Valkey connection URL (e.g. redis://:password@host:6379/1). When set, it takes precedence over Host, Port, Password, and Database Index.",redisType:null},{name:"host",label:"Host",type:"string",section:"connection",helpText:"Redis server hostname or IP address",redisType:null},{name:"port",label:"Port",type:"string",section:"connection",helpText:"Redis server port number",redisType:null,defaultValue:"6379",rules:[{validator:(e,t)=>{if(null==t||""===String(t).trim())return Promise.resolve();let r=Number(t);return!Number.isInteger(r)||r<1||r>65535?Promise.reject(Error("Port must be an integer between 1 and 65535")):Promise.resolve()}}]},{name:"db",label:"Database Index",type:"integer",section:"connection",helpText:"Logical database index to isolate the cache (e.g. 1 for redis://host:6379/1)",redisType:null,rules:[G]},{name:"password",label:"Password",type:"password",section:"connection",helpText:"Redis server password",redisType:null},{name:"username",label:"Username",type:"string",section:"connection",helpText:"Redis server username (if required)",redisType:null},{name:"redis_startup_nodes",label:"Startup Nodes",type:"list",section:"cluster",helpText:'List of startup nodes for Redis Cluster (e.g., [{"host": "127.0.0.1", "port": "7001"}])',redisType:"cluster",rules:[q]},{name:"sentinel_nodes",label:"Sentinel Nodes",type:"list",section:"sentinel",helpText:'List of Sentinel nodes (e.g., [["localhost", 26379]])',redisType:"sentinel",rules:[q]},{name:"service_name",label:"Service Name",type:"string",section:"sentinel",helpText:"Master service name for Redis Sentinel",redisType:"sentinel"},{name:"sentinel_password",label:"Sentinel Password",type:"password",section:"sentinel",helpText:"Password for Redis Sentinel authentication",redisType:"sentinel"},{name:"similarity_threshold",label:"Similarity Threshold",type:"float",section:"semantic",helpText:"Similarity threshold for semantic cache",redisType:"semantic",defaultValue:.8,rules:[z]},{name:"redis_semantic_cache_embedding_model",label:"Embedding Model",type:"model-select",section:"semantic",helpText:"Embedding model for semantic cache",redisType:"semantic"},{name:"ssl",label:"SSL",type:"boolean",section:"ssl",helpText:"Enable SSL/TLS connection",redisType:null,defaultValue:!1},{name:"ssl_cert_reqs",label:"SSL Cert Reqs",type:"string",section:"ssl",helpText:"SSL certificate requirements (None, CERT_REQUIRED, CERT_OPTIONAL)",redisType:null},{name:"ssl_check_hostname",label:"SSL Check Hostname",type:"boolean",section:"ssl",helpText:"Enable SSL hostname verification",redisType:null,defaultValue:!1},{name:"namespace",label:"Namespace",type:"string",section:"cacheManagement",helpText:"Namespace prefix for cache keys",redisType:null},{name:"ttl",label:"TTL (seconds)",type:"float",section:"cacheManagement",helpText:"Time-to-live for cached items in seconds",redisType:null,rules:[z]},{name:"max_connections",label:"Max Connections",type:"integer",section:"cacheManagement",helpText:"Maximum number of connections in the connection pool",redisType:null,rules:[G]},{name:"gcp_service_account",label:"GCP Service Account",type:"string",section:"gcp",helpText:"GCP service account for IAM authentication (e.g., projects/-/serviceAccounts/your-sa@project.iam.gserviceaccount.com)",redisType:null},{name:"gcp_ssl_ca_certs",label:"GCP SSL CA Certs",type:"string",section:"gcp",helpText:"Path to SSL CA certificate file for GCP Memorystore Redis",redisType:null}],Y=(e,t)=>null===e.redisType||e.redisType===t,X=(e,t,{forTesting:r})=>({type:r||"semantic"!==e?"redis":"redis-semantic",...Object.fromEntries(W.filter(t=>Y(t,e)).flatMap(e=>{let r=((e,t)=>{if("boolean"===e.type)return!!t;if("list"===e.type){if("string"!=typeof t||""===t.trim())return;try{return JSON.parse(t)}catch{return}}if("integer"===e.type||"float"===e.type){if(null==t||""===t)return;let e=Number(t);return Number.isNaN(e)?void 0:e}if("string"!=typeof t)return void 0===t?void 0:String(t);let r=t.trim();return""===r?void 0:r})(e,t[e.name]);return void 0===r?[]:[[e.name,r]]}))}),Z=({title:e,section:r,redisType:a,embeddingModels:s,gridCols:n="grid-cols-1 gap-6 sm:grid-cols-2",headingLevel:l="h4"})=>{let o=W.filter(e=>e.section===r&&Y(e,a));return 0===o.length?null:(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsx)(l,{className:"text-sm font-medium text-gray-900",children:e}),(0,t.jsx)("div",{className:`grid ${n}`,children:o.map(e=>(0,t.jsx)(B,{field:e,embeddingModels:s},e.name))})]})},$=e=>J.includes(e)?e:"node",K=({accessToken:e})=>{let[r]=L.Form.useForm(),[a,s]=(0,f.useState)("node"),[n,l]=(0,f.useState)([]),[o,i]=(0,f.useState)(!1),[c,d]=(0,f.useState)(!1),u=(0,f.useCallback)(async()=>{if(e)try{let t=(await (0,y.getCacheSettingsCall)(e)).current_values??{};r.setFieldsValue(Object.fromEntries(W.map(e=>{let r;return[e.name,(r=t[e.name]??e.defaultValue,"boolean"===e.type?!0===r||"true"===r:"list"===e.type?null==r||""===r?"":"string"==typeof r?r:JSON.stringify(r,null,2):null==r?"":String(r))]}))),s($(t.redis_type))}catch(e){console.error("Failed to load cache settings:",e),x.default.fromBackend("Failed to load cache settings")}},[e,r]);(0,f.useEffect)(()=>{u()},[u]),(0,f.useEffect)(()=>{e&&(0,A.fetchAvailableModels)(e).then(e=>l(e.filter(e=>"embedding"===e.mode).map(e=>({value:e.model_group,label:e.model_group})))).catch(e=>console.error("Error fetching embedding models:",e))},[e]);let m=async()=>{try{return await r.validateFields()}catch{return null}},h=async()=>{if(!e)return;let t=await m();if(null!==t){i(!0);try{let r=await (0,y.testCacheConnectionCall)(e,X(a,t,{forTesting:!0}));"success"===r.status?x.default.success("Cache connection test successful!"):x.default.fromBackend(`Connection test failed: ${r.message||r.error}`)}catch(e){console.error("Test connection error:",e),x.default.fromBackend(`Connection test failed: ${e instanceof Error?e.message:"Unknown error"}`)}finally{i(!1)}}},p=async()=>{if(!e)return;let t=await m();if(null!==t){d(!0);try{await (0,y.updateCacheSettingsCall)(e,X(a,t,{forTesting:!1})),x.default.success("Cache settings updated successfully"),await u()}catch(e){console.error("Failed to save cache settings:",e),x.default.fromBackend("Failed to update cache settings")}finally{d(!1)}}};return e?(0,t.jsxs)("div",{className:"w-full space-y-8 py-2",children:[(0,t.jsxs)(L.Form,{form:r,layout:"vertical",requiredMark:!1,className:"space-y-6",children:[(0,t.jsxs)("div",{className:"max-w-3xl",children:[(0,t.jsx)("h3",{className:"text-sm font-medium text-gray-900",children:"Cache Settings"}),(0,t.jsx)("p",{className:"text-xs text-gray-500 mt-1",children:"Configure Redis cache for LiteLLM"})]}),(0,t.jsx)(F,{redisType:a,redisTypeDescriptions:U,onTypeChange:e=>s($(e))}),(0,t.jsx)("div",{className:"pt-4 border-t border-gray-200",children:(0,t.jsx)(Z,{title:"Connection Settings",section:"connection",redisType:a,embeddingModels:n})}),"cluster"===a&&(0,t.jsx)("div",{className:"pt-4 border-t border-gray-200",children:(0,t.jsx)(Z,{title:"Cluster Configuration",section:"cluster",redisType:a,embeddingModels:n,gridCols:"grid-cols-1 gap-6"})}),"sentinel"===a&&(0,t.jsx)("div",{className:"pt-4 border-t border-gray-200",children:(0,t.jsx)(Z,{title:"Sentinel Configuration",section:"sentinel",redisType:a,embeddingModels:n})}),"semantic"===a&&(0,t.jsx)("div",{className:"pt-4 border-t border-gray-200",children:(0,t.jsx)(Z,{title:"Semantic Configuration",section:"semantic",redisType:a,embeddingModels:n})}),(0,t.jsxs)(M.Accordion,{className:"mt-4",children:[(0,t.jsx)(R.AccordionHeader,{children:(0,t.jsx)("span",{className:"text-sm font-medium text-gray-900",children:"Advanced Settings"})}),(0,t.jsx)(P.AccordionBody,{children:(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsx)(Z,{title:"SSL Settings",section:"ssl",redisType:a,embeddingModels:n,headingLevel:"h5"}),(0,t.jsx)(Z,{title:"Cache Management",section:"cacheManagement",redisType:a,embeddingModels:n,headingLevel:"h5"}),(0,t.jsx)(Z,{title:"GCP Authentication",section:"gcp",redisType:a,embeddingModels:n,headingLevel:"h5"})]})})]})]}),(0,t.jsxs)("div",{className:"border-t border-gray-200 pt-6 flex justify-end gap-3",children:[(0,t.jsx)(C.Button,{variant:"secondary",size:"sm",onClick:h,disabled:o,className:"text-sm",children:o?"Testing...":"Test Connection"}),(0,t.jsx)(C.Button,{size:"sm",onClick:p,disabled:c,className:"text-sm font-medium",children:c?"Saving...":"Save Changes"})]})]}):null},Q=e=>{if(e)return e.toISOString().split("T")[0]};function ee(e){return new Intl.NumberFormat("en-US",{maximumFractionDigits:0,notation:"compact",compactDisplay:"short"}).format(e)}let et=({accessToken:e,token:C,userRole:w,userID:N,premiumUser:k})=>{let[j,S]=(0,f.useState)([]),[T,_]=(0,f.useState)([]),[M,R]=(0,f.useState)([]),[P,L]=(0,f.useState)([]),[A,I]=(0,f.useState)("0"),[O,F]=(0,f.useState)("0"),[D,H]=(0,f.useState)("0"),[V,B]=(0,f.useState)({from:new Date(Date.now()-6048e5),to:new Date}),[J,U]=(0,f.useState)(""),[q,G]=(0,f.useState)("");(0,f.useEffect)(()=>{e&&V&&((async()=>{L(await (0,y.adminGlobalCacheActivity)(e,Q(V.from),Q(V.to)))})(),U(new Date().toLocaleString()))},[e]);let z=Array.from(new Set(P.map(e=>e?.api_key??""))),W=Array.from(new Set(P.map(e=>e?.model??"")));Array.from(new Set(P.map(e=>e?.call_type??"")));let Y=async(t,r)=>{t&&r&&e&&L(await (0,y.adminGlobalCacheActivity)(e,Q(t),Q(r)))};(0,f.useEffect)(()=>{let e=P;T.length>0&&(e=e.filter(e=>T.includes(e.api_key))),M.length>0&&(e=e.filter(e=>M.includes(e.model)));let t=0,r=0,a=0,s=e.reduce((e,s)=>{s.call_type||(s.call_type="Unknown"),t+=(s.total_rows||0)-(s.cache_hit_true_rows||0),r+=s.cache_hit_true_rows||0,a+=s.cached_completion_tokens||0;let n=e.find(e=>e.name===s.call_type);return n?(n["LLM API requests"]+=(s.total_rows||0)-(s.cache_hit_true_rows||0),n["Cache hit"]+=s.cache_hit_true_rows||0,n["Cached Completion Tokens"]+=s.cached_completion_tokens||0,n["Generated Completion Tokens"]+=s.generated_completion_tokens||0):e.push({name:s.call_type,"LLM API requests":(s.total_rows||0)-(s.cache_hit_true_rows||0),"Cache hit":s.cache_hit_true_rows||0,"Cached Completion Tokens":s.cached_completion_tokens||0,"Generated Completion Tokens":s.generated_completion_tokens||0}),e},[]);I(ee(r)),F(ee(a));let n=r+t;n>0?H((r/n*100).toFixed(2)):H("0"),S(s)},[T,M,V,P]);let X=async()=>{try{x.default.info("Running cache health check..."),G("");let t=await (0,y.cachingHealthCheckCall)(null!==e?e:"");G(t)}catch(t){let e;if(console.error("Error running health check:",t),t&&t.message)try{let r=JSON.parse(t.message);r.error&&(r=r.error),e=r}catch(r){e={message:t.message}}else e={message:"Unknown error occurred"};G({error:e})}};return(0,t.jsxs)(u.TabGroup,{className:"gap-2 p-8 h-full w-full mt-2 mb-8",children:[(0,t.jsxs)(m.TabList,{className:"flex justify-between mt-2 w-full items-center",children:[(0,t.jsxs)("div",{className:"flex",children:[(0,t.jsx)(d.Tab,{children:"Cache Analytics"}),(0,t.jsx)(d.Tab,{children:"Cache Health"}),(0,t.jsx)(d.Tab,{children:"Cache Settings"})]}),(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[J&&(0,t.jsxs)(g.Text,{children:["Last Refreshed: ",J]}),(0,t.jsx)(l.Icon,{icon:v.RefreshIcon,variant:"shadow",size:"xs",className:"self-center",onClick:()=>{U(new Date().toLocaleString())}})]})]}),(0,t.jsxs)(p.TabPanels,{children:[(0,t.jsx)(h.TabPanel,{children:(0,t.jsxs)(a.Card,{children:[(0,t.jsxs)(n.Grid,{numItems:3,className:"gap-4 mt-4",children:[(0,t.jsx)(s.Col,{children:(0,t.jsx)(o.MultiSelect,{placeholder:"Select Virtual Keys",value:T,onValueChange:_,children:z.map(e=>(0,t.jsx)(i.MultiSelectItem,{value:e,children:e},e))})}),(0,t.jsx)(s.Col,{children:(0,t.jsx)(o.MultiSelect,{placeholder:"Select Models",value:M,onValueChange:R,children:W.map(e=>(0,t.jsx)(i.MultiSelectItem,{value:e,children:e},e))})}),(0,t.jsx)(s.Col,{children:(0,t.jsx)(b.default,{value:V,onValueChange:e=>{B(e),Y(e.from,e.to)}})})]}),(0,t.jsxs)("div",{className:"grid grid-cols-1 gap-6 sm:grid-cols-2 lg:grid-cols-3 mt-4",children:[(0,t.jsxs)(a.Card,{children:[(0,t.jsx)("p",{className:"text-tremor-default font-medium text-tremor-content dark:text-dark-tremor-content",children:"Cache Hit Ratio"}),(0,t.jsx)("div",{className:"mt-2 flex items-baseline space-x-2.5",children:(0,t.jsxs)("p",{className:"text-tremor-metric font-semibold text-tremor-content-strong dark:text-dark-tremor-content-strong",children:[D,"%"]})})]}),(0,t.jsxs)(a.Card,{children:[(0,t.jsx)("p",{className:"text-tremor-default font-medium text-tremor-content dark:text-dark-tremor-content",children:"Cache Hits"}),(0,t.jsx)("div",{className:"mt-2 flex items-baseline space-x-2.5",children:(0,t.jsx)("p",{className:"text-tremor-metric font-semibold text-tremor-content-strong dark:text-dark-tremor-content-strong",children:A})})]}),(0,t.jsxs)(a.Card,{children:[(0,t.jsx)("p",{className:"text-tremor-default font-medium text-tremor-content dark:text-dark-tremor-content",children:"Cached Tokens"}),(0,t.jsx)("div",{className:"mt-2 flex items-baseline space-x-2.5",children:(0,t.jsx)("p",{className:"text-tremor-metric font-semibold text-tremor-content-strong dark:text-dark-tremor-content-strong",children:O})})]})]}),(0,t.jsx)(c.Subtitle,{className:"mt-4",children:"Cache Hits vs API Requests"}),(0,t.jsx)(r.BarChart,{title:"Cache Hits vs API Requests",data:j,stack:!0,index:"name",valueFormatter:ee,categories:["LLM API requests","Cache hit"],colors:["sky","teal"],yAxisWidth:48}),(0,t.jsx)(c.Subtitle,{className:"mt-4",children:"Cached Completion Tokens vs Generated Completion Tokens"}),(0,t.jsx)(r.BarChart,{className:"mt-6",data:j,stack:!0,index:"name",valueFormatter:ee,categories:["Generated Completion Tokens","Cached Completion Tokens"],colors:["sky","teal"],yAxisWidth:48})]})}),(0,t.jsx)(h.TabPanel,{children:(0,t.jsx)(E,{accessToken:e,healthCheckResponse:q,runCachingHealthCheck:X})}),(0,t.jsx)(h.TabPanel,{children:(0,t.jsx)(K,{accessToken:e,userRole:w,userID:N})})]})]})};var er=e.i(135214);e.s(["default",0,function(){let{accessToken:e,userRole:r,userId:a,token:s,premiumUser:n}=(0,er.default)();return(0,t.jsx)(et,{userID:a,userRole:r,token:s,accessToken:e,premiumUser:n})}],254709)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/00g6xfr4yow7h.js b/litellm/proxy/_experimental/out/_next/static/chunks/00g6xfr4yow7h.js new file mode 100644 index 00000000000..248cab25929 --- /dev/null +++ b/litellm/proxy/_experimental/out/_next/static/chunks/00g6xfr4yow7h.js @@ -0,0 +1 @@ +(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,263005,e=>{"use strict";var t=e.i(843476);e.s(["PageHeader",0,function({title:e,subtitle:a,icon:l,actions:i}){return(0,t.jsxs)("div",{className:"flex flex-wrap items-start justify-between gap-4",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2.5",children:[null!=l&&(0,t.jsx)("span",{className:"flex flex-none items-center text-foreground",children:l}),(0,t.jsxs)("div",{className:"min-w-0",children:[(0,t.jsx)("h1",{className:"text-xl font-semibold tracking-tight text-foreground",children:e}),null!=a&&(0,t.jsx)("p",{className:"mt-0.5 text-sm text-muted-foreground",children:a})]})]}),null!=i&&(0,t.jsx)("div",{className:"flex items-center gap-2",children:i})]})}])},655063,e=>{"use strict";var t=e.i(399029),a=e.i(271645);e.s(["useDebouncedValue",0,function(e,l,i){let[r,s,n]=(0,t.useDebouncedState)(e,l,i);return(0,a.useEffect)(()=>{s(e)},[e,s]),[r,n]}])},624687,e=>{"use strict";var t=e.i(843476),a=e.i(271645),l=e.i(115504);let i=a.forwardRef(({className:e,...a},i)=>(0,t.jsx)("textarea",{ref:i,"data-slot":"textarea",className:(0,l.cn)("flex field-sizing-content min-h-16 w-full rounded-md border border-input bg-transparent px-2.5 py-2 text-base shadow-xs transition-[color,box-shadow] outline-none placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 md:text-sm dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40",e),...a}));i.displayName="Textarea",e.s(["Textarea",0,i])},950594,e=>{"use strict";var t=e.i(843476),a=e.i(271645),l=e.i(115504),i=e.i(519455),r=e.i(793479),s=e.i(624687);let n=(0,l.cva)({base:"flex h-auto cursor-text items-center justify-center gap-2 py-1.5 text-sm font-medium text-muted-foreground select-none group-data-[disabled=true]/input-group:opacity-50 [&>kbd]:rounded-[calc(var(--radius)-5px)] [&>svg:not([class*='size-'])]:size-4",variants:{align:{"inline-start":"order-first pl-2 has-[>button]:-ml-1 has-[>kbd]:ml-[-0.15rem]","inline-end":"order-last pr-2 has-[>button]:-mr-1 has-[>kbd]:mr-[-0.15rem]","block-start":"order-first w-full justify-start px-2.5 pt-2 group-has-[>input]/input-group:pt-2 [.border-b]:pb-2","block-end":"order-last w-full justify-start px-2.5 pb-2 group-has-[>input]/input-group:pb-2 [.border-t]:pt-2"}},defaultVariants:{align:"inline-start"}}),o=(0,l.cva)({base:"flex items-center gap-2 text-sm shadow-none",variants:{size:{xs:"h-6 gap-1 rounded-[calc(var(--radius)-5px)] px-1.5 [&>svg:not([class*='size-'])]:size-3.5",sm:"","icon-xs":"size-6 rounded-[calc(var(--radius)-5px)] p-0 has-[>svg]:p-0","icon-sm":"size-8 p-0 has-[>svg]:p-0"}},defaultVariants:{size:"xs"}}),d=a.forwardRef(({className:e,type:a="button",variant:r="ghost",size:s="xs",...n},d)=>(0,t.jsx)(i.Button,{ref:d,type:a,"data-size":s,variant:r,className:(0,l.cn)(o({size:s}),e),...n}));d.displayName="InputGroupButton";let u=a.forwardRef(({className:e,...a},i)=>(0,t.jsx)(r.Input,{ref:i,"data-slot":"input-group-control",className:(0,l.cn)("flex-1 rounded-none border-0 bg-transparent shadow-none ring-0 focus-visible:ring-0 aria-invalid:ring-0 dark:bg-transparent",e),...a}));u.displayName="InputGroupInput",a.forwardRef(({className:e,...a},i)=>(0,t.jsx)(s.Textarea,{ref:i,"data-slot":"input-group-control",className:(0,l.cn)("flex-1 resize-none rounded-none border-0 bg-transparent py-2 shadow-none ring-0 focus-visible:ring-0 aria-invalid:ring-0 dark:bg-transparent",e),...a})).displayName="InputGroupTextarea",e.s(["InputGroup",0,function({className:e,...a}){return(0,t.jsx)("div",{"data-slot":"input-group",role:"group",className:(0,l.cn)("group/input-group relative flex h-9 w-full min-w-0 items-center rounded-md border border-input shadow-xs transition-[color,box-shadow] outline-none in-data-[slot=combobox-content]:focus-within:border-inherit in-data-[slot=combobox-content]:focus-within:ring-0 has-[[data-slot=input-group-control]:focus-visible]:border-ring has-[[data-slot=input-group-control]:focus-visible]:ring-3 has-[[data-slot=input-group-control]:focus-visible]:ring-ring/50 has-[[data-slot][aria-invalid=true]]:border-destructive has-[[data-slot][aria-invalid=true]]:ring-3 has-[[data-slot][aria-invalid=true]]:ring-destructive/20 has-[>[data-align=block-end]]:h-auto has-[>[data-align=block-end]]:flex-col has-[>[data-align=block-start]]:h-auto has-[>[data-align=block-start]]:flex-col has-[>textarea]:h-auto dark:bg-input/30 dark:has-[[data-slot][aria-invalid=true]]:ring-destructive/40 has-[>[data-align=block-end]]:[&>input]:pt-3 has-[>[data-align=block-start]]:[&>input]:pb-3 has-[>[data-align=inline-end]]:[&>input]:pr-1.5 has-[>[data-align=inline-start]]:[&>input]:pl-1.5",e),...a})},"InputGroupAddon",0,function({className:e,align:a="inline-start",...i}){return(0,t.jsx)("div",{role:"group","data-slot":"input-group-addon","data-align":a,className:(0,l.cn)(n({align:a}),e),onClick:e=>{e.target.closest("button")||e.currentTarget.parentElement?.querySelector("input")?.focus()},...i})},"InputGroupButton",0,d,"InputGroupInput",0,u,"InputGroupText",0,function({className:e,...a}){return(0,t.jsx)("span",{className:(0,l.cn)("flex items-center gap-2 text-sm text-muted-foreground [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4",e),...a})}])},552546,e=>{"use strict";var t=e.i(843476),a=e.i(131792);let l=(e,t)=>{let a=t.trim().toLowerCase();return!a||e.label.toLowerCase().includes(a)||(e.sublabel?.toLowerCase().includes(a)??!1)};e.s(["SearchSelect",0,function({options:e,value:i,onValueChange:r,placeholder:s="Select…",emptyText:n="No results",disabled:o=!1,className:d}){let u=e.find(e=>e.value===i)??null;return(0,t.jsxs)(a.Combobox,{items:e,value:u,onValueChange:e=>r(e?.value??""),isItemEqualToValue:(e,t)=>e.value===t.value,itemToStringLabel:e=>e.label,filter:l,disabled:o,children:[(0,t.jsx)(a.ComboboxInput,{placeholder:s,showClear:null!=i&&""!==i,className:`w-full ${d??""}`}),(0,t.jsxs)(a.ComboboxContent,{children:[(0,t.jsx)(a.ComboboxEmpty,{children:n}),(0,t.jsx)(a.ComboboxList,{children:e=>(0,t.jsx)(a.ComboboxItem,{value:e,children:(0,t.jsxs)("span",{className:"flex min-w-0 flex-col",children:[(0,t.jsx)("span",{className:"truncate",children:e.label}),null!=e.sublabel&&""!==e.sublabel&&(0,t.jsx)("span",{className:"truncate text-xs text-muted-foreground",children:e.sublabel})]})},e.value)})]})]})}])},611363,e=>{"use strict";e.s(["navigateWithParams",0,function(e){let t=new URLSearchParams(window.location.search);e(t);let a=t.toString(),l=a?`${window.location.pathname}?${a}`:window.location.pathname;window.history.pushState(null,"",l)}])},502501,e=>{"use strict";var t=e.i(843476),a=e.i(785242),l=e.i(135214),i=e.i(268004),r=e.i(309426),s=e.i(350967),n=e.i(947293),o=e.i(271645),d=e.i(602869);let u=async(e,t,a,l,i)=>{i("Admin"!=a&&"Admin Viewer"!=a?await (0,d.teamListCall)(e,l?.organization_id||null,t):await (0,d.teamListCall)(e,l?.organization_id||null))};var c=e.i(702597),m=e.i(618566),g=e.i(611363),p=e.i(266027),x=e.i(207082),h=e.i(109799),f=e.i(741466);e.i(707701);var b=e.i(807235),v=e.i(981080),y=e.i(531649),_=e.i(552546),w=e.i(263005),k=e.i(793479),j=e.i(655063),S=e.i(465261),C=e.i(20147),I=e.i(827252),N=e.i(282786),z=e.i(898586),D=e.i(494862),T=e.i(302747);e.i(622826);var U=e.i(200208),E=e.i(399536),A=e.i(997422),R=e.i(547227),K=e.i(630500),V=e.i(112179),M=e.i(304911);let L=[{id:"spend",label:"Spend"},{id:"max_budget",label:"Budget"}],P=({userAlias:e,userEmail:a,userId:l,width:i})=>{let r=e||a||l,s="default_user_id"===l,n=(0,t.jsx)("div",{className:"flex flex-col gap-2 text-xs min-w-[200px] max-w-[300px]",children:[{label:"User Alias",value:e},{label:"User Email",value:a},{label:"User ID",value:l}].map(({label:e,value:a})=>(0,t.jsxs)("div",{className:"flex flex-col min-w-0",children:[(0,t.jsx)("span",{className:"text-gray-400",children:e}),a?(0,t.jsx)(z.Typography.Text,{className:"font-mono text-xs",ellipsis:{tooltip:a},copyable:!0,children:a}):(0,t.jsx)("span",{className:"font-mono",children:"-"})]},e))});return!s||e||a?(0,t.jsx)(N.Popover,{content:n,trigger:"hover",placement:"bottomLeft",children:(0,t.jsx)("span",{className:"font-mono text-xs truncate block cursor-default",style:{maxWidth:i,overflow:"hidden"},children:r||"-"})}):(0,t.jsx)(N.Popover,{content:n,trigger:"hover",placement:"bottomLeft",children:(0,t.jsx)("span",{className:"cursor-default",children:(0,t.jsx)(M.default,{userId:l})})})},B=({label:e,tooltip:a})=>(0,t.jsxs)("span",{className:"flex items-center gap-1",children:[e,(0,t.jsx)(N.Popover,{content:a,trigger:"hover",children:(0,t.jsx)(I.InfoCircleOutlined,{className:"text-gray-400 text-xs cursor-help"})})]}),O={token:!1,organization_alias:!1,created_by:!1,updated_at:!1,expires:!1,rate_limits:!1},F=[{id:"created_at",desc:!0}],G={team_id:"Team",org_id:"Organization",user_id:"User ID",key_hash:"Key ID"};function H({headerActions:e}){let i,r,s,{data:n}=(0,h.useOrganizations)(),u=(0,o.useMemo)(()=>n??[],[n]),{data:c}=(0,a.useAllTeams)(),I=(0,o.useMemo)(()=>c??[],[c]),{keyId:N,openKey:z,close:M}=(i=(0,m.useSearchParams)(),r=(0,o.useCallback)(e=>{(0,g.navigateWithParams)(t=>{t.set("key",e)})},[]),s=(0,o.useCallback)(()=>{(0,g.navigateWithParams)(e=>{e.delete("key")})},[]),{keyId:i?.get("key")??null,openKey:r,close:s}),[W,q]=(0,o.useState)(F),[$,J]=(0,o.useState)({pageIndex:0,pageSize:50}),[Q,X]=(0,o.useState)([]),[Y,Z]=(0,o.useState)(!1),[ee,et]=(0,o.useState)(""),[ea]=(0,j.useDebouncedValue)(ee,{wait:f.DEBOUNCE_WAIT_MS}),el=(0,o.useCallback)(e=>{let t=Q.find(t=>t.id===e);return"string"==typeof t?.value&&t.value.trim()?t.value.trim():void 0},[Q]),ei=W[0]?.id,er=(e=>{let t=e[0];if(t)return t.desc?"desc":"asc"})(W),es={teamID:el("team_id"),organizationID:el("org_id"),selectedKeyAlias:ea.trim()||void 0,userID:el("user_id"),keyHash:el("key_hash"),sortBy:ei,sortOrder:er,expand:"user"},{data:en,isPending:eo,isFetching:ed,refetch:eu}=(0,x.useKeys)($.pageIndex+1,$.pageSize,es),ec=(0,o.useMemo)(()=>en?.keys??[],[en]),em=en?.total_count??0,eg=(0,o.useCallback)(e=>{et(e),J(e=>({...e,pageIndex:0}))},[]),ep=(0,o.useCallback)(e=>{q(e),J(e=>({...e,pageIndex:0}))},[]),ex=(0,o.useCallback)(e=>{X(e),J(e=>({...e,pageIndex:0}))},[]),eh=(0,o.useMemo)(()=>(({allTeams:e,organizations:a,onSelectKey:l})=>[{id:"key_alias",accessorKey:"key_alias",meta:{title:"Key",renderSkeleton:()=>(0,t.jsxs)("div",{className:"flex flex-col gap-1 py-1",children:[(0,t.jsx)(T.Skeleton,{className:"h-4 w-32"}),(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(T.Skeleton,{className:"h-3 w-20"}),(0,t.jsx)(T.Skeleton,{className:"h-5 w-16 rounded-full"})]})]})},header:({column:e})=>(0,t.jsx)(D.DataTableSortHeader,{column:e,title:"Key",variant:"header-cycle"}),size:260,enableSorting:!0,cell:({row:e})=>{let a=(e=>{if(!0===e.blocked)return{tone:"error",label:"Blocked",tooltip:e.metadata?.scim_blocked===!0?"Blocked by SCIM (external identity provider deactivated or deleted the owning user).":"Blocked. Requests using this key will be rejected with 401."};let t=e.expires?Date.parse(e.expires):NaN;return!Number.isNaN(t)&&tl(e.original)})}},{id:"token",accessorKey:"token",meta:{title:"Key ID"},header:({column:e})=>(0,t.jsx)(D.DataTableSortHeader,{column:e,title:"Key ID",variant:"header-cycle"}),size:120,enableSorting:!0,cell:e=>(0,t.jsx)(E.IdCell,{value:e.getValue(),onClick:()=>l(e.row.original)})},{id:"team_alias",accessorKey:"team_id",meta:{title:"Team"},header:"Team",size:120,enableSorting:!1,cell:a=>{let l=a.getValue();if(!l)return"-";let i=e.find(e=>e.team_id===l),r=i?.team_alias||l,s=a.cell.column.getSize();return(0,t.jsx)("span",{className:"font-mono text-xs truncate block",style:{maxWidth:s,overflow:"hidden"},children:r})}},{id:"organization_alias",accessorKey:"org_id",meta:{title:"Organization"},header:"Organization",size:140,enableSorting:!1,cell:e=>{let l=e.getValue();if(!l)return"-";let i=a.find(e=>e.organization_id===l),r=i?.organization_alias||l,s=e.cell.column.getSize();return(0,t.jsx)("span",{className:"font-mono text-xs truncate block",style:{maxWidth:s,overflow:"hidden"},children:r})}},{id:"user",accessorKey:"user",meta:{title:"User"},header:()=>(0,t.jsx)(B,{label:"User",tooltip:"Displays the first available value: User Alias, User Email, or User ID."}),size:160,enableSorting:!1,cell:({row:e})=>{let a=e.original;return(0,t.jsx)(P,{userAlias:a.user?.user_alias??null,userEmail:a.user?.user_email??a.user_email??null,userId:a.user_id??null,width:160})}},{id:"created_at",accessorKey:"created_at",meta:{title:"Created At"},header:({column:e})=>(0,t.jsx)(D.DataTableSortHeader,{column:e,title:"Created At",variant:"header-cycle"}),size:120,enableSorting:!0,cell:e=>(0,t.jsx)(U.DateCell,{value:e.getValue(),precision:"date"})},{id:"created_by",accessorKey:"created_by",meta:{title:"Created By"},header:"Created By",size:160,enableSorting:!1,cell:e=>{let a=e.getValue();if(!a)return"-";let l=e.row.original.created_by_user;return(0,t.jsx)(P,{userAlias:l?.user_alias??null,userEmail:l?.user_email??null,userId:a,width:160})}},{id:"updated_at",accessorKey:"updated_at",meta:{title:"Updated At"},header:({column:e})=>(0,t.jsx)(D.DataTableSortHeader,{column:e,title:"Updated At",variant:"header-cycle"}),size:120,enableSorting:!0,cell:e=>(0,t.jsx)(U.DateCell,{value:e.getValue(),precision:"date",fallback:"Never"})},{id:"last_active",accessorKey:"last_active",meta:{title:"Last Active"},header:()=>(0,t.jsx)(B,{label:"Last Active",tooltip:"This is a new field and is not backfilled. Only new key usage will update this value."}),size:130,enableSorting:!1,cell:e=>(0,t.jsx)(U.DateCell,{value:e.getValue(),precision:"date",fallback:"Unknown"})},{id:"expires",accessorKey:"expires",meta:{title:"Expires"},header:"Expires",size:120,enableSorting:!1,cell:e=>(0,t.jsx)(U.DateCell,{value:e.getValue(),precision:"date",fallback:"Never"})},{id:"spend",accessorKey:"spend",meta:{title:"Spend / Budget",skeleton:"meter"},header:({table:e})=>(0,t.jsx)(D.DataTableMultiSortHeader,{table:e,fields:L}),size:180,enableSorting:!0,cell:({row:a})=>{let l=a.original.team_id,i=e.find(e=>e.team_id===l);return(0,t.jsx)(K.SpendBudgetCell,{spend:a.original.spend,maxBudget:a.original.max_budget,teamMaxBudget:i?.max_budget??null})}},{id:"budget_reset_at",accessorKey:"budget_reset_at",meta:{title:"Budget Reset"},header:"Budget Reset",size:130,enableSorting:!1,cell:e=>(0,t.jsx)(U.DateCell,{value:e.getValue(),fallback:"Never"})},{id:"models",accessorKey:"models",meta:{title:"Models",skeleton:"chips"},header:"Models",size:220,enableSorting:!1,cell:e=>(0,t.jsx)(R.ModelsCell,{models:e.getValue(),allowedRoutes:e.row.original.allowed_routes,keyType:e.row.original.key_type})},{id:"rate_limits",meta:{title:"Rate Limits"},header:"Rate Limits",size:140,enableSorting:!1,cell:({row:e})=>{let a=e.original;return(0,t.jsxs)("div",{className:"text-xs",children:[(0,t.jsxs)("div",{children:["TPM: ",null!==a.tpm_limit?a.tpm_limit:"Unlimited"]}),(0,t.jsxs)("div",{children:["RPM: ",null!==a.rpm_limit?a.rpm_limit:"Unlimited"]})]})}}])({allTeams:I,organizations:u,onSelectKey:e=>z(e.token)}),[I,u,z]),ef=(0,o.useMemo)(()=>ec.find(e=>e.token===N),[ec,N]),{data:eb,isError:ev}=function(e,t){let{accessToken:a}=(0,l.default)();return(0,p.useQuery)({queryKey:[...x.keyKeys.detail(e??""),a],queryFn:async()=>{if(!a||!e)throw Error("Missing access token or key id");return{...(await (0,d.keyInfoV1Call)(a,e)).info,token:e,api_key:e}},enabled:!!(a&&e)&&(t?.enabled??!0)})}(N,{enabled:!ef}),ey=ef??eb,e_=(0,o.useMemo)(()=>I.map(e=>({label:e.team_alias||e.team_id,value:e.team_id,sublabel:e.team_alias?e.team_id:void 0})),[I]),ew=(0,o.useMemo)(()=>u.filter(e=>e.organization_id).map(e=>{let t=e.organization_id;return{label:e.organization_alias||t,value:t,sublabel:e.organization_alias?t:void 0}}),[u]),ek=(0,o.useCallback)((e,t)=>{let a=String(t);return"team_id"===e?I.find(e=>e.team_id===a)?.team_alias||a:"org_id"===e&&u.find(e=>e.organization_id===a)?.organization_alias||a},[I,u]);return N?ey||ev?(0,t.jsx)("div",{className:"w-full h-full overflow-hidden",children:(0,t.jsx)(C.default,{keyId:N,onClose:M,keyData:ey,teams:I,onDelete:eu})}):(0,t.jsx)("div",{className:"p-4 text-sm text-muted-foreground",children:"Loading key..."}):(0,t.jsxs)("div",{className:"flex h-full flex-col gap-4 overflow-hidden py-2",children:[(0,t.jsx)(w.PageHeader,{icon:(0,t.jsx)(S.KeyRound,{className:"size-5"}),title:"Virtual Keys",subtitle:"Every key that authenticates requests to the gateway."}),e,(0,t.jsx)(b.DataTable,{data:ec,columns:eh,getRowId:e=>e.token,defaultColumnVisibility:O,sortingMode:"server",sorting:W,onSortingChange:ep,paginationMode:"server",pagination:$,onPaginationChange:J,rowCount:em,filterMode:"server",columnFilters:Q,onColumnFiltersChange:ex,enableColumnResizing:!0,columnResizeMode:"onChange",isLoading:eo,loadingMessage:"Loading keys...",noDataMessage:"No keys found",maxBodyHeight:"calc(75vh - 210px)",size:"compact",toolbar:e=>(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(y.DataTableToolbar,{table:e,searchValue:ee,onSearchChange:eg,searchPlaceholder:"Search by key alias…",onRefresh:()=>eu?.(),isRefreshing:ed,onOpenFilters:()=>Z(!0),filterLabels:G,formatFilterValue:ek}),(0,t.jsx)(v.DataTableFilterDrawer,{table:e,open:Y,onOpenChange:Z,title:"Filters",description:"Narrow down virtual keys",children:({get:e,set:a})=>(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(v.DataTableFilterField,{label:"Team",children:(0,t.jsx)(_.SearchSelect,{options:e_,value:e("team_id")||void 0,onValueChange:e=>a("team_id",e),placeholder:"Select a team…",emptyText:"No teams found"})}),(0,t.jsx)(v.DataTableFilterField,{label:"Organization",children:(0,t.jsx)(_.SearchSelect,{options:ew,value:e("org_id")||void 0,onValueChange:e=>a("org_id",e),placeholder:"Select an organization…",emptyText:"No organizations found"})}),(0,t.jsx)(v.DataTableFilterField,{label:"User ID",children:(0,t.jsx)(k.Input,{value:e("user_id")??"",onChange:e=>a("user_id",e.target.value),placeholder:"Enter User ID…"})}),(0,t.jsx)(v.DataTableFilterField,{label:"Key ID",children:(0,t.jsx)(k.Input,{value:e("key_hash")??"",onChange:e=>a("key_hash",e.target.value),placeholder:"Enter Key ID…"})})]})})]})})]})}let W=({userID:e,userRole:a,teams:l,keys:m,setUserRole:g,userEmail:p,setUserEmail:x,setTeams:h,setKeys:f,premiumUser:b,addKey:v,createClicked:y,autoOpenCreate:_,prefillData:w})=>{let[k,j]=(0,o.useState)(null),[S,C]=(0,o.useState)(null),I=(0,i.getCookie)("token"),[N,z]=(0,o.useState)(null),[D,T]=(0,o.useState)(null),[U,E]=(0,o.useState)([]),[A,R]=(0,o.useState)(null),[K,V]=(0,o.useState)(null);function M(){(0,i.clearTokenCookies)();let e=(0,d.getProxyBaseUrl)(),t=e?`${e}/sso/key/generate`:"/sso/key/generate";return window.location.href=t,null}if((0,o.useEffect)(()=>{let e=()=>{let e=sessionStorage.getItem("token");sessionStorage.clear(),e&&sessionStorage.setItem("token",e)};return window.addEventListener("beforeunload",e),()=>window.removeEventListener("beforeunload",e)},[]),(0,o.useEffect)(()=>{if(I){let e=(0,n.jwtDecode)(I);e&&(z(e.key),e.user_role&&g(function(e){if(!e)return"Undefined Role";switch(e.toLowerCase()){case"app_owner":case"demo_app_owner":return"App Owner";case"app_admin":case"proxy_admin":return"Admin";case"proxy_admin_viewer":return"Admin Viewer";case"app_user":return"App User";case"internal_user":return"Internal User";case"internal_user_viewer":return"Internal Viewer";default:return"Unknown Role"}}(e.user_role)),e.user_email&&x(e.user_email))}if(e&&N&&a&&!k){let t=sessionStorage.getItem("userModels"+e);t?E(JSON.parse(t)):((async()=>{try{let t=await (0,d.getProxyUISettings)(N);R(t);let l=await (0,d.userGetInfoV2)(N,e);j(l),sessionStorage.setItem("userSpendData"+e,JSON.stringify(l));let i=(await (0,d.modelAvailableCall)(N,e,a)).data.map(e=>e.id);E(i),sessionStorage.setItem("userModels"+e,JSON.stringify(i))}catch(e){console.error("There was an error fetching the data",e),e.message.includes("Invalid proxy server token passed")&&M()}})(),u(N,e,a,S,h))}},[e,I,N,a]),(0,o.useEffect)(()=>{N&&(async()=>{try{await (0,d.keyInfoCall)(N,[N])}catch(e){e.message.includes("Invalid proxy server token passed")&&M()}})()},[N]),(0,o.useEffect)(()=>{N&&u(N,e,a,S,h)},[S]),(0,o.useEffect)(()=>{if(null!==m&&null!=K&&null!==K.team_id){let e=0;for(let t of m)K.hasOwnProperty("team_id")&&null!==t.team_id&&t.team_id===K.team_id&&(e+=t.spend);T(e)}else if(null!==m){let e=0;for(let t of m)e+=t.spend;T(e)}},[K]),null==I)return M(),null;try{let e=(0,n.jwtDecode)(I).exp,t=Math.floor(Date.now()/1e3);if(e&&t>=e)return M(),null}catch(e){return console.error("Error decoding token:",e),(0,i.clearTokenCookies)(),M(),null}if(null==N)return null;if(null==e)return(0,t.jsx)("h1",{children:"User ID is not set"});null==a&&g("App Owner");let L="Admin Viewer"!==a&&"proxy_admin_viewer"!==a;return(0,t.jsx)("div",{className:"mx-4 h-[75vh]",children:(0,t.jsx)(s.Grid,{numItems:1,className:"gap-2 p-8 w-full mt-2",children:(0,t.jsx)(r.Col,{numColSpan:1,className:"flex flex-col gap-2",children:(0,t.jsx)(H,{headerActions:L?(0,t.jsx)(c.default,{team:K,teams:l,data:m,addKey:v,autoOpenCreate:_,prefillData:w},K?K.team_id:null):void 0})})})})};var q=e.i(557951);e.s(["default",0,function(){let{userId:e,userRole:i,userEmail:r,accessToken:s,premiumUser:n}=(0,l.default)(),{setUserRole:d,setUserEmail:u}=(0,q.useAuth)(),c=(0,m.useSearchParams)(),[g,p]=(0,o.useState)(null),[x,h]=(0,o.useState)([]),[f,b]=(0,o.useState)(!1),v="true"===c.get("create"),y=(0,o.useMemo)(()=>{if(!v)return;let e=c.get("owned_by"),t=c.get("team_id"),a=c.get("key_alias"),l=c.get("models"),i=c.get("key_type");if(!e&&!t&&!a&&!l&&!i)return;let r=e&&["you","service_account","another_user"].includes(e)?e:void 0,s=i&&["default","llm_api","management"].includes(i)?i:void 0,n=a?a.trim().slice(0,256):void 0,o=l?l.split(",").slice(0,100).map(e=>e.trim().slice(0,256)).filter(e=>e.length>0):void 0;return{owned_by:r,team_id:t?.trim()||void 0,key_alias:n,models:o&&o.length>0?o:void 0,key_type:s}},[c,v]);return(0,o.useEffect)(()=>{s&&e&&i&&(0,a.teamListCall)(s,1,100,{userID:"Admin"!==i&&"Admin Viewer"!==i?e:null}).then(e=>p(e.teams??[])).catch(console.error)},[s,e,i]),(0,t.jsx)(W,{userID:e,userRole:i,premiumUser:n??!1,teams:g,keys:x,setUserRole:d,userEmail:r,setUserEmail:u,setTeams:p,setKeys:h,addKey:e=>{h(t=>t?[...t,e]:[e]),b(e=>!e)},createClicked:f,autoOpenCreate:v,prefillData:y})}],502501)},871135,e=>{"use strict";var t=e.i(843476),a=e.i(502501),l=e.i(936578),i=e.i(602869),r=e.i(207082),s=e.i(708347),n=e.i(557951),o=e.i(321836),d=e.i(571353),u=e.i(618566),c=e.i(271645);function m(){let{authLoading:e,token:m,userRole:g,userID:p}=(0,n.useAuth)(),x=(0,u.useRouter)(),h=(0,u.useSearchParams)(),f=h.get("page"),b=(0,c.useRef)(!1),v=(0,c.useRef)(!1),y=!1===e&&null===m;(0,c.useEffect)(()=>{if(y){(0,o.storeReturnUrl)();let e=(0,o.getLoginUrl)(i.proxyBaseUrl||""),t=(0,o.buildLoginUrlWithReturn)(e);window.location.replace(t)}},[y]);let _=null!==f&&f in d.MIGRATED_PAGES;(0,c.useEffect)(()=>{!e&&_&&x.replace((0,d.migratedHref)(d.MIGRATED_PAGES[f]))},[e,_,f,x]),(0,c.useEffect)(()=>{if(e||!m||b.current)return;b.current=!0;let t=(0,o.consumeReturnUrl)();if(t&&(0,o.isValidReturnUrl)(t)){let e=new URL(t,window.location.origin);if(e.origin!==window.location.origin)return;let a=window.location.href;(0,o.normalizeUrlForCompare)(t)!==(0,o.normalizeUrlForCompare)(a)&&(v.current=!0,window.location.replace(e.href))}},[e,m]),(0,c.useEffect)(()=>{m||(b.current=!1,v.current=!1)},[m]);let w="success"===h.get("login"),k=!e&&!!m,j=w&&k&&""===g,S=w&&k&&s.internalUserRoles.includes(g),{data:C,isLoading:I}=(0,r.useKeys)(1,1,{userID:p},S),N=S&&!I&&C?.keys?.length===0,z=S&&I||N;(0,c.useEffect)(()=>{N&&!v.current&&x.replace((0,d.migratedHref)("connect"))},[N,x]);let D=y||_||j||z;return e||D?(0,t.jsx)(l.default,{}):(0,t.jsx)(a.default,{})}e.s(["default",0,function(){return(0,t.jsx)(c.Suspense,{fallback:(0,t.jsx)(l.default,{}),children:(0,t.jsx)(m,{})})}])}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/00pr1xqcusy8a.js b/litellm/proxy/_experimental/out/_next/static/chunks/00pr1xqcusy8a.js deleted file mode 100644 index a6f74b19695..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/00pr1xqcusy8a.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,207082,e=>{"use strict";var t=e.i(619273),s=e.i(266027),l=e.i(243652),a=e.i(602869),r=e.i(431703),i=e.i(135214);let n=(0,l.createQueryKeys)("keys"),o=async(e,t,s,l={})=>{try{let i=(0,a.getProxyBaseUrl)(),n=new URLSearchParams(Object.entries({team_id:l.teamID,project_id:l.projectID,agent_id:l.agentID,organization_id:l.organizationID,key_alias:l.selectedKeyAlias,key_hash:l.keyHash,user_id:l.userID,page:t,size:s,sort_by:l.sortBy,sort_order:l.sortOrder,expand:l.expand,status:l.status,return_full_object:"true",include_team_keys:"true",include_created_by_keys:"true",substring_matching:"true"}).filter(([,e])=>null!=e).map(([e,t])=>[e,String(t)])),o=`${i?`${i}/key/list`:"/key/list"}?${n}`,d=await fetch(o,{method:"GET",headers:{[(0,a.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!d.ok){let e=await d.json(),t=(0,r.deriveErrorMessage)(e);throw(0,a.handleError)(t),Error(t)}return await d.json()}catch(e){throw console.error("Failed to list keys:",e),e}},d=(0,l.createQueryKeys)("deletedKeys");e.s(["keyKeys",0,n,"useDeletedKeys",0,(e,l,a={})=>{let{accessToken:r}=(0,i.default)();return(0,s.useQuery)({queryKey:d.list({page:e,limit:l,...a}),queryFn:async()=>await o(r,e,l,{...a,status:"deleted"}),enabled:!!r,staleTime:3e4,placeholderData:t.keepPreviousData})},"useKeys",0,(e,l,a={})=>{let{accessToken:r}=(0,i.default)();return(0,s.useQuery)({queryKey:n.list({page:e,limit:l,...a}),queryFn:async()=>await o(r,e,l,a),enabled:!!r,staleTime:3e4,placeholderData:t.keepPreviousData})}])},510674,e=>{"use strict";var t=e.i(266027),s=e.i(243652),l=e.i(602869),a=e.i(431703),r=e.i(135214),i=e.i(708347);let n=(0,s.createQueryKeys)("projects"),o=[...i.all_admin_roles,...i.internalUserRoles],d=async e=>{let t=(0,l.getProxyBaseUrl)(),s=`${t}/project/list`,r=await fetch(s,{method:"GET",headers:{[(0,l.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!r.ok){let e=await r.json(),t=(0,a.deriveErrorMessage)(e);throw(0,l.handleError)(t),Error(t)}return r.json()};e.s(["projectKeys",0,n,"useProjects",0,()=>{let{accessToken:e,userRole:s}=(0,r.default)();return(0,t.useQuery)({queryKey:n.list({}),queryFn:async()=>d(e),enabled:!!e&&o.includes(s)})}])},557662,e=>{"use strict";let t="/ui/assets/logos/",s=[{id:"arize",displayName:"Arize",logo:`${t}arize.png`,supports_key_team_logging:!0,dynamic_params:{arize_api_key:"password",arize_space_id:"password"},description:"Arize Logging Integration"},{id:"braintrust",displayName:"Braintrust",logo:`${t}braintrust.png`,supports_key_team_logging:!1,dynamic_params:{braintrust_api_key:"password",braintrust_project_name:"text"},description:"Braintrust Logging Integration"},{id:"custom_callback_api",displayName:"Custom Callback API",logo:`${t}custom.svg`,supports_key_team_logging:!0,dynamic_params:{custom_callback_api_url:"text",custom_callback_api_headers:"text"},description:"Custom Callback API Logging Integration"},{id:"galileo",displayName:"Galileo",logo:`${t}galileo.ico`,supports_key_team_logging:!1,dynamic_params:{GALILEO_API_KEY:"password",GALILEO_PROJECT_ID:"text",GALILEO_LOG_STREAM_ID:"text",GALILEO_BASE_URL:"text",GALILEO_USERNAME:"text",GALILEO_PASSWORD:"password"},description:"Galileo AI Observability Integration"},{id:"datadog",displayName:"Datadog",logo:`${t}datadog.png`,supports_key_team_logging:!1,dynamic_params:{dd_api_key:"password",dd_site:"text"},description:"Datadog Logging Integration"},{id:"lago",displayName:"Lago",logo:`${t}lago.svg`,supports_key_team_logging:!1,dynamic_params:{lago_api_url:"text",lago_api_key:"password"},description:"Lago Billing Logging Integration"},{id:"langfuse",displayName:"Langfuse",logo:`${t}langfuse.png`,supports_key_team_logging:!0,dynamic_params:{langfuse_public_key:"text",langfuse_secret_key:"password",langfuse_host:"text"},description:"Langfuse v2 Logging Integration"},{id:"langfuse_otel",displayName:"Langfuse OTEL",logo:`${t}langfuse.png`,supports_key_team_logging:!0,dynamic_params:{langfuse_public_key:"text",langfuse_secret_key:"password",langfuse_host:"text"},description:"Langfuse v3 OTEL Logging Integration"},{id:"langsmith",displayName:"LangSmith",logo:`${t}langsmith.png`,supports_key_team_logging:!0,dynamic_params:{langsmith_api_key:"password",langsmith_project:"text",langsmith_base_url:"text",langsmith_sampling_rate:"number"},description:"Langsmith Logging Integration"},{id:"openmeter",displayName:"OpenMeter",logo:`${t}openmeter.png`,supports_key_team_logging:!1,dynamic_params:{openmeter_api_key:"password",openmeter_base_url:"text"},description:"OpenMeter Logging Integration"},{id:"otel",displayName:"Open Telemetry",logo:`${t}otel.png`,supports_key_team_logging:!1,dynamic_params:{otel_endpoint:"text",otel_headers:"text"},description:"OpenTelemetry Logging Integration"},{id:"s3",displayName:"S3",logo:`${t}aws.svg`,supports_key_team_logging:!1,dynamic_params:{s3_bucket_name:"text",aws_access_key_id:"password",aws_secret_access_key:"password",aws_region:"text"},description:"S3 Bucket (AWS) Logging Integration"},{id:"SQS",displayName:"SQS",logo:`${t}aws.svg`,supports_key_team_logging:!1,dynamic_params:{sqs_queue_url:"text",aws_access_key_id:"password",aws_secret_access_key:"password",aws_region:"text"},description:"SQS Queue (AWS) Logging Integration"}],l=s.reduce((e,t)=>(e[t.displayName]=t,e),{}),a=s.reduce((e,t)=>(e[t.displayName]=t.id,e),{}),r=s.reduce((e,t)=>(e[t.id]=t.displayName,e),{});e.s(["callbackInfo",0,l,"callback_map",0,a,"mapDisplayToInternalNames",0,e=>e.map(e=>a[e]||e),"mapInternalToDisplayNames",0,e=>e.map(e=>r[e]||e),"reverse_callback_map",0,r])},810757,477386,e=>{"use strict";var t=e.i(271645);let s=t.forwardRef(function(e,s){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z"}),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15 12a3 3 0 11-6 0 3 3 0 016 0z"}))});e.s(["CogIcon",0,s],810757);let l=t.forwardRef(function(e,s){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M18.364 18.364A9 9 0 005.636 5.636m12.728 12.728A9 9 0 015.636 5.636m12.728 12.728L5.636 5.636"}))});e.s(["BanIcon",0,l],477386)},552130,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(602869);e.s(["default",0,({onChange:e,value:r,className:i,accessToken:n,placeholder:o="Select agents",disabled:d=!1})=>{let[c,u]=(0,s.useState)([]),[m,p]=(0,s.useState)([]),[g,h]=(0,s.useState)(!1);(0,s.useEffect)(()=>{(async()=>{if(n){h(!0);try{let e=await (0,a.getAgentsList)(n),t=e?.agents||[];u(t);let s=new Set;t.forEach(e=>{let t=e.agent_access_groups;t&&Array.isArray(t)&&t.forEach(e=>s.add(e))}),p(Array.from(s))}catch(e){console.error("Error fetching agents:",e)}finally{h(!1)}}})()},[n]);let x=[...m.map(e=>({label:e,value:`group:${e}`,isAccessGroup:!0,searchText:`${e} Access Group`})),...c.map(e=>({label:`${e.agent_name||e.agent_id}`,value:e.agent_id,isAccessGroup:!1,searchText:`${e.agent_name||e.agent_id} ${e.agent_id} Agent`}))],y=[...r?.agents||[],...(r?.accessGroups||[]).map(e=>`group:${e}`)];return(0,t.jsx)("div",{children:(0,t.jsx)(l.Select,{mode:"multiple",placeholder:o,onChange:t=>{e({agents:t.filter(e=>!e.startsWith("group:")),accessGroups:t.filter(e=>e.startsWith("group:")).map(e=>e.replace("group:",""))})},value:y,loading:g,className:i,allowClear:!0,showSearch:!0,style:{width:"100%"},disabled:d,filterOption:(e,t)=>(x.find(e=>e.value===t?.value)?.searchText||"").toLowerCase().includes(e.toLowerCase()),children:x.map(e=>(0,t.jsx)(l.Select.Option,{value:e.value,label:e.label,children:(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,t.jsx)("span",{style:{display:"inline-block",width:8,height:8,borderRadius:"50%",background:e.isAccessGroup?"#52c41a":"#722ed1",flexShrink:0}}),(0,t.jsx)("span",{style:{flex:1},children:e.label}),(0,t.jsx)("span",{style:{color:e.isAccessGroup?"#52c41a":"#722ed1",fontSize:"12px",fontWeight:500,opacity:.8},children:e.isAccessGroup?"Access Group":"Agent"})]})},e.value))})})}])},9314,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(981339),a=e.i(645526),r=e.i(599724),i=e.i(263147);e.s(["default",0,({value:e,onChange:n,placeholder:o="Select access groups",disabled:d=!1,style:c,className:u,showLabel:m=!1,labelText:p="Access Group",allowClear:g=!0})=>{let{data:h,isLoading:x,isError:y}=(0,i.useAccessGroups)();if(x)return(0,t.jsxs)("div",{children:[m&&(0,t.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(a.TeamOutlined,{className:"mr-2"})," ",p]}),(0,t.jsx)(l.Skeleton.Input,{active:!0,block:!0,style:{height:32,...c}})]});let f=(h??[]).map(e=>({label:(0,t.jsxs)("span",{children:[(0,t.jsx)("span",{className:"font-medium",children:e.access_group_name})," ",(0,t.jsxs)("span",{className:"text-gray-400 text-xs",children:["(",e.access_group_id,")"]})]}),value:e.access_group_id,selectedLabel:e.access_group_name,searchText:`${e.access_group_name} ${e.access_group_id}`}));return(0,t.jsxs)("div",{children:[m&&(0,t.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(a.TeamOutlined,{className:"mr-2"})," ",p]}),(0,t.jsx)(s.Select,{mode:"multiple",value:e,placeholder:o,onChange:n,disabled:d,allowClear:g,showSearch:!0,style:{width:"100%",...c},className:`rounded-md ${u??""}`,notFoundContent:y?(0,t.jsx)("span",{className:"text-red-500",children:"Failed to load access groups"}):"No access groups found",filterOption:(e,t)=>(f.find(e=>e.value===t?.value)?.searchText??"").toLowerCase().includes(e.toLowerCase()),optionLabelProp:"selectedLabel",options:f.map(e=>({label:e.label,value:e.value,selectedLabel:e.selectedLabel}))})]})}])},392110,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(592968),r=e.i(312361),i=e.i(790848),n=e.i(536916),o=e.i(827252),d=e.i(779241);let{Option:c}=l.Select;e.s(["default",0,({form:e,autoRotationEnabled:u,onAutoRotationChange:m,rotationInterval:p,onRotationIntervalChange:g,isCreateMode:h=!1,neverExpire:x=!1,onNeverExpireChange:y})=>{let f=p&&!["7d","30d","90d","180d","365d"].includes(p),[b,_]=(0,s.useState)(f),[j,v]=(0,s.useState)(f?p:""),[w,N]=(0,s.useState)(e?.getFieldValue?.("duration")||"");return(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Key Expiry Settings"}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Expire Key"}),(0,t.jsx)(a.Tooltip,{title:"Set when this key should expire. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days). Leave empty to keep the current expiry unchanged.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})}),!h&&y&&(0,t.jsx)(n.Checkbox,{checked:x,onChange:t=>{let s=t.target.checked;y(s),s&&(N(""),e&&"function"==typeof e.setFieldValue?e.setFieldValue("duration",""):e&&"function"==typeof e.setFieldsValue&&e.setFieldsValue({duration:""}))},className:"ml-2 text-sm font-normal text-gray-600",children:"Never Expire"})]}),(0,t.jsx)(d.TextInput,{name:"duration",placeholder:h?"e.g., 30d or leave empty to never expire":"e.g., 30d",className:"w-full",value:w,onValueChange:t=>{N(t),e&&"function"==typeof e.setFieldValue?e.setFieldValue("duration",t):e&&"function"==typeof e.setFieldsValue&&e.setFieldsValue({duration:t})},disabled:!h&&x})]})]}),(0,t.jsx)(r.Divider,{}),(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Auto-Rotation Settings"}),(0,t.jsxs)("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Enable Auto-Rotation"}),(0,t.jsx)(a.Tooltip,{title:"Key will automatically regenerate at the specified interval for enhanced security.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})})]}),(0,t.jsx)(i.Switch,{checked:u,onChange:m,size:"default",className:u?"":"bg-gray-400"})]}),u&&(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Rotation Interval"}),(0,t.jsx)(a.Tooltip,{title:"How often the key should be automatically rotated. Choose the interval that best fits your security requirements.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)(l.Select,{value:b?"custom":p,onChange:e=>{"custom"===e?_(!0):(_(!1),v(""),g(e))},className:"w-full",placeholder:"Select interval",children:[(0,t.jsx)(c,{value:"7d",children:"7 days"}),(0,t.jsx)(c,{value:"30d",children:"30 days"}),(0,t.jsx)(c,{value:"90d",children:"90 days"}),(0,t.jsx)(c,{value:"180d",children:"180 days"}),(0,t.jsx)(c,{value:"365d",children:"365 days"}),(0,t.jsx)(c,{value:"custom",children:"Custom interval"})]}),b&&(0,t.jsxs)("div",{className:"space-y-1",children:[(0,t.jsx)(d.TextInput,{value:j,onChange:e=>{let t=e.target.value;v(t),g(t)},placeholder:"e.g., 1s, 5m, 2h, 14d"}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Supported formats: seconds (s), minutes (m), hours (h), days (d)"})]})]})]})]}),u&&(0,t.jsx)("div",{className:"bg-blue-50 p-3 rounded-md text-sm text-blue-700",children:"When rotation occurs, you'll receive a notification with the new key. The old key will be deactivated after a brief grace period."})]})]})}])},844565,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(602869);e.s(["default",0,({onChange:e,value:r,className:i,accessToken:n,placeholder:o="Select pass through routes",disabled:d=!1,teamId:c})=>{let[u,m]=(0,s.useState)([]),[p,g]=(0,s.useState)(!1);return(0,s.useEffect)(()=>{(async()=>{if(n){g(!0);try{let e=await (0,a.getPassThroughEndpointsCall)(n,c);if(e.endpoints){let t=e.endpoints.flatMap(e=>{let t=e.path,s=e.methods;return s&&s.length>0?s.map(e=>({label:`${e} ${t}`,value:t})):[{label:t,value:t}]});m(t)}}catch(e){console.error("Error fetching pass through routes:",e)}finally{g(!1)}}})()},[n,c]),(0,t.jsx)(l.Select,{mode:"tags",placeholder:o,onChange:e,value:r,loading:p,className:i,allowClear:!0,options:u,optionFilterProp:"label",showSearch:!0,style:{width:"100%"},disabled:d})}])},939510,e=>{"use strict";var t=e.i(843476),s=e.i(808613),l=e.i(199133),a=e.i(592968),r=e.i(827252);let{Option:i}=l.Select;e.s(["default",0,({type:e,name:n,showDetailedDescriptions:o=!0,className:d="",initialValue:c=null,form:u,onChange:m})=>{let p=e.toUpperCase(),g=e.toLowerCase(),h=`Select 'guaranteed_throughput' to prevent overallocating ${p} limit when the key belongs to a Team with specific ${p} limits.`;return(0,t.jsx)(s.Form.Item,{label:(0,t.jsxs)("span",{children:[p," Rate Limit Type"," ",(0,t.jsx)(a.Tooltip,{title:h,children:(0,t.jsx)(r.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:n,initialValue:c,className:d,children:(0,t.jsx)(l.Select,{defaultValue:o?"default":void 0,placeholder:"Select rate limit type",style:{width:"100%"},optionLabelProp:o?"label":void 0,onChange:e=>{u&&u.setFieldValue(n,e),m&&m(e)},children:o?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i,{value:"best_effort_throughput",label:"Default",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Default"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["Best effort throughput - no error if we're overallocating ",g," (Team/Key Limits checked at runtime)."]})]})}),(0,t.jsx)(i,{value:"guaranteed_throughput",label:"Guaranteed throughput",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Guaranteed throughput"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["Guaranteed throughput - raise an error if we're overallocating ",g," (also checks model-specific limits)"]})]})}),(0,t.jsx)(i,{value:"dynamic",label:"Dynamic",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Dynamic"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["If the key has a set ",p," (e.g. 2 ",p,") and there are no 429 errors, it can dynamically exceed the limit when the model being called is not erroring."]})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i,{value:"best_effort_throughput",children:"Best effort throughput"}),(0,t.jsx)(i,{value:"guaranteed_throughput",children:"Guaranteed throughput"}),(0,t.jsx)(i,{value:"dynamic",children:"Dynamic"})]})})})}])},363256,e=>{"use strict";var t=e.i(843476),s=e.i(199133);let{Text:l}=e.i(898586).Typography;e.s(["default",0,({organizations:e,value:a,onChange:r,disabled:i,loading:n,style:o})=>(0,t.jsx)(s.Select,{showSearch:!0,placeholder:"All Organizations",value:a,onChange:r,disabled:i,loading:n,allowClear:!0,style:{minWidth:280,...o},filterOption:(t,s)=>{if(!s)return!1;let l=e?.find(e=>e.organization_id===s.key);if(!l)return!1;let a=t.toLowerCase().trim(),r=(l.organization_alias||"").toLowerCase(),i=(l.organization_id||"").toLowerCase();return r.includes(a)||i.includes(a)},children:e?.map(e=>(0,t.jsxs)(s.Select.Option,{value:e.organization_id,children:[(0,t.jsx)("span",{className:"font-medium",children:e.organization_alias})," ",(0,t.jsxs)(l,{type:"secondary",children:["(",e.organization_id,")"]})]},e.organization_id))})])},128233,319312,e=>{"use strict";var t=e.i(843476),s=e.i(464571),l=e.i(199133),a=e.i(592968),r=e.i(425063),i=e.i(107233),n=e.i(37727),o=e.i(271645);e.s(["BudgetFallbacksEditor",0,function({value:e,onChange:d,availableModels:c}){let[u,m]=(0,o.useState)(()=>{let t;return 0===(t=Object.keys(e)).length?[]:t.map((t,s)=>({id:String(s+1),primaryModel:t,fallbackModels:e[t]}))}),p=e=>{m(e),d(Object.fromEntries(e.filter(e=>null!==e.primaryModel&&e.fallbackModels.length>0).map(e=>[e.primaryModel,e.fallbackModels])))},g=()=>{p([...u,{id:Date.now().toString(),primaryModel:null,fallbackModels:[]}])},h=(e,t)=>{p(u.map(s=>s.id===e?{...s,...t}:s))},x=new Set(u.map(e=>e.primaryModel).filter(Boolean));return 0===u.length?(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"text-xs text-gray-500 mb-2",children:"When a model exceeds its per-model budget, requests automatically reroute to fallback models"}),(0,t.jsx)(s.Button,{size:"small",onClick:g,icon:(0,t.jsx)(i.Plus,{className:"w-3 h-3"}),children:"Add Budget Fallback"})]}):(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"When a model exceeds its per-model budget, requests automatically reroute to fallback models"}),u.map(e=>{let s=c.filter(t=>t===e.primaryModel||!x.has(t)),i=c.filter(t=>t!==e.primaryModel);return(0,t.jsxs)("div",{className:"relative rounded-lg border border-gray-200 bg-gray-50 p-4",children:[(0,t.jsx)("button",{type:"button",onClick:()=>{var t;return t=e.id,void p(u.filter(e=>e.id!==t))},className:"absolute top-2 right-2 text-gray-400 hover:text-red-500 transition-colors p-1",children:(0,t.jsx)(n.X,{className:"w-4 h-4"})}),(0,t.jsxs)("div",{className:"mb-3",children:[(0,t.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Primary Model"}),(0,t.jsx)(l.Select,{className:"w-full",placeholder:"Select model",value:e.primaryModel,onChange:t=>{let s=e.fallbackModels.filter(e=>e!==t);h(e.id,{primaryModel:t,fallbackModels:s})},showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:s.map(e=>({label:e,value:e})),getPopupContainer:e=>e.parentElement||document.body})]}),(0,t.jsx)("div",{className:"flex items-center justify-center -my-1 mb-2",children:(0,t.jsxs)("div",{className:"bg-amber-50 text-amber-600 px-3 py-0.5 rounded-full text-[10px] font-bold border border-amber-100 flex items-center gap-1",children:[(0,t.jsx)(r.ArrowDown,{className:"w-3 h-3"}),"IF BUDGET EXCEEDED, TRY"]})}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Fallback Models"}),(0,t.jsx)(l.Select,{mode:"multiple",className:"w-full",placeholder:e.primaryModel?"Select fallback models":"Select a primary model first",value:e.fallbackModels,onChange:t=>h(e.id,{fallbackModels:t}),disabled:!e.primaryModel,showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:i.map(e=>({label:e,value:e})),getPopupContainer:e=>e.parentElement||document.body,maxTagCount:"responsive",maxTagPlaceholder:e=>(0,t.jsx)(a.Tooltip,{styles:{root:{pointerEvents:"none"}},title:e.map(({value:e})=>e).join(", "),children:(0,t.jsxs)("span",{children:["+",e.length," more"]})})}),e.fallbackModels.length>1&&(0,t.jsx)("div",{className:"text-[10px] text-gray-400 mt-1 ml-1",children:"Tried in order; first model still within its own budget is used"})]})]},e.id)}),(0,t.jsx)(s.Button,{size:"small",onClick:g,icon:(0,t.jsx)(i.Plus,{className:"w-3 h-3"}),children:"Add Budget Fallback"})]})}],128233);var d=e.i(28651);let c=[{value:"1h",label:"Hourly",resetHint:"Resets every hour"},{value:"24h",label:"Daily",resetHint:"Resets daily at midnight UTC"},{value:"7d",label:"Weekly",resetHint:"Resets every Sunday at midnight UTC"},{value:"30d",label:"Monthly",resetHint:"Resets on the 1st of every month at midnight UTC"}];e.s(["BudgetWindowsEditor",0,function({value:e,onChange:a}){let r=(t,s,l)=>{a(e.map((e,a)=>a===t?{...e,[s]:l}:e))};return(0,t.jsxs)("div",{children:[e.map((i,n)=>{let o=c.find(e=>e.value===i.budget_duration)?.resetHint;return(0,t.jsxs)("div",{style:{marginBottom:12},children:[(0,t.jsxs)("div",{style:{display:"flex",gap:8,alignItems:"center"},children:[(0,t.jsx)(l.Select,{value:i.budget_duration,onChange:e=>r(n,"budget_duration",e),style:{width:130},options:c.map(e=>({value:e.value,label:e.label}))}),(0,t.jsx)(d.InputNumber,{step:.01,min:0,precision:2,value:i.max_budget??void 0,onChange:e=>r(n,"max_budget",e??null),placeholder:"Max spend ($)",style:{width:160},prefix:"$"}),(0,t.jsx)(s.Button,{type:"text",danger:!0,size:"small",onClick:()=>{a(e.filter((e,t)=>t!==n))},style:{padding:"0 4px"},children:"✕"})]}),o&&(0,t.jsxs)("div",{style:{fontSize:11,color:"#888",marginTop:3,marginLeft:2},children:["↻ ",o]})]},n)}),(0,t.jsx)(s.Button,{size:"small",onClick:t=>{t.preventDefault(),a([...e,{budget_duration:"24h",max_budget:null}])},children:"+ Add Budget Window"})]})}],319312)},390605,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(602869),a=e.i(599724),r=e.i(482725),i=e.i(91739),n=e.i(500727),o=e.i(531516),d=e.i(696609);e.s(["default",0,({accessToken:e,selectedServers:c,toolPermissions:u,onChange:m,disabled:p=!1})=>{let{data:g=[]}=(0,n.useMCPServers)(),[h,x]=(0,s.useState)({}),[y,f]=(0,s.useState)({}),[b,_]=(0,s.useState)({}),[j,v]=(0,s.useState)({}),w=(0,s.useRef)(u);(0,s.useEffect)(()=>{w.current=u},[u]);let N=(0,s.useMemo)(()=>0===c.length?[]:g.filter(e=>c.includes(e.server_id)),[g,c]),k=async(e,t)=>{f(t=>({...t,[e]:!0})),_(t=>({...t,[e]:""}));try{let s=await (0,l.listMCPTools)(t,e);if(s.error)_(t=>({...t,[e]:s.message||"Failed to fetch tools"})),x(t=>({...t,[e]:[]}));else{let t=s.tools||[];x(s=>({...s,[e]:t}));let l=w.current;if(!l[e]&&t.length>0){let s=t.filter(e=>"delete"!==(0,d.classifyToolOp)(e.name,e.description||"")).map(e=>e.name);m({...l,[e]:s})}}}catch(t){console.error(`Error fetching tools for server ${e}:`,t),_(t=>({...t,[e]:"Failed to fetch tools"})),x(t=>({...t,[e]:[]}))}finally{f(t=>({...t,[e]:!1}))}};(0,s.useEffect)(()=>{N.forEach(t=>{h[t.server_id]||y[t.server_id]||k(t.server_id,e)})},[N,e]);let S=(e,t)=>{m({...u,[e]:t})};return 0===c.length?null:(0,t.jsx)("div",{className:"space-y-4",children:N.map(e=>{let s=e.server_name||e.alias||e.server_id,l=h[e.server_id]||[],n=u[e.server_id]||[],d=y[e.server_id],c=b[e.server_id],g=j[e.server_id]??"crud";return(0,t.jsxs)("div",{className:"border rounded-lg bg-gray-50",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between p-4 border-b bg-white rounded-t-lg",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(a.Text,{className:"font-semibold text-gray-900",children:s}),e.description&&(0,t.jsx)(a.Text,{className:"text-sm text-gray-500",children:e.description})]}),(0,t.jsxs)("div",{className:"flex items-center gap-3",children:[!p&&l.length>0&&(0,t.jsx)(i.Radio.Group,{value:g,onChange:t=>v(s=>({...s,[e.server_id]:t.target.value})),size:"small",optionType:"button",buttonStyle:"solid",options:[{label:"Risk Groups",value:"crud"},{label:"Flat List",value:"flat"}]}),!p&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("button",{type:"button",className:"text-sm text-blue-600 hover:text-blue-700 font-medium",onClick:()=>{var t;let s;return s=h[t=e.server_id]||[],void m({...u,[t]:s.map(e=>e.name)})},disabled:d,children:"Select All"}),(0,t.jsx)("button",{type:"button",className:"text-sm text-blue-600 hover:text-blue-700 font-medium",onClick:()=>{var t;return t=e.server_id,void m({...u,[t]:[]})},disabled:d,children:"Deselect All"})]})]})]}),(0,t.jsxs)("div",{className:"p-4",children:[d&&(0,t.jsxs)("div",{className:"flex items-center justify-center py-8",children:[(0,t.jsx)(r.Spin,{size:"large"}),(0,t.jsx)(a.Text,{className:"ml-3 text-gray-500",children:"Loading tools..."})]}),c&&!d&&(0,t.jsxs)("div",{className:"p-4 bg-red-50 border border-red-200 rounded-lg text-center",children:[(0,t.jsx)(a.Text,{className:"text-red-600 font-medium",children:"Unable to load tools"}),(0,t.jsx)(a.Text,{className:"text-sm text-red-500 mt-1",children:c})]}),!d&&!c&&l.length>0&&"crud"===g&&(0,t.jsx)(o.default,{tools:l,value:u[e.server_id]?n:void 0,onChange:t=>S(e.server_id,t),readOnly:p}),!d&&!c&&l.length>0&&"flat"===g&&(0,t.jsx)("div",{className:"space-y-2",children:l.map(s=>{let l=n.includes(s.name);return(0,t.jsxs)("div",{className:"flex items-start gap-2",children:[(0,t.jsx)("input",{type:"checkbox",checked:l,onChange:()=>{if(p)return;let t=l?n.filter(e=>e!==s.name):[...n,s.name];S(e.server_id,t)},disabled:p,className:"mt-0.5"}),(0,t.jsx)("div",{className:"flex-1 min-w-0",children:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(a.Text,{className:"font-medium text-gray-900",children:s.name}),(0,t.jsxs)(a.Text,{className:"text-sm text-gray-500",children:["- ",s.description||"No description"]})]})})]},s.name)})}),!d&&!c&&0===l.length&&(0,t.jsx)("div",{className:"text-center py-6",children:(0,t.jsx)(a.Text,{className:"text-gray-500",children:"No tools available"})})]})]},e.server_id)})})}])},109034,e=>{"use strict";var t=e.i(266027),s=e.i(243652),l=e.i(602869),a=e.i(135214);let r=(0,s.createQueryKeys)("tags");e.s(["useTags",0,()=>{let{accessToken:e,userId:s,userRole:i}=(0,a.default)();return(0,t.useQuery)({queryKey:r.list({}),queryFn:async()=>await (0,l.tagListCall)(e),enabled:!!(e&&s&&i)})}])},533882,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(250980),a=e.i(797672),r=e.i(68155),i=e.i(304967),n=e.i(629569),o=e.i(599724),d=e.i(269200),c=e.i(427612),u=e.i(64848),m=e.i(942232),p=e.i(496020),g=e.i(977572),h=e.i(992619),x=e.i(727749);e.s(["default",0,({accessToken:e,initialModelAliases:y={},onAliasUpdate:f,showExampleConfig:b=!0})=>{let[_,j]=(0,s.useState)([]),[v,w]=(0,s.useState)({aliasName:"",targetModel:""}),[N,k]=(0,s.useState)(null);(0,s.useEffect)(()=>{j(Object.entries(y).map(([e,t],s)=>({id:`${s}-${e}`,aliasName:e,targetModel:t})))},[y]);let S=()=>{if(!N)return;if(!N.aliasName||!N.targetModel)return void x.default.fromBackend("Please provide both alias name and target model");if(_.some(e=>e.id!==N.id&&e.aliasName===N.aliasName))return void x.default.fromBackend("An alias with this name already exists");let e=_.map(e=>e.id===N.id?N:e);j(e),k(null);let t={};e.forEach(e=>{t[e.aliasName]=e.targetModel}),f&&f(t),x.default.success("Alias updated successfully")},C=()=>{k(null)},T=_.reduce((e,t)=>(e[t.aliasName]=t.targetModel,e),{});return(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsxs)("div",{className:"mb-6",children:[(0,t.jsx)(o.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Add New Alias"}),(0,t.jsxs)("div",{className:"grid grid-cols-3 gap-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Alias Name"}),(0,t.jsx)("input",{type:"text",value:v.aliasName,onChange:e=>w({...v,aliasName:e.target.value}),placeholder:"e.g., gpt-4o",className:"w-full px-3 py-2 border border-gray-300 rounded-md text-sm"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Target Model"}),(0,t.jsx)(h.default,{accessToken:e,value:v.targetModel,placeholder:"Select target model",onChange:e=>w({...v,targetModel:e}),showLabel:!1})]}),(0,t.jsx)("div",{className:"flex items-end",children:(0,t.jsxs)("button",{onClick:()=>{if(!v.aliasName||!v.targetModel)return void x.default.fromBackend("Please provide both alias name and target model");if(_.some(e=>e.aliasName===v.aliasName))return void x.default.fromBackend("An alias with this name already exists");let e=[..._,{id:`${Date.now()}-${v.aliasName}`,aliasName:v.aliasName,targetModel:v.targetModel}];j(e),w({aliasName:"",targetModel:""});let t={};e.forEach(e=>{t[e.aliasName]=e.targetModel}),f&&f(t),x.default.success("Alias added successfully")},disabled:!v.aliasName||!v.targetModel,className:`flex items-center px-4 py-2 rounded-md text-sm ${!v.aliasName||!v.targetModel?"bg-gray-300 text-gray-500 cursor-not-allowed":"bg-green-600 text-white hover:bg-green-700"}`,children:[(0,t.jsx)(l.PlusCircleIcon,{className:"w-4 h-4 mr-1"}),"Add Alias"]})})]})]}),(0,t.jsx)(o.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Manage Existing Aliases"}),(0,t.jsx)("div",{className:"rounded-lg custom-border relative mb-6",children:(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(d.Table,{className:"[&_td]:py-0.5 [&_th]:py-1",children:[(0,t.jsx)(c.TableHead,{children:(0,t.jsxs)(p.TableRow,{children:[(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Alias Name"}),(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Target Model"}),(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Actions"})]})}),(0,t.jsxs)(m.TableBody,{children:[_.map(s=>(0,t.jsx)(p.TableRow,{className:"h-8",children:N&&N.id===s.id?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(g.TableCell,{className:"py-0.5",children:(0,t.jsx)("input",{type:"text",value:N.aliasName,onChange:e=>k({...N,aliasName:e.target.value}),className:"w-full px-2 py-1 border border-gray-300 rounded-md text-sm"})}),(0,t.jsx)(g.TableCell,{className:"py-0.5",children:(0,t.jsx)(h.default,{accessToken:e,value:N.targetModel,onChange:e=>k({...N,targetModel:e}),showLabel:!1,style:{height:"32px"}})}),(0,t.jsx)(g.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:S,className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:"Save"}),(0,t.jsx)("button",{onClick:C,className:"text-xs bg-gray-50 text-gray-600 px-2 py-1 rounded-sm hover:bg-gray-100",children:"Cancel"})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(g.TableCell,{className:"py-0.5 text-sm text-gray-900",children:s.aliasName}),(0,t.jsx)(g.TableCell,{className:"py-0.5 text-sm text-gray-500",children:s.targetModel}),(0,t.jsx)(g.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:()=>{k({...s})},className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:(0,t.jsx)(a.PencilIcon,{className:"w-3 h-3"})}),(0,t.jsx)("button",{onClick:()=>{var e;let t,l;return e=s.id,j(t=_.filter(t=>t.id!==e)),l={},void(t.forEach(e=>{l[e.aliasName]=e.targetModel}),f&&f(l),x.default.success("Alias deleted successfully"))},className:"text-xs bg-red-50 text-red-600 px-2 py-1 rounded-sm hover:bg-red-100",children:(0,t.jsx)(r.TrashIcon,{className:"w-3 h-3"})})]})})]})},s.id)),0===_.length&&(0,t.jsx)(p.TableRow,{children:(0,t.jsx)(g.TableCell,{colSpan:3,className:"py-0.5 text-sm text-gray-500 text-center",children:"No aliases added yet. Add a new alias above."})})]})]})})}),b&&(0,t.jsxs)(i.Card,{children:[(0,t.jsx)(n.Title,{className:"mb-4",children:"Configuration Example"}),(0,t.jsx)(o.Text,{className:"text-gray-600 mb-4",children:"Here's how your current aliases would look in the config:"}),(0,t.jsx)("div",{className:"bg-gray-100 rounded-lg p-4 font-mono text-sm",children:(0,t.jsxs)("div",{className:"text-gray-700",children:["model_aliases:",0===Object.keys(T).length?(0,t.jsxs)("span",{className:"text-gray-500",children:[(0,t.jsx)("br",{}),"  # No aliases configured yet"]}):Object.entries(T).map(([e,s])=>(0,t.jsxs)("span",{children:[(0,t.jsx)("br",{}),'  "',e,'": "',s,'"']},e))]})})]})]})}])},266484,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(592968),a=e.i(312361),r=e.i(827252),i=e.i(994388),n=e.i(304967),o=e.i(779241),d=e.i(988297),c=e.i(68155),u=e.i(810757),m=e.i(477386),p=e.i(557662),g=e.i(555987),h=e.i(435451);let{Option:x}=s.Select;e.s(["default",0,({value:e=[],onChange:y,disabledCallbacks:f=[],onDisabledCallbacksChange:b})=>{let _=Object.entries(p.callbackInfo).filter(([e,t])=>t.supports_key_team_logging).map(([e,t])=>e),j=Object.keys(p.callbackInfo),v=e=>{y?.(e)},w=(t,s,l)=>{let a=[...e];if("callback_name"===s){let e=p.callback_map[l]||l;a[t]={...a[t],[s]:e,callback_vars:{}}}else a[t]={...a[t],[s]:l};v(a)},N=(t,s,l)=>{let a=[...e];a[t]={...a[t],callback_vars:{...a[t].callback_vars,[s]:l}},v(a)};return(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(m.BanIcon,{className:"w-5 h-5 text-red-500"}),(0,t.jsx)("span",{className:"text-base font-semibold text-gray-800",children:"Disabled Callbacks"}),(0,t.jsx)(l.Tooltip,{title:"Select callbacks to disable for this key. Disabled callbacks will not receive any logging data.",children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Disabled Callbacks"}),(0,t.jsx)(s.Select,{mode:"multiple",placeholder:"Select callbacks to disable",value:f,onChange:e=>{let t=(0,p.mapDisplayToInternalNames)(e);b?.(t)},style:{width:"100%"},optionLabelProp:"label",children:j.map(e=>{let s=(0,g.resolveLogoSrc)(p.callbackInfo[e]?.logo),a=p.callbackInfo[e]?.description;return(0,t.jsx)(x,{value:e,label:e,children:(0,t.jsx)(l.Tooltip,{title:a,placement:"right",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[s&&(0,t.jsx)("img",{src:s,alt:e,className:"w-4 h-4 object-contain",onError:t=>{let s=t.target,l=s.parentElement;if(l){let t=document.createElement("div");t.className="w-4 h-4 rounded-full bg-gray-200 flex items-center justify-center text-xs",t.textContent=e.charAt(0),l.replaceChild(t,s)}}}),(0,t.jsx)("span",{children:e})]})})},e)})}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Select callbacks that should be disabled for this key. These callbacks will not receive any logging data."})]})]}),(0,t.jsx)(a.Divider,{}),(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(u.CogIcon,{className:"w-5 h-5 text-blue-500"}),(0,t.jsx)("span",{className:"text-base font-semibold text-gray-800",children:"Logging Integrations"}),(0,t.jsx)(l.Tooltip,{title:"Configure callback logging integrations for this team.",children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),(0,t.jsx)(i.Button,{variant:"secondary",onClick:()=>{v([...e,{callback_name:"",callback_type:"success",callback_vars:{}}])},icon:d.PlusIcon,size:"sm",className:"hover:border-blue-400 hover:text-blue-500",type:"button",children:"Add Integration"})]}),(0,t.jsx)("div",{className:"space-y-4",children:e.map((a,d)=>{let u=a.callback_name?Object.entries(p.callback_map).find(([e,t])=>t===a.callback_name)?.[0]:void 0,m=u?(0,g.resolveLogoSrc)(p.callbackInfo[u]?.logo):null;return(0,t.jsxs)(n.Card,{className:"border border-gray-200 shadow-xs hover:shadow-md transition-shadow duration-200",decoration:"top",decorationColor:"blue",children:[(0,t.jsxs)("div",{className:"flex justify-between items-start mb-4",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[m&&(0,t.jsx)("img",{src:m,alt:u,className:"w-5 h-5 object-contain"}),(0,t.jsxs)("span",{className:"text-sm font-medium",children:[u||"New Integration"," Configuration"]})]}),(0,t.jsx)(i.Button,{variant:"light",onClick:()=>{v(e.filter((e,t)=>t!==d))},icon:c.TrashIcon,size:"xs",color:"red",className:"hover:bg-red-50",type:"button",children:"Remove"})]}),(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Integration Type"}),(0,t.jsx)(s.Select,{value:u,placeholder:"Select integration",onChange:e=>w(d,"callback_name",e),className:"w-full",optionLabelProp:"label",children:_.map(e=>{let s=(0,g.resolveLogoSrc)(p.callbackInfo[e]?.logo),a=p.callbackInfo[e]?.description;return(0,t.jsx)(x,{value:e,label:e,children:(0,t.jsx)(l.Tooltip,{title:a,placement:"right",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[s&&(0,t.jsx)("img",{src:s,alt:e,className:"w-4 h-4 object-contain",onError:t=>{let s=t.target,l=s.parentElement;if(l){let t=document.createElement("div");t.className="w-4 h-4 rounded-full bg-gray-200 flex items-center justify-center text-xs",t.textContent=e.charAt(0),l.replaceChild(t,s)}}}),(0,t.jsx)("span",{children:e})]})})},e)})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Event Type"}),(0,t.jsxs)(s.Select,{value:a.callback_type,onChange:e=>w(d,"callback_type",e),className:"w-full",children:[(0,t.jsx)(x,{value:"success",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-green-500 rounded-full"}),(0,t.jsx)("span",{children:"Success Only"})]})}),(0,t.jsx)(x,{value:"failure",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-red-500 rounded-full"}),(0,t.jsx)("span",{children:"Failure Only"})]})}),(0,t.jsx)(x,{value:"success_and_failure",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-blue-500 rounded-full"}),(0,t.jsx)("span",{children:"Success & Failure"})]})})]})]})]}),((e,s)=>{if(!e.callback_name)return null;let a=Object.entries(p.callback_map).find(([t,s])=>s===e.callback_name)?.[0];if(!a)return null;let i=p.callbackInfo[a]?.dynamic_params||{};return 0===Object.keys(i).length?null:(0,t.jsxs)("div",{className:"mt-6 pt-4 border-t border-gray-100",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2 mb-4",children:[(0,t.jsx)("div",{className:"w-3 h-3 bg-blue-100 rounded-full flex items-center justify-center",children:(0,t.jsx)("div",{className:"w-1.5 h-1.5 bg-blue-500 rounded-full"})}),(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Integration Parameters"})]}),(0,t.jsx)("div",{className:"grid grid-cols-1 gap-4",children:Object.entries(i).map(([a,i])=>(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 capitalize flex items-center space-x-1",children:[(0,t.jsx)("span",{children:a.replace(/_/g," ")}),(0,t.jsx)(l.Tooltip,{title:`Environment variable reference recommended: os.environ/${a.toUpperCase()}`,children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})}),"password"===i&&(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800",children:"Sensitive"}),"number"===i&&(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800",children:"Number"})]}),"number"===i&&(0,t.jsx)("span",{className:"text-xs text-gray-500",children:"Value must be between 0 and 1"}),"number"===i?(0,t.jsx)(h.default,{step:.01,width:400,placeholder:`os.environ/${a.toUpperCase()}`,value:e.callback_vars[a]||"",onChange:e=>N(s,a,e.target.value)}):(0,t.jsx)(o.TextInput,{type:"password"===i?"password":"text",placeholder:`os.environ/${a.toUpperCase()}`,value:e.callback_vars[a]||"",onChange:e=>N(s,a,e.target.value)})]},a))})]})})(a,d)]})]},d)})}),0===e.length&&(0,t.jsxs)("div",{className:"text-center py-12 text-gray-500 border-2 border-dashed border-gray-200 rounded-lg bg-gray-50/50",children:[(0,t.jsx)(u.CogIcon,{className:"w-12 h-12 text-gray-300 mb-3 mx-auto"}),(0,t.jsx)("div",{className:"text-base font-medium mb-1",children:"No logging integrations configured"}),(0,t.jsx)("div",{className:"text-sm text-gray-400",children:'Click "Add Integration" to configure logging for this team'})]})]})}])},651904,e=>{"use strict";var t=e.i(843476),s=e.i(599724),l=e.i(266484);e.s(["default",0,function({value:e,onChange:a,premiumUser:r=!1,disabledCallbacks:i=[],onDisabledCallbacksChange:n}){return r?(0,t.jsx)(l.default,{value:e,onChange:a,disabledCallbacks:i,onDisabledCallbacksChange:n}):(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{className:"flex flex-wrap gap-2 mb-3",children:[(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50",children:"✨ langfuse-logging"}),(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50",children:"✨ datadog-logging"})]}),(0,t.jsx)("div",{className:"p-3 bg-yellow-50 border border-yellow-200 rounded-lg",children:(0,t.jsxs)(s.Text,{className:"text-sm text-yellow-800",children:["Setting Key/Team logging settings is a LiteLLM Enterprise feature. Global Logging Settings are available for all free users. Get a trial key"," ",(0,t.jsx)("a",{href:"https://www.litellm.ai/#pricing",target:"_blank",rel:"noopener noreferrer",className:"underline",children:"here"}),"."]})})]})}])},460285,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(404206),a=e.i(723731),r=e.i(653824),i=e.i(881073),n=e.i(197647),o=e.i(602869),d=e.i(158392),c=e.i(419470),u=e.i(695411);let m=(0,s.forwardRef)(({accessToken:e,value:m,onChange:p,modelData:g},h)=>{let[x,y]=(0,s.useState)({routerSettings:{},selectedStrategy:null,enableTagFiltering:!1}),[f,b]=(0,s.useState)([]),[_,j]=(0,s.useState)([]),[v,w]=(0,s.useState)([]),[N,k]=(0,s.useState)([]),[S,C]=(0,s.useState)({}),[T,I]=(0,s.useState)({}),A=(0,s.useRef)(!1),L=(0,s.useRef)(null);(0,s.useEffect)(()=>{let e=m?.router_settings?JSON.stringify({routing_strategy:m.router_settings.routing_strategy,fallbacks:m.router_settings.fallbacks,enable_tag_filtering:m.router_settings.enable_tag_filtering}):null;if(A.current&&e===L.current){A.current=!1;return}if(A.current&&e!==L.current&&(A.current=!1),e!==L.current)if(L.current=e,m?.router_settings){let e=m.router_settings,{fallbacks:t,...s}=e;y({routerSettings:s,selectedStrategy:e.routing_strategy||null,enableTagFiltering:e.enable_tag_filtering??!1});let l=e.fallbacks||[];b(l),j(l&&0!==l.length?l.map((e,t)=>{let[s,l]=Object.entries(e)[0];return{id:(t+1).toString(),primaryModel:s||null,fallbackModels:l||[]}}):[{id:"1",primaryModel:null,fallbackModels:[]}])}else y({routerSettings:{},selectedStrategy:null,enableTagFiltering:!1}),b([]),j([{id:"1",primaryModel:null,fallbackModels:[]}])},[m]),(0,s.useEffect)(()=>{e&&(0,o.getRouterSettingsCall)(e).then(e=>{if(e.fields){let t={};e.fields.forEach(e=>{t[e.field_name]={ui_field_name:e.ui_field_name,field_description:e.field_description,options:e.options,link:e.link}}),C(t);let s=e.fields.find(e=>"routing_strategy"===e.field_name);s?.options&&k(s.options),e.routing_strategy_descriptions&&I(e.routing_strategy_descriptions)}})},[e]),(0,s.useEffect)(()=>{e&&(async()=>{try{let t=await (0,u.fetchAvailableModels)(e);w(t)}catch(e){console.error("Error fetching model info for fallbacks:",e)}})()},[e]);let F=()=>{let e=new Set(["allowed_fails","cooldown_time","num_retries","timeout","retry_after"]),t=new Set(["model_group_alias","retry_policy"]),s=Object.fromEntries(Object.entries({...x.routerSettings,enable_tag_filtering:x.enableTagFiltering,routing_strategy:x.selectedStrategy,fallbacks:f.length>0?f:null}).map(([s,l])=>{if("routing_strategy_args"!==s&&"routing_strategy"!==s&&"enable_tag_filtering"!==s&&"fallbacks"!==s){let a=document.querySelector(`input[name="${s}"]`);if(a){if(void 0!==a.value&&""!==a.value){let r=((s,l,a)=>{if(null==l)return a;let r=String(l).trim();if(""===r||"null"===r.toLowerCase())return null;if(e.has(s)){let e=Number(r);return Number.isNaN(e)?a:e}if(t.has(s)){if(""===r)return null;try{return JSON.parse(r)}catch{return a}}return"true"===r.toLowerCase()||"false"!==r.toLowerCase()&&r})(s,a.value,l);return[s,r]}return[s,null]}}else if("routing_strategy"===s)return[s,x.selectedStrategy];else if("enable_tag_filtering"===s)return[s,x.enableTagFiltering];else if("fallbacks"===s)return[s,f.length>0?f:null];else if("routing_strategy_args"===s&&"latency-based-routing"===x.selectedStrategy){let e=document.querySelector('input[name="lowest_latency_buffer"]'),t=document.querySelector('input[name="ttl"]'),s={};return e?.value&&(s.lowest_latency_buffer=Number(e.value)),t?.value&&(s.ttl=Number(t.value)),["routing_strategy_args",Object.keys(s).length>0?s:null]}return[s,l]}).filter(e=>null!=e)),l=(e,t=!1)=>null==e||"object"==typeof e&&!Array.isArray(e)&&0===Object.keys(e).length||t&&("number"!=typeof e||Number.isNaN(e))?null:e;return{routing_strategy:l(s.routing_strategy),allowed_fails:l(s.allowed_fails,!0),cooldown_time:l(s.cooldown_time,!0),num_retries:l(s.num_retries,!0),timeout:l(s.timeout,!0),retry_after:l(s.retry_after,!0),fallbacks:f.length>0?f:null,context_window_fallbacks:l(s.context_window_fallbacks),retry_policy:l(s.retry_policy),model_group_alias:l(s.model_group_alias),enable_tag_filtering:x.enableTagFiltering,routing_strategy_args:l(s.routing_strategy_args)}};(0,s.useEffect)(()=>{if(!p)return;let e=setTimeout(()=>{A.current=!0,p({router_settings:F()})},100);return()=>clearTimeout(e)},[x,f]);let M=Array.from(new Set(v.map(e=>e.model_group))).sort();return((0,s.useImperativeHandle)(h,()=>({getValue:()=>({router_settings:F()})})),e)?(0,t.jsx)("div",{className:"w-full",children:(0,t.jsxs)(r.TabGroup,{className:"w-full",children:[(0,t.jsxs)(i.TabList,{variant:"line",defaultValue:"1",className:"px-8 pt-4",children:[(0,t.jsx)(n.Tab,{value:"1",children:"Loadbalancing"}),(0,t.jsx)(n.Tab,{value:"2",children:"Fallbacks"})]}),(0,t.jsxs)(a.TabPanels,{className:"px-8 py-6",children:[(0,t.jsx)(l.TabPanel,{children:(0,t.jsx)(d.default,{value:x,onChange:y,routerFieldsMetadata:S,availableRoutingStrategies:N,routingStrategyDescriptions:T})}),(0,t.jsx)(l.TabPanel,{children:(0,t.jsx)(c.FallbackSelectionForm,{groups:_,onGroupsChange:e=>{j(e),b(e.filter(e=>e.primaryModel&&e.fallbackModels.length>0).map(e=>({[e.primaryModel]:e.fallbackModels})))},availableModels:M,maxGroups:5})})]})]})}):null});m.displayName="RouterSettingsAccordion",e.s(["default",0,m])},575260,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(482725),a=e.i(56456);e.s(["default",0,({projects:e,value:r,onChange:i,disabled:n,loading:o,teamId:d})=>{let c=d?e?.filter(e=>e.team_id===d):e;return(0,t.jsx)(s.Select,{showSearch:!0,placeholder:"Search or select a project",value:r,onChange:i,disabled:n,loading:o,allowClear:!0,notFoundContent:o?(0,t.jsx)(l.Spin,{indicator:(0,t.jsx)(a.LoadingOutlined,{spin:!0}),size:"small"}):void 0,filterOption:(e,t)=>{if(!t)return!1;let s=c?.find(e=>e.project_id===t.key);if(!s)return!1;let l=e.toLowerCase().trim(),a=(s.project_alias||"").toLowerCase(),r=(s.project_id||"").toLowerCase();return a.includes(l)||r.includes(l)},optionFilterProp:"children",children:!o&&c?.map(e=>(0,t.jsxs)(s.Select.Option,{value:e.project_id,children:[(0,t.jsx)("span",{className:"font-medium",children:e.project_alias||e.project_id})," ",(0,t.jsxs)("span",{className:"text-gray-500",children:["(",e.project_id,")"]})]},e.project_id))})}])},364769,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(237016),a=e.i(464571),r=e.i(888259);e.s(["default",0,({apiKey:e})=>{let[i,n]=(0,s.useState)(!1);return(0,t.jsxs)("div",{children:[(0,t.jsxs)("p",{className:"mb-2",children:["Please save this secret key somewhere safe and accessible. For security reasons,"," ",(0,t.jsx)("b",{children:"you will not be able to view it again"})," through your LiteLLM account. If you lose this secret key, you will need to generate a new one."]}),(0,t.jsx)("p",{className:"text-sm text-gray-600 mt-3 mb-1",children:"Virtual Key:"}),(0,t.jsx)("div",{style:{background:"#f8f8f8",padding:"10px",borderRadius:"5px",marginBottom:"10px"},children:(0,t.jsx)("pre",{style:{wordWrap:"break-word",whiteSpace:"normal",margin:0},children:e})}),(0,t.jsx)(l.CopyToClipboard,{text:e,onCopy:()=>{n(!0),r.default.success("Key copied to clipboard"),setTimeout(()=>n(!1),2e3)},children:(0,t.jsx)(a.Button,{type:"primary",style:{marginTop:12},children:i?"Copied!":"Copy Virtual Key"})})]})}])},702597,e=>{"use strict";var t=e.i(843476),s=e.i(207082),l=e.i(109799),a=e.i(510674),r=e.i(109034),i=e.i(292639),n=e.i(135214),o=e.i(500330),d=e.i(827252),c=e.i(912598),u=e.i(677667),m=e.i(130643),p=e.i(898667),g=e.i(994388),h=e.i(309426),x=e.i(350967),y=e.i(599724),f=e.i(779241),b=e.i(629569),_=e.i(464571),j=e.i(808613),v=e.i(311451),w=e.i(212931),N=e.i(91739),k=e.i(199133),S=e.i(790848),C=e.i(262218),T=e.i(592968),I=e.i(898586),A=e.i(374009),L=e.i(271645),F=e.i(708347),M=e.i(552130),O=e.i(557662),E=e.i(9314),P=e.i(860585),B=e.i(82946),$=e.i(392110),R=e.i(533882),D=e.i(844565),V=e.i(651904),z=e.i(939510),U=e.i(460285),G=e.i(663435),K=e.i(363256),q=e.i(575260),W=e.i(371455),H=e.i(128233),Q=e.i(319312),J=e.i(355619),Y=e.i(75921),X=e.i(234713),Z=e.i(390605),ee=e.i(727749),et=e.i(602869),es=e.i(364769),el=e.i(435451),ea=e.i(916940);let{Option:er}=k.Select,ei=async(e,t,s,l)=>{try{if(null===e||null===t)return[];if(null!==s)return(await (0,et.modelAvailableCall)(s,e,t,!0,l,!0)).data.map(e=>e.id);return[]}catch(e){return console.error("Error fetching user models:",e),[]}},en=async(e,t,s,l)=>{try{if(null===e||null===t)return;if(null!==s){let a=(await (0,et.modelAvailableCall)(s,e,t)).data.map(e=>e.id);l(a)}}catch(e){console.error("Error fetching user models:",e)}};e.s(["default",0,({team:e,teams:eo,data:ed,addKey:ec,autoOpenCreate:eu,prefillData:em})=>{let{accessToken:ep,userId:eg,userRole:eh,premiumUser:ex}=(0,n.default)(),ey=ex||null!=eh&&F.rolesWithWriteAccess.includes(eh),{data:ef,isLoading:eb}=(0,l.useOrganizations)(),{data:e_,isLoading:ej}=(0,a.useProjects)(),{data:ev}=(0,i.useUISettings)(),{data:ew}=(0,r.useTags)(),eN=!!ev?.values?.enable_projects_ui,ek=!!ev?.values?.disable_custom_api_keys,eS=ew?Object.values(ew).map(e=>({value:e.name,label:e.name})):[],eC=(0,c.useQueryClient)(),[eT]=j.Form.useForm(),[eI,eA]=(0,L.useState)(!1),[eL,eF]=(0,L.useState)(null),[eM,eO]=(0,L.useState)(null),[eE,eP]=(0,L.useState)([]),[eB,e$]=(0,L.useState)([]),[eR,eD]=(0,L.useState)("you"),[eV,ez]=(0,L.useState)(!1),[eU,eG]=(0,L.useState)(null),[eK,eq]=(0,L.useState)([]),[eW,eH]=(0,L.useState)([]),[eQ,eJ]=(0,L.useState)([]),[eY,eX]=(0,L.useState)([]),[eZ,e0]=(0,L.useState)(e),[e1,e2]=(0,L.useState)(null),[e4,e3]=(0,L.useState)(null),[e5,e6]=(0,L.useState)(!1),[e7,e9]=(0,L.useState)(null),[e8,te]=(0,L.useState)({}),[tt,ts]=(0,L.useState)([]),[tl,ta]=(0,L.useState)(!1),[tr,ti]=(0,L.useState)([]),[tn,to]=(0,L.useState)([]),[td,tc]=(0,L.useState)("llm_api"),[tu,tm]=(0,L.useState)({}),[tp,tg]=(0,L.useState)(!1),[th,tx]=(0,L.useState)("30d"),[ty,tf]=(0,L.useState)(null),[tb,t_]=(0,L.useState)([]),[tj,tv]=(0,L.useState)({}),[tw,tN]=(0,L.useState)(0),[tk,tS]=(0,L.useState)(0),[tC,tT]=(0,L.useState)([]),[tI,tA]=(0,L.useState)(null),tL=()=>{eA(!1),eT.resetFields(),eX([]),to([]),tc("llm_api"),tm({}),tg(!1),tx("30d"),tf(null),tS(e=>e+1),tA(null),e2(null),e3(null),t_([]),tv({}),tN(e=>e+1)},tF=()=>{eA(!1),eF(null),e0(null),eT.resetFields(),eX([]),to([]),tc("llm_api"),tm({}),tg(!1),tx("30d"),tf(null),tS(e=>e+1),tA(null),e2(null),e3(null),t_([]),tv({}),tN(e=>e+1)};(0,L.useEffect)(()=>{eg&&eh&&ep&&en(eg,eh,ep,eP)},[ep,eg,eh]),(0,L.useEffect)(()=>{ep&&(0,et.getAgentsList)(ep).then(e=>tT(e?.agents||[])).catch(()=>tT([]))},[ep]),(0,L.useEffect)(()=>{let e=async()=>{try{let e=(await (0,et.getPoliciesList)(ep)).policies.map(e=>e.policy_name);eH(e)}catch(e){console.error("Failed to fetch policies:",e)}},t=async()=>{try{let e=await (0,et.getPromptsList)(ep);eJ(e.prompts.map(e=>e.prompt_id))}catch(e){console.error("Failed to fetch prompts:",e)}};(async()=>{try{let e=(await (0,et.getGuardrailsList)(ep)).guardrails.map(e=>e.guardrail_name);eq(e)}catch(e){console.error("Failed to fetch guardrails:",e)}})(),e(),t()},[ep]),(0,L.useEffect)(()=>{(async()=>{try{if(ep){let e=sessionStorage.getItem("possibleUserRoles");if(e)te(JSON.parse(e));else{let e=await (0,et.getPossibleUserRoles)(ep);sessionStorage.setItem("possibleUserRoles",JSON.stringify(e)),te(e)}}}catch(e){console.error("Error fetching possible user roles:",e)}})()},[ep]),(0,L.useEffect)(()=>{if(eu&&!eV&&eo&&eh&&F.rolesWithWriteAccess.includes(eh)&&(eA(!0),ez(!0),em)){if(em.owned_by&&("another_user"===em.owned_by&&"Admin"!==eh?eD("you"):eD(em.owned_by)),em.team_id){let e=eo?.find(e=>e.team_id===em.team_id)||null;e&&(e0(e),eT.setFieldsValue({team_id:em.team_id}))}em.key_alias&&eT.setFieldsValue({key_alias:em.key_alias}),em.models&&em.models.length>0&&eG(em.models),em.key_type&&(tc(em.key_type),eT.setFieldsValue({key_type:em.key_type}))}},[eu,em,eo,eV,eT,eh]);let tM=eB.includes("no-default-models")&&!eZ,tO=async e=>{try{let t,l=e?.key_alias??"",a=e?.team_id??null;if((ed?.filter(e=>e.team_id===a).map(e=>e.key_alias)??[]).includes(l))throw Error(`Key alias ${l} already exists for team with ID ${a}, please provide another key alias`);if(ee.default.info("Making API Call"),eA(!0),"you"===eR)e.user_id=eg;else if("agent"===eR){if(!tI)return void ee.default.fromBackend("Please select an agent");e.agent_id=tI}let r={};try{r=JSON.parse(e.metadata||"{}")}catch(e){console.error("Error parsing metadata:",e)}if("service_account"===eR&&(r.service_account_id=e.key_alias),eY.length>0&&(r={...r,logging:eY.filter(e=>e.callback_name)}),tn.length>0){let e=(0,O.mapDisplayToInternalNames)(tn);r={...r,litellm_disabled_callbacks:e}}if(tp&&(e.auto_rotate=!0,e.rotation_interval=th),e.duration&&""!==e.duration.trim()||(e.duration=null),e.metadata=JSON.stringify(r),e.disable_global_guardrails||delete e.disable_global_guardrails,e.allowed_vector_store_ids&&e.allowed_vector_store_ids.length>0&&(e.object_permission={vector_stores:e.allowed_vector_store_ids},delete e.allowed_vector_store_ids),e.allowed_mcp_servers_and_groups&&(e.allowed_mcp_servers_and_groups.servers?.length>0||e.allowed_mcp_servers_and_groups.accessGroups?.length>0)){e.object_permission||(e.object_permission={});let{servers:t,accessGroups:s}=e.allowed_mcp_servers_and_groups;t&&t.length>0&&(e.object_permission.mcp_servers=t),s&&s.length>0&&(e.object_permission.mcp_access_groups=s),delete e.allowed_mcp_servers_and_groups}let i=e.mcp_tool_permissions||{};if(Object.keys(i).length>0&&(e.object_permission||(e.object_permission={}),e.object_permission.mcp_tool_permissions=i),delete e.mcp_tool_permissions,e.allowed_mcp_access_groups&&e.allowed_mcp_access_groups.length>0&&(e.object_permission||(e.object_permission={}),e.object_permission.mcp_access_groups=e.allowed_mcp_access_groups,delete e.allowed_mcp_access_groups),e.allowed_agents_and_groups&&(e.allowed_agents_and_groups.agents?.length>0||e.allowed_agents_and_groups.accessGroups?.length>0)){e.object_permission||(e.object_permission={});let{agents:t,accessGroups:s}=e.allowed_agents_and_groups;t&&t.length>0&&(e.object_permission.agents=t),s&&s.length>0&&(e.object_permission.agent_access_groups=s),delete e.allowed_agents_and_groups}Object.keys(tu).length>0&&(e.aliases=JSON.stringify(tu)),ty?.router_settings&&Object.values(ty.router_settings).some(e=>null!=e&&""!==e)&&(e.router_settings=ty.router_settings);let n=tb.filter(e=>e.budget_duration&&null!==e.max_budget&&void 0!==e.max_budget);n.length>0&&(e.budget_limits=n),Object.keys(tj).length>0&&(e.budget_fallbacks=tj),t="service_account"===eR?await (0,et.keyCreateServiceAccountCall)(ep,e):await (0,et.keyCreateCall)(ep,eg,e),ec(t),eC.invalidateQueries({queryKey:s.keyKeys.lists()}),eF(t.key),eO(t.soft_budget),ee.default.success("Virtual Key Created"),eT.resetFields(),t_([]),tv({}),tN(e=>e+1),localStorage.removeItem("userData"+eg)}catch(t){let e=(e=>{let t;if(!(t=!e||"object"!=typeof e||e instanceof Error?String(e):JSON.stringify(e)).includes("/key/generate")&&!t.includes("KeyManagementRoutes.KEY_GENERATE"))return`Error creating the key: ${e}`;let s=t;try{if(!e||"object"!=typeof e||e instanceof Error){let e=t.match(/\{[\s\S]*\}/);if(e){let t=JSON.parse(e[0]),l=t?.error||t;l?.message&&(s=l.message)}}else{let t=e?.error||e;t?.message&&(s=t.message)}}catch(e){}return t.includes("team_member_permission_error")||s.includes("Team member does not have permissions")?"Team member does not have permission to generate key for this team. Ask your proxy admin to configure the team member permission settings.":`Error creating the key: ${e}`})(t);ee.default.fromBackend(e)}};(0,L.useEffect)(()=>{if(e4){let e=e_?.find(e=>e.project_id===e4);e$(e?.models??[]),eT.setFieldValue("models",[]);return}eg&&eh&&ep&&ei(eg,eh,ep,eZ?.team_id??null).then(e=>{e$(Array.from(new Set([...eZ?.models??[],...e])))}),eU||eT.setFieldValue("models",[]),eT.setFieldValue("allowed_mcp_servers_and_groups",{servers:[],accessGroups:[]})},[eZ,e4,ep,eg,eh,eT]),(0,L.useEffect)(()=>{if(!eU||0===eU.length||!eB||0===eB.length)return;let e=eU.filter(e=>eB.includes(e));e.length>0&&eT.setFieldsValue({models:e}),eG(null)},[eU,eB,eT]),(0,L.useEffect)(()=>{if(!e4||!eo)return;let e=e_?.find(e=>e.project_id===e4);if(!e?.team_id||eZ?.team_id===e.team_id)return;let t=eo.find(t=>t.team_id===e.team_id)||null;t&&(e0(t),eT.setFieldValue("team_id",t.team_id))},[eo,e4,e_]);let tE=async e=>{if(!e)return void ts([]);ta(!0);try{let t=new URLSearchParams;if(t.append("user_email",e),null==ep)return;let s=(await (0,et.userFilterUICall)(ep,t)).map(e=>({label:`${e.user_email} (${e.user_id})`,value:e.user_id,user:e}));ts(s)}catch(e){console.error("Error fetching users:",e),ee.default.fromBackend("Failed to search for users")}finally{ta(!1)}},tP=(0,L.useCallback)((0,A.default)(e=>tE(e),300),[ep]);return(0,t.jsxs)("div",{children:[eh&&F.rolesWithWriteAccess.includes(eh)&&(0,t.jsx)(g.Button,{className:"mx-auto",onClick:()=>eA(!0),"data-testid":"create-key-button",children:"+ Create New Key"}),(0,t.jsx)(w.Modal,{open:eI,width:1e3,footer:null,onOk:tL,onCancel:tF,children:(0,t.jsxs)(j.Form,{form:eT,onFinish:tO,labelCol:{span:8},wrapperCol:{span:16},labelAlign:"left",children:[(0,t.jsxs)("div",{className:"mb-8",children:[(0,t.jsx)(b.Title,{className:"mb-4",children:"Key Ownership"}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Owned By"," ",(0,t.jsx)(T.Tooltip,{title:"Select who will own this Virtual Key",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),className:"mb-4",children:(0,t.jsxs)(N.Radio.Group,{onChange:e=>eD(e.target.value),value:eR,children:[(0,t.jsx)(N.Radio,{value:"you",children:"You"}),(0,t.jsx)(N.Radio,{value:"service_account",children:"Service Account"}),"Admin"===eh&&(0,t.jsx)(N.Radio,{value:"another_user",children:"Another User"}),(0,t.jsxs)(N.Radio,{value:"agent",children:["Agent ",(0,t.jsx)(C.Tag,{color:"purple",children:"New"})]})]})}),"another_user"===eR&&(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["User ID"," ",(0,t.jsx)(T.Tooltip,{title:"The user who will own this key and be responsible for its usage",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"user_id",className:"mt-4",rules:[{required:"another_user"===eR,message:"Please input the user ID of the user you are assigning the key to"}],children:(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{style:{display:"flex",marginBottom:"8px"},children:[(0,t.jsx)(k.Select,{showSearch:!0,placeholder:"Type email to search for users",filterOption:!1,onSearch:e=>{tP(e)},onSelect:(e,t)=>{let s;return s=t.user,void eT.setFieldsValue({user_id:s.user_id})},options:tt,loading:tl,allowClear:!0,style:{width:"100%"},notFoundContent:tl?"Searching...":"No users found"}),(0,t.jsx)(_.Button,{onClick:()=>e6(!0),style:{marginLeft:"8px"},children:"Create User"})]}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Search by email to find users"})]})}),"agent"===eR&&(0,t.jsxs)("div",{className:"mt-4 p-4 bg-purple-50 border border-purple-200 rounded-md",children:[(0,t.jsx)("div",{className:"mb-3",children:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700",children:["Select Agent ",(0,t.jsx)("span",{className:"text-red-500",children:"*"})]})}),(0,t.jsx)(k.Select,{showSearch:!0,placeholder:"Select an agent",style:{width:"100%"},value:tI,onChange:e=>tA(e),filterOption:(e,t)=>t?.label?.toLowerCase().includes(e.toLowerCase()),options:tC.map(e=>({label:e.agent_name||e.agent_id,value:e.agent_id}))}),(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-2",children:"This key will be used by the selected agent to make requests to LiteLLM"})]}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Organization"," ",(0,t.jsx)(T.Tooltip,{title:"The organization this key belongs to. Selecting an organization filters the available teams.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"organization_id",className:"mt-4",children:(0,t.jsx)(K.default,{organizations:ef,loading:eb,disabled:"Admin"!==eh,onChange:e=>{e2(e||null),e0(null),e3(null),eT.setFieldValue("team_id",void 0),eT.setFieldValue("project_id",void 0)}})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Team"," ",(0,t.jsx)(T.Tooltip,{title:"The team this key belongs to, which determines available models and budget limits",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"team_id",initialValue:e?e.team_id:null,className:"mt-4",rules:[{required:"service_account"===eR,message:"Please select a team for the service account"}],help:"service_account"===eR?"required":"",children:(0,t.jsx)(G.default,{disabled:null!==e4,organizationId:e1,onTeamSelect:e=>{e0(e),e3(null),eT.setFieldValue("project_id",void 0),e?.organization_id?(e2(e.organization_id),eT.setFieldValue("organization_id",e.organization_id)):e||(e2(null),eT.setFieldValue("organization_id",void 0))}})}),eN&&(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Project"," ",(0,t.jsx)(T.Tooltip,{title:"Assign this key to a project. Selecting a project will lock the team to the project's team.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"project_id",className:"mt-4",children:(0,t.jsx)(q.default,{projects:e_,teamId:eZ?.team_id,loading:ej||!eo,onChange:e=>{if(!e){e3(null),e0(null),eT.setFieldValue("team_id",void 0);return}e3(e)}})})]}),tM&&(0,t.jsx)("div",{className:"mb-8 p-4 bg-blue-50 border border-blue-200 rounded-md",children:(0,t.jsx)(y.Text,{className:"text-blue-800 text-sm",children:"Please select a team to continue configuring your Virtual Key. If you do not see any teams, please contact your Proxy Admin to either provide you with access to models or to add you to a team."})}),!tM&&(0,t.jsxs)("div",{className:"mb-8",children:[(0,t.jsx)(b.Title,{className:"mb-4",children:"Key Details"}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["you"===eR||"another_user"===eR?"Key Name":"Service Account ID"," ",(0,t.jsx)(T.Tooltip,{title:"you"===eR||"another_user"===eR?"A descriptive name to identify this key":"Unique identifier for this service account",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"key_alias",rules:[{required:!0,message:`Please input a ${"you"===eR?"key name":"service account ID"}`}],help:"required",children:(0,t.jsx)(f.TextInput,{placeholder:""})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Models"," ",(0,t.jsx)(T.Tooltip,{title:"Select which models this key can access. Choose 'All Team Models' to grant access to all models available to the team. Leave empty to allow access to all models.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"models",rules:[],help:"management"===td||"read_only"===td?"Models field is disabled for this key type":"optional - leave empty to allow access to all models",className:"mt-4",children:(0,t.jsxs)(k.Select,{mode:"multiple",placeholder:"Select models",style:{width:"100%"},disabled:"management"===td||"read_only"===td,onChange:e=>{e.includes("all-team-models")&&eT.setFieldsValue({models:["all-team-models"]})},children:[!e4&&(0,t.jsx)(er,{value:"all-team-models",children:"All Team Models"},"all-team-models"),eB.map(e=>(0,t.jsx)(er,{value:e,children:(0,J.getModelDisplayName)(e)},e))]})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Key Type"," ",(0,t.jsx)(T.Tooltip,{title:"Select the type of key to determine what routes and operations this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"key_type",initialValue:"llm_api",className:"mt-4",children:(0,t.jsxs)(k.Select,{defaultValue:"llm_api",placeholder:"Select key type",style:{width:"100%"},optionLabelProp:"label",onChange:e=>{tc(e),("management"===e||"read_only"===e)&&eT.setFieldsValue({models:[]})},children:[(0,t.jsx)(er,{value:"llm_api",label:"AI APIs",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"AI APIs"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call only AI API routes (chat/completions, embeddings, etc.)"})]})}),(0,t.jsx)(er,{value:"management",label:"Management",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"Management"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call only management routes (user/team/key management)"})]})}),(0,t.jsx)(er,{value:"default",label:"Full Access",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"Full Access"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call all routes (AI APIs, Management, and read-only)"})]})})]})})]}),!tM&&(0,t.jsx)("div",{className:"mb-8",children:(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)(b.Title,{className:"m-0",children:"Optional Settings"})}),(0,t.jsxs)(m.AccordionBody,{children:[(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Max Budget (USD)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum amount in USD this key can spend. When reached, the key will be blocked from making further requests",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"max_budget",help:`Budget cannot exceed team max budget: $${e?.max_budget!==null&&e?.max_budget!==void 0?e?.max_budget:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.max_budget&&s>e.max_budget)throw Error(`Budget cannot exceed team max budget: $${(0,o.formatNumberWithCommas)(e.max_budget,4)}`)}}],children:(0,t.jsx)(el.default,{step:.01,precision:2,width:200})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Reset Budget"," ",(0,t.jsx)(T.Tooltip,{title:"How often the budget should reset. For example, setting 'daily' will reset the budget every 24 hours",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"budget_duration",help:`Team Reset Budget: ${e?.budget_duration!==null&&e?.budget_duration!==void 0?e?.budget_duration:"None"}`,children:(0,t.jsx)(P.default,{onChange:e=>eT.setFieldValue("budget_duration",e)})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Budget Windows"," ",(0,t.jsx)(T.Tooltip,{title:"Set multiple independent budget windows (e.g., hourly $10 AND monthly $200). Each window tracks spend separately and resets on its own schedule.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)(Q.BudgetWindowsEditor,{value:tb,onChange:t_})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Budget Fallbacks"," ",(0,t.jsx)(T.Tooltip,{title:"When a model exceeds its per-model budget (model_max_budget), requests automatically reroute to fallback models instead of failing. Configure per-model budgets in Advanced Settings.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)(H.BudgetFallbacksEditor,{value:tj,onChange:tv,availableModels:eB},tw)}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Tokens per minute Limit (TPM)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum number of tokens this key can process per minute. Helps control usage and costs",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"tpm_limit",help:`TPM cannot exceed team TPM limit: ${e?.tpm_limit!==null&&e?.tpm_limit!==void 0?e?.tpm_limit:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.tpm_limit&&s>e.tpm_limit)throw Error(`TPM limit cannot exceed team TPM limit: ${e.tpm_limit}`)}}],children:(0,t.jsx)(el.default,{step:1,width:400})}),(0,t.jsx)(z.default,{type:"tpm",name:"tpm_limit_type",className:"mt-4",initialValue:null,form:eT,showDetailedDescriptions:!0}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Requests per minute Limit (RPM)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum number of API requests this key can make per minute. Helps prevent abuse and manage load",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"rpm_limit",help:`RPM cannot exceed team RPM limit: ${e?.rpm_limit!==null&&e?.rpm_limit!==void 0?e?.rpm_limit:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.rpm_limit&&s>e.rpm_limit)throw Error(`RPM limit cannot exceed team RPM limit: ${e.rpm_limit}`)}}],children:(0,t.jsx)(el.default,{step:1,width:400})}),(0,t.jsx)(z.default,{type:"rpm",name:"rpm_limit_type",className:"mt-4",initialValue:null,form:eT,showDetailedDescriptions:!0}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Guardrails"," ",(0,t.jsx)(T.Tooltip,{title:"Apply safety guardrails to this key to filter content or enforce policies",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"guardrails",className:"mt-4",help:ey?"Select existing guardrails or enter new ones":"Premium feature - Upgrade to set guardrails by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ey,placeholder:ey?"Select or enter guardrails":"Premium feature - Upgrade to set guardrails by key",options:eK.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Disable Global Guardrails"," ",(0,t.jsx)(T.Tooltip,{title:"When enabled, this key will bypass any guardrails configured to run on every request (global guardrails)",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"disable_global_guardrails",className:"mt-4",valuePropName:"checked",help:ey?"Bypass global guardrails for this key":"Premium feature - Upgrade to disable global guardrails by key",children:(0,t.jsx)(S.Switch,{disabled:!ey,checkedChildren:"Yes",unCheckedChildren:"No"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Policies"," ",(0,t.jsx)(T.Tooltip,{title:"Apply policies to this key to control guardrails and other settings",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"policies",className:"mt-4",help:ex?"Select existing policies or enter new ones":"Premium feature - Upgrade to set policies by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ex,placeholder:ex?"Select or enter policies":"Premium feature - Upgrade to set policies by key",options:eW.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Prompts"," ",(0,t.jsx)(T.Tooltip,{title:"Allow this key to use specific prompt templates",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/prompt_management",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"prompts",className:"mt-4",help:ex?"Select existing prompts or enter new ones":"Premium feature - Upgrade to set prompts by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ex,placeholder:ex?"Select or enter prompts":"Premium feature - Upgrade to set prompts by key",options:eQ.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Access Groups"," ",(0,t.jsx)(T.Tooltip,{title:"Assign access groups to this key. Access groups control which models, MCP servers, and agents this key can use",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"access_group_ids",className:"mt-4",help:"Select access groups to assign to this key",children:(0,t.jsx)(E.default,{placeholder:"Select access groups (optional)"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Pass Through Routes"," ",(0,t.jsx)(T.Tooltip,{title:"Allow this key to use specific pass through routes",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/pass_through",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"allowed_passthrough_routes",className:"mt-4",help:ex?"Select existing pass through routes or enter new ones":"Premium feature - Upgrade to set pass through routes by key",children:(0,t.jsx)(D.default,{onChange:e=>eT.setFieldValue("allowed_passthrough_routes",e),value:eT.getFieldValue("allowed_passthrough_routes"),accessToken:ep,placeholder:ex?"Select or enter pass through routes":"Premium feature - Upgrade to set pass through routes by key",disabled:!ex,teamId:eZ?eZ.team_id:null})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Vector Stores"," ",(0,t.jsx)(T.Tooltip,{title:"Select which vector stores this key can access. If none selected, the key will have access to all available vector stores",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_vector_store_ids",className:"mt-4",help:"Select vector stores this key can access. Leave empty for access to all vector stores",children:(0,t.jsx)(ea.default,{onChange:e=>eT.setFieldValue("allowed_vector_store_ids",e),value:eT.getFieldValue("allowed_vector_store_ids"),accessToken:ep,placeholder:"Select vector stores (optional)"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Metadata"," ",(0,t.jsx)(T.Tooltip,{title:"JSON object with additional information about this key. Used for tracking or custom logic",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"metadata",className:"mt-4",children:(0,t.jsx)(v.Input.TextArea,{rows:4,placeholder:"Enter metadata as JSON"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Tags"," ",(0,t.jsx)(T.Tooltip,{title:"Tags for tracking spend and/or doing tag-based routing. Used for analytics and filtering",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"tags",className:"mt-4",help:"Tags for tracking spend and/or doing tag-based routing.",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},placeholder:"Select or enter tags",tokenSeparators:[","],options:eS})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"MCP Settings"})}),(0,t.jsxs)(m.AccordionBody,{children:[(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed MCP Servers"," ",(0,t.jsx)(T.Tooltip,{title:"Select which MCP servers or access groups this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_mcp_servers_and_groups",help:"Select MCP servers or access groups this key can access",children:(0,t.jsx)(Y.default,{onChange:e=>eT.setFieldValue("allowed_mcp_servers_and_groups",e),value:eT.getFieldValue("allowed_mcp_servers_and_groups"),accessToken:ep,teamId:eZ?.team_id??null,placeholder:"Select MCP servers or access groups (optional)",allowNoMcpServers:!0})}),(0,t.jsx)(j.Form.Item,{name:"mcp_tool_permissions",initialValue:{},hidden:!0,children:(0,t.jsx)(v.Input,{type:"hidden"})}),(0,t.jsx)(j.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.allowed_mcp_servers_and_groups!==t.allowed_mcp_servers_and_groups||e.mcp_tool_permissions!==t.mcp_tool_permissions,children:()=>(0,t.jsx)("div",{className:"mt-6",children:(0,t.jsx)(Z.default,{accessToken:ep,selectedServers:(eT.getFieldValue("allowed_mcp_servers_and_groups")?.servers||[]).filter(e=>e!==X.NO_MCP_SERVERS_SENTINEL),toolPermissions:eT.getFieldValue("mcp_tool_permissions")||{},onChange:e=>eT.setFieldsValue({mcp_tool_permissions:e})})})})]})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Agent Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Agents"," ",(0,t.jsx)(T.Tooltip,{title:"Select which agents or access groups this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_agents_and_groups",help:"Select agents or access groups this key can access",children:(0,t.jsx)(M.default,{onChange:e=>eT.setFieldValue("allowed_agents_and_groups",e),value:eT.getFieldValue("allowed_agents_and_groups"),accessToken:ep,placeholder:"Select agents or access groups (optional)"})})})]}),ex?(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Logging Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(V.default,{value:eY,onChange:eX,premiumUser:!0,disabledCallbacks:tn,onDisabledCallbacksChange:to})})})]}):(0,t.jsx)(T.Tooltip,{title:(0,t.jsxs)("span",{children:["Key-level logging settings is an enterprise feature, get in touch -",(0,t.jsx)("a",{href:"https://www.litellm.ai/enterprise",target:"_blank",children:"https://www.litellm.ai/enterprise"})]}),placement:"top",children:(0,t.jsxs)("div",{style:{position:"relative"},children:[(0,t.jsx)("div",{style:{opacity:.5},children:(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Logging Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(V.default,{value:eY,onChange:eX,premiumUser:!1,disabledCallbacks:tn,onDisabledCallbacksChange:to})})})]})}),(0,t.jsx)("div",{style:{position:"absolute",inset:0,cursor:"not-allowed"}})]})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Router Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4 w-full",children:(0,t.jsx)(U.default,{accessToken:ep||"",value:ty||void 0,onChange:tf,modelData:eE.length>0?{data:eE.map(e=>({model_name:e}))}:void 0},tk)})})]},`router-settings-accordion-${tk}`),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Model Aliases"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsx)(y.Text,{className:"text-sm text-gray-600 mb-4",children:"Create custom aliases for models that can be used in API calls. This allows you to create shortcuts for specific models."}),(0,t.jsx)(R.default,{accessToken:ep,initialModelAliases:tu,onAliasUpdate:tm,showExampleConfig:!1})]})})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Key Lifecycle"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)($.default,{form:eT,autoRotationEnabled:tp,onAutoRotationChange:tg,rotationInterval:th,onRotationIntervalChange:tx,isCreateMode:!0})})}),(0,t.jsx)(j.Form.Item,{name:"duration",hidden:!0,initialValue:null,children:(0,t.jsx)(v.Input,{})})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)("b",{children:"Advanced Settings"}),(0,t.jsx)(T.Tooltip,{title:(0,t.jsxs)("span",{children:["Learn more about advanced settings in our"," ",(0,t.jsx)("a",{href:et.proxyBaseUrl?`${et.proxyBaseUrl}/#/key%20management/generate_key_fn_key_generate_post`:"/#/key%20management/generate_key_fn_key_generate_post",target:"_blank",rel:"noopener noreferrer",className:"text-blue-400 hover:text-blue-300",children:"documentation"})]}),children:(0,t.jsx)(d.InfoCircleOutlined,{className:"text-gray-400 hover:text-gray-300 cursor-help"})})]})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)(B.default,{schemaComponent:"GenerateKeyRequest",form:eT,excludedFields:["key_alias","team_id","organization_id","models","duration","metadata","tags","guardrails","max_budget","budget_duration","tpm_limit","rpm_limit",...ek?["key"]:[]]})})]})]})]})}),(0,t.jsx)("div",{style:{textAlign:"right",marginTop:"10px"},children:(0,t.jsx)(_.Button,{htmlType:"submit",disabled:tM,style:{opacity:tM?.5:1},children:"Create Key"})})]})}),e5&&(0,t.jsx)(w.Modal,{title:"Create New User",open:e5,onCancel:()=>e6(!1),footer:null,width:800,children:(0,t.jsx)(W.CreateUserButton,{userID:eg,accessToken:ep,teams:eo,possibleUIRoles:e8,onUserCreated:e=>{e9(e),eT.setFieldsValue({user_id:e}),e6(!1)},isEmbedded:!0})}),eL&&(0,t.jsx)(w.Modal,{open:eI,onOk:tL,onCancel:tF,footer:null,children:(0,t.jsxs)(x.Grid,{numItems:1,className:"gap-2 w-full",children:[(0,t.jsx)(b.Title,{children:"Save your Key"}),(0,t.jsx)(h.Col,{numColSpan:1,children:null!=eL?(0,t.jsx)(es.default,{apiKey:eL}):(0,t.jsx)(y.Text,{children:"Key being created, this might take 30s"})})]})})]})},"fetchTeamModels",0,ei,"fetchUserModels",0,en],702597)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/010e8lif45kbo.js b/litellm/proxy/_experimental/out/_next/static/chunks/010e8lif45kbo.js deleted file mode 100644 index 6cdee9105cd..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/010e8lif45kbo.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,362024,e=>{"use strict";var r=e.i(988122);e.s(["Collapse",()=>r.default])},21548,e=>{"use strict";var r=e.i(616303);e.s(["Empty",()=>r.default])},166406,e=>{"use strict";var r=e.i(190144);e.s(["CopyOutlined",()=>r.default])},599724,936325,e=>{"use strict";var r=e.i(95779),t=e.i(444755),a=e.i(673706),o=e.i(271645);let l=o.default.forwardRef((e,l)=>{let{color:s,className:n,children:i}=e;return o.default.createElement("p",{ref:l,className:(0,t.tremorTwMerge)("text-tremor-default",s?(0,a.getColorClassNames)(s,r.colorPalette.text).textColor:(0,t.tremorTwMerge)("text-tremor-content","dark:text-dark-tremor-content"),n)},i)});l.displayName="Text",e.s(["default",0,l],936325),e.s(["Text",0,l],599724)},994388,e=>{"use strict";var r=e.i(290571),t=e.i(829087),a=e.i(271645);let o=["preEnter","entering","entered","preExit","exiting","exited","unmounted"],l=e=>({_s:e,status:o[e],isEnter:e<3,isMounted:6!==e,isResolved:2===e||e>4}),s=e=>e?6:5,n=(e,r,t,a,o)=>{clearTimeout(a.current);let s=l(e);r(s),t.current=s,o&&o({current:s})};var i=e.i(480731),d=e.i(444755),c=e.i(673706);let m=e=>{var t=(0,r.__rest)(e,[]);return a.default.createElement("svg",Object.assign({},t,{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24",fill:"currentColor"}),a.default.createElement("path",{fill:"none",d:"M0 0h24v24H0z"}),a.default.createElement("path",{d:"M18.364 5.636L16.95 7.05A7 7 0 1 0 19 12h2a9 9 0 1 1-2.636-6.364z"}))};var u=e.i(95779);let f={xs:{height:"h-4",width:"w-4"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-6",width:"w-6"},xl:{height:"h-6",width:"w-6"}},g=(e,r)=>{switch(e){case"primary":return{textColor:r?(0,c.getColorClassNames)("white").textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",hoverTextColor:r?(0,c.getColorClassNames)("white").textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:r?(0,c.getColorClassNames)(r,u.colorPalette.background).bgColor:"bg-tremor-brand dark:bg-dark-tremor-brand",hoverBgColor:r?(0,c.getColorClassNames)(r,u.colorPalette.darkBackground).hoverBgColor:"hover:bg-tremor-brand-emphasis dark:hover:bg-dark-tremor-brand-emphasis",borderColor:r?(0,c.getColorClassNames)(r,u.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand",hoverBorderColor:r?(0,c.getColorClassNames)(r,u.colorPalette.darkBorder).hoverBorderColor:"hover:border-tremor-brand-emphasis dark:hover:border-dark-tremor-brand-emphasis"};case"secondary":return{textColor:r?(0,c.getColorClassNames)(r,u.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",hoverTextColor:r?(0,c.getColorClassNames)(r,u.colorPalette.text).textColor:"hover:text-tremor-brand-emphasis dark:hover:text-dark-tremor-brand-emphasis",bgColor:(0,c.getColorClassNames)("transparent").bgColor,hoverBgColor:r?(0,d.tremorTwMerge)((0,c.getColorClassNames)(r,u.colorPalette.background).hoverBgColor,"hover:bg-opacity-20 dark:hover:bg-opacity-20"):"hover:bg-tremor-brand-faint dark:hover:bg-dark-tremor-brand-faint",borderColor:r?(0,c.getColorClassNames)(r,u.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand"};case"light":return{textColor:r?(0,c.getColorClassNames)(r,u.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",hoverTextColor:r?(0,c.getColorClassNames)(r,u.colorPalette.darkText).hoverTextColor:"hover:text-tremor-brand-emphasis dark:hover:text-dark-tremor-brand-emphasis",bgColor:(0,c.getColorClassNames)("transparent").bgColor,borderColor:"",hoverBorderColor:""}}},p=(0,c.makeClassName)("Button"),b=({loading:e,iconSize:r,iconPosition:t,Icon:o,needMargin:l,transitionStatus:s})=>{let n=l?t===i.HorizontalPositions.Left?(0,d.tremorTwMerge)("-ml-1","mr-1.5"):(0,d.tremorTwMerge)("-mr-1","ml-1.5"):"",c=(0,d.tremorTwMerge)("w-0 h-0"),u={default:c,entering:c,entered:r,exiting:r,exited:c};return e?a.default.createElement(m,{className:(0,d.tremorTwMerge)(p("icon"),"animate-spin shrink-0",n,u.default,u[s]),style:{transition:"width 150ms"}}):a.default.createElement(o,{className:(0,d.tremorTwMerge)(p("icon"),"shrink-0",r,n)})},h=a.default.forwardRef((e,o)=>{let{icon:m,iconPosition:u=i.HorizontalPositions.Left,size:h=i.Sizes.SM,color:y,variant:v="primary",disabled:x,loading:C=!1,loadingText:w,children:k,tooltip:N,className:T}=e,O=(0,r.__rest)(e,["icon","iconPosition","size","color","variant","disabled","loading","loadingText","children","tooltip","className"]),E=C||x,M=void 0!==m||C,j=C&&w,P=!(!k&&!j),S=(0,d.tremorTwMerge)(f[h].height,f[h].width),_="light"!==v?(0,d.tremorTwMerge)("rounded-tremor-default border","shadow-tremor-input","dark:shadow-dark-tremor-input"):"",z=g(v,y),R=("light"!==v?{xs:{paddingX:"px-2.5",paddingY:"py-1.5",fontSize:"text-xs"},sm:{paddingX:"px-4",paddingY:"py-2",fontSize:"text-sm"},md:{paddingX:"px-4",paddingY:"py-2",fontSize:"text-md"},lg:{paddingX:"px-4",paddingY:"py-2.5",fontSize:"text-lg"},xl:{paddingX:"px-4",paddingY:"py-3",fontSize:"text-xl"}}:{xs:{paddingX:"",paddingY:"",fontSize:"text-xs"},sm:{paddingX:"",paddingY:"",fontSize:"text-sm"},md:{paddingX:"",paddingY:"",fontSize:"text-md"},lg:{paddingX:"",paddingY:"",fontSize:"text-lg"},xl:{paddingX:"",paddingY:"",fontSize:"text-xl"}})[h],{tooltipProps:B,getReferenceProps:$}=(0,t.useTooltip)(300),[L,H]=(({enter:e=!0,exit:r=!0,preEnter:t,preExit:o,timeout:i,initialEntered:d,mountOnEnter:c,unmountOnExit:m,onStateChange:u}={})=>{let[f,g]=(0,a.useState)(()=>l(d?2:s(c))),p=(0,a.useRef)(f),b=(0,a.useRef)(0),[h,y]="object"==typeof i?[i.enter,i.exit]:[i,i],v=(0,a.useCallback)(()=>{let e=((e,r)=>{switch(e){case 1:case 0:return 2;case 4:case 3:return s(r)}})(p.current._s,m);e&&n(e,g,p,b,u)},[u,m]);return[f,(0,a.useCallback)(a=>{let l=e=>{switch(n(e,g,p,b,u),e){case 1:h>=0&&(b.current=((...e)=>setTimeout(...e))(v,h));break;case 4:y>=0&&(b.current=((...e)=>setTimeout(...e))(v,y));break;case 0:case 3:b.current=((...e)=>setTimeout(...e))(()=>{isNaN(document.body.offsetTop)||l(e+1)},0)}},i=p.current.isEnter;"boolean"!=typeof a&&(a=!i),a?i||l(e?+!t:2):i&&l(r?o?3:4:s(m))},[v,u,e,r,t,o,h,y,m]),v]})({timeout:50});return(0,a.useEffect)(()=>{H(C)},[C]),a.default.createElement("button",Object.assign({ref:(0,c.mergeRefs)([o,B.refs.setReference]),className:(0,d.tremorTwMerge)(p("root"),"shrink-0 inline-flex justify-center items-center group font-medium outline-none",_,R.paddingX,R.paddingY,R.fontSize,z.textColor,z.bgColor,z.borderColor,z.hoverBorderColor,E?"opacity-50 cursor-not-allowed":(0,d.tremorTwMerge)(g(v,y).hoverTextColor,g(v,y).hoverBgColor,g(v,y).hoverBorderColor),T),disabled:E},$,O),a.default.createElement(t.default,Object.assign({text:N},B)),M&&u!==i.HorizontalPositions.Right?a.default.createElement(b,{loading:C,iconSize:S,iconPosition:u,Icon:m,transitionStatus:L.status,needMargin:P}):null,j||k?a.default.createElement("span",{className:(0,d.tremorTwMerge)(p("text"),"text-tremor-default whitespace-nowrap")},j?w:k):null,M&&u===i.HorizontalPositions.Right?a.default.createElement(b,{loading:C,iconSize:S,iconPosition:u,Icon:m,transitionStatus:L.status,needMargin:P}):null)});h.displayName="Button",e.s(["Button",0,h],994388)},304967,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(480731),o=e.i(95779),l=e.i(444755),s=e.i(673706);let n=(0,s.makeClassName)("Card"),i=t.default.forwardRef((e,i)=>{let{decoration:d="",decorationColor:c,children:m,className:u}=e,f=(0,r.__rest)(e,["decoration","decorationColor","children","className"]);return t.default.createElement("div",Object.assign({ref:i,className:(0,l.tremorTwMerge)(n("root"),"relative w-full text-left ring-1 rounded-tremor-default p-6","bg-tremor-background ring-tremor-ring shadow-tremor-card","dark:bg-dark-tremor-background dark:ring-dark-tremor-ring dark:shadow-dark-tremor-card",c?(0,s.getColorClassNames)(c,o.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand",(e=>{if(!e)return"";switch(e){case a.HorizontalPositions.Left:return"border-l-4";case a.VerticalPositions.Top:return"border-t-4";case a.HorizontalPositions.Right:return"border-r-4";case a.VerticalPositions.Bottom:return"border-b-4";default:return""}})(d),u)},f),m)});i.displayName="Card",e.s(["Card",0,i],304967)},629569,e=>{"use strict";var r=e.i(290571),t=e.i(95779),a=e.i(444755),o=e.i(673706),l=e.i(271645);let s=l.default.forwardRef((e,s)=>{let{color:n,children:i,className:d}=e,c=(0,r.__rest)(e,["color","children","className"]);return l.default.createElement("p",Object.assign({ref:s,className:(0,a.tremorTwMerge)("font-medium text-tremor-title",n?(0,o.getColorClassNames)(n,t.colorPalette.darkText).textColor:"text-tremor-content-strong dark:text-dark-tremor-content-strong",d)},c),i)});s.displayName="Title",e.s(["Title",0,s],629569)},653496,e=>{"use strict";var r=e.i(721369);e.s(["Tabs",()=>r.default])},637235,e=>{"use strict";e.i(247167);var r=e.i(931067),t=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M512 64C264.6 64 64 264.6 64 512s200.6 448 448 448 448-200.6 448-448S759.4 64 512 64zm0 820c-205.4 0-372-166.6-372-372s166.6-372 372-372 372 166.6 372 372-166.6 372-372 372z"}},{tag:"path",attrs:{d:"M686.7 638.6L544.1 535.5V288c0-4.4-3.6-8-8-8H488c-4.4 0-8 3.6-8 8v275.4c0 2.6 1.2 5 3.3 6.5l165.4 120.6c3.6 2.6 8.6 1.8 11.2-1.7l28.6-39c2.6-3.7 1.8-8.7-1.8-11.2z"}}]},name:"clock-circle",theme:"outlined"};var o=e.i(9583),l=t.forwardRef(function(e,l){return t.createElement(o.default,(0,r.default)({},e,{ref:l,icon:a}))});e.s(["ClockCircleOutlined",0,l],637235)},525720,e=>{"use strict";e.i(247167);var r=e.i(271645),t=e.i(343794),a=e.i(529681),o=e.i(908286),l=e.i(242064),s=e.i(246422),n=e.i(838378);let i=["wrap","nowrap","wrap-reverse"],d=["flex-start","flex-end","start","end","center","space-between","space-around","space-evenly","stretch","normal","left","right"],c=["center","start","end","flex-start","flex-end","self-start","self-end","baseline","normal","stretch"],m=function(e,r){let a,o,l;return(0,t.default)(Object.assign(Object.assign(Object.assign({},(a=!0===r.wrap?"wrap":r.wrap,{[`${e}-wrap-${a}`]:a&&i.includes(a)})),(o={},c.forEach(t=>{o[`${e}-align-${t}`]=r.align===t}),o[`${e}-align-stretch`]=!r.align&&!!r.vertical,o)),(l={},d.forEach(t=>{l[`${e}-justify-${t}`]=r.justify===t}),l)))},u=(0,s.genStyleHooks)("Flex",e=>{let{paddingXS:r,padding:t,paddingLG:a}=e,o=(0,n.mergeToken)(e,{flexGapSM:r,flexGap:t,flexGapLG:a});return[(e=>{let{componentCls:r}=e;return{[r]:{display:"flex",margin:0,padding:0,"&-vertical":{flexDirection:"column"},"&-rtl":{direction:"rtl"},"&:empty":{display:"none"}}}})(o),(e=>{let{componentCls:r}=e;return{[r]:{"&-gap-small":{gap:e.flexGapSM},"&-gap-middle":{gap:e.flexGap},"&-gap-large":{gap:e.flexGapLG}}}})(o),(e=>{let{componentCls:r}=e,t={};return i.forEach(e=>{t[`${r}-wrap-${e}`]={flexWrap:e}}),t})(o),(e=>{let{componentCls:r}=e,t={};return c.forEach(e=>{t[`${r}-align-${e}`]={alignItems:e}}),t})(o),(e=>{let{componentCls:r}=e,t={};return d.forEach(e=>{t[`${r}-justify-${e}`]={justifyContent:e}}),t})(o)]},()=>({}),{resetStyle:!1});var f=function(e,r){var t={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&0>r.indexOf(a)&&(t[a]=e[a]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var o=0,a=Object.getOwnPropertySymbols(e);or.indexOf(a[o])&&Object.prototype.propertyIsEnumerable.call(e,a[o])&&(t[a[o]]=e[a[o]]);return t};let g=r.default.forwardRef((e,s)=>{let{prefixCls:n,rootClassName:i,className:d,style:c,flex:g,gap:p,vertical:b=!1,component:h="div",children:y}=e,v=f(e,["prefixCls","rootClassName","className","style","flex","gap","vertical","component","children"]),{flex:x,direction:C,getPrefixCls:w}=r.default.useContext(l.ConfigContext),k=w("flex",n),[N,T,O]=u(k),E=null!=b?b:null==x?void 0:x.vertical,M=(0,t.default)(d,i,null==x?void 0:x.className,k,T,O,m(k,e),{[`${k}-rtl`]:"rtl"===C,[`${k}-gap-${p}`]:(0,o.isPresetSize)(p),[`${k}-vertical`]:E}),j=Object.assign(Object.assign({},null==x?void 0:x.style),c);return g&&(j.flex=g),p&&!(0,o.isPresetSize)(p)&&(j.gap=p),N(r.default.createElement(h,Object.assign({ref:s,className:M,style:j},(0,a.default)(v,["justify","wrap","align"])),y))});e.s(["Flex",0,g],525720)},743151,(e,r,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.CopyToClipboard=void 0;var a=s(e.r(844343)),o=s(e.r(271645)),l=["text","onCopy","options","children"];function s(e){return e&&e.__esModule?e:{default:e}}function n(e){return(n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function i(e,r){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);r&&(a=a.filter(function(r){return Object.getOwnPropertyDescriptor(e,r).enumerable})),t.push.apply(t,a)}return t}function d(e){for(var r=1;r{"use strict";var a=e.r(743151).CopyToClipboard;a.CopyToClipboard=a,r.exports=a},269200,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("Table"),l=t.default.forwardRef((e,l)=>{let{children:s,className:n}=e,i=(0,r.__rest)(e,["children","className"]);return t.default.createElement("div",{className:(0,a.tremorTwMerge)(o("root"),"overflow-auto",n)},t.default.createElement("table",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("table"),"w-full text-tremor-default","text-tremor-content","dark:text-dark-tremor-content")},i),s))});l.displayName="Table",e.s(["Table",0,l],269200)},942232,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableBody"),l=t.default.forwardRef((e,l)=>{let{children:s,className:n}=e,i=(0,r.__rest)(e,["children","className"]);return t.default.createElement(t.default.Fragment,null,t.default.createElement("tbody",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("root"),"align-top divide-y","divide-tremor-border","dark:divide-dark-tremor-border",n)},i),s))});l.displayName="TableBody",e.s(["TableBody",0,l],942232)},977572,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableCell"),l=t.default.forwardRef((e,l)=>{let{children:s,className:n}=e,i=(0,r.__rest)(e,["children","className"]);return t.default.createElement(t.default.Fragment,null,t.default.createElement("td",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("root"),"align-middle whitespace-nowrap text-left p-4",n)},i),s))});l.displayName="TableCell",e.s(["TableCell",0,l],977572)},427612,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableHead"),l=t.default.forwardRef((e,l)=>{let{children:s,className:n}=e,i=(0,r.__rest)(e,["children","className"]);return t.default.createElement(t.default.Fragment,null,t.default.createElement("thead",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("root"),"text-left","text-tremor-content","dark:text-dark-tremor-content",n)},i),s))});l.displayName="TableHead",e.s(["TableHead",0,l],427612)},64848,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableHeaderCell"),l=t.default.forwardRef((e,l)=>{let{children:s,className:n}=e,i=(0,r.__rest)(e,["children","className"]);return t.default.createElement(t.default.Fragment,null,t.default.createElement("th",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("root"),"whitespace-nowrap text-left font-semibold top-0 px-4 py-3.5","text-tremor-content-strong","dark:text-dark-tremor-content-strong",n)},i),s))});l.displayName="TableHeaderCell",e.s(["TableHeaderCell",0,l],64848)},496020,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(444755);let o=(0,e.i(673706).makeClassName)("TableRow"),l=t.default.forwardRef((e,l)=>{let{children:s,className:n}=e,i=(0,r.__rest)(e,["children","className"]);return t.default.createElement(t.default.Fragment,null,t.default.createElement("tr",Object.assign({ref:l,className:(0,a.tremorTwMerge)(o("row"),n)},i),s))});l.displayName="TableRow",e.s(["TableRow",0,l],496020)},536916,e=>{"use strict";var r=e.i(374276);e.s(["Checkbox",()=>r.default])},350967,46757,e=>{"use strict";var r=e.i(290571),t=e.i(444755),a=e.i(673706),o=e.i(271645);let l={0:"grid-cols-none",1:"grid-cols-1",2:"grid-cols-2",3:"grid-cols-3",4:"grid-cols-4",5:"grid-cols-5",6:"grid-cols-6",7:"grid-cols-7",8:"grid-cols-8",9:"grid-cols-9",10:"grid-cols-10",11:"grid-cols-11",12:"grid-cols-12"},s={0:"sm:grid-cols-none",1:"sm:grid-cols-1",2:"sm:grid-cols-2",3:"sm:grid-cols-3",4:"sm:grid-cols-4",5:"sm:grid-cols-5",6:"sm:grid-cols-6",7:"sm:grid-cols-7",8:"sm:grid-cols-8",9:"sm:grid-cols-9",10:"sm:grid-cols-10",11:"sm:grid-cols-11",12:"sm:grid-cols-12"},n={0:"md:grid-cols-none",1:"md:grid-cols-1",2:"md:grid-cols-2",3:"md:grid-cols-3",4:"md:grid-cols-4",5:"md:grid-cols-5",6:"md:grid-cols-6",7:"md:grid-cols-7",8:"md:grid-cols-8",9:"md:grid-cols-9",10:"md:grid-cols-10",11:"md:grid-cols-11",12:"md:grid-cols-12"},i={0:"lg:grid-cols-none",1:"lg:grid-cols-1",2:"lg:grid-cols-2",3:"lg:grid-cols-3",4:"lg:grid-cols-4",5:"lg:grid-cols-5",6:"lg:grid-cols-6",7:"lg:grid-cols-7",8:"lg:grid-cols-8",9:"lg:grid-cols-9",10:"lg:grid-cols-10",11:"lg:grid-cols-11",12:"lg:grid-cols-12"};e.s(["colSpan",0,{1:"col-span-1",2:"col-span-2",3:"col-span-3",4:"col-span-4",5:"col-span-5",6:"col-span-6",7:"col-span-7",8:"col-span-8",9:"col-span-9",10:"col-span-10",11:"col-span-11",12:"col-span-12",13:"col-span-13"},"colSpanLg",0,{1:"lg:col-span-1",2:"lg:col-span-2",3:"lg:col-span-3",4:"lg:col-span-4",5:"lg:col-span-5",6:"lg:col-span-6",7:"lg:col-span-7",8:"lg:col-span-8",9:"lg:col-span-9",10:"lg:col-span-10",11:"lg:col-span-11",12:"lg:col-span-12",13:"lg:col-span-13"},"colSpanMd",0,{1:"md:col-span-1",2:"md:col-span-2",3:"md:col-span-3",4:"md:col-span-4",5:"md:col-span-5",6:"md:col-span-6",7:"md:col-span-7",8:"md:col-span-8",9:"md:col-span-9",10:"md:col-span-10",11:"md:col-span-11",12:"md:col-span-12",13:"md:col-span-13"},"colSpanSm",0,{1:"sm:col-span-1",2:"sm:col-span-2",3:"sm:col-span-3",4:"sm:col-span-4",5:"sm:col-span-5",6:"sm:col-span-6",7:"sm:col-span-7",8:"sm:col-span-8",9:"sm:col-span-9",10:"sm:col-span-10",11:"sm:col-span-11",12:"sm:col-span-12",13:"sm:col-span-13"},"gridCols",0,l,"gridColsLg",0,i,"gridColsMd",0,n,"gridColsSm",0,s],46757);let d=(0,a.makeClassName)("Grid"),c=(e,r)=>e&&Object.keys(r).includes(String(e))?r[e]:"",m=o.default.forwardRef((e,a)=>{let{numItems:m=1,numItemsSm:u,numItemsMd:f,numItemsLg:g,children:p,className:b}=e,h=(0,r.__rest)(e,["numItems","numItemsSm","numItemsMd","numItemsLg","children","className"]),y=c(m,l),v=c(u,s),x=c(f,n),C=c(g,i),w=(0,t.tremorTwMerge)(y,v,x,C);return o.default.createElement("div",Object.assign({ref:a,className:(0,t.tremorTwMerge)(d("root"),"grid",w,b)},h),p)});m.displayName="Grid",e.s(["Grid",0,m],350967)},981339,e=>{"use strict";var r=e.i(185793);e.s(["Skeleton",()=>r.default])},596239,e=>{"use strict";e.i(247167);var r=e.i(931067),t=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M574 665.4a8.03 8.03 0 00-11.3 0L446.5 781.6c-53.8 53.8-144.6 59.5-204 0-59.5-59.5-53.8-150.2 0-204l116.2-116.2c3.1-3.1 3.1-8.2 0-11.3l-39.8-39.8a8.03 8.03 0 00-11.3 0L191.4 526.5c-84.6 84.6-84.6 221.5 0 306s221.5 84.6 306 0l116.2-116.2c3.1-3.1 3.1-8.2 0-11.3L574 665.4zm258.6-474c-84.6-84.6-221.5-84.6-306 0L410.3 307.6a8.03 8.03 0 000 11.3l39.7 39.7c3.1 3.1 8.2 3.1 11.3 0l116.2-116.2c53.8-53.8 144.6-59.5 204 0 59.5 59.5 53.8 150.2 0 204L665.3 562.6a8.03 8.03 0 000 11.3l39.8 39.8c3.1 3.1 8.2 3.1 11.3 0l116.2-116.2c84.5-84.6 84.5-221.5 0-306.1zM610.1 372.3a8.03 8.03 0 00-11.3 0L372.3 598.7a8.03 8.03 0 000 11.3l39.6 39.6c3.1 3.1 8.2 3.1 11.3 0l226.4-226.4c3.1-3.1 3.1-8.2 0-11.3l-39.5-39.6z"}}]},name:"link",theme:"outlined"};var o=e.i(9583),l=t.forwardRef(function(e,l){return t.createElement(o.default,(0,r.default)({},e,{ref:l,icon:a}))});e.s(["LinkOutlined",0,l],596239)},751904,e=>{"use strict";var r=e.i(401361);e.s(["EditOutlined",()=>r.default])},727612,e=>{"use strict";let r=(0,e.i(475254).default)("trash-2",[["path",{d:"M3 6h18",key:"d0wm0j"}],["path",{d:"M19 6v14c0 1-1 2-2 2H7c-1 0-2-1-2-2V6",key:"4alrt4"}],["path",{d:"M8 6V4c0-1 1-2 2-2h4c1 0 2 1 2 2v2",key:"v07s0e"}],["line",{x1:"10",x2:"10",y1:"11",y2:"17",key:"1uufr5"}],["line",{x1:"14",x2:"14",y1:"11",y2:"17",key:"xtxkd"}]]);e.s(["Trash2",0,r],727612)},823429,e=>{"use strict";let r=(0,e.i(475254).default)("square-pen",[["path",{d:"M12 3H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7",key:"1m0v6g"}],["path",{d:"M18.375 2.625a1 1 0 0 1 3 3l-9.013 9.014a2 2 0 0 1-.853.505l-2.873.84a.5.5 0 0 1-.62-.62l.84-2.873a2 2 0 0 1 .506-.852z",key:"ohrbg2"}]]);e.s(["default",0,r])},465261,e=>{"use strict";let r=(0,e.i(475254).default)("key-round",[["path",{d:"M2.586 17.414A2 2 0 0 0 2 18.828V21a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h1a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h.172a2 2 0 0 0 1.414-.586l.814-.814a6.5 6.5 0 1 0-4-4z",key:"1s6t7t"}],["circle",{cx:"16.5",cy:"7.5",r:".5",fill:"currentColor",key:"w0ekpg"}]]);e.s(["KeyRound",0,r],465261)},688511,e=>{"use strict";var r=e.i(823429);e.s(["Edit",()=>r.default])},700514,e=>{"use strict";var r=e.i(271645);e.s(["defaultPageSize",0,25,"useBaseUrl",0,()=>{let[e,t]=(0,r.useState)("http://localhost:4000");return(0,r.useEffect)(()=>{{let{protocol:e,host:r}=window.location;t(`${e}//${r}`)}},[]),e}])},98919,e=>{"use strict";let r=(0,e.i(475254).default)("shield",[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}]]);e.s(["Shield",0,r],98919)},114600,e=>{"use strict";var r=e.i(290571),t=e.i(444755),a=e.i(673706),o=e.i(271645);let l=(0,a.makeClassName)("Divider"),s=o.default.forwardRef((e,a)=>{let{className:s,children:n}=e,i=(0,r.__rest)(e,["className","children"]);return o.default.createElement("div",Object.assign({ref:a,className:(0,t.tremorTwMerge)(l("root"),"w-full mx-auto my-6 flex justify-between gap-3 items-center text-tremor-default","text-tremor-content","dark:text-dark-tremor-content",s)},i),n?o.default.createElement(o.default.Fragment,null,o.default.createElement("div",{className:(0,t.tremorTwMerge)("w-full h-[1px] bg-tremor-border dark:bg-dark-tremor-border")}),o.default.createElement("div",{className:(0,t.tremorTwMerge)("text-inherit whitespace-nowrap")},n),o.default.createElement("div",{className:(0,t.tremorTwMerge)("w-full h-[1px] bg-tremor-border dark:bg-dark-tremor-border")})):o.default.createElement("div",{className:(0,t.tremorTwMerge)("w-full h-[1px] bg-tremor-border dark:bg-dark-tremor-border")}))});s.displayName="Divider",e.s(["Divider",0,s],114600)},366283,e=>{"use strict";var r=e.i(290571),t=e.i(271645),a=e.i(95779),o=e.i(444755),l=e.i(673706);let s=(0,l.makeClassName)("Callout"),n=t.default.forwardRef((e,n)=>{let{title:i,icon:d,color:c,className:m,children:u}=e,f=(0,r.__rest)(e,["title","icon","color","className","children"]);return t.default.createElement("div",Object.assign({ref:n,className:(0,o.tremorTwMerge)(s("root"),"flex flex-col overflow-hidden rounded-tremor-default text-tremor-default border-l-4 py-3 pr-3 pl-4",c?(0,o.tremorTwMerge)((0,l.getColorClassNames)(c,a.colorPalette.background).bgColor,(0,l.getColorClassNames)(c,a.colorPalette.darkBorder).borderColor,(0,l.getColorClassNames)(c,a.colorPalette.darkText).textColor,"dark:bg-opacity-10 bg-opacity-10"):(0,o.tremorTwMerge)("bg-tremor-brand-faint border-tremor-brand-emphasis text-tremor-brand-emphasis","dark:bg-dark-tremor-brand-muted/70 dark:border-dark-tremor-brand-emphasis dark:text-dark-tremor-brand-emphasis"),m)},f),t.default.createElement("div",{className:(0,o.tremorTwMerge)(s("header"),"flex items-start")},d?t.default.createElement(d,{className:(0,o.tremorTwMerge)(s("icon"),"flex-none h-5 w-5 mr-1.5")}):null,t.default.createElement("h4",{className:(0,o.tremorTwMerge)(s("title"),"font-semibold")},i)),t.default.createElement("p",{className:(0,o.tremorTwMerge)(s("body"),"overflow-y-auto",u?"mt-2":"")},u))});n.displayName="Callout",e.s(["Callout",0,n],366283)},475647,e=>{"use strict";e.i(247167);var r=e.i(931067),t=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M696 480H544V328c0-4.4-3.6-8-8-8h-48c-4.4 0-8 3.6-8 8v152H328c-4.4 0-8 3.6-8 8v48c0 4.4 3.6 8 8 8h152v152c0 4.4 3.6 8 8 8h48c4.4 0 8-3.6 8-8V544h152c4.4 0 8-3.6 8-8v-48c0-4.4-3.6-8-8-8z"}},{tag:"path",attrs:{d:"M512 64C264.6 64 64 264.6 64 512s200.6 448 448 448 448-200.6 448-448S759.4 64 512 64zm0 820c-205.4 0-372-166.6-372-372s166.6-372 372-372 372 166.6 372 372-166.6 372-372 372z"}}]},name:"plus-circle",theme:"outlined"};var o=e.i(9583),l=t.forwardRef(function(e,l){return t.createElement(o.default,(0,r.default)({},e,{ref:l,icon:a}))});e.s(["PlusCircleOutlined",0,l],475647)},153472,e=>{"use strict";var r,t,a=e.i(266027),o=e.i(954616),l=e.i(912598),s=e.i(243652),n=e.i(135214),i=e.i(602869),d=e.i(431703),c=((r={}).GENERAL_SETTINGS="general_settings",r),m=((t={}).MAXIMUM_SPEND_LOGS_RETENTION_PERIOD="maximum_spend_logs_retention_period",t);let u=async(e,r)=>{try{let t=i.proxyBaseUrl?`${i.proxyBaseUrl}/config/list?config_type=${r}`:`/config/list?config_type=${r}`,a=await fetch(t,{method:"GET",headers:{[(0,i.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!a.ok){let e=await a.json(),r=(0,d.deriveErrorMessage)(e);throw(0,i.handleError)(r),Error(r)}return await a.json()}catch(e){throw console.error(`Failed to get proxy config for ${r}:`,e),e}},f=(0,s.createQueryKeys)("proxyConfig"),g=async(e,r)=>{try{let t=i.proxyBaseUrl?`${i.proxyBaseUrl}/config/field/delete`:"/config/field/delete",a=await fetch(t,{method:"POST",headers:{[(0,i.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"},body:JSON.stringify(r)});if(!a.ok){let e=await a.json(),r=(0,d.deriveErrorMessage)(e);throw(0,i.handleError)(r),Error(r)}return await a.json()}catch(e){throw console.error(`Failed to delete proxy config field ${r.field_name}:`,e),e}};e.s(["ConfigType",()=>c,"GeneralSettingsFieldName",()=>m,"proxyConfigKeys",0,f,"useDeleteProxyConfigField",0,()=>{let{accessToken:e}=(0,n.default)(),r=(0,l.useQueryClient)();return(0,o.useMutation)({mutationFn:async r=>{if(!e)throw Error("Access token is required");return await g(e,r)},onSuccess:()=>{r.invalidateQueries({queryKey:f.all})}})},"useProxyConfig",0,e=>{let{accessToken:r}=(0,n.default)();return(0,a.useQuery)({queryKey:f.list({filters:{configType:e}}),queryFn:async()=>await u(r,e),enabled:!!r})}])},286536,77705,e=>{"use strict";var r=e.i(475254);let t=(0,r.default)("eye",[["path",{d:"M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0",key:"1nclc0"}],["circle",{cx:"12",cy:"12",r:"3",key:"1v7zrd"}]]);e.s(["Eye",0,t],286536);let a=(0,r.default)("eye-off",[["path",{d:"M10.733 5.076a10.744 10.744 0 0 1 11.205 6.575 1 1 0 0 1 0 .696 10.747 10.747 0 0 1-1.444 2.49",key:"ct8e1f"}],["path",{d:"M14.084 14.158a3 3 0 0 1-4.242-4.242",key:"151rxh"}],["path",{d:"M17.479 17.499a10.75 10.75 0 0 1-15.417-5.151 1 1 0 0 1 0-.696 10.75 10.75 0 0 1 4.446-5.143",key:"13bj9a"}],["path",{d:"m2 2 20 20",key:"1ooewy"}]]);e.s(["EyeOff",0,a],77705)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/017kxo-8o84bv.js b/litellm/proxy/_experimental/out/_next/static/chunks/017kxo-8o84bv.js new file mode 100644 index 00000000000..edb12734d22 --- /dev/null +++ b/litellm/proxy/_experimental/out/_next/static/chunks/017kxo-8o84bv.js @@ -0,0 +1 @@ +(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,560025,e=>{"use strict";e.i(247167);var t=e.i(271645),n=e.i(343794),a=e.i(931067),l=e.i(392221),o=e.i(703923),i=e.i(211577),r=e.i(209428),s=e.i(410160),c=e.i(914949),u=e.i(529681),d=e.i(611935),f=e.i(361275),m=e.i(174428),v=function(e,t){if(!e)return null;var n={left:e.offsetLeft,right:e.parentElement.clientWidth-e.clientWidth-e.offsetLeft,width:e.clientWidth,top:e.offsetTop,bottom:e.parentElement.clientHeight-e.clientHeight-e.offsetTop,height:e.clientHeight};return t?{left:0,right:0,width:0,top:n.top,bottom:n.bottom,height:n.height}:{left:n.left,right:n.right,width:n.width,top:0,bottom:0,height:0}},p=function(e){return void 0!==e?"".concat(e,"px"):void 0};function g(e){var a=e.prefixCls,o=e.containerRef,i=e.value,s=e.getValueIndex,c=e.motionName,u=e.onMotionStart,g=e.onMotionEnd,h=e.direction,b=e.vertical,y=void 0!==b&&b,w=t.useRef(null),x=t.useState(i),$=(0,l.default)(x,2),C=$[0],O=$[1],S=function(e){var t,n=s(e),l=null==(t=o.current)?void 0:t.querySelectorAll(".".concat(a,"-item"))[n];return(null==l?void 0:l.offsetParent)&&l},k=t.useState(null),E=(0,l.default)(k,2),N=E[0],j=E[1],R=t.useState(null),M=(0,l.default)(R,2),z=M[0],D=M[1];(0,m.default)(function(){if(C!==i){var e=S(C),t=S(i),n=v(e,y),a=v(t,y);O(i),j(n),D(a),e&&t?u():g()}},[i]);var I=t.useMemo(function(){if(y){var e;return p(null!=(e=null==N?void 0:N.top)?e:0)}return"rtl"===h?p(-(null==N?void 0:N.right)):p(null==N?void 0:N.left)},[y,h,N]),H=t.useMemo(function(){if(y){var e;return p(null!=(e=null==z?void 0:z.top)?e:0)}return"rtl"===h?p(-(null==z?void 0:z.right)):p(null==z?void 0:z.left)},[y,h,z]);return N&&z?t.createElement(f.default,{visible:!0,motionName:c,motionAppear:!0,onAppearStart:function(){return y?{transform:"translateY(var(--thumb-start-top))",height:"var(--thumb-start-height)"}:{transform:"translateX(var(--thumb-start-left))",width:"var(--thumb-start-width)"}},onAppearActive:function(){return y?{transform:"translateY(var(--thumb-active-top))",height:"var(--thumb-active-height)"}:{transform:"translateX(var(--thumb-active-left))",width:"var(--thumb-active-width)"}},onVisibleChanged:function(){j(null),D(null),g()}},function(e,l){var o=e.className,i=e.style,s=(0,r.default)((0,r.default)({},i),{},{"--thumb-start-left":I,"--thumb-start-width":p(null==N?void 0:N.width),"--thumb-active-left":H,"--thumb-active-width":p(null==z?void 0:z.width),"--thumb-start-top":I,"--thumb-start-height":p(null==N?void 0:N.height),"--thumb-active-top":H,"--thumb-active-height":p(null==z?void 0:z.height)}),c={ref:(0,d.composeRef)(w,l),style:s,className:(0,n.default)("".concat(a,"-thumb"),o)};return t.createElement("div",c)}):null}var h=["prefixCls","direction","vertical","options","disabled","defaultValue","value","name","onChange","className","motionName"],b=function(e){var a=e.prefixCls,l=e.className,o=e.disabled,r=e.checked,s=e.label,c=e.title,u=e.value,d=e.name,f=e.onChange,m=e.onFocus,v=e.onBlur,p=e.onKeyDown,g=e.onKeyUp,h=e.onMouseDown;return t.createElement("label",{className:(0,n.default)(l,(0,i.default)({},"".concat(a,"-item-disabled"),o)),onMouseDown:h},t.createElement("input",{name:d,className:"".concat(a,"-item-input"),type:"radio",disabled:o,checked:r,onChange:function(e){o||f(e,u)},onFocus:m,onBlur:v,onKeyDown:p,onKeyUp:g}),t.createElement("div",{className:"".concat(a,"-item-label"),title:c},s))},y=t.forwardRef(function(e,f){var m,v=e.prefixCls,p=void 0===v?"rc-segmented":v,y=e.direction,w=e.vertical,x=e.options,$=void 0===x?[]:x,C=e.disabled,O=e.defaultValue,S=e.value,k=e.name,E=e.onChange,N=e.className,j=e.motionName,R=(0,o.default)(e,h),M=t.useRef(null),z=t.useMemo(function(){return(0,d.composeRef)(M,f)},[M,f]),D=t.useMemo(function(){return $.map(function(e){if("object"===(0,s.default)(e)&&null!==e){var t=function(e){if(void 0!==e.title)return e.title;if("object"!==(0,s.default)(e.label)){var t;return null==(t=e.label)?void 0:t.toString()}}(e);return(0,r.default)((0,r.default)({},e),{},{title:t})}return{label:null==e?void 0:e.toString(),title:null==e?void 0:e.toString(),value:e}})},[$]),I=(0,c.default)(null==(m=D[0])?void 0:m.value,{value:S,defaultValue:O}),H=(0,l.default)(I,2),L=H[0],P=H[1],B=t.useState(!1),A=(0,l.default)(B,2),K=A[0],T=A[1],V=function(e,t){P(t),null==E||E(t)},U=(0,u.default)(R,["children"]),F=t.useState(!1),W=(0,l.default)(F,2),X=W[0],q=W[1],Y=t.useState(!1),_=(0,l.default)(Y,2),G=_[0],Z=_[1],J=function(){Z(!0)},Q=function(){Z(!1)},ee=function(){q(!1)},et=function(e){"Tab"===e.key&&q(!0)},en=function(e){var t=D.findIndex(function(e){return e.value===L}),n=D.length,a=D[(t+e+n)%n];a&&(P(a.value),null==E||E(a.value))},ea=function(e){switch(e.key){case"ArrowLeft":case"ArrowUp":en(-1);break;case"ArrowRight":case"ArrowDown":en(1)}};return t.createElement("div",(0,a.default)({role:"radiogroup","aria-label":"segmented control",tabIndex:C?void 0:0,"aria-orientation":w?"vertical":"horizontal"},U,{className:(0,n.default)(p,(0,i.default)((0,i.default)((0,i.default)({},"".concat(p,"-rtl"),"rtl"===y),"".concat(p,"-disabled"),C),"".concat(p,"-vertical"),w),void 0===N?"":N),ref:z}),t.createElement("div",{className:"".concat(p,"-group")},t.createElement(g,{vertical:w,prefixCls:p,value:L,containerRef:M,motionName:"".concat(p,"-").concat(void 0===j?"thumb-motion":j),direction:y,getValueIndex:function(e){return D.findIndex(function(t){return t.value===e})},onMotionStart:function(){T(!0)},onMotionEnd:function(){T(!1)}}),D.map(function(e){return t.createElement(b,(0,a.default)({},e,{name:k,key:e.value,prefixCls:p,className:(0,n.default)(e.className,"".concat(p,"-item"),(0,i.default)((0,i.default)({},"".concat(p,"-item-selected"),e.value===L&&!K),"".concat(p,"-item-focused"),G&&X&&e.value===L)),checked:e.value===L,onChange:V,onFocus:J,onBlur:Q,onKeyDown:ea,onKeyUp:et,onMouseDown:ee,disabled:!!C||!!e.disabled}))})))}),w=e.i(981444),x=e.i(242064),$=e.i(517455);e.i(296059);var C=e.i(915654),O=e.i(183293),S=e.i(246422),k=e.i(838378);function E(e,t){return{[`${e}, ${e}:hover, ${e}:focus`]:{color:t.colorTextDisabled,cursor:"not-allowed"}}}function N(e){return{background:e.itemSelectedBg,boxShadow:e.boxShadowTertiary}}let j=Object.assign({overflow:"hidden"},O.textEllipsis),R=(0,S.genStyleHooks)("Segmented",e=>{let{lineWidth:t,calc:n}=e;return(e=>{let{componentCls:t}=e,n=e.calc(e.controlHeight).sub(e.calc(e.trackPadding).mul(2)).equal(),a=e.calc(e.controlHeightLG).sub(e.calc(e.trackPadding).mul(2)).equal(),l=e.calc(e.controlHeightSM).sub(e.calc(e.trackPadding).mul(2)).equal();return{[t]:Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},(0,O.resetComponent)(e)),{display:"inline-block",padding:e.trackPadding,color:e.itemColor,background:e.trackBg,borderRadius:e.borderRadius,transition:`all ${e.motionDurationMid}`}),(0,O.genFocusStyle)(e)),{[`${t}-group`]:{position:"relative",display:"flex",alignItems:"stretch",justifyItems:"flex-start",flexDirection:"row",width:"100%"},[`&${t}-rtl`]:{direction:"rtl"},[`&${t}-vertical`]:{[`${t}-group`]:{flexDirection:"column"},[`${t}-thumb`]:{width:"100%",height:0,padding:`0 ${(0,C.unit)(e.paddingXXS)}`}},[`&${t}-block`]:{display:"flex"},[`&${t}-block ${t}-item`]:{flex:1,minWidth:0},[`${t}-item`]:{position:"relative",textAlign:"center",cursor:"pointer",transition:`color ${e.motionDurationMid}`,borderRadius:e.borderRadiusSM,transform:"translateZ(0)","&-selected":Object.assign(Object.assign({},N(e)),{color:e.itemSelectedColor}),"&-focused":(0,O.genFocusOutline)(e),"&::after":{content:'""',position:"absolute",zIndex:-1,width:"100%",height:"100%",top:0,insetInlineStart:0,borderRadius:"inherit",opacity:0,transition:`opacity ${e.motionDurationMid}, background-color ${e.motionDurationMid}`,pointerEvents:"none"},[`&:not(${t}-item-selected):not(${t}-item-disabled)`]:{"&:hover, &:active":{color:e.itemHoverColor},"&:hover::after":{opacity:1,backgroundColor:e.itemHoverBg},"&:active::after":{opacity:1,backgroundColor:e.itemActiveBg}},"&-label":Object.assign({minHeight:n,lineHeight:(0,C.unit)(n),padding:`0 ${(0,C.unit)(e.segmentedPaddingHorizontal)}`},j),"&-icon + *":{marginInlineStart:e.calc(e.marginSM).div(2).equal()},"&-input":{position:"absolute",insetBlockStart:0,insetInlineStart:0,width:0,height:0,opacity:0,pointerEvents:"none"}},[`${t}-thumb`]:Object.assign(Object.assign({},N(e)),{position:"absolute",insetBlockStart:0,insetInlineStart:0,width:0,height:"100%",padding:`${(0,C.unit)(e.paddingXXS)} 0`,borderRadius:e.borderRadiusSM,[`& ~ ${t}-item:not(${t}-item-selected):not(${t}-item-disabled)::after`]:{backgroundColor:"transparent"}}),[`&${t}-lg`]:{borderRadius:e.borderRadiusLG,[`${t}-item-label`]:{minHeight:a,lineHeight:(0,C.unit)(a),padding:`0 ${(0,C.unit)(e.segmentedPaddingHorizontal)}`,fontSize:e.fontSizeLG},[`${t}-item, ${t}-thumb`]:{borderRadius:e.borderRadius}},[`&${t}-sm`]:{borderRadius:e.borderRadiusSM,[`${t}-item-label`]:{minHeight:l,lineHeight:(0,C.unit)(l),padding:`0 ${(0,C.unit)(e.segmentedPaddingHorizontalSM)}`},[`${t}-item, ${t}-thumb`]:{borderRadius:e.borderRadiusXS}}}),E(`&-disabled ${t}-item`,e)),E(`${t}-item-disabled`,e)),{[`${t}-thumb-motion-appear-active`]:{transition:`transform ${e.motionDurationSlow} ${e.motionEaseInOut}, width ${e.motionDurationSlow} ${e.motionEaseInOut}`,willChange:"transform, width"},[`&${t}-shape-round`]:{borderRadius:9999,[`${t}-item, ${t}-thumb`]:{borderRadius:9999}}})}})((0,k.mergeToken)(e,{segmentedPaddingHorizontal:n(e.controlPaddingHorizontal).sub(t).equal(),segmentedPaddingHorizontalSM:n(e.controlPaddingHorizontalSM).sub(t).equal()}))},e=>{let{colorTextLabel:t,colorText:n,colorFillSecondary:a,colorBgElevated:l,colorFill:o,lineWidthBold:i,colorBgLayout:r}=e;return{trackPadding:i,trackBg:r,itemColor:t,itemHoverColor:n,itemHoverBg:a,itemSelectedBg:l,itemActiveBg:o,itemSelectedColor:n}});var M=function(e,t){var n={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&0>t.indexOf(a)&&(n[a]=e[a]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var l=0,a=Object.getOwnPropertySymbols(e);lt.indexOf(a[l])&&Object.prototype.propertyIsEnumerable.call(e,a[l])&&(n[a[l]]=e[a[l]]);return n};let z=t.forwardRef((e,a)=>{let l=(0,w.default)(),{prefixCls:o,className:i,rootClassName:r,block:s,options:c=[],size:u="middle",style:d,vertical:f,shape:m="default",name:v=l}=e,p=M(e,["prefixCls","className","rootClassName","block","options","size","style","vertical","shape","name"]),{getPrefixCls:g,direction:h,className:b,style:C}=(0,x.useComponentConfig)("segmented"),O=g("segmented",o),[S,k,E]=R(O),N=(0,$.default)(u),j=t.useMemo(()=>c.map(e=>{if("object"==typeof e&&(null==e?void 0:e.icon)){let{icon:n,label:a}=e;return Object.assign(Object.assign({},M(e,["icon","label"])),{label:t.createElement(t.Fragment,null,t.createElement("span",{className:`${O}-item-icon`},n),a&&t.createElement("span",null,a))})}return e}),[c,O]),z=(0,n.default)(i,r,b,{[`${O}-block`]:s,[`${O}-sm`]:"small"===N,[`${O}-lg`]:"large"===N,[`${O}-vertical`]:f,[`${O}-shape-${m}`]:"round"===m},k,E),D=Object.assign(Object.assign({},C),d);return S(t.createElement(y,Object.assign({},p,{name:v,className:z,style:D,options:j,ref:a,prefixCls:O,direction:h,vertical:f})))});e.s(["Segmented",0,z],560025)},362024,e=>{"use strict";var t=e.i(988122);e.s(["Collapse",()=>t.default])},240647,e=>{"use strict";var t=e.i(286612);e.s(["RightOutlined",()=>t.default])},149192,e=>{"use strict";var t=e.i(864517);e.s(["CloseOutlined",()=>t.default])},518617,e=>{"use strict";e.i(247167);var t=e.i(931067),n=e.i(271645);let a={icon:{tag:"svg",attrs:{"fill-rule":"evenodd",viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M512 64c247.4 0 448 200.6 448 448S759.4 960 512 960 64 759.4 64 512 264.6 64 512 64zm0 76c-205.4 0-372 166.6-372 372s166.6 372 372 372 372-166.6 372-372-166.6-372-372-372zm128.01 198.83c.03 0 .05.01.09.06l45.02 45.01a.2.2 0 01.05.09.12.12 0 010 .07c0 .02-.01.04-.05.08L557.25 512l127.87 127.86a.27.27 0 01.05.06v.02a.12.12 0 010 .07c0 .03-.01.05-.05.09l-45.02 45.02a.2.2 0 01-.09.05.12.12 0 01-.07 0c-.02 0-.04-.01-.08-.05L512 557.25 384.14 685.12c-.04.04-.06.05-.08.05a.12.12 0 01-.07 0c-.03 0-.05-.01-.09-.05l-45.02-45.02a.2.2 0 01-.05-.09.12.12 0 010-.07c0-.02.01-.04.06-.08L466.75 512 338.88 384.14a.27.27 0 01-.05-.06l-.01-.02a.12.12 0 010-.07c0-.03.01-.05.05-.09l45.02-45.02a.2.2 0 01.09-.05.12.12 0 01.07 0c.02 0 .04.01.08.06L512 466.75l127.86-127.86c.04-.05.06-.06.08-.06a.12.12 0 01.07 0z"}}]},name:"close-circle",theme:"outlined"};var l=e.i(9583),o=n.forwardRef(function(e,o){return n.createElement(l.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["CloseCircleOutlined",0,o],518617)},19732,e=>{"use strict";e.i(247167);var t=e.i(931067),n=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M512 472a40 40 0 1080 0 40 40 0 10-80 0zm367 352.9L696.3 352V178H768v-68H256v68h71.7v174L145 824.9c-2.8 7.4-4.3 15.2-4.3 23.1 0 35.3 28.7 64 64 64h614.6c7.9 0 15.7-1.5 23.1-4.3 33-12.7 49.4-49.8 36.6-82.8zM395.7 364.7V180h232.6v184.7L719.2 600c-20.7-5.3-42.1-8-63.9-8-61.2 0-119.2 21.5-165.3 60a188.78 188.78 0 01-121.3 43.9c-32.7 0-64.1-8.3-91.8-23.7l118.8-307.5zM210.5 844l41.7-107.8c35.7 18.1 75.4 27.8 116.6 27.8 61.2 0 119.2-21.5 165.3-60 33.9-28.2 76.3-43.9 121.3-43.9 35 0 68.4 9.5 97.6 27.1L813.5 844h-603z"}}]},name:"experiment",theme:"outlined"};var l=e.i(9583),o=n.forwardRef(function(e,o){return n.createElement(l.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["ExperimentOutlined",0,o],19732)},366308,e=>{"use strict";e.i(247167);var t=e.i(931067),n=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M876.6 239.5c-.5-.9-1.2-1.8-2-2.5-5-5-13.1-5-18.1 0L684.2 409.3l-67.9-67.9L788.7 169c.8-.8 1.4-1.6 2-2.5 3.6-6.1 1.6-13.9-4.5-17.5-98.2-58-226.8-44.7-311.3 39.7-67 67-89.2 162-66.5 247.4l-293 293c-3 3-2.8 7.9.3 11l169.7 169.7c3.1 3.1 8.1 3.3 11 .3l292.9-292.9c85.5 22.8 180.5.7 247.6-66.4 84.4-84.5 97.7-213.1 39.7-311.3zM786 499.8c-58.1 58.1-145.3 69.3-214.6 33.6l-8.8 8.8-.1-.1-274 274.1-79.2-79.2 230.1-230.1s0 .1.1.1l52.8-52.8c-35.7-69.3-24.5-156.5 33.6-214.6a184.2 184.2 0 01144-53.5L537 318.9a32.05 32.05 0 000 45.3l124.5 124.5a32.05 32.05 0 0045.3 0l132.8-132.8c3.7 51.8-14.4 104.8-53.6 143.9z"}}]},name:"tool",theme:"outlined"};var l=e.i(9583),o=n.forwardRef(function(e,o){return n.createElement(l.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["ToolOutlined",0,o],366308)},782273,e=>{"use strict";e.i(247167);var t=e.i(931067),n=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M625.9 115c-5.9 0-11.9 1.6-17.4 5.3L254 352H90c-8.8 0-16 7.2-16 16v288c0 8.8 7.2 16 16 16h164l354.5 231.7c5.5 3.6 11.6 5.3 17.4 5.3 16.7 0 32.1-13.3 32.1-32.1V147.1c0-18.8-15.4-32.1-32.1-32.1zM586 803L293.4 611.7l-18-11.7H146V424h129.4l17.9-11.7L586 221v582zm348-327H806c-8.8 0-16 7.2-16 16v40c0 8.8 7.2 16 16 16h128c8.8 0 16-7.2 16-16v-40c0-8.8-7.2-16-16-16zm-41.9 261.8l-110.3-63.7a15.9 15.9 0 00-21.7 5.9l-19.9 34.5c-4.4 7.6-1.8 17.4 5.8 21.8L856.3 800a15.9 15.9 0 0021.7-5.9l19.9-34.5c4.4-7.6 1.7-17.4-5.8-21.8zM760 344a15.9 15.9 0 0021.7 5.9L892 286.2c7.6-4.4 10.2-14.2 5.8-21.8L878 230a15.9 15.9 0 00-21.7-5.9L746 287.8a15.99 15.99 0 00-5.8 21.8L760 344z"}}]},name:"sound",theme:"outlined"};var l=e.i(9583),o=n.forwardRef(function(e,o){return n.createElement(l.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["SoundOutlined",0,o],782273)},313603,e=>{"use strict";e.i(247167);var t=e.i(931067),n=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M924.8 625.7l-65.5-56c3.1-19 4.7-38.4 4.7-57.8s-1.6-38.8-4.7-57.8l65.5-56a32.03 32.03 0 009.3-35.2l-.9-2.6a443.74 443.74 0 00-79.7-137.9l-1.8-2.1a32.12 32.12 0 00-35.1-9.5l-81.3 28.9c-30-24.6-63.5-44-99.7-57.6l-15.7-85a32.05 32.05 0 00-25.8-25.7l-2.7-.5c-52.1-9.4-106.9-9.4-159 0l-2.7.5a32.05 32.05 0 00-25.8 25.7l-15.8 85.4a351.86 351.86 0 00-99 57.4l-81.9-29.1a32 32 0 00-35.1 9.5l-1.8 2.1a446.02 446.02 0 00-79.7 137.9l-.9 2.6c-4.5 12.5-.8 26.5 9.3 35.2l66.3 56.6c-3.1 18.8-4.6 38-4.6 57.1 0 19.2 1.5 38.4 4.6 57.1L99 625.5a32.03 32.03 0 00-9.3 35.2l.9 2.6c18.1 50.4 44.9 96.9 79.7 137.9l1.8 2.1a32.12 32.12 0 0035.1 9.5l81.9-29.1c29.8 24.5 63.1 43.9 99 57.4l15.8 85.4a32.05 32.05 0 0025.8 25.7l2.7.5a449.4 449.4 0 00159 0l2.7-.5a32.05 32.05 0 0025.8-25.7l15.7-85a350 350 0 0099.7-57.6l81.3 28.9a32 32 0 0035.1-9.5l1.8-2.1c34.8-41.1 61.6-87.5 79.7-137.9l.9-2.6c4.5-12.3.8-26.3-9.3-35zM788.3 465.9c2.5 15.1 3.8 30.6 3.8 46.1s-1.3 31-3.8 46.1l-6.6 40.1 74.7 63.9a370.03 370.03 0 01-42.6 73.6L721 702.8l-31.4 25.8c-23.9 19.6-50.5 35-79.3 45.8l-38.1 14.3-17.9 97a377.5 377.5 0 01-85 0l-17.9-97.2-37.8-14.5c-28.5-10.8-55-26.2-78.7-45.7l-31.4-25.9-93.4 33.2c-17-22.9-31.2-47.6-42.6-73.6l75.5-64.5-6.5-40c-2.4-14.9-3.7-30.3-3.7-45.5 0-15.3 1.2-30.6 3.7-45.5l6.5-40-75.5-64.5c11.3-26.1 25.6-50.7 42.6-73.6l93.4 33.2 31.4-25.9c23.7-19.5 50.2-34.9 78.7-45.7l37.9-14.3 17.9-97.2c28.1-3.2 56.8-3.2 85 0l17.9 97 38.1 14.3c28.7 10.8 55.4 26.2 79.3 45.8l31.4 25.8 92.8-32.9c17 22.9 31.2 47.6 42.6 73.6L781.8 426l6.5 39.9zM512 326c-97.2 0-176 78.8-176 176s78.8 176 176 176 176-78.8 176-176-78.8-176-176-176zm79.2 255.2A111.6 111.6 0 01512 614c-29.9 0-58-11.7-79.2-32.8A111.6 111.6 0 01400 502c0-29.9 11.7-58 32.8-79.2C454 401.6 482.1 390 512 390c29.9 0 58 11.6 79.2 32.8A111.6 111.6 0 01624 502c0 29.9-11.7 58-32.8 79.2z"}}]},name:"setting",theme:"outlined"};var l=e.i(9583),o=n.forwardRef(function(e,o){return n.createElement(l.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["SettingOutlined",0,o],313603)},793916,e=>{"use strict";e.i(247167);var t=e.i(931067),n=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M842 454c0-4.4-3.6-8-8-8h-60c-4.4 0-8 3.6-8 8 0 140.3-113.7 254-254 254S258 594.3 258 454c0-4.4-3.6-8-8-8h-60c-4.4 0-8 3.6-8 8 0 168.7 126.6 307.9 290 327.6V884H326.7c-13.7 0-24.7 14.3-24.7 32v36c0 4.4 2.8 8 6.2 8h407.6c3.4 0 6.2-3.6 6.2-8v-36c0-17.7-11-32-24.7-32H548V782.1c165.3-18 294-158 294-328.1zM512 624c93.9 0 170-75.2 170-168V232c0-92.8-76.1-168-170-168s-170 75.2-170 168v224c0 92.8 76.1 168 170 168zm-94-392c0-50.6 41.9-92 94-92s94 41.4 94 92v224c0 50.6-41.9 92-94 92s-94-41.4-94-92V232z"}}]},name:"audio",theme:"outlined"};var l=e.i(9583),o=n.forwardRef(function(e,o){return n.createElement(l.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["AudioOutlined",0,o],793916)},608856,e=>{"use strict";e.i(247167);var t=e.i(271645),n=e.i(343794),a=e.i(209428),l=e.i(392221),o=e.i(951160),i=e.i(174428),r=t.createContext(null),s=t.createContext({}),c=e.i(211577),u=e.i(931067),d=e.i(361275),f=e.i(404948),m=e.i(244009),v=e.i(703923),p=e.i(611935),g=["prefixCls","className","containerRef"];let h=function(e){var a=e.prefixCls,l=e.className,o=e.containerRef,i=(0,v.default)(e,g),r=t.useContext(s).panel,c=(0,p.useComposeRef)(r,o);return t.createElement("div",(0,u.default)({className:(0,n.default)("".concat(a,"-content"),l),role:"dialog",ref:c},(0,m.default)(e,{aria:!0}),{"aria-modal":"true"},i))};var b=e.i(883110);function y(e){return"string"==typeof e&&String(Number(e))===e?((0,b.default)(!1,"Invalid value type of `width` or `height` which should be number type instead."),Number(e)):e}var w={width:0,height:0,overflow:"hidden",outline:"none",position:"absolute"},x=t.forwardRef(function(e,o){var i,s,v,p=e.prefixCls,g=e.open,b=e.placement,x=e.inline,$=e.push,C=e.forceRender,O=e.autoFocus,S=e.keyboard,k=e.classNames,E=e.rootClassName,N=e.rootStyle,j=e.zIndex,R=e.className,M=e.id,z=e.style,D=e.motion,I=e.width,H=e.height,L=e.children,P=e.mask,B=e.maskClosable,A=e.maskMotion,K=e.maskClassName,T=e.maskStyle,V=e.afterOpenChange,U=e.onClose,F=e.onMouseEnter,W=e.onMouseOver,X=e.onMouseLeave,q=e.onClick,Y=e.onKeyDown,_=e.onKeyUp,G=e.styles,Z=e.drawerRender,J=t.useRef(),Q=t.useRef(),ee=t.useRef();t.useImperativeHandle(o,function(){return J.current}),t.useEffect(function(){if(g&&O){var e;null==(e=J.current)||e.focus({preventScroll:!0})}},[g]);var et=t.useState(!1),en=(0,l.default)(et,2),ea=en[0],el=en[1],eo=t.useContext(r),ei=null!=(i=null!=(s=null==(v="boolean"==typeof $?$?{}:{distance:0}:$||{})?void 0:v.distance)?s:null==eo?void 0:eo.pushDistance)?i:180,er=t.useMemo(function(){return{pushDistance:ei,push:function(){el(!0)},pull:function(){el(!1)}}},[ei]);t.useEffect(function(){var e,t;g?null==eo||null==(e=eo.push)||e.call(eo):null==eo||null==(t=eo.pull)||t.call(eo)},[g]),t.useEffect(function(){return function(){var e;null==eo||null==(e=eo.pull)||e.call(eo)}},[]);var es=t.createElement(d.default,(0,u.default)({key:"mask"},A,{visible:P&&g}),function(e,l){var o=e.className,i=e.style;return t.createElement("div",{className:(0,n.default)("".concat(p,"-mask"),o,null==k?void 0:k.mask,K),style:(0,a.default)((0,a.default)((0,a.default)({},i),T),null==G?void 0:G.mask),onClick:B&&g?U:void 0,ref:l})}),ec="function"==typeof D?D(b):D,eu={};if(ea&&ei)switch(b){case"top":eu.transform="translateY(".concat(ei,"px)");break;case"bottom":eu.transform="translateY(".concat(-ei,"px)");break;case"left":eu.transform="translateX(".concat(ei,"px)");break;default:eu.transform="translateX(".concat(-ei,"px)")}"left"===b||"right"===b?eu.width=y(I):eu.height=y(H);var ed={onMouseEnter:F,onMouseOver:W,onMouseLeave:X,onClick:q,onKeyDown:Y,onKeyUp:_},ef=t.createElement(d.default,(0,u.default)({key:"panel"},ec,{visible:g,forceRender:C,onVisibleChanged:function(e){null==V||V(e)},removeOnLeave:!1,leavedClassName:"".concat(p,"-content-wrapper-hidden")}),function(l,o){var i=l.className,r=l.style,s=t.createElement(h,(0,u.default)({id:M,containerRef:o,prefixCls:p,className:(0,n.default)(R,null==k?void 0:k.content),style:(0,a.default)((0,a.default)({},z),null==G?void 0:G.content)},(0,m.default)(e,{aria:!0}),ed),L);return t.createElement("div",(0,u.default)({className:(0,n.default)("".concat(p,"-content-wrapper"),null==k?void 0:k.wrapper,i),style:(0,a.default)((0,a.default)((0,a.default)({},eu),r),null==G?void 0:G.wrapper)},(0,m.default)(e,{data:!0})),Z?Z(s):s)}),em=(0,a.default)({},N);return j&&(em.zIndex=j),t.createElement(r.Provider,{value:er},t.createElement("div",{className:(0,n.default)(p,"".concat(p,"-").concat(b),E,(0,c.default)((0,c.default)({},"".concat(p,"-open"),g),"".concat(p,"-inline"),x)),style:em,tabIndex:-1,ref:J,onKeyDown:function(e){var t,n,a=e.keyCode,l=e.shiftKey;switch(a){case f.default.TAB:a===f.default.TAB&&(l||document.activeElement!==ee.current?l&&document.activeElement===Q.current&&(null==(n=ee.current)||n.focus({preventScroll:!0})):null==(t=Q.current)||t.focus({preventScroll:!0}));break;case f.default.ESC:U&&S&&(e.stopPropagation(),U(e))}}},es,t.createElement("div",{tabIndex:0,ref:Q,style:w,"aria-hidden":"true","data-sentinel":"start"}),ef,t.createElement("div",{tabIndex:0,ref:ee,style:w,"aria-hidden":"true","data-sentinel":"end"})))});let $=function(e){var n=e.open,r=e.prefixCls,c=e.placement,u=e.autoFocus,d=e.keyboard,f=e.width,m=e.mask,v=void 0===m||m,p=e.maskClosable,g=e.getContainer,h=e.forceRender,b=e.afterOpenChange,y=e.destroyOnClose,w=e.onMouseEnter,$=e.onMouseOver,C=e.onMouseLeave,O=e.onClick,S=e.onKeyDown,k=e.onKeyUp,E=e.panelRef,N=t.useState(!1),j=(0,l.default)(N,2),R=j[0],M=j[1],z=t.useState(!1),D=(0,l.default)(z,2),I=D[0],H=D[1];(0,i.default)(function(){H(!0)},[]);var L=!!I&&void 0!==n&&n,P=t.useRef(),B=t.useRef();(0,i.default)(function(){L&&(B.current=document.activeElement)},[L]);var A=t.useMemo(function(){return{panel:E}},[E]);if(!h&&!R&&!L&&y)return null;var K=(0,a.default)((0,a.default)({},e),{},{open:L,prefixCls:void 0===r?"rc-drawer":r,placement:void 0===c?"right":c,autoFocus:void 0===u||u,keyboard:void 0===d||d,width:void 0===f?378:f,mask:v,maskClosable:void 0===p||p,inline:!1===g,afterOpenChange:function(e){var t,n;M(e),null==b||b(e),e||!B.current||null!=(t=P.current)&&t.contains(B.current)||null==(n=B.current)||n.focus({preventScroll:!0})},ref:P},{onMouseEnter:w,onMouseOver:$,onMouseLeave:C,onClick:O,onKeyDown:S,onKeyUp:k});return t.createElement(s.Provider,{value:A},t.createElement(o.default,{open:L||h||R,autoDestroy:!1,getContainer:g,autoLock:v&&(L||R)},t.createElement(x,K)))};var C=e.i(981444),O=e.i(617206),S=e.i(122767),k=e.i(613541),E=e.i(340010),N=e.i(242064),j=e.i(922611),R=e.i(563113),M=e.i(185793);let z=e=>{var a,l,o,i;let r,{prefixCls:s,ariaId:c,title:u,footer:d,extra:f,closable:m,loading:v,onClose:p,headerStyle:g,bodyStyle:h,footerStyle:b,children:y,classNames:w,styles:x}=e,$=(0,N.useComponentConfig)("drawer");r=!1===m?void 0:void 0===m||!0===m?"start":(null==m?void 0:m.placement)==="end"?"end":"start";let C=t.useCallback(e=>t.createElement("button",{type:"button",onClick:p,className:(0,n.default)(`${s}-close`,{[`${s}-close-${r}`]:"end"===r})},e),[p,s,r]),[O,S]=(0,R.useClosable)((0,R.pickClosable)(e),(0,R.pickClosable)($),{closable:!0,closeIconRender:C});return t.createElement(t.Fragment,null,u||O?t.createElement("div",{style:Object.assign(Object.assign(Object.assign({},null==(o=$.styles)?void 0:o.header),g),null==x?void 0:x.header),className:(0,n.default)(`${s}-header`,{[`${s}-header-close-only`]:O&&!u&&!f},null==(i=$.classNames)?void 0:i.header,null==w?void 0:w.header)},t.createElement("div",{className:`${s}-header-title`},"start"===r&&S,u&&t.createElement("div",{className:`${s}-title`,id:c},u)),f&&t.createElement("div",{className:`${s}-extra`},f),"end"===r&&S):null,t.createElement("div",{className:(0,n.default)(`${s}-body`,null==w?void 0:w.body,null==(a=$.classNames)?void 0:a.body),style:Object.assign(Object.assign(Object.assign({},null==(l=$.styles)?void 0:l.body),h),null==x?void 0:x.body)},v?t.createElement(M.default,{active:!0,title:!1,paragraph:{rows:5},className:`${s}-body-skeleton`}):y),(()=>{var e,a;if(!d)return null;let l=`${s}-footer`;return t.createElement("div",{className:(0,n.default)(l,null==(e=$.classNames)?void 0:e.footer,null==w?void 0:w.footer),style:Object.assign(Object.assign(Object.assign({},null==(a=$.styles)?void 0:a.footer),b),null==x?void 0:x.footer)},d)})())};e.i(296059);var D=e.i(915654),I=e.i(183293),H=e.i(246422),L=e.i(838378);let P=(e,t)=>({"&-enter, &-appear":Object.assign(Object.assign({},e),{"&-active":t}),"&-leave":Object.assign(Object.assign({},t),{"&-active":e})}),B=(e,t)=>Object.assign({"&-enter, &-appear, &-leave":{"&-start":{transition:"none"},"&-active":{transition:`all ${t}`}}},P({opacity:e},{opacity:1})),A=(0,H.genStyleHooks)("Drawer",e=>{let t=(0,L.mergeToken)(e,{});return[(e=>{let{borderRadiusSM:t,componentCls:n,zIndexPopup:a,colorBgMask:l,colorBgElevated:o,motionDurationSlow:i,motionDurationMid:r,paddingXS:s,padding:c,paddingLG:u,fontSizeLG:d,lineHeightLG:f,lineWidth:m,lineType:v,colorSplit:p,marginXS:g,colorIcon:h,colorIconHover:b,colorBgTextHover:y,colorBgTextActive:w,colorText:x,fontWeightStrong:$,footerPaddingBlock:C,footerPaddingInline:O,calc:S}=e,k=`${n}-content-wrapper`;return{[n]:{position:"fixed",inset:0,zIndex:a,pointerEvents:"none",color:x,"&-pure":{position:"relative",background:o,display:"flex",flexDirection:"column",[`&${n}-left`]:{boxShadow:e.boxShadowDrawerLeft},[`&${n}-right`]:{boxShadow:e.boxShadowDrawerRight},[`&${n}-top`]:{boxShadow:e.boxShadowDrawerUp},[`&${n}-bottom`]:{boxShadow:e.boxShadowDrawerDown}},"&-inline":{position:"absolute"},[`${n}-mask`]:{position:"absolute",inset:0,zIndex:a,background:l,pointerEvents:"auto"},[k]:{position:"absolute",zIndex:a,maxWidth:"100vw",transition:`all ${i}`,"&-hidden":{display:"none"}},[`&-left > ${k}`]:{top:0,bottom:0,left:{_skip_check_:!0,value:0},boxShadow:e.boxShadowDrawerLeft},[`&-right > ${k}`]:{top:0,right:{_skip_check_:!0,value:0},bottom:0,boxShadow:e.boxShadowDrawerRight},[`&-top > ${k}`]:{top:0,insetInline:0,boxShadow:e.boxShadowDrawerUp},[`&-bottom > ${k}`]:{bottom:0,insetInline:0,boxShadow:e.boxShadowDrawerDown},[`${n}-content`]:{display:"flex",flexDirection:"column",width:"100%",height:"100%",overflow:"auto",background:o,pointerEvents:"auto"},[`${n}-header`]:{display:"flex",flex:0,alignItems:"center",padding:`${(0,D.unit)(c)} ${(0,D.unit)(u)}`,fontSize:d,lineHeight:f,borderBottom:`${(0,D.unit)(m)} ${v} ${p}`,"&-title":{display:"flex",flex:1,alignItems:"center",minWidth:0,minHeight:0}},[`${n}-extra`]:{flex:"none"},[`${n}-close`]:Object.assign({display:"inline-flex",width:S(d).add(s).equal(),height:S(d).add(s).equal(),borderRadius:t,justifyContent:"center",alignItems:"center",color:h,fontWeight:$,fontSize:d,fontStyle:"normal",lineHeight:1,textAlign:"center",textTransform:"none",textDecoration:"none",background:"transparent",border:0,cursor:"pointer",transition:`all ${r}`,textRendering:"auto",[`&${n}-close-end`]:{marginInlineStart:g},[`&:not(${n}-close-end)`]:{marginInlineEnd:g},"&:hover":{color:b,backgroundColor:y,textDecoration:"none"},"&:active":{backgroundColor:w}},(0,I.genFocusStyle)(e)),[`${n}-title`]:{flex:1,margin:0,fontWeight:e.fontWeightStrong,fontSize:d,lineHeight:f},[`${n}-body`]:{flex:1,minWidth:0,minHeight:0,padding:u,overflow:"auto",[`${n}-body-skeleton`]:{width:"100%",height:"100%",display:"flex",justifyContent:"center"}},[`${n}-footer`]:{flexShrink:0,padding:`${(0,D.unit)(C)} ${(0,D.unit)(O)}`,borderTop:`${(0,D.unit)(m)} ${v} ${p}`},"&-rtl":{direction:"rtl"}}}})(t),(e=>{let{componentCls:t,motionDurationSlow:n}=e;return{[t]:{[`${t}-mask-motion`]:B(0,n),[`${t}-panel-motion`]:["left","right","top","bottom"].reduce((e,t)=>{let a;return Object.assign(Object.assign({},e),{[`&-${t}`]:[B(.7,n),P({transform:(a="100%",({left:`translateX(-${a})`,right:`translateX(${a})`,top:`translateY(-${a})`,bottom:`translateY(${a})`})[t])},{transform:"none"})]})},{})}}})(t)]},e=>({zIndexPopup:e.zIndexPopupBase,footerPaddingBlock:e.paddingXS,footerPaddingInline:e.padding}));var K=function(e,t){var n={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&0>t.indexOf(a)&&(n[a]=e[a]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var l=0,a=Object.getOwnPropertySymbols(e);lt.indexOf(a[l])&&Object.prototype.propertyIsEnumerable.call(e,a[l])&&(n[a[l]]=e[a[l]]);return n};let T={distance:180},V=e=>{let{rootClassName:a,width:l,height:o,size:i="default",mask:r=!0,push:s=T,open:c,afterOpenChange:u,onClose:d,prefixCls:f,getContainer:m,panelRef:v=null,style:g,className:h,"aria-labelledby":b,visible:y,afterVisibleChange:w,maskStyle:x,drawerStyle:R,contentWrapperStyle:M,destroyOnClose:D,destroyOnHidden:I}=e,H=K(e,["rootClassName","width","height","size","mask","push","open","afterOpenChange","onClose","prefixCls","getContainer","panelRef","style","className","aria-labelledby","visible","afterVisibleChange","maskStyle","drawerStyle","contentWrapperStyle","destroyOnClose","destroyOnHidden"]),L=(0,C.default)(),P=H.title?L:void 0,{getPopupContainer:B,getPrefixCls:V,direction:U,className:F,style:W,classNames:X,styles:q}=(0,N.useComponentConfig)("drawer"),Y=V("drawer",f),[_,G,Z]=A(Y),J=void 0===m&&B?()=>B(document.body):m,Q=(0,n.default)({"no-mask":!r,[`${Y}-rtl`]:"rtl"===U},a,G,Z),ee=t.useMemo(()=>null!=l?l:"large"===i?736:378,[l,i]),et=t.useMemo(()=>null!=o?o:"large"===i?736:378,[o,i]),en={motionName:(0,k.getTransitionName)(Y,"mask-motion"),motionAppear:!0,motionEnter:!0,motionLeave:!0,motionDeadline:500},ea=(0,j.usePanelRef)(),el=(0,p.composeRef)(v,ea),[eo,ei]=(0,S.useZIndex)("Drawer",H.zIndex),{classNames:er={},styles:es={}}=H;return _(t.createElement(O.default,{form:!0,space:!0},t.createElement(E.default.Provider,{value:ei},t.createElement($,Object.assign({prefixCls:Y,onClose:d,maskMotion:en,motion:e=>({motionName:(0,k.getTransitionName)(Y,`panel-motion-${e}`),motionAppear:!0,motionEnter:!0,motionLeave:!0,motionDeadline:500})},H,{classNames:{mask:(0,n.default)(er.mask,X.mask),content:(0,n.default)(er.content,X.content),wrapper:(0,n.default)(er.wrapper,X.wrapper)},styles:{mask:Object.assign(Object.assign(Object.assign({},es.mask),x),q.mask),content:Object.assign(Object.assign(Object.assign({},es.content),R),q.content),wrapper:Object.assign(Object.assign(Object.assign({},es.wrapper),M),q.wrapper)},open:null!=c?c:y,mask:r,push:s,width:ee,height:et,style:Object.assign(Object.assign({},W),g),className:(0,n.default)(F,h),rootClassName:Q,getContainer:J,afterOpenChange:null!=u?u:w,panelRef:el,zIndex:eo,"aria-labelledby":null!=b?b:P,destroyOnClose:null!=I?I:D}),t.createElement(z,Object.assign({prefixCls:Y},H,{ariaId:P,onClose:d}))))))};V._InternalPanelDoNotUseOrYouWillBeFired=e=>{let{prefixCls:a,style:l,className:o,placement:i="right"}=e,r=K(e,["prefixCls","style","className","placement"]),{getPrefixCls:s}=t.useContext(N.ConfigContext),c=s("drawer",a),[u,d,f]=A(c),m=(0,n.default)(c,`${c}-pure`,`${c}-${i}`,d,f,o);return u(t.createElement("div",{className:m,style:l},t.createElement(z,Object.assign({prefixCls:c},r))))},e.s(["Drawer",0,V],608856)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/01wjkyxc6hqho.js b/litellm/proxy/_experimental/out/_next/static/chunks/01wjkyxc6hqho.js deleted file mode 100644 index 0c6112b4cc7..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/01wjkyxc6hqho.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,94629,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M7 16V4m0 0L3 8m4-4l4 4m6 0v12m0 0l4-4m-4 4l-4-4"}))});e.s(["SwitchVerticalIcon",0,r],94629)},728889,e=>{"use strict";var t=e.i(290571),r=e.i(271645),l=e.i(829087),a=e.i(480731),s=e.i(444755),i=e.i(673706),o=e.i(95779);let n={xs:{paddingX:"px-1.5",paddingY:"py-1.5"},sm:{paddingX:"px-1.5",paddingY:"py-1.5"},md:{paddingX:"px-2",paddingY:"py-2"},lg:{paddingX:"px-2",paddingY:"py-2"},xl:{paddingX:"px-2.5",paddingY:"py-2.5"}},d={xs:{height:"h-3",width:"w-3"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-7",width:"w-7"},xl:{height:"h-9",width:"w-9"}},c={simple:{rounded:"",border:"",ring:"",shadow:""},light:{rounded:"rounded-tremor-default",border:"",ring:"",shadow:""},shadow:{rounded:"rounded-tremor-default",border:"border",ring:"",shadow:"shadow-tremor-card dark:shadow-dark-tremor-card"},solid:{rounded:"rounded-tremor-default",border:"border-2",ring:"ring-1",shadow:""},outlined:{rounded:"rounded-tremor-default",border:"border",ring:"ring-2",shadow:""}},m=(0,i.makeClassName)("Icon"),u=r.default.forwardRef((e,u)=>{let{icon:g,variant:x="simple",tooltip:h,size:p=a.Sizes.SM,color:b,className:f}=e,j=(0,t.__rest)(e,["icon","variant","tooltip","size","color","className"]),w=((e,t)=>{switch(e){case"simple":return{textColor:t?(0,i.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:"",borderColor:"",ringColor:""};case"light":return{textColor:t?(0,i.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,s.tremorTwMerge)((0,i.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand-muted dark:bg-dark-tremor-brand-muted",borderColor:"",ringColor:""};case"shadow":return{textColor:t?(0,i.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,s.tremorTwMerge)((0,i.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:"border-tremor-border dark:border-dark-tremor-border",ringColor:""};case"solid":return{textColor:t?(0,i.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:t?(0,s.tremorTwMerge)((0,i.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand dark:bg-dark-tremor-brand",borderColor:"border-tremor-brand-inverted dark:border-dark-tremor-brand-inverted",ringColor:"ring-tremor-ring dark:ring-dark-tremor-ring"};case"outlined":return{textColor:t?(0,i.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,s.tremorTwMerge)((0,i.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:t?(0,i.getColorClassNames)(t,o.colorPalette.ring).borderColor:"border-tremor-brand-subtle dark:border-dark-tremor-brand-subtle",ringColor:t?(0,s.tremorTwMerge)((0,i.getColorClassNames)(t,o.colorPalette.ring).ringColor,"ring-opacity-40"):"ring-tremor-brand-muted dark:ring-dark-tremor-brand-muted"}}})(x,b),{tooltipProps:v,getReferenceProps:C}=(0,l.useTooltip)();return r.default.createElement("span",Object.assign({ref:(0,i.mergeRefs)([u,v.refs.setReference]),className:(0,s.tremorTwMerge)(m("root"),"inline-flex shrink-0 items-center justify-center",w.bgColor,w.textColor,w.borderColor,w.ringColor,c[x].rounded,c[x].border,c[x].shadow,c[x].ring,n[p].paddingX,n[p].paddingY,f)},C,j),r.default.createElement(l.default,Object.assign({text:h},v)),r.default.createElement(g,{className:(0,s.tremorTwMerge)(m("icon"),"shrink-0",d[p].height,d[p].width)}))});u.displayName="Icon",e.s(["default",0,u],728889)},752978,e=>{"use strict";var t=e.i(728889);e.s(["Icon",()=>t.default])},591935,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"}))});e.s(["PencilAltIcon",0,r],591935)},871943,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 9l-7 7-7-7"}))});e.s(["ChevronDownIcon",0,r],871943)},360820,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M5 15l7-7 7 7"}))});e.s(["ChevronUpIcon",0,r],360820)},269200,e=>{"use strict";var t=e.i(290571),r=e.i(271645),l=e.i(444755);let a=(0,e.i(673706).makeClassName)("Table"),s=r.default.forwardRef((e,s)=>{let{children:i,className:o}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement("div",{className:(0,l.tremorTwMerge)(a("root"),"overflow-auto",o)},r.default.createElement("table",Object.assign({ref:s,className:(0,l.tremorTwMerge)(a("table"),"w-full text-tremor-default","text-tremor-content","dark:text-dark-tremor-content")},n),i))});s.displayName="Table",e.s(["Table",0,s],269200)},427612,e=>{"use strict";var t=e.i(290571),r=e.i(271645),l=e.i(444755);let a=(0,e.i(673706).makeClassName)("TableHead"),s=r.default.forwardRef((e,s)=>{let{children:i,className:o}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("thead",Object.assign({ref:s,className:(0,l.tremorTwMerge)(a("root"),"text-left","text-tremor-content","dark:text-dark-tremor-content",o)},n),i))});s.displayName="TableHead",e.s(["TableHead",0,s],427612)},64848,e=>{"use strict";var t=e.i(290571),r=e.i(271645),l=e.i(444755);let a=(0,e.i(673706).makeClassName)("TableHeaderCell"),s=r.default.forwardRef((e,s)=>{let{children:i,className:o}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("th",Object.assign({ref:s,className:(0,l.tremorTwMerge)(a("root"),"whitespace-nowrap text-left font-semibold top-0 px-4 py-3.5","text-tremor-content-strong","dark:text-dark-tremor-content-strong",o)},n),i))});s.displayName="TableHeaderCell",e.s(["TableHeaderCell",0,s],64848)},942232,e=>{"use strict";var t=e.i(290571),r=e.i(271645),l=e.i(444755);let a=(0,e.i(673706).makeClassName)("TableBody"),s=r.default.forwardRef((e,s)=>{let{children:i,className:o}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("tbody",Object.assign({ref:s,className:(0,l.tremorTwMerge)(a("root"),"align-top divide-y","divide-tremor-border","dark:divide-dark-tremor-border",o)},n),i))});s.displayName="TableBody",e.s(["TableBody",0,s],942232)},496020,e=>{"use strict";var t=e.i(290571),r=e.i(271645),l=e.i(444755);let a=(0,e.i(673706).makeClassName)("TableRow"),s=r.default.forwardRef((e,s)=>{let{children:i,className:o}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("tr",Object.assign({ref:s,className:(0,l.tremorTwMerge)(a("row"),o)},n),i))});s.displayName="TableRow",e.s(["TableRow",0,s],496020)},977572,e=>{"use strict";var t=e.i(290571),r=e.i(271645),l=e.i(444755);let a=(0,e.i(673706).makeClassName)("TableCell"),s=r.default.forwardRef((e,s)=>{let{children:i,className:o}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("td",Object.assign({ref:s,className:(0,l.tremorTwMerge)(a("root"),"align-middle whitespace-nowrap text-left p-4",o)},n),i))});s.displayName="TableCell",e.s(["TableCell",0,s],977572)},68155,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"}))});e.s(["TrashIcon",0,r],68155)},278587,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"}))});e.s(["RefreshIcon",0,r],278587)},250980,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M12 9v3m0 0v3m0-3h3m-3 0H9m12 0a9 9 0 11-18 0 9 9 0 0118 0z"}))});e.s(["PlusCircleIcon",0,r],250980)},991124,e=>{"use strict";let t=(0,e.i(475254).default)("copy",[["rect",{width:"14",height:"14",x:"8",y:"8",rx:"2",ry:"2",key:"17jyea"}],["path",{d:"M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2",key:"zix9uf"}]]);e.s(["default",0,t])},678745,e=>{"use strict";let t=(0,e.i(475254).default)("check",[["path",{d:"M20 6 9 17l-5-5",key:"1gmf2c"}]]);e.s(["default",0,t])},678784,e=>{"use strict";var t=e.i(678745);e.s(["CheckIcon",()=>t.default])},118366,e=>{"use strict";var t=e.i(991124);e.s(["CopyIcon",()=>t.default])},601757,e=>{"use strict";var t=e.i(843476),r=e.i(271645),l=e.i(752978),a=e.i(994388),s=e.i(309426),i=e.i(599724),o=e.i(350967),n=e.i(278587),d=e.i(304967),c=e.i(629569),m=e.i(389083),u=e.i(677667),g=e.i(898667),x=e.i(130643),h=e.i(808613),p=e.i(311451),b=e.i(199133),f=e.i(592968),j=e.i(827252),w=e.i(702597),v=e.i(355619),C=e.i(602869),N=e.i(727749),y=e.i(435451),T=e.i(860585),k=e.i(500330),_=e.i(678784),I=e.i(118366),M=e.i(464571);let E=({tagId:e,onClose:l,accessToken:s,is_admin:o,editTag:n})=>{let[E]=h.Form.useForm(),[S,B]=(0,r.useState)(null),[R,L]=(0,r.useState)(n),[D,F]=(0,r.useState)([]),[A,P]=(0,r.useState)({}),O=async(e,t)=>{await (0,k.copyToClipboard)(e)&&(P(e=>({...e,[t]:!0})),setTimeout(()=>{P(e=>({...e,[t]:!1}))},2e3))},H=async()=>{if(s)try{let t=(await (0,C.tagInfoCall)(s,[e]))[e];t&&(B(t),n&&E.setFieldsValue({name:t.name,description:t.description,models:t.models,max_budget:t.litellm_budget_table?.max_budget,budget_duration:t.litellm_budget_table?.budget_duration}))}catch(e){console.error("Error fetching tag details:",e),N.default.fromBackend("Error fetching tag details: "+e)}};(0,r.useEffect)(()=>{H()},[e,s]),(0,r.useEffect)(()=>{s&&(0,w.fetchUserModels)("dummy-user","Admin",s,F)},[s]);let z=async e=>{if(s)try{await (0,C.tagUpdateCall)(s,{name:e.name,description:e.description,models:e.models,max_budget:e.max_budget,tpm_limit:e.tpm_limit,rpm_limit:e.rpm_limit,budget_duration:e.budget_duration}),N.default.success("Tag updated successfully"),L(!1),H()}catch(e){console.error("Error updating tag:",e),N.default.fromBackend("Error updating tag: "+e)}};return S?(0,t.jsxs)("div",{className:"p-4",children:[(0,t.jsxs)("div",{className:"flex justify-between items-center mb-6",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(a.Button,{onClick:l,className:"mb-4",children:"← Back to Tags"}),(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(i.Text,{className:"font-medium",children:"Tag Name:"}),(0,t.jsx)("span",{className:"font-mono px-2 py-1 bg-gray-100 rounded-sm text-sm border border-gray-200",children:S.name}),(0,t.jsx)(M.Button,{type:"text",size:"small",icon:A["tag-name"]?(0,t.jsx)(_.CheckIcon,{size:12}):(0,t.jsx)(I.CopyIcon,{size:12}),onClick:()=>O(S.name,"tag-name"),className:`transition-all duration-200 ${A["tag-name"]?"text-green-600 bg-green-50 border-green-200":"text-gray-500 hover:text-gray-700 hover:bg-gray-100"}`})]}),(0,t.jsx)(i.Text,{className:"text-gray-500",children:S.description||"No description"})]}),o&&!R&&(0,t.jsx)(a.Button,{onClick:()=>L(!0),children:"Edit Tag"})]}),R?(0,t.jsx)(d.Card,{children:(0,t.jsxs)(h.Form,{form:E,onFinish:z,layout:"vertical",initialValues:S,children:[(0,t.jsx)(h.Form.Item,{label:"Tag Name",name:"name",rules:[{required:!0,message:"Please input a tag name"}],children:(0,t.jsx)(p.Input,{className:"rounded-md border-gray-300"})}),(0,t.jsx)(h.Form.Item,{label:"Description",name:"description",children:(0,t.jsx)(p.Input.TextArea,{rows:4})}),(0,t.jsx)(h.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Models",(0,t.jsx)(f.Tooltip,{title:"Select which models are allowed to process this type of data",children:(0,t.jsx)(j.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"models",children:(0,t.jsx)(b.Select,{mode:"multiple",placeholder:"Select Models",children:D.map(e=>(0,t.jsx)(b.Select.Option,{value:e,children:(0,v.getModelDisplayName)(e)},e))})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsx)(c.Title,{className:"m-0",children:"Budget & Rate Limits"})}),(0,t.jsxs)(x.AccordionBody,{children:[(0,t.jsx)(h.Form.Item,{label:(0,t.jsxs)("span",{children:["Max Budget (USD)"," ",(0,t.jsx)(f.Tooltip,{title:"Maximum amount in USD this tag can spend",children:(0,t.jsx)(j.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"max_budget",children:(0,t.jsx)(y.default,{step:.01,precision:2,width:200})}),(0,t.jsx)(h.Form.Item,{label:(0,t.jsxs)("span",{children:["Reset Budget"," ",(0,t.jsx)(f.Tooltip,{title:"How often the budget should reset",children:(0,t.jsx)(j.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"budget_duration",children:(0,t.jsx)(T.default,{onChange:e=>E.setFieldValue("budget_duration",e)})}),(0,t.jsx)("div",{className:"mt-4 p-3 bg-gray-50 rounded-md border border-gray-200",children:(0,t.jsxs)("p",{className:"text-sm text-gray-600",children:["TPM/RPM limits for tags are not currently supported. If you need this feature, please"," ",(0,t.jsx)("a",{href:"https://github.com/BerriAI/litellm/issues/new",target:"_blank",rel:"noopener noreferrer",className:"text-blue-600 hover:text-blue-800 underline",children:"create a GitHub issue"}),"."]})})]})]}),(0,t.jsxs)("div",{className:"flex justify-end space-x-2",children:[(0,t.jsx)(a.Button,{onClick:()=>L(!1),children:"Cancel"}),(0,t.jsx)(a.Button,{type:"submit",children:"Save Changes"})]})]})}):(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)(d.Card,{children:[(0,t.jsx)(c.Title,{children:"Tag Details"}),(0,t.jsxs)("div",{className:"space-y-4 mt-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(i.Text,{className:"font-medium",children:"Name"}),(0,t.jsx)(i.Text,{children:S.name})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(i.Text,{className:"font-medium",children:"Description"}),(0,t.jsx)(i.Text,{children:S.description||"-"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(i.Text,{className:"font-medium",children:"Allowed Models"}),(0,t.jsx)("div",{className:"flex flex-wrap gap-2 mt-2",children:S.models&&0!==S.models.length?S.models.map(e=>(0,t.jsx)(m.Badge,{color:"blue",children:(0,t.jsx)(f.Tooltip,{title:`ID: ${e}`,children:S.model_info?.[e]||e})},e)):(0,t.jsx)(m.Badge,{color:"red",children:"All Models"})})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(i.Text,{className:"font-medium",children:"Created"}),(0,t.jsx)(i.Text,{children:S.created_at?new Date(S.created_at).toLocaleString():"-"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(i.Text,{className:"font-medium",children:"Last Updated"}),(0,t.jsx)(i.Text,{children:S.updated_at?new Date(S.updated_at).toLocaleString():"-"})]})]})]}),S.litellm_budget_table&&(0,t.jsxs)(d.Card,{children:[(0,t.jsx)(c.Title,{children:"Budget & Rate Limits"}),(0,t.jsxs)("div",{className:"space-y-4 mt-4",children:[void 0!==S.litellm_budget_table.max_budget&&null!==S.litellm_budget_table.max_budget&&(0,t.jsxs)("div",{children:[(0,t.jsx)(i.Text,{className:"font-medium",children:"Max Budget"}),(0,t.jsxs)(i.Text,{children:["$",S.litellm_budget_table.max_budget]})]}),S.litellm_budget_table.budget_duration&&(0,t.jsxs)("div",{children:[(0,t.jsx)(i.Text,{className:"font-medium",children:"Budget Duration"}),(0,t.jsx)(i.Text,{children:S.litellm_budget_table.budget_duration})]}),void 0!==S.litellm_budget_table.tpm_limit&&null!==S.litellm_budget_table.tpm_limit&&(0,t.jsxs)("div",{children:[(0,t.jsx)(i.Text,{className:"font-medium",children:"TPM Limit"}),(0,t.jsx)(i.Text,{children:S.litellm_budget_table.tpm_limit.toLocaleString()})]}),void 0!==S.litellm_budget_table.rpm_limit&&null!==S.litellm_budget_table.rpm_limit&&(0,t.jsxs)("div",{children:[(0,t.jsx)(i.Text,{className:"font-medium",children:"RPM Limit"}),(0,t.jsx)(i.Text,{children:S.litellm_budget_table.rpm_limit.toLocaleString()})]})]})]})]})]}):(0,t.jsx)("div",{children:"Loading..."})};var S=e.i(871943),B=e.i(360820),R=e.i(591935),L=e.i(94629),D=e.i(68155),F=e.i(152990),A=e.i(682830),P=e.i(269200),O=e.i(942232),H=e.i(977572),z=e.i(427612),U=e.i(64848),V=e.i(496020);let W="This is just a spend tag that was passed dynamically in a request. It does not control any LLM models.",Y=({data:e,onEdit:s,onDelete:o,onSelectTag:n})=>{let[d,c]=r.default.useState([{id:"created_at",desc:!0}]),u=[{header:"Tag Name",accessorKey:"name",cell:({row:e})=>{let r=e.original,l=r.description===W;return(0,t.jsx)("div",{className:"overflow-hidden",children:(0,t.jsx)(f.Tooltip,{title:l?"You cannot view the information of a dynamically generated spend tag":r.name,children:(0,t.jsx)(a.Button,{size:"xs",variant:"light",className:"font-mono text-blue-500 bg-blue-50 hover:bg-blue-100 text-xs font-normal px-2 py-0.5",onClick:()=>n(r.name),disabled:l,children:r.name})})})}},{header:"Description",accessorKey:"description",cell:({row:e})=>{let r=e.original;return(0,t.jsx)(f.Tooltip,{title:r.description,children:(0,t.jsx)("span",{className:"text-xs",children:r.description||"-"})})}},{header:"Allowed Models",accessorKey:"models",cell:({row:e})=>{let r=e.original;return(0,t.jsx)("div",{style:{display:"flex",flexDirection:"column"},children:r?.models?.length===0?(0,t.jsx)(m.Badge,{size:"xs",className:"mb-1",color:"red",children:"All Models"}):r?.models?.map(e=>(0,t.jsx)(m.Badge,{size:"xs",className:"mb-1",color:"blue",children:(0,t.jsx)(f.Tooltip,{title:`ID: ${e}`,children:(0,t.jsx)(i.Text,{children:r.model_info?.[e]||e})})},e))})}},{header:"Created",accessorKey:"created_at",sortingFn:"datetime",cell:({row:e})=>{let r=e.original;return(0,t.jsx)("span",{className:"text-xs",children:new Date(r.created_at).toLocaleDateString()})}},{id:"actions",header:"Actions",cell:({row:e})=>{let r=e.original,a=r.description===W;return(0,t.jsxs)("div",{className:"flex space-x-2",children:[a?(0,t.jsx)(f.Tooltip,{title:"Dynamically generated spend tags cannot be edited",children:(0,t.jsx)(l.Icon,{icon:R.PencilAltIcon,size:"sm",className:"opacity-50 cursor-not-allowed","aria-label":"Edit tag (disabled)"})}):(0,t.jsx)(f.Tooltip,{title:"Edit tag",children:(0,t.jsx)(l.Icon,{icon:R.PencilAltIcon,size:"sm",onClick:()=>s(r),className:"cursor-pointer hover:text-blue-500"})}),a?(0,t.jsx)(f.Tooltip,{title:"Dynamically generated spend tags cannot be deleted",children:(0,t.jsx)(l.Icon,{icon:D.TrashIcon,size:"sm",className:"opacity-50 cursor-not-allowed","aria-label":"Delete tag (disabled)"})}):(0,t.jsx)(f.Tooltip,{title:"Delete tag",children:(0,t.jsx)(l.Icon,{icon:D.TrashIcon,size:"sm",onClick:()=>o(r.name),className:"cursor-pointer hover:text-red-500"})})]})}}],g=(0,F.useReactTable)({data:e,columns:u,state:{sorting:d},onSortingChange:c,getCoreRowModel:(0,A.getCoreRowModel)(),getSortedRowModel:(0,A.getSortedRowModel)(),enableSorting:!0});return(0,t.jsx)("div",{className:"rounded-lg custom-border relative",children:(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(P.Table,{className:"[&_td]:py-0.5 [&_th]:py-1",children:[(0,t.jsx)(z.TableHead,{children:g.getHeaderGroups().map(e=>(0,t.jsx)(V.TableRow,{children:e.headers.map(e=>(0,t.jsx)(U.TableHeaderCell,{className:`py-1 h-8 ${"actions"===e.id?"sticky right-0 bg-white shadow-[-4px_0_8px_-6px_rgba(0,0,0,0.1)]":""}`,onClick:e.column.getToggleSortingHandler(),children:(0,t.jsxs)("div",{className:"flex items-center justify-between gap-2",children:[(0,t.jsx)("div",{className:"flex items-center",children:e.isPlaceholder?null:(0,F.flexRender)(e.column.columnDef.header,e.getContext())}),"actions"!==e.id&&(0,t.jsx)("div",{className:"w-4",children:e.column.getIsSorted()?({asc:(0,t.jsx)(B.ChevronUpIcon,{className:"h-4 w-4 text-blue-500"}),desc:(0,t.jsx)(S.ChevronDownIcon,{className:"h-4 w-4 text-blue-500"})})[e.column.getIsSorted()]:(0,t.jsx)(L.SwitchVerticalIcon,{className:"h-4 w-4 text-gray-400"})})]})},e.id))},e.id))}),(0,t.jsx)(O.TableBody,{children:g.getRowModel().rows.length>0?g.getRowModel().rows.map(e=>(0,t.jsx)(V.TableRow,{className:"h-8",children:e.getVisibleCells().map(e=>(0,t.jsx)(H.TableCell,{className:`py-0.5 max-h-8 overflow-hidden text-ellipsis whitespace-nowrap ${"actions"===e.column.id?"sticky right-0 bg-white shadow-[-4px_0_8px_-6px_rgba(0,0,0,0.1)]":""}`,children:(0,F.flexRender)(e.column.columnDef.cell,e.getContext())},e.id))},e.id)):(0,t.jsx)(V.TableRow,{children:(0,t.jsx)(H.TableCell,{colSpan:u.length,className:"h-8 text-center",children:(0,t.jsx)("div",{className:"text-center text-gray-500",children:(0,t.jsx)("p",{children:"No tags found"})})})})})]})})})};var q=e.i(779241),K=e.i(212931);let X=({visible:e,onCancel:r,onSubmit:l,availableModels:s})=>{let[i]=h.Form.useForm();return(0,t.jsx)(K.Modal,{title:"Create New Tag",open:e,width:800,footer:null,onCancel:()=>{i.resetFields(),r()},children:(0,t.jsxs)(h.Form,{form:i,onFinish:e=>{l(e),i.resetFields()},labelCol:{span:8},wrapperCol:{span:16},labelAlign:"left",children:[(0,t.jsx)(h.Form.Item,{label:"Tag Name",name:"tag_name",rules:[{required:!0,message:"Please input a tag name"}],children:(0,t.jsx)(q.TextInput,{})}),(0,t.jsx)(h.Form.Item,{label:"Description",name:"description",children:(0,t.jsx)(p.Input.TextArea,{rows:4})}),(0,t.jsx)(h.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Models",(0,t.jsx)(f.Tooltip,{title:"Select which models are allowed to process requests from this tag",children:(0,t.jsx)(j.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_llms",children:(0,t.jsx)(b.Select,{mode:"multiple",placeholder:"Select Models",children:s.map(e=>(0,t.jsx)(b.Select.Option,{value:e.model_info.id,children:(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{children:e.model_name}),(0,t.jsxs)("span",{className:"text-gray-400 ml-2",children:["(",e.model_info.id,")"]})]})},e.model_info.id))})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(g.AccordionHeader,{children:(0,t.jsx)(c.Title,{className:"m-0",children:"Budget & Rate Limits (Optional)"})}),(0,t.jsxs)(x.AccordionBody,{children:[(0,t.jsx)(h.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Max Budget (USD)"," ",(0,t.jsx)(f.Tooltip,{title:"Maximum amount in USD this tag can spend. When reached, requests with this tag will be blocked",children:(0,t.jsx)(j.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"max_budget",children:(0,t.jsx)(y.default,{step:.01,precision:2,width:200})}),(0,t.jsx)(h.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Reset Budget"," ",(0,t.jsx)(f.Tooltip,{title:"How often the budget should reset. For example, setting 'daily' will reset the budget every 24 hours",children:(0,t.jsx)(j.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"budget_duration",children:(0,t.jsx)(T.default,{onChange:e=>i.setFieldValue("budget_duration",e)})}),(0,t.jsx)("div",{className:"mt-4 p-3 bg-gray-50 rounded-md border border-gray-200",children:(0,t.jsxs)("p",{className:"text-sm text-gray-600",children:["TPM/RPM limits for tags are not currently supported. If you need this feature, please"," ",(0,t.jsx)("a",{href:"https://github.com/BerriAI/litellm/issues/new",target:"_blank",rel:"noopener noreferrer",className:"text-blue-600 hover:text-blue-800 underline",children:"create a GitHub issue"}),"."]})})]})]}),(0,t.jsx)("div",{style:{textAlign:"right",marginTop:"10px"},children:(0,t.jsx)(a.Button,{type:"submit",children:"Create Tag"})})]})})},$=({accessToken:e,userID:d,userRole:c})=>{let[m,u]=(0,r.useState)([]),[g,x]=(0,r.useState)(!1),[h,p]=(0,r.useState)(null),[b,f]=(0,r.useState)(!1),[j,w]=(0,r.useState)(!1),[v,y]=(0,r.useState)(null),[T,k]=(0,r.useState)(""),[_,I]=(0,r.useState)([]),M=async()=>{if(e)try{let t=await (0,C.tagListCall)(e);u(Object.values(t))}catch(e){console.error("Error fetching tags:",e),N.default.fromBackend("Error fetching tags: "+e)}},S=async t=>{if(e)try{await (0,C.tagCreateCall)(e,{name:t.tag_name,description:t.description,models:t.allowed_llms,max_budget:t.max_budget,soft_budget:t.soft_budget,tpm_limit:t.tpm_limit,rpm_limit:t.rpm_limit,budget_duration:t.budget_duration}),N.default.success("Tag created successfully"),x(!1),M()}catch(e){console.error("Error creating tag:",e),N.default.fromBackend("Error creating tag: "+e)}},B=async e=>{y(e),w(!0)},R=async()=>{if(e&&v){try{await (0,C.tagDeleteCall)(e,v),N.default.success("Tag deleted successfully"),M()}catch(e){console.error("Error deleting tag:",e),N.default.fromBackend("Error deleting tag: "+e)}w(!1),y(null)}};return(0,r.useEffect)(()=>{d&&c&&e&&(async()=>{try{let t=await (0,C.modelInfoCall)(e,d,c);t&&t.data&&I(t.data)}catch(e){console.error("Error fetching models:",e),N.default.fromBackend("Error fetching models: "+e)}})()},[e,d,c]),(0,r.useEffect)(()=>{M()},[e]),(0,t.jsx)("div",{className:"w-full mx-4 h-[75vh]",children:h?(0,t.jsx)(E,{tagId:h,onClose:()=>{p(null),f(!1)},accessToken:e,is_admin:"Admin"===c,editTag:b}):(0,t.jsxs)("div",{className:"gap-2 p-8 h-[75vh] w-full mt-2",children:[(0,t.jsxs)("div",{className:"flex justify-between mt-2 w-full items-center mb-4",children:[(0,t.jsx)("h1",{children:"Tag Management"}),(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[T&&(0,t.jsxs)(i.Text,{children:["Last Refreshed: ",T]}),(0,t.jsx)(l.Icon,{icon:n.RefreshIcon,variant:"shadow",size:"xs",className:"self-center cursor-pointer",onClick:()=>{M(),k(new Date().toLocaleString())}})]})]}),(0,t.jsxs)(i.Text,{className:"mb-4",children:["Click on a tag name to view and edit its details.",(0,t.jsxs)("p",{children:["You can use tags to restrict the usage of certain LLMs based on tags passed in the request. Read more about tag routing"," ",(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/tag_routing",target:"_blank",rel:"noopener noreferrer",children:"here"}),"."]})]}),(0,t.jsx)(a.Button,{className:"mb-4",onClick:()=>x(!0),children:"+ Create New Tag"}),(0,t.jsx)(o.Grid,{numItems:1,className:"gap-2 pt-2 pb-2 h-[75vh] w-full mt-2",children:(0,t.jsx)(s.Col,{numColSpan:1,children:(0,t.jsx)(Y,{data:m,onEdit:e=>{p(e.name),f(!0)},onDelete:B,onSelectTag:p})})}),(0,t.jsx)(X,{visible:g,onCancel:()=>x(!1),onSubmit:S,availableModels:_}),j&&(0,t.jsx)("div",{className:"fixed z-10 inset-0 overflow-y-auto",children:(0,t.jsxs)("div",{className:"flex items-end justify-center min-h-screen pt-4 px-4 pb-20 text-center sm:block sm:p-0",children:[(0,t.jsx)("div",{className:"fixed inset-0 transition-opacity","aria-hidden":"true",children:(0,t.jsx)("div",{className:"absolute inset-0 bg-gray-500 opacity-75"})}),(0,t.jsxs)("div",{className:"inline-block align-bottom bg-white rounded-lg text-left overflow-hidden shadow-xl transform transition-all sm:my-8 sm:align-middle sm:max-w-lg sm:w-full",children:[(0,t.jsx)("div",{className:"bg-white px-4 pt-5 pb-4 sm:p-6 sm:pb-4",children:(0,t.jsx)("div",{className:"sm:flex sm:items-start",children:(0,t.jsxs)("div",{className:"mt-3 text-center sm:mt-0 sm:ml-4 sm:text-left",children:[(0,t.jsx)("h3",{className:"text-lg leading-6 font-medium text-gray-900",children:"Delete Tag"}),(0,t.jsx)("div",{className:"mt-2",children:(0,t.jsx)("p",{className:"text-sm text-gray-500",children:"Are you sure you want to delete this tag?"})})]})})}),(0,t.jsxs)("div",{className:"bg-gray-50 px-4 py-3 sm:px-6 sm:flex sm:flex-row-reverse",children:[(0,t.jsx)(a.Button,{onClick:R,color:"red",className:"ml-2",children:"Delete"}),(0,t.jsx)(a.Button,{onClick:()=>{w(!1),y(null)},children:"Cancel"})]})]})]})})]})})};var G=e.i(135214);e.s(["default",0,function(){let{accessToken:e,userRole:r,userId:l}=(0,G.default)();return(0,t.jsx)($,{accessToken:e,userRole:r,userID:l})}],601757)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/01y._o853f7le.js b/litellm/proxy/_experimental/out/_next/static/chunks/01y._o853f7le.js deleted file mode 100644 index cf74c1c9c1f..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/01y._o853f7le.js +++ /dev/null @@ -1,4 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,783222,433336,80758,402155,368578,544508,746725,835696,941444,914189,394487,e=>{"use strict";let t;e.i(247167);let r=e=>e?.ownerDocument??document,n=e=>e&&"window"in e&&e.window===e?e:r(e).defaultView||window;function o(e,t){return!!t&&!!e&&e.contains(t)}function s(e){return e.target}let a=null;"u">typeof Element&&Element.prototype;let i=["input:not([disabled]):not([type=hidden])","select:not([disabled])","textarea:not([disabled])","button:not([disabled])","a[href]","area[href]","summary","iframe","object","embed","audio[controls]","video[controls]",'[contenteditable]:not([contenteditable^="false"])',"permission"];i.join(":not([hidden]),"),i.push('[tabindex]:not([tabindex="-1"]):not([disabled])'),i.join(':not([hidden]):not([tabindex="-1"]),');var l=e.i(271645);let u="u">typeof document?l.default.useLayoutEffect:()=>{};function c(e){return e.nativeEvent=e,e.isDefaultPrevented=()=>e.defaultPrevented,e.isPropagationStopped=()=>e.cancelBubble,e.persist=()=>{},e}function d(e){let t=(0,l.useRef)({isFocused:!1,observer:null});return u(()=>{let e=t.current;return()=>{e.observer&&(e.observer.disconnect(),e.observer=null)}},[]),(0,l.useCallback)(r=>{let n=s(r);(n instanceof HTMLButtonElement||n instanceof HTMLInputElement||n instanceof HTMLTextAreaElement||n instanceof HTMLSelectElement)&&(t.current.isFocused=!0,n.addEventListener("focusout",r=>{if(t.current.isFocused=!1,n.disabled){let t=c(r);e?.(t)}t.current.observer&&(t.current.observer.disconnect(),t.current.observer=null)},{once:!0}),t.current.observer=new MutationObserver(()=>{if(t.current.isFocused&&n.disabled){t.current.observer?.disconnect();let e=n===((e=document)=>e.activeElement)()?null:((e=document)=>e.activeElement)();n.dispatchEvent(new FocusEvent("blur",{relatedTarget:e})),n.dispatchEvent(new FocusEvent("focusout",{bubbles:!0,relatedTarget:e}))}}),t.current.observer.observe(n,{attributes:!0,attributeFilter:["disabled"]}))},[e])}function f(e){if("u"e.test(t.brand))||e.test(window.navigator.userAgent)}function p(e){return"u">typeof window&&null!=window.navigator&&e.test(window.navigator.userAgentData?.platform||window.navigator.platform)}function m(e){let t=null;return()=>(null==t&&(t=e()),t)}let b=m(function(){return p(/^Mac/i)}),v=m(function(){return p(/^iPhone/i)}),h=m(function(){return p(/^iPad/i)||b()&&navigator.maxTouchPoints>1}),g=m(function(){return v()||h()});m(function(){return b()||g()});let y=m(function(){return f(/AppleWebKit/i)&&!E()}),E=m(function(){return f(/Chrome/i)}),T=m(function(){return f(/Android/i)}),w=m(function(){return f(/Firefox/i)});function x(e,t,r=!0){let{metaKey:n,ctrlKey:o,altKey:s,shiftKey:i}=t;w()&&window.event?.type?.startsWith("key")&&"_blank"===e.target&&(b()?n=!0:o=!0);let l=y()&&b()&&!h()&&1?new KeyboardEvent("keydown",{keyIdentifier:"Enter",metaKey:n,ctrlKey:o,altKey:s,shiftKey:i}):new MouseEvent("click",{metaKey:n,ctrlKey:o,altKey:s,shiftKey:i,detail:1,bubbles:!0,cancelable:!0});x.isOpening=r;if(function(){if(null==a){a=!1;try{document.createElement("div").focus({get preventScroll(){return a=!0,!0}})}catch{}}return a}())e.focus({preventScroll:!0});else{let t=function(e){let t=e.parentNode,r=[],n=document.scrollingElement||document.documentElement;for(;t instanceof HTMLElement&&t!==n;)(t.offsetHeighttypeof window&&window.document&&window.document.createElement,new WeakMap;l.default.useId;let P=null,k=new Set,L=new Map,N=!1,C=!1,I={Tab:!0,Escape:!0};function S(e,t){for(let r of k)r(e,t)}function A(e){N=!0,x.isOpening||e.metaKey||!b()&&e.altKey||e.ctrlKey||"Control"===e.key||"Shift"===e.key||"Meta"===e.key||(P="keyboard",S("keyboard",e))}function M(e){P="pointer","pointerType"in e&&e.pointerType,("mousedown"===e.type||"pointerdown"===e.type)&&(N=!0,S("pointer",e))}function R(e){x.isOpening||(""!==e.pointerType||!e.isTrusted)&&(T()&&e.pointerType?"click"!==e.type||1!==e.buttons:0!==e.detail||e.pointerType)||(N=!0,P="virtual")}function O(e){let t=n(s(e)),o=r(s(e));s(e)!==t&&s(e)!==o&&e.isTrusted&&(N||C||(P="virtual",S("virtual",e)),N=!1,C=!1)}function D(){N=!1,C=!0}function H(e){if("u"typeof PointerEvent&&(o.addEventListener("pointerdown",M,!0),o.addEventListener("pointermove",M,!0),o.addEventListener("pointerup",M,!0)),t.addEventListener("beforeunload",()=>{j(e)},{once:!0}),L.set(t,{focus:s})}let j=(e,t)=>{let o=n(e),s=r(e);t&&s.removeEventListener("DOMContentLoaded",t),L.has(o)&&(o.HTMLElement.prototype.focus=L.get(o).focus,s.removeEventListener("keydown",A,!0),s.removeEventListener("keyup",A,!0),s.removeEventListener("click",R,!0),o.removeEventListener("focus",O,!0),o.removeEventListener("blur",D,!1),"u">typeof PointerEvent&&(s.removeEventListener("pointerdown",M,!0),s.removeEventListener("pointermove",M,!0),s.removeEventListener("pointerup",M,!0)),L.delete(o))};function K(){return"pointer"!==P}"u">typeof document&&("loading"!==(t=r(void 0)).readyState?H(void 0):t.addEventListener("DOMContentLoaded",()=>{H(void 0)}));let W=new Set(["checkbox","radio","range","color","file","image","button","submit","reset"]);function B(){let e=(0,l.useRef)(new Map),t=(0,l.useCallback)((t,r,n,o)=>{let s=o?.once?(...t)=>{e.current.delete(n),n(...t)}:n;e.current.set(n,{type:r,eventTarget:t,fn:s,options:o}),t.addEventListener(r,s,o)},[]),r=(0,l.useCallback)((t,r,n,o)=>{let s=e.current.get(n)?.fn||n;t.removeEventListener(r,s,o),e.current.delete(n)},[]),n=(0,l.useCallback)(()=>{e.current.forEach((e,t)=>{r(e.eventTarget,e.type,t,e.options)})},[r]);return(0,l.useEffect)(()=>n,[n]),{addGlobalListener:t,removeGlobalListener:r,removeAllGlobalListeners:n}}e.s(["useFocusRing",0,function(e={}){var t;let{autoFocus:a=!1,isTextInput:i,within:u}=e,f=(0,l.useRef)({isFocused:!1,isFocusVisible:a||K()}),[p,m]=(0,l.useState)(!1),[b,v]=(0,l.useState)(()=>f.current.isFocused&&f.current.isFocusVisible),h=(0,l.useCallback)(()=>v(f.current.isFocused&&f.current.isFocusVisible),[]),g=(0,l.useCallback)(e=>{f.current.isFocused=e,f.current.isFocusVisible=K(),m(e),h()},[h]);t={enabled:p,isTextInput:i},H(),(0,l.useEffect)(()=>{if(t?.enabled===!1)return;let e=(e,o)=>{var a;let i,l,u,c,d,p,m,b;a=!!t?.isTextInput,l=r(i=o?s(o):void 0),c=void 0!==(u=n(i))?u.HTMLInputElement:HTMLInputElement,d=void 0!==u?u.HTMLTextAreaElement:HTMLTextAreaElement,p=void 0!==u?u.HTMLElement:HTMLElement,m=void 0!==u?u.KeyboardEvent:KeyboardEvent,b=((e=document)=>e.activeElement)(l),(a=a||b instanceof c&&!W.has(b.type)||b instanceof d||b instanceof p&&b.isContentEditable)&&"keyboard"===e&&o instanceof m&&!I[o.key]||(e=>{f.current.isFocusVisible=e,h()})(K())};return k.add(e),()=>{k.delete(e)}},[i,p]);let{focusProps:y}=function(e){let{isDisabled:t,onFocus:n,onBlur:o,onFocusChange:a}=e,i=(0,l.useCallback)(e=>{if(s(e)===e.currentTarget)return o&&o(e),a&&a(!1),!0},[o,a]),u=d(i),c=(0,l.useCallback)(e=>{let t=s(e),o=r(t),i=o?((e=document)=>e.activeElement)(o):((e=document)=>e.activeElement)();t===e.currentTarget&&t===i&&(n&&n(e),a&&a(!0),u(e))},[a,n,u]);return{focusProps:{onFocus:!t&&(n||a||o)?c:void 0,onBlur:!t&&(o||a)?i:void 0}}}({isDisabled:u,onFocusChange:g}),{focusWithinProps:E}=function(e){let{isDisabled:t,onBlurWithin:n,onFocusWithin:a,onFocusWithinChange:i}=e,u=(0,l.useRef)({isFocusWithin:!1}),{addGlobalListener:f,removeAllGlobalListeners:p}=B(),m=(0,l.useCallback)(e=>{o(e.currentTarget,s(e))&&u.current.isFocusWithin&&!o(e.currentTarget,e.relatedTarget)&&(u.current.isFocusWithin=!1,p(),n&&n(e),i&&i(!1))},[n,i,u,p]),b=d(m),v=(0,l.useCallback)(e=>{if(!o(e.currentTarget,s(e)))return;let t=s(e),n=r(t),l=((e=document)=>e.activeElement)(n);if(!u.current.isFocusWithin&&l===t){a&&a(e),i&&i(!0),u.current.isFocusWithin=!0,b(e);let t=e.currentTarget;f(n,"focus",e=>{let r=s(e);if(u.current.isFocusWithin&&!o(t,r)){let e=new n.defaultView.FocusEvent("blur",{relatedTarget:r});Object.defineProperty(e,"target",{value:t}),Object.defineProperty(e,"currentTarget",{value:t}),m(c(e))}},{capture:!0})}},[a,i,b,f,m]);return t?{focusWithinProps:{onFocus:void 0,onBlur:void 0}}:{focusWithinProps:{onFocus:v,onBlur:m}}}({isDisabled:!u,onFocusWithinChange:g});return{isFocused:p,isFocusVisible:b,focusProps:u?E:y}}],783222);let V=!1,_=0;function G(e){"touch"===e.pointerType&&(V=!0,setTimeout(()=>{V=!1},500))}function U(){let e=r(null);if(void 0!==e)return 0===_&&"u">typeof PointerEvent&&e.addEventListener("pointerup",G),_++,()=>{!(--_>0)&&"u">typeof PointerEvent&&e.removeEventListener("pointerup",G)}}e.s(["useHover",0,function(e){let{onHoverStart:t,onHoverChange:n,onHoverEnd:a,isDisabled:i}=e,[u,c]=(0,l.useState)(!1),d=(0,l.useRef)({isHovered:!1,ignoreEmulatedMouseEvents:!1,pointerType:"",target:null}).current;(0,l.useEffect)(U,[]);let{addGlobalListener:f,removeAllGlobalListeners:p}=B(),{hoverProps:m,triggerHoverEnd:b}=(0,l.useMemo)(()=>{let e=(e,t)=>{let r=d.target;d.pointerType="",d.target=null,"touch"!==t&&d.isHovered&&r&&(d.isHovered=!1,p(),a&&a({type:"hoverend",target:r,pointerType:t}),n&&n(!1),c(!1))},l={};return"u">typeof PointerEvent&&(l.onPointerEnter=a=>{V&&"mouse"===a.pointerType||((a,l)=>{if(d.pointerType=l,i||"touch"===l||d.isHovered||!o(a.currentTarget,s(a)))return;d.isHovered=!0;let u=a.currentTarget;d.target=u,f(r(s(a)),"pointerover",t=>{d.isHovered&&d.target&&!o(d.target,s(t))&&e(t,t.pointerType)},{capture:!0}),t&&t({type:"hoverstart",target:u,pointerType:l}),n&&n(!0),c(!0)})(a,a.pointerType)},l.onPointerLeave=t=>{!i&&o(t.currentTarget,s(t))&&e(t,t.pointerType)}),{hoverProps:l,triggerHoverEnd:e}},[t,n,a,i,d,f,p]);return(0,l.useEffect)(()=>{i&&b({currentTarget:d.target},d.pointerType)},[i]),{hoverProps:m,isHovered:u}}],433336);var $=Object.defineProperty,q=(e,t,r)=>{let n;return(n="symbol"!=typeof t?t+"":t)in e?$(e,n,{enumerable:!0,configurable:!0,writable:!0,value:r}):e[n]=r,r};let X=new class{constructor(){q(this,"current",this.detect()),q(this,"handoffState","pending"),q(this,"currentId",0)}set(e){this.current!==e&&(this.handoffState="pending",this.currentId=0,this.current=e)}reset(){this.set(this.detect())}nextId(){return++this.currentId}get isServer(){return"server"===this.current}get isClient(){return"client"===this.current}detect(){return"u"setTimeout(()=>{throw e}))}function Z(){let e=[],t={addEventListener:(e,r,n,o)=>(e.addEventListener(r,n,o),t.add(()=>e.removeEventListener(r,n,o))),requestAnimationFrame(...e){let r=requestAnimationFrame(...e);return t.add(()=>cancelAnimationFrame(r))},nextFrame:(...e)=>t.requestAnimationFrame(()=>t.requestAnimationFrame(...e)),setTimeout(...e){let r=setTimeout(...e);return t.add(()=>clearTimeout(r))},microTask(...e){let r={current:!0};return z(()=>{r.current&&e[0]()}),t.add(()=>{r.current=!1})},style(e,t,r){let n=e.style.getPropertyValue(t);return Object.assign(e.style,{[t]:r}),this.add(()=>{Object.assign(e.style,{[t]:n})})},group(e){let t=Z();return e(t),this.add(()=>t.dispose())},add:t=>(e.includes(t)||e.push(t),()=>{let r=e.indexOf(t);if(r>=0)for(let t of e.splice(r,1))t()}),dispose(){for(let t of e.splice(0))t()}};return t}function J(){let[e]=(0,l.useState)(Z);return(0,l.useEffect)(()=>()=>e.dispose(),[e]),e}e.s(["env",0,X],80758),e.s(["getOwnerDocument",0,Y],402155),e.s(["microTask",0,z],368578),e.s(["disposables",0,Z],544508),e.s(["useDisposables",0,J],746725);let Q=(e,t)=>{X.isServer?(0,l.useEffect)(e,t):(0,l.useLayoutEffect)(e,t)};function ee(e){let t=(0,l.useRef)(e);return Q(()=>{t.current=e},[e]),t}e.s(["useIsoMorphicEffect",0,Q],835696),e.s(["useLatestValue",0,ee],941444);let et=function(e){let t=ee(e);return l.default.useCallback((...e)=>t.current(...e),[t])};e.s(["useEvent",0,et],914189),e.s(["useActivePress",0,function({disabled:e=!1}={}){let t=(0,l.useRef)(null),[r,n]=(0,l.useState)(!1),o=J(),s=et(()=>{t.current=null,n(!1),o.dispose()}),a=et(e=>{if(o.dispose(),null===t.current){t.current=e.currentTarget,n(!0);{let r=Y(e.currentTarget);o.addEventListener(r,"pointerup",s,!1),o.addEventListener(r,"pointermove",e=>{if(t.current){var r,o;let s,a;n((s=e.width/2,a=e.height/2,r={top:e.clientY-a,right:e.clientX+s,bottom:e.clientY+a,left:e.clientX-s},o=t.current.getBoundingClientRect(),!(!r||!o||r.righto.right||r.bottomo.bottom)))}},!1),o.addEventListener(r,"pointercancel",s,!1)}}});return{pressed:r,pressProps:e?{}:{onPointerDown:a,onPointerUp:s,onClick:s}}}],394487)},397701,e=>{"use strict";e.s(["match",0,function e(t,r,...n){if(t in r){let e=r[t];return"function"==typeof e?e(...n):e}let o=Error(`Tried to handle "${t}" but there is no handler defined. Only defined handlers are: ${Object.keys(r).map(e=>`"${e}"`).join(", ")}.`);throw Error.captureStackTrace&&Error.captureStackTrace(o,e),o}])},652265,e=>{"use strict";let t,r,n,o,s;e.i(544508);var a=e.i(397701),i=e.i(402155);let l=["[contentEditable=true]","[tabindex]","a[href]","area[href]","button:not([disabled])","iframe","input:not([disabled])","select:not([disabled])","textarea:not([disabled])"].map(e=>`${e}:not([tabindex='-1'])`).join(","),u=["[data-autofocus]"].map(e=>`${e}:not([tabindex='-1'])`).join(",");var c=((t=c||{})[t.First=1]="First",t[t.Previous=2]="Previous",t[t.Next=4]="Next",t[t.Last=8]="Last",t[t.WrapAround=16]="WrapAround",t[t.NoScroll=32]="NoScroll",t[t.AutoFocus=64]="AutoFocus",t),d=((r=d||{})[r.Error=0]="Error",r[r.Overflow=1]="Overflow",r[r.Success=2]="Success",r[r.Underflow=3]="Underflow",r),f=((n=f||{})[n.Previous=-1]="Previous",n[n.Next=1]="Next",n);function p(e=document.body){return null==e?[]:Array.from(e.querySelectorAll(l)).sort((e,t)=>Math.sign((e.tabIndex||Number.MAX_SAFE_INTEGER)-(t.tabIndex||Number.MAX_SAFE_INTEGER)))}var m=((o=m||{})[o.Strict=0]="Strict",o[o.Loose=1]="Loose",o),b=((s=b||{})[s.Keyboard=0]="Keyboard",s[s.Mouse=1]="Mouse",s);function v(e,t=e=>e){return e.slice().sort((e,r)=>{let n=t(e),o=t(r);if(null===n||null===o)return 0;let s=n.compareDocumentPosition(o);return s&Node.DOCUMENT_POSITION_FOLLOWING?-1:s&Node.DOCUMENT_POSITION_PRECEDING?1:0})}function h(e,t,{sorted:r=!0,relativeTo:n=null,skipElements:o=[]}={}){var s,a,i;let l=Array.isArray(e)?e.length>0?e[0].ownerDocument:document:e.ownerDocument,c=Array.isArray(e)?r?v(e):e:64&t?function(e=document.body){return null==e?[]:Array.from(e.querySelectorAll(u)).sort((e,t)=>Math.sign((e.tabIndex||Number.MAX_SAFE_INTEGER)-(t.tabIndex||Number.MAX_SAFE_INTEGER)))}(e):p(e);o.length>0&&c.length>1&&(c=c.filter(e=>!o.some(t=>null!=t&&"current"in t?(null==t?void 0:t.current)===e:t===e))),n=null!=n?n:l.activeElement;let d=(()=>{if(5&t)return 1;if(10&t)return -1;throw Error("Missing Focus.First, Focus.Previous, Focus.Next or Focus.Last")})(),f=(()=>{if(1&t)return 0;if(2&t)return Math.max(0,c.indexOf(n))-1;if(4&t)return Math.max(0,c.indexOf(n))+1;if(8&t)return c.length-1;throw Error("Missing Focus.First, Focus.Previous, Focus.Next or Focus.Last")})(),m=32&t?{preventScroll:!0}:{},b=0,g=c.length,y;do{if(b>=g||b+g<=0)return 0;let e=f+b;if(16&t)e=(e+g)%g;else{if(e<0)return 3;if(e>=g)return 1}null==(y=c[e])||y.focus(m),b+=d}while(y!==l.activeElement)return 6&t&&null!=(i=null==(a=null==(s=y)?void 0:s.matches)?void 0:a.call(s,"textarea,input"))&&i&&y.select(),2}"u">typeof window&&"u">typeof document&&(document.addEventListener("keydown",e=>{e.metaKey||e.altKey||e.ctrlKey||(document.documentElement.dataset.headlessuiFocusVisible="")},!0),document.addEventListener("click",e=>{1===e.detail?delete document.documentElement.dataset.headlessuiFocusVisible:0===e.detail&&(document.documentElement.dataset.headlessuiFocusVisible="")},!0)),e.s(["Focus",0,c,"FocusResult",0,d,"FocusableMode",0,m,"focusFrom",0,function(e,t){return h(p(),t,{relativeTo:e})},"focusIn",0,h,"getFocusableElements",0,p,"isFocusableElement",0,function(e,t=0){var r;return e!==(null==(r=(0,i.getOwnerDocument)(e))?void 0:r.body)&&(0,a.match)(t,{0:()=>e.matches(l),1(){let t=e;for(;null!==t;){if(t.matches(l))return!0;t=t.parentElement}return!1}})},"sortByDomNode",0,v])},144279,294316,e=>{"use strict";var t=e.i(271645);e.s(["useResolveButtonType",0,function(e,r){return(0,t.useMemo)(()=>{var t;if(e.type)return e.type;let n=null!=(t=e.as)?t:"button";if("string"==typeof n&&"button"===n.toLowerCase()||(null==r?void 0:r.tagName)==="BUTTON"&&!r.hasAttribute("type"))return"button"},[e.type,e.as,r])}],144279);var r=e.i(914189);let n=Symbol();e.s(["optionalRef",0,function(e,t=!0){return Object.assign(e,{[n]:t})},"useSyncRefs",0,function(...e){let o=(0,t.useRef)(e);(0,t.useEffect)(()=>{o.current=e},[e]);let s=(0,r.useEvent)(e=>{for(let t of o.current)null!=t&&("function"==typeof t?t(e):t.current=e)});return e.every(e=>null==e||(null==e?void 0:e[n]))?void 0:s}],294316)},732607,e=>{"use strict";e.s(["classNames",0,function(...e){return Array.from(new Set(e.flatMap(e=>"string"==typeof e?e.split(" "):[]))).filter(Boolean).join(" ")}])},700020,e=>{"use strict";let t,r;var n=e.i(271645),o=e.i(732607),s=e.i(397701),a=((t=a||{})[t.None=0]="None",t[t.RenderStrategy=1]="RenderStrategy",t[t.Static=2]="Static",t),i=((r=i||{})[r.Unmount=0]="Unmount",r[r.Hidden=1]="Hidden",r);function l(e,t={},r,s,a){let{as:i=r,children:u,refName:p="ref",...m}=f(e,["unmount","static"]),b=void 0!==e.ref?{[p]:e.ref}:{},v="function"==typeof u?u(t):u;"className"in m&&m.className&&"function"==typeof m.className&&(m.className=m.className(t)),m["aria-labelledby"]&&m["aria-labelledby"]===m.id&&(m["aria-labelledby"]=void 0);let h={};if(t){let e=!1,r=[];for(let[n,o]of Object.entries(t))"boolean"==typeof o&&(e=!0),!0===o&&r.push(n.replace(/([A-Z])/g,e=>`-${e.toLowerCase()}`));if(e)for(let e of(h["data-headlessui-state"]=r.join(" "),r))h[`data-${e}`]=""}if(i===n.Fragment&&(Object.keys(d(m)).length>0||Object.keys(d(h)).length>0))if(!(0,n.isValidElement)(v)||Array.isArray(v)&&v.length>1){if(Object.keys(d(m)).length>0)throw Error(['Passing props on "Fragment"!',"",`The current component <${s} /> is rendering a "Fragment".`,"However we need to passthrough the following props:",Object.keys(d(m)).concat(Object.keys(d(h))).map(e=>` - ${e}`).join(` -`),"","You can apply a few solutions:",['Add an `as="..."` prop, to ensure that we render an actual element instead of a "Fragment".',"Render a single element as the child so that we can forward the props onto that element."].map(e=>` - ${e}`).join(` -`)].join(` -`))}else{var g;let e=v.props,t=null==e?void 0:e.className,r="function"==typeof t?(...e)=>(0,o.classNames)(t(...e),m.className):(0,o.classNames)(t,m.className),s=c(v.props,d(f(m,["ref"])));for(let e in h)e in s&&delete h[e];return(0,n.cloneElement)(v,Object.assign({},s,h,b,{ref:a((g=v,n.default.version.split(".")[0]>="19"?g.props.ref:g.ref),b.ref)},r?{className:r}:{}))}return(0,n.createElement)(i,Object.assign({},f(m,["ref"]),i!==n.Fragment&&b,i!==n.Fragment&&h),v)}function u(...e){return e.every(e=>null==e)?void 0:t=>{for(let r of e)null!=r&&("function"==typeof r?r(t):r.current=t)}}function c(...e){if(0===e.length)return{};if(1===e.length)return e[0];let t={},r={};for(let n of e)for(let e in n)e.startsWith("on")&&"function"==typeof n[e]?(null!=r[e]||(r[e]=[]),r[e].push(n[e])):t[e]=n[e];if(t.disabled||t["aria-disabled"])for(let e in r)/^(on(?:Click|Pointer|Mouse|Key)(?:Down|Up|Press)?)$/.test(e)&&(r[e]=[e=>{var t;return null==(t=null==e?void 0:e.preventDefault)?void 0:t.call(e)}]);for(let e in r)Object.assign(t,{[e](t,...n){for(let o of r[e]){if((t instanceof Event||(null==t?void 0:t.nativeEvent)instanceof Event)&&t.defaultPrevented)return;o(t,...n)}}});return t}function d(e){let t=Object.assign({},e);for(let e in t)void 0===t[e]&&delete t[e];return t}function f(e,t=[]){let r=Object.assign({},e);for(let e of t)e in r&&delete r[e];return r}e.s(["RenderFeatures",0,a,"RenderStrategy",0,i,"compact",0,d,"forwardRefWithAs",0,function(e){var t;return Object.assign((0,n.forwardRef)(e),{displayName:null!=(t=e.displayName)?t:e.name})},"mergeProps",0,function(...e){if(0===e.length)return{};if(1===e.length)return e[0];let t={},r={};for(let n of e)for(let e in n)e.startsWith("on")&&"function"==typeof n[e]?(null!=r[e]||(r[e]=[]),r[e].push(n[e])):t[e]=n[e];for(let e in r)Object.assign(t,{[e](...t){for(let n of r[e])null==n||n(...t)}});return t},"useRender",0,function(){let e,t,r=(e=(0,n.useRef)([]),t=(0,n.useCallback)(t=>{for(let r of e.current)null!=r&&("function"==typeof r?r(t):r.current=t)},[]),(...r)=>{if(!r.every(e=>null==e))return e.current=r,t});return(0,n.useCallback)(e=>(function({ourProps:e,theirProps:t,slot:r,defaultTag:n,features:o,visible:a=!0,name:i,mergeRefs:d}){d=null!=d?d:u;let f=c(t,e);if(a)return l(f,r,n,i,d);let p=null!=o?o:0;if(2&p){let{static:e=!1,...t}=f;if(e)return l(t,r,n,i,d)}if(1&p){let{unmount:e=!0,...t}=f;return(0,s.match)(+!e,{0:()=>null,1:()=>l({...t,hidden:!0,style:{display:"none"}},r,n,i,d)})}return l(f,r,n,i,d)})({mergeRefs:r,...e}),[r])}])},2788,e=>{"use strict";let t;var r=e.i(700020),n=((t=n||{})[t.None=1]="None",t[t.Focusable=2]="Focusable",t[t.Hidden=4]="Hidden",t);let o=(0,r.forwardRefWithAs)(function(e,t){var n;let{features:o=1,...s}=e,a={ref:t,"aria-hidden":(2&o)==2||(null!=(n=s["aria-hidden"])?n:void 0),hidden:(4&o)==4||void 0,style:{position:"fixed",top:1,left:1,width:1,height:0,padding:0,margin:-1,overflow:"hidden",clip:"rect(0, 0, 0, 0)",whiteSpace:"nowrap",borderWidth:"0",...(4&o)==4&&(2&o)!=2&&{display:"none"}}};return(0,r.useRender)()({ourProps:a,theirProps:s,slot:{},defaultTag:"span",name:"Hidden"})});e.s(["Hidden",0,o,"HiddenFeatures",0,n])},998348,e=>{"use strict";let t;var r=((t=r||{}).Space=" ",t.Enter="Enter",t.Escape="Escape",t.Backspace="Backspace",t.Delete="Delete",t.ArrowLeft="ArrowLeft",t.ArrowUp="ArrowUp",t.ArrowRight="ArrowRight",t.ArrowDown="ArrowDown",t.Home="Home",t.End="End",t.PageUp="PageUp",t.PageDown="PageDown",t.Tab="Tab",t);e.s(["Keys",0,r])},553521,e=>{"use strict";var t=e.i(271645),r=e.i(835696);e.s(["useIsMounted",0,function(){let e=(0,t.useRef)(!1);return(0,r.useIsoMorphicEffect)(()=>(e.current=!0,()=>{e.current=!1}),[]),e}])},751734,e=>{"use strict";let t=(0,e.i(271645).createContext)(0);e.s(["default",0,t])},144582,e=>{"use strict";let t=(0,e.i(271645).createContext)({selectedValue:void 0,handleValueChange:void 0});e.s(["default",0,t])},404206,e=>{"use strict";var t=e.i(290571),r=e.i(751734),n=e.i(144582),o=e.i(444755),s=e.i(673706),a=e.i(271645);let i=(0,s.makeClassName)("TabPanel"),l=a.default.forwardRef((e,s)=>{let{children:l,className:u}=e,c=(0,t.__rest)(e,["children","className"]),{selectedValue:d}=(0,a.useContext)(n.default),f=d===(0,a.useContext)(r.default);return a.default.createElement("div",Object.assign({ref:s,className:(0,o.tremorTwMerge)(i("root"),"w-full mt-2",f?"":"hidden",u),"aria-selected":f?"true":"false"},c),l)});l.displayName="TabPanel",e.s(["TabPanel",0,l],404206)},640497,e=>{"use strict";var t=e.i(271645),r=e.i(553521),n=e.i(2788);e.s(["FocusSentinel",0,function({onFocus:e}){let[o,s]=(0,t.useState)(!0),a=(0,r.useIsMounted)();return o?t.default.createElement(n.Hidden,{as:"button",type:"button",features:n.HiddenFeatures.Focusable,onFocus:t=>{t.preventDefault();let r,n=50;r=requestAnimationFrame(function t(){if(n--<=0){r&&cancelAnimationFrame(r);return}if(e()){if(cancelAnimationFrame(r),!a.current)return;s(!1);return}r=requestAnimationFrame(t)})}}):null}])},963703,e=>{"use strict";var t=e.i(271645);let r=t.createContext(null);e.s(["StableCollection",0,function({children:e}){let n=t.useRef({groups:new Map,get(e,t){var r;let n=this.groups.get(e);n||(n=new Map,this.groups.set(e,n));let o=null!=(r=n.get(t))?r:0;return n.set(t,o+1),[Array.from(n.keys()).indexOf(t),function(){let e=n.get(t);e>1?n.set(t,e-1):n.delete(t)}]}});return t.createElement(r.Provider,{value:n},e)},"useStableCollectionIndex",0,function(e){let n=t.useContext(r);if(!n)throw Error("You must wrap your component in a ");let o=t.useId(),[s,a]=n.current.get(e,o);return t.useEffect(()=>a,[]),s}])},970554,e=>{"use strict";let t,r,n;var o=e.i(783222),s=e.i(433336),a=e.i(271645),i=e.i(394487),l=e.i(914189),u=e.i(835696),c=e.i(941444),d=e.i(144279),f=e.i(294316),p=e.i(640497),m=e.i(2788),b=e.i(652265),v=e.i(397701),h=e.i(368578),g=e.i(402155),y=e.i(700020),E=e.i(963703),T=e.i(998348),w=((t=w||{})[t.Forwards=0]="Forwards",t[t.Backwards=1]="Backwards",t),x=((r=x||{})[r.Less=-1]="Less",r[r.Equal=0]="Equal",r[r.Greater=1]="Greater",r),F=((n=F||{})[n.SetSelectedIndex=0]="SetSelectedIndex",n[n.RegisterTab=1]="RegisterTab",n[n.UnregisterTab=2]="UnregisterTab",n[n.RegisterPanel=3]="RegisterPanel",n[n.UnregisterPanel=4]="UnregisterPanel",n);let P={0(e,t){var r;let n=(0,b.sortByDomNode)(e.tabs,e=>e.current),o=(0,b.sortByDomNode)(e.panels,e=>e.current),s=n.filter(e=>{var t;return!(null!=(t=e.current)&&t.hasAttribute("disabled"))}),a={...e,tabs:n,panels:o};if(t.index<0||t.index>n.length-1){let r=(0,v.match)(Math.sign(t.index-e.selectedIndex),{[-1]:()=>1,0:()=>(0,v.match)(Math.sign(t.index),{[-1]:()=>0,0:()=>0,1:()=>1}),1:()=>0});if(0===s.length)return a;let o=(0,v.match)(r,{0:()=>n.indexOf(s[0]),1:()=>n.indexOf(s[s.length-1])});return{...a,selectedIndex:-1===o?e.selectedIndex:o}}let i=n.slice(0,t.index),l=[...n.slice(t.index),...i].find(e=>s.includes(e));if(!l)return a;let u=null!=(r=n.indexOf(l))?r:e.selectedIndex;return -1===u&&(u=e.selectedIndex),{...a,selectedIndex:u}},1(e,t){if(e.tabs.includes(t.tab))return e;let r=e.tabs[e.selectedIndex],n=(0,b.sortByDomNode)([...e.tabs,t.tab],e=>e.current),o=e.selectedIndex;return e.info.current.isControlled||-1===(o=n.indexOf(r))&&(o=e.selectedIndex),{...e,tabs:n,selectedIndex:o}},2:(e,t)=>({...e,tabs:e.tabs.filter(e=>e!==t.tab)}),3:(e,t)=>e.panels.includes(t.panel)?e:{...e,panels:(0,b.sortByDomNode)([...e.panels,t.panel],e=>e.current)},4:(e,t)=>({...e,panels:e.panels.filter(e=>e!==t.panel)})},k=(0,a.createContext)(null);function L(e){let t=(0,a.useContext)(k);if(null===t){let t=Error(`<${e} /> is missing a parent component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,L),t}return t}k.displayName="TabsDataContext";let N=(0,a.createContext)(null);function C(e){let t=(0,a.useContext)(N);if(null===t){let t=Error(`<${e} /> is missing a parent component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,C),t}return t}function I(e,t){return(0,v.match)(t.type,P,e,t)}N.displayName="TabsActionsContext";let S=y.RenderFeatures.RenderStrategy|y.RenderFeatures.Static,A=Object.assign((0,y.forwardRefWithAs)(function(e,t){var r,n;let c=(0,a.useId)(),{id:p=`headlessui-tabs-tab-${c}`,disabled:m=!1,autoFocus:w=!1,...x}=e,{orientation:F,activation:P,selectedIndex:k,tabs:N,panels:I}=L("Tab"),S=C("Tab"),A=L("Tab"),[M,R]=(0,a.useState)(null),O=(0,a.useRef)(null),D=(0,f.useSyncRefs)(O,t,R);(0,u.useIsoMorphicEffect)(()=>S.registerTab(O),[S,O]);let H=(0,E.useStableCollectionIndex)("tabs"),j=N.indexOf(O);-1===j&&(j=H);let K=j===k,W=(0,l.useEvent)(e=>{var t;let r=e();if(r===b.FocusResult.Success&&"auto"===P){let e=null==(t=(0,g.getOwnerDocument)(O))?void 0:t.activeElement,r=A.tabs.findIndex(t=>t.current===e);-1!==r&&S.change(r)}return r}),B=(0,l.useEvent)(e=>{let t=N.map(e=>e.current).filter(Boolean);if(e.key===T.Keys.Space||e.key===T.Keys.Enter){e.preventDefault(),e.stopPropagation(),S.change(j);return}switch(e.key){case T.Keys.Home:case T.Keys.PageUp:return e.preventDefault(),e.stopPropagation(),W(()=>(0,b.focusIn)(t,b.Focus.First));case T.Keys.End:case T.Keys.PageDown:return e.preventDefault(),e.stopPropagation(),W(()=>(0,b.focusIn)(t,b.Focus.Last))}if(W(()=>(0,v.match)(F,{vertical:()=>e.key===T.Keys.ArrowUp?(0,b.focusIn)(t,b.Focus.Previous|b.Focus.WrapAround):e.key===T.Keys.ArrowDown?(0,b.focusIn)(t,b.Focus.Next|b.Focus.WrapAround):b.FocusResult.Error,horizontal:()=>e.key===T.Keys.ArrowLeft?(0,b.focusIn)(t,b.Focus.Previous|b.Focus.WrapAround):e.key===T.Keys.ArrowRight?(0,b.focusIn)(t,b.Focus.Next|b.Focus.WrapAround):b.FocusResult.Error}))===b.FocusResult.Success)return e.preventDefault()}),V=(0,a.useRef)(!1),_=(0,l.useEvent)(()=>{var e;V.current||(V.current=!0,null==(e=O.current)||e.focus({preventScroll:!0}),S.change(j),(0,h.microTask)(()=>{V.current=!1}))}),G=(0,l.useEvent)(e=>{e.preventDefault()}),{isFocusVisible:U,focusProps:$}=(0,o.useFocusRing)({autoFocus:w}),{isHovered:q,hoverProps:X}=(0,s.useHover)({isDisabled:m}),{pressed:Y,pressProps:z}=(0,i.useActivePress)({disabled:m}),Z=(0,a.useMemo)(()=>({selected:K,hover:q,active:Y,focus:U,autofocus:w,disabled:m}),[K,q,U,Y,w,m]),J=(0,y.mergeProps)({ref:D,onKeyDown:B,onMouseDown:G,onClick:_,id:p,role:"tab",type:(0,d.useResolveButtonType)(e,M),"aria-controls":null==(n=null==(r=I[j])?void 0:r.current)?void 0:n.id,"aria-selected":K,tabIndex:K?0:-1,disabled:m||void 0,autoFocus:w},$,X,z);return(0,y.useRender)()({ourProps:J,theirProps:x,slot:Z,defaultTag:"button",name:"Tabs.Tab"})}),{Group:(0,y.forwardRefWithAs)(function(e,t){let{defaultIndex:r=0,vertical:n=!1,manual:o=!1,onChange:s,selectedIndex:i=null,...d}=e,m=n?"vertical":"horizontal",v=o?"manual":"auto",h=null!==i,g=(0,c.useLatestValue)({isControlled:h}),T=(0,f.useSyncRefs)(t),[w,x]=(0,a.useReducer)(I,{info:g,selectedIndex:null!=i?i:r,tabs:[],panels:[]}),F=(0,a.useMemo)(()=>({selectedIndex:w.selectedIndex}),[w.selectedIndex]),P=(0,c.useLatestValue)(s||(()=>{})),L=(0,c.useLatestValue)(w.tabs),C=(0,a.useMemo)(()=>({orientation:m,activation:v,...w}),[m,v,w]),S=(0,l.useEvent)(e=>(x({type:1,tab:e}),()=>x({type:2,tab:e}))),A=(0,l.useEvent)(e=>(x({type:3,panel:e}),()=>x({type:4,panel:e}))),M=(0,l.useEvent)(e=>{R.current!==e&&P.current(e),h||x({type:0,index:e})}),R=(0,c.useLatestValue)(h?e.selectedIndex:w.selectedIndex),O=(0,a.useMemo)(()=>({registerTab:S,registerPanel:A,change:M}),[]);(0,u.useIsoMorphicEffect)(()=>{x({type:0,index:null!=i?i:r})},[i]),(0,u.useIsoMorphicEffect)(()=>{if(void 0===R.current||w.tabs.length<=0)return;let e=(0,b.sortByDomNode)(w.tabs,e=>e.current);e.some((e,t)=>w.tabs[t]!==e)&&M(e.indexOf(w.tabs[R.current]))});let D=(0,y.useRender)();return a.default.createElement(E.StableCollection,null,a.default.createElement(N.Provider,{value:O},a.default.createElement(k.Provider,{value:C},C.tabs.length<=0&&a.default.createElement(p.FocusSentinel,{onFocus:()=>{var e,t;for(let r of L.current)if((null==(e=r.current)?void 0:e.tabIndex)===0)return null==(t=r.current)||t.focus(),!0;return!1}}),D({ourProps:{ref:T},theirProps:d,slot:F,defaultTag:"div",name:"Tabs"}))))}),List:(0,y.forwardRefWithAs)(function(e,t){let{orientation:r,selectedIndex:n}=L("Tab.List"),o=(0,f.useSyncRefs)(t),s=(0,a.useMemo)(()=>({selectedIndex:n}),[n]);return(0,y.useRender)()({ourProps:{ref:o,role:"tablist","aria-orientation":r},theirProps:e,slot:s,defaultTag:"div",name:"Tabs.List"})}),Panels:(0,y.forwardRefWithAs)(function(e,t){let{selectedIndex:r}=L("Tab.Panels"),n=(0,f.useSyncRefs)(t),o=(0,a.useMemo)(()=>({selectedIndex:r}),[r]);return(0,y.useRender)()({ourProps:{ref:n},theirProps:e,slot:o,defaultTag:"div",name:"Tabs.Panels"})}),Panel:(0,y.forwardRefWithAs)(function(e,t){var r,n,s,i;let l=(0,a.useId)(),{id:c=`headlessui-tabs-panel-${l}`,tabIndex:d=0,...p}=e,{selectedIndex:b,tabs:v,panels:h}=L("Tab.Panel"),g=C("Tab.Panel"),T=(0,a.useRef)(null),w=(0,f.useSyncRefs)(T,t);(0,u.useIsoMorphicEffect)(()=>g.registerPanel(T),[g,T]);let x=(0,E.useStableCollectionIndex)("panels"),F=h.indexOf(T);-1===F&&(F=x);let P=F===b,{isFocusVisible:k,focusProps:N}=(0,o.useFocusRing)(),I=(0,a.useMemo)(()=>({selected:P,focus:k}),[P,k]),A=(0,y.mergeProps)({ref:w,id:c,role:"tabpanel","aria-labelledby":null==(n=null==(r=v[F])?void 0:r.current)?void 0:n.id,tabIndex:P?d:-1},N),M=(0,y.useRender)();return P||null!=(s=p.unmount)&&!s||null!=(i=p.static)&&i?M({ourProps:A,theirProps:p,slot:I,defaultTag:"div",features:S,visible:P,name:"Tabs.Panel"}):a.default.createElement(m.Hidden,{"aria-hidden":"true",...A})})});e.s(["Tab",0,A])},723731,e=>{"use strict";var t=e.i(290571),r=e.i(970554),n=e.i(751734),o=e.i(144582),s=e.i(444755),a=e.i(673706),i=e.i(271645);let l=(0,a.makeClassName)("TabPanels"),u=i.default.forwardRef((e,a)=>{let{children:u,className:c}=e,d=(0,t.__rest)(e,["children","className"]);return i.default.createElement(r.Tab.Panels,Object.assign({as:"div",ref:a,className:(0,s.tremorTwMerge)(l("root"),"w-full",c)},d),({selectedIndex:e})=>i.default.createElement(o.default.Provider,{value:{selectedValue:e}},i.default.Children.map(u,(e,t)=>i.default.createElement(n.default.Provider,{value:t},e))))});u.displayName="TabPanels",e.s(["TabPanels",0,u],723731)},653824,e=>{"use strict";var t=e.i(290571),r=e.i(970554),n=e.i(444755),o=e.i(673706),s=e.i(271645);let a=(0,o.makeClassName)("TabGroup"),i=s.default.forwardRef((e,o)=>{let{defaultIndex:i,index:l,onIndexChange:u,children:c,className:d}=e,f=(0,t.__rest)(e,["defaultIndex","index","onIndexChange","children","className"]);return s.default.createElement(r.Tab.Group,Object.assign({as:"div",ref:o,defaultIndex:i,selectedIndex:l,onChange:u,className:(0,n.tremorTwMerge)(a("root"),"w-full",d)},f),c)});i.displayName="TabGroup",e.s(["TabGroup",0,i],653824)},405371,910342,e=>{"use strict";var t=e.i(290571),r=e.i(271645),n=e.i(480731);let o=(0,r.createContext)(n.BaseColors.Blue);e.s(["default",0,o],910342);var s=e.i(970554),a=e.i(444755);let i=(0,e.i(673706).makeClassName)("TabList"),l=(0,r.createContext)("line"),u={line:(0,a.tremorTwMerge)("flex border-b space-x-4","border-tremor-border","dark:border-dark-tremor-border"),solid:(0,a.tremorTwMerge)("inline-flex p-0.5 rounded-tremor-default space-x-1.5","bg-tremor-background-subtle","dark:bg-dark-tremor-background-subtle")},c=r.default.forwardRef((e,n)=>{let{color:c,variant:d="line",children:f,className:p}=e,m=(0,t.__rest)(e,["color","variant","children","className"]);return r.default.createElement(s.Tab.List,Object.assign({ref:n,className:(0,a.tremorTwMerge)(i("root"),"justify-start overflow-x-clip",u[d],p)},m),r.default.createElement(l.Provider,{value:d},r.default.createElement(o.Provider,{value:c},f)))});c.displayName="TabList",e.s(["TabVariantContext",0,l,"default",0,c],405371)},881073,e=>{"use strict";var t=e.i(405371);e.s(["TabList",()=>t.default])},197647,e=>{"use strict";var t=e.i(290571),r=e.i(970554),n=e.i(95779),o=e.i(444755),s=e.i(673706),a=e.i(271645),i=e.i(405371),l=e.i(910342);let u=(0,s.makeClassName)("Tab"),c=a.default.forwardRef((e,c)=>{let{icon:d,className:f,children:p}=e,m=(0,t.__rest)(e,["icon","className","children"]),b=(0,a.useContext)(i.TabVariantContext),v=(0,a.useContext)(l.default);return a.default.createElement(r.Tab,Object.assign({ref:c,className:(0,o.tremorTwMerge)(u("root"),"flex whitespace-nowrap truncate max-w-xs outline-none data-focus-visible:ring text-tremor-default transition duration-100",function(e,t){switch(e){case"line":return(0,o.tremorTwMerge)("data-[selected]:border-b-2 hover:border-b-2 border-transparent transition duration-100 -mb-px px-2 py-2","hover:border-tremor-content hover:text-tremor-content-emphasis text-tremor-content","[&:not([data-selected])]:dark:hover:border-dark-tremor-content-emphasis [&:not([data-selected])]:dark:hover:text-dark-tremor-content-emphasis [&:not([data-selected])]:dark:text-dark-tremor-content",t?(0,s.getColorClassNames)(t,n.colorPalette.border).selectBorderColor:["data-[selected]:border-tremor-brand data-[selected]:text-tremor-brand","data-[selected]:dark:border-dark-tremor-brand data-[selected]:dark:text-dark-tremor-brand"]);case"solid":return(0,o.tremorTwMerge)("border-transparent border rounded-tremor-small px-2.5 py-1","data-[selected]:border-tremor-border data-[selected]:bg-tremor-background data-[selected]:shadow-tremor-input [&:not([data-selected])]:hover:text-tremor-content-emphasis data-[selected]:text-tremor-brand [&:not([data-selected])]:text-tremor-content","dark:data-[selected]:border-dark-tremor-border dark:data-[selected]:bg-dark-tremor-background dark:data-[selected]:shadow-dark-tremor-input dark:[&:not([data-selected])]:hover:text-dark-tremor-content-emphasis dark:data-[selected]:text-dark-tremor-brand dark:[&:not([data-selected])]:text-dark-tremor-content",t?(0,s.getColorClassNames)(t,n.colorPalette.text).selectTextColor:"text-tremor-content dark:text-dark-tremor-content")}}(b,v),f,v&&(0,s.getColorClassNames)(v,n.colorPalette.text).selectTextColor)},m),d?a.default.createElement(d,{className:(0,o.tremorTwMerge)(u("icon"),"flex-none h-5 w-5",p?"mr-2":"")}):null,p?a.default.createElement("span",null,p):null)});c.displayName="Tab",e.s(["Tab",0,c],197647)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/022.sz94ycw4x.js b/litellm/proxy/_experimental/out/_next/static/chunks/022.sz94ycw4x.js deleted file mode 100644 index 746b869a2c6..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/022.sz94ycw4x.js +++ /dev/null @@ -1,4 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,751734,e=>{"use strict";let t=(0,e.i(271645).createContext)(0);e.s(["default",0,t])},144582,e=>{"use strict";let t=(0,e.i(271645).createContext)({selectedValue:void 0,handleValueChange:void 0});e.s(["default",0,t])},404206,e=>{"use strict";var t=e.i(290571),r=e.i(751734),n=e.i(144582),o=e.i(444755),s=e.i(673706),a=e.i(271645);let i=(0,s.makeClassName)("TabPanel"),l=a.default.forwardRef((e,s)=>{let{children:l,className:u}=e,c=(0,t.__rest)(e,["children","className"]),{selectedValue:d}=(0,a.useContext)(n.default),f=d===(0,a.useContext)(r.default);return a.default.createElement("div",Object.assign({ref:s,className:(0,o.tremorTwMerge)(i("root"),"w-full mt-2",f?"":"hidden",u),"aria-selected":f?"true":"false"},c),l)});l.displayName="TabPanel",e.s(["TabPanel",0,l],404206)},783222,433336,80758,402155,368578,544508,746725,835696,941444,914189,394487,e=>{"use strict";let t;e.i(247167);let r=e=>e?.ownerDocument??document,n=e=>e&&"window"in e&&e.window===e?e:r(e).defaultView||window;function o(e,t){return!!t&&!!e&&e.contains(t)}function s(e){return e.target}let a=null;"u">typeof Element&&Element.prototype;let i=["input:not([disabled]):not([type=hidden])","select:not([disabled])","textarea:not([disabled])","button:not([disabled])","a[href]","area[href]","summary","iframe","object","embed","audio[controls]","video[controls]",'[contenteditable]:not([contenteditable^="false"])',"permission"];i.join(":not([hidden]),"),i.push('[tabindex]:not([tabindex="-1"]):not([disabled])'),i.join(':not([hidden]):not([tabindex="-1"]),');var l=e.i(271645);let u="u">typeof document?l.default.useLayoutEffect:()=>{};function c(e){return e.nativeEvent=e,e.isDefaultPrevented=()=>e.defaultPrevented,e.isPropagationStopped=()=>e.cancelBubble,e.persist=()=>{},e}function d(e){let t=(0,l.useRef)({isFocused:!1,observer:null});return u(()=>{let e=t.current;return()=>{e.observer&&(e.observer.disconnect(),e.observer=null)}},[]),(0,l.useCallback)(r=>{let n=s(r);(n instanceof HTMLButtonElement||n instanceof HTMLInputElement||n instanceof HTMLTextAreaElement||n instanceof HTMLSelectElement)&&(t.current.isFocused=!0,n.addEventListener("focusout",r=>{if(t.current.isFocused=!1,n.disabled){let t=c(r);e?.(t)}t.current.observer&&(t.current.observer.disconnect(),t.current.observer=null)},{once:!0}),t.current.observer=new MutationObserver(()=>{if(t.current.isFocused&&n.disabled){t.current.observer?.disconnect();let e=n===((e=document)=>e.activeElement)()?null:((e=document)=>e.activeElement)();n.dispatchEvent(new FocusEvent("blur",{relatedTarget:e})),n.dispatchEvent(new FocusEvent("focusout",{bubbles:!0,relatedTarget:e}))}}),t.current.observer.observe(n,{attributes:!0,attributeFilter:["disabled"]}))},[e])}function f(e){if("u"e.test(t.brand))||e.test(window.navigator.userAgent)}function p(e){return"u">typeof window&&null!=window.navigator&&e.test(window.navigator.userAgentData?.platform||window.navigator.platform)}function m(e){let t=null;return()=>(null==t&&(t=e()),t)}let b=m(function(){return p(/^Mac/i)}),v=m(function(){return p(/^iPhone/i)}),h=m(function(){return p(/^iPad/i)||b()&&navigator.maxTouchPoints>1}),g=m(function(){return v()||h()});m(function(){return b()||g()});let y=m(function(){return f(/AppleWebKit/i)&&!E()}),E=m(function(){return f(/Chrome/i)}),T=m(function(){return f(/Android/i)}),w=m(function(){return f(/Firefox/i)});function x(e,t,r=!0){let{metaKey:n,ctrlKey:o,altKey:s,shiftKey:i}=t;w()&&window.event?.type?.startsWith("key")&&"_blank"===e.target&&(b()?n=!0:o=!0);let l=y()&&b()&&!h()&&1?new KeyboardEvent("keydown",{keyIdentifier:"Enter",metaKey:n,ctrlKey:o,altKey:s,shiftKey:i}):new MouseEvent("click",{metaKey:n,ctrlKey:o,altKey:s,shiftKey:i,detail:1,bubbles:!0,cancelable:!0});x.isOpening=r;if(function(){if(null==a){a=!1;try{document.createElement("div").focus({get preventScroll(){return a=!0,!0}})}catch{}}return a}())e.focus({preventScroll:!0});else{let t=function(e){let t=e.parentNode,r=[],n=document.scrollingElement||document.documentElement;for(;t instanceof HTMLElement&&t!==n;)(t.offsetHeighttypeof window&&window.document&&window.document.createElement,new WeakMap;l.default.useId;let P=null,k=new Set,L=new Map,N=!1,C=!1,I={Tab:!0,Escape:!0};function S(e,t){for(let r of k)r(e,t)}function A(e){N=!0,x.isOpening||e.metaKey||!b()&&e.altKey||e.ctrlKey||"Control"===e.key||"Shift"===e.key||"Meta"===e.key||(P="keyboard",S("keyboard",e))}function M(e){P="pointer","pointerType"in e&&e.pointerType,("mousedown"===e.type||"pointerdown"===e.type)&&(N=!0,S("pointer",e))}function R(e){x.isOpening||(""!==e.pointerType||!e.isTrusted)&&(T()&&e.pointerType?"click"!==e.type||1!==e.buttons:0!==e.detail||e.pointerType)||(N=!0,P="virtual")}function O(e){let t=n(s(e)),o=r(s(e));s(e)!==t&&s(e)!==o&&e.isTrusted&&(N||C||(P="virtual",S("virtual",e)),N=!1,C=!1)}function D(){N=!1,C=!0}function H(e){if("u"typeof PointerEvent&&(o.addEventListener("pointerdown",M,!0),o.addEventListener("pointermove",M,!0),o.addEventListener("pointerup",M,!0)),t.addEventListener("beforeunload",()=>{j(e)},{once:!0}),L.set(t,{focus:s})}let j=(e,t)=>{let o=n(e),s=r(e);t&&s.removeEventListener("DOMContentLoaded",t),L.has(o)&&(o.HTMLElement.prototype.focus=L.get(o).focus,s.removeEventListener("keydown",A,!0),s.removeEventListener("keyup",A,!0),s.removeEventListener("click",R,!0),o.removeEventListener("focus",O,!0),o.removeEventListener("blur",D,!1),"u">typeof PointerEvent&&(s.removeEventListener("pointerdown",M,!0),s.removeEventListener("pointermove",M,!0),s.removeEventListener("pointerup",M,!0)),L.delete(o))};function K(){return"pointer"!==P}"u">typeof document&&("loading"!==(t=r(void 0)).readyState?H(void 0):t.addEventListener("DOMContentLoaded",()=>{H(void 0)}));let W=new Set(["checkbox","radio","range","color","file","image","button","submit","reset"]);function B(){let e=(0,l.useRef)(new Map),t=(0,l.useCallback)((t,r,n,o)=>{let s=o?.once?(...t)=>{e.current.delete(n),n(...t)}:n;e.current.set(n,{type:r,eventTarget:t,fn:s,options:o}),t.addEventListener(r,s,o)},[]),r=(0,l.useCallback)((t,r,n,o)=>{let s=e.current.get(n)?.fn||n;t.removeEventListener(r,s,o),e.current.delete(n)},[]),n=(0,l.useCallback)(()=>{e.current.forEach((e,t)=>{r(e.eventTarget,e.type,t,e.options)})},[r]);return(0,l.useEffect)(()=>n,[n]),{addGlobalListener:t,removeGlobalListener:r,removeAllGlobalListeners:n}}e.s(["useFocusRing",0,function(e={}){var t;let{autoFocus:a=!1,isTextInput:i,within:u}=e,f=(0,l.useRef)({isFocused:!1,isFocusVisible:a||K()}),[p,m]=(0,l.useState)(!1),[b,v]=(0,l.useState)(()=>f.current.isFocused&&f.current.isFocusVisible),h=(0,l.useCallback)(()=>v(f.current.isFocused&&f.current.isFocusVisible),[]),g=(0,l.useCallback)(e=>{f.current.isFocused=e,f.current.isFocusVisible=K(),m(e),h()},[h]);t={enabled:p,isTextInput:i},H(),(0,l.useEffect)(()=>{if(t?.enabled===!1)return;let e=(e,o)=>{var a;let i,l,u,c,d,p,m,b;a=!!t?.isTextInput,l=r(i=o?s(o):void 0),c=void 0!==(u=n(i))?u.HTMLInputElement:HTMLInputElement,d=void 0!==u?u.HTMLTextAreaElement:HTMLTextAreaElement,p=void 0!==u?u.HTMLElement:HTMLElement,m=void 0!==u?u.KeyboardEvent:KeyboardEvent,b=((e=document)=>e.activeElement)(l),(a=a||b instanceof c&&!W.has(b.type)||b instanceof d||b instanceof p&&b.isContentEditable)&&"keyboard"===e&&o instanceof m&&!I[o.key]||(e=>{f.current.isFocusVisible=e,h()})(K())};return k.add(e),()=>{k.delete(e)}},[i,p]);let{focusProps:y}=function(e){let{isDisabled:t,onFocus:n,onBlur:o,onFocusChange:a}=e,i=(0,l.useCallback)(e=>{if(s(e)===e.currentTarget)return o&&o(e),a&&a(!1),!0},[o,a]),u=d(i),c=(0,l.useCallback)(e=>{let t=s(e),o=r(t),i=o?((e=document)=>e.activeElement)(o):((e=document)=>e.activeElement)();t===e.currentTarget&&t===i&&(n&&n(e),a&&a(!0),u(e))},[a,n,u]);return{focusProps:{onFocus:!t&&(n||a||o)?c:void 0,onBlur:!t&&(o||a)?i:void 0}}}({isDisabled:u,onFocusChange:g}),{focusWithinProps:E}=function(e){let{isDisabled:t,onBlurWithin:n,onFocusWithin:a,onFocusWithinChange:i}=e,u=(0,l.useRef)({isFocusWithin:!1}),{addGlobalListener:f,removeAllGlobalListeners:p}=B(),m=(0,l.useCallback)(e=>{o(e.currentTarget,s(e))&&u.current.isFocusWithin&&!o(e.currentTarget,e.relatedTarget)&&(u.current.isFocusWithin=!1,p(),n&&n(e),i&&i(!1))},[n,i,u,p]),b=d(m),v=(0,l.useCallback)(e=>{if(!o(e.currentTarget,s(e)))return;let t=s(e),n=r(t),l=((e=document)=>e.activeElement)(n);if(!u.current.isFocusWithin&&l===t){a&&a(e),i&&i(!0),u.current.isFocusWithin=!0,b(e);let t=e.currentTarget;f(n,"focus",e=>{let r=s(e);if(u.current.isFocusWithin&&!o(t,r)){let e=new n.defaultView.FocusEvent("blur",{relatedTarget:r});Object.defineProperty(e,"target",{value:t}),Object.defineProperty(e,"currentTarget",{value:t}),m(c(e))}},{capture:!0})}},[a,i,b,f,m]);return t?{focusWithinProps:{onFocus:void 0,onBlur:void 0}}:{focusWithinProps:{onFocus:v,onBlur:m}}}({isDisabled:!u,onFocusWithinChange:g});return{isFocused:p,isFocusVisible:b,focusProps:u?E:y}}],783222);let V=!1,_=0;function G(e){"touch"===e.pointerType&&(V=!0,setTimeout(()=>{V=!1},500))}function U(){let e=r(null);if(void 0!==e)return 0===_&&"u">typeof PointerEvent&&e.addEventListener("pointerup",G),_++,()=>{!(--_>0)&&"u">typeof PointerEvent&&e.removeEventListener("pointerup",G)}}e.s(["useHover",0,function(e){let{onHoverStart:t,onHoverChange:n,onHoverEnd:a,isDisabled:i}=e,[u,c]=(0,l.useState)(!1),d=(0,l.useRef)({isHovered:!1,ignoreEmulatedMouseEvents:!1,pointerType:"",target:null}).current;(0,l.useEffect)(U,[]);let{addGlobalListener:f,removeAllGlobalListeners:p}=B(),{hoverProps:m,triggerHoverEnd:b}=(0,l.useMemo)(()=>{let e=(e,t)=>{let r=d.target;d.pointerType="",d.target=null,"touch"!==t&&d.isHovered&&r&&(d.isHovered=!1,p(),a&&a({type:"hoverend",target:r,pointerType:t}),n&&n(!1),c(!1))},l={};return"u">typeof PointerEvent&&(l.onPointerEnter=a=>{V&&"mouse"===a.pointerType||((a,l)=>{if(d.pointerType=l,i||"touch"===l||d.isHovered||!o(a.currentTarget,s(a)))return;d.isHovered=!0;let u=a.currentTarget;d.target=u,f(r(s(a)),"pointerover",t=>{d.isHovered&&d.target&&!o(d.target,s(t))&&e(t,t.pointerType)},{capture:!0}),t&&t({type:"hoverstart",target:u,pointerType:l}),n&&n(!0),c(!0)})(a,a.pointerType)},l.onPointerLeave=t=>{!i&&o(t.currentTarget,s(t))&&e(t,t.pointerType)}),{hoverProps:l,triggerHoverEnd:e}},[t,n,a,i,d,f,p]);return(0,l.useEffect)(()=>{i&&b({currentTarget:d.target},d.pointerType)},[i]),{hoverProps:m,isHovered:u}}],433336);var $=Object.defineProperty,q=(e,t,r)=>{let n;return(n="symbol"!=typeof t?t+"":t)in e?$(e,n,{enumerable:!0,configurable:!0,writable:!0,value:r}):e[n]=r,r};let X=new class{constructor(){q(this,"current",this.detect()),q(this,"handoffState","pending"),q(this,"currentId",0)}set(e){this.current!==e&&(this.handoffState="pending",this.currentId=0,this.current=e)}reset(){this.set(this.detect())}nextId(){return++this.currentId}get isServer(){return"server"===this.current}get isClient(){return"client"===this.current}detect(){return"u"setTimeout(()=>{throw e}))}function Z(){let e=[],t={addEventListener:(e,r,n,o)=>(e.addEventListener(r,n,o),t.add(()=>e.removeEventListener(r,n,o))),requestAnimationFrame(...e){let r=requestAnimationFrame(...e);return t.add(()=>cancelAnimationFrame(r))},nextFrame:(...e)=>t.requestAnimationFrame(()=>t.requestAnimationFrame(...e)),setTimeout(...e){let r=setTimeout(...e);return t.add(()=>clearTimeout(r))},microTask(...e){let r={current:!0};return z(()=>{r.current&&e[0]()}),t.add(()=>{r.current=!1})},style(e,t,r){let n=e.style.getPropertyValue(t);return Object.assign(e.style,{[t]:r}),this.add(()=>{Object.assign(e.style,{[t]:n})})},group(e){let t=Z();return e(t),this.add(()=>t.dispose())},add:t=>(e.includes(t)||e.push(t),()=>{let r=e.indexOf(t);if(r>=0)for(let t of e.splice(r,1))t()}),dispose(){for(let t of e.splice(0))t()}};return t}function J(){let[e]=(0,l.useState)(Z);return(0,l.useEffect)(()=>()=>e.dispose(),[e]),e}e.s(["env",0,X],80758),e.s(["getOwnerDocument",0,Y],402155),e.s(["microTask",0,z],368578),e.s(["disposables",0,Z],544508),e.s(["useDisposables",0,J],746725);let Q=(e,t)=>{X.isServer?(0,l.useEffect)(e,t):(0,l.useLayoutEffect)(e,t)};function ee(e){let t=(0,l.useRef)(e);return Q(()=>{t.current=e},[e]),t}e.s(["useIsoMorphicEffect",0,Q],835696),e.s(["useLatestValue",0,ee],941444);let et=function(e){let t=ee(e);return l.default.useCallback((...e)=>t.current(...e),[t])};e.s(["useEvent",0,et],914189),e.s(["useActivePress",0,function({disabled:e=!1}={}){let t=(0,l.useRef)(null),[r,n]=(0,l.useState)(!1),o=J(),s=et(()=>{t.current=null,n(!1),o.dispose()}),a=et(e=>{if(o.dispose(),null===t.current){t.current=e.currentTarget,n(!0);{let r=Y(e.currentTarget);o.addEventListener(r,"pointerup",s,!1),o.addEventListener(r,"pointermove",e=>{if(t.current){var r,o;let s,a;n((s=e.width/2,a=e.height/2,r={top:e.clientY-a,right:e.clientX+s,bottom:e.clientY+a,left:e.clientX-s},o=t.current.getBoundingClientRect(),!(!r||!o||r.righto.right||r.bottomo.bottom)))}},!1),o.addEventListener(r,"pointercancel",s,!1)}}});return{pressed:r,pressProps:e?{}:{onPointerDown:a,onPointerUp:s,onClick:s}}}],394487)},397701,e=>{"use strict";e.s(["match",0,function e(t,r,...n){if(t in r){let e=r[t];return"function"==typeof e?e(...n):e}let o=Error(`Tried to handle "${t}" but there is no handler defined. Only defined handlers are: ${Object.keys(r).map(e=>`"${e}"`).join(", ")}.`);throw Error.captureStackTrace&&Error.captureStackTrace(o,e),o}])},652265,e=>{"use strict";let t,r,n,o,s;e.i(544508);var a=e.i(397701),i=e.i(402155);let l=["[contentEditable=true]","[tabindex]","a[href]","area[href]","button:not([disabled])","iframe","input:not([disabled])","select:not([disabled])","textarea:not([disabled])"].map(e=>`${e}:not([tabindex='-1'])`).join(","),u=["[data-autofocus]"].map(e=>`${e}:not([tabindex='-1'])`).join(",");var c=((t=c||{})[t.First=1]="First",t[t.Previous=2]="Previous",t[t.Next=4]="Next",t[t.Last=8]="Last",t[t.WrapAround=16]="WrapAround",t[t.NoScroll=32]="NoScroll",t[t.AutoFocus=64]="AutoFocus",t),d=((r=d||{})[r.Error=0]="Error",r[r.Overflow=1]="Overflow",r[r.Success=2]="Success",r[r.Underflow=3]="Underflow",r),f=((n=f||{})[n.Previous=-1]="Previous",n[n.Next=1]="Next",n);function p(e=document.body){return null==e?[]:Array.from(e.querySelectorAll(l)).sort((e,t)=>Math.sign((e.tabIndex||Number.MAX_SAFE_INTEGER)-(t.tabIndex||Number.MAX_SAFE_INTEGER)))}var m=((o=m||{})[o.Strict=0]="Strict",o[o.Loose=1]="Loose",o),b=((s=b||{})[s.Keyboard=0]="Keyboard",s[s.Mouse=1]="Mouse",s);function v(e,t=e=>e){return e.slice().sort((e,r)=>{let n=t(e),o=t(r);if(null===n||null===o)return 0;let s=n.compareDocumentPosition(o);return s&Node.DOCUMENT_POSITION_FOLLOWING?-1:s&Node.DOCUMENT_POSITION_PRECEDING?1:0})}function h(e,t,{sorted:r=!0,relativeTo:n=null,skipElements:o=[]}={}){var s,a,i;let l=Array.isArray(e)?e.length>0?e[0].ownerDocument:document:e.ownerDocument,c=Array.isArray(e)?r?v(e):e:64&t?function(e=document.body){return null==e?[]:Array.from(e.querySelectorAll(u)).sort((e,t)=>Math.sign((e.tabIndex||Number.MAX_SAFE_INTEGER)-(t.tabIndex||Number.MAX_SAFE_INTEGER)))}(e):p(e);o.length>0&&c.length>1&&(c=c.filter(e=>!o.some(t=>null!=t&&"current"in t?(null==t?void 0:t.current)===e:t===e))),n=null!=n?n:l.activeElement;let d=(()=>{if(5&t)return 1;if(10&t)return -1;throw Error("Missing Focus.First, Focus.Previous, Focus.Next or Focus.Last")})(),f=(()=>{if(1&t)return 0;if(2&t)return Math.max(0,c.indexOf(n))-1;if(4&t)return Math.max(0,c.indexOf(n))+1;if(8&t)return c.length-1;throw Error("Missing Focus.First, Focus.Previous, Focus.Next or Focus.Last")})(),m=32&t?{preventScroll:!0}:{},b=0,g=c.length,y;do{if(b>=g||b+g<=0)return 0;let e=f+b;if(16&t)e=(e+g)%g;else{if(e<0)return 3;if(e>=g)return 1}null==(y=c[e])||y.focus(m),b+=d}while(y!==l.activeElement)return 6&t&&null!=(i=null==(a=null==(s=y)?void 0:s.matches)?void 0:a.call(s,"textarea,input"))&&i&&y.select(),2}"u">typeof window&&"u">typeof document&&(document.addEventListener("keydown",e=>{e.metaKey||e.altKey||e.ctrlKey||(document.documentElement.dataset.headlessuiFocusVisible="")},!0),document.addEventListener("click",e=>{1===e.detail?delete document.documentElement.dataset.headlessuiFocusVisible:0===e.detail&&(document.documentElement.dataset.headlessuiFocusVisible="")},!0)),e.s(["Focus",0,c,"FocusResult",0,d,"FocusableMode",0,m,"focusFrom",0,function(e,t){return h(p(),t,{relativeTo:e})},"focusIn",0,h,"getFocusableElements",0,p,"isFocusableElement",0,function(e,t=0){var r;return e!==(null==(r=(0,i.getOwnerDocument)(e))?void 0:r.body)&&(0,a.match)(t,{0:()=>e.matches(l),1(){let t=e;for(;null!==t;){if(t.matches(l))return!0;t=t.parentElement}return!1}})},"sortByDomNode",0,v])},144279,294316,e=>{"use strict";var t=e.i(271645);e.s(["useResolveButtonType",0,function(e,r){return(0,t.useMemo)(()=>{var t;if(e.type)return e.type;let n=null!=(t=e.as)?t:"button";if("string"==typeof n&&"button"===n.toLowerCase()||(null==r?void 0:r.tagName)==="BUTTON"&&!r.hasAttribute("type"))return"button"},[e.type,e.as,r])}],144279);var r=e.i(914189);let n=Symbol();e.s(["optionalRef",0,function(e,t=!0){return Object.assign(e,{[n]:t})},"useSyncRefs",0,function(...e){let o=(0,t.useRef)(e);(0,t.useEffect)(()=>{o.current=e},[e]);let s=(0,r.useEvent)(e=>{for(let t of o.current)null!=t&&("function"==typeof t?t(e):t.current=e)});return e.every(e=>null==e||(null==e?void 0:e[n]))?void 0:s}],294316)},732607,e=>{"use strict";e.s(["classNames",0,function(...e){return Array.from(new Set(e.flatMap(e=>"string"==typeof e?e.split(" "):[]))).filter(Boolean).join(" ")}])},700020,e=>{"use strict";let t,r;var n=e.i(271645),o=e.i(732607),s=e.i(397701),a=((t=a||{})[t.None=0]="None",t[t.RenderStrategy=1]="RenderStrategy",t[t.Static=2]="Static",t),i=((r=i||{})[r.Unmount=0]="Unmount",r[r.Hidden=1]="Hidden",r);function l(e,t={},r,s,a){let{as:i=r,children:u,refName:p="ref",...m}=f(e,["unmount","static"]),b=void 0!==e.ref?{[p]:e.ref}:{},v="function"==typeof u?u(t):u;"className"in m&&m.className&&"function"==typeof m.className&&(m.className=m.className(t)),m["aria-labelledby"]&&m["aria-labelledby"]===m.id&&(m["aria-labelledby"]=void 0);let h={};if(t){let e=!1,r=[];for(let[n,o]of Object.entries(t))"boolean"==typeof o&&(e=!0),!0===o&&r.push(n.replace(/([A-Z])/g,e=>`-${e.toLowerCase()}`));if(e)for(let e of(h["data-headlessui-state"]=r.join(" "),r))h[`data-${e}`]=""}if(i===n.Fragment&&(Object.keys(d(m)).length>0||Object.keys(d(h)).length>0))if(!(0,n.isValidElement)(v)||Array.isArray(v)&&v.length>1){if(Object.keys(d(m)).length>0)throw Error(['Passing props on "Fragment"!',"",`The current component <${s} /> is rendering a "Fragment".`,"However we need to passthrough the following props:",Object.keys(d(m)).concat(Object.keys(d(h))).map(e=>` - ${e}`).join(` -`),"","You can apply a few solutions:",['Add an `as="..."` prop, to ensure that we render an actual element instead of a "Fragment".',"Render a single element as the child so that we can forward the props onto that element."].map(e=>` - ${e}`).join(` -`)].join(` -`))}else{var g;let e=v.props,t=null==e?void 0:e.className,r="function"==typeof t?(...e)=>(0,o.classNames)(t(...e),m.className):(0,o.classNames)(t,m.className),s=c(v.props,d(f(m,["ref"])));for(let e in h)e in s&&delete h[e];return(0,n.cloneElement)(v,Object.assign({},s,h,b,{ref:a((g=v,n.default.version.split(".")[0]>="19"?g.props.ref:g.ref),b.ref)},r?{className:r}:{}))}return(0,n.createElement)(i,Object.assign({},f(m,["ref"]),i!==n.Fragment&&b,i!==n.Fragment&&h),v)}function u(...e){return e.every(e=>null==e)?void 0:t=>{for(let r of e)null!=r&&("function"==typeof r?r(t):r.current=t)}}function c(...e){if(0===e.length)return{};if(1===e.length)return e[0];let t={},r={};for(let n of e)for(let e in n)e.startsWith("on")&&"function"==typeof n[e]?(null!=r[e]||(r[e]=[]),r[e].push(n[e])):t[e]=n[e];if(t.disabled||t["aria-disabled"])for(let e in r)/^(on(?:Click|Pointer|Mouse|Key)(?:Down|Up|Press)?)$/.test(e)&&(r[e]=[e=>{var t;return null==(t=null==e?void 0:e.preventDefault)?void 0:t.call(e)}]);for(let e in r)Object.assign(t,{[e](t,...n){for(let o of r[e]){if((t instanceof Event||(null==t?void 0:t.nativeEvent)instanceof Event)&&t.defaultPrevented)return;o(t,...n)}}});return t}function d(e){let t=Object.assign({},e);for(let e in t)void 0===t[e]&&delete t[e];return t}function f(e,t=[]){let r=Object.assign({},e);for(let e of t)e in r&&delete r[e];return r}e.s(["RenderFeatures",0,a,"RenderStrategy",0,i,"compact",0,d,"forwardRefWithAs",0,function(e){var t;return Object.assign((0,n.forwardRef)(e),{displayName:null!=(t=e.displayName)?t:e.name})},"mergeProps",0,function(...e){if(0===e.length)return{};if(1===e.length)return e[0];let t={},r={};for(let n of e)for(let e in n)e.startsWith("on")&&"function"==typeof n[e]?(null!=r[e]||(r[e]=[]),r[e].push(n[e])):t[e]=n[e];for(let e in r)Object.assign(t,{[e](...t){for(let n of r[e])null==n||n(...t)}});return t},"useRender",0,function(){let e,t,r=(e=(0,n.useRef)([]),t=(0,n.useCallback)(t=>{for(let r of e.current)null!=r&&("function"==typeof r?r(t):r.current=t)},[]),(...r)=>{if(!r.every(e=>null==e))return e.current=r,t});return(0,n.useCallback)(e=>(function({ourProps:e,theirProps:t,slot:r,defaultTag:n,features:o,visible:a=!0,name:i,mergeRefs:d}){d=null!=d?d:u;let f=c(t,e);if(a)return l(f,r,n,i,d);let p=null!=o?o:0;if(2&p){let{static:e=!1,...t}=f;if(e)return l(t,r,n,i,d)}if(1&p){let{unmount:e=!0,...t}=f;return(0,s.match)(+!e,{0:()=>null,1:()=>l({...t,hidden:!0,style:{display:"none"}},r,n,i,d)})}return l(f,r,n,i,d)})({mergeRefs:r,...e}),[r])}])},2788,e=>{"use strict";let t;var r=e.i(700020),n=((t=n||{})[t.None=1]="None",t[t.Focusable=2]="Focusable",t[t.Hidden=4]="Hidden",t);let o=(0,r.forwardRefWithAs)(function(e,t){var n;let{features:o=1,...s}=e,a={ref:t,"aria-hidden":(2&o)==2||(null!=(n=s["aria-hidden"])?n:void 0),hidden:(4&o)==4||void 0,style:{position:"fixed",top:1,left:1,width:1,height:0,padding:0,margin:-1,overflow:"hidden",clip:"rect(0, 0, 0, 0)",whiteSpace:"nowrap",borderWidth:"0",...(4&o)==4&&(2&o)!=2&&{display:"none"}}};return(0,r.useRender)()({ourProps:a,theirProps:s,slot:{},defaultTag:"span",name:"Hidden"})});e.s(["Hidden",0,o,"HiddenFeatures",0,n])},998348,e=>{"use strict";let t;var r=((t=r||{}).Space=" ",t.Enter="Enter",t.Escape="Escape",t.Backspace="Backspace",t.Delete="Delete",t.ArrowLeft="ArrowLeft",t.ArrowUp="ArrowUp",t.ArrowRight="ArrowRight",t.ArrowDown="ArrowDown",t.Home="Home",t.End="End",t.PageUp="PageUp",t.PageDown="PageDown",t.Tab="Tab",t);e.s(["Keys",0,r])},553521,e=>{"use strict";var t=e.i(271645),r=e.i(835696);e.s(["useIsMounted",0,function(){let e=(0,t.useRef)(!1);return(0,r.useIsoMorphicEffect)(()=>(e.current=!0,()=>{e.current=!1}),[]),e}])},640497,e=>{"use strict";var t=e.i(271645),r=e.i(553521),n=e.i(2788);e.s(["FocusSentinel",0,function({onFocus:e}){let[o,s]=(0,t.useState)(!0),a=(0,r.useIsMounted)();return o?t.default.createElement(n.Hidden,{as:"button",type:"button",features:n.HiddenFeatures.Focusable,onFocus:t=>{t.preventDefault();let r,n=50;r=requestAnimationFrame(function t(){if(n--<=0){r&&cancelAnimationFrame(r);return}if(e()){if(cancelAnimationFrame(r),!a.current)return;s(!1);return}r=requestAnimationFrame(t)})}}):null}])},963703,e=>{"use strict";var t=e.i(271645);let r=t.createContext(null);e.s(["StableCollection",0,function({children:e}){let n=t.useRef({groups:new Map,get(e,t){var r;let n=this.groups.get(e);n||(n=new Map,this.groups.set(e,n));let o=null!=(r=n.get(t))?r:0;return n.set(t,o+1),[Array.from(n.keys()).indexOf(t),function(){let e=n.get(t);e>1?n.set(t,e-1):n.delete(t)}]}});return t.createElement(r.Provider,{value:n},e)},"useStableCollectionIndex",0,function(e){let n=t.useContext(r);if(!n)throw Error("You must wrap your component in a ");let o=t.useId(),[s,a]=n.current.get(e,o);return t.useEffect(()=>a,[]),s}])},970554,e=>{"use strict";let t,r,n;var o=e.i(783222),s=e.i(433336),a=e.i(271645),i=e.i(394487),l=e.i(914189),u=e.i(835696),c=e.i(941444),d=e.i(144279),f=e.i(294316),p=e.i(640497),m=e.i(2788),b=e.i(652265),v=e.i(397701),h=e.i(368578),g=e.i(402155),y=e.i(700020),E=e.i(963703),T=e.i(998348),w=((t=w||{})[t.Forwards=0]="Forwards",t[t.Backwards=1]="Backwards",t),x=((r=x||{})[r.Less=-1]="Less",r[r.Equal=0]="Equal",r[r.Greater=1]="Greater",r),F=((n=F||{})[n.SetSelectedIndex=0]="SetSelectedIndex",n[n.RegisterTab=1]="RegisterTab",n[n.UnregisterTab=2]="UnregisterTab",n[n.RegisterPanel=3]="RegisterPanel",n[n.UnregisterPanel=4]="UnregisterPanel",n);let P={0(e,t){var r;let n=(0,b.sortByDomNode)(e.tabs,e=>e.current),o=(0,b.sortByDomNode)(e.panels,e=>e.current),s=n.filter(e=>{var t;return!(null!=(t=e.current)&&t.hasAttribute("disabled"))}),a={...e,tabs:n,panels:o};if(t.index<0||t.index>n.length-1){let r=(0,v.match)(Math.sign(t.index-e.selectedIndex),{[-1]:()=>1,0:()=>(0,v.match)(Math.sign(t.index),{[-1]:()=>0,0:()=>0,1:()=>1}),1:()=>0});if(0===s.length)return a;let o=(0,v.match)(r,{0:()=>n.indexOf(s[0]),1:()=>n.indexOf(s[s.length-1])});return{...a,selectedIndex:-1===o?e.selectedIndex:o}}let i=n.slice(0,t.index),l=[...n.slice(t.index),...i].find(e=>s.includes(e));if(!l)return a;let u=null!=(r=n.indexOf(l))?r:e.selectedIndex;return -1===u&&(u=e.selectedIndex),{...a,selectedIndex:u}},1(e,t){if(e.tabs.includes(t.tab))return e;let r=e.tabs[e.selectedIndex],n=(0,b.sortByDomNode)([...e.tabs,t.tab],e=>e.current),o=e.selectedIndex;return e.info.current.isControlled||-1===(o=n.indexOf(r))&&(o=e.selectedIndex),{...e,tabs:n,selectedIndex:o}},2:(e,t)=>({...e,tabs:e.tabs.filter(e=>e!==t.tab)}),3:(e,t)=>e.panels.includes(t.panel)?e:{...e,panels:(0,b.sortByDomNode)([...e.panels,t.panel],e=>e.current)},4:(e,t)=>({...e,panels:e.panels.filter(e=>e!==t.panel)})},k=(0,a.createContext)(null);function L(e){let t=(0,a.useContext)(k);if(null===t){let t=Error(`<${e} /> is missing a parent component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,L),t}return t}k.displayName="TabsDataContext";let N=(0,a.createContext)(null);function C(e){let t=(0,a.useContext)(N);if(null===t){let t=Error(`<${e} /> is missing a parent component.`);throw Error.captureStackTrace&&Error.captureStackTrace(t,C),t}return t}function I(e,t){return(0,v.match)(t.type,P,e,t)}N.displayName="TabsActionsContext";let S=y.RenderFeatures.RenderStrategy|y.RenderFeatures.Static,A=Object.assign((0,y.forwardRefWithAs)(function(e,t){var r,n;let c=(0,a.useId)(),{id:p=`headlessui-tabs-tab-${c}`,disabled:m=!1,autoFocus:w=!1,...x}=e,{orientation:F,activation:P,selectedIndex:k,tabs:N,panels:I}=L("Tab"),S=C("Tab"),A=L("Tab"),[M,R]=(0,a.useState)(null),O=(0,a.useRef)(null),D=(0,f.useSyncRefs)(O,t,R);(0,u.useIsoMorphicEffect)(()=>S.registerTab(O),[S,O]);let H=(0,E.useStableCollectionIndex)("tabs"),j=N.indexOf(O);-1===j&&(j=H);let K=j===k,W=(0,l.useEvent)(e=>{var t;let r=e();if(r===b.FocusResult.Success&&"auto"===P){let e=null==(t=(0,g.getOwnerDocument)(O))?void 0:t.activeElement,r=A.tabs.findIndex(t=>t.current===e);-1!==r&&S.change(r)}return r}),B=(0,l.useEvent)(e=>{let t=N.map(e=>e.current).filter(Boolean);if(e.key===T.Keys.Space||e.key===T.Keys.Enter){e.preventDefault(),e.stopPropagation(),S.change(j);return}switch(e.key){case T.Keys.Home:case T.Keys.PageUp:return e.preventDefault(),e.stopPropagation(),W(()=>(0,b.focusIn)(t,b.Focus.First));case T.Keys.End:case T.Keys.PageDown:return e.preventDefault(),e.stopPropagation(),W(()=>(0,b.focusIn)(t,b.Focus.Last))}if(W(()=>(0,v.match)(F,{vertical:()=>e.key===T.Keys.ArrowUp?(0,b.focusIn)(t,b.Focus.Previous|b.Focus.WrapAround):e.key===T.Keys.ArrowDown?(0,b.focusIn)(t,b.Focus.Next|b.Focus.WrapAround):b.FocusResult.Error,horizontal:()=>e.key===T.Keys.ArrowLeft?(0,b.focusIn)(t,b.Focus.Previous|b.Focus.WrapAround):e.key===T.Keys.ArrowRight?(0,b.focusIn)(t,b.Focus.Next|b.Focus.WrapAround):b.FocusResult.Error}))===b.FocusResult.Success)return e.preventDefault()}),V=(0,a.useRef)(!1),_=(0,l.useEvent)(()=>{var e;V.current||(V.current=!0,null==(e=O.current)||e.focus({preventScroll:!0}),S.change(j),(0,h.microTask)(()=>{V.current=!1}))}),G=(0,l.useEvent)(e=>{e.preventDefault()}),{isFocusVisible:U,focusProps:$}=(0,o.useFocusRing)({autoFocus:w}),{isHovered:q,hoverProps:X}=(0,s.useHover)({isDisabled:m}),{pressed:Y,pressProps:z}=(0,i.useActivePress)({disabled:m}),Z=(0,a.useMemo)(()=>({selected:K,hover:q,active:Y,focus:U,autofocus:w,disabled:m}),[K,q,U,Y,w,m]),J=(0,y.mergeProps)({ref:D,onKeyDown:B,onMouseDown:G,onClick:_,id:p,role:"tab",type:(0,d.useResolveButtonType)(e,M),"aria-controls":null==(n=null==(r=I[j])?void 0:r.current)?void 0:n.id,"aria-selected":K,tabIndex:K?0:-1,disabled:m||void 0,autoFocus:w},$,X,z);return(0,y.useRender)()({ourProps:J,theirProps:x,slot:Z,defaultTag:"button",name:"Tabs.Tab"})}),{Group:(0,y.forwardRefWithAs)(function(e,t){let{defaultIndex:r=0,vertical:n=!1,manual:o=!1,onChange:s,selectedIndex:i=null,...d}=e,m=n?"vertical":"horizontal",v=o?"manual":"auto",h=null!==i,g=(0,c.useLatestValue)({isControlled:h}),T=(0,f.useSyncRefs)(t),[w,x]=(0,a.useReducer)(I,{info:g,selectedIndex:null!=i?i:r,tabs:[],panels:[]}),F=(0,a.useMemo)(()=>({selectedIndex:w.selectedIndex}),[w.selectedIndex]),P=(0,c.useLatestValue)(s||(()=>{})),L=(0,c.useLatestValue)(w.tabs),C=(0,a.useMemo)(()=>({orientation:m,activation:v,...w}),[m,v,w]),S=(0,l.useEvent)(e=>(x({type:1,tab:e}),()=>x({type:2,tab:e}))),A=(0,l.useEvent)(e=>(x({type:3,panel:e}),()=>x({type:4,panel:e}))),M=(0,l.useEvent)(e=>{R.current!==e&&P.current(e),h||x({type:0,index:e})}),R=(0,c.useLatestValue)(h?e.selectedIndex:w.selectedIndex),O=(0,a.useMemo)(()=>({registerTab:S,registerPanel:A,change:M}),[]);(0,u.useIsoMorphicEffect)(()=>{x({type:0,index:null!=i?i:r})},[i]),(0,u.useIsoMorphicEffect)(()=>{if(void 0===R.current||w.tabs.length<=0)return;let e=(0,b.sortByDomNode)(w.tabs,e=>e.current);e.some((e,t)=>w.tabs[t]!==e)&&M(e.indexOf(w.tabs[R.current]))});let D=(0,y.useRender)();return a.default.createElement(E.StableCollection,null,a.default.createElement(N.Provider,{value:O},a.default.createElement(k.Provider,{value:C},C.tabs.length<=0&&a.default.createElement(p.FocusSentinel,{onFocus:()=>{var e,t;for(let r of L.current)if((null==(e=r.current)?void 0:e.tabIndex)===0)return null==(t=r.current)||t.focus(),!0;return!1}}),D({ourProps:{ref:T},theirProps:d,slot:F,defaultTag:"div",name:"Tabs"}))))}),List:(0,y.forwardRefWithAs)(function(e,t){let{orientation:r,selectedIndex:n}=L("Tab.List"),o=(0,f.useSyncRefs)(t),s=(0,a.useMemo)(()=>({selectedIndex:n}),[n]);return(0,y.useRender)()({ourProps:{ref:o,role:"tablist","aria-orientation":r},theirProps:e,slot:s,defaultTag:"div",name:"Tabs.List"})}),Panels:(0,y.forwardRefWithAs)(function(e,t){let{selectedIndex:r}=L("Tab.Panels"),n=(0,f.useSyncRefs)(t),o=(0,a.useMemo)(()=>({selectedIndex:r}),[r]);return(0,y.useRender)()({ourProps:{ref:n},theirProps:e,slot:o,defaultTag:"div",name:"Tabs.Panels"})}),Panel:(0,y.forwardRefWithAs)(function(e,t){var r,n,s,i;let l=(0,a.useId)(),{id:c=`headlessui-tabs-panel-${l}`,tabIndex:d=0,...p}=e,{selectedIndex:b,tabs:v,panels:h}=L("Tab.Panel"),g=C("Tab.Panel"),T=(0,a.useRef)(null),w=(0,f.useSyncRefs)(T,t);(0,u.useIsoMorphicEffect)(()=>g.registerPanel(T),[g,T]);let x=(0,E.useStableCollectionIndex)("panels"),F=h.indexOf(T);-1===F&&(F=x);let P=F===b,{isFocusVisible:k,focusProps:N}=(0,o.useFocusRing)(),I=(0,a.useMemo)(()=>({selected:P,focus:k}),[P,k]),A=(0,y.mergeProps)({ref:w,id:c,role:"tabpanel","aria-labelledby":null==(n=null==(r=v[F])?void 0:r.current)?void 0:n.id,tabIndex:P?d:-1},N),M=(0,y.useRender)();return P||null!=(s=p.unmount)&&!s||null!=(i=p.static)&&i?M({ourProps:A,theirProps:p,slot:I,defaultTag:"div",features:S,visible:P,name:"Tabs.Panel"}):a.default.createElement(m.Hidden,{"aria-hidden":"true",...A})})});e.s(["Tab",0,A])},405371,910342,e=>{"use strict";var t=e.i(290571),r=e.i(271645),n=e.i(480731);let o=(0,r.createContext)(n.BaseColors.Blue);e.s(["default",0,o],910342);var s=e.i(970554),a=e.i(444755);let i=(0,e.i(673706).makeClassName)("TabList"),l=(0,r.createContext)("line"),u={line:(0,a.tremorTwMerge)("flex border-b space-x-4","border-tremor-border","dark:border-dark-tremor-border"),solid:(0,a.tremorTwMerge)("inline-flex p-0.5 rounded-tremor-default space-x-1.5","bg-tremor-background-subtle","dark:bg-dark-tremor-background-subtle")},c=r.default.forwardRef((e,n)=>{let{color:c,variant:d="line",children:f,className:p}=e,m=(0,t.__rest)(e,["color","variant","children","className"]);return r.default.createElement(s.Tab.List,Object.assign({ref:n,className:(0,a.tremorTwMerge)(i("root"),"justify-start overflow-x-clip",u[d],p)},m),r.default.createElement(l.Provider,{value:d},r.default.createElement(o.Provider,{value:c},f)))});c.displayName="TabList",e.s(["TabVariantContext",0,l,"default",0,c],405371)},197647,e=>{"use strict";var t=e.i(290571),r=e.i(970554),n=e.i(95779),o=e.i(444755),s=e.i(673706),a=e.i(271645),i=e.i(405371),l=e.i(910342);let u=(0,s.makeClassName)("Tab"),c=a.default.forwardRef((e,c)=>{let{icon:d,className:f,children:p}=e,m=(0,t.__rest)(e,["icon","className","children"]),b=(0,a.useContext)(i.TabVariantContext),v=(0,a.useContext)(l.default);return a.default.createElement(r.Tab,Object.assign({ref:c,className:(0,o.tremorTwMerge)(u("root"),"flex whitespace-nowrap truncate max-w-xs outline-none data-focus-visible:ring text-tremor-default transition duration-100",function(e,t){switch(e){case"line":return(0,o.tremorTwMerge)("data-[selected]:border-b-2 hover:border-b-2 border-transparent transition duration-100 -mb-px px-2 py-2","hover:border-tremor-content hover:text-tremor-content-emphasis text-tremor-content","[&:not([data-selected])]:dark:hover:border-dark-tremor-content-emphasis [&:not([data-selected])]:dark:hover:text-dark-tremor-content-emphasis [&:not([data-selected])]:dark:text-dark-tremor-content",t?(0,s.getColorClassNames)(t,n.colorPalette.border).selectBorderColor:["data-[selected]:border-tremor-brand data-[selected]:text-tremor-brand","data-[selected]:dark:border-dark-tremor-brand data-[selected]:dark:text-dark-tremor-brand"]);case"solid":return(0,o.tremorTwMerge)("border-transparent border rounded-tremor-small px-2.5 py-1","data-[selected]:border-tremor-border data-[selected]:bg-tremor-background data-[selected]:shadow-tremor-input [&:not([data-selected])]:hover:text-tremor-content-emphasis data-[selected]:text-tremor-brand [&:not([data-selected])]:text-tremor-content","dark:data-[selected]:border-dark-tremor-border dark:data-[selected]:bg-dark-tremor-background dark:data-[selected]:shadow-dark-tremor-input dark:[&:not([data-selected])]:hover:text-dark-tremor-content-emphasis dark:data-[selected]:text-dark-tremor-brand dark:[&:not([data-selected])]:text-dark-tremor-content",t?(0,s.getColorClassNames)(t,n.colorPalette.text).selectTextColor:"text-tremor-content dark:text-dark-tremor-content")}}(b,v),f,v&&(0,s.getColorClassNames)(v,n.colorPalette.text).selectTextColor)},m),d?a.default.createElement(d,{className:(0,o.tremorTwMerge)(u("icon"),"flex-none h-5 w-5",p?"mr-2":"")}):null,p?a.default.createElement("span",null,p):null)});c.displayName="Tab",e.s(["Tab",0,c],197647)},653824,e=>{"use strict";var t=e.i(290571),r=e.i(970554),n=e.i(444755),o=e.i(673706),s=e.i(271645);let a=(0,o.makeClassName)("TabGroup"),i=s.default.forwardRef((e,o)=>{let{defaultIndex:i,index:l,onIndexChange:u,children:c,className:d}=e,f=(0,t.__rest)(e,["defaultIndex","index","onIndexChange","children","className"]);return s.default.createElement(r.Tab.Group,Object.assign({as:"div",ref:o,defaultIndex:i,selectedIndex:l,onChange:u,className:(0,n.tremorTwMerge)(a("root"),"w-full",d)},f),c)});i.displayName="TabGroup",e.s(["TabGroup",0,i],653824)},881073,e=>{"use strict";var t=e.i(405371);e.s(["TabList",()=>t.default])},723731,e=>{"use strict";var t=e.i(290571),r=e.i(970554),n=e.i(751734),o=e.i(144582),s=e.i(444755),a=e.i(673706),i=e.i(271645);let l=(0,a.makeClassName)("TabPanels"),u=i.default.forwardRef((e,a)=>{let{children:u,className:c}=e,d=(0,t.__rest)(e,["children","className"]);return i.default.createElement(r.Tab.Panels,Object.assign({as:"div",ref:a,className:(0,s.tremorTwMerge)(l("root"),"w-full",c)},d),({selectedIndex:e})=>i.default.createElement(o.default.Provider,{value:{selectedValue:e}},i.default.Children.map(u,(e,t)=>i.default.createElement(n.default.Provider,{value:t},e))))});u.displayName="TabPanels",e.s(["TabPanels",0,u],723731)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/024dtgrf2jszs.js b/litellm/proxy/_experimental/out/_next/static/chunks/024dtgrf2jszs.js deleted file mode 100644 index b1a91138cd5..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/024dtgrf2jszs.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,510674,e=>{"use strict";var t=e.i(266027),s=e.i(243652),l=e.i(602869),a=e.i(431703),r=e.i(135214),i=e.i(708347);let n=(0,s.createQueryKeys)("projects"),o=[...i.all_admin_roles,...i.internalUserRoles],d=async e=>{let t=(0,l.getProxyBaseUrl)(),s=`${t}/project/list`,r=await fetch(s,{method:"GET",headers:{[(0,l.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!r.ok){let e=await r.json(),t=(0,a.deriveErrorMessage)(e);throw(0,l.handleError)(t),Error(t)}return r.json()};e.s(["projectKeys",0,n,"useProjects",0,()=>{let{accessToken:e,userRole:s}=(0,r.default)();return(0,t.useQuery)({queryKey:n.list({}),queryFn:async()=>d(e),enabled:!!e&&o.includes(s)})}])},207082,e=>{"use strict";var t=e.i(619273),s=e.i(266027),l=e.i(243652),a=e.i(602869),r=e.i(431703),i=e.i(135214);let n=(0,l.createQueryKeys)("keys"),o=async(e,t,s,l={})=>{try{let i=(0,a.getProxyBaseUrl)(),n=new URLSearchParams(Object.entries({team_id:l.teamID,project_id:l.projectID,agent_id:l.agentID,organization_id:l.organizationID,key_alias:l.selectedKeyAlias,key_hash:l.keyHash,user_id:l.userID,page:t,size:s,sort_by:l.sortBy,sort_order:l.sortOrder,expand:l.expand,status:l.status,return_full_object:"true",include_team_keys:"true",include_created_by_keys:"true",substring_matching:"true"}).filter(([,e])=>null!=e).map(([e,t])=>[e,String(t)])),o=`${i?`${i}/key/list`:"/key/list"}?${n}`,d=await fetch(o,{method:"GET",headers:{[(0,a.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!d.ok){let e=await d.json(),t=(0,r.deriveErrorMessage)(e);throw(0,a.handleError)(t),Error(t)}return await d.json()}catch(e){throw console.error("Failed to list keys:",e),e}},d=(0,l.createQueryKeys)("deletedKeys");e.s(["keyKeys",0,n,"useDeletedKeys",0,(e,l,a={})=>{let{accessToken:r}=(0,i.default)();return(0,s.useQuery)({queryKey:d.list({page:e,limit:l,...a}),queryFn:async()=>await o(r,e,l,{...a,status:"deleted"}),enabled:!!r,staleTime:3e4,placeholderData:t.keepPreviousData})},"useKeys",0,(e,l,a={})=>{let{accessToken:r}=(0,i.default)();return(0,s.useQuery)({queryKey:n.list({page:e,limit:l,...a}),queryFn:async()=>await o(r,e,l,a),enabled:!!r,staleTime:3e4,placeholderData:t.keepPreviousData})}])},109034,e=>{"use strict";var t=e.i(266027),s=e.i(243652),l=e.i(602869),a=e.i(135214);let r=(0,s.createQueryKeys)("tags");e.s(["useTags",0,()=>{let{accessToken:e,userId:s,userRole:i}=(0,a.default)();return(0,t.useQuery)({queryKey:r.list({}),queryFn:async()=>await (0,l.tagListCall)(e),enabled:!!(e&&s&&i)})}])},552130,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(602869);e.s(["default",0,({onChange:e,value:r,className:i,accessToken:n,placeholder:o="Select agents",disabled:d=!1})=>{let[c,u]=(0,s.useState)([]),[m,p]=(0,s.useState)([]),[g,h]=(0,s.useState)(!1);(0,s.useEffect)(()=>{(async()=>{if(n){h(!0);try{let e=await (0,a.getAgentsList)(n),t=e?.agents||[];u(t);let s=new Set;t.forEach(e=>{let t=e.agent_access_groups;t&&Array.isArray(t)&&t.forEach(e=>s.add(e))}),p(Array.from(s))}catch(e){console.error("Error fetching agents:",e)}finally{h(!1)}}})()},[n]);let x=[...m.map(e=>({label:e,value:`group:${e}`,isAccessGroup:!0,searchText:`${e} Access Group`})),...c.map(e=>({label:`${e.agent_name||e.agent_id}`,value:e.agent_id,isAccessGroup:!1,searchText:`${e.agent_name||e.agent_id} ${e.agent_id} Agent`}))],y=[...r?.agents||[],...(r?.accessGroups||[]).map(e=>`group:${e}`)];return(0,t.jsx)("div",{children:(0,t.jsx)(l.Select,{mode:"multiple",placeholder:o,onChange:t=>{e({agents:t.filter(e=>!e.startsWith("group:")),accessGroups:t.filter(e=>e.startsWith("group:")).map(e=>e.replace("group:",""))})},value:y,loading:g,className:i,allowClear:!0,showSearch:!0,style:{width:"100%"},disabled:d,filterOption:(e,t)=>(x.find(e=>e.value===t?.value)?.searchText||"").toLowerCase().includes(e.toLowerCase()),children:x.map(e=>(0,t.jsx)(l.Select.Option,{value:e.value,label:e.label,children:(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,t.jsx)("span",{style:{display:"inline-block",width:8,height:8,borderRadius:"50%",background:e.isAccessGroup?"#52c41a":"#722ed1",flexShrink:0}}),(0,t.jsx)("span",{style:{flex:1},children:e.label}),(0,t.jsx)("span",{style:{color:e.isAccessGroup?"#52c41a":"#722ed1",fontSize:"12px",fontWeight:500,opacity:.8},children:e.isAccessGroup?"Access Group":"Agent"})]})},e.value))})})}])},557662,e=>{"use strict";let t="/ui/assets/logos/",s=[{id:"arize",displayName:"Arize",logo:`${t}arize.png`,supports_key_team_logging:!0,dynamic_params:{arize_api_key:"password",arize_space_id:"password"},description:"Arize Logging Integration"},{id:"braintrust",displayName:"Braintrust",logo:`${t}braintrust.png`,supports_key_team_logging:!1,dynamic_params:{braintrust_api_key:"password",braintrust_project_name:"text"},description:"Braintrust Logging Integration"},{id:"custom_callback_api",displayName:"Custom Callback API",logo:`${t}custom.svg`,supports_key_team_logging:!0,dynamic_params:{custom_callback_api_url:"text",custom_callback_api_headers:"text"},description:"Custom Callback API Logging Integration"},{id:"galileo",displayName:"Galileo",logo:`${t}galileo.ico`,supports_key_team_logging:!1,dynamic_params:{GALILEO_API_KEY:"password",GALILEO_PROJECT_ID:"text",GALILEO_LOG_STREAM_ID:"text",GALILEO_BASE_URL:"text",GALILEO_USERNAME:"text",GALILEO_PASSWORD:"password"},description:"Galileo AI Observability Integration"},{id:"datadog",displayName:"Datadog",logo:`${t}datadog.png`,supports_key_team_logging:!1,dynamic_params:{dd_api_key:"password",dd_site:"text"},description:"Datadog Logging Integration"},{id:"lago",displayName:"Lago",logo:`${t}lago.svg`,supports_key_team_logging:!1,dynamic_params:{lago_api_url:"text",lago_api_key:"password"},description:"Lago Billing Logging Integration"},{id:"langfuse",displayName:"Langfuse",logo:`${t}langfuse.png`,supports_key_team_logging:!0,dynamic_params:{langfuse_public_key:"text",langfuse_secret_key:"password",langfuse_host:"text"},description:"Langfuse v2 Logging Integration"},{id:"langfuse_otel",displayName:"Langfuse OTEL",logo:`${t}langfuse.png`,supports_key_team_logging:!0,dynamic_params:{langfuse_public_key:"text",langfuse_secret_key:"password",langfuse_host:"text"},description:"Langfuse v3 OTEL Logging Integration"},{id:"langsmith",displayName:"LangSmith",logo:`${t}langsmith.png`,supports_key_team_logging:!0,dynamic_params:{langsmith_api_key:"password",langsmith_project:"text",langsmith_base_url:"text",langsmith_sampling_rate:"number"},description:"Langsmith Logging Integration"},{id:"openmeter",displayName:"OpenMeter",logo:`${t}openmeter.png`,supports_key_team_logging:!1,dynamic_params:{openmeter_api_key:"password",openmeter_base_url:"text"},description:"OpenMeter Logging Integration"},{id:"otel",displayName:"Open Telemetry",logo:`${t}otel.png`,supports_key_team_logging:!1,dynamic_params:{otel_endpoint:"text",otel_headers:"text"},description:"OpenTelemetry Logging Integration"},{id:"s3",displayName:"S3",logo:`${t}aws.svg`,supports_key_team_logging:!1,dynamic_params:{s3_bucket_name:"text",aws_access_key_id:"password",aws_secret_access_key:"password",aws_region:"text"},description:"S3 Bucket (AWS) Logging Integration"},{id:"SQS",displayName:"SQS",logo:`${t}aws.svg`,supports_key_team_logging:!1,dynamic_params:{sqs_queue_url:"text",aws_access_key_id:"password",aws_secret_access_key:"password",aws_region:"text"},description:"SQS Queue (AWS) Logging Integration"}],l=s.reduce((e,t)=>(e[t.displayName]=t,e),{}),a=s.reduce((e,t)=>(e[t.displayName]=t.id,e),{}),r=s.reduce((e,t)=>(e[t.id]=t.displayName,e),{});e.s(["callbackInfo",0,l,"callback_map",0,a,"mapDisplayToInternalNames",0,e=>e.map(e=>a[e]||e),"mapInternalToDisplayNames",0,e=>e.map(e=>r[e]||e),"reverse_callback_map",0,r])},9314,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(981339),a=e.i(645526),r=e.i(599724),i=e.i(263147);e.s(["default",0,({value:e,onChange:n,placeholder:o="Select access groups",disabled:d=!1,style:c,className:u,showLabel:m=!1,labelText:p="Access Group",allowClear:g=!0})=>{let{data:h,isLoading:x,isError:y}=(0,i.useAccessGroups)();if(x)return(0,t.jsxs)("div",{children:[m&&(0,t.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(a.TeamOutlined,{className:"mr-2"})," ",p]}),(0,t.jsx)(l.Skeleton.Input,{active:!0,block:!0,style:{height:32,...c}})]});let f=(h??[]).map(e=>({label:(0,t.jsxs)("span",{children:[(0,t.jsx)("span",{className:"font-medium",children:e.access_group_name})," ",(0,t.jsxs)("span",{className:"text-gray-400 text-xs",children:["(",e.access_group_id,")"]})]}),value:e.access_group_id,selectedLabel:e.access_group_name,searchText:`${e.access_group_name} ${e.access_group_id}`}));return(0,t.jsxs)("div",{children:[m&&(0,t.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(a.TeamOutlined,{className:"mr-2"})," ",p]}),(0,t.jsx)(s.Select,{mode:"multiple",value:e,placeholder:o,onChange:n,disabled:d,allowClear:g,showSearch:!0,style:{width:"100%",...c},className:`rounded-md ${u??""}`,notFoundContent:y?(0,t.jsx)("span",{className:"text-red-500",children:"Failed to load access groups"}):"No access groups found",filterOption:(e,t)=>(f.find(e=>e.value===t?.value)?.searchText??"").toLowerCase().includes(e.toLowerCase()),optionLabelProp:"selectedLabel",options:f.map(e=>({label:e.label,value:e.value,selectedLabel:e.selectedLabel}))})]})}])},392110,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(592968),r=e.i(312361),i=e.i(790848),n=e.i(536916),o=e.i(827252),d=e.i(779241);let{Option:c}=l.Select;e.s(["default",0,({form:e,autoRotationEnabled:u,onAutoRotationChange:m,rotationInterval:p,onRotationIntervalChange:g,isCreateMode:h=!1,neverExpire:x=!1,onNeverExpireChange:y})=>{let f=p&&!["7d","30d","90d","180d","365d"].includes(p),[b,_]=(0,s.useState)(f),[j,v]=(0,s.useState)(f?p:""),[w,N]=(0,s.useState)(e?.getFieldValue?.("duration")||"");return(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Key Expiry Settings"}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Expire Key"}),(0,t.jsx)(a.Tooltip,{title:"Set when this key should expire. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days). Leave empty to keep the current expiry unchanged.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})}),!h&&y&&(0,t.jsx)(n.Checkbox,{checked:x,onChange:t=>{let s=t.target.checked;y(s),s&&(N(""),e&&"function"==typeof e.setFieldValue?e.setFieldValue("duration",""):e&&"function"==typeof e.setFieldsValue&&e.setFieldsValue({duration:""}))},className:"ml-2 text-sm font-normal text-gray-600",children:"Never Expire"})]}),(0,t.jsx)(d.TextInput,{name:"duration",placeholder:h?"e.g., 30d or leave empty to never expire":"e.g., 30d",className:"w-full",value:w,onValueChange:t=>{N(t),e&&"function"==typeof e.setFieldValue?e.setFieldValue("duration",t):e&&"function"==typeof e.setFieldsValue&&e.setFieldsValue({duration:t})},disabled:!h&&x})]})]}),(0,t.jsx)(r.Divider,{}),(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Auto-Rotation Settings"}),(0,t.jsxs)("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Enable Auto-Rotation"}),(0,t.jsx)(a.Tooltip,{title:"Key will automatically regenerate at the specified interval for enhanced security.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})})]}),(0,t.jsx)(i.Switch,{checked:u,onChange:m,size:"default",className:u?"":"bg-gray-400"})]}),u&&(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Rotation Interval"}),(0,t.jsx)(a.Tooltip,{title:"How often the key should be automatically rotated. Choose the interval that best fits your security requirements.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)(l.Select,{value:b?"custom":p,onChange:e=>{"custom"===e?_(!0):(_(!1),v(""),g(e))},className:"w-full",placeholder:"Select interval",children:[(0,t.jsx)(c,{value:"7d",children:"7 days"}),(0,t.jsx)(c,{value:"30d",children:"30 days"}),(0,t.jsx)(c,{value:"90d",children:"90 days"}),(0,t.jsx)(c,{value:"180d",children:"180 days"}),(0,t.jsx)(c,{value:"365d",children:"365 days"}),(0,t.jsx)(c,{value:"custom",children:"Custom interval"})]}),b&&(0,t.jsxs)("div",{className:"space-y-1",children:[(0,t.jsx)(d.TextInput,{value:j,onChange:e=>{let t=e.target.value;v(t),g(t)},placeholder:"e.g., 1s, 5m, 2h, 14d"}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Supported formats: seconds (s), minutes (m), hours (h), days (d)"})]})]})]})]}),u&&(0,t.jsx)("div",{className:"bg-blue-50 p-3 rounded-md text-sm text-blue-700",children:"When rotation occurs, you'll receive a notification with the new key. The old key will be deactivated after a brief grace period."})]})]})}])},533882,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(250980),a=e.i(797672),r=e.i(68155),i=e.i(304967),n=e.i(629569),o=e.i(599724),d=e.i(269200),c=e.i(427612),u=e.i(64848),m=e.i(942232),p=e.i(496020),g=e.i(977572),h=e.i(992619),x=e.i(727749);e.s(["default",0,({accessToken:e,initialModelAliases:y={},onAliasUpdate:f,showExampleConfig:b=!0})=>{let[_,j]=(0,s.useState)([]),[v,w]=(0,s.useState)({aliasName:"",targetModel:""}),[N,k]=(0,s.useState)(null);(0,s.useEffect)(()=>{j(Object.entries(y).map(([e,t],s)=>({id:`${s}-${e}`,aliasName:e,targetModel:t})))},[y]);let S=()=>{if(!N)return;if(!N.aliasName||!N.targetModel)return void x.default.fromBackend("Please provide both alias name and target model");if(_.some(e=>e.id!==N.id&&e.aliasName===N.aliasName))return void x.default.fromBackend("An alias with this name already exists");let e=_.map(e=>e.id===N.id?N:e);j(e),k(null);let t={};e.forEach(e=>{t[e.aliasName]=e.targetModel}),f&&f(t),x.default.success("Alias updated successfully")},C=()=>{k(null)},T=_.reduce((e,t)=>(e[t.aliasName]=t.targetModel,e),{});return(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsxs)("div",{className:"mb-6",children:[(0,t.jsx)(o.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Add New Alias"}),(0,t.jsxs)("div",{className:"grid grid-cols-3 gap-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Alias Name"}),(0,t.jsx)("input",{type:"text",value:v.aliasName,onChange:e=>w({...v,aliasName:e.target.value}),placeholder:"e.g., gpt-4o",className:"w-full px-3 py-2 border border-gray-300 rounded-md text-sm"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Target Model"}),(0,t.jsx)(h.default,{accessToken:e,value:v.targetModel,placeholder:"Select target model",onChange:e=>w({...v,targetModel:e}),showLabel:!1})]}),(0,t.jsx)("div",{className:"flex items-end",children:(0,t.jsxs)("button",{onClick:()=>{if(!v.aliasName||!v.targetModel)return void x.default.fromBackend("Please provide both alias name and target model");if(_.some(e=>e.aliasName===v.aliasName))return void x.default.fromBackend("An alias with this name already exists");let e=[..._,{id:`${Date.now()}-${v.aliasName}`,aliasName:v.aliasName,targetModel:v.targetModel}];j(e),w({aliasName:"",targetModel:""});let t={};e.forEach(e=>{t[e.aliasName]=e.targetModel}),f&&f(t),x.default.success("Alias added successfully")},disabled:!v.aliasName||!v.targetModel,className:`flex items-center px-4 py-2 rounded-md text-sm ${!v.aliasName||!v.targetModel?"bg-gray-300 text-gray-500 cursor-not-allowed":"bg-green-600 text-white hover:bg-green-700"}`,children:[(0,t.jsx)(l.PlusCircleIcon,{className:"w-4 h-4 mr-1"}),"Add Alias"]})})]})]}),(0,t.jsx)(o.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Manage Existing Aliases"}),(0,t.jsx)("div",{className:"rounded-lg custom-border relative mb-6",children:(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(d.Table,{className:"[&_td]:py-0.5 [&_th]:py-1",children:[(0,t.jsx)(c.TableHead,{children:(0,t.jsxs)(p.TableRow,{children:[(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Alias Name"}),(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Target Model"}),(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Actions"})]})}),(0,t.jsxs)(m.TableBody,{children:[_.map(s=>(0,t.jsx)(p.TableRow,{className:"h-8",children:N&&N.id===s.id?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(g.TableCell,{className:"py-0.5",children:(0,t.jsx)("input",{type:"text",value:N.aliasName,onChange:e=>k({...N,aliasName:e.target.value}),className:"w-full px-2 py-1 border border-gray-300 rounded-md text-sm"})}),(0,t.jsx)(g.TableCell,{className:"py-0.5",children:(0,t.jsx)(h.default,{accessToken:e,value:N.targetModel,onChange:e=>k({...N,targetModel:e}),showLabel:!1,style:{height:"32px"}})}),(0,t.jsx)(g.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:S,className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:"Save"}),(0,t.jsx)("button",{onClick:C,className:"text-xs bg-gray-50 text-gray-600 px-2 py-1 rounded-sm hover:bg-gray-100",children:"Cancel"})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(g.TableCell,{className:"py-0.5 text-sm text-gray-900",children:s.aliasName}),(0,t.jsx)(g.TableCell,{className:"py-0.5 text-sm text-gray-500",children:s.targetModel}),(0,t.jsx)(g.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:()=>{k({...s})},className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:(0,t.jsx)(a.PencilIcon,{className:"w-3 h-3"})}),(0,t.jsx)("button",{onClick:()=>{var e;let t,l;return e=s.id,j(t=_.filter(t=>t.id!==e)),l={},void(t.forEach(e=>{l[e.aliasName]=e.targetModel}),f&&f(l),x.default.success("Alias deleted successfully"))},className:"text-xs bg-red-50 text-red-600 px-2 py-1 rounded-sm hover:bg-red-100",children:(0,t.jsx)(r.TrashIcon,{className:"w-3 h-3"})})]})})]})},s.id)),0===_.length&&(0,t.jsx)(p.TableRow,{children:(0,t.jsx)(g.TableCell,{colSpan:3,className:"py-0.5 text-sm text-gray-500 text-center",children:"No aliases added yet. Add a new alias above."})})]})]})})}),b&&(0,t.jsxs)(i.Card,{children:[(0,t.jsx)(n.Title,{className:"mb-4",children:"Configuration Example"}),(0,t.jsx)(o.Text,{className:"text-gray-600 mb-4",children:"Here's how your current aliases would look in the config:"}),(0,t.jsx)("div",{className:"bg-gray-100 rounded-lg p-4 font-mono text-sm",children:(0,t.jsxs)("div",{className:"text-gray-700",children:["model_aliases:",0===Object.keys(T).length?(0,t.jsxs)("span",{className:"text-gray-500",children:[(0,t.jsx)("br",{}),"  # No aliases configured yet"]}):Object.entries(T).map(([e,s])=>(0,t.jsxs)("span",{children:[(0,t.jsx)("br",{}),'  "',e,'": "',s,'"']},e))]})})]})]})}])},844565,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(602869);e.s(["default",0,({onChange:e,value:r,className:i,accessToken:n,placeholder:o="Select pass through routes",disabled:d=!1,teamId:c})=>{let[u,m]=(0,s.useState)([]),[p,g]=(0,s.useState)(!1);return(0,s.useEffect)(()=>{(async()=>{if(n){g(!0);try{let e=await (0,a.getPassThroughEndpointsCall)(n,c);if(e.endpoints){let t=e.endpoints.flatMap(e=>{let t=e.path,s=e.methods;return s&&s.length>0?s.map(e=>({label:`${e} ${t}`,value:t})):[{label:t,value:t}]});m(t)}}catch(e){console.error("Error fetching pass through routes:",e)}finally{g(!1)}}})()},[n,c]),(0,t.jsx)(l.Select,{mode:"tags",placeholder:o,onChange:e,value:r,loading:p,className:i,allowClear:!0,options:u,optionFilterProp:"label",showSearch:!0,style:{width:"100%"},disabled:d})}])},810757,477386,e=>{"use strict";var t=e.i(271645);let s=t.forwardRef(function(e,s){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z"}),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15 12a3 3 0 11-6 0 3 3 0 016 0z"}))});e.s(["CogIcon",0,s],810757);let l=t.forwardRef(function(e,s){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M18.364 18.364A9 9 0 005.636 5.636m12.728 12.728A9 9 0 015.636 5.636m12.728 12.728L5.636 5.636"}))});e.s(["BanIcon",0,l],477386)},266484,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(592968),a=e.i(312361),r=e.i(827252),i=e.i(994388),n=e.i(304967),o=e.i(779241),d=e.i(988297),c=e.i(68155),u=e.i(810757),m=e.i(477386),p=e.i(557662),g=e.i(555987),h=e.i(435451);let{Option:x}=s.Select;e.s(["default",0,({value:e=[],onChange:y,disabledCallbacks:f=[],onDisabledCallbacksChange:b})=>{let _=Object.entries(p.callbackInfo).filter(([e,t])=>t.supports_key_team_logging).map(([e,t])=>e),j=Object.keys(p.callbackInfo),v=e=>{y?.(e)},w=(t,s,l)=>{let a=[...e];if("callback_name"===s){let e=p.callback_map[l]||l;a[t]={...a[t],[s]:e,callback_vars:{}}}else a[t]={...a[t],[s]:l};v(a)},N=(t,s,l)=>{let a=[...e];a[t]={...a[t],callback_vars:{...a[t].callback_vars,[s]:l}},v(a)};return(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(m.BanIcon,{className:"w-5 h-5 text-red-500"}),(0,t.jsx)("span",{className:"text-base font-semibold text-gray-800",children:"Disabled Callbacks"}),(0,t.jsx)(l.Tooltip,{title:"Select callbacks to disable for this key. Disabled callbacks will not receive any logging data.",children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Disabled Callbacks"}),(0,t.jsx)(s.Select,{mode:"multiple",placeholder:"Select callbacks to disable",value:f,onChange:e=>{let t=(0,p.mapDisplayToInternalNames)(e);b?.(t)},style:{width:"100%"},optionLabelProp:"label",children:j.map(e=>{let s=(0,g.resolveLogoSrc)(p.callbackInfo[e]?.logo),a=p.callbackInfo[e]?.description;return(0,t.jsx)(x,{value:e,label:e,children:(0,t.jsx)(l.Tooltip,{title:a,placement:"right",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[s&&(0,t.jsx)("img",{src:s,alt:e,className:"w-4 h-4 object-contain",onError:t=>{let s=t.target,l=s.parentElement;if(l){let t=document.createElement("div");t.className="w-4 h-4 rounded-full bg-gray-200 flex items-center justify-center text-xs",t.textContent=e.charAt(0),l.replaceChild(t,s)}}}),(0,t.jsx)("span",{children:e})]})})},e)})}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Select callbacks that should be disabled for this key. These callbacks will not receive any logging data."})]})]}),(0,t.jsx)(a.Divider,{}),(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(u.CogIcon,{className:"w-5 h-5 text-blue-500"}),(0,t.jsx)("span",{className:"text-base font-semibold text-gray-800",children:"Logging Integrations"}),(0,t.jsx)(l.Tooltip,{title:"Configure callback logging integrations for this team.",children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),(0,t.jsx)(i.Button,{variant:"secondary",onClick:()=>{v([...e,{callback_name:"",callback_type:"success",callback_vars:{}}])},icon:d.PlusIcon,size:"sm",className:"hover:border-blue-400 hover:text-blue-500",type:"button",children:"Add Integration"})]}),(0,t.jsx)("div",{className:"space-y-4",children:e.map((a,d)=>{let u=a.callback_name?Object.entries(p.callback_map).find(([e,t])=>t===a.callback_name)?.[0]:void 0,m=u?(0,g.resolveLogoSrc)(p.callbackInfo[u]?.logo):null;return(0,t.jsxs)(n.Card,{className:"border border-gray-200 shadow-xs hover:shadow-md transition-shadow duration-200",decoration:"top",decorationColor:"blue",children:[(0,t.jsxs)("div",{className:"flex justify-between items-start mb-4",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[m&&(0,t.jsx)("img",{src:m,alt:u,className:"w-5 h-5 object-contain"}),(0,t.jsxs)("span",{className:"text-sm font-medium",children:[u||"New Integration"," Configuration"]})]}),(0,t.jsx)(i.Button,{variant:"light",onClick:()=>{v(e.filter((e,t)=>t!==d))},icon:c.TrashIcon,size:"xs",color:"red",className:"hover:bg-red-50",type:"button",children:"Remove"})]}),(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Integration Type"}),(0,t.jsx)(s.Select,{value:u,placeholder:"Select integration",onChange:e=>w(d,"callback_name",e),className:"w-full",optionLabelProp:"label",children:_.map(e=>{let s=(0,g.resolveLogoSrc)(p.callbackInfo[e]?.logo),a=p.callbackInfo[e]?.description;return(0,t.jsx)(x,{value:e,label:e,children:(0,t.jsx)(l.Tooltip,{title:a,placement:"right",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[s&&(0,t.jsx)("img",{src:s,alt:e,className:"w-4 h-4 object-contain",onError:t=>{let s=t.target,l=s.parentElement;if(l){let t=document.createElement("div");t.className="w-4 h-4 rounded-full bg-gray-200 flex items-center justify-center text-xs",t.textContent=e.charAt(0),l.replaceChild(t,s)}}}),(0,t.jsx)("span",{children:e})]})})},e)})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Event Type"}),(0,t.jsxs)(s.Select,{value:a.callback_type,onChange:e=>w(d,"callback_type",e),className:"w-full",children:[(0,t.jsx)(x,{value:"success",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-green-500 rounded-full"}),(0,t.jsx)("span",{children:"Success Only"})]})}),(0,t.jsx)(x,{value:"failure",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-red-500 rounded-full"}),(0,t.jsx)("span",{children:"Failure Only"})]})}),(0,t.jsx)(x,{value:"success_and_failure",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-blue-500 rounded-full"}),(0,t.jsx)("span",{children:"Success & Failure"})]})})]})]})]}),((e,s)=>{if(!e.callback_name)return null;let a=Object.entries(p.callback_map).find(([t,s])=>s===e.callback_name)?.[0];if(!a)return null;let i=p.callbackInfo[a]?.dynamic_params||{};return 0===Object.keys(i).length?null:(0,t.jsxs)("div",{className:"mt-6 pt-4 border-t border-gray-100",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2 mb-4",children:[(0,t.jsx)("div",{className:"w-3 h-3 bg-blue-100 rounded-full flex items-center justify-center",children:(0,t.jsx)("div",{className:"w-1.5 h-1.5 bg-blue-500 rounded-full"})}),(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Integration Parameters"})]}),(0,t.jsx)("div",{className:"grid grid-cols-1 gap-4",children:Object.entries(i).map(([a,i])=>(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 capitalize flex items-center space-x-1",children:[(0,t.jsx)("span",{children:a.replace(/_/g," ")}),(0,t.jsx)(l.Tooltip,{title:`Environment variable reference recommended: os.environ/${a.toUpperCase()}`,children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})}),"password"===i&&(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800",children:"Sensitive"}),"number"===i&&(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800",children:"Number"})]}),"number"===i&&(0,t.jsx)("span",{className:"text-xs text-gray-500",children:"Value must be between 0 and 1"}),"number"===i?(0,t.jsx)(h.default,{step:.01,width:400,placeholder:`os.environ/${a.toUpperCase()}`,value:e.callback_vars[a]||"",onChange:e=>N(s,a,e.target.value)}):(0,t.jsx)(o.TextInput,{type:"password"===i?"password":"text",placeholder:`os.environ/${a.toUpperCase()}`,value:e.callback_vars[a]||"",onChange:e=>N(s,a,e.target.value)})]},a))})]})})(a,d)]})]},d)})}),0===e.length&&(0,t.jsxs)("div",{className:"text-center py-12 text-gray-500 border-2 border-dashed border-gray-200 rounded-lg bg-gray-50/50",children:[(0,t.jsx)(u.CogIcon,{className:"w-12 h-12 text-gray-300 mb-3 mx-auto"}),(0,t.jsx)("div",{className:"text-base font-medium mb-1",children:"No logging integrations configured"}),(0,t.jsx)("div",{className:"text-sm text-gray-400",children:'Click "Add Integration" to configure logging for this team'})]})]})}])},651904,e=>{"use strict";var t=e.i(843476),s=e.i(599724),l=e.i(266484);e.s(["default",0,function({value:e,onChange:a,premiumUser:r=!1,disabledCallbacks:i=[],onDisabledCallbacksChange:n}){return r?(0,t.jsx)(l.default,{value:e,onChange:a,disabledCallbacks:i,onDisabledCallbacksChange:n}):(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{className:"flex flex-wrap gap-2 mb-3",children:[(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50",children:"✨ langfuse-logging"}),(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50",children:"✨ datadog-logging"})]}),(0,t.jsx)("div",{className:"p-3 bg-yellow-50 border border-yellow-200 rounded-lg",children:(0,t.jsxs)(s.Text,{className:"text-sm text-yellow-800",children:["Setting Key/Team logging settings is a LiteLLM Enterprise feature. Global Logging Settings are available for all free users. Get a trial key"," ",(0,t.jsx)("a",{href:"https://www.litellm.ai/#pricing",target:"_blank",rel:"noopener noreferrer",className:"underline",children:"here"}),"."]})})]})}])},939510,e=>{"use strict";var t=e.i(843476),s=e.i(808613),l=e.i(199133),a=e.i(592968),r=e.i(827252);let{Option:i}=l.Select;e.s(["default",0,({type:e,name:n,showDetailedDescriptions:o=!0,className:d="",initialValue:c=null,form:u,onChange:m})=>{let p=e.toUpperCase(),g=e.toLowerCase(),h=`Select 'guaranteed_throughput' to prevent overallocating ${p} limit when the key belongs to a Team with specific ${p} limits.`;return(0,t.jsx)(s.Form.Item,{label:(0,t.jsxs)("span",{children:[p," Rate Limit Type"," ",(0,t.jsx)(a.Tooltip,{title:h,children:(0,t.jsx)(r.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:n,initialValue:c,className:d,children:(0,t.jsx)(l.Select,{defaultValue:o?"default":void 0,placeholder:"Select rate limit type",style:{width:"100%"},optionLabelProp:o?"label":void 0,onChange:e=>{u&&u.setFieldValue(n,e),m&&m(e)},children:o?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i,{value:"best_effort_throughput",label:"Default",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Default"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["Best effort throughput - no error if we're overallocating ",g," (Team/Key Limits checked at runtime)."]})]})}),(0,t.jsx)(i,{value:"guaranteed_throughput",label:"Guaranteed throughput",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Guaranteed throughput"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["Guaranteed throughput - raise an error if we're overallocating ",g," (also checks model-specific limits)"]})]})}),(0,t.jsx)(i,{value:"dynamic",label:"Dynamic",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Dynamic"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["If the key has a set ",p," (e.g. 2 ",p,") and there are no 429 errors, it can dynamically exceed the limit when the model being called is not erroring."]})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i,{value:"best_effort_throughput",children:"Best effort throughput"}),(0,t.jsx)(i,{value:"guaranteed_throughput",children:"Guaranteed throughput"}),(0,t.jsx)(i,{value:"dynamic",children:"Dynamic"})]})})})}])},460285,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(404206),a=e.i(723731),r=e.i(653824),i=e.i(881073),n=e.i(197647),o=e.i(602869),d=e.i(158392),c=e.i(419470),u=e.i(695411);let m=(0,s.forwardRef)(({accessToken:e,value:m,onChange:p,modelData:g},h)=>{let[x,y]=(0,s.useState)({routerSettings:{},selectedStrategy:null,enableTagFiltering:!1}),[f,b]=(0,s.useState)([]),[_,j]=(0,s.useState)([]),[v,w]=(0,s.useState)([]),[N,k]=(0,s.useState)([]),[S,C]=(0,s.useState)({}),[T,I]=(0,s.useState)({}),A=(0,s.useRef)(!1),L=(0,s.useRef)(null);(0,s.useEffect)(()=>{let e=m?.router_settings?JSON.stringify({routing_strategy:m.router_settings.routing_strategy,fallbacks:m.router_settings.fallbacks,enable_tag_filtering:m.router_settings.enable_tag_filtering}):null;if(A.current&&e===L.current){A.current=!1;return}if(A.current&&e!==L.current&&(A.current=!1),e!==L.current)if(L.current=e,m?.router_settings){let e=m.router_settings,{fallbacks:t,...s}=e;y({routerSettings:s,selectedStrategy:e.routing_strategy||null,enableTagFiltering:e.enable_tag_filtering??!1});let l=e.fallbacks||[];b(l),j(l&&0!==l.length?l.map((e,t)=>{let[s,l]=Object.entries(e)[0];return{id:(t+1).toString(),primaryModel:s||null,fallbackModels:l||[]}}):[{id:"1",primaryModel:null,fallbackModels:[]}])}else y({routerSettings:{},selectedStrategy:null,enableTagFiltering:!1}),b([]),j([{id:"1",primaryModel:null,fallbackModels:[]}])},[m]),(0,s.useEffect)(()=>{e&&(0,o.getRouterSettingsCall)(e).then(e=>{if(e.fields){let t={};e.fields.forEach(e=>{t[e.field_name]={ui_field_name:e.ui_field_name,field_description:e.field_description,options:e.options,link:e.link}}),C(t);let s=e.fields.find(e=>"routing_strategy"===e.field_name);s?.options&&k(s.options),e.routing_strategy_descriptions&&I(e.routing_strategy_descriptions)}})},[e]),(0,s.useEffect)(()=>{e&&(async()=>{try{let t=await (0,u.fetchAvailableModels)(e);w(t)}catch(e){console.error("Error fetching model info for fallbacks:",e)}})()},[e]);let F=()=>{let e=new Set(["allowed_fails","cooldown_time","num_retries","timeout","retry_after"]),t=new Set(["model_group_alias","retry_policy"]),s=Object.fromEntries(Object.entries({...x.routerSettings,enable_tag_filtering:x.enableTagFiltering,routing_strategy:x.selectedStrategy,fallbacks:f.length>0?f:null}).map(([s,l])=>{if("routing_strategy_args"!==s&&"routing_strategy"!==s&&"enable_tag_filtering"!==s&&"fallbacks"!==s){let a=document.querySelector(`input[name="${s}"]`);if(a){if(void 0!==a.value&&""!==a.value){let r=((s,l,a)=>{if(null==l)return a;let r=String(l).trim();if(""===r||"null"===r.toLowerCase())return null;if(e.has(s)){let e=Number(r);return Number.isNaN(e)?a:e}if(t.has(s)){if(""===r)return null;try{return JSON.parse(r)}catch{return a}}return"true"===r.toLowerCase()||"false"!==r.toLowerCase()&&r})(s,a.value,l);return[s,r]}return[s,null]}}else if("routing_strategy"===s)return[s,x.selectedStrategy];else if("enable_tag_filtering"===s)return[s,x.enableTagFiltering];else if("fallbacks"===s)return[s,f.length>0?f:null];else if("routing_strategy_args"===s&&"latency-based-routing"===x.selectedStrategy){let e=document.querySelector('input[name="lowest_latency_buffer"]'),t=document.querySelector('input[name="ttl"]'),s={};return e?.value&&(s.lowest_latency_buffer=Number(e.value)),t?.value&&(s.ttl=Number(t.value)),["routing_strategy_args",Object.keys(s).length>0?s:null]}return[s,l]}).filter(e=>null!=e)),l=(e,t=!1)=>null==e||"object"==typeof e&&!Array.isArray(e)&&0===Object.keys(e).length||t&&("number"!=typeof e||Number.isNaN(e))?null:e;return{routing_strategy:l(s.routing_strategy),allowed_fails:l(s.allowed_fails,!0),cooldown_time:l(s.cooldown_time,!0),num_retries:l(s.num_retries,!0),timeout:l(s.timeout,!0),retry_after:l(s.retry_after,!0),fallbacks:f.length>0?f:null,context_window_fallbacks:l(s.context_window_fallbacks),retry_policy:l(s.retry_policy),model_group_alias:l(s.model_group_alias),enable_tag_filtering:x.enableTagFiltering,routing_strategy_args:l(s.routing_strategy_args)}};(0,s.useEffect)(()=>{if(!p)return;let e=setTimeout(()=>{A.current=!0,p({router_settings:F()})},100);return()=>clearTimeout(e)},[x,f]);let M=Array.from(new Set(v.map(e=>e.model_group))).sort();return((0,s.useImperativeHandle)(h,()=>({getValue:()=>({router_settings:F()})})),e)?(0,t.jsx)("div",{className:"w-full",children:(0,t.jsxs)(r.TabGroup,{className:"w-full",children:[(0,t.jsxs)(i.TabList,{variant:"line",defaultValue:"1",className:"px-8 pt-4",children:[(0,t.jsx)(n.Tab,{value:"1",children:"Loadbalancing"}),(0,t.jsx)(n.Tab,{value:"2",children:"Fallbacks"})]}),(0,t.jsxs)(a.TabPanels,{className:"px-8 py-6",children:[(0,t.jsx)(l.TabPanel,{children:(0,t.jsx)(d.default,{value:x,onChange:y,routerFieldsMetadata:S,availableRoutingStrategies:N,routingStrategyDescriptions:T})}),(0,t.jsx)(l.TabPanel,{children:(0,t.jsx)(c.FallbackSelectionForm,{groups:_,onGroupsChange:e=>{j(e),b(e.filter(e=>e.primaryModel&&e.fallbackModels.length>0).map(e=>({[e.primaryModel]:e.fallbackModels})))},availableModels:M,maxGroups:5})})]})]})}):null});m.displayName="RouterSettingsAccordion",e.s(["default",0,m])},363256,e=>{"use strict";var t=e.i(843476),s=e.i(199133);let{Text:l}=e.i(898586).Typography;e.s(["default",0,({organizations:e,value:a,onChange:r,disabled:i,loading:n,style:o})=>(0,t.jsx)(s.Select,{showSearch:!0,placeholder:"All Organizations",value:a,onChange:r,disabled:i,loading:n,allowClear:!0,style:{minWidth:280,...o},filterOption:(t,s)=>{if(!s)return!1;let l=e?.find(e=>e.organization_id===s.key);if(!l)return!1;let a=t.toLowerCase().trim(),r=(l.organization_alias||"").toLowerCase(),i=(l.organization_id||"").toLowerCase();return r.includes(a)||i.includes(a)},children:e?.map(e=>(0,t.jsxs)(s.Select.Option,{value:e.organization_id,children:[(0,t.jsx)("span",{className:"font-medium",children:e.organization_alias})," ",(0,t.jsxs)(l,{type:"secondary",children:["(",e.organization_id,")"]})]},e.organization_id))})])},575260,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(482725),a=e.i(56456);e.s(["default",0,({projects:e,value:r,onChange:i,disabled:n,loading:o,teamId:d})=>{let c=d?e?.filter(e=>e.team_id===d):e;return(0,t.jsx)(s.Select,{showSearch:!0,placeholder:"Search or select a project",value:r,onChange:i,disabled:n,loading:o,allowClear:!0,notFoundContent:o?(0,t.jsx)(l.Spin,{indicator:(0,t.jsx)(a.LoadingOutlined,{spin:!0}),size:"small"}):void 0,filterOption:(e,t)=>{if(!t)return!1;let s=c?.find(e=>e.project_id===t.key);if(!s)return!1;let l=e.toLowerCase().trim(),a=(s.project_alias||"").toLowerCase(),r=(s.project_id||"").toLowerCase();return a.includes(l)||r.includes(l)},optionFilterProp:"children",children:!o&&c?.map(e=>(0,t.jsxs)(s.Select.Option,{value:e.project_id,children:[(0,t.jsx)("span",{className:"font-medium",children:e.project_alias||e.project_id})," ",(0,t.jsxs)("span",{className:"text-gray-500",children:["(",e.project_id,")"]})]},e.project_id))})}])},128233,319312,e=>{"use strict";var t=e.i(843476),s=e.i(464571),l=e.i(199133),a=e.i(592968),r=e.i(425063),i=e.i(107233),n=e.i(37727),o=e.i(271645);e.s(["BudgetFallbacksEditor",0,function({value:e,onChange:d,availableModels:c}){let[u,m]=(0,o.useState)(()=>{let t;return 0===(t=Object.keys(e)).length?[]:t.map((t,s)=>({id:String(s+1),primaryModel:t,fallbackModels:e[t]}))}),p=e=>{m(e),d(Object.fromEntries(e.filter(e=>null!==e.primaryModel&&e.fallbackModels.length>0).map(e=>[e.primaryModel,e.fallbackModels])))},g=()=>{p([...u,{id:Date.now().toString(),primaryModel:null,fallbackModels:[]}])},h=(e,t)=>{p(u.map(s=>s.id===e?{...s,...t}:s))},x=new Set(u.map(e=>e.primaryModel).filter(Boolean));return 0===u.length?(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"text-xs text-gray-500 mb-2",children:"When a model exceeds its per-model budget, requests automatically reroute to fallback models"}),(0,t.jsx)(s.Button,{size:"small",onClick:g,icon:(0,t.jsx)(i.Plus,{className:"w-3 h-3"}),children:"Add Budget Fallback"})]}):(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"When a model exceeds its per-model budget, requests automatically reroute to fallback models"}),u.map(e=>{let s=c.filter(t=>t===e.primaryModel||!x.has(t)),i=c.filter(t=>t!==e.primaryModel);return(0,t.jsxs)("div",{className:"relative rounded-lg border border-gray-200 bg-gray-50 p-4",children:[(0,t.jsx)("button",{type:"button",onClick:()=>{var t;return t=e.id,void p(u.filter(e=>e.id!==t))},className:"absolute top-2 right-2 text-gray-400 hover:text-red-500 transition-colors p-1",children:(0,t.jsx)(n.X,{className:"w-4 h-4"})}),(0,t.jsxs)("div",{className:"mb-3",children:[(0,t.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Primary Model"}),(0,t.jsx)(l.Select,{className:"w-full",placeholder:"Select model",value:e.primaryModel,onChange:t=>{let s=e.fallbackModels.filter(e=>e!==t);h(e.id,{primaryModel:t,fallbackModels:s})},showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:s.map(e=>({label:e,value:e})),getPopupContainer:e=>e.parentElement||document.body})]}),(0,t.jsx)("div",{className:"flex items-center justify-center -my-1 mb-2",children:(0,t.jsxs)("div",{className:"bg-amber-50 text-amber-600 px-3 py-0.5 rounded-full text-[10px] font-bold border border-amber-100 flex items-center gap-1",children:[(0,t.jsx)(r.ArrowDown,{className:"w-3 h-3"}),"IF BUDGET EXCEEDED, TRY"]})}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Fallback Models"}),(0,t.jsx)(l.Select,{mode:"multiple",className:"w-full",placeholder:e.primaryModel?"Select fallback models":"Select a primary model first",value:e.fallbackModels,onChange:t=>h(e.id,{fallbackModels:t}),disabled:!e.primaryModel,showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:i.map(e=>({label:e,value:e})),getPopupContainer:e=>e.parentElement||document.body,maxTagCount:"responsive",maxTagPlaceholder:e=>(0,t.jsx)(a.Tooltip,{styles:{root:{pointerEvents:"none"}},title:e.map(({value:e})=>e).join(", "),children:(0,t.jsxs)("span",{children:["+",e.length," more"]})})}),e.fallbackModels.length>1&&(0,t.jsx)("div",{className:"text-[10px] text-gray-400 mt-1 ml-1",children:"Tried in order; first model still within its own budget is used"})]})]},e.id)}),(0,t.jsx)(s.Button,{size:"small",onClick:g,icon:(0,t.jsx)(i.Plus,{className:"w-3 h-3"}),children:"Add Budget Fallback"})]})}],128233);var d=e.i(28651);let c=[{value:"1h",label:"Hourly",resetHint:"Resets every hour"},{value:"24h",label:"Daily",resetHint:"Resets daily at midnight UTC"},{value:"7d",label:"Weekly",resetHint:"Resets every Sunday at midnight UTC"},{value:"30d",label:"Monthly",resetHint:"Resets on the 1st of every month at midnight UTC"}];e.s(["BudgetWindowsEditor",0,function({value:e,onChange:a}){let r=(t,s,l)=>{a(e.map((e,a)=>a===t?{...e,[s]:l}:e))};return(0,t.jsxs)("div",{children:[e.map((i,n)=>{let o=c.find(e=>e.value===i.budget_duration)?.resetHint;return(0,t.jsxs)("div",{style:{marginBottom:12},children:[(0,t.jsxs)("div",{style:{display:"flex",gap:8,alignItems:"center"},children:[(0,t.jsx)(l.Select,{value:i.budget_duration,onChange:e=>r(n,"budget_duration",e),style:{width:130},options:c.map(e=>({value:e.value,label:e.label}))}),(0,t.jsx)(d.InputNumber,{step:.01,min:0,precision:2,value:i.max_budget??void 0,onChange:e=>r(n,"max_budget",e??null),placeholder:"Max spend ($)",style:{width:160},prefix:"$"}),(0,t.jsx)(s.Button,{type:"text",danger:!0,size:"small",onClick:()=>{a(e.filter((e,t)=>t!==n))},style:{padding:"0 4px"},children:"✕"})]}),o&&(0,t.jsxs)("div",{style:{fontSize:11,color:"#888",marginTop:3,marginLeft:2},children:["↻ ",o]})]},n)}),(0,t.jsx)(s.Button,{size:"small",onClick:t=>{t.preventDefault(),a([...e,{budget_duration:"24h",max_budget:null}])},children:"+ Add Budget Window"})]})}],319312)},390605,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(602869),a=e.i(599724),r=e.i(482725),i=e.i(91739),n=e.i(500727),o=e.i(531516),d=e.i(696609);e.s(["default",0,({accessToken:e,selectedServers:c,toolPermissions:u,onChange:m,disabled:p=!1})=>{let{data:g=[]}=(0,n.useMCPServers)(),[h,x]=(0,s.useState)({}),[y,f]=(0,s.useState)({}),[b,_]=(0,s.useState)({}),[j,v]=(0,s.useState)({}),w=(0,s.useRef)(u);(0,s.useEffect)(()=>{w.current=u},[u]);let N=(0,s.useMemo)(()=>0===c.length?[]:g.filter(e=>c.includes(e.server_id)),[g,c]),k=async(e,t)=>{f(t=>({...t,[e]:!0})),_(t=>({...t,[e]:""}));try{let s=await (0,l.listMCPTools)(t,e);if(s.error)_(t=>({...t,[e]:s.message||"Failed to fetch tools"})),x(t=>({...t,[e]:[]}));else{let t=s.tools||[];x(s=>({...s,[e]:t}));let l=w.current;if(!l[e]&&t.length>0){let s=t.filter(e=>"delete"!==(0,d.classifyToolOp)(e.name,e.description||"")).map(e=>e.name);m({...l,[e]:s})}}}catch(t){console.error(`Error fetching tools for server ${e}:`,t),_(t=>({...t,[e]:"Failed to fetch tools"})),x(t=>({...t,[e]:[]}))}finally{f(t=>({...t,[e]:!1}))}};(0,s.useEffect)(()=>{N.forEach(t=>{h[t.server_id]||y[t.server_id]||k(t.server_id,e)})},[N,e]);let S=(e,t)=>{m({...u,[e]:t})};return 0===c.length?null:(0,t.jsx)("div",{className:"space-y-4",children:N.map(e=>{let s=e.server_name||e.alias||e.server_id,l=h[e.server_id]||[],n=u[e.server_id]||[],d=y[e.server_id],c=b[e.server_id],g=j[e.server_id]??"crud";return(0,t.jsxs)("div",{className:"border rounded-lg bg-gray-50",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between p-4 border-b bg-white rounded-t-lg",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(a.Text,{className:"font-semibold text-gray-900",children:s}),e.description&&(0,t.jsx)(a.Text,{className:"text-sm text-gray-500",children:e.description})]}),(0,t.jsxs)("div",{className:"flex items-center gap-3",children:[!p&&l.length>0&&(0,t.jsx)(i.Radio.Group,{value:g,onChange:t=>v(s=>({...s,[e.server_id]:t.target.value})),size:"small",optionType:"button",buttonStyle:"solid",options:[{label:"Risk Groups",value:"crud"},{label:"Flat List",value:"flat"}]}),!p&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("button",{type:"button",className:"text-sm text-blue-600 hover:text-blue-700 font-medium",onClick:()=>{var t;let s;return s=h[t=e.server_id]||[],void m({...u,[t]:s.map(e=>e.name)})},disabled:d,children:"Select All"}),(0,t.jsx)("button",{type:"button",className:"text-sm text-blue-600 hover:text-blue-700 font-medium",onClick:()=>{var t;return t=e.server_id,void m({...u,[t]:[]})},disabled:d,children:"Deselect All"})]})]})]}),(0,t.jsxs)("div",{className:"p-4",children:[d&&(0,t.jsxs)("div",{className:"flex items-center justify-center py-8",children:[(0,t.jsx)(r.Spin,{size:"large"}),(0,t.jsx)(a.Text,{className:"ml-3 text-gray-500",children:"Loading tools..."})]}),c&&!d&&(0,t.jsxs)("div",{className:"p-4 bg-red-50 border border-red-200 rounded-lg text-center",children:[(0,t.jsx)(a.Text,{className:"text-red-600 font-medium",children:"Unable to load tools"}),(0,t.jsx)(a.Text,{className:"text-sm text-red-500 mt-1",children:c})]}),!d&&!c&&l.length>0&&"crud"===g&&(0,t.jsx)(o.default,{tools:l,value:u[e.server_id]?n:void 0,onChange:t=>S(e.server_id,t),readOnly:p}),!d&&!c&&l.length>0&&"flat"===g&&(0,t.jsx)("div",{className:"space-y-2",children:l.map(s=>{let l=n.includes(s.name);return(0,t.jsxs)("div",{className:"flex items-start gap-2",children:[(0,t.jsx)("input",{type:"checkbox",checked:l,onChange:()=>{if(p)return;let t=l?n.filter(e=>e!==s.name):[...n,s.name];S(e.server_id,t)},disabled:p,className:"mt-0.5"}),(0,t.jsx)("div",{className:"flex-1 min-w-0",children:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(a.Text,{className:"font-medium text-gray-900",children:s.name}),(0,t.jsxs)(a.Text,{className:"text-sm text-gray-500",children:["- ",s.description||"No description"]})]})})]},s.name)})}),!d&&!c&&0===l.length&&(0,t.jsx)("div",{className:"text-center py-6",children:(0,t.jsx)(a.Text,{className:"text-gray-500",children:"No tools available"})})]})]},e.server_id)})})}])},364769,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(237016),a=e.i(464571),r=e.i(888259);e.s(["default",0,({apiKey:e})=>{let[i,n]=(0,s.useState)(!1);return(0,t.jsxs)("div",{children:[(0,t.jsxs)("p",{className:"mb-2",children:["Please save this secret key somewhere safe and accessible. For security reasons,"," ",(0,t.jsx)("b",{children:"you will not be able to view it again"})," through your LiteLLM account. If you lose this secret key, you will need to generate a new one."]}),(0,t.jsx)("p",{className:"text-sm text-gray-600 mt-3 mb-1",children:"Virtual Key:"}),(0,t.jsx)("div",{style:{background:"#f8f8f8",padding:"10px",borderRadius:"5px",marginBottom:"10px"},children:(0,t.jsx)("pre",{style:{wordWrap:"break-word",whiteSpace:"normal",margin:0},children:e})}),(0,t.jsx)(l.CopyToClipboard,{text:e,onCopy:()=>{n(!0),r.default.success("Key copied to clipboard"),setTimeout(()=>n(!1),2e3)},children:(0,t.jsx)(a.Button,{type:"primary",style:{marginTop:12},children:i?"Copied!":"Copy Virtual Key"})})]})}])},702597,e=>{"use strict";var t=e.i(843476),s=e.i(207082),l=e.i(109799),a=e.i(510674),r=e.i(109034),i=e.i(292639),n=e.i(135214),o=e.i(500330),d=e.i(827252),c=e.i(912598),u=e.i(677667),m=e.i(130643),p=e.i(898667),g=e.i(994388),h=e.i(309426),x=e.i(350967),y=e.i(599724),f=e.i(779241),b=e.i(629569),_=e.i(464571),j=e.i(808613),v=e.i(311451),w=e.i(212931),N=e.i(91739),k=e.i(199133),S=e.i(790848),C=e.i(262218),T=e.i(592968),I=e.i(898586),A=e.i(374009),L=e.i(271645),F=e.i(708347),M=e.i(552130),O=e.i(557662),E=e.i(9314),P=e.i(860585),B=e.i(82946),$=e.i(392110),R=e.i(533882),D=e.i(844565),V=e.i(651904),z=e.i(939510),U=e.i(460285),G=e.i(663435),K=e.i(363256),q=e.i(575260),W=e.i(371455),H=e.i(128233),Q=e.i(319312),J=e.i(355619),Y=e.i(75921),X=e.i(234713),Z=e.i(390605),ee=e.i(727749),et=e.i(602869),es=e.i(364769),el=e.i(435451),ea=e.i(916940);let{Option:er}=k.Select,ei=async(e,t,s,l)=>{try{if(null===e||null===t)return[];if(null!==s)return(await (0,et.modelAvailableCall)(s,e,t,!0,l,!0)).data.map(e=>e.id);return[]}catch(e){return console.error("Error fetching user models:",e),[]}},en=async(e,t,s,l)=>{try{if(null===e||null===t)return;if(null!==s){let a=(await (0,et.modelAvailableCall)(s,e,t)).data.map(e=>e.id);l(a)}}catch(e){console.error("Error fetching user models:",e)}};e.s(["default",0,({team:e,teams:eo,data:ed,addKey:ec,autoOpenCreate:eu,prefillData:em})=>{let{accessToken:ep,userId:eg,userRole:eh,premiumUser:ex}=(0,n.default)(),ey=ex||null!=eh&&F.rolesWithWriteAccess.includes(eh),{data:ef,isLoading:eb}=(0,l.useOrganizations)(),{data:e_,isLoading:ej}=(0,a.useProjects)(),{data:ev}=(0,i.useUISettings)(),{data:ew}=(0,r.useTags)(),eN=!!ev?.values?.enable_projects_ui,ek=!!ev?.values?.disable_custom_api_keys,eS=ew?Object.values(ew).map(e=>({value:e.name,label:e.name})):[],eC=(0,c.useQueryClient)(),[eT]=j.Form.useForm(),[eI,eA]=(0,L.useState)(!1),[eL,eF]=(0,L.useState)(null),[eM,eO]=(0,L.useState)(null),[eE,eP]=(0,L.useState)([]),[eB,e$]=(0,L.useState)([]),[eR,eD]=(0,L.useState)("you"),[eV,ez]=(0,L.useState)(!1),[eU,eG]=(0,L.useState)(null),[eK,eq]=(0,L.useState)([]),[eW,eH]=(0,L.useState)([]),[eQ,eJ]=(0,L.useState)([]),[eY,eX]=(0,L.useState)([]),[eZ,e0]=(0,L.useState)(e),[e1,e2]=(0,L.useState)(null),[e4,e3]=(0,L.useState)(null),[e5,e6]=(0,L.useState)(!1),[e7,e9]=(0,L.useState)(null),[e8,te]=(0,L.useState)({}),[tt,ts]=(0,L.useState)([]),[tl,ta]=(0,L.useState)(!1),[tr,ti]=(0,L.useState)([]),[tn,to]=(0,L.useState)([]),[td,tc]=(0,L.useState)("llm_api"),[tu,tm]=(0,L.useState)({}),[tp,tg]=(0,L.useState)(!1),[th,tx]=(0,L.useState)("30d"),[ty,tf]=(0,L.useState)(null),[tb,t_]=(0,L.useState)([]),[tj,tv]=(0,L.useState)({}),[tw,tN]=(0,L.useState)(0),[tk,tS]=(0,L.useState)(0),[tC,tT]=(0,L.useState)([]),[tI,tA]=(0,L.useState)(null),tL=()=>{eA(!1),eT.resetFields(),eX([]),to([]),tc("llm_api"),tm({}),tg(!1),tx("30d"),tf(null),tS(e=>e+1),tA(null),e2(null),e3(null),t_([]),tv({}),tN(e=>e+1)},tF=()=>{eA(!1),eF(null),e0(null),eT.resetFields(),eX([]),to([]),tc("llm_api"),tm({}),tg(!1),tx("30d"),tf(null),tS(e=>e+1),tA(null),e2(null),e3(null),t_([]),tv({}),tN(e=>e+1)};(0,L.useEffect)(()=>{eg&&eh&&ep&&en(eg,eh,ep,eP)},[ep,eg,eh]),(0,L.useEffect)(()=>{ep&&(0,et.getAgentsList)(ep).then(e=>tT(e?.agents||[])).catch(()=>tT([]))},[ep]),(0,L.useEffect)(()=>{let e=async()=>{try{let e=(await (0,et.getPoliciesList)(ep)).policies.map(e=>e.policy_name);eH(e)}catch(e){console.error("Failed to fetch policies:",e)}},t=async()=>{try{let e=await (0,et.getPromptsList)(ep);eJ(e.prompts.map(e=>e.prompt_id))}catch(e){console.error("Failed to fetch prompts:",e)}};(async()=>{try{let e=(await (0,et.getGuardrailsList)(ep)).guardrails.map(e=>e.guardrail_name);eq(e)}catch(e){console.error("Failed to fetch guardrails:",e)}})(),e(),t()},[ep]),(0,L.useEffect)(()=>{(async()=>{try{if(ep){let e=sessionStorage.getItem("possibleUserRoles");if(e)te(JSON.parse(e));else{let e=await (0,et.getPossibleUserRoles)(ep);sessionStorage.setItem("possibleUserRoles",JSON.stringify(e)),te(e)}}}catch(e){console.error("Error fetching possible user roles:",e)}})()},[ep]),(0,L.useEffect)(()=>{if(eu&&!eV&&eo&&eh&&F.rolesWithWriteAccess.includes(eh)&&(eA(!0),ez(!0),em)){if(em.owned_by&&("another_user"===em.owned_by&&"Admin"!==eh?eD("you"):eD(em.owned_by)),em.team_id){let e=eo?.find(e=>e.team_id===em.team_id)||null;e&&(e0(e),eT.setFieldsValue({team_id:em.team_id}))}em.key_alias&&eT.setFieldsValue({key_alias:em.key_alias}),em.models&&em.models.length>0&&eG(em.models),em.key_type&&(tc(em.key_type),eT.setFieldsValue({key_type:em.key_type}))}},[eu,em,eo,eV,eT,eh]);let tM=eB.includes("no-default-models")&&!eZ,tO=async e=>{try{let t,l=e?.key_alias??"",a=e?.team_id??null;if((ed?.filter(e=>e.team_id===a).map(e=>e.key_alias)??[]).includes(l))throw Error(`Key alias ${l} already exists for team with ID ${a}, please provide another key alias`);if(ee.default.info("Making API Call"),eA(!0),"you"===eR)e.user_id=eg;else if("agent"===eR){if(!tI)return void ee.default.fromBackend("Please select an agent");e.agent_id=tI}let r={};try{r=JSON.parse(e.metadata||"{}")}catch(e){console.error("Error parsing metadata:",e)}if("service_account"===eR&&(r.service_account_id=e.key_alias),eY.length>0&&(r={...r,logging:eY.filter(e=>e.callback_name)}),tn.length>0){let e=(0,O.mapDisplayToInternalNames)(tn);r={...r,litellm_disabled_callbacks:e}}if(tp&&(e.auto_rotate=!0,e.rotation_interval=th),e.duration&&""!==e.duration.trim()||(e.duration=null),e.metadata=JSON.stringify(r),e.disable_global_guardrails||delete e.disable_global_guardrails,e.allowed_vector_store_ids&&e.allowed_vector_store_ids.length>0&&(e.object_permission={vector_stores:e.allowed_vector_store_ids},delete e.allowed_vector_store_ids),e.allowed_mcp_servers_and_groups&&(e.allowed_mcp_servers_and_groups.servers?.length>0||e.allowed_mcp_servers_and_groups.accessGroups?.length>0)){e.object_permission||(e.object_permission={});let{servers:t,accessGroups:s}=e.allowed_mcp_servers_and_groups;t&&t.length>0&&(e.object_permission.mcp_servers=t),s&&s.length>0&&(e.object_permission.mcp_access_groups=s),delete e.allowed_mcp_servers_and_groups}let i=e.mcp_tool_permissions||{};if(Object.keys(i).length>0&&(e.object_permission||(e.object_permission={}),e.object_permission.mcp_tool_permissions=i),delete e.mcp_tool_permissions,e.allowed_mcp_access_groups&&e.allowed_mcp_access_groups.length>0&&(e.object_permission||(e.object_permission={}),e.object_permission.mcp_access_groups=e.allowed_mcp_access_groups,delete e.allowed_mcp_access_groups),e.allowed_agents_and_groups&&(e.allowed_agents_and_groups.agents?.length>0||e.allowed_agents_and_groups.accessGroups?.length>0)){e.object_permission||(e.object_permission={});let{agents:t,accessGroups:s}=e.allowed_agents_and_groups;t&&t.length>0&&(e.object_permission.agents=t),s&&s.length>0&&(e.object_permission.agent_access_groups=s),delete e.allowed_agents_and_groups}Object.keys(tu).length>0&&(e.aliases=JSON.stringify(tu)),ty?.router_settings&&Object.values(ty.router_settings).some(e=>null!=e&&""!==e)&&(e.router_settings=ty.router_settings);let n=tb.filter(e=>e.budget_duration&&null!==e.max_budget&&void 0!==e.max_budget);n.length>0&&(e.budget_limits=n),Object.keys(tj).length>0&&(e.budget_fallbacks=tj),t="service_account"===eR?await (0,et.keyCreateServiceAccountCall)(ep,e):await (0,et.keyCreateCall)(ep,eg,e),ec(t),eC.invalidateQueries({queryKey:s.keyKeys.lists()}),eF(t.key),eO(t.soft_budget),ee.default.success("Virtual Key Created"),eT.resetFields(),t_([]),tv({}),tN(e=>e+1),localStorage.removeItem("userData"+eg)}catch(t){let e=(e=>{let t;if(!(t=!e||"object"!=typeof e||e instanceof Error?String(e):JSON.stringify(e)).includes("/key/generate")&&!t.includes("KeyManagementRoutes.KEY_GENERATE"))return`Error creating the key: ${e}`;let s=t;try{if(!e||"object"!=typeof e||e instanceof Error){let e=t.match(/\{[\s\S]*\}/);if(e){let t=JSON.parse(e[0]),l=t?.error||t;l?.message&&(s=l.message)}}else{let t=e?.error||e;t?.message&&(s=t.message)}}catch(e){}return t.includes("team_member_permission_error")||s.includes("Team member does not have permissions")?"Team member does not have permission to generate key for this team. Ask your proxy admin to configure the team member permission settings.":`Error creating the key: ${e}`})(t);ee.default.fromBackend(e)}};(0,L.useEffect)(()=>{if(e4){let e=e_?.find(e=>e.project_id===e4);e$(e?.models??[]),eT.setFieldValue("models",[]);return}eg&&eh&&ep&&ei(eg,eh,ep,eZ?.team_id??null).then(e=>{e$(Array.from(new Set([...eZ?.models??[],...e])))}),eU||eT.setFieldValue("models",[]),eT.setFieldValue("allowed_mcp_servers_and_groups",{servers:[],accessGroups:[]})},[eZ,e4,ep,eg,eh,eT]),(0,L.useEffect)(()=>{if(!eU||0===eU.length||!eB||0===eB.length)return;let e=eU.filter(e=>eB.includes(e));e.length>0&&eT.setFieldsValue({models:e}),eG(null)},[eU,eB,eT]),(0,L.useEffect)(()=>{if(!e4||!eo)return;let e=e_?.find(e=>e.project_id===e4);if(!e?.team_id||eZ?.team_id===e.team_id)return;let t=eo.find(t=>t.team_id===e.team_id)||null;t&&(e0(t),eT.setFieldValue("team_id",t.team_id))},[eo,e4,e_]);let tE=async e=>{if(!e)return void ts([]);ta(!0);try{let t=new URLSearchParams;if(t.append("user_email",e),null==ep)return;let s=(await (0,et.userFilterUICall)(ep,t)).map(e=>({label:`${e.user_email} (${e.user_id})`,value:e.user_id,user:e}));ts(s)}catch(e){console.error("Error fetching users:",e),ee.default.fromBackend("Failed to search for users")}finally{ta(!1)}},tP=(0,L.useCallback)((0,A.default)(e=>tE(e),300),[ep]);return(0,t.jsxs)("div",{children:[eh&&F.rolesWithWriteAccess.includes(eh)&&(0,t.jsx)(g.Button,{className:"mx-auto",onClick:()=>eA(!0),"data-testid":"create-key-button",children:"+ Create New Key"}),(0,t.jsx)(w.Modal,{open:eI,width:1e3,footer:null,onOk:tL,onCancel:tF,children:(0,t.jsxs)(j.Form,{form:eT,onFinish:tO,labelCol:{span:8},wrapperCol:{span:16},labelAlign:"left",children:[(0,t.jsxs)("div",{className:"mb-8",children:[(0,t.jsx)(b.Title,{className:"mb-4",children:"Key Ownership"}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Owned By"," ",(0,t.jsx)(T.Tooltip,{title:"Select who will own this Virtual Key",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),className:"mb-4",children:(0,t.jsxs)(N.Radio.Group,{onChange:e=>eD(e.target.value),value:eR,children:[(0,t.jsx)(N.Radio,{value:"you",children:"You"}),(0,t.jsx)(N.Radio,{value:"service_account",children:"Service Account"}),"Admin"===eh&&(0,t.jsx)(N.Radio,{value:"another_user",children:"Another User"}),(0,t.jsxs)(N.Radio,{value:"agent",children:["Agent ",(0,t.jsx)(C.Tag,{color:"purple",children:"New"})]})]})}),"another_user"===eR&&(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["User ID"," ",(0,t.jsx)(T.Tooltip,{title:"The user who will own this key and be responsible for its usage",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"user_id",className:"mt-4",rules:[{required:"another_user"===eR,message:"Please input the user ID of the user you are assigning the key to"}],children:(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{style:{display:"flex",marginBottom:"8px"},children:[(0,t.jsx)(k.Select,{showSearch:!0,placeholder:"Type email to search for users",filterOption:!1,onSearch:e=>{tP(e)},onSelect:(e,t)=>{let s;return s=t.user,void eT.setFieldsValue({user_id:s.user_id})},options:tt,loading:tl,allowClear:!0,style:{width:"100%"},notFoundContent:tl?"Searching...":"No users found"}),(0,t.jsx)(_.Button,{onClick:()=>e6(!0),style:{marginLeft:"8px"},children:"Create User"})]}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Search by email to find users"})]})}),"agent"===eR&&(0,t.jsxs)("div",{className:"mt-4 p-4 bg-purple-50 border border-purple-200 rounded-md",children:[(0,t.jsx)("div",{className:"mb-3",children:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700",children:["Select Agent ",(0,t.jsx)("span",{className:"text-red-500",children:"*"})]})}),(0,t.jsx)(k.Select,{showSearch:!0,placeholder:"Select an agent",style:{width:"100%"},value:tI,onChange:e=>tA(e),filterOption:(e,t)=>t?.label?.toLowerCase().includes(e.toLowerCase()),options:tC.map(e=>({label:e.agent_name||e.agent_id,value:e.agent_id}))}),(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-2",children:"This key will be used by the selected agent to make requests to LiteLLM"})]}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Organization"," ",(0,t.jsx)(T.Tooltip,{title:"The organization this key belongs to. Selecting an organization filters the available teams.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"organization_id",className:"mt-4",children:(0,t.jsx)(K.default,{organizations:ef,loading:eb,disabled:"Admin"!==eh,onChange:e=>{e2(e||null),e0(null),e3(null),eT.setFieldValue("team_id",void 0),eT.setFieldValue("project_id",void 0)}})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Team"," ",(0,t.jsx)(T.Tooltip,{title:"The team this key belongs to, which determines available models and budget limits",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"team_id",initialValue:e?e.team_id:null,className:"mt-4",rules:[{required:"service_account"===eR,message:"Please select a team for the service account"}],help:"service_account"===eR?"required":"",children:(0,t.jsx)(G.default,{disabled:null!==e4,organizationId:e1,onTeamSelect:e=>{e0(e),e3(null),eT.setFieldValue("project_id",void 0),e?.organization_id?(e2(e.organization_id),eT.setFieldValue("organization_id",e.organization_id)):e||(e2(null),eT.setFieldValue("organization_id",void 0))}})}),eN&&(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Project"," ",(0,t.jsx)(T.Tooltip,{title:"Assign this key to a project. Selecting a project will lock the team to the project's team.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"project_id",className:"mt-4",children:(0,t.jsx)(q.default,{projects:e_,teamId:eZ?.team_id,loading:ej||!eo,onChange:e=>{if(!e){e3(null),e0(null),eT.setFieldValue("team_id",void 0);return}e3(e)}})})]}),tM&&(0,t.jsx)("div",{className:"mb-8 p-4 bg-blue-50 border border-blue-200 rounded-md",children:(0,t.jsx)(y.Text,{className:"text-blue-800 text-sm",children:"Please select a team to continue configuring your Virtual Key. If you do not see any teams, please contact your Proxy Admin to either provide you with access to models or to add you to a team."})}),!tM&&(0,t.jsxs)("div",{className:"mb-8",children:[(0,t.jsx)(b.Title,{className:"mb-4",children:"Key Details"}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["you"===eR||"another_user"===eR?"Key Name":"Service Account ID"," ",(0,t.jsx)(T.Tooltip,{title:"you"===eR||"another_user"===eR?"A descriptive name to identify this key":"Unique identifier for this service account",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"key_alias",rules:[{required:!0,message:`Please input a ${"you"===eR?"key name":"service account ID"}`}],help:"required",children:(0,t.jsx)(f.TextInput,{placeholder:""})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Models"," ",(0,t.jsx)(T.Tooltip,{title:"Select which models this key can access. Choose 'All Team Models' to grant access to all models available to the team. Leave empty to allow access to all models.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"models",rules:[],help:"management"===td||"read_only"===td?"Models field is disabled for this key type":"optional - leave empty to allow access to all models",className:"mt-4",children:(0,t.jsxs)(k.Select,{mode:"multiple",placeholder:"Select models",style:{width:"100%"},disabled:"management"===td||"read_only"===td,onChange:e=>{e.includes("all-team-models")&&eT.setFieldsValue({models:["all-team-models"]})},children:[!e4&&(0,t.jsx)(er,{value:"all-team-models",children:"All Team Models"},"all-team-models"),eB.map(e=>(0,t.jsx)(er,{value:e,children:(0,J.getModelDisplayName)(e)},e))]})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Key Type"," ",(0,t.jsx)(T.Tooltip,{title:"Select the type of key to determine what routes and operations this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"key_type",initialValue:"llm_api",className:"mt-4",children:(0,t.jsxs)(k.Select,{defaultValue:"llm_api",placeholder:"Select key type",style:{width:"100%"},optionLabelProp:"label",onChange:e=>{tc(e),("management"===e||"read_only"===e)&&eT.setFieldsValue({models:[]})},children:[(0,t.jsx)(er,{value:"llm_api",label:"AI APIs",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"AI APIs"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call only AI API routes (chat/completions, embeddings, etc.)"})]})}),(0,t.jsx)(er,{value:"management",label:"Management",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"Management"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call only management routes (user/team/key management)"})]})}),(0,t.jsx)(er,{value:"default",label:"Full Access",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"Full Access"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call all routes (AI APIs, Management, and read-only)"})]})})]})})]}),!tM&&(0,t.jsx)("div",{className:"mb-8",children:(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)(b.Title,{className:"m-0",children:"Optional Settings"})}),(0,t.jsxs)(m.AccordionBody,{children:[(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Max Budget (USD)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum amount in USD this key can spend. When reached, the key will be blocked from making further requests",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"max_budget",help:`Budget cannot exceed team max budget: $${e?.max_budget!==null&&e?.max_budget!==void 0?e?.max_budget:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.max_budget&&s>e.max_budget)throw Error(`Budget cannot exceed team max budget: $${(0,o.formatNumberWithCommas)(e.max_budget,4)}`)}}],children:(0,t.jsx)(el.default,{step:.01,precision:2,width:200})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Reset Budget"," ",(0,t.jsx)(T.Tooltip,{title:"How often the budget should reset. For example, setting 'daily' will reset the budget every 24 hours",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"budget_duration",help:`Team Reset Budget: ${e?.budget_duration!==null&&e?.budget_duration!==void 0?e?.budget_duration:"None"}`,children:(0,t.jsx)(P.default,{onChange:e=>eT.setFieldValue("budget_duration",e)})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Budget Windows"," ",(0,t.jsx)(T.Tooltip,{title:"Set multiple independent budget windows (e.g., hourly $10 AND monthly $200). Each window tracks spend separately and resets on its own schedule.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)(Q.BudgetWindowsEditor,{value:tb,onChange:t_})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Budget Fallbacks"," ",(0,t.jsx)(T.Tooltip,{title:"When a model exceeds its per-model budget (model_max_budget), requests automatically reroute to fallback models instead of failing. Configure per-model budgets in Advanced Settings.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)(H.BudgetFallbacksEditor,{value:tj,onChange:tv,availableModels:eB},tw)}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Tokens per minute Limit (TPM)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum number of tokens this key can process per minute. Helps control usage and costs",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"tpm_limit",help:`TPM cannot exceed team TPM limit: ${e?.tpm_limit!==null&&e?.tpm_limit!==void 0?e?.tpm_limit:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.tpm_limit&&s>e.tpm_limit)throw Error(`TPM limit cannot exceed team TPM limit: ${e.tpm_limit}`)}}],children:(0,t.jsx)(el.default,{step:1,width:400})}),(0,t.jsx)(z.default,{type:"tpm",name:"tpm_limit_type",className:"mt-4",initialValue:null,form:eT,showDetailedDescriptions:!0}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Requests per minute Limit (RPM)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum number of API requests this key can make per minute. Helps prevent abuse and manage load",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"rpm_limit",help:`RPM cannot exceed team RPM limit: ${e?.rpm_limit!==null&&e?.rpm_limit!==void 0?e?.rpm_limit:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.rpm_limit&&s>e.rpm_limit)throw Error(`RPM limit cannot exceed team RPM limit: ${e.rpm_limit}`)}}],children:(0,t.jsx)(el.default,{step:1,width:400})}),(0,t.jsx)(z.default,{type:"rpm",name:"rpm_limit_type",className:"mt-4",initialValue:null,form:eT,showDetailedDescriptions:!0}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Guardrails"," ",(0,t.jsx)(T.Tooltip,{title:"Apply safety guardrails to this key to filter content or enforce policies",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"guardrails",className:"mt-4",help:ey?"Select existing guardrails or enter new ones":"Premium feature - Upgrade to set guardrails by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ey,placeholder:ey?"Select or enter guardrails":"Premium feature - Upgrade to set guardrails by key",options:eK.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Disable Global Guardrails"," ",(0,t.jsx)(T.Tooltip,{title:"When enabled, this key will bypass any guardrails configured to run on every request (global guardrails)",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"disable_global_guardrails",className:"mt-4",valuePropName:"checked",help:ey?"Bypass global guardrails for this key":"Premium feature - Upgrade to disable global guardrails by key",children:(0,t.jsx)(S.Switch,{disabled:!ey,checkedChildren:"Yes",unCheckedChildren:"No"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Policies"," ",(0,t.jsx)(T.Tooltip,{title:"Apply policies to this key to control guardrails and other settings",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"policies",className:"mt-4",help:ex?"Select existing policies or enter new ones":"Premium feature - Upgrade to set policies by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ex,placeholder:ex?"Select or enter policies":"Premium feature - Upgrade to set policies by key",options:eW.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Prompts"," ",(0,t.jsx)(T.Tooltip,{title:"Allow this key to use specific prompt templates",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/prompt_management",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"prompts",className:"mt-4",help:ex?"Select existing prompts or enter new ones":"Premium feature - Upgrade to set prompts by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ex,placeholder:ex?"Select or enter prompts":"Premium feature - Upgrade to set prompts by key",options:eQ.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Access Groups"," ",(0,t.jsx)(T.Tooltip,{title:"Assign access groups to this key. Access groups control which models, MCP servers, and agents this key can use",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"access_group_ids",className:"mt-4",help:"Select access groups to assign to this key",children:(0,t.jsx)(E.default,{placeholder:"Select access groups (optional)"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Pass Through Routes"," ",(0,t.jsx)(T.Tooltip,{title:"Allow this key to use specific pass through routes",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/pass_through",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"allowed_passthrough_routes",className:"mt-4",help:ex?"Select existing pass through routes or enter new ones":"Premium feature - Upgrade to set pass through routes by key",children:(0,t.jsx)(D.default,{onChange:e=>eT.setFieldValue("allowed_passthrough_routes",e),value:eT.getFieldValue("allowed_passthrough_routes"),accessToken:ep,placeholder:ex?"Select or enter pass through routes":"Premium feature - Upgrade to set pass through routes by key",disabled:!ex,teamId:eZ?eZ.team_id:null})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Vector Stores"," ",(0,t.jsx)(T.Tooltip,{title:"Select which vector stores this key can access. If none selected, the key will have access to all available vector stores",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_vector_store_ids",className:"mt-4",help:"Select vector stores this key can access. Leave empty for access to all vector stores",children:(0,t.jsx)(ea.default,{onChange:e=>eT.setFieldValue("allowed_vector_store_ids",e),value:eT.getFieldValue("allowed_vector_store_ids"),accessToken:ep,placeholder:"Select vector stores (optional)"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Metadata"," ",(0,t.jsx)(T.Tooltip,{title:"JSON object with additional information about this key. Used for tracking or custom logic",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"metadata",className:"mt-4",children:(0,t.jsx)(v.Input.TextArea,{rows:4,placeholder:"Enter metadata as JSON"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Tags"," ",(0,t.jsx)(T.Tooltip,{title:"Tags for tracking spend and/or doing tag-based routing. Used for analytics and filtering",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"tags",className:"mt-4",help:"Tags for tracking spend and/or doing tag-based routing.",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},placeholder:"Select or enter tags",tokenSeparators:[","],options:eS})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"MCP Settings"})}),(0,t.jsxs)(m.AccordionBody,{children:[(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed MCP Servers"," ",(0,t.jsx)(T.Tooltip,{title:"Select which MCP servers or access groups this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_mcp_servers_and_groups",help:"Select MCP servers or access groups this key can access",children:(0,t.jsx)(Y.default,{onChange:e=>eT.setFieldValue("allowed_mcp_servers_and_groups",e),value:eT.getFieldValue("allowed_mcp_servers_and_groups"),accessToken:ep,teamId:eZ?.team_id??null,placeholder:"Select MCP servers or access groups (optional)",allowNoMcpServers:!0})}),(0,t.jsx)(j.Form.Item,{name:"mcp_tool_permissions",initialValue:{},hidden:!0,children:(0,t.jsx)(v.Input,{type:"hidden"})}),(0,t.jsx)(j.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.allowed_mcp_servers_and_groups!==t.allowed_mcp_servers_and_groups||e.mcp_tool_permissions!==t.mcp_tool_permissions,children:()=>(0,t.jsx)("div",{className:"mt-6",children:(0,t.jsx)(Z.default,{accessToken:ep,selectedServers:(eT.getFieldValue("allowed_mcp_servers_and_groups")?.servers||[]).filter(e=>e!==X.NO_MCP_SERVERS_SENTINEL),toolPermissions:eT.getFieldValue("mcp_tool_permissions")||{},onChange:e=>eT.setFieldsValue({mcp_tool_permissions:e})})})})]})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Agent Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Agents"," ",(0,t.jsx)(T.Tooltip,{title:"Select which agents or access groups this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_agents_and_groups",help:"Select agents or access groups this key can access",children:(0,t.jsx)(M.default,{onChange:e=>eT.setFieldValue("allowed_agents_and_groups",e),value:eT.getFieldValue("allowed_agents_and_groups"),accessToken:ep,placeholder:"Select agents or access groups (optional)"})})})]}),ex?(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Logging Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(V.default,{value:eY,onChange:eX,premiumUser:!0,disabledCallbacks:tn,onDisabledCallbacksChange:to})})})]}):(0,t.jsx)(T.Tooltip,{title:(0,t.jsxs)("span",{children:["Key-level logging settings is an enterprise feature, get in touch -",(0,t.jsx)("a",{href:"https://www.litellm.ai/enterprise",target:"_blank",children:"https://www.litellm.ai/enterprise"})]}),placement:"top",children:(0,t.jsxs)("div",{style:{position:"relative"},children:[(0,t.jsx)("div",{style:{opacity:.5},children:(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Logging Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(V.default,{value:eY,onChange:eX,premiumUser:!1,disabledCallbacks:tn,onDisabledCallbacksChange:to})})})]})}),(0,t.jsx)("div",{style:{position:"absolute",inset:0,cursor:"not-allowed"}})]})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Router Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4 w-full",children:(0,t.jsx)(U.default,{accessToken:ep||"",value:ty||void 0,onChange:tf,modelData:eE.length>0?{data:eE.map(e=>({model_name:e}))}:void 0},tk)})})]},`router-settings-accordion-${tk}`),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Model Aliases"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsx)(y.Text,{className:"text-sm text-gray-600 mb-4",children:"Create custom aliases for models that can be used in API calls. This allows you to create shortcuts for specific models."}),(0,t.jsx)(R.default,{accessToken:ep,initialModelAliases:tu,onAliasUpdate:tm,showExampleConfig:!1})]})})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Key Lifecycle"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)($.default,{form:eT,autoRotationEnabled:tp,onAutoRotationChange:tg,rotationInterval:th,onRotationIntervalChange:tx,isCreateMode:!0})})}),(0,t.jsx)(j.Form.Item,{name:"duration",hidden:!0,initialValue:null,children:(0,t.jsx)(v.Input,{})})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)("b",{children:"Advanced Settings"}),(0,t.jsx)(T.Tooltip,{title:(0,t.jsxs)("span",{children:["Learn more about advanced settings in our"," ",(0,t.jsx)("a",{href:et.proxyBaseUrl?`${et.proxyBaseUrl}/#/key%20management/generate_key_fn_key_generate_post`:"/#/key%20management/generate_key_fn_key_generate_post",target:"_blank",rel:"noopener noreferrer",className:"text-blue-400 hover:text-blue-300",children:"documentation"})]}),children:(0,t.jsx)(d.InfoCircleOutlined,{className:"text-gray-400 hover:text-gray-300 cursor-help"})})]})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)(B.default,{schemaComponent:"GenerateKeyRequest",form:eT,excludedFields:["key_alias","team_id","organization_id","models","duration","metadata","tags","guardrails","max_budget","budget_duration","tpm_limit","rpm_limit",...ek?["key"]:[]]})})]})]})]})}),(0,t.jsx)("div",{style:{textAlign:"right",marginTop:"10px"},children:(0,t.jsx)(_.Button,{htmlType:"submit",disabled:tM,style:{opacity:tM?.5:1},children:"Create Key"})})]})}),e5&&(0,t.jsx)(w.Modal,{title:"Create New User",open:e5,onCancel:()=>e6(!1),footer:null,width:800,children:(0,t.jsx)(W.CreateUserButton,{userID:eg,accessToken:ep,teams:eo,possibleUIRoles:e8,onUserCreated:e=>{e9(e),eT.setFieldsValue({user_id:e}),e6(!1)},isEmbedded:!0})}),eL&&(0,t.jsx)(w.Modal,{open:eI,onOk:tL,onCancel:tF,footer:null,children:(0,t.jsxs)(x.Grid,{numItems:1,className:"gap-2 w-full",children:[(0,t.jsx)(b.Title,{children:"Save your Key"}),(0,t.jsx)(h.Col,{numColSpan:1,children:null!=eL?(0,t.jsx)(es.default,{apiKey:eL}):(0,t.jsx)(y.Text,{children:"Key being created, this might take 30s"})})]})})]})},"fetchTeamModels",0,ei,"fetchUserModels",0,en],702597)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/025gva_b59p-5.js b/litellm/proxy/_experimental/out/_next/static/chunks/025gva_b59p-5.js deleted file mode 100644 index c0fe3dcc751..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/025gva_b59p-5.js +++ /dev/null @@ -1,68 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,599724,936325,e=>{"use strict";var o=e.i(95779),r=e.i(444755),l=e.i(673706),n=e.i(271645);let t=n.default.forwardRef((e,t)=>{let{color:a,className:s,children:i}=e;return n.default.createElement("p",{ref:t,className:(0,r.tremorTwMerge)("text-tremor-default",a?(0,l.getColorClassNames)(a,o.colorPalette.text).textColor:(0,r.tremorTwMerge)("text-tremor-content","dark:text-dark-tremor-content"),s)},i)});t.displayName="Text",e.s(["default",0,t],936325),e.s(["Text",0,t],599724)},350967,46757,e=>{"use strict";var o=e.i(290571),r=e.i(444755),l=e.i(673706),n=e.i(271645);let t={0:"grid-cols-none",1:"grid-cols-1",2:"grid-cols-2",3:"grid-cols-3",4:"grid-cols-4",5:"grid-cols-5",6:"grid-cols-6",7:"grid-cols-7",8:"grid-cols-8",9:"grid-cols-9",10:"grid-cols-10",11:"grid-cols-11",12:"grid-cols-12"},a={0:"sm:grid-cols-none",1:"sm:grid-cols-1",2:"sm:grid-cols-2",3:"sm:grid-cols-3",4:"sm:grid-cols-4",5:"sm:grid-cols-5",6:"sm:grid-cols-6",7:"sm:grid-cols-7",8:"sm:grid-cols-8",9:"sm:grid-cols-9",10:"sm:grid-cols-10",11:"sm:grid-cols-11",12:"sm:grid-cols-12"},s={0:"md:grid-cols-none",1:"md:grid-cols-1",2:"md:grid-cols-2",3:"md:grid-cols-3",4:"md:grid-cols-4",5:"md:grid-cols-5",6:"md:grid-cols-6",7:"md:grid-cols-7",8:"md:grid-cols-8",9:"md:grid-cols-9",10:"md:grid-cols-10",11:"md:grid-cols-11",12:"md:grid-cols-12"},i={0:"lg:grid-cols-none",1:"lg:grid-cols-1",2:"lg:grid-cols-2",3:"lg:grid-cols-3",4:"lg:grid-cols-4",5:"lg:grid-cols-5",6:"lg:grid-cols-6",7:"lg:grid-cols-7",8:"lg:grid-cols-8",9:"lg:grid-cols-9",10:"lg:grid-cols-10",11:"lg:grid-cols-11",12:"lg:grid-cols-12"};e.s(["colSpan",0,{1:"col-span-1",2:"col-span-2",3:"col-span-3",4:"col-span-4",5:"col-span-5",6:"col-span-6",7:"col-span-7",8:"col-span-8",9:"col-span-9",10:"col-span-10",11:"col-span-11",12:"col-span-12",13:"col-span-13"},"colSpanLg",0,{1:"lg:col-span-1",2:"lg:col-span-2",3:"lg:col-span-3",4:"lg:col-span-4",5:"lg:col-span-5",6:"lg:col-span-6",7:"lg:col-span-7",8:"lg:col-span-8",9:"lg:col-span-9",10:"lg:col-span-10",11:"lg:col-span-11",12:"lg:col-span-12",13:"lg:col-span-13"},"colSpanMd",0,{1:"md:col-span-1",2:"md:col-span-2",3:"md:col-span-3",4:"md:col-span-4",5:"md:col-span-5",6:"md:col-span-6",7:"md:col-span-7",8:"md:col-span-8",9:"md:col-span-9",10:"md:col-span-10",11:"md:col-span-11",12:"md:col-span-12",13:"md:col-span-13"},"colSpanSm",0,{1:"sm:col-span-1",2:"sm:col-span-2",3:"sm:col-span-3",4:"sm:col-span-4",5:"sm:col-span-5",6:"sm:col-span-6",7:"sm:col-span-7",8:"sm:col-span-8",9:"sm:col-span-9",10:"sm:col-span-10",11:"sm:col-span-11",12:"sm:col-span-12",13:"sm:col-span-13"},"gridCols",0,t,"gridColsLg",0,i,"gridColsMd",0,s,"gridColsSm",0,a],46757);let c=(0,l.makeClassName)("Grid"),d=(e,o)=>e&&Object.keys(o).includes(String(e))?o[e]:"",g=n.default.forwardRef((e,l)=>{let{numItems:g=1,numItemsSm:p,numItemsMd:m,numItemsLg:h,children:u,className:b}=e,k=(0,o.__rest)(e,["numItems","numItemsSm","numItemsMd","numItemsLg","children","className"]),f=d(g,t),x=d(p,a),v=d(m,s),w=d(h,i),y=(0,r.tremorTwMerge)(f,x,v,w);return n.default.createElement("div",Object.assign({ref:l,className:(0,r.tremorTwMerge)(c("root"),"grid",y,b)},k),u)});g.displayName="Grid",e.s(["Grid",0,g],350967)},678745,e=>{"use strict";let o=(0,e.i(475254).default)("check",[["path",{d:"M20 6 9 17l-5-5",key:"1gmf2c"}]]);e.s(["default",0,o])},678784,e=>{"use strict";var o=e.i(678745);e.s(["CheckIcon",()=>o.default])},546467,e=>{"use strict";let o=(0,e.i(475254).default)("external-link",[["path",{d:"M15 3h6v6",key:"1q9fwt"}],["path",{d:"M10 14 21 3",key:"gplh6r"}],["path",{d:"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6",key:"a6xqqp"}]]);e.s(["default",0,o])},673709,e=>{"use strict";var o=e.i(843476),r=e.i(271645),l=e.i(678784);let n=(0,e.i(475254).default)("clipboard",[["rect",{width:"8",height:"4",x:"8",y:"2",rx:"1",ry:"1",key:"tgr4d6"}],["path",{d:"M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2",key:"116196"}]]);var t=e.i(650056);let a={'code[class*="language-"]':{background:"hsl(230, 1%, 98%)",color:"hsl(230, 8%, 24%)",fontFamily:'"Fira Code", "Fira Mono", Menlo, Consolas, "DejaVu Sans Mono", monospace',direction:"ltr",textAlign:"left",whiteSpace:"pre",wordSpacing:"normal",wordBreak:"normal",lineHeight:"1.5",MozTabSize:"2",OTabSize:"2",tabSize:"2",WebkitHyphens:"none",MozHyphens:"none",msHyphens:"none",hyphens:"none"},'pre[class*="language-"]':{background:"hsl(230, 1%, 98%)",color:"hsl(230, 8%, 24%)",fontFamily:'"Fira Code", "Fira Mono", Menlo, Consolas, "DejaVu Sans Mono", monospace',direction:"ltr",textAlign:"left",whiteSpace:"pre",wordSpacing:"normal",wordBreak:"normal",lineHeight:"1.5",MozTabSize:"2",OTabSize:"2",tabSize:"2",WebkitHyphens:"none",MozHyphens:"none",msHyphens:"none",hyphens:"none",padding:"1em",margin:"0.5em 0",overflow:"auto",borderRadius:"0.3em"},'code[class*="language-"]::-moz-selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},'code[class*="language-"] *::-moz-selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},'pre[class*="language-"] *::-moz-selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},'code[class*="language-"]::selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},'code[class*="language-"] *::selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},'pre[class*="language-"] *::selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},':not(pre) > code[class*="language-"]':{padding:"0.2em 0.3em",borderRadius:"0.3em",whiteSpace:"normal"},comment:{color:"hsl(230, 4%, 64%)",fontStyle:"italic"},prolog:{color:"hsl(230, 4%, 64%)"},cdata:{color:"hsl(230, 4%, 64%)"},doctype:{color:"hsl(230, 8%, 24%)"},punctuation:{color:"hsl(230, 8%, 24%)"},entity:{color:"hsl(230, 8%, 24%)",cursor:"help"},"attr-name":{color:"hsl(35, 99%, 36%)"},"class-name":{color:"hsl(35, 99%, 36%)"},boolean:{color:"hsl(35, 99%, 36%)"},constant:{color:"hsl(35, 99%, 36%)"},number:{color:"hsl(35, 99%, 36%)"},atrule:{color:"hsl(35, 99%, 36%)"},keyword:{color:"hsl(301, 63%, 40%)"},property:{color:"hsl(5, 74%, 59%)"},tag:{color:"hsl(5, 74%, 59%)"},symbol:{color:"hsl(5, 74%, 59%)"},deleted:{color:"hsl(5, 74%, 59%)"},important:{color:"hsl(5, 74%, 59%)"},selector:{color:"hsl(119, 34%, 47%)"},string:{color:"hsl(119, 34%, 47%)"},char:{color:"hsl(119, 34%, 47%)"},builtin:{color:"hsl(119, 34%, 47%)"},inserted:{color:"hsl(119, 34%, 47%)"},regex:{color:"hsl(119, 34%, 47%)"},"attr-value":{color:"hsl(119, 34%, 47%)"},"attr-value > .token.punctuation":{color:"hsl(119, 34%, 47%)"},variable:{color:"hsl(221, 87%, 60%)"},operator:{color:"hsl(221, 87%, 60%)"},function:{color:"hsl(221, 87%, 60%)"},url:{color:"hsl(198, 99%, 37%)"},"attr-value > .token.punctuation.attr-equals":{color:"hsl(230, 8%, 24%)"},"special-attr > .token.attr-value > .token.value.css":{color:"hsl(230, 8%, 24%)"},".language-css .token.selector":{color:"hsl(5, 74%, 59%)"},".language-css .token.property":{color:"hsl(230, 8%, 24%)"},".language-css .token.function":{color:"hsl(198, 99%, 37%)"},".language-css .token.url > .token.function":{color:"hsl(198, 99%, 37%)"},".language-css .token.url > .token.string.url":{color:"hsl(119, 34%, 47%)"},".language-css .token.important":{color:"hsl(301, 63%, 40%)"},".language-css .token.atrule .token.rule":{color:"hsl(301, 63%, 40%)"},".language-javascript .token.operator":{color:"hsl(301, 63%, 40%)"},".language-javascript .token.template-string > .token.interpolation > .token.interpolation-punctuation.punctuation":{color:"hsl(344, 84%, 43%)"},".language-json .token.operator":{color:"hsl(230, 8%, 24%)"},".language-json .token.null.keyword":{color:"hsl(35, 99%, 36%)"},".language-markdown .token.url":{color:"hsl(230, 8%, 24%)"},".language-markdown .token.url > .token.operator":{color:"hsl(230, 8%, 24%)"},".language-markdown .token.url-reference.url > .token.string":{color:"hsl(230, 8%, 24%)"},".language-markdown .token.url > .token.content":{color:"hsl(221, 87%, 60%)"},".language-markdown .token.url > .token.url":{color:"hsl(198, 99%, 37%)"},".language-markdown .token.url-reference.url":{color:"hsl(198, 99%, 37%)"},".language-markdown .token.blockquote.punctuation":{color:"hsl(230, 4%, 64%)",fontStyle:"italic"},".language-markdown .token.hr.punctuation":{color:"hsl(230, 4%, 64%)",fontStyle:"italic"},".language-markdown .token.code-snippet":{color:"hsl(119, 34%, 47%)"},".language-markdown .token.bold .token.content":{color:"hsl(35, 99%, 36%)"},".language-markdown .token.italic .token.content":{color:"hsl(301, 63%, 40%)"},".language-markdown .token.strike .token.content":{color:"hsl(5, 74%, 59%)"},".language-markdown .token.strike .token.punctuation":{color:"hsl(5, 74%, 59%)"},".language-markdown .token.list.punctuation":{color:"hsl(5, 74%, 59%)"},".language-markdown .token.title.important > .token.punctuation":{color:"hsl(5, 74%, 59%)"},bold:{fontWeight:"bold"},italic:{fontStyle:"italic"},namespace:{Opacity:"0.8"},"token.tab:not(:empty):before":{color:"hsla(230, 8%, 24%, 0.2)"},"token.cr:before":{color:"hsla(230, 8%, 24%, 0.2)"},"token.lf:before":{color:"hsla(230, 8%, 24%, 0.2)"},"token.space:before":{color:"hsla(230, 8%, 24%, 0.2)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item":{marginRight:"0.4em"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > button":{background:"hsl(230, 1%, 90%)",color:"hsl(230, 6%, 44%)",padding:"0.1em 0.4em",borderRadius:"0.3em"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > a":{background:"hsl(230, 1%, 90%)",color:"hsl(230, 6%, 44%)",padding:"0.1em 0.4em",borderRadius:"0.3em"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > span":{background:"hsl(230, 1%, 90%)",color:"hsl(230, 6%, 44%)",padding:"0.1em 0.4em",borderRadius:"0.3em"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > button:hover":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > button:focus":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > a:hover":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > a:focus":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > span:hover":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > span:focus":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},".line-highlight.line-highlight":{background:"hsla(230, 8%, 24%, 0.05)"},".line-highlight.line-highlight:before":{background:"hsl(230, 1%, 90%)",color:"hsl(230, 8%, 24%)",padding:"0.1em 0.6em",borderRadius:"0.3em",boxShadow:"0 2px 0 0 rgba(0, 0, 0, 0.2)"},".line-highlight.line-highlight[data-end]:after":{background:"hsl(230, 1%, 90%)",color:"hsl(230, 8%, 24%)",padding:"0.1em 0.6em",borderRadius:"0.3em",boxShadow:"0 2px 0 0 rgba(0, 0, 0, 0.2)"},"pre[id].linkable-line-numbers.linkable-line-numbers span.line-numbers-rows > span:hover:before":{backgroundColor:"hsla(230, 8%, 24%, 0.05)"},".line-numbers.line-numbers .line-numbers-rows":{borderRightColor:"hsla(230, 8%, 24%, 0.2)"},".command-line .command-line-prompt":{borderRightColor:"hsla(230, 8%, 24%, 0.2)"},".line-numbers .line-numbers-rows > span:before":{color:"hsl(230, 1%, 62%)"},".command-line .command-line-prompt > span:before":{color:"hsl(230, 1%, 62%)"},".rainbow-braces .token.token.punctuation.brace-level-1":{color:"hsl(5, 74%, 59%)"},".rainbow-braces .token.token.punctuation.brace-level-5":{color:"hsl(5, 74%, 59%)"},".rainbow-braces .token.token.punctuation.brace-level-9":{color:"hsl(5, 74%, 59%)"},".rainbow-braces .token.token.punctuation.brace-level-2":{color:"hsl(119, 34%, 47%)"},".rainbow-braces .token.token.punctuation.brace-level-6":{color:"hsl(119, 34%, 47%)"},".rainbow-braces .token.token.punctuation.brace-level-10":{color:"hsl(119, 34%, 47%)"},".rainbow-braces .token.token.punctuation.brace-level-3":{color:"hsl(221, 87%, 60%)"},".rainbow-braces .token.token.punctuation.brace-level-7":{color:"hsl(221, 87%, 60%)"},".rainbow-braces .token.token.punctuation.brace-level-11":{color:"hsl(221, 87%, 60%)"},".rainbow-braces .token.token.punctuation.brace-level-4":{color:"hsl(301, 63%, 40%)"},".rainbow-braces .token.token.punctuation.brace-level-8":{color:"hsl(301, 63%, 40%)"},".rainbow-braces .token.token.punctuation.brace-level-12":{color:"hsl(301, 63%, 40%)"},"pre.diff-highlight > code .token.token.deleted:not(.prefix)":{backgroundColor:"hsla(353, 100%, 66%, 0.15)"},"pre > code.diff-highlight .token.token.deleted:not(.prefix)":{backgroundColor:"hsla(353, 100%, 66%, 0.15)"},"pre.diff-highlight > code .token.token.deleted:not(.prefix)::-moz-selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre.diff-highlight > code .token.token.deleted:not(.prefix) *::-moz-selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre > code.diff-highlight .token.token.deleted:not(.prefix)::-moz-selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre > code.diff-highlight .token.token.deleted:not(.prefix) *::-moz-selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre.diff-highlight > code .token.token.deleted:not(.prefix)::selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre.diff-highlight > code .token.token.deleted:not(.prefix) *::selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre > code.diff-highlight .token.token.deleted:not(.prefix)::selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre > code.diff-highlight .token.token.deleted:not(.prefix) *::selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre.diff-highlight > code .token.token.inserted:not(.prefix)":{backgroundColor:"hsla(137, 100%, 55%, 0.15)"},"pre > code.diff-highlight .token.token.inserted:not(.prefix)":{backgroundColor:"hsla(137, 100%, 55%, 0.15)"},"pre.diff-highlight > code .token.token.inserted:not(.prefix)::-moz-selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre.diff-highlight > code .token.token.inserted:not(.prefix) *::-moz-selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre > code.diff-highlight .token.token.inserted:not(.prefix)::-moz-selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre > code.diff-highlight .token.token.inserted:not(.prefix) *::-moz-selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre.diff-highlight > code .token.token.inserted:not(.prefix)::selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre.diff-highlight > code .token.token.inserted:not(.prefix) *::selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre > code.diff-highlight .token.token.inserted:not(.prefix)::selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre > code.diff-highlight .token.token.inserted:not(.prefix) *::selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},".prism-previewer.prism-previewer:before":{borderColor:"hsl(0, 0, 95%)"},".prism-previewer-gradient.prism-previewer-gradient div":{borderColor:"hsl(0, 0, 95%)",borderRadius:"0.3em"},".prism-previewer-color.prism-previewer-color:before":{borderRadius:"0.3em"},".prism-previewer-easing.prism-previewer-easing:before":{borderRadius:"0.3em"},".prism-previewer.prism-previewer:after":{borderTopColor:"hsl(0, 0, 95%)"},".prism-previewer-flipped.prism-previewer-flipped.after":{borderBottomColor:"hsl(0, 0, 95%)"},".prism-previewer-angle.prism-previewer-angle:before":{background:"hsl(0, 0%, 100%)"},".prism-previewer-time.prism-previewer-time:before":{background:"hsl(0, 0%, 100%)"},".prism-previewer-easing.prism-previewer-easing":{background:"hsl(0, 0%, 100%)"},".prism-previewer-angle.prism-previewer-angle circle":{stroke:"hsl(230, 8%, 24%)",strokeOpacity:"1"},".prism-previewer-time.prism-previewer-time circle":{stroke:"hsl(230, 8%, 24%)",strokeOpacity:"1"},".prism-previewer-easing.prism-previewer-easing circle":{stroke:"hsl(230, 8%, 24%)",fill:"transparent"},".prism-previewer-easing.prism-previewer-easing path":{stroke:"hsl(230, 8%, 24%)"},".prism-previewer-easing.prism-previewer-easing line":{stroke:"hsl(230, 8%, 24%)"}};e.s(["default",0,({code:e,language:s})=>{let[i,c]=(0,r.useState)(!1);return(0,o.jsxs)("div",{className:"relative rounded-lg border border-gray-200 overflow-hidden",children:[(0,o.jsx)("button",{onClick:()=>{navigator.clipboard.writeText(e),c(!0),setTimeout(()=>c(!1),2e3)},className:"absolute top-3 right-3 p-2 rounded-md bg-gray-100 hover:bg-gray-200 text-gray-600 z-10","aria-label":"Copy code",children:i?(0,o.jsx)(l.CheckIcon,{size:16}):(0,o.jsx)(n,{size:16})}),(0,o.jsx)(t.Prism,{language:s,style:a,customStyle:{margin:0,padding:"1.5rem",borderRadius:"0.5rem",fontSize:"0.9rem",backgroundColor:"#fafafa"},showLineNumbers:!0,children:e})]})}],673709)},778917,e=>{"use strict";var o=e.i(546467);e.s(["ExternalLink",()=>o.default])},191905,e=>{"use strict";var o=e.i(843476),r=e.i(599724),l=e.i(197647),n=e.i(653824),t=e.i(881073),a=e.i(404206),s=e.i(723731),i=e.i(350967),c=e.i(673709),d=e.i(778917),g=e.i(115504);let p=({href:e,className:r})=>(0,o.jsxs)("a",{href:e,target:"_blank",rel:"noopener noreferrer",title:"Open documentation in a new tab",className:(0,g.cn)("inline-flex items-center gap-2 rounded-xl border border-zinc-200 bg-white/80 px-3.5 py-2 text-sm font-medium text-zinc-700 shadow-xs","hover:bg-white focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-blue-500 active:translate-y-[0.5px]",r),children:[(0,o.jsx)("span",{children:"API Reference Docs"}),(0,o.jsx)(d.ExternalLink,{"aria-hidden":!0,className:"h-4 w-4 opacity-80"}),(0,o.jsx)("span",{className:"sr-only",children:"(opens in a new tab)"})]}),m=({proxySettings:e})=>{let d="",g=e?.LITELLM_UI_API_DOC_BASE_URL;return g&&g.trim()?d=g:e?.PROXY_BASE_URL&&(d=e.PROXY_BASE_URL),(0,o.jsx)(o.Fragment,{children:(0,o.jsx)(i.Grid,{className:"gap-2 p-8 h-[80vh] w-full mt-2",children:(0,o.jsxs)("div",{className:"mb-5",children:[(0,o.jsxs)("div",{className:"flex items-center justify-between",children:[(0,o.jsx)("p",{className:"text-2xl text-tremor-content-strong dark:text-dark-tremor-content-strong font-semibold",children:"OpenAI Compatible Proxy: API Reference"}),(0,o.jsx)(p,{className:"ml-3 shrink-0",href:"https://docs.litellm.ai/docs/proxy/user_keys"})]}),(0,o.jsxs)(r.Text,{className:"mt-2 mb-2",children:["LiteLLM is OpenAI Compatible. This means your API Key works with the OpenAI SDK. Just replace the base_url to point to your litellm proxy. Example Below"," "]}),(0,o.jsxs)(n.TabGroup,{children:[(0,o.jsxs)(t.TabList,{children:[(0,o.jsx)(l.Tab,{children:"OpenAI Python SDK"}),(0,o.jsx)(l.Tab,{children:"LlamaIndex"}),(0,o.jsx)(l.Tab,{children:"Langchain Py"})]}),(0,o.jsxs)(s.TabPanels,{children:[(0,o.jsx)(a.TabPanel,{children:(0,o.jsx)(c.default,{language:"python",code:`import openai -client = openai.OpenAI( - api_key="your_api_key", - base_url="${d}" # LiteLLM Proxy is OpenAI compatible, Read More: https://docs.litellm.ai/docs/proxy/user_keys -) - -response = client.chat.completions.create( - model="gpt-3.5-turbo", # model to send to the proxy - messages = [ - { - "role": "user", - "content": "this is a test request, write a short poem" - } - ] -) - -print(response)`})}),(0,o.jsx)(a.TabPanel,{children:(0,o.jsx)(c.default,{language:"python",code:`import os, dotenv - -from llama_index.llms import AzureOpenAI -from llama_index.embeddings import AzureOpenAIEmbedding -from llama_index import VectorStoreIndex, SimpleDirectoryReader, ServiceContext - -llm = AzureOpenAI( - engine="azure-gpt-3.5", # model_name on litellm proxy - temperature=0.0, - azure_endpoint="${d}", # litellm proxy endpoint - api_key="sk-1234", # litellm proxy API Key - api_version="2023-07-01-preview", -) - -embed_model = AzureOpenAIEmbedding( - deployment_name="azure-embedding-model", - azure_endpoint="${d}", - api_key="sk-1234", - api_version="2023-07-01-preview", -) - -documents = SimpleDirectoryReader("llama_index_data").load_data() -service_context = ServiceContext.from_defaults(llm=llm, embed_model=embed_model) -index = VectorStoreIndex.from_documents(documents, service_context=service_context) - -query_engine = index.as_query_engine() -response = query_engine.query("What did the author do growing up?") -print(response)`})}),(0,o.jsx)(a.TabPanel,{children:(0,o.jsx)(c.default,{language:"python",code:`from langchain.chat_models import ChatOpenAI -from langchain.prompts.chat import ( - ChatPromptTemplate, - HumanMessagePromptTemplate, - SystemMessagePromptTemplate, -) -from langchain.schema import HumanMessage, SystemMessage - -chat = ChatOpenAI( - openai_api_base="${d}", - model = "gpt-3.5-turbo", - temperature=0.1 -) - -messages = [ - SystemMessage( - content="You are a helpful assistant that im using to make a test request to." - ), - HumanMessage( - content="test from litellm. tell me why it's amazing in 1 sentence" - ), -] -response = chat(messages) - -print(response)`})})]})]})]})})})};var h=e.i(135214),u=e.i(592392);e.s(["default",0,()=>{let{accessToken:e}=(0,h.default)(),r=(0,u.default)(e);return(0,o.jsx)(m,{proxySettings:r})}],191905)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/025ocjcb8e481.js b/litellm/proxy/_experimental/out/_next/static/chunks/025ocjcb8e481.js new file mode 100644 index 00000000000..d45da443d18 --- /dev/null +++ b/litellm/proxy/_experimental/out/_next/static/chunks/025ocjcb8e481.js @@ -0,0 +1,7 @@ +(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,244451,e=>{"use strict";let t;e.i(247167);var r=e.i(271645),a=e.i(343794),i=e.i(242064),o=e.i(763731),l=e.i(174428);let n=80*Math.PI,s=e=>{let{dotClassName:t,style:i,hasCircleCls:o}=e;return r.createElement("circle",{className:(0,a.default)(`${t}-circle`,{[`${t}-circle-bg`]:o}),r:40,cx:50,cy:50,strokeWidth:20,style:i})},c=({percent:e,prefixCls:t})=>{let i=`${t}-dot`,o=`${i}-holder`,c=`${o}-hidden`,[d,u]=r.useState(!1);(0,l.default)(()=>{0!==e&&u(!0)},[0!==e]);let f=Math.max(Math.min(e,100),0);if(!d)return null;let m={strokeDashoffset:`${n/4}`,strokeDasharray:`${n*f/100} ${n*(100-f)/100}`};return r.createElement("span",{className:(0,a.default)(o,`${i}-progress`,f<=0&&c)},r.createElement("svg",{viewBox:"0 0 100 100",role:"progressbar","aria-valuemin":0,"aria-valuemax":100,"aria-valuenow":f},r.createElement(s,{dotClassName:i,hasCircleCls:!0}),r.createElement(s,{dotClassName:i,style:m})))};function d(e){let{prefixCls:t,percent:i=0}=e,o=`${t}-dot`,l=`${o}-holder`,n=`${l}-hidden`;return r.createElement(r.Fragment,null,r.createElement("span",{className:(0,a.default)(l,i>0&&n)},r.createElement("span",{className:(0,a.default)(o,`${t}-dot-spin`)},[1,2,3,4].map(e=>r.createElement("i",{className:`${t}-dot-item`,key:e})))),r.createElement(c,{prefixCls:t,percent:i}))}function u(e){var t;let{prefixCls:i,indicator:l,percent:n}=e,s=`${i}-dot`;return l&&r.isValidElement(l)?(0,o.cloneElement)(l,{className:(0,a.default)(null==(t=l.props)?void 0:t.className,s),percent:n}):r.createElement(d,{prefixCls:i,percent:n})}e.i(296059);var f=e.i(694758),m=e.i(183293),p=e.i(246422),v=e.i(838378);let h=new f.Keyframes("antSpinMove",{to:{opacity:1}}),g=new f.Keyframes("antRotate",{to:{transform:"rotate(405deg)"}}),b=(0,p.genStyleHooks)("Spin",e=>(e=>{let{componentCls:t,calc:r}=e;return{[t]:Object.assign(Object.assign({},(0,m.resetComponent)(e)),{position:"absolute",display:"none",color:e.colorPrimary,fontSize:0,textAlign:"center",verticalAlign:"middle",opacity:0,transition:`transform ${e.motionDurationSlow} ${e.motionEaseInOutCirc}`,"&-spinning":{position:"relative",display:"inline-block",opacity:1},[`${t}-text`]:{fontSize:e.fontSize,paddingTop:r(r(e.dotSize).sub(e.fontSize)).div(2).add(2).equal()},"&-fullscreen":{position:"fixed",width:"100vw",height:"100vh",backgroundColor:e.colorBgMask,zIndex:e.zIndexPopupBase,inset:0,display:"flex",alignItems:"center",flexDirection:"column",justifyContent:"center",opacity:0,visibility:"hidden",transition:`all ${e.motionDurationMid}`,"&-show":{opacity:1,visibility:"visible"},[t]:{[`${t}-dot-holder`]:{color:e.colorWhite},[`${t}-text`]:{color:e.colorTextLightSolid}}},"&-nested-loading":{position:"relative",[`> div > ${t}`]:{position:"absolute",top:0,insetInlineStart:0,zIndex:4,display:"block",width:"100%",height:"100%",maxHeight:e.contentHeight,[`${t}-dot`]:{position:"absolute",top:"50%",insetInlineStart:"50%",margin:r(e.dotSize).mul(-1).div(2).equal()},[`${t}-text`]:{position:"absolute",top:"50%",width:"100%",textShadow:`0 1px 2px ${e.colorBgContainer}`},[`&${t}-show-text ${t}-dot`]:{marginTop:r(e.dotSize).div(2).mul(-1).sub(10).equal()},"&-sm":{[`${t}-dot`]:{margin:r(e.dotSizeSM).mul(-1).div(2).equal()},[`${t}-text`]:{paddingTop:r(r(e.dotSizeSM).sub(e.fontSize)).div(2).add(2).equal()},[`&${t}-show-text ${t}-dot`]:{marginTop:r(e.dotSizeSM).div(2).mul(-1).sub(10).equal()}},"&-lg":{[`${t}-dot`]:{margin:r(e.dotSizeLG).mul(-1).div(2).equal()},[`${t}-text`]:{paddingTop:r(r(e.dotSizeLG).sub(e.fontSize)).div(2).add(2).equal()},[`&${t}-show-text ${t}-dot`]:{marginTop:r(e.dotSizeLG).div(2).mul(-1).sub(10).equal()}}},[`${t}-container`]:{position:"relative",transition:`opacity ${e.motionDurationSlow}`,"&::after":{position:"absolute",top:0,insetInlineEnd:0,bottom:0,insetInlineStart:0,zIndex:10,width:"100%",height:"100%",background:e.colorBgContainer,opacity:0,transition:`all ${e.motionDurationSlow}`,content:'""',pointerEvents:"none"}},[`${t}-blur`]:{clear:"both",opacity:.5,userSelect:"none",pointerEvents:"none","&::after":{opacity:.4,pointerEvents:"auto"}}},"&-tip":{color:e.spinDotDefault},[`${t}-dot-holder`]:{width:"1em",height:"1em",fontSize:e.dotSize,display:"inline-block",transition:`transform ${e.motionDurationSlow} ease, opacity ${e.motionDurationSlow} ease`,transformOrigin:"50% 50%",lineHeight:1,color:e.colorPrimary,"&-hidden":{transform:"scale(0.3)",opacity:0}},[`${t}-dot-progress`]:{position:"absolute",inset:0},[`${t}-dot`]:{position:"relative",display:"inline-block",fontSize:e.dotSize,width:"1em",height:"1em","&-item":{position:"absolute",display:"block",width:r(e.dotSize).sub(r(e.marginXXS).div(2)).div(2).equal(),height:r(e.dotSize).sub(r(e.marginXXS).div(2)).div(2).equal(),background:"currentColor",borderRadius:"100%",transform:"scale(0.75)",transformOrigin:"50% 50%",opacity:.3,animationName:h,animationDuration:"1s",animationIterationCount:"infinite",animationTimingFunction:"linear",animationDirection:"alternate","&:nth-child(1)":{top:0,insetInlineStart:0,animationDelay:"0s"},"&:nth-child(2)":{top:0,insetInlineEnd:0,animationDelay:"0.4s"},"&:nth-child(3)":{insetInlineEnd:0,bottom:0,animationDelay:"0.8s"},"&:nth-child(4)":{bottom:0,insetInlineStart:0,animationDelay:"1.2s"}},"&-spin":{transform:"rotate(45deg)",animationName:g,animationDuration:"1.2s",animationIterationCount:"infinite",animationTimingFunction:"linear"},"&-circle":{strokeLinecap:"round",transition:["stroke-dashoffset","stroke-dasharray","stroke","stroke-width","opacity"].map(t=>`${t} ${e.motionDurationSlow} ease`).join(","),fillOpacity:0,stroke:"currentcolor"},"&-circle-bg":{stroke:e.colorFillSecondary}},[`&-sm ${t}-dot`]:{"&, &-holder":{fontSize:e.dotSizeSM}},[`&-sm ${t}-dot-holder`]:{i:{width:r(r(e.dotSizeSM).sub(r(e.marginXXS).div(2))).div(2).equal(),height:r(r(e.dotSizeSM).sub(r(e.marginXXS).div(2))).div(2).equal()}},[`&-lg ${t}-dot`]:{"&, &-holder":{fontSize:e.dotSizeLG}},[`&-lg ${t}-dot-holder`]:{i:{width:r(r(e.dotSizeLG).sub(e.marginXXS)).div(2).equal(),height:r(r(e.dotSizeLG).sub(e.marginXXS)).div(2).equal()}},[`&${t}-show-text ${t}-text`]:{display:"block"}})}})((0,v.mergeToken)(e,{spinDotDefault:e.colorTextDescription})),e=>{let{controlHeightLG:t,controlHeight:r}=e;return{contentHeight:400,dotSize:t/2,dotSizeSM:.35*t,dotSizeLG:r}}),y=[[30,.05],[70,.03],[96,.01]];var $=function(e,t){var r={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&0>t.indexOf(a)&&(r[a]=e[a]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var i=0,a=Object.getOwnPropertySymbols(e);it.indexOf(a[i])&&Object.prototype.propertyIsEnumerable.call(e,a[i])&&(r[a[i]]=e[a[i]]);return r};let S=e=>{var o;let{prefixCls:l,spinning:n=!0,delay:s=0,className:c,rootClassName:d,size:f="default",tip:m,wrapperClassName:p,style:v,children:h,fullscreen:g=!1,indicator:S,percent:C}=e,x=$(e,["prefixCls","spinning","delay","className","rootClassName","size","tip","wrapperClassName","style","children","fullscreen","indicator","percent"]),{getPrefixCls:w,direction:k,className:E,style:z,indicator:O}=(0,i.useComponentConfig)("spin"),N=w("spin",l),[M,D,j]=b(N),[P,I]=r.useState(()=>n&&(!n||!s||!!Number.isNaN(Number(s)))),T=function(e,t){let[a,i]=r.useState(0),o=r.useRef(null),l="auto"===t;return r.useEffect(()=>(l&&e&&(i(0),o.current=setInterval(()=>{i(e=>{let t=100-e;for(let r=0;r{o.current&&(clearInterval(o.current),o.current=null)}),[l,e]),l?a:t}(P,C);r.useEffect(()=>{if(n){let e=function(e,t,r){var a,i=r||{},o=i.noTrailing,l=void 0!==o&&o,n=i.noLeading,s=void 0!==n&&n,c=i.debounceMode,d=void 0===c?void 0:c,u=!1,f=0;function m(){a&&clearTimeout(a)}function p(){for(var r=arguments.length,i=Array(r),o=0;oe?s?(f=Date.now(),l||(a=setTimeout(d?v:p,e))):p():!0!==l&&(a=setTimeout(d?v:p,void 0===d?e-c:e)))}return p.cancel=function(e){var t=(e||{}).upcomingOnly;m(),u=!(void 0!==t&&t)},p}(s,()=>{I(!0)},{debounceMode:false});return e(),()=>{var t;null==(t=null==e?void 0:e.cancel)||t.call(e)}}I(!1)},[s,n]);let _=r.useMemo(()=>void 0!==h&&!g,[h,g]),H=(0,a.default)(N,E,{[`${N}-sm`]:"small"===f,[`${N}-lg`]:"large"===f,[`${N}-spinning`]:P,[`${N}-show-text`]:!!m,[`${N}-rtl`]:"rtl"===k},c,!g&&d,D,j),R=(0,a.default)(`${N}-container`,{[`${N}-blur`]:P}),B=null!=(o=null!=S?S:O)?o:t,L=Object.assign(Object.assign({},z),v),q=r.createElement("div",Object.assign({},x,{style:L,className:H,"aria-live":"polite","aria-busy":P}),r.createElement(u,{prefixCls:N,indicator:B,percent:T}),m&&(_||g)?r.createElement("div",{className:`${N}-text`},m):null);return M(_?r.createElement("div",Object.assign({},x,{className:(0,a.default)(`${N}-nested-loading`,p,D,j)}),P&&r.createElement("div",{key:"loading"},q),r.createElement("div",{className:R,key:"container"},h)):g?r.createElement("div",{className:(0,a.default)(`${N}-fullscreen`,{[`${N}-fullscreen-show`]:P},d,D,j)},q):q)};S.setDefaultIndicator=e=>{t=e},e.s(["default",0,S],244451)},482725,e=>{"use strict";var t=e.i(244451);e.s(["Spin",()=>t.default])},184163,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M505.7 661a8 8 0 0012.6 0l112-141.7c4.1-5.2.4-12.9-6.3-12.9h-74.1V168c0-4.4-3.6-8-8-8h-60c-4.4 0-8 3.6-8 8v338.3H400c-6.7 0-10.4 7.7-6.3 12.9l112 141.8zM878 626h-60c-4.4 0-8 3.6-8 8v154H214V634c0-4.4-3.6-8-8-8h-60c-4.4 0-8 3.6-8 8v198c0 17.7 14.3 32 32 32h684c17.7 0 32-14.3 32-32V634c0-4.4-3.6-8-8-8z"}}]},name:"download",theme:"outlined"};var i=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(i.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["default",0,o],184163)},737434,e=>{"use strict";var t=e.i(184163);e.s(["DownloadOutlined",()=>t.default])},107233,603908,e=>{"use strict";let t=(0,e.i(475254).default)("plus",[["path",{d:"M5 12h14",key:"1ays0h"}],["path",{d:"M12 5v14",key:"s699le"}]]);e.s(["default",0,t],603908),e.s(["Plus",0,t],107233)},695411,e=>{"use strict";var t=e.i(602869);let r=async e=>{try{let r=await (0,t.modelHubCall)(e);if(r?.data.length>0){let e=r.data.map(e=>({model_group:e.model_group,mode:e?.mode}));return e.sort((e,t)=>e.model_group.localeCompare(t.model_group)),e}return[]}catch(e){throw console.error("Error fetching model info:",e),e}};e.s(["fetchAvailableModels",0,r])},343488,e=>{"use strict";var t=e.i(540626),r=e.i(271645);e.s(["useDebouncedCallback",0,function(e,a){let i=(0,t.useDebouncer)(e,a).maybeExecute;return(0,r.useCallback)((...e)=>i(...e),[i])}])},983561,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M300 328a60 60 0 10120 0 60 60 0 10-120 0zM852 64H172c-17.7 0-32 14.3-32 32v660c0 17.7 14.3 32 32 32h680c17.7 0 32-14.3 32-32V96c0-17.7-14.3-32-32-32zm-32 660H204V128h616v596zM604 328a60 60 0 10120 0 60 60 0 10-120 0zm250.2 556H169.8c-16.5 0-29.8 14.3-29.8 32v36c0 4.4 3.3 8 7.4 8h729.1c4.1 0 7.4-3.6 7.4-8v-36c.1-17.7-13.2-32-29.7-32zM664 508H360c-4.4 0-8 3.6-8 8v60c0 4.4 3.6 8 8 8h304c4.4 0 8-3.6 8-8v-60c0-4.4-3.6-8-8-8z"}}]},name:"robot",theme:"outlined"};var i=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(i.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["RobotOutlined",0,o],983561)},916940,e=>{"use strict";var t=e.i(843476),r=e.i(271645),a=e.i(199133),i=e.i(602869);e.s(["default",0,({onChange:e,value:o,className:l,accessToken:n,placeholder:s="Select vector stores",disabled:c=!1})=>{let[d,u]=(0,r.useState)([]),[f,m]=(0,r.useState)(!1);return(0,r.useEffect)(()=>{(async()=>{if(n){m(!0);try{let e=await (0,i.vectorStoreListCall)(n);e.data&&u(e.data)}catch(e){console.error("Error fetching vector stores:",e)}finally{m(!1)}}})()},[n]),(0,t.jsx)("div",{children:(0,t.jsx)(a.Select,{mode:"multiple",placeholder:s,onChange:e,value:o,loading:f,className:l,allowClear:!0,options:d.map(e=>({label:`${e.vector_store_name||e.vector_store_id} (${e.vector_store_id})`,value:e.vector_store_id,title:e.vector_store_description||e.vector_store_id})),optionFilterProp:"label",showSearch:!0,style:{width:"100%"},disabled:c})})}])},245704,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M699 353h-46.9c-10.2 0-19.9 4.9-25.9 13.3L469 584.3l-71.2-98.8c-6-8.3-15.6-13.3-25.9-13.3H325c-6.5 0-10.3 7.4-6.5 12.7l124.6 172.8a31.8 31.8 0 0051.7 0l210.6-292c3.9-5.3.1-12.7-6.4-12.7z"}},{tag:"path",attrs:{d:"M512 64C264.6 64 64 264.6 64 512s200.6 448 448 448 448-200.6 448-448S759.4 64 512 64zm0 820c-205.4 0-372-166.6-372-372s166.6-372 372-372 372 166.6 372 372-166.6 372-372 372z"}}]},name:"check-circle",theme:"outlined"};var i=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(i.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["CheckCircleOutlined",0,o],245704)},637235,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M512 64C264.6 64 64 264.6 64 512s200.6 448 448 448 448-200.6 448-448S759.4 64 512 64zm0 820c-205.4 0-372-166.6-372-372s166.6-372 372-372 372 166.6 372 372-166.6 372-372 372z"}},{tag:"path",attrs:{d:"M686.7 638.6L544.1 535.5V288c0-4.4-3.6-8-8-8H488c-4.4 0-8 3.6-8 8v275.4c0 2.6 1.2 5 3.3 6.5l165.4 120.6c3.6 2.6 8.6 1.8 11.2-1.7l28.6-39c2.6-3.7 1.8-8.7-1.8-11.2z"}}]},name:"clock-circle",theme:"outlined"};var i=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(i.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["ClockCircleOutlined",0,o],637235)},646563,e=>{"use strict";var t=e.i(959013);e.s(["PlusOutlined",()=>t.default])},597440,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M360 184h-8c4.4 0 8-3.6 8-8v8h304v-8c0 4.4 3.6 8 8 8h-8v72h72v-80c0-35.3-28.7-64-64-64H352c-35.3 0-64 28.7-64 64v80h72v-72zm504 72H160c-17.7 0-32 14.3-32 32v32c0 4.4 3.6 8 8 8h60.4l24.7 523c1.6 34.1 29.8 61 63.9 61h454c34.2 0 62.3-26.8 63.9-61l24.7-523H888c4.4 0 8-3.6 8-8v-32c0-17.7-14.3-32-32-32zM731.3 840H292.7l-24.2-512h487l-24.2 512z"}}]},name:"delete",theme:"outlined"};var i=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(i.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["default",0,o],597440)},955135,e=>{"use strict";var t=e.i(597440);e.s(["DeleteOutlined",()=>t.default])},166406,e=>{"use strict";var t=e.i(190144);e.s(["CopyOutlined",()=>t.default])},447566,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M872 474H286.9l350.2-304c5.6-4.9 2.2-14-5.2-14h-88.5c-3.9 0-7.6 1.4-10.5 3.9L155 487.8a31.96 31.96 0 000 48.3L535.1 866c1.5 1.3 3.3 2 5.2 2h91.5c7.4 0 10.8-9.2 5.2-14L286.9 550H872c4.4 0 8-3.6 8-8v-60c0-4.4-3.6-8-8-8z"}}]},name:"arrow-left",theme:"outlined"};var i=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(i.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["ArrowLeftOutlined",0,o],447566)},653496,e=>{"use strict";var t=e.i(721369);e.s(["Tabs",()=>t.default])},629569,e=>{"use strict";var t=e.i(290571),r=e.i(95779),a=e.i(444755),i=e.i(673706),o=e.i(271645);let l=o.default.forwardRef((e,l)=>{let{color:n,children:s,className:c}=e,d=(0,t.__rest)(e,["color","children","className"]);return o.default.createElement("p",Object.assign({ref:l,className:(0,a.tremorTwMerge)("font-medium text-tremor-title",n?(0,i.getColorClassNames)(n,r.colorPalette.darkText).textColor:"text-tremor-content-strong dark:text-dark-tremor-content-strong",c)},d),s)});l.displayName="Title",e.s(["Title",0,l],629569)},304967,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(480731),i=e.i(95779),o=e.i(444755),l=e.i(673706);let n=(0,l.makeClassName)("Card"),s=r.default.forwardRef((e,s)=>{let{decoration:c="",decorationColor:d,children:u,className:f}=e,m=(0,t.__rest)(e,["decoration","decorationColor","children","className"]);return r.default.createElement("div",Object.assign({ref:s,className:(0,o.tremorTwMerge)(n("root"),"relative w-full text-left ring-1 rounded-tremor-default p-6","bg-tremor-background ring-tremor-ring shadow-tremor-card","dark:bg-dark-tremor-background dark:ring-dark-tremor-ring dark:shadow-dark-tremor-card",d?(0,l.getColorClassNames)(d,i.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand",(e=>{if(!e)return"";switch(e){case a.HorizontalPositions.Left:return"border-l-4";case a.VerticalPositions.Top:return"border-t-4";case a.HorizontalPositions.Right:return"border-r-4";case a.VerticalPositions.Bottom:return"border-b-4";default:return""}})(c),f)},m),u)});s.displayName="Card",e.s(["Card",0,s],304967)},91874,681216,e=>{"use strict";var t=e.i(931067),r=e.i(209428),a=e.i(211577),i=e.i(392221),o=e.i(703923),l=e.i(343794),n=e.i(914949),s=e.i(271645),c=["prefixCls","className","style","checked","disabled","defaultChecked","type","title","onChange"],d=(0,s.forwardRef)(function(e,d){var u=e.prefixCls,f=void 0===u?"rc-checkbox":u,m=e.className,p=e.style,v=e.checked,h=e.disabled,g=e.defaultChecked,b=e.type,y=void 0===b?"checkbox":b,$=e.title,S=e.onChange,C=(0,o.default)(e,c),x=(0,s.useRef)(null),w=(0,s.useRef)(null),k=(0,n.default)(void 0!==g&&g,{value:v}),E=(0,i.default)(k,2),z=E[0],O=E[1];(0,s.useImperativeHandle)(d,function(){return{focus:function(e){var t;null==(t=x.current)||t.focus(e)},blur:function(){var e;null==(e=x.current)||e.blur()},input:x.current,nativeElement:w.current}});var N=(0,l.default)(f,m,(0,a.default)((0,a.default)({},"".concat(f,"-checked"),z),"".concat(f,"-disabled"),h));return s.createElement("span",{className:N,title:$,style:p,ref:w},s.createElement("input",(0,t.default)({},C,{className:"".concat(f,"-input"),ref:x,onChange:function(t){h||("checked"in e||O(t.target.checked),null==S||S({target:(0,r.default)((0,r.default)({},e),{},{type:y,checked:t.target.checked}),stopPropagation:function(){t.stopPropagation()},preventDefault:function(){t.preventDefault()},nativeEvent:t.nativeEvent}))},disabled:h,checked:!!z,type:y})),s.createElement("span",{className:"".concat(f,"-inner")}))});e.s(["default",0,d],91874);var u=e.i(963188);e.s(["default",0,function(e){let t=s.default.useRef(null),r=()=>{u.default.cancel(t.current),t.current=null};return[()=>{r(),t.current=(0,u.default)(()=>{t.current=null})},a=>{t.current&&(a.stopPropagation(),r()),null==e||e(a)}]}],681216)},374276,236836,e=>{"use strict";e.i(247167);var t=e.i(271645),r=e.i(343794),a=e.i(91874),i=e.i(611935),o=e.i(121872),l=e.i(26905),n=e.i(242064),s=e.i(937328),c=e.i(321883),d=e.i(62139);let u=t.default.createContext(null);e.i(296059);var f=e.i(915654),m=e.i(183293),p=e.i(246422),v=e.i(838378);function h(e,t){return(e=>{let{checkboxCls:t}=e,r=`${t}-wrapper`;return[{[`${t}-group`]:Object.assign(Object.assign({},(0,m.resetComponent)(e)),{display:"inline-flex",flexWrap:"wrap",columnGap:e.marginXS,[`> ${e.antCls}-row`]:{flex:1}}),[r]:Object.assign(Object.assign({},(0,m.resetComponent)(e)),{display:"inline-flex",alignItems:"baseline",cursor:"pointer","&:after":{display:"inline-block",width:0,overflow:"hidden",content:"'\\a0'"},[`& + ${r}`]:{marginInlineStart:0},[`&${r}-in-form-item`]:{'input[type="checkbox"]':{width:14,height:14}}}),[t]:Object.assign(Object.assign({},(0,m.resetComponent)(e)),{position:"relative",whiteSpace:"nowrap",lineHeight:1,cursor:"pointer",borderRadius:e.borderRadiusSM,alignSelf:"center",[`${t}-input`]:{position:"absolute",inset:0,zIndex:1,cursor:"pointer",opacity:0,margin:0,[`&:focus-visible + ${t}-inner`]:(0,m.genFocusOutline)(e)},[`${t}-inner`]:{boxSizing:"border-box",display:"block",width:e.checkboxSize,height:e.checkboxSize,direction:"ltr",backgroundColor:e.colorBgContainer,border:`${(0,f.unit)(e.lineWidth)} ${e.lineType} ${e.colorBorder}`,borderRadius:e.borderRadiusSM,borderCollapse:"separate",transition:`all ${e.motionDurationSlow}`,"&:after":{boxSizing:"border-box",position:"absolute",top:"50%",insetInlineStart:"25%",display:"table",width:e.calc(e.checkboxSize).div(14).mul(5).equal(),height:e.calc(e.checkboxSize).div(14).mul(8).equal(),border:`${(0,f.unit)(e.lineWidthBold)} solid ${e.colorWhite}`,borderTop:0,borderInlineStart:0,transform:"rotate(45deg) scale(0) translate(-50%,-50%)",opacity:0,content:'""',transition:`all ${e.motionDurationFast} ${e.motionEaseInBack}, opacity ${e.motionDurationFast}`}},"& + span":{paddingInlineStart:e.paddingXS,paddingInlineEnd:e.paddingXS}})},{[` + ${r}:not(${r}-disabled), + ${t}:not(${t}-disabled) + `]:{[`&:hover ${t}-inner`]:{borderColor:e.colorPrimary}},[`${r}:not(${r}-disabled)`]:{[`&:hover ${t}-checked:not(${t}-disabled) ${t}-inner`]:{backgroundColor:e.colorPrimaryHover,borderColor:"transparent"},[`&:hover ${t}-checked:not(${t}-disabled):after`]:{borderColor:e.colorPrimaryHover}}},{[`${t}-checked`]:{[`${t}-inner`]:{backgroundColor:e.colorPrimary,borderColor:e.colorPrimary,"&:after":{opacity:1,transform:"rotate(45deg) scale(1) translate(-50%,-50%)",transition:`all ${e.motionDurationMid} ${e.motionEaseOutBack} ${e.motionDurationFast}`}}},[` + ${r}-checked:not(${r}-disabled), + ${t}-checked:not(${t}-disabled) + `]:{[`&:hover ${t}-inner`]:{backgroundColor:e.colorPrimaryHover,borderColor:"transparent"}}},{[t]:{"&-indeterminate":{"&":{[`${t}-inner`]:{backgroundColor:`${e.colorBgContainer}`,borderColor:`${e.colorBorder}`,"&:after":{top:"50%",insetInlineStart:"50%",width:e.calc(e.fontSizeLG).div(2).equal(),height:e.calc(e.fontSizeLG).div(2).equal(),backgroundColor:e.colorPrimary,border:0,transform:"translate(-50%, -50%) scale(1)",opacity:1,content:'""'}},[`&:hover ${t}-inner`]:{backgroundColor:`${e.colorBgContainer}`,borderColor:`${e.colorPrimary}`}}}}},{[`${r}-disabled`]:{cursor:"not-allowed"},[`${t}-disabled`]:{[`&, ${t}-input`]:{cursor:"not-allowed",pointerEvents:"none"},[`${t}-inner`]:{background:e.colorBgContainerDisabled,borderColor:e.colorBorder,"&:after":{borderColor:e.colorTextDisabled}},"&:after":{display:"none"},"& + span":{color:e.colorTextDisabled},[`&${t}-indeterminate ${t}-inner::after`]:{background:e.colorTextDisabled}}}]})((0,v.mergeToken)(t,{checkboxCls:`.${e}`,checkboxSize:t.controlInteractiveSize}))}let g=(0,p.genStyleHooks)("Checkbox",(e,{prefixCls:t})=>[h(t,e)]);e.s(["default",0,g,"getStyle",0,h],236836);var b=e.i(681216),y=function(e,t){var r={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&0>t.indexOf(a)&&(r[a]=e[a]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var i=0,a=Object.getOwnPropertySymbols(e);it.indexOf(a[i])&&Object.prototype.propertyIsEnumerable.call(e,a[i])&&(r[a[i]]=e[a[i]]);return r};let $=t.forwardRef((e,f)=>{var m;let{prefixCls:p,className:v,rootClassName:h,children:$,indeterminate:S=!1,style:C,onMouseEnter:x,onMouseLeave:w,skipGroup:k=!1,disabled:E}=e,z=y(e,["prefixCls","className","rootClassName","children","indeterminate","style","onMouseEnter","onMouseLeave","skipGroup","disabled"]),{getPrefixCls:O,direction:N,checkbox:M}=t.useContext(n.ConfigContext),D=t.useContext(u),{isFormItemInput:j}=t.useContext(d.FormItemInputContext),P=t.useContext(s.default),I=null!=(m=(null==D?void 0:D.disabled)||E)?m:P,T=t.useRef(z.value),_=t.useRef(null),H=(0,i.composeRef)(f,_);t.useEffect(()=>{null==D||D.registerValue(z.value)},[]),t.useEffect(()=>{if(!k)return z.value!==T.current&&(null==D||D.cancelValue(T.current),null==D||D.registerValue(z.value),T.current=z.value),()=>null==D?void 0:D.cancelValue(z.value)},[z.value]),t.useEffect(()=>{var e;(null==(e=_.current)?void 0:e.input)&&(_.current.input.indeterminate=S)},[S]);let R=O("checkbox",p),B=(0,c.default)(R),[L,q,X]=g(R,B),G=Object.assign({},z);D&&!k&&(G.onChange=(...e)=>{z.onChange&&z.onChange.apply(z,e),D.toggleOption&&D.toggleOption({label:$,value:z.value})},G.name=D.name,G.checked=D.value.includes(z.value));let V=(0,r.default)(`${R}-wrapper`,{[`${R}-rtl`]:"rtl"===N,[`${R}-wrapper-checked`]:G.checked,[`${R}-wrapper-disabled`]:I,[`${R}-wrapper-in-form-item`]:j},null==M?void 0:M.className,v,h,X,B,q),F=(0,r.default)({[`${R}-indeterminate`]:S},l.TARGET_CLS,q),[A,W]=(0,b.default)(G.onClick);return L(t.createElement(o.default,{component:"Checkbox",disabled:I},t.createElement("label",{className:V,style:Object.assign(Object.assign({},null==M?void 0:M.style),C),onMouseEnter:x,onMouseLeave:w,onClick:A},t.createElement(a.default,Object.assign({},G,{onClick:W,prefixCls:R,className:F,disabled:I,ref:H})),null!=$&&t.createElement("span",{className:`${R}-label`},$))))});var S=e.i(8211),C=e.i(529681),x=function(e,t){var r={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&0>t.indexOf(a)&&(r[a]=e[a]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var i=0,a=Object.getOwnPropertySymbols(e);it.indexOf(a[i])&&Object.prototype.propertyIsEnumerable.call(e,a[i])&&(r[a[i]]=e[a[i]]);return r};let w=t.forwardRef((e,a)=>{let{defaultValue:i,children:o,options:l=[],prefixCls:s,className:d,rootClassName:f,style:m,onChange:p}=e,v=x(e,["defaultValue","children","options","prefixCls","className","rootClassName","style","onChange"]),{getPrefixCls:h,direction:b}=t.useContext(n.ConfigContext),[y,w]=t.useState(v.value||i||[]),[k,E]=t.useState([]);t.useEffect(()=>{"value"in v&&w(v.value||[])},[v.value]);let z=t.useMemo(()=>l.map(e=>"string"==typeof e||"number"==typeof e?{label:e,value:e}:e),[l]),O=e=>{E(t=>t.filter(t=>t!==e))},N=e=>{E(t=>[].concat((0,S.default)(t),[e]))},M=e=>{let t=y.indexOf(e.value),r=(0,S.default)(y);-1===t?r.push(e.value):r.splice(t,1),"value"in v||w(r),null==p||p(r.filter(e=>k.includes(e)).sort((e,t)=>z.findIndex(t=>t.value===e)-z.findIndex(e=>e.value===t)))},D=h("checkbox",s),j=`${D}-group`,P=(0,c.default)(D),[I,T,_]=g(D,P),H=(0,C.default)(v,["value","disabled"]),R=l.length?z.map(e=>t.createElement($,{prefixCls:D,key:e.value.toString(),disabled:"disabled"in e?e.disabled:v.disabled,value:e.value,checked:y.includes(e.value),onChange:e.onChange,className:(0,r.default)(`${j}-item`,e.className),style:e.style,title:e.title,id:e.id,required:e.required},e.label)):o,B=t.useMemo(()=>({toggleOption:M,value:y,disabled:v.disabled,name:v.name,registerValue:N,cancelValue:O}),[M,y,v.disabled,v.name,N,O]),L=(0,r.default)(j,{[`${j}-rtl`]:"rtl"===b},d,f,_,P,T);return I(t.createElement("div",Object.assign({className:L,style:m},H,{ref:a}),t.createElement(u.Provider,{value:B},R)))});$.Group=w,$.__ANT_CHECKBOX=!0,e.s(["default",0,$],374276)},536916,e=>{"use strict";var t=e.i(374276);e.s(["Checkbox",()=>t.default])},921511,e=>{"use strict";var t=e.i(843476),r=e.i(271645),a=e.i(199133),i=e.i(602869);function o(e){return e.filter(e=>(e.version_status??"draft")!=="draft").map(e=>{var t;let r=e.version_number??1,a=e.version_status??"draft";return{label:`${e.policy_name} — v${r} (${a})${e.description?` — ${e.description}`:""}`,value:"production"===a?e.policy_name:e.policy_id?(t=e.policy_id,`policy_${t}`):e.policy_name}})}e.s(["default",0,({onChange:e,value:l,className:n,accessToken:s,disabled:c,onPoliciesLoaded:d})=>{let[u,f]=(0,r.useState)([]),[m,p]=(0,r.useState)(!1);return(0,r.useEffect)(()=>{(async()=>{if(s){p(!0);try{let e=await (0,i.getPoliciesList)(s);e.policies&&(f(e.policies),d?.(e.policies))}catch(e){console.error("Error fetching policies:",e)}finally{p(!1)}}})()},[s,d]),(0,t.jsx)("div",{children:(0,t.jsx)(a.Select,{mode:"multiple",disabled:c,placeholder:c?"Setting policies is a premium feature.":"Select policies (production or published versions)",onChange:t=>{e(t)},value:l,loading:m,className:n,allowClear:!0,options:o(u),optionFilterProp:"label",showSearch:!0,style:{width:"100%"}})})},"getPolicyOptionEntries",0,o])},891547,e=>{"use strict";var t=e.i(843476),r=e.i(271645),a=e.i(199133),i=e.i(602869);e.s(["default",0,({onChange:e,value:o,className:l,accessToken:n,disabled:s})=>{let[c,d]=(0,r.useState)([]),[u,f]=(0,r.useState)(!1);return(0,r.useEffect)(()=>{(async()=>{if(n){f(!0);try{let e=await (0,i.getGuardrailsList)(n);e.guardrails&&d(e.guardrails)}catch(e){console.error("Error fetching guardrails:",e)}finally{f(!1)}}})()},[n]),(0,t.jsx)("div",{children:(0,t.jsx)(a.Select,{mode:"multiple",disabled:s,placeholder:s?"Setting guardrails is a premium feature.":"Select guardrails",onChange:t=>{e(t)},value:o,loading:u,className:l,allowClear:!0,options:c.map(e=>({label:`${e.guardrail_name}`,value:e.guardrail_name})),optionFilterProp:"label",showSearch:!0,style:{width:"100%"}})})}])}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/02ax9y70kcggv.js b/litellm/proxy/_experimental/out/_next/static/chunks/02ax9y70kcggv.js deleted file mode 100644 index c436d5dcf0f..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/02ax9y70kcggv.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,246349,e=>{"use strict";let t=(0,e.i(475254).default)("chevron-right",[["path",{d:"m9 18 6-6-6-6",key:"mthhwq"}]]);e.s(["default",0,t])},195116,e=>{"use strict";let t=(0,e.i(475254).default)("wrench",[["path",{d:"M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z",key:"cbrjhi"}]]);e.s(["Wrench",0,t],195116)},180127,e=>{"use strict";let t=(0,e.i(475254).default)("arrow-left",[["path",{d:"m12 19-7-7 7-7",key:"1l729n"}],["path",{d:"M19 12H5",key:"x3x0zl"}]]);e.s(["default",0,t])},434166,e=>{"use strict";e.s(["getSecureItem",0,function(e){try{let t=window.sessionStorage.getItem(e);if(null===t)return null;return decodeURIComponent(atob(t).split("").map(e=>"%"+e.charCodeAt(0).toString(16).padStart(2,"0")).join(""))}catch{return null}},"setSecureItem",0,function(e,t){window.sessionStorage.setItem(e,btoa(encodeURIComponent(t).replace(/%([0-9A-F]{2})/g,(e,t)=>String.fromCharCode(parseInt(t,16)))))}])},531278,e=>{"use strict";let t=(0,e.i(475254).default)("loader-circle",[["path",{d:"M21 12a9 9 0 1 1-6.219-8.56",key:"13zald"}]]);e.s(["Loader2",0,t],531278)},302747,e=>{"use strict";var t=e.i(843476),r=e.i(115504);e.s(["Skeleton",0,function({className:e,...s}){return(0,t.jsx)("div",{"data-slot":"skeleton",className:(0,r.cn)("animate-pulse rounded-md bg-accent",e),...s})}])},463059,e=>{"use strict";var t=e.i(246349);e.s(["ChevronRight",()=>t.default])},269638,e=>{"use strict";let t=(0,e.i(475254).default)("circle-check-big",[["path",{d:"M21.801 10A10 10 0 1 1 17 3.335",key:"yps3ct"}],["path",{d:"m9 11 3 3L22 4",key:"1pflzl"}]]);e.s(["CheckCircle",0,t],269638)},292335,122520,165615,779129,280024,e=>{"use strict";let t={NONE:"none",API_KEY:"api_key",BEARER_TOKEN:"bearer_token",TOKEN:"token",BASIC:"basic",OAUTH2:"oauth2",AWS_SIGV4:"aws_sigv4"},r="client_credentials",s={SSE:"sse",HTTP:"http",STDIO:"stdio",OPENAPI:"openapi"};e.s(["AUTH_TYPE",0,t,"MCP_OAUTH2_FLOW_M2M",0,r,"OAUTH_FLOW",0,{INTERACTIVE:"interactive",M2M:"m2m"},"TRANSPORT",0,s,"getMcpOAuthMode",0,function(e){return e.auth_type!==t.OAUTH2?null:e.oauth2_flow===r?"m2m":e.delegate_auth_to_upstream?"passthrough":"obo"},"handleAuth",0,e=>null==e?t.NONE:e,"handleTransport",0,(e,t)=>null==e?s.SSE:t&&e!==s.STDIO?s.OPENAPI:e],292335);var a=e.i(271645),n=e.i(602869),i=e.i(727749);function l(e){if(e instanceof Error)return e.message;if(e&&"object"==typeof e){let t=e.detail;return"string"==typeof t?t:Array.isArray(t)?t.map(e=>e&&"object"==typeof e?"string"==typeof e.msg?e.msg:JSON.stringify(e):String(e)).join("; "):t&&"object"==typeof t&&"string"==typeof t.error?t.error:"string"==typeof e.message?e.message:JSON.stringify(e)}return String(e)}e.s(["extractErrorMessage",0,l],122520);let o=e=>{let t=new Uint8Array(e),r="";return t.forEach(e=>r+=String.fromCharCode(e)),btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},c=()=>{let e=new Uint8Array(32);return window.crypto.getRandomValues(e),o(e.buffer)},d=async e=>{let t=new TextEncoder().encode(e);return o(await window.crypto.subtle.digest("SHA-256",t))};e.s(["generateCodeChallenge",0,d,"generateCodeVerifier",0,c],165615);var u=e.i(434166);let f=()=>{{let e=window.location.pathname||"",t=e.indexOf("/ui"),r=t>=0?e.slice(0,t+3).replace(/\/+$/,""):"";return`${window.location.origin}${r}/mcp/oauth/callback`}},h=(...e)=>{e.forEach(e=>{try{window.sessionStorage.removeItem(e)}catch(e){}})};e.s(["TOOLS_OAUTH_UI_STATE_KEY",0,"litellm-mcp-oauth-tools-state","buildCallbackUrl",0,f,"clearStorage",0,h],779129);let p="litellm-user-mcp-oauth-flow-state",m="litellm-user-mcp-oauth-result",x=(e,t)=>{(0,u.setSecureItem)(e,t)},g=e=>(0,u.getSecureItem)(e);e.s(["useUserMcpOAuthFlow",0,({accessToken:e,serverId:t,serverAlias:r,scopes:s,clientId:o,onSuccess:u})=>{let[v,b]=(0,a.useState)("idle"),[y,w]=(0,a.useState)(null),j=(0,a.useRef)(!1),N=(0,a.useCallback)(async()=>{try{let a;b("authorizing"),w(null);let i=o??void 0;if(!i)try{let s=await (0,n.registerMcpOAuthClient)(e,t,{client_name:r||t,grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none"});i=s?.client_id,a=s?.client_secret}catch(e){}let l=c(),u=await d(l),h=crypto.randomUUID(),m=f(),g=s?.filter(e=>e.trim()).join(" "),v=(0,n.buildMcpOAuthAuthorizeUrl)({serverId:t,clientId:i,redirectUri:m,state:h,codeChallenge:u,scope:g}),y={state:h,codeVerifier:l,serverId:t,redirectUri:m,clientId:i,clientSecret:a,scopes:s};x(p,JSON.stringify(y));let j=new URL(window.location.href);j.searchParams.set("mcpOauthReturn","apps"),x("litellm-mcp-oauth-return-url",j.toString()),window.location.href=v}catch(t){let e=l(t);w(e),b("error"),i.default.error(e)}},[e,t,r,s,o]),k=(0,a.useCallback)(async()=>{if(j.current)return;let r=g(m);if(!r)return;let s=g(p);if(!s)return;try{let e=JSON.parse(s);if(e.serverId&&e.serverId!==t)return}catch(e){}j.current=!0,h(m);let a=null,o=null;try{a=JSON.parse(r);let e=g(p);o=e?JSON.parse(e):null}catch(e){w("Failed to resume OAuth flow. Please retry."),b("error"),j.current=!1,h(p);return}try{if(!o?.state||!o.codeVerifier||!o.serverId)throw Error("OAuth session state was lost. Please retry.");if(!a?.state||a.state!==o.state)throw Error("OAuth state mismatch. Please retry.");if(a.error)throw Error(a.error_description||a.error);if(!a.code)throw Error("Authorization code missing in callback.");b("exchanging");let t=await (0,n.exchangeMcpOAuthToken)({serverId:o.serverId,code:a.code,clientId:o.clientId,clientSecret:o.clientSecret,codeVerifier:o.codeVerifier,redirectUri:o.redirectUri,accessToken:e});await (0,n.storeMCPOAuthUserCredential)(e,o.serverId,{access_token:t.access_token,refresh_token:t.refresh_token,expires_in:t.expires_in,scopes:o.scopes}),b("success"),w(null),i.default.success("Connected successfully"),u()}catch(t){let e=l(t);w(e),b("error"),i.default.error(e)}finally{h(p),setTimeout(()=>{j.current=!1},1e3)}},[e,t,u]);return(0,a.useEffect)(()=>{k()},[k]),{startOAuthFlow:N,status:v,error:y}}],280024)},248536,e=>{"use strict";var t=e.i(843476),r=e.i(271645),s=e.i(618566),a=e.i(405033),n=e.i(266027),i=e.i(555436),l=e.i(180127),l=l,o=e.i(463059),c=e.i(195116),d=e.i(269638),u=e.i(531278),f=e.i(519455),h=e.i(793479),p=e.i(302747),m=e.i(981140),x=e.i(30030),g=e.i(820783),v=e.i(991918),b=new WeakMap;function y(e,t){var r,s;let a,n,i;if("at"in Array.prototype)return Array.prototype.at.call(e,t);let l=(r=e,s=t,a=r.length,(i=(n=w(s))>=0?n:a+n)<0||i>=a?-1:i);return -1===l?void 0:e[l]}function w(e){return e!=e||0===e?0:Math.trunc(e)}(class e extends Map{#e;constructor(e){super(e),this.#e=[...super.keys()],b.set(this,!0)}set(e,t){return b.get(this)&&(this.has(e)?this.#e[this.#e.indexOf(e)]=e:this.#e.push(e)),super.set(e,t),this}insert(e,t,r){let s,a=this.has(t),n=this.#e.length,i=w(e),l=i>=0?i:n+i,o=l<0||l>=n?-1:l;if(o===this.size||a&&o===this.size-1||-1===o)return this.set(t,r),this;let c=this.size+ +!a;i<0&&l++;let d=[...this.#e],u=!1;for(let e=l;e=this.size&&(s=this.size-1),this.at(s)}keyFrom(e,t){let r=this.indexOf(e);if(-1===r)return;let s=r+t;return s<0&&(s=0),s>=this.size&&(s=this.size-1),this.keyAt(s)}find(e,t){let r=0;for(let s of this){if(Reflect.apply(e,t,[s,r,this]))return s;r++}}findIndex(e,t){let r=0;for(let s of this){if(Reflect.apply(e,t,[s,r,this]))return r;r++}return -1}filter(t,r){let s=[],a=0;for(let e of this)Reflect.apply(t,r,[e,a,this])&&s.push(e),a++;return new e(s)}map(t,r){let s=[],a=0;for(let e of this)s.push([e[0],Reflect.apply(t,r,[e,a,this])]),a++;return new e(s)}reduce(...e){let[t,r]=e,s=0,a=r??this.at(0);for(let r of this)a=0===s&&1===e.length?r:Reflect.apply(t,this,[a,r,s,this]),s++;return a}reduceRight(...e){let[t,r]=e,s=r??this.at(-1);for(let r=this.size-1;r>=0;r--){let a=this.at(r);s=r===this.size-1&&1===e.length?a:Reflect.apply(t,this,[s,a,r,this])}return s}toSorted(t){return new e([...this.entries()].sort(t))}toReversed(){let t=new e;for(let e=this.size-1;e>=0;e--){let r=this.keyAt(e),s=this.get(r);t.set(r,s)}return t}toSpliced(...t){let r=[...this.entries()];return r.splice(...t),new e(r)}slice(t,r){let s=new e,a=this.size-1;if(void 0===t)return s;t<0&&(t+=this.size),void 0!==r&&r>0&&(a=r-1);for(let e=t;e<=a;e++){let t=this.keyAt(e),r=this.get(t);s.set(t,r)}return s}every(e,t){let r=0;for(let s of this){if(!Reflect.apply(e,t,[s,r,this]))return!1;r++}return!0}some(e,t){let r=0;for(let s of this){if(Reflect.apply(e,t,[s,r,this]))return!0;r++}return!1}});var j=e.i(610772),N=e.i(248425),k=e.i(30207),S=e.i(369340),C=e.i(586318),A="rovingFocusGroup.onEntryFocus",_={bubbles:!1,cancelable:!0},T="RovingFocusGroup",[R,E,O]=function(e){let s=e+"CollectionProvider",[a,n]=(0,x.createContextScope)(s),[i,l]=a(s,{collectionRef:{current:null},itemMap:new Map}),o=e=>{let{scope:s,children:a}=e,n=r.useRef(null),l=r.useRef(new Map).current;return(0,t.jsx)(i,{scope:s,itemMap:l,collectionRef:n,children:a})};o.displayName=s;let c=e+"CollectionSlot",d=(0,v.createSlot)(c),u=r.forwardRef((e,r)=>{let{scope:s,children:a}=e,n=l(c,s),i=(0,g.useComposedRefs)(r,n.collectionRef);return(0,t.jsx)(d,{ref:i,children:a})});u.displayName=c;let f=e+"CollectionItemSlot",h="data-radix-collection-item",p=(0,v.createSlot)(f),m=r.forwardRef((e,s)=>{let{scope:a,children:n,...i}=e,o=r.useRef(null),c=(0,g.useComposedRefs)(s,o),d=l(f,a);return r.useEffect(()=>(d.itemMap.set(o,{ref:o,...i}),()=>void d.itemMap.delete(o))),(0,t.jsx)(p,{...{[h]:""},ref:c,children:n})});return m.displayName=f,[{Provider:o,Slot:u,ItemSlot:m},function(t){let s=l(e+"CollectionConsumer",t);return r.useCallback(()=>{let e=s.collectionRef.current;if(!e)return[];let t=Array.from(e.querySelectorAll(`[${h}]`));return Array.from(s.itemMap.values()).sort((e,r)=>t.indexOf(e.ref.current)-t.indexOf(r.ref.current))},[s.collectionRef,s.itemMap])},n]}(T),[I,M]=(0,x.createContextScope)(T,[O]),[P,U]=I(T),z=r.forwardRef((e,r)=>(0,t.jsx)(R.Provider,{scope:e.__scopeRovingFocusGroup,children:(0,t.jsx)(R.Slot,{scope:e.__scopeRovingFocusGroup,children:(0,t.jsx)(F,{...e,ref:r})})}));z.displayName=T;var F=r.forwardRef((e,s)=>{let{__scopeRovingFocusGroup:a,orientation:n,loop:i=!1,dir:l,currentTabStopId:o,defaultCurrentTabStopId:c,onCurrentTabStopIdChange:d,onEntryFocus:u,preventScrollOnEntryFocus:f=!1,...h}=e,p=r.useRef(null),x=(0,g.useComposedRefs)(s,p),v=(0,C.useDirection)(l),[b,y]=(0,S.useControllableState)({prop:o,defaultProp:c??null,onChange:d,caller:T}),[w,j]=r.useState(!1),R=(0,k.useCallbackRef)(u),O=E(a),I=r.useRef(!1),[M,U]=r.useState(0);return r.useEffect(()=>{let e=p.current;if(e)return e.addEventListener(A,R),()=>e.removeEventListener(A,R)},[R]),(0,t.jsx)(P,{scope:a,orientation:n,dir:v,loop:i,currentTabStopId:b,onItemFocus:r.useCallback(e=>y(e),[y]),onItemShiftTab:r.useCallback(()=>j(!0),[]),onFocusableItemAdd:r.useCallback(()=>U(e=>e+1),[]),onFocusableItemRemove:r.useCallback(()=>U(e=>e-1),[]),children:(0,t.jsx)(N.Primitive.div,{tabIndex:w||0===M?-1:0,"data-orientation":n,...h,ref:x,style:{outline:"none",...e.style},onMouseDown:(0,m.composeEventHandlers)(e.onMouseDown,()=>{I.current=!0}),onFocus:(0,m.composeEventHandlers)(e.onFocus,e=>{let t=!I.current;if(e.target===e.currentTarget&&t&&!w){let t=new CustomEvent(A,_);if(e.currentTarget.dispatchEvent(t),!t.defaultPrevented){let e=O().filter(e=>e.focusable);$([e.find(e=>e.active),e.find(e=>e.id===b),...e].filter(Boolean).map(e=>e.ref.current),f)}}I.current=!1}),onBlur:(0,m.composeEventHandlers)(e.onBlur,()=>j(!1))})})}),L="RovingFocusGroupItem",D=r.forwardRef((e,s)=>{let{__scopeRovingFocusGroup:a,focusable:n=!0,active:i=!1,tabStopId:l,children:o,...c}=e,d=(0,j.useId)(),u=l||d,f=U(L,a),h=f.currentTabStopId===u,p=E(a),{onFocusableItemAdd:x,onFocusableItemRemove:g,currentTabStopId:v}=f;return r.useEffect(()=>{if(n)return x(),()=>g()},[n,x,g]),(0,t.jsx)(R.ItemSlot,{scope:a,id:u,focusable:n,active:i,children:(0,t.jsx)(N.Primitive.span,{tabIndex:h?0:-1,"data-orientation":f.orientation,...c,ref:s,onMouseDown:(0,m.composeEventHandlers)(e.onMouseDown,e=>{n?f.onItemFocus(u):e.preventDefault()}),onFocus:(0,m.composeEventHandlers)(e.onFocus,()=>f.onItemFocus(u)),onKeyDown:(0,m.composeEventHandlers)(e.onKeyDown,e=>{if("Tab"===e.key&&e.shiftKey)return void f.onItemShiftTab();if(e.target!==e.currentTarget)return;let t=function(e,t,r){var s;let a=(s=e.key,"rtl"!==r?s:"ArrowLeft"===s?"ArrowRight":"ArrowRight"===s?"ArrowLeft":s);if(!("vertical"===t&&["ArrowLeft","ArrowRight"].includes(a))&&!("horizontal"===t&&["ArrowUp","ArrowDown"].includes(a)))return H[a]}(e,f.orientation,f.dir);if(void 0!==t){if(e.metaKey||e.ctrlKey||e.altKey||e.shiftKey)return;e.preventDefault();let a=p().filter(e=>e.focusable).map(e=>e.ref.current);if("last"===t)a.reverse();else if("prev"===t||"next"===t){var r,s;"prev"===t&&a.reverse();let n=a.indexOf(e.currentTarget);a=f.loop?(r=a,s=n+1,r.map((e,t)=>r[(s+t)%r.length])):a.slice(n+1)}setTimeout(()=>$(a))}}),children:"function"==typeof o?o({isCurrentTabStop:h,hasTabStop:null!=v}):o})})});D.displayName=L;var H={ArrowLeft:"prev",ArrowUp:"prev",ArrowRight:"next",ArrowDown:"next",PageUp:"first",Home:"first",PageDown:"last",End:"last"};function $(e,t=!1){let r=document.activeElement;for(let s of e)if(s===r||(s.focus({preventScroll:t}),document.activeElement!==r))return}var K=e.i(296626),B="Tabs",[V,W]=(0,x.createContextScope)(B,[M]),G=M(),[J,Y]=V(B),q=r.forwardRef((e,r)=>{let{__scopeTabs:s,value:a,onValueChange:n,defaultValue:i,orientation:l="horizontal",dir:o,activationMode:c="automatic",...d}=e,u=(0,C.useDirection)(o),[f,h]=(0,S.useControllableState)({prop:a,onChange:n,defaultProp:i??"",caller:B});return(0,t.jsx)(J,{scope:s,baseId:(0,j.useId)(),value:f,onValueChange:h,orientation:l,dir:u,activationMode:c,children:(0,t.jsx)(N.Primitive.div,{dir:u,"data-orientation":l,...d,ref:r})})});q.displayName=B;var Q="TabsList",X=r.forwardRef((e,r)=>{let{__scopeTabs:s,loop:a=!0,...n}=e,i=Y(Q,s),l=G(s);return(0,t.jsx)(z,{asChild:!0,...l,orientation:i.orientation,dir:i.dir,loop:a,children:(0,t.jsx)(N.Primitive.div,{role:"tablist","aria-orientation":i.orientation,...n,ref:r})})});X.displayName=Q;var Z="TabsTrigger",ee=r.forwardRef((e,r)=>{let{__scopeTabs:s,value:a,disabled:n=!1,...i}=e,l=Y(Z,s),o=G(s),c=es(l.baseId,a),d=ea(l.baseId,a),u=a===l.value;return(0,t.jsx)(D,{asChild:!0,...o,focusable:!n,active:u,children:(0,t.jsx)(N.Primitive.button,{type:"button",role:"tab","aria-selected":u,"aria-controls":d,"data-state":u?"active":"inactive","data-disabled":n?"":void 0,disabled:n,id:c,...i,ref:r,onMouseDown:(0,m.composeEventHandlers)(e.onMouseDown,e=>{n||0!==e.button||!1!==e.ctrlKey?e.preventDefault():l.onValueChange(a)}),onKeyDown:(0,m.composeEventHandlers)(e.onKeyDown,e=>{[" ","Enter"].includes(e.key)&&l.onValueChange(a)}),onFocus:(0,m.composeEventHandlers)(e.onFocus,()=>{let e="manual"!==l.activationMode;u||n||!e||l.onValueChange(a)})})})});ee.displayName=Z;var et="TabsContent",er=r.forwardRef((e,s)=>{let{__scopeTabs:a,value:n,forceMount:i,children:l,...o}=e,c=Y(et,a),d=es(c.baseId,n),u=ea(c.baseId,n),f=n===c.value,h=r.useRef(f);return r.useEffect(()=>{let e=requestAnimationFrame(()=>h.current=!1);return()=>cancelAnimationFrame(e)},[]),(0,t.jsx)(K.Presence,{present:i||f,children:({present:r})=>(0,t.jsx)(N.Primitive.div,{"data-state":f?"active":"inactive","data-orientation":c.orientation,role:"tabpanel","aria-labelledby":d,hidden:!r,id:u,tabIndex:0,...o,ref:s,style:{...e.style,animationDuration:h.current?"0s":void 0},children:r&&l})})});function es(e,t){return`${e}-trigger-${t}`}function ea(e,t){return`${e}-content-${t}`}er.displayName=et,e.s(["Content",0,er,"List",0,X,"Root",0,q,"Tabs",0,q,"TabsContent",0,er,"TabsList",0,X,"TabsTrigger",0,ee,"Trigger",0,ee,"createTabsScope",0,W],926209);var en=e.i(926209),en=en,ei=e.i(115504);function el({className:e,orientation:r="horizontal",...s}){return(0,t.jsx)(en.Root,{"data-slot":"tabs","data-orientation":r,orientation:r,className:(0,ei.cn)("group/tabs flex gap-2 data-[orientation=horizontal]:flex-col",e),...s})}let eo=(0,ei.cva)({base:"group/tabs-list inline-flex w-fit items-center justify-center rounded-lg p-[3px] text-muted-foreground group-data-[orientation=horizontal]/tabs:h-9 group-data-[orientation=vertical]/tabs:h-fit group-data-[orientation=vertical]/tabs:flex-col data-[variant=line]:rounded-none",variants:{variant:{default:"bg-muted",line:"gap-1 bg-transparent"}},defaultVariants:{variant:"default"}});function ec({className:e,variant:r="default",...s}){return(0,t.jsx)(en.List,{"data-slot":"tabs-list","data-variant":r,className:(0,ei.cn)(eo({variant:r}),e),...s})}function ed({className:e,...r}){return(0,t.jsx)(en.Trigger,{"data-slot":"tabs-trigger",className:(0,ei.cn)("relative inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 rounded-md border border-transparent px-2 py-1 text-sm font-medium whitespace-nowrap text-foreground/60 transition-all group-data-[orientation=vertical]/tabs:w-full group-data-[orientation=vertical]/tabs:justify-start hover:text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-1 focus-visible:outline-ring disabled:pointer-events-none disabled:opacity-50 group-data-[variant=default]/tabs-list:data-[state=active]:shadow-sm group-data-[variant=line]/tabs-list:data-[state=active]:shadow-none dark:text-muted-foreground dark:hover:text-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4","group-data-[variant=line]/tabs-list:bg-transparent group-data-[variant=line]/tabs-list:data-[state=active]:bg-transparent dark:group-data-[variant=line]/tabs-list:data-[state=active]:border-transparent dark:group-data-[variant=line]/tabs-list:data-[state=active]:bg-transparent","data-[state=active]:bg-background data-[state=active]:text-foreground dark:data-[state=active]:border-input dark:data-[state=active]:bg-input/30 dark:data-[state=active]:text-foreground","after:absolute after:bg-foreground after:opacity-0 after:transition-opacity group-data-[orientation=horizontal]/tabs:after:inset-x-0 group-data-[orientation=horizontal]/tabs:after:bottom-[-5px] group-data-[orientation=horizontal]/tabs:after:h-0.5 group-data-[orientation=vertical]/tabs:after:inset-y-0 group-data-[orientation=vertical]/tabs:after:-right-1 group-data-[orientation=vertical]/tabs:after:w-0.5 group-data-[variant=line]/tabs-list:data-[state=active]:after:opacity-100",e),...r})}var eu=e.i(602869),ef=e.i(292335),eh=e.i(888259),ep=e.i(280024);let em=({server:e,accessToken:s,onConnect:a,variant:n="badge"})=>{let i=e.server_name??e.alias??e.server_id,{startOAuthFlow:l,status:o}=(0,ep.useUserMcpOAuthFlow)({accessToken:s,serverId:e.server_id,serverAlias:i,onSuccess:(0,r.useCallback)(()=>a(e.server_id),[a,e.server_id])}),c="authorizing"===o||"exchanging"===o;return"button"===n?(0,t.jsxs)(f.Button,{onClick:l,disabled:c,className:"font-semibold h-[38px] min-w-[110px]",children:[c&&(0,t.jsx)(u.Loader2,{className:"h-4 w-4 animate-spin mr-1.5"}),c?"Connecting…":"Connect"]}):(0,t.jsx)("span",{onClick:e=>{e.stopPropagation(),c||l()},className:`text-[11px] font-semibold rounded-md px-2 py-0.5 shrink-0 whitespace-nowrap ${c?"text-muted-foreground bg-muted cursor-default":"text-primary-foreground bg-primary cursor-pointer hover:bg-primary/90"}`,children:c?"Connecting…":"Connect"})},ex=["#1677ff","#52c41a","#fa8c16","#eb2f96","#722ed1","#13c2c2","#fa541c","#2f54eb","#a0d911","#faad14"];function eg(e){let t=0;for(let r=0;r{let[m,x]=(0,r.useState)([]),[g,v]=(0,r.useState)(!0),[b,y]=(0,r.useState)(""),[w,j]=(0,r.useState)("all"),[N,k]=(0,r.useState)(new Set),[S,C]=(0,r.useState)(null),[A,_]=(0,r.useState)({}),[T,R]=(0,r.useState)(!1),[E,O]=(0,r.useState)(new Set),I=(0,r.useRef)([]);(0,r.useEffect)(()=>{I.current=m},[m]);let M=(0,r.useRef)(s);(0,r.useEffect)(()=>{M.current=s},[s]);let P=(0,r.useRef)(a);(0,r.useEffect)(()=>{P.current=a},[a]);let U=e=>e.server_name??e.alias??e.server_id,z=(0,r.useRef)(!1),F=(0,r.useCallback)(async t=>{try{let r=await (0,eu.listMCPTools)(e,t.server_id);if(z.current)return;let s=Array.isArray(r?.tools)?r.tools:[];_(e=>({...e,[U(t)]:s.length}))}catch{}},[e]),L=(0,r.useCallback)(async t=>{try{let r=await (0,eu.getMCPOAuthUserCredentialStatus)(e,t.server_id);if(z.current)return;r.has_credential&&!r.is_expired&&O(e=>new Set(e).add(t.server_id))}catch{}},[e]);(0,r.useEffect)(()=>(z.current=!1,(0,eu.fetchMCPServers)(e).then(async e=>{if(z.current)return;let t=Array.isArray(e)?e:e?.data??[];for(let e of(x(t),v(!1),R(!0),Array.from({length:Math.ceil(t.length/5)},(e,r)=>t.slice(5*r,(r+1)*5)))){if(z.current)return;await Promise.allSettled(e.map(e=>F(e)))}z.current||R(!1),t.filter(e=>e.auth_type===ef.AUTH_TYPE.OAUTH2).forEach(e=>L(e))}).catch(()=>{z.current||(x([]),v(!1))}),()=>{z.current=!0}),[e,F,L]),(0,r.useEffect)(()=>{if(0===E.size)return;let e=I.current.filter(e=>E.has(e.server_id)&&!M.current.includes(U(e))).map(U);e.length>0&&P.current([...M.current,...e])},[E]);let D=async(t,r,n)=>{if(!r){a(s.filter(e=>e!==t)),n&&O(e=>{let t=new Set(e);return t.delete(n),t});return}k(e=>new Set(e).add(t));try{let r=n??t,s=await (0,eu.listMCPTools)(e,r);if(s?.error)return void eh.default.warning(`Could not load tools for ${t}`);M.current.includes(t)||a([...M.current,t])}catch{eh.default.warning(`Could not load tools for ${t}`)}finally{k(e=>{let r=new Set(e);return r.delete(t),r})}},{data:H,isLoading:$}=(0,n.useQuery)({queryKey:["mcp-apps-panel-detail-tools",S?.server_id],queryFn:()=>(0,eu.listMCPTools)(e,S.server_id),enabled:!!S}),K=Array.isArray(H?.tools)?H.tools:[],B=m.filter(e=>{let t=U(e),r=!b.trim()||t.toLowerCase().includes(b.toLowerCase())||(e.description??"").toLowerCase().includes(b.toLowerCase()),a="all"===w||s.includes(t);return r&&a}),V=m.filter(e=>s.includes(U(e))).length,W=Object.values(A).reduce((e,t)=>e+t,0);if(S){let r=U(S),a=s.includes(r),n=N.has(r),i=eg(r);return(0,t.jsxs)("div",{className:"w-full",children:[(0,t.jsxs)(f.Button,{variant:"ghost",size:"sm",onClick:()=>C(null),className:"-ml-3 mb-5 gap-1.5 text-muted-foreground hover:text-foreground",children:[(0,t.jsx)(l.default,{className:"h-3 w-3"}),"Back"]}),(0,t.jsxs)("div",{className:"flex items-start gap-5 mb-7",children:[S.mcp_info?.logo_url?(0,t.jsx)("img",{src:S.mcp_info.logo_url,alt:`${r} logo`,className:"w-16 h-16 rounded-2xl object-contain shrink-0 bg-muted/50",onError:e=>{let t=e.target;t.style.display="none",t.nextElementSibling&&(t.nextElementSibling.style.display="flex")}}):null,(0,t.jsx)("div",{className:"w-16 h-16 rounded-2xl flex items-center justify-center text-white font-bold text-[28px] shrink-0",style:{background:i,display:S.mcp_info?.logo_url?"none":"flex"},children:r.charAt(0).toUpperCase()}),(0,t.jsxs)("div",{className:"flex-1",children:[(0,t.jsx)("h2",{className:"m-0 mb-1 text-[22px] font-bold text-foreground",children:r}),(0,t.jsx)("p",{className:"m-0 text-sm text-muted-foreground",children:S.description??"MCP server"})]}),S.auth_type===ef.AUTH_TYPE.OAUTH2?E.has(S.server_id)?(0,t.jsx)(f.Button,{variant:"destructive",onClick:async()=>{try{await (0,eu.deleteMCPOAuthUserCredential)(e,S.server_id)}catch(e){}O(e=>{let t=new Set(e);return t.delete(S.server_id),t}),P.current(M.current.filter(e=>e!==r))},className:"font-semibold h-[38px] min-w-[110px]",children:"Disconnect"}):(0,t.jsx)(em,{server:S,accessToken:e,onConnect:e=>{O(t=>new Set(t).add(e))},variant:"button"}):(0,t.jsxs)(f.Button,{variant:a?"outline":"default",disabled:n,onClick:()=>D(r,!a,S.server_id),className:"font-semibold h-[38px] min-w-[110px]",children:[n&&(0,t.jsx)(u.Loader2,{className:"h-4 w-4 animate-spin mr-1.5"}),a?"Disconnect":"Connect"]})]}),(0,t.jsx)("h3",{className:"m-0 mb-3 text-[15px] font-semibold text-foreground",children:"Information"}),(0,t.jsx)("div",{className:"border rounded-lg overflow-hidden mb-7",children:[["Server ID",S.server_id],["Transport",(0,ef.handleTransport)(S.transport,S.spec_path)],["Status",a?"Connected":"Not connected"]].filter(([,e])=>e).map(([e,r],s,a)=>(0,t.jsxs)("div",{className:`flex px-4 py-3 text-[13px] ${s(0,t.jsxs)("div",{className:"border rounded-lg px-3.5 py-2.5 bg-muted/30 flex flex-col gap-1.5",children:[(0,t.jsx)(p.Skeleton,{className:"h-3.5 w-1/3"}),(0,t.jsx)(p.Skeleton,{className:"h-3 w-2/3"})]},r))}):0===K.length?(0,t.jsx)("div",{className:"text-muted-foreground text-[13px] py-2",children:"No tools available"}):(0,t.jsx)("div",{className:"flex flex-col gap-2",children:K.map(e=>(0,t.jsxs)("div",{className:"border rounded-lg px-3.5 py-2.5 bg-muted/30",children:[(0,t.jsxs)("div",{className:`flex items-center gap-2 ${e.description?"mb-1":""}`,children:[(0,t.jsx)(c.Wrench,{className:"h-3.5 w-3.5 text-muted-foreground"}),(0,t.jsx)("span",{className:"text-[13px] font-semibold text-foreground font-mono",children:e.name})]}),e.description&&(0,t.jsx)("p",{className:"m-0 text-xs text-muted-foreground pl-[21px]",children:e.description})]},e.name))})]})}return(0,t.jsxs)("div",{className:"w-full",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between mb-5 gap-4 flex-wrap",children:[(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{className:"flex items-center gap-2 mb-1",children:[(0,t.jsx)("h2",{className:"m-0 text-lg font-semibold text-foreground",children:"MCP Servers"}),(0,t.jsx)("span",{className:"text-[10px] font-semibold text-primary bg-primary/10 rounded px-1.5 py-0.5 uppercase tracking-wider",children:"Beta"})]}),(0,t.jsxs)("div",{className:"flex items-center gap-3",children:[(0,t.jsx)("p",{className:"m-0 text-[13px] text-muted-foreground",children:"Browse tools, authenticate once, use in chat"}),T?(0,t.jsxs)("span",{className:"flex items-center gap-1.5 text-xs text-muted-foreground",children:[(0,t.jsx)(u.Loader2,{className:"h-3 w-3 animate-spin"}),"Loading tools..."]}):W>0?(0,t.jsxs)("span",{className:"flex items-center gap-1 text-xs text-muted-foreground",children:[(0,t.jsx)(c.Wrench,{className:"h-3 w-3"}),W," tool",1!==W?"s":""," available"]}):null]})]}),(0,t.jsxs)("div",{className:"relative w-[220px]",children:[(0,t.jsx)(i.Search,{className:"absolute left-3 top-1/2 -translate-y-1/2 h-3.5 w-3.5 text-muted-foreground"}),(0,t.jsx)(h.Input,{placeholder:"Search servers...",value:b,onChange:e=>y(e.target.value),className:"pl-9 text-[13px] h-9"})]})]}),(0,t.jsx)(el,{value:w,onValueChange:e=>j(e),className:"mb-4",children:(0,t.jsxs)(ec,{variant:"line",className:"border-b rounded-none w-full justify-start h-auto p-0",children:[(0,t.jsx)(ed,{value:"all",className:"rounded-none px-4 py-2 text-[13px]",children:"All"}),(0,t.jsxs)(ed,{value:"connected",className:"rounded-none px-4 py-2 text-[13px]",children:["Connected",V>0?` (${V})`:""]})]})}),g?(0,t.jsx)("div",{className:"grid grid-cols-2 border rounded-lg overflow-hidden",children:Array.from({length:6},(e,r)=>(0,t.jsxs)("div",{className:`flex items-center gap-3 p-4 ${r%2==0?"border-r":""} ${r<4?"border-b":""}`,children:[(0,t.jsx)(p.Skeleton,{className:"w-[38px] h-[38px] rounded-xl shrink-0"}),(0,t.jsxs)("div",{className:"flex-1 min-w-0 flex flex-col gap-1.5",children:[(0,t.jsx)(p.Skeleton,{className:"h-3.5 w-2/3"}),(0,t.jsx)(p.Skeleton,{className:"h-3 w-1/2"})]})]},r))}):0===B.length?(0,t.jsx)("div",{className:"text-center text-muted-foreground text-[13px] py-12 px-3",children:0===m.length?"No MCP servers configured. Add servers in Tools -> MCP Servers.":"connected"===w?"No servers connected yet.":"No servers match your search."}):(0,t.jsx)("div",{className:"grid grid-cols-2 border rounded-lg overflow-hidden",children:B.map((r,a)=>{let n=U(r),i=s.includes(n),l=eg(n),u=A[n];return(0,t.jsxs)("div",{onClick:()=>C(r),className:`flex items-center gap-3 p-4 bg-card cursor-pointer transition-colors hover:bg-accent/30 min-w-0 ${a%2==0?"border-r":""} ${Math.floor(a/2){let t=e.target;t.style.display="none",t.nextElementSibling&&(t.nextElementSibling.style.display="flex")}}):null,(0,t.jsx)("div",{className:"w-[38px] h-[38px] rounded-xl flex items-center justify-center text-white font-bold text-base shrink-0",style:{background:l,display:r.mcp_info?.logo_url?"none":"flex"},children:n.charAt(0).toUpperCase()}),(0,t.jsxs)("div",{className:"flex-1 min-w-0",children:[(0,t.jsx)("div",{className:"text-sm font-medium text-foreground truncate",children:n}),(0,t.jsxs)("div",{className:"text-xs text-muted-foreground mt-0.5 flex items-center gap-1.5",children:[(0,t.jsx)("span",{className:"truncate",children:r.description??"MCP server"}),void 0!==u?u>0?(0,t.jsxs)("span",{className:"shrink-0 flex items-center gap-1 text-muted-foreground",children:["· ",(0,t.jsx)(c.Wrench,{className:"h-2.5 w-2.5"})," ",u]}):null:T?(0,t.jsx)(p.Skeleton,{className:"w-7 h-3 shrink-0"}):null]})]}),r.auth_type===ef.AUTH_TYPE.OAUTH2?E.has(r.server_id)?(0,t.jsx)(d.CheckCircle,{className:"h-3.5 w-3.5 text-emerald-600 shrink-0"}):(0,t.jsx)(em,{server:r,accessToken:e,onConnect:e=>{O(t=>new Set(t).add(e))},variant:"badge"}):i?(0,t.jsx)("span",{className:"w-[7px] h-[7px] rounded-full bg-emerald-600 dark:bg-emerald-400 shrink-0"}):null,(0,t.jsx)(o.ChevronRight,{className:"h-3 w-3 text-muted-foreground/40 shrink-0"})]},r.server_id)})})]})};function eb(){let{accessToken:e,selectedMCPServers:n,setSelectedMCPServers:i}=(0,a.useChatShell)(),l=(0,s.useRouter)(),o=(0,s.useSearchParams)().get("mcpOauthReturn");return(0,r.useEffect)(()=>{if(o){let e=new URL(window.location.href);e.searchParams.delete("mcpOauthReturn"),l.replace(e.pathname+e.search)}},[o,l]),(0,t.jsx)("div",{className:"flex-1 min-h-0 overflow-auto w-full py-8 px-8",children:(0,t.jsx)(ev,{accessToken:e,selectedServers:n,onChange:i})})}e.s(["default",0,function(){return(0,t.jsx)(r.Suspense,{children:(0,t.jsx)(eb,{})})}],248536)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/02c1-r_khzb89.js b/litellm/proxy/_experimental/out/_next/static/chunks/02c1-r_khzb89.js deleted file mode 100644 index 48e8446d60e..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/02c1-r_khzb89.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,21548,e=>{"use strict";var t=e.i(616303);e.s(["Empty",()=>t.default])},482725,e=>{"use strict";var t=e.i(244451);e.s(["Spin",()=>t.default])},362024,e=>{"use strict";var t=e.i(988122);e.s(["Collapse",()=>t.default])},91979,e=>{"use strict";e.i(247167);var t=e.i(931067),a=e.i(271645);let n={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M909.1 209.3l-56.4 44.1C775.8 155.1 656.2 92 521.9 92 290 92 102.3 279.5 102 511.5 101.7 743.7 289.8 932 521.9 932c181.3 0 335.8-115 394.6-276.1 1.5-4.2-.7-8.9-4.9-10.3l-56.7-19.5a8 8 0 00-10.1 4.8c-1.8 5-3.8 10-5.9 14.9-17.3 41-42.1 77.8-73.7 109.4A344.77 344.77 0 01655.9 829c-42.3 17.9-87.4 27-133.8 27-46.5 0-91.5-9.1-133.8-27A341.5 341.5 0 01279 755.2a342.16 342.16 0 01-73.7-109.4c-17.9-42.4-27-87.4-27-133.9s9.1-91.5 27-133.9c17.3-41 42.1-77.8 73.7-109.4 31.6-31.6 68.4-56.4 109.3-73.8 42.3-17.9 87.4-27 133.8-27 46.5 0 91.5 9.1 133.8 27a341.5 341.5 0 01109.3 73.8c9.9 9.9 19.2 20.4 27.8 31.4l-60.2 47a8 8 0 003 14.1l175.6 43c5 1.2 9.9-2.6 9.9-7.7l.8-180.9c-.1-6.6-7.8-10.3-13-6.2z"}}]},name:"reload",theme:"outlined"};var l=e.i(9583),o=a.forwardRef(function(e,o){return a.createElement(l.default,(0,t.default)({},e,{ref:o,icon:n}))});e.s(["ReloadOutlined",0,o],91979)},608856,e=>{"use strict";e.i(247167);var t=e.i(271645),a=e.i(343794),n=e.i(209428),l=e.i(392221),o=e.i(951160),r=e.i(174428),s=t.createContext(null),i=t.createContext({}),d=e.i(211577),c=e.i(931067),u=e.i(361275),f=e.i(404948),p=e.i(244009),m=e.i(703923),h=e.i(611935),x=["prefixCls","className","containerRef"];let g=function(e){var n=e.prefixCls,l=e.className,o=e.containerRef,r=(0,m.default)(e,x),s=t.useContext(i).panel,d=(0,h.useComposeRef)(s,o);return t.createElement("div",(0,c.default)({className:(0,a.default)("".concat(n,"-content"),l),role:"dialog",ref:d},(0,p.default)(e,{aria:!0}),{"aria-modal":"true"},r))};var y=e.i(883110);function b(e){return"string"==typeof e&&String(Number(e))===e?((0,y.default)(!1,"Invalid value type of `width` or `height` which should be number type instead."),Number(e)):e}var v={width:0,height:0,overflow:"hidden",outline:"none",position:"absolute"},w=t.forwardRef(function(e,o){var r,i,m,h=e.prefixCls,x=e.open,y=e.placement,w=e.inline,j=e.push,k=e.forceRender,S=e.autoFocus,C=e.keyboard,$=e.classNames,O=e.rootClassName,E=e.rootStyle,z=e.zIndex,_=e.className,N=e.id,I=e.style,R=e.motion,D=e.width,T=e.height,M=e.children,B=e.mask,F=e.maskClosable,P=e.maskMotion,L=e.maskClassName,W=e.maskStyle,A=e.afterOpenChange,K=e.onClose,H=e.onMouseEnter,U=e.onMouseOver,q=e.onMouseLeave,X=e.onClick,Y=e.onKeyDown,J=e.onKeyUp,G=e.styles,V=e.drawerRender,Z=t.useRef(),Q=t.useRef(),ee=t.useRef();t.useImperativeHandle(o,function(){return Z.current}),t.useEffect(function(){if(x&&S){var e;null==(e=Z.current)||e.focus({preventScroll:!0})}},[x]);var et=t.useState(!1),ea=(0,l.default)(et,2),en=ea[0],el=ea[1],eo=t.useContext(s),er=null!=(r=null!=(i=null==(m="boolean"==typeof j?j?{}:{distance:0}:j||{})?void 0:m.distance)?i:null==eo?void 0:eo.pushDistance)?r:180,es=t.useMemo(function(){return{pushDistance:er,push:function(){el(!0)},pull:function(){el(!1)}}},[er]);t.useEffect(function(){var e,t;x?null==eo||null==(e=eo.push)||e.call(eo):null==eo||null==(t=eo.pull)||t.call(eo)},[x]),t.useEffect(function(){return function(){var e;null==eo||null==(e=eo.pull)||e.call(eo)}},[]);var ei=t.createElement(u.default,(0,c.default)({key:"mask"},P,{visible:B&&x}),function(e,l){var o=e.className,r=e.style;return t.createElement("div",{className:(0,a.default)("".concat(h,"-mask"),o,null==$?void 0:$.mask,L),style:(0,n.default)((0,n.default)((0,n.default)({},r),W),null==G?void 0:G.mask),onClick:F&&x?K:void 0,ref:l})}),ed="function"==typeof R?R(y):R,ec={};if(en&&er)switch(y){case"top":ec.transform="translateY(".concat(er,"px)");break;case"bottom":ec.transform="translateY(".concat(-er,"px)");break;case"left":ec.transform="translateX(".concat(er,"px)");break;default:ec.transform="translateX(".concat(-er,"px)")}"left"===y||"right"===y?ec.width=b(D):ec.height=b(T);var eu={onMouseEnter:H,onMouseOver:U,onMouseLeave:q,onClick:X,onKeyDown:Y,onKeyUp:J},ef=t.createElement(u.default,(0,c.default)({key:"panel"},ed,{visible:x,forceRender:k,onVisibleChanged:function(e){null==A||A(e)},removeOnLeave:!1,leavedClassName:"".concat(h,"-content-wrapper-hidden")}),function(l,o){var r=l.className,s=l.style,i=t.createElement(g,(0,c.default)({id:N,containerRef:o,prefixCls:h,className:(0,a.default)(_,null==$?void 0:$.content),style:(0,n.default)((0,n.default)({},I),null==G?void 0:G.content)},(0,p.default)(e,{aria:!0}),eu),M);return t.createElement("div",(0,c.default)({className:(0,a.default)("".concat(h,"-content-wrapper"),null==$?void 0:$.wrapper,r),style:(0,n.default)((0,n.default)((0,n.default)({},ec),s),null==G?void 0:G.wrapper)},(0,p.default)(e,{data:!0})),V?V(i):i)}),ep=(0,n.default)({},E);return z&&(ep.zIndex=z),t.createElement(s.Provider,{value:es},t.createElement("div",{className:(0,a.default)(h,"".concat(h,"-").concat(y),O,(0,d.default)((0,d.default)({},"".concat(h,"-open"),x),"".concat(h,"-inline"),w)),style:ep,tabIndex:-1,ref:Z,onKeyDown:function(e){var t,a,n=e.keyCode,l=e.shiftKey;switch(n){case f.default.TAB:n===f.default.TAB&&(l||document.activeElement!==ee.current?l&&document.activeElement===Q.current&&(null==(a=ee.current)||a.focus({preventScroll:!0})):null==(t=Q.current)||t.focus({preventScroll:!0}));break;case f.default.ESC:K&&C&&(e.stopPropagation(),K(e))}}},ei,t.createElement("div",{tabIndex:0,ref:Q,style:v,"aria-hidden":"true","data-sentinel":"start"}),ef,t.createElement("div",{tabIndex:0,ref:ee,style:v,"aria-hidden":"true","data-sentinel":"end"})))});let j=function(e){var a=e.open,s=e.prefixCls,d=e.placement,c=e.autoFocus,u=e.keyboard,f=e.width,p=e.mask,m=void 0===p||p,h=e.maskClosable,x=e.getContainer,g=e.forceRender,y=e.afterOpenChange,b=e.destroyOnClose,v=e.onMouseEnter,j=e.onMouseOver,k=e.onMouseLeave,S=e.onClick,C=e.onKeyDown,$=e.onKeyUp,O=e.panelRef,E=t.useState(!1),z=(0,l.default)(E,2),_=z[0],N=z[1],I=t.useState(!1),R=(0,l.default)(I,2),D=R[0],T=R[1];(0,r.default)(function(){T(!0)},[]);var M=!!D&&void 0!==a&&a,B=t.useRef(),F=t.useRef();(0,r.default)(function(){M&&(F.current=document.activeElement)},[M]);var P=t.useMemo(function(){return{panel:O}},[O]);if(!g&&!_&&!M&&b)return null;var L=(0,n.default)((0,n.default)({},e),{},{open:M,prefixCls:void 0===s?"rc-drawer":s,placement:void 0===d?"right":d,autoFocus:void 0===c||c,keyboard:void 0===u||u,width:void 0===f?378:f,mask:m,maskClosable:void 0===h||h,inline:!1===x,afterOpenChange:function(e){var t,a;N(e),null==y||y(e),e||!F.current||null!=(t=B.current)&&t.contains(F.current)||null==(a=F.current)||a.focus({preventScroll:!0})},ref:B},{onMouseEnter:v,onMouseOver:j,onMouseLeave:k,onClick:S,onKeyDown:C,onKeyUp:$});return t.createElement(i.Provider,{value:P},t.createElement(o.default,{open:M||g||_,autoDestroy:!1,getContainer:x,autoLock:m&&(M||_)},t.createElement(w,L)))};var k=e.i(981444),S=e.i(617206),C=e.i(122767),$=e.i(613541),O=e.i(340010),E=e.i(242064),z=e.i(922611),_=e.i(563113),N=e.i(185793);let I=e=>{var n,l,o,r;let s,{prefixCls:i,ariaId:d,title:c,footer:u,extra:f,closable:p,loading:m,onClose:h,headerStyle:x,bodyStyle:g,footerStyle:y,children:b,classNames:v,styles:w}=e,j=(0,E.useComponentConfig)("drawer");s=!1===p?void 0:void 0===p||!0===p?"start":(null==p?void 0:p.placement)==="end"?"end":"start";let k=t.useCallback(e=>t.createElement("button",{type:"button",onClick:h,className:(0,a.default)(`${i}-close`,{[`${i}-close-${s}`]:"end"===s})},e),[h,i,s]),[S,C]=(0,_.useClosable)((0,_.pickClosable)(e),(0,_.pickClosable)(j),{closable:!0,closeIconRender:k});return t.createElement(t.Fragment,null,c||S?t.createElement("div",{style:Object.assign(Object.assign(Object.assign({},null==(o=j.styles)?void 0:o.header),x),null==w?void 0:w.header),className:(0,a.default)(`${i}-header`,{[`${i}-header-close-only`]:S&&!c&&!f},null==(r=j.classNames)?void 0:r.header,null==v?void 0:v.header)},t.createElement("div",{className:`${i}-header-title`},"start"===s&&C,c&&t.createElement("div",{className:`${i}-title`,id:d},c)),f&&t.createElement("div",{className:`${i}-extra`},f),"end"===s&&C):null,t.createElement("div",{className:(0,a.default)(`${i}-body`,null==v?void 0:v.body,null==(n=j.classNames)?void 0:n.body),style:Object.assign(Object.assign(Object.assign({},null==(l=j.styles)?void 0:l.body),g),null==w?void 0:w.body)},m?t.createElement(N.default,{active:!0,title:!1,paragraph:{rows:5},className:`${i}-body-skeleton`}):b),(()=>{var e,n;if(!u)return null;let l=`${i}-footer`;return t.createElement("div",{className:(0,a.default)(l,null==(e=j.classNames)?void 0:e.footer,null==v?void 0:v.footer),style:Object.assign(Object.assign(Object.assign({},null==(n=j.styles)?void 0:n.footer),y),null==w?void 0:w.footer)},u)})())};e.i(296059);var R=e.i(915654),D=e.i(183293),T=e.i(246422),M=e.i(838378);let B=(e,t)=>({"&-enter, &-appear":Object.assign(Object.assign({},e),{"&-active":t}),"&-leave":Object.assign(Object.assign({},t),{"&-active":e})}),F=(e,t)=>Object.assign({"&-enter, &-appear, &-leave":{"&-start":{transition:"none"},"&-active":{transition:`all ${t}`}}},B({opacity:e},{opacity:1})),P=(0,T.genStyleHooks)("Drawer",e=>{let t=(0,M.mergeToken)(e,{});return[(e=>{let{borderRadiusSM:t,componentCls:a,zIndexPopup:n,colorBgMask:l,colorBgElevated:o,motionDurationSlow:r,motionDurationMid:s,paddingXS:i,padding:d,paddingLG:c,fontSizeLG:u,lineHeightLG:f,lineWidth:p,lineType:m,colorSplit:h,marginXS:x,colorIcon:g,colorIconHover:y,colorBgTextHover:b,colorBgTextActive:v,colorText:w,fontWeightStrong:j,footerPaddingBlock:k,footerPaddingInline:S,calc:C}=e,$=`${a}-content-wrapper`;return{[a]:{position:"fixed",inset:0,zIndex:n,pointerEvents:"none",color:w,"&-pure":{position:"relative",background:o,display:"flex",flexDirection:"column",[`&${a}-left`]:{boxShadow:e.boxShadowDrawerLeft},[`&${a}-right`]:{boxShadow:e.boxShadowDrawerRight},[`&${a}-top`]:{boxShadow:e.boxShadowDrawerUp},[`&${a}-bottom`]:{boxShadow:e.boxShadowDrawerDown}},"&-inline":{position:"absolute"},[`${a}-mask`]:{position:"absolute",inset:0,zIndex:n,background:l,pointerEvents:"auto"},[$]:{position:"absolute",zIndex:n,maxWidth:"100vw",transition:`all ${r}`,"&-hidden":{display:"none"}},[`&-left > ${$}`]:{top:0,bottom:0,left:{_skip_check_:!0,value:0},boxShadow:e.boxShadowDrawerLeft},[`&-right > ${$}`]:{top:0,right:{_skip_check_:!0,value:0},bottom:0,boxShadow:e.boxShadowDrawerRight},[`&-top > ${$}`]:{top:0,insetInline:0,boxShadow:e.boxShadowDrawerUp},[`&-bottom > ${$}`]:{bottom:0,insetInline:0,boxShadow:e.boxShadowDrawerDown},[`${a}-content`]:{display:"flex",flexDirection:"column",width:"100%",height:"100%",overflow:"auto",background:o,pointerEvents:"auto"},[`${a}-header`]:{display:"flex",flex:0,alignItems:"center",padding:`${(0,R.unit)(d)} ${(0,R.unit)(c)}`,fontSize:u,lineHeight:f,borderBottom:`${(0,R.unit)(p)} ${m} ${h}`,"&-title":{display:"flex",flex:1,alignItems:"center",minWidth:0,minHeight:0}},[`${a}-extra`]:{flex:"none"},[`${a}-close`]:Object.assign({display:"inline-flex",width:C(u).add(i).equal(),height:C(u).add(i).equal(),borderRadius:t,justifyContent:"center",alignItems:"center",color:g,fontWeight:j,fontSize:u,fontStyle:"normal",lineHeight:1,textAlign:"center",textTransform:"none",textDecoration:"none",background:"transparent",border:0,cursor:"pointer",transition:`all ${s}`,textRendering:"auto",[`&${a}-close-end`]:{marginInlineStart:x},[`&:not(${a}-close-end)`]:{marginInlineEnd:x},"&:hover":{color:y,backgroundColor:b,textDecoration:"none"},"&:active":{backgroundColor:v}},(0,D.genFocusStyle)(e)),[`${a}-title`]:{flex:1,margin:0,fontWeight:e.fontWeightStrong,fontSize:u,lineHeight:f},[`${a}-body`]:{flex:1,minWidth:0,minHeight:0,padding:c,overflow:"auto",[`${a}-body-skeleton`]:{width:"100%",height:"100%",display:"flex",justifyContent:"center"}},[`${a}-footer`]:{flexShrink:0,padding:`${(0,R.unit)(k)} ${(0,R.unit)(S)}`,borderTop:`${(0,R.unit)(p)} ${m} ${h}`},"&-rtl":{direction:"rtl"}}}})(t),(e=>{let{componentCls:t,motionDurationSlow:a}=e;return{[t]:{[`${t}-mask-motion`]:F(0,a),[`${t}-panel-motion`]:["left","right","top","bottom"].reduce((e,t)=>{let n;return Object.assign(Object.assign({},e),{[`&-${t}`]:[F(.7,a),B({transform:(n="100%",({left:`translateX(-${n})`,right:`translateX(${n})`,top:`translateY(-${n})`,bottom:`translateY(${n})`})[t])},{transform:"none"})]})},{})}}})(t)]},e=>({zIndexPopup:e.zIndexPopupBase,footerPaddingBlock:e.paddingXS,footerPaddingInline:e.padding}));var L=function(e,t){var a={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(a[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var l=0,n=Object.getOwnPropertySymbols(e);lt.indexOf(n[l])&&Object.prototype.propertyIsEnumerable.call(e,n[l])&&(a[n[l]]=e[n[l]]);return a};let W={distance:180},A=e=>{let{rootClassName:n,width:l,height:o,size:r="default",mask:s=!0,push:i=W,open:d,afterOpenChange:c,onClose:u,prefixCls:f,getContainer:p,panelRef:m=null,style:x,className:g,"aria-labelledby":y,visible:b,afterVisibleChange:v,maskStyle:w,drawerStyle:_,contentWrapperStyle:N,destroyOnClose:R,destroyOnHidden:D}=e,T=L(e,["rootClassName","width","height","size","mask","push","open","afterOpenChange","onClose","prefixCls","getContainer","panelRef","style","className","aria-labelledby","visible","afterVisibleChange","maskStyle","drawerStyle","contentWrapperStyle","destroyOnClose","destroyOnHidden"]),M=(0,k.default)(),B=T.title?M:void 0,{getPopupContainer:F,getPrefixCls:A,direction:K,className:H,style:U,classNames:q,styles:X}=(0,E.useComponentConfig)("drawer"),Y=A("drawer",f),[J,G,V]=P(Y),Z=void 0===p&&F?()=>F(document.body):p,Q=(0,a.default)({"no-mask":!s,[`${Y}-rtl`]:"rtl"===K},n,G,V),ee=t.useMemo(()=>null!=l?l:"large"===r?736:378,[l,r]),et=t.useMemo(()=>null!=o?o:"large"===r?736:378,[o,r]),ea={motionName:(0,$.getTransitionName)(Y,"mask-motion"),motionAppear:!0,motionEnter:!0,motionLeave:!0,motionDeadline:500},en=(0,z.usePanelRef)(),el=(0,h.composeRef)(m,en),[eo,er]=(0,C.useZIndex)("Drawer",T.zIndex),{classNames:es={},styles:ei={}}=T;return J(t.createElement(S.default,{form:!0,space:!0},t.createElement(O.default.Provider,{value:er},t.createElement(j,Object.assign({prefixCls:Y,onClose:u,maskMotion:ea,motion:e=>({motionName:(0,$.getTransitionName)(Y,`panel-motion-${e}`),motionAppear:!0,motionEnter:!0,motionLeave:!0,motionDeadline:500})},T,{classNames:{mask:(0,a.default)(es.mask,q.mask),content:(0,a.default)(es.content,q.content),wrapper:(0,a.default)(es.wrapper,q.wrapper)},styles:{mask:Object.assign(Object.assign(Object.assign({},ei.mask),w),X.mask),content:Object.assign(Object.assign(Object.assign({},ei.content),_),X.content),wrapper:Object.assign(Object.assign(Object.assign({},ei.wrapper),N),X.wrapper)},open:null!=d?d:b,mask:s,push:i,width:ee,height:et,style:Object.assign(Object.assign({},U),x),className:(0,a.default)(H,g),rootClassName:Q,getContainer:Z,afterOpenChange:null!=c?c:v,panelRef:el,zIndex:eo,"aria-labelledby":null!=y?y:B,destroyOnClose:null!=D?D:R}),t.createElement(I,Object.assign({prefixCls:Y},T,{ariaId:B,onClose:u}))))))};A._InternalPanelDoNotUseOrYouWillBeFired=e=>{let{prefixCls:n,style:l,className:o,placement:r="right"}=e,s=L(e,["prefixCls","style","className","placement"]),{getPrefixCls:i}=t.useContext(E.ConfigContext),d=i("drawer",n),[c,u,f]=P(d),p=(0,a.default)(d,`${d}-pure`,`${d}-${r}`,u,f,o);return c(t.createElement("div",{className:p,style:l},t.createElement(I,Object.assign({prefixCls:d},s))))},e.s(["Drawer",0,A],608856)},425656,e=>{"use strict";var t=e.i(843476),a=e.i(271645),n=e.i(464571),l=e.i(362024),o=e.i(608856),r=e.i(21548),s=e.i(482725),i=e.i(291542),d=e.i(592968),c=e.i(898586),u=e.i(91979),f=e.i(602869);let{Text:p}=c.Typography,m={pending:"#a1a1aa",running:"#3b82f6",paused:"#f59e0b",completed:"#22c55e",failed:"#ef4444"},h={"step.started":{bar:"#f0fdf4",border:"#86efac",text:"#16a34a"},"step.failed":{bar:"#fef2f2",border:"#fca5a5",text:"#dc2626"},"hook.waiting":{bar:"#fffbeb",border:"#fcd34d",text:"#d97706"},"hook.received":{bar:"#eff6ff",border:"#93c5fd",text:"#2563eb"}};function x(e){let t=Date.now()-new Date(e).getTime();if(isNaN(t))return e;let a=Math.floor(t/1e3);if(a<60)return`${a}s ago`;let n=Math.floor(a/60);if(n<60)return`${n}m ago`;let l=Math.floor(n/60);return l<24?`${l}h ago`:`${Math.floor(l/24)}d ago`}function g(e){return e<0?"":e<1e3?`${e}ms`:`${(e/1e3).toFixed(1)}s`}function y(e){let t=e.metadata?.title;return t?String(t):e.workflow_type??e.run_id.slice(0,8)}function b(e){return e.slice(0,8)}let v=({status:e,size:a=8})=>(0,t.jsx)("span",{style:{display:"inline-block",width:a,height:a,borderRadius:"50%",background:m[e]??"#a1a1aa",flexShrink:0}}),w=({value:e})=>{let[n,l]=(0,a.useState)(!1);return e.length<=120?(0,t.jsx)("span",{style:{color:"#27272a",wordBreak:"break-all"},children:e}):(0,t.jsxs)("span",{style:{color:"#27272a",wordBreak:"break-all"},children:[n?e:e.slice(0,120)+"…",(0,t.jsx)("button",{onClick:()=>l(e=>!e),style:{background:"none",border:"none",padding:"0 4px",cursor:"pointer",color:"#2563eb",fontSize:11,flexShrink:0},children:n?"less":"more"})]})},j=({run:e})=>{let a=e.metadata??{},n=[{key:"state",label:"state"},{key:"worktree_path",label:"worktree"},{key:"grill_session_id",label:"grill session"},{key:"session_id",label:"session"}],l=new Set(["title",...n.map(e=>e.key)]),o=Object.entries(a).filter(([e,t])=>!l.has(e)&&null!=t&&""!==t);return(0,t.jsxs)("div",{style:{borderRadius:8,border:"1px solid #e4e4e7",marginBottom:16,overflow:"hidden"},children:[(0,t.jsxs)("div",{style:{padding:"14px 20px",borderBottom:"1px solid #f4f4f5",display:"flex",alignItems:"center",gap:10},children:[(0,t.jsx)(v,{status:e.status,size:10}),(0,t.jsx)("span",{style:{fontSize:14,fontWeight:600,color:"#18181b",flex:1},children:y(e)}),(0,t.jsx)("span",{style:{fontFamily:"monospace",fontSize:11,color:"#a1a1aa",background:"#f4f4f5",padding:"2px 8px",borderRadius:4},children:b(e.run_id)}),(0,t.jsx)("span",{style:{fontSize:11,color:"#a1a1aa",background:"#f4f4f5",padding:"2px 8px",borderRadius:4},children:e.workflow_type})]}),(0,t.jsxs)("div",{style:{padding:"12px 20px",display:"grid",gridTemplateColumns:"repeat(auto-fill, minmax(220px, 1fr))",gap:"8px 24px",fontFamily:"monospace",fontSize:12},children:[(0,t.jsx)(k,{label:"status",children:(0,t.jsx)("span",{style:{textTransform:"capitalize",color:"#27272a"},children:e.status})}),(0,t.jsx)(k,{label:"created",children:(0,t.jsx)("span",{style:{color:"#27272a"},children:x(e.created_at)})}),a.pr_url&&(0,t.jsx)(k,{label:"pr",children:(0,t.jsx)("a",{href:String(a.pr_url),target:"_blank",rel:"noopener noreferrer",style:{color:"#2563eb",textDecoration:"none",wordBreak:"break-all"},children:String(a.pr_url)})}),n.map(({key:e,label:n})=>{let l=a[e];if(null==l||""===l)return null;let o="object"==typeof l?JSON.stringify(l):String(l);return(0,t.jsx)(k,{label:n,children:(0,t.jsx)(w,{value:o})},e)}),o.map(([e,a])=>{let n="object"==typeof a?JSON.stringify(a):String(a);return(0,t.jsx)(k,{label:e,children:(0,t.jsx)(w,{value:n})},e)})]})]})},k=({label:e,children:a})=>(0,t.jsxs)("div",{style:{display:"flex",flexDirection:"column",gap:1},children:[(0,t.jsx)("span",{style:{fontSize:10,color:"#a1a1aa",textTransform:"uppercase",letterSpacing:"0.06em"},children:e}),(0,t.jsx)("span",{style:{fontSize:12},children:a})]}),S=({run:e,events:n})=>{if(0===n.length)return(0,t.jsx)("div",{style:{padding:"16px 0",color:"#a1a1aa",fontSize:12,fontFamily:"monospace"},children:"No events recorded"});let l=new Date(e.created_at).getTime(),o=Math.max(...n.map(e=>new Date(e.created_at).getTime())),r=Math.max(o-l,1),s=g(o-l);return(0,t.jsxs)("div",{style:{fontFamily:"monospace",fontSize:12},children:[(0,t.jsxs)("div",{style:{display:"grid",gridTemplateColumns:"160px 1fr",gap:"0 12px",marginBottom:2},children:[(0,t.jsx)("div",{}),(0,t.jsx)("div",{style:{position:"relative",height:16},children:[0,100].map(e=>(0,t.jsx)("span",{style:{position:"absolute",left:`${e}%`,transform:100===e?"translateX(-100%)":void 0,fontSize:10,color:"#a1a1aa"},children:0===e?"0":s},e))})]}),(0,t.jsxs)("div",{style:{display:"grid",gridTemplateColumns:"160px 1fr",gap:"0 12px",marginBottom:4},children:[(0,t.jsx)("div",{style:{color:"#3f3f46",overflow:"hidden",textOverflow:"ellipsis",whiteSpace:"nowrap",paddingTop:2},children:y(e)}),(0,t.jsx)("div",{style:{height:24,background:"#f4f4f5",border:"1px solid #d4d4d8",borderRadius:4,display:"flex",alignItems:"center",paddingLeft:8},children:(0,t.jsx)("span",{style:{color:"#71717a",fontSize:11},children:s})})]}),(0,t.jsx)("div",{style:{display:"grid",gridTemplateColumns:"160px 1fr",gap:"0 12px",rowGap:3},children:n.map(e=>{let s=new Date(e.created_at).getTime(),i=(s-l)/r*100,c=n.findIndex(t=>t.sequence_number>e.sequence_number),u=c>=0?new Date(n[c].created_at).getTime():o+Math.max(.12*r,500),f=Math.max(8,(u-s)/r*100),p=h[e.event_type]??{bar:"#f4f4f5",border:"#d4d4d8",text:"#52525b"},m=g(u-s);return(0,t.jsxs)(a.default.Fragment,{children:[(0,t.jsx)("div",{style:{color:p.text,overflow:"hidden",textOverflow:"ellipsis",whiteSpace:"nowrap",paddingTop:2,paddingLeft:12},children:e.step_name||e.event_type}),(0,t.jsx)("div",{style:{position:"relative",height:24},children:(0,t.jsx)(d.Tooltip,{title:(0,t.jsxs)("div",{style:{fontFamily:"monospace",fontSize:11,lineHeight:1.6},children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{style:{color:"#a1a1aa"},children:"type: "}),(0,t.jsx)("span",{style:{color:p.text},children:e.event_type})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{style:{color:"#a1a1aa"},children:"step: "}),e.step_name]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{style:{color:"#a1a1aa"},children:"seq: "}),e.sequence_number]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{style:{color:"#a1a1aa"},children:"time: "}),x(e.created_at)]}),e.data&&Object.keys(e.data).length>0&&(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{style:{color:"#a1a1aa"},children:"data: "}),JSON.stringify(e.data)]})]}),children:(0,t.jsxs)("div",{style:{position:"absolute",left:`${Math.min(i,92)}%`,width:`${Math.min(f,100-Math.min(i,92))}%`,height:"100%",background:p.bar,border:`1px solid ${p.border}`,borderRadius:4,display:"flex",alignItems:"center",paddingLeft:8,cursor:"default",overflow:"hidden",gap:6},children:[(0,t.jsx)("span",{style:{color:p.text,whiteSpace:"nowrap",fontSize:11},children:e.event_type}),m&&(0,t.jsx)("span",{style:{color:"#a1a1aa",whiteSpace:"nowrap",fontSize:11},children:m})]})})})]},e.event_id)})})]})},C=({msg:e})=>{let a={user:"#2563eb",assistant:"#16a34a",system:"#7c3aed",tool_result:"#d97706"}[e.role]??"#52525b";return(0,t.jsxs)("div",{style:{display:"grid",gridTemplateColumns:"80px 1fr",gap:"0 16px",padding:"10px 0",borderBottom:"1px solid #f4f4f5",fontFamily:"monospace",fontSize:12,alignItems:"start"},children:[(0,t.jsxs)("span",{style:{color:a,paddingTop:1},children:["[",e.role,"]"]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{style:{color:"#27272a",lineHeight:1.6,whiteSpace:"pre-wrap",wordBreak:"break-word",display:"block"},children:e.content}),(0,t.jsx)("span",{style:{color:"#a1a1aa",fontSize:11,marginTop:2,display:"block"},children:x(e.created_at)})]})]})},$=({accessToken:e})=>{let[d,c]=(0,a.useState)([]),[p,m]=(0,a.useState)(!1),[h,g]=(0,a.useState)(null),[w,k]=(0,a.useState)([]),[$,O]=(0,a.useState)([]),[E,z]=(0,a.useState)(!1),[_,N]=(0,a.useState)(!1),I=(0,a.useCallback)(async()=>{if(e){m(!0);try{let t=await fetch(`${f.proxyBaseUrl??""}/v1/workflows/runs?limit=100`,{headers:{Authorization:`Bearer ${e}`}});if(!t.ok)throw Error(`HTTP ${t.status}`);let a=await t.json();c(a.runs??[])}catch(e){console.error("workflow runs fetch failed:",e)}finally{m(!1)}}},[e]),R=(0,a.useCallback)(async t=>{if(e){g(t),N(!0),z(!0),k([]),O([]);try{let a=f.proxyBaseUrl??"",[n,l]=await Promise.all([fetch(`${a}/v1/workflows/runs/${t.run_id}/events`,{headers:{Authorization:`Bearer ${e}`}}),fetch(`${a}/v1/workflows/runs/${t.run_id}/messages`,{headers:{Authorization:`Bearer ${e}`}})]),o=n.ok?await n.json():{events:[]},r=l.ok?await l.json():{messages:[]};k([...o.events??[]].sort((e,t)=>e.sequence_number-t.sequence_number)),O([...r.messages??[]].sort((e,t)=>e.sequence_number-t.sequence_number))}catch(e){console.error("workflow run detail fetch failed:",e)}finally{z(!1)}}},[e]);(0,a.useEffect)(()=>{I()},[I]);let D=[{title:"Run",dataIndex:"run_id",key:"run",render:(e,a)=>(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:8},children:[(0,t.jsx)(v,{status:a.status,size:7}),(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{style:{fontSize:13,color:"#18181b",fontWeight:500,lineHeight:1.4},children:y(a)}),(0,t.jsx)("div",{style:{fontFamily:"monospace",fontSize:11,color:"#a1a1aa"},children:b(a.run_id)})]})]})},{title:"Type",dataIndex:"workflow_type",key:"workflow_type",render:e=>(0,t.jsx)("span",{style:{fontFamily:"monospace",fontSize:12,color:"#71717a"},children:e})},{title:"Status",dataIndex:"status",key:"status",render:(e,a)=>{let n=a.metadata?.state;return(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:6},children:[(0,t.jsx)(v,{status:e,size:7}),(0,t.jsx)("span",{style:{fontSize:12,color:"#52525b",textTransform:"capitalize"},children:n??e})]})}},{title:"Created",dataIndex:"created_at",key:"created_at",render:e=>(0,t.jsx)("span",{style:{fontSize:12,color:"#a1a1aa"},children:x(e)})}];return(0,t.jsxs)("div",{style:{width:"100%",padding:"24px 32px",fontFamily:'-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif',minHeight:"calc(100vh - 64px)",background:"#fff"},children:[(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",justifyContent:"space-between",marginBottom:20},children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{style:{fontSize:18,fontWeight:600,color:"#18181b"},children:"Workflow Runs"}),(0,t.jsx)("div",{style:{fontSize:13,color:"#71717a",marginTop:2},children:"Durable state tracking for agents and automated workflows"})]}),(0,t.jsx)(n.Button,{icon:(0,t.jsx)(u.ReloadOutlined,{}),onClick:I,loading:p,style:{color:"#71717a",borderColor:"#e4e4e7"},children:"Refresh"})]}),(0,t.jsx)("div",{className:"rounded-lg custom-border overflow-x-auto w-full",children:(0,t.jsx)(i.Table,{dataSource:d,columns:D,rowKey:"run_id",loading:p,size:"small",pagination:{pageSize:50,hideOnSinglePage:!0,size:"small"},onRow:e=>({onClick:()=>R(e),style:{cursor:"pointer"}}),locale:{emptyText:(0,t.jsx)(r.Empty,{description:(0,t.jsx)("span",{style:{color:"#a1a1aa",fontSize:13},children:"No workflow runs yet"}),image:r.Empty.PRESENTED_IMAGE_SIMPLE})},className:"[&_.ant-table-cell]:py-0.5 [&_.ant-table-thead_.ant-table-cell]:py-1",style:{border:"none"}})}),(0,t.jsx)(o.Drawer,{open:_,onClose:()=>N(!1),width:680,title:null,closable:!1,bodyStyle:{padding:0},styles:{body:{padding:0}},children:h?E?(0,t.jsx)("div",{style:{display:"flex",justifyContent:"center",padding:80},children:(0,t.jsx)(s.Spin,{})}):(0,t.jsxs)("div",{style:{padding:"24px 28px",fontFamily:'-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif'},children:[(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",justifyContent:"space-between",marginBottom:16},children:[(0,t.jsx)("button",{onClick:()=>N(!1),style:{background:"none",border:"none",cursor:"pointer",padding:"4px 0",fontSize:12,color:"#a1a1aa",display:"flex",alignItems:"center",gap:4},children:"← close"}),(0,t.jsx)(n.Button,{size:"small",icon:(0,t.jsx)(u.ReloadOutlined,{}),onClick:()=>R(h),loading:E,style:{color:"#71717a",borderColor:"#e4e4e7"},children:"Refresh"})]}),(0,t.jsx)(j,{run:h}),(0,t.jsx)(l.Collapse,{defaultActiveKey:["timeline"],ghost:!1,style:{border:"1px solid #e4e4e7",borderRadius:8,overflow:"hidden"},items:[{key:"timeline",label:(0,t.jsxs)("span",{style:{fontSize:12,fontWeight:500,color:"#3f3f46"},children:["Timeline",(0,t.jsxs)("span",{style:{marginLeft:6,fontSize:11,color:"#a1a1aa",fontWeight:400},children:[w.length," ",1===w.length?"event":"events"]})]}),children:(0,t.jsx)("div",{style:{padding:"4px 4px 12px"},children:(0,t.jsx)(S,{run:h,events:w})})},{key:"messages",label:(0,t.jsxs)("span",{style:{fontSize:12,fontWeight:500,color:"#3f3f46"},children:["Messages",(0,t.jsx)("span",{style:{marginLeft:6,fontSize:11,color:"#a1a1aa",fontWeight:400},children:$.length})]}),children:0===$.length?(0,t.jsx)("div",{style:{padding:"12px 4px",color:"#a1a1aa",fontSize:12,fontFamily:"monospace"},children:"No messages"}):(0,t.jsx)("div",{style:{paddingBottom:4},children:$.map(e=>(0,t.jsx)(C,{msg:e},e.message_id))})}]})]}):null})]})};var O=e.i(135214);e.s(["default",0,function(){let{accessToken:e}=(0,O.default)();return(0,t.jsx)($,{accessToken:e})}],425656)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/02eah8_db3ldv.js b/litellm/proxy/_experimental/out/_next/static/chunks/02eah8_db3ldv.js deleted file mode 100644 index 74495e8e91e..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/02eah8_db3ldv.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,250980,e=>{"use strict";var l=e.i(271645);let s=l.forwardRef(function(e,s){return l.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),l.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M12 9v3m0 0v3m0-3h3m-3 0H9m12 0a9 9 0 11-18 0 9 9 0 0118 0z"}))});e.s(["PlusCircleIcon",0,s],250980)},695411,e=>{"use strict";var l=e.i(602869);let s=async e=>{try{let s=await (0,l.modelHubCall)(e);if(s?.data.length>0){let e=s.data.map(e=>({model_group:e.model_group,mode:e?.mode}));return e.sort((e,l)=>e.model_group.localeCompare(l.model_group)),e}return[]}catch(e){throw console.error("Error fetching model info:",e),e}};e.s(["fetchAvailableModels",0,s])},841947,e=>{"use strict";let l=(0,e.i(475254).default)("x",[["path",{d:"M18 6 6 18",key:"1bl5f8"}],["path",{d:"m6 6 12 12",key:"d8bk6v"}]]);e.s(["default",0,l])},603908,e=>{"use strict";let l=(0,e.i(475254).default)("plus",[["path",{d:"M5 12h14",key:"1ays0h"}],["path",{d:"M12 5v14",key:"s699le"}]]);e.s(["default",0,l])},107233,e=>{"use strict";var l=e.i(603908);e.s(["Plus",()=>l.default])},37727,e=>{"use strict";var l=e.i(841947);e.s(["X",()=>l.default])},158392,63209,e=>{"use strict";var l=e.i(843476),s=e.i(311451);let t={ttl:3600,lowest_latency_buffer:0},r=({routingStrategyArgs:e})=>{let r={ttl:"Sliding window to look back over when calculating the average latency of a deployment. Default - 1 hour (in seconds).",lowest_latency_buffer:"Shuffle between deployments within this % of the lowest latency. Default - 0 (i.e. always pick lowest latency)."};return(0,l.jsxs)(l.Fragment,{children:[(0,l.jsxs)("div",{className:"space-y-6",children:[(0,l.jsxs)("div",{className:"max-w-3xl",children:[(0,l.jsx)("h3",{className:"text-sm font-medium text-gray-900",children:"Latency-Based Configuration"}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-1",children:"Fine-tune latency-based routing behavior"})]}),(0,l.jsx)("div",{className:"grid grid-cols-1 gap-6 lg:grid-cols-2 xl:grid-cols-3",children:Object.entries(e||t).map(([e,t])=>(0,l.jsx)("div",{className:"space-y-2",children:(0,l.jsxs)("label",{className:"block",children:[(0,l.jsx)("span",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:e.replace(/_/g," ")}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-0.5 mb-2",children:r[e]||""}),(0,l.jsx)(s.Input,{name:e,defaultValue:"object"==typeof t?JSON.stringify(t,null,2):t?.toString(),className:"font-mono text-sm w-full"})]})},e))})]}),(0,l.jsx)("div",{className:"border-t border-gray-200"})]})},a=({routerSettings:e,routerFieldsMetadata:t})=>(0,l.jsxs)("div",{className:"space-y-6",children:[(0,l.jsxs)("div",{className:"max-w-3xl",children:[(0,l.jsx)("h3",{className:"text-sm font-medium text-gray-900",children:"Reliability & Retries"}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-1",children:"Configure retry logic and failure handling"})]}),(0,l.jsx)("div",{className:"grid grid-cols-1 gap-6 lg:grid-cols-2 xl:grid-cols-3",children:Object.entries(e).filter(([e])=>"fallbacks"!=e&&"context_window_fallbacks"!=e&&"routing_strategy_args"!=e&&"routing_strategy"!=e&&"enable_tag_filtering"!=e&&"retry_policy"!=e&&"model_group_retry_policy"!=e&&"routing_groups"!=e).map(([e,r])=>(0,l.jsx)("div",{className:"space-y-2",children:(0,l.jsxs)("label",{className:"block",children:[(0,l.jsx)("span",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:t[e]?.ui_field_name||e}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-0.5 mb-2",children:t[e]?.field_description||""}),(0,l.jsx)(s.Input,{name:e,defaultValue:null==r||"null"===r?"":"object"==typeof r?JSON.stringify(r,null,2):r?.toString()||"",placeholder:"—",className:"font-mono text-sm w-full"})]})},e))})]});var i=e.i(199133);let n=({selectedStrategy:e,availableStrategies:s,routingStrategyDescriptions:t,routerFieldsMetadata:r,onStrategyChange:a})=>(0,l.jsxs)("div",{className:"space-y-2 max-w-3xl",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)("label",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:r.routing_strategy?.ui_field_name||"Routing Strategy"}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-0.5 mb-2",children:r.routing_strategy?.field_description||""})]}),(0,l.jsx)("div",{className:"routing-strategy-select max-w-3xl",children:(0,l.jsx)(i.Select,{value:e,onChange:a,style:{width:"100%"},size:"large",children:s.map(e=>(0,l.jsx)(i.Select.Option,{value:e,label:e,children:(0,l.jsxs)("div",{className:"flex flex-col gap-0.5 py-1",children:[(0,l.jsx)("span",{className:"font-mono text-sm font-medium",children:e}),t[e]&&(0,l.jsx)("span",{className:"text-xs text-gray-500 font-normal",children:t[e]})]})},e))})})]});var o=e.i(790848);let c=({enabled:e,routerFieldsMetadata:s,onToggle:t})=>(0,l.jsx)("div",{className:"space-y-3 max-w-3xl",children:(0,l.jsxs)("div",{className:"flex items-start justify-between",children:[(0,l.jsxs)("div",{className:"flex-1",children:[(0,l.jsx)("label",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:s.enable_tag_filtering?.ui_field_name||"Enable Tag Filtering"}),(0,l.jsxs)("p",{className:"text-xs text-gray-500 mt-0.5",children:[s.enable_tag_filtering?.field_description||"",s.enable_tag_filtering?.link&&(0,l.jsxs)(l.Fragment,{children:[" ",(0,l.jsx)("a",{href:s.enable_tag_filtering.link,target:"_blank",rel:"noopener noreferrer",className:"text-blue-600 hover:text-blue-800 underline",children:"Learn more"})]})]})]}),(0,l.jsx)(o.Switch,{checked:e,onChange:t,className:"ml-4"})]})});e.s(["default",0,({value:e,onChange:s,routerFieldsMetadata:t,availableRoutingStrategies:i,routingStrategyDescriptions:o})=>(0,l.jsxs)("div",{className:"w-full space-y-8 py-2",children:[(0,l.jsxs)("div",{className:"space-y-6",children:[(0,l.jsxs)("div",{className:"max-w-3xl",children:[(0,l.jsx)("h3",{className:"text-sm font-medium text-gray-900",children:"Routing Settings"}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-1",children:"Configure how requests are routed to deployments"})]}),i.length>0&&(0,l.jsx)(n,{selectedStrategy:e.selectedStrategy||e.routerSettings.routing_strategy||null,availableStrategies:i,routingStrategyDescriptions:o,routerFieldsMetadata:t,onStrategyChange:l=>{s({...e,selectedStrategy:l})}}),(0,l.jsx)(c,{enabled:e.enableTagFiltering,routerFieldsMetadata:t,onToggle:l=>{s({...e,enableTagFiltering:l})}})]}),(0,l.jsx)("div",{className:"border-t border-gray-200"}),"latency-based-routing"===e.selectedStrategy&&(0,l.jsx)(r,{routingStrategyArgs:e.routerSettings.routing_strategy_args}),(0,l.jsx)(a,{routerSettings:e.routerSettings,routerFieldsMetadata:t})]})],158392);var d=e.i(361653);e.s(["AlertCircle",()=>d.default],63209)},425063,e=>{"use strict";let l=(0,e.i(475254).default)("arrow-down",[["path",{d:"M12 5v14",key:"s699le"}],["path",{d:"m19 12-7 7-7-7",key:"1idqje"}]]);e.s(["ArrowDown",0,l],425063)},419470,e=>{"use strict";var l=e.i(843476),s=e.i(994388),t=e.i(653496),r=e.i(107233),a=e.i(271645),i=e.i(888259),n=e.i(199133),o=e.i(592968),c=e.i(63209),d=e.i(425063),m=e.i(37727);function u({group:e,onChange:s,availableModels:t,maxFallbacks:r}){let a=t.filter(l=>l!==e.primaryModel),i=e.fallbackModels.length{let t=[...e.fallbackModels];t.includes(l)&&(t=t.filter(e=>e!==l)),s({...e,primaryModel:l,fallbackModels:t})},showSearch:!0,getPopupContainer:e=>e.parentElement||document.body,filterOption:(e,l)=>(l?.label??"").toLowerCase().includes(e.toLowerCase()),options:t.map(e=>({label:e,value:e}))}),!e.primaryModel&&(0,l.jsxs)("div",{className:"mt-2 flex items-center gap-2 text-amber-600 text-xs bg-amber-50 p-2 rounded-sm",children:[(0,l.jsx)(c.AlertCircle,{className:"w-4 h-4"}),(0,l.jsx)("span",{children:"Select a model to begin configuring fallbacks"})]})]}),(0,l.jsx)("div",{className:"flex items-center justify-center -my-4 z-10",children:(0,l.jsxs)("div",{className:"bg-indigo-50 text-indigo-500 px-4 py-1 rounded-full text-xs font-bold border border-indigo-100 flex items-center gap-2 shadow-xs",children:[(0,l.jsx)(d.ArrowDown,{className:"w-4 h-4"}),"IF FAILS, TRY..."]})}),(0,l.jsxs)("div",{className:`transition-opacity duration-300 ${!e.primaryModel?"opacity-50 pointer-events-none":"opacity-100"}`,children:[(0,l.jsxs)("label",{className:"block text-sm font-semibold text-gray-700 mb-2",children:["Fallback Chain ",(0,l.jsx)("span",{className:"text-red-500",children:"*"}),(0,l.jsxs)("span",{className:"text-xs text-gray-500 font-normal ml-2",children:["(Max ",r," fallbacks at a time)"]})]}),(0,l.jsxs)("div",{className:"bg-gray-50 rounded-xl p-4 border border-gray-200",children:[(0,l.jsxs)("div",{className:"mb-4",children:[(0,l.jsx)(n.Select,{mode:"multiple",className:"w-full",size:"large",placeholder:i?"Select fallback models to add...":`Maximum ${r} fallbacks reached`,value:e.fallbackModels,onChange:l=>{let t=l.slice(0,r);s({...e,fallbackModels:t})},disabled:!e.primaryModel,getPopupContainer:e=>e.parentElement||document.body,options:a.map(e=>({label:e,value:e})),optionRender:(s,t)=>{let r=e.fallbackModels.includes(s.value),a=r?e.fallbackModels.indexOf(s.value)+1:null;return(0,l.jsxs)("div",{className:"flex items-center gap-2",children:[r&&null!==a&&(0,l.jsx)("span",{className:"flex items-center justify-center w-5 h-5 rounded-sm bg-indigo-100 text-indigo-600 text-xs font-bold",children:a}),(0,l.jsx)("span",{children:s.label})]})},maxTagCount:"responsive",maxTagPlaceholder:e=>(0,l.jsx)(o.Tooltip,{styles:{root:{pointerEvents:"none"}},title:e.map(({value:e})=>e).join(", "),children:(0,l.jsxs)("span",{children:["+",e.length," more"]})}),showSearch:!0,filterOption:(e,l)=>(l?.label??"").toLowerCase().includes(e.toLowerCase())}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-1 ml-1",children:i?`Search and select multiple models. Selected models will appear below in order. (${e.fallbackModels.length}/${r} used)`:`Maximum ${r} fallbacks reached. Remove some to add more.`})]}),(0,l.jsx)("div",{className:"space-y-2 min-h-[100px]",children:0===e.fallbackModels.length?(0,l.jsxs)("div",{className:"h-32 border-2 border-dashed border-gray-300 rounded-lg flex flex-col items-center justify-center text-gray-400",children:[(0,l.jsx)("span",{className:"text-sm",children:"No fallback models selected"}),(0,l.jsx)("span",{className:"text-xs mt-1",children:"Add models from the dropdown above"})]}):e.fallbackModels.map((t,r)=>(0,l.jsxs)("div",{className:"group flex items-center justify-between p-3 bg-white rounded-lg border border-gray-200 hover:border-indigo-300 hover:shadow-xs transition-all",children:[(0,l.jsxs)("div",{className:"flex items-center gap-3",children:[(0,l.jsx)("div",{className:"flex items-center justify-center w-6 h-6 rounded-sm bg-gray-100 text-gray-400 group-hover:text-indigo-500 group-hover:bg-indigo-50",children:(0,l.jsx)("span",{className:"text-xs font-bold",children:r+1})}),(0,l.jsx)("div",{children:(0,l.jsx)("span",{className:"font-medium text-gray-800",children:t})})]}),(0,l.jsx)("button",{type:"button",onClick:()=>{let l;return l=e.fallbackModels.filter((e,l)=>l!==r),void s({...e,fallbackModels:l})},className:"opacity-0 group-hover:opacity-100 transition-opacity text-gray-400 hover:text-red-500 p-1",children:(0,l.jsx)(m.X,{className:"w-4 h-4"})})]},`${t}-${r}`))})]})]})]})}e.s(["FallbackSelectionForm",0,function({groups:e,onGroupsChange:n,availableModels:o,maxFallbacks:c=10,maxGroups:d=5}){let[m,g]=(0,a.useState)(e.length>0?e[0].id:"1");(0,a.useEffect)(()=>{e.length>0?e.some(e=>e.id===m)||g(e[0].id):g("1")},[e]);let p=()=>{if(e.length>=d)return;let l=Date.now().toString();n([...e,{id:l,primaryModel:null,fallbackModels:[]}]),g(l)},h=l=>{n(e.map(e=>e.id===l.id?l:e))},x=e.map((s,t)=>{let r=s.primaryModel?s.primaryModel:`Group ${t+1}`;return{key:s.id,label:r,closable:e.length>1,children:(0,l.jsx)(u,{group:s,onChange:h,availableModels:o,maxFallbacks:c})}});return 0===e.length?(0,l.jsxs)("div",{className:"text-center py-12 bg-gray-50 rounded-lg border border-dashed border-gray-300",children:[(0,l.jsx)("p",{className:"text-gray-500 mb-4",children:"No fallback groups configured"}),(0,l.jsx)(s.Button,{variant:"primary",onClick:p,icon:()=>(0,l.jsx)(r.Plus,{className:"w-4 h-4"}),children:"Create First Group"})]}):(0,l.jsx)(t.Tabs,{type:"editable-card",activeKey:m,onChange:g,onEdit:(l,s)=>{"add"===s?p():"remove"===s&&e.length>1&&(l=>{if(1===e.length)return i.default.warning("At least one group is required");let s=e.filter(e=>e.id!==l);n(s),m===l&&s.length>0&&g(s[s.length-1].id)})(l)},items:x,className:"fallback-tabs",tabBarStyle:{marginBottom:0},hideAdd:e.length>=d})}],419470)},246349,e=>{"use strict";let l=(0,e.i(475254).default)("chevron-right",[["path",{d:"m9 18 6-6-6-6",key:"mthhwq"}]]);e.s(["default",0,l])},992619,e=>{"use strict";var l=e.i(843476),s=e.i(271645),t=e.i(779241),r=e.i(599724),a=e.i(199133),i=e.i(983561),n=e.i(695411);e.s(["default",0,({accessToken:e,value:o,placeholder:c="Select a Model",onChange:d,disabled:m=!1,style:u,className:g,showLabel:p=!0,labelText:h="Select Model"})=>{let[x,f]=(0,s.useState)(o),[y,b]=(0,s.useState)(!1),[v,j]=(0,s.useState)([]),w=(0,s.useRef)(null);return(0,s.useEffect)(()=>{f(o)},[o]),(0,s.useEffect)(()=>{e&&(async()=>{try{let l=await (0,n.fetchAvailableModels)(e);l.length>0&&j(l)}catch(e){console.error("Error fetching model info:",e)}})()},[e]),(0,l.jsxs)("div",{children:[p&&(0,l.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,l.jsx)(i.RobotOutlined,{className:"mr-2"})," ",h]}),(0,l.jsx)(a.Select,{value:x,placeholder:c,onChange:e=>{"custom"===e?(b(!0),f(void 0)):(b(!1),f(e),d&&d(e))},options:[...Array.from(new Set(v.map(e=>e.model_group))).map((e,l)=>({value:e,label:e,key:l})),{value:"custom",label:"Enter custom model",key:"custom"}],style:{width:"100%",...u},showSearch:!0,className:`rounded-md ${g||""}`,disabled:m}),y&&(0,l.jsx)(t.TextInput,{className:"mt-2",placeholder:"Enter custom model name",onValueChange:e=>{w.current&&clearTimeout(w.current),w.current=setTimeout(()=>{f(e),d&&d(e)},500)},disabled:m})]})}])},91739,e=>{"use strict";var l=e.i(544195);e.s(["Radio",()=>l.default])},988297,e=>{"use strict";var l=e.i(271645);let s=l.forwardRef(function(e,s){return l.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),l.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M12 4v16m8-8H4"}))});e.s(["PlusIcon",0,s],988297)},797672,e=>{"use strict";var l=e.i(271645);let s=l.forwardRef(function(e,s){return l.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),l.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z"}))});e.s(["PencilIcon",0,s],797672)},361653,e=>{"use strict";let l=(0,e.i(475254).default)("circle-alert",[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["line",{x1:"12",x2:"12",y1:"8",y2:"12",key:"1pkeuh"}],["line",{x1:"12",x2:"12.01",y1:"16",y2:"16",key:"4dfq90"}]]);e.s(["default",0,l])},409797,e=>{"use strict";var l=e.i(631171);e.s(["ChevronDownIcon",()=>l.default])},531516,696609,e=>{"use strict";var l=e.i(843476),s=e.i(271645),t=e.i(536916),r=e.i(599724),a=e.i(409797),i=e.i(246349),i=i;let n=/\b(delete|remove|destroy|purge|drop|erase|unlink)\b/i,o=/\b(create|add|insert|new|post|submit|register|make|generate|write|upload)\b/i,c=/\b(update|edit|modify|change|patch|put|set|rename|move|transform)\b/i,d=/\b(get|read|list|fetch|search|find|query|retrieve|show|view|check|describe|info)\b/i;function m(e,l=""){let s=e.toLowerCase();if(d.test(s))return"read";if(n.test(s))return"delete";if(c.test(s))return"update";if(o.test(s))return"create";if(l){let e=l.toLowerCase();if(d.test(e))return"read";if(n.test(e))return"delete";if(c.test(e))return"update";if(o.test(e))return"create"}return"unknown"}function u(e){let l={read:[],create:[],update:[],delete:[],unknown:[]};for(let s of e)l[m(s.name,s.description)].push(s);return l}let g={read:{label:"Read",description:"Safe operations — fetch, list, search. No side effects.",risk:"low"},create:{label:"Create",description:"Add new resources — insert, upload, register.",risk:"medium"},update:{label:"Update",description:"Modify existing resources — edit, patch, rename.",risk:"medium"},delete:{label:"Delete",description:"Destructive operations — remove, purge, destroy.",risk:"high"},unknown:{label:"Other",description:"Operations that could not be automatically classified.",risk:"unknown"}};e.s(["CRUD_GROUP_META",0,g,"classifyToolOp",0,m,"groupToolsByCrud",0,u],696609);let p=["read","create","update","delete","unknown"],h={low:"bg-green-100 text-green-800",medium:"bg-yellow-100 text-yellow-800",high:"bg-red-100 text-red-800 font-semibold",unknown:"bg-gray-100 text-gray-700"},x={read:"border-green-200",create:"border-blue-200",update:"border-yellow-200",delete:"border-red-300",unknown:"border-gray-200"},f={read:"bg-green-50",create:"bg-blue-50",update:"bg-yellow-50",delete:"bg-red-50",unknown:"bg-gray-50"};e.s(["default",0,({tools:e,value:n,onChange:o,readOnly:c=!1,searchFilter:d=""})=>{let[m,y]=(0,s.useState)({read:!1,create:!1,update:!1,delete:!1,unknown:!0}),b=(0,s.useMemo)(()=>u(e),[e]),v=(0,s.useMemo)(()=>new Set(void 0===n?e.map(e=>e.name):n),[n,e]),j=e=>{if(c)return;let l=new Set(v);l.has(e)?l.delete(e):l.add(e),o(Array.from(l))};return 0===e.length?null:(0,l.jsx)("div",{className:"space-y-3",children:p.map(e=>{let s,n=b[e];if(0===n.length)return null;if(d){let e=d.toLowerCase();if(!n.some(l=>l.name.toLowerCase().includes(e)||(l.description??"").toLowerCase().includes(e)))return null}let u=g[e],p=(s=b[e]).length>0&&s.every(e=>v.has(e.name)),w=(e=>{let l=b[e];if(0===l.length)return!1;let s=l.filter(e=>v.has(e.name)).length;return s>0&&s{y(l=>({...l,[e]:!l[e]}))},children:[N?(0,l.jsx)(i.default,{className:"w-4 h-4 text-gray-500 shrink-0"}):(0,l.jsx)(a.ChevronDownIcon,{className:"w-4 h-4 text-gray-500 shrink-0"}),(0,l.jsx)("span",{className:"font-semibold text-gray-900 text-sm",children:u.label}),(0,l.jsx)("span",{className:`text-xs px-2 py-0.5 rounded-full ${h[u.risk]}`,children:"high"===u.risk?"High Risk":"medium"===u.risk?"Medium Risk":"low"===u.risk?"Safe":"Unclassified"}),(0,l.jsxs)("span",{className:"text-xs text-gray-500 ml-1",children:[n.filter(e=>v.has(e.name)).length,"/",n.length," allowed"]})]}),!c&&(0,l.jsxs)("div",{className:"flex items-center gap-2 ml-4",children:[(0,l.jsx)(r.Text,{className:"text-xs text-gray-500",children:p?"All on":w?"Partial":"All off"}),(0,l.jsx)(t.Checkbox,{checked:p,indeterminate:w,onChange:l=>((e,l)=>{if(c)return;let s=new Set(v);for(let t of b[e])l?s.add(t.name):s.delete(t.name);o(Array.from(s))})(e,l.target.checked),onClick:e=>e.stopPropagation()})]})]}),!N&&(0,l.jsx)("div",{className:"px-4 pt-2 pb-1 text-xs text-gray-500 bg-white border-b border-gray-100",children:u.description}),!N&&(0,l.jsx)("div",{className:"bg-white divide-y divide-gray-50",children:n.filter(e=>!d||e.name.toLowerCase().includes(d.toLowerCase())||(e.description??"").toLowerCase().includes(d.toLowerCase())).map(e=>{let s,a=(s=e.name,v.has(s));return(0,l.jsxs)("div",{className:`flex items-start gap-3 px-4 py-2.5 transition-colors hover:bg-gray-50 ${!c?"cursor-pointer":""} ${a?"":"opacity-60"}`,onClick:()=>j(e.name),children:[(0,l.jsx)(t.Checkbox,{checked:a,onChange:()=>j(e.name),disabled:c,onClick:e=>e.stopPropagation()}),(0,l.jsxs)("div",{className:"flex-1 min-w-0",children:[(0,l.jsx)(r.Text,{className:"font-medium text-gray-900 text-sm",children:e.name}),e.description&&(0,l.jsx)(r.Text,{className:"text-xs text-gray-500 mt-0.5 leading-snug",children:e.description})]}),(0,l.jsx)("span",{className:`text-xs px-1.5 py-0.5 rounded shrink-0 ${a?"bg-green-100 text-green-700":"bg-gray-100 text-gray-500"}`,children:a?"on":"off"})]},e.name)})})]},e)})})}],531516)},309426,e=>{"use strict";var l=e.i(290571),s=e.i(444755),t=e.i(673706),r=e.i(271645),a=e.i(46757);let i=(0,t.makeClassName)("Col"),n=r.default.forwardRef((e,t)=>{let n,o,c,d,{numColSpan:m=1,numColSpanSm:u,numColSpanMd:g,numColSpanLg:p,children:h,className:x}=e,f=(0,l.__rest)(e,["numColSpan","numColSpanSm","numColSpanMd","numColSpanLg","children","className"]),y=(e,l)=>e&&Object.keys(l).includes(String(e))?l[e]:"";return r.default.createElement("div",Object.assign({ref:t,className:(0,s.tremorTwMerge)(i("root"),(n=y(m,a.colSpan),o=y(u,a.colSpanSm),c=y(g,a.colSpanMd),d=y(p,a.colSpanLg),(0,s.tremorTwMerge)(n,o,c,d)),x)},f),h)});n.displayName="Col",e.s(["Col",0,n],309426)},213205,e=>{"use strict";e.i(247167);var l=e.i(931067),s=e.i(271645);let t={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M678.3 642.4c24.2-13 51.9-20.4 81.4-20.4h.1c3 0 4.4-3.6 2.2-5.6a371.67 371.67 0 00-103.7-65.8c-.4-.2-.8-.3-1.2-.5C719.2 505 759.6 431.7 759.6 349c0-137-110.8-248-247.5-248S264.7 212 264.7 349c0 82.7 40.4 156 102.6 201.1-.4.2-.8.3-1.2.5-44.7 18.9-84.8 46-119.3 80.6a373.42 373.42 0 00-80.4 119.5A373.6 373.6 0 00137 888.8a8 8 0 008 8.2h59.9c4.3 0 7.9-3.5 8-7.8 2-77.2 32.9-149.5 87.6-204.3C357 628.2 432.2 597 512.2 597c56.7 0 111.1 15.7 158 45.1a8.1 8.1 0 008.1.3zM512.2 521c-45.8 0-88.9-17.9-121.4-50.4A171.2 171.2 0 01340.5 349c0-45.9 17.9-89.1 50.3-121.6S466.3 177 512.2 177s88.9 17.9 121.4 50.4A171.2 171.2 0 01683.9 349c0 45.9-17.9 89.1-50.3 121.6C601.1 503.1 558 521 512.2 521zM880 759h-84v-84c0-4.4-3.6-8-8-8h-56c-4.4 0-8 3.6-8 8v84h-84c-4.4 0-8 3.6-8 8v56c0 4.4 3.6 8 8 8h84v84c0 4.4 3.6 8 8 8h56c4.4 0 8-3.6 8-8v-84h84c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8z"}}]},name:"user-add",theme:"outlined"};var r=e.i(9583),a=s.forwardRef(function(e,a){return s.createElement(r.default,(0,l.default)({},e,{ref:a,icon:t}))});e.s(["UserAddOutlined",0,a],213205)},355619,e=>{"use strict";var l=e.i(602869);let s=async(e,s,t)=>{try{if(null===e||null===s)return;if(null!==t){let r=(await (0,l.modelAvailableCall)(t,e,s,!0,null,!0)).data.map(e=>e.id),a=[],i=[];return r.forEach(e=>{e.endsWith("/*")?a.push(e):i.push(e)}),[...a,...i]}}catch(e){console.error("Error fetching user models:",e)}};e.s(["fetchAvailableModelsForTeamOrKey",0,s,"getModelDisplayName",0,e=>{if("all-proxy-models"===e)return"All Proxy Models";if(e.endsWith("/*")){let l=e.replace("/*","");return`All ${l} models`}return e},"unfurlWildcardModelsInList",0,(e,l)=>{let s=[],t=[];return e.forEach(e=>{if(e.endsWith("/*")){let r=e.replace("/*",""),a=l.filter(e=>e.startsWith(r+"/"));t.push(...a),s.push(e)}else t.push(e)}),[...s,...t].filter((e,l,s)=>s.indexOf(e)===l)}])},860585,e=>{"use strict";var l=e.i(843476),s=e.i(199133);let{Option:t}=s.Select;e.s(["default",0,({value:e,onChange:r,className:a="",style:i={}})=>(0,l.jsxs)(s.Select,{style:{width:"100%",...i},value:e||void 0,onChange:r,className:a,placeholder:"n/a",allowClear:!0,children:[(0,l.jsx)(t,{value:"1h",children:"hourly"}),(0,l.jsx)(t,{value:"24h",children:"daily"}),(0,l.jsx)(t,{value:"7d",children:"weekly"}),(0,l.jsx)(t,{value:"30d",children:"monthly"})]}),"getBudgetDurationLabel",0,e=>e?({"1h":"hourly","24h":"daily","7d":"weekly","30d":"monthly"})[e]||e:"Not set"])},350967,46757,e=>{"use strict";var l=e.i(290571),s=e.i(444755),t=e.i(673706),r=e.i(271645);let a={0:"grid-cols-none",1:"grid-cols-1",2:"grid-cols-2",3:"grid-cols-3",4:"grid-cols-4",5:"grid-cols-5",6:"grid-cols-6",7:"grid-cols-7",8:"grid-cols-8",9:"grid-cols-9",10:"grid-cols-10",11:"grid-cols-11",12:"grid-cols-12"},i={0:"sm:grid-cols-none",1:"sm:grid-cols-1",2:"sm:grid-cols-2",3:"sm:grid-cols-3",4:"sm:grid-cols-4",5:"sm:grid-cols-5",6:"sm:grid-cols-6",7:"sm:grid-cols-7",8:"sm:grid-cols-8",9:"sm:grid-cols-9",10:"sm:grid-cols-10",11:"sm:grid-cols-11",12:"sm:grid-cols-12"},n={0:"md:grid-cols-none",1:"md:grid-cols-1",2:"md:grid-cols-2",3:"md:grid-cols-3",4:"md:grid-cols-4",5:"md:grid-cols-5",6:"md:grid-cols-6",7:"md:grid-cols-7",8:"md:grid-cols-8",9:"md:grid-cols-9",10:"md:grid-cols-10",11:"md:grid-cols-11",12:"md:grid-cols-12"},o={0:"lg:grid-cols-none",1:"lg:grid-cols-1",2:"lg:grid-cols-2",3:"lg:grid-cols-3",4:"lg:grid-cols-4",5:"lg:grid-cols-5",6:"lg:grid-cols-6",7:"lg:grid-cols-7",8:"lg:grid-cols-8",9:"lg:grid-cols-9",10:"lg:grid-cols-10",11:"lg:grid-cols-11",12:"lg:grid-cols-12"};e.s(["colSpan",0,{1:"col-span-1",2:"col-span-2",3:"col-span-3",4:"col-span-4",5:"col-span-5",6:"col-span-6",7:"col-span-7",8:"col-span-8",9:"col-span-9",10:"col-span-10",11:"col-span-11",12:"col-span-12",13:"col-span-13"},"colSpanLg",0,{1:"lg:col-span-1",2:"lg:col-span-2",3:"lg:col-span-3",4:"lg:col-span-4",5:"lg:col-span-5",6:"lg:col-span-6",7:"lg:col-span-7",8:"lg:col-span-8",9:"lg:col-span-9",10:"lg:col-span-10",11:"lg:col-span-11",12:"lg:col-span-12",13:"lg:col-span-13"},"colSpanMd",0,{1:"md:col-span-1",2:"md:col-span-2",3:"md:col-span-3",4:"md:col-span-4",5:"md:col-span-5",6:"md:col-span-6",7:"md:col-span-7",8:"md:col-span-8",9:"md:col-span-9",10:"md:col-span-10",11:"md:col-span-11",12:"md:col-span-12",13:"md:col-span-13"},"colSpanSm",0,{1:"sm:col-span-1",2:"sm:col-span-2",3:"sm:col-span-3",4:"sm:col-span-4",5:"sm:col-span-5",6:"sm:col-span-6",7:"sm:col-span-7",8:"sm:col-span-8",9:"sm:col-span-9",10:"sm:col-span-10",11:"sm:col-span-11",12:"sm:col-span-12",13:"sm:col-span-13"},"gridCols",0,a,"gridColsLg",0,o,"gridColsMd",0,n,"gridColsSm",0,i],46757);let c=(0,t.makeClassName)("Grid"),d=(e,l)=>e&&Object.keys(l).includes(String(e))?l[e]:"",m=r.default.forwardRef((e,t)=>{let{numItems:m=1,numItemsSm:u,numItemsMd:g,numItemsLg:p,children:h,className:x}=e,f=(0,l.__rest)(e,["numItems","numItemsSm","numItemsMd","numItemsLg","children","className"]),y=d(m,a),b=d(u,i),v=d(g,n),j=d(p,o),w=(0,s.tremorTwMerge)(y,b,v,j);return r.default.createElement("div",Object.assign({ref:t,className:(0,s.tremorTwMerge)(c("root"),"grid",w,x)},f),h)});m.displayName="Grid",e.s(["Grid",0,m],350967)},981339,e=>{"use strict";var l=e.i(185793);e.s(["Skeleton",()=>l.default])},500727,e=>{"use strict";var l=e.i(266027),s=e.i(243652),t=e.i(602869),r=e.i(135214);let a=(0,s.createQueryKeys)("mcpServers");e.s(["useMCPServers",0,e=>{let{accessToken:s}=(0,r.default)();return(0,l.useQuery)({queryKey:a.list(e?{filters:{teamId:e}}:void 0),queryFn:async()=>await (0,t.fetchMCPServers)(s,e),enabled:!!s})}])},699857,e=>{"use strict";var l=e.i(266027),s=e.i(243652),t=e.i(602869),r=e.i(135214);let a=(0,s.createQueryKeys)("mcpToolsets");e.s(["useMCPToolsets",0,()=>{let{accessToken:e}=(0,r.default)();return(0,l.useQuery)({queryKey:a.list(),queryFn:async()=>await (0,t.fetchMCPToolsets)(e),enabled:!!e})}])},916940,e=>{"use strict";var l=e.i(843476),s=e.i(271645),t=e.i(199133),r=e.i(602869);e.s(["default",0,({onChange:e,value:a,className:i,accessToken:n,placeholder:o="Select vector stores",disabled:c=!1})=>{let[d,m]=(0,s.useState)([]),[u,g]=(0,s.useState)(!1);return(0,s.useEffect)(()=>{(async()=>{if(n){g(!0);try{let e=await (0,r.vectorStoreListCall)(n);e.data&&m(e.data)}catch(e){console.error("Error fetching vector stores:",e)}finally{g(!1)}}})()},[n]),(0,l.jsx)("div",{children:(0,l.jsx)(t.Select,{mode:"multiple",placeholder:o,onChange:e,value:a,loading:u,className:i,allowClear:!0,options:d.map(e=>({label:`${e.vector_store_name||e.vector_store_id} (${e.vector_store_id})`,value:e.vector_store_id,title:e.vector_store_description||e.vector_store_id})),optionFilterProp:"label",showSearch:!0,style:{width:"100%"},disabled:c})})}])},75921,e=>{"use strict";var l=e.i(843476),s=e.i(266027),t=e.i(243652),r=e.i(602869),a=e.i(135214);let i=(0,t.createQueryKeys)("mcpAccessGroups");var n=e.i(500727),o=e.i(699857),c=e.i(199133),d=e.i(234713);let m="toolset:";e.s(["default",0,({onChange:e,value:t,className:u,accessToken:g,placeholder:p="Select MCP servers",disabled:h=!1,teamId:x,allowNoMcpServers:f=!1,allowAllProxyMcpServers:y=!1})=>{let{data:b=[],isLoading:v}=(0,n.useMCPServers)(x),{data:j=[],isLoading:w}=(()=>{let{accessToken:e}=(0,a.default)();return(0,s.useQuery)({queryKey:i.list({}),queryFn:async()=>await (0,r.fetchMCPAccessGroups)(e),enabled:!!e})})(),{data:N=[],isLoading:S}=(0,o.useMCPToolsets)(),k=new Set(j),_=[...j.map(e=>({label:e,value:e,type:"accessGroup",searchText:`${e} Access Group`})),...b.map(e=>({label:`${e.server_name||e.server_id} (${e.server_id})`,value:e.server_id,type:"server",searchText:`${e.server_name||e.server_id} ${e.server_id} MCP Server`})),...N.map(e=>({label:e.toolset_name,value:`${m}${e.toolset_id}`,type:"toolset",searchText:`${e.toolset_name} ${e.toolset_id} Toolset`}))],C={accessGroup:"#52c41a",server:"#1890ff",toolset:"#722ed1"},M={accessGroup:"Access Group",server:"MCP Server",toolset:"Toolset"},E=[...t?.servers||[],...t?.accessGroups||[],...(t?.toolsets||[]).map(e=>`${m}${e}`)],L=f&&E.includes(d.NO_MCP_SERVERS_SENTINEL),R=E.includes(d.ALL_PROXY_MCP_SERVERS_SENTINEL);return(0,l.jsx)("div",{children:(0,l.jsxs)(c.Select,{mode:"multiple",placeholder:p,onChange:l=>{if(y&&l.includes(d.ALL_PROXY_MCP_SERVERS_SENTINEL))return void e({servers:[d.ALL_PROXY_MCP_SERVERS_SENTINEL],accessGroups:[],toolsets:[]});if(f&&l.includes(d.NO_MCP_SERVERS_SENTINEL))return void e({servers:[d.NO_MCP_SERVERS_SENTINEL],accessGroups:[],toolsets:[]});let s=l.filter(e=>e.startsWith(m)).map(e=>e.slice(m.length)),t=l.filter(e=>!e.startsWith(m));e({servers:t.filter(e=>!k.has(e)),accessGroups:t.filter(e=>k.has(e)),toolsets:s})},value:E,loading:v||w||S,className:u,allowClear:!0,showSearch:!0,style:{width:"100%"},disabled:h,filterOption:(e,l)=>l?.value===d.NO_MCP_SERVERS_SENTINEL||l?.value===d.ALL_PROXY_MCP_SERVERS_SENTINEL||(_.find(e=>e.value===l?.value)?.searchText||"").toLowerCase().includes(e.toLowerCase()),children:[(y||R)&&(0,l.jsx)(c.Select.Option,{value:d.ALL_PROXY_MCP_SERVERS_SENTINEL,label:"All Proxy MCP Servers",children:(0,l.jsx)("span",{style:{color:"#1890ff",fontWeight:500},children:"All Proxy MCP Servers"})},d.ALL_PROXY_MCP_SERVERS_SENTINEL),f&&(0,l.jsx)(c.Select.Option,{value:d.NO_MCP_SERVERS_SENTINEL,label:"No MCP Servers",children:(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,l.jsx)("span",{style:{flex:1},children:"No MCP Servers"}),(0,l.jsx)("span",{style:{color:"#8c8c8c",fontSize:"12px",fontWeight:500,opacity:.8},children:"Block all"})]})},d.NO_MCP_SERVERS_SENTINEL),_.map(e=>(0,l.jsx)(c.Select.Option,{value:e.value,label:e.label,disabled:L||R,children:(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,l.jsx)("span",{style:{display:"inline-block",width:8,height:8,borderRadius:"50%",background:C[e.type],flexShrink:0}}),(0,l.jsx)("span",{style:{flex:1},children:e.label}),(0,l.jsx)("span",{style:{color:C[e.type],fontSize:"12px",fontWeight:500,opacity:.8},children:M[e.type]})]})},e.value))]})})}],75921)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/02iqizny3-cps.js b/litellm/proxy/_experimental/out/_next/static/chunks/02iqizny3-cps.js deleted file mode 100644 index 8a139b3e0b2..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/02iqizny3-cps.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,250980,e=>{"use strict";var l=e.i(271645);let s=l.forwardRef(function(e,s){return l.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),l.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M12 9v3m0 0v3m0-3h3m-3 0H9m12 0a9 9 0 11-18 0 9 9 0 0118 0z"}))});e.s(["PlusCircleIcon",0,s],250980)},695411,e=>{"use strict";var l=e.i(602869);let s=async e=>{try{let s=await (0,l.modelHubCall)(e);if(s?.data.length>0){let e=s.data.map(e=>({model_group:e.model_group,mode:e?.mode}));return e.sort((e,l)=>e.model_group.localeCompare(l.model_group)),e}return[]}catch(e){throw console.error("Error fetching model info:",e),e}};e.s(["fetchAvailableModels",0,s])},841947,e=>{"use strict";let l=(0,e.i(475254).default)("x",[["path",{d:"M18 6 6 18",key:"1bl5f8"}],["path",{d:"m6 6 12 12",key:"d8bk6v"}]]);e.s(["default",0,l])},603908,e=>{"use strict";let l=(0,e.i(475254).default)("plus",[["path",{d:"M5 12h14",key:"1ays0h"}],["path",{d:"M12 5v14",key:"s699le"}]]);e.s(["default",0,l])},107233,e=>{"use strict";var l=e.i(603908);e.s(["Plus",()=>l.default])},37727,e=>{"use strict";var l=e.i(841947);e.s(["X",()=>l.default])},425063,e=>{"use strict";let l=(0,e.i(475254).default)("arrow-down",[["path",{d:"M12 5v14",key:"s699le"}],["path",{d:"m19 12-7 7-7-7",key:"1idqje"}]]);e.s(["ArrowDown",0,l],425063)},158392,63209,e=>{"use strict";var l=e.i(843476),s=e.i(311451);let t={ttl:3600,lowest_latency_buffer:0},r=({routingStrategyArgs:e})=>{let r={ttl:"Sliding window to look back over when calculating the average latency of a deployment. Default - 1 hour (in seconds).",lowest_latency_buffer:"Shuffle between deployments within this % of the lowest latency. Default - 0 (i.e. always pick lowest latency)."};return(0,l.jsxs)(l.Fragment,{children:[(0,l.jsxs)("div",{className:"space-y-6",children:[(0,l.jsxs)("div",{className:"max-w-3xl",children:[(0,l.jsx)("h3",{className:"text-sm font-medium text-gray-900",children:"Latency-Based Configuration"}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-1",children:"Fine-tune latency-based routing behavior"})]}),(0,l.jsx)("div",{className:"grid grid-cols-1 gap-6 lg:grid-cols-2 xl:grid-cols-3",children:Object.entries(e||t).map(([e,t])=>(0,l.jsx)("div",{className:"space-y-2",children:(0,l.jsxs)("label",{className:"block",children:[(0,l.jsx)("span",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:e.replace(/_/g," ")}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-0.5 mb-2",children:r[e]||""}),(0,l.jsx)(s.Input,{name:e,defaultValue:"object"==typeof t?JSON.stringify(t,null,2):t?.toString(),className:"font-mono text-sm w-full"})]})},e))})]}),(0,l.jsx)("div",{className:"border-t border-gray-200"})]})},a=({routerSettings:e,routerFieldsMetadata:t})=>(0,l.jsxs)("div",{className:"space-y-6",children:[(0,l.jsxs)("div",{className:"max-w-3xl",children:[(0,l.jsx)("h3",{className:"text-sm font-medium text-gray-900",children:"Reliability & Retries"}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-1",children:"Configure retry logic and failure handling"})]}),(0,l.jsx)("div",{className:"grid grid-cols-1 gap-6 lg:grid-cols-2 xl:grid-cols-3",children:Object.entries(e).filter(([e])=>"fallbacks"!=e&&"context_window_fallbacks"!=e&&"routing_strategy_args"!=e&&"routing_strategy"!=e&&"enable_tag_filtering"!=e&&"retry_policy"!=e&&"model_group_retry_policy"!=e&&"routing_groups"!=e).map(([e,r])=>(0,l.jsx)("div",{className:"space-y-2",children:(0,l.jsxs)("label",{className:"block",children:[(0,l.jsx)("span",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:t[e]?.ui_field_name||e}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-0.5 mb-2",children:t[e]?.field_description||""}),(0,l.jsx)(s.Input,{name:e,defaultValue:null==r||"null"===r?"":"object"==typeof r?JSON.stringify(r,null,2):r?.toString()||"",placeholder:"—",className:"font-mono text-sm w-full"})]})},e))})]});var i=e.i(199133);let n=({selectedStrategy:e,availableStrategies:s,routingStrategyDescriptions:t,routerFieldsMetadata:r,onStrategyChange:a})=>(0,l.jsxs)("div",{className:"space-y-2 max-w-3xl",children:[(0,l.jsxs)("div",{children:[(0,l.jsx)("label",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:r.routing_strategy?.ui_field_name||"Routing Strategy"}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-0.5 mb-2",children:r.routing_strategy?.field_description||""})]}),(0,l.jsx)("div",{className:"routing-strategy-select max-w-3xl",children:(0,l.jsx)(i.Select,{value:e,onChange:a,style:{width:"100%"},size:"large",children:s.map(e=>(0,l.jsx)(i.Select.Option,{value:e,label:e,children:(0,l.jsxs)("div",{className:"flex flex-col gap-0.5 py-1",children:[(0,l.jsx)("span",{className:"font-mono text-sm font-medium",children:e}),t[e]&&(0,l.jsx)("span",{className:"text-xs text-gray-500 font-normal",children:t[e]})]})},e))})})]});var o=e.i(790848);let c=({enabled:e,routerFieldsMetadata:s,onToggle:t})=>(0,l.jsx)("div",{className:"space-y-3 max-w-3xl",children:(0,l.jsxs)("div",{className:"flex items-start justify-between",children:[(0,l.jsxs)("div",{className:"flex-1",children:[(0,l.jsx)("label",{className:"text-xs font-medium text-gray-700 uppercase tracking-wide",children:s.enable_tag_filtering?.ui_field_name||"Enable Tag Filtering"}),(0,l.jsxs)("p",{className:"text-xs text-gray-500 mt-0.5",children:[s.enable_tag_filtering?.field_description||"",s.enable_tag_filtering?.link&&(0,l.jsxs)(l.Fragment,{children:[" ",(0,l.jsx)("a",{href:s.enable_tag_filtering.link,target:"_blank",rel:"noopener noreferrer",className:"text-blue-600 hover:text-blue-800 underline",children:"Learn more"})]})]})]}),(0,l.jsx)(o.Switch,{checked:e,onChange:t,className:"ml-4"})]})});e.s(["default",0,({value:e,onChange:s,routerFieldsMetadata:t,availableRoutingStrategies:i,routingStrategyDescriptions:o})=>(0,l.jsxs)("div",{className:"w-full space-y-8 py-2",children:[(0,l.jsxs)("div",{className:"space-y-6",children:[(0,l.jsxs)("div",{className:"max-w-3xl",children:[(0,l.jsx)("h3",{className:"text-sm font-medium text-gray-900",children:"Routing Settings"}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-1",children:"Configure how requests are routed to deployments"})]}),i.length>0&&(0,l.jsx)(n,{selectedStrategy:e.selectedStrategy||e.routerSettings.routing_strategy||null,availableStrategies:i,routingStrategyDescriptions:o,routerFieldsMetadata:t,onStrategyChange:l=>{s({...e,selectedStrategy:l})}}),(0,l.jsx)(c,{enabled:e.enableTagFiltering,routerFieldsMetadata:t,onToggle:l=>{s({...e,enableTagFiltering:l})}})]}),(0,l.jsx)("div",{className:"border-t border-gray-200"}),"latency-based-routing"===e.selectedStrategy&&(0,l.jsx)(r,{routingStrategyArgs:e.routerSettings.routing_strategy_args}),(0,l.jsx)(a,{routerSettings:e.routerSettings,routerFieldsMetadata:t})]})],158392);var d=e.i(361653);e.s(["AlertCircle",()=>d.default],63209)},419470,e=>{"use strict";var l=e.i(843476),s=e.i(994388),t=e.i(653496),r=e.i(107233),a=e.i(271645),i=e.i(888259),n=e.i(199133),o=e.i(592968),c=e.i(63209),d=e.i(425063),m=e.i(37727);function u({group:e,onChange:s,availableModels:t,maxFallbacks:r}){let a=t.filter(l=>l!==e.primaryModel),i=e.fallbackModels.length{let t=[...e.fallbackModels];t.includes(l)&&(t=t.filter(e=>e!==l)),s({...e,primaryModel:l,fallbackModels:t})},showSearch:!0,getPopupContainer:e=>e.parentElement||document.body,filterOption:(e,l)=>(l?.label??"").toLowerCase().includes(e.toLowerCase()),options:t.map(e=>({label:e,value:e}))}),!e.primaryModel&&(0,l.jsxs)("div",{className:"mt-2 flex items-center gap-2 text-amber-600 text-xs bg-amber-50 p-2 rounded-sm",children:[(0,l.jsx)(c.AlertCircle,{className:"w-4 h-4"}),(0,l.jsx)("span",{children:"Select a model to begin configuring fallbacks"})]})]}),(0,l.jsx)("div",{className:"flex items-center justify-center -my-4 z-10",children:(0,l.jsxs)("div",{className:"bg-indigo-50 text-indigo-500 px-4 py-1 rounded-full text-xs font-bold border border-indigo-100 flex items-center gap-2 shadow-xs",children:[(0,l.jsx)(d.ArrowDown,{className:"w-4 h-4"}),"IF FAILS, TRY..."]})}),(0,l.jsxs)("div",{className:`transition-opacity duration-300 ${!e.primaryModel?"opacity-50 pointer-events-none":"opacity-100"}`,children:[(0,l.jsxs)("label",{className:"block text-sm font-semibold text-gray-700 mb-2",children:["Fallback Chain ",(0,l.jsx)("span",{className:"text-red-500",children:"*"}),(0,l.jsxs)("span",{className:"text-xs text-gray-500 font-normal ml-2",children:["(Max ",r," fallbacks at a time)"]})]}),(0,l.jsxs)("div",{className:"bg-gray-50 rounded-xl p-4 border border-gray-200",children:[(0,l.jsxs)("div",{className:"mb-4",children:[(0,l.jsx)(n.Select,{mode:"multiple",className:"w-full",size:"large",placeholder:i?"Select fallback models to add...":`Maximum ${r} fallbacks reached`,value:e.fallbackModels,onChange:l=>{let t=l.slice(0,r);s({...e,fallbackModels:t})},disabled:!e.primaryModel,getPopupContainer:e=>e.parentElement||document.body,options:a.map(e=>({label:e,value:e})),optionRender:(s,t)=>{let r=e.fallbackModels.includes(s.value),a=r?e.fallbackModels.indexOf(s.value)+1:null;return(0,l.jsxs)("div",{className:"flex items-center gap-2",children:[r&&null!==a&&(0,l.jsx)("span",{className:"flex items-center justify-center w-5 h-5 rounded-sm bg-indigo-100 text-indigo-600 text-xs font-bold",children:a}),(0,l.jsx)("span",{children:s.label})]})},maxTagCount:"responsive",maxTagPlaceholder:e=>(0,l.jsx)(o.Tooltip,{styles:{root:{pointerEvents:"none"}},title:e.map(({value:e})=>e).join(", "),children:(0,l.jsxs)("span",{children:["+",e.length," more"]})}),showSearch:!0,filterOption:(e,l)=>(l?.label??"").toLowerCase().includes(e.toLowerCase())}),(0,l.jsx)("p",{className:"text-xs text-gray-500 mt-1 ml-1",children:i?`Search and select multiple models. Selected models will appear below in order. (${e.fallbackModels.length}/${r} used)`:`Maximum ${r} fallbacks reached. Remove some to add more.`})]}),(0,l.jsx)("div",{className:"space-y-2 min-h-[100px]",children:0===e.fallbackModels.length?(0,l.jsxs)("div",{className:"h-32 border-2 border-dashed border-gray-300 rounded-lg flex flex-col items-center justify-center text-gray-400",children:[(0,l.jsx)("span",{className:"text-sm",children:"No fallback models selected"}),(0,l.jsx)("span",{className:"text-xs mt-1",children:"Add models from the dropdown above"})]}):e.fallbackModels.map((t,r)=>(0,l.jsxs)("div",{className:"group flex items-center justify-between p-3 bg-white rounded-lg border border-gray-200 hover:border-indigo-300 hover:shadow-xs transition-all",children:[(0,l.jsxs)("div",{className:"flex items-center gap-3",children:[(0,l.jsx)("div",{className:"flex items-center justify-center w-6 h-6 rounded-sm bg-gray-100 text-gray-400 group-hover:text-indigo-500 group-hover:bg-indigo-50",children:(0,l.jsx)("span",{className:"text-xs font-bold",children:r+1})}),(0,l.jsx)("div",{children:(0,l.jsx)("span",{className:"font-medium text-gray-800",children:t})})]}),(0,l.jsx)("button",{type:"button",onClick:()=>{let l;return l=e.fallbackModels.filter((e,l)=>l!==r),void s({...e,fallbackModels:l})},className:"opacity-0 group-hover:opacity-100 transition-opacity text-gray-400 hover:text-red-500 p-1",children:(0,l.jsx)(m.X,{className:"w-4 h-4"})})]},`${t}-${r}`))})]})]})]})}e.s(["FallbackSelectionForm",0,function({groups:e,onGroupsChange:n,availableModels:o,maxFallbacks:c=10,maxGroups:d=5}){let[m,g]=(0,a.useState)(e.length>0?e[0].id:"1");(0,a.useEffect)(()=>{e.length>0?e.some(e=>e.id===m)||g(e[0].id):g("1")},[e]);let p=()=>{if(e.length>=d)return;let l=Date.now().toString();n([...e,{id:l,primaryModel:null,fallbackModels:[]}]),g(l)},h=l=>{n(e.map(e=>e.id===l.id?l:e))},x=e.map((s,t)=>{let r=s.primaryModel?s.primaryModel:`Group ${t+1}`;return{key:s.id,label:r,closable:e.length>1,children:(0,l.jsx)(u,{group:s,onChange:h,availableModels:o,maxFallbacks:c})}});return 0===e.length?(0,l.jsxs)("div",{className:"text-center py-12 bg-gray-50 rounded-lg border border-dashed border-gray-300",children:[(0,l.jsx)("p",{className:"text-gray-500 mb-4",children:"No fallback groups configured"}),(0,l.jsx)(s.Button,{variant:"primary",onClick:p,icon:()=>(0,l.jsx)(r.Plus,{className:"w-4 h-4"}),children:"Create First Group"})]}):(0,l.jsx)(t.Tabs,{type:"editable-card",activeKey:m,onChange:g,onEdit:(l,s)=>{"add"===s?p():"remove"===s&&e.length>1&&(l=>{if(1===e.length)return i.default.warning("At least one group is required");let s=e.filter(e=>e.id!==l);n(s),m===l&&s.length>0&&g(s[s.length-1].id)})(l)},items:x,className:"fallback-tabs",tabBarStyle:{marginBottom:0},hideAdd:e.length>=d})}],419470)},246349,e=>{"use strict";let l=(0,e.i(475254).default)("chevron-right",[["path",{d:"m9 18 6-6-6-6",key:"mthhwq"}]]);e.s(["default",0,l])},992619,e=>{"use strict";var l=e.i(843476),s=e.i(271645),t=e.i(779241),r=e.i(599724),a=e.i(199133),i=e.i(983561),n=e.i(695411);e.s(["default",0,({accessToken:e,value:o,placeholder:c="Select a Model",onChange:d,disabled:m=!1,style:u,className:g,showLabel:p=!0,labelText:h="Select Model"})=>{let[x,f]=(0,s.useState)(o),[y,b]=(0,s.useState)(!1),[v,j]=(0,s.useState)([]),w=(0,s.useRef)(null);return(0,s.useEffect)(()=>{f(o)},[o]),(0,s.useEffect)(()=>{e&&(async()=>{try{let l=await (0,n.fetchAvailableModels)(e);l.length>0&&j(l)}catch(e){console.error("Error fetching model info:",e)}})()},[e]),(0,l.jsxs)("div",{children:[p&&(0,l.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,l.jsx)(i.RobotOutlined,{className:"mr-2"})," ",h]}),(0,l.jsx)(a.Select,{value:x,placeholder:c,onChange:e=>{"custom"===e?(b(!0),f(void 0)):(b(!1),f(e),d&&d(e))},options:[...Array.from(new Set(v.map(e=>e.model_group))).map((e,l)=>({value:e,label:e,key:l})),{value:"custom",label:"Enter custom model",key:"custom"}],style:{width:"100%",...u},showSearch:!0,className:`rounded-md ${g||""}`,disabled:m}),y&&(0,l.jsx)(t.TextInput,{className:"mt-2",placeholder:"Enter custom model name",onValueChange:e=>{w.current&&clearTimeout(w.current),w.current=setTimeout(()=>{f(e),d&&d(e)},500)},disabled:m})]})}])},91739,e=>{"use strict";var l=e.i(544195);e.s(["Radio",()=>l.default])},988297,e=>{"use strict";var l=e.i(271645);let s=l.forwardRef(function(e,s){return l.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),l.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M12 4v16m8-8H4"}))});e.s(["PlusIcon",0,s],988297)},797672,e=>{"use strict";var l=e.i(271645);let s=l.forwardRef(function(e,s){return l.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),l.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z"}))});e.s(["PencilIcon",0,s],797672)},361653,e=>{"use strict";let l=(0,e.i(475254).default)("circle-alert",[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["line",{x1:"12",x2:"12",y1:"8",y2:"12",key:"1pkeuh"}],["line",{x1:"12",x2:"12.01",y1:"16",y2:"16",key:"4dfq90"}]]);e.s(["default",0,l])},409797,e=>{"use strict";var l=e.i(631171);e.s(["ChevronDownIcon",()=>l.default])},531516,696609,e=>{"use strict";var l=e.i(843476),s=e.i(271645),t=e.i(536916),r=e.i(599724),a=e.i(409797),i=e.i(246349),i=i;let n=/\b(delete|remove|destroy|purge|drop|erase|unlink)\b/i,o=/\b(create|add|insert|new|post|submit|register|make|generate|write|upload)\b/i,c=/\b(update|edit|modify|change|patch|put|set|rename|move|transform)\b/i,d=/\b(get|read|list|fetch|search|find|query|retrieve|show|view|check|describe|info)\b/i;function m(e,l=""){let s=e.toLowerCase();if(d.test(s))return"read";if(n.test(s))return"delete";if(c.test(s))return"update";if(o.test(s))return"create";if(l){let e=l.toLowerCase();if(d.test(e))return"read";if(n.test(e))return"delete";if(c.test(e))return"update";if(o.test(e))return"create"}return"unknown"}function u(e){let l={read:[],create:[],update:[],delete:[],unknown:[]};for(let s of e)l[m(s.name,s.description)].push(s);return l}let g={read:{label:"Read",description:"Safe operations — fetch, list, search. No side effects.",risk:"low"},create:{label:"Create",description:"Add new resources — insert, upload, register.",risk:"medium"},update:{label:"Update",description:"Modify existing resources — edit, patch, rename.",risk:"medium"},delete:{label:"Delete",description:"Destructive operations — remove, purge, destroy.",risk:"high"},unknown:{label:"Other",description:"Operations that could not be automatically classified.",risk:"unknown"}};e.s(["CRUD_GROUP_META",0,g,"classifyToolOp",0,m,"groupToolsByCrud",0,u],696609);let p=["read","create","update","delete","unknown"],h={low:"bg-green-100 text-green-800",medium:"bg-yellow-100 text-yellow-800",high:"bg-red-100 text-red-800 font-semibold",unknown:"bg-gray-100 text-gray-700"},x={read:"border-green-200",create:"border-blue-200",update:"border-yellow-200",delete:"border-red-300",unknown:"border-gray-200"},f={read:"bg-green-50",create:"bg-blue-50",update:"bg-yellow-50",delete:"bg-red-50",unknown:"bg-gray-50"};e.s(["default",0,({tools:e,value:n,onChange:o,readOnly:c=!1,searchFilter:d=""})=>{let[m,y]=(0,s.useState)({read:!1,create:!1,update:!1,delete:!1,unknown:!0}),b=(0,s.useMemo)(()=>u(e),[e]),v=(0,s.useMemo)(()=>new Set(void 0===n?e.map(e=>e.name):n),[n,e]),j=e=>{if(c)return;let l=new Set(v);l.has(e)?l.delete(e):l.add(e),o(Array.from(l))};return 0===e.length?null:(0,l.jsx)("div",{className:"space-y-3",children:p.map(e=>{let s,n=b[e];if(0===n.length)return null;if(d){let e=d.toLowerCase();if(!n.some(l=>l.name.toLowerCase().includes(e)||(l.description??"").toLowerCase().includes(e)))return null}let u=g[e],p=(s=b[e]).length>0&&s.every(e=>v.has(e.name)),w=(e=>{let l=b[e];if(0===l.length)return!1;let s=l.filter(e=>v.has(e.name)).length;return s>0&&s{y(l=>({...l,[e]:!l[e]}))},children:[N?(0,l.jsx)(i.default,{className:"w-4 h-4 text-gray-500 shrink-0"}):(0,l.jsx)(a.ChevronDownIcon,{className:"w-4 h-4 text-gray-500 shrink-0"}),(0,l.jsx)("span",{className:"font-semibold text-gray-900 text-sm",children:u.label}),(0,l.jsx)("span",{className:`text-xs px-2 py-0.5 rounded-full ${h[u.risk]}`,children:"high"===u.risk?"High Risk":"medium"===u.risk?"Medium Risk":"low"===u.risk?"Safe":"Unclassified"}),(0,l.jsxs)("span",{className:"text-xs text-gray-500 ml-1",children:[n.filter(e=>v.has(e.name)).length,"/",n.length," allowed"]})]}),!c&&(0,l.jsxs)("div",{className:"flex items-center gap-2 ml-4",children:[(0,l.jsx)(r.Text,{className:"text-xs text-gray-500",children:p?"All on":w?"Partial":"All off"}),(0,l.jsx)(t.Checkbox,{checked:p,indeterminate:w,onChange:l=>((e,l)=>{if(c)return;let s=new Set(v);for(let t of b[e])l?s.add(t.name):s.delete(t.name);o(Array.from(s))})(e,l.target.checked),onClick:e=>e.stopPropagation()})]})]}),!N&&(0,l.jsx)("div",{className:"px-4 pt-2 pb-1 text-xs text-gray-500 bg-white border-b border-gray-100",children:u.description}),!N&&(0,l.jsx)("div",{className:"bg-white divide-y divide-gray-50",children:n.filter(e=>!d||e.name.toLowerCase().includes(d.toLowerCase())||(e.description??"").toLowerCase().includes(d.toLowerCase())).map(e=>{let s,a=(s=e.name,v.has(s));return(0,l.jsxs)("div",{className:`flex items-start gap-3 px-4 py-2.5 transition-colors hover:bg-gray-50 ${!c?"cursor-pointer":""} ${a?"":"opacity-60"}`,onClick:()=>j(e.name),children:[(0,l.jsx)(t.Checkbox,{checked:a,onChange:()=>j(e.name),disabled:c,onClick:e=>e.stopPropagation()}),(0,l.jsxs)("div",{className:"flex-1 min-w-0",children:[(0,l.jsx)(r.Text,{className:"font-medium text-gray-900 text-sm",children:e.name}),e.description&&(0,l.jsx)(r.Text,{className:"text-xs text-gray-500 mt-0.5 leading-snug",children:e.description})]}),(0,l.jsx)("span",{className:`text-xs px-1.5 py-0.5 rounded shrink-0 ${a?"bg-green-100 text-green-700":"bg-gray-100 text-gray-500"}`,children:a?"on":"off"})]},e.name)})})]},e)})})}],531516)},309426,e=>{"use strict";var l=e.i(290571),s=e.i(444755),t=e.i(673706),r=e.i(271645),a=e.i(46757);let i=(0,t.makeClassName)("Col"),n=r.default.forwardRef((e,t)=>{let n,o,c,d,{numColSpan:m=1,numColSpanSm:u,numColSpanMd:g,numColSpanLg:p,children:h,className:x}=e,f=(0,l.__rest)(e,["numColSpan","numColSpanSm","numColSpanMd","numColSpanLg","children","className"]),y=(e,l)=>e&&Object.keys(l).includes(String(e))?l[e]:"";return r.default.createElement("div",Object.assign({ref:t,className:(0,s.tremorTwMerge)(i("root"),(n=y(m,a.colSpan),o=y(u,a.colSpanSm),c=y(g,a.colSpanMd),d=y(p,a.colSpanLg),(0,s.tremorTwMerge)(n,o,c,d)),x)},f),h)});n.displayName="Col",e.s(["Col",0,n],309426)},355619,e=>{"use strict";var l=e.i(602869);let s=async(e,s,t)=>{try{if(null===e||null===s)return;if(null!==t){let r=(await (0,l.modelAvailableCall)(t,e,s,!0,null,!0)).data.map(e=>e.id),a=[],i=[];return r.forEach(e=>{e.endsWith("/*")?a.push(e):i.push(e)}),[...a,...i]}}catch(e){console.error("Error fetching user models:",e)}};e.s(["fetchAvailableModelsForTeamOrKey",0,s,"getModelDisplayName",0,e=>{if("all-proxy-models"===e)return"All Proxy Models";if(e.endsWith("/*")){let l=e.replace("/*","");return`All ${l} models`}return e},"unfurlWildcardModelsInList",0,(e,l)=>{let s=[],t=[];return e.forEach(e=>{if(e.endsWith("/*")){let r=e.replace("/*",""),a=l.filter(e=>e.startsWith(r+"/"));t.push(...a),s.push(e)}else t.push(e)}),[...s,...t].filter((e,l,s)=>s.indexOf(e)===l)}])},860585,e=>{"use strict";var l=e.i(843476),s=e.i(199133);let{Option:t}=s.Select;e.s(["default",0,({value:e,onChange:r,className:a="",style:i={}})=>(0,l.jsxs)(s.Select,{style:{width:"100%",...i},value:e||void 0,onChange:r,className:a,placeholder:"n/a",allowClear:!0,children:[(0,l.jsx)(t,{value:"1h",children:"hourly"}),(0,l.jsx)(t,{value:"24h",children:"daily"}),(0,l.jsx)(t,{value:"7d",children:"weekly"}),(0,l.jsx)(t,{value:"30d",children:"monthly"})]}),"getBudgetDurationLabel",0,e=>e?({"1h":"hourly","24h":"daily","7d":"weekly","30d":"monthly"})[e]||e:"Not set"])},213205,e=>{"use strict";e.i(247167);var l=e.i(931067),s=e.i(271645);let t={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M678.3 642.4c24.2-13 51.9-20.4 81.4-20.4h.1c3 0 4.4-3.6 2.2-5.6a371.67 371.67 0 00-103.7-65.8c-.4-.2-.8-.3-1.2-.5C719.2 505 759.6 431.7 759.6 349c0-137-110.8-248-247.5-248S264.7 212 264.7 349c0 82.7 40.4 156 102.6 201.1-.4.2-.8.3-1.2.5-44.7 18.9-84.8 46-119.3 80.6a373.42 373.42 0 00-80.4 119.5A373.6 373.6 0 00137 888.8a8 8 0 008 8.2h59.9c4.3 0 7.9-3.5 8-7.8 2-77.2 32.9-149.5 87.6-204.3C357 628.2 432.2 597 512.2 597c56.7 0 111.1 15.7 158 45.1a8.1 8.1 0 008.1.3zM512.2 521c-45.8 0-88.9-17.9-121.4-50.4A171.2 171.2 0 01340.5 349c0-45.9 17.9-89.1 50.3-121.6S466.3 177 512.2 177s88.9 17.9 121.4 50.4A171.2 171.2 0 01683.9 349c0 45.9-17.9 89.1-50.3 121.6C601.1 503.1 558 521 512.2 521zM880 759h-84v-84c0-4.4-3.6-8-8-8h-56c-4.4 0-8 3.6-8 8v84h-84c-4.4 0-8 3.6-8 8v56c0 4.4 3.6 8 8 8h84v84c0 4.4 3.6 8 8 8h56c4.4 0 8-3.6 8-8v-84h84c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8z"}}]},name:"user-add",theme:"outlined"};var r=e.i(9583),a=s.forwardRef(function(e,a){return s.createElement(r.default,(0,l.default)({},e,{ref:a,icon:t}))});e.s(["UserAddOutlined",0,a],213205)},350967,46757,e=>{"use strict";var l=e.i(290571),s=e.i(444755),t=e.i(673706),r=e.i(271645);let a={0:"grid-cols-none",1:"grid-cols-1",2:"grid-cols-2",3:"grid-cols-3",4:"grid-cols-4",5:"grid-cols-5",6:"grid-cols-6",7:"grid-cols-7",8:"grid-cols-8",9:"grid-cols-9",10:"grid-cols-10",11:"grid-cols-11",12:"grid-cols-12"},i={0:"sm:grid-cols-none",1:"sm:grid-cols-1",2:"sm:grid-cols-2",3:"sm:grid-cols-3",4:"sm:grid-cols-4",5:"sm:grid-cols-5",6:"sm:grid-cols-6",7:"sm:grid-cols-7",8:"sm:grid-cols-8",9:"sm:grid-cols-9",10:"sm:grid-cols-10",11:"sm:grid-cols-11",12:"sm:grid-cols-12"},n={0:"md:grid-cols-none",1:"md:grid-cols-1",2:"md:grid-cols-2",3:"md:grid-cols-3",4:"md:grid-cols-4",5:"md:grid-cols-5",6:"md:grid-cols-6",7:"md:grid-cols-7",8:"md:grid-cols-8",9:"md:grid-cols-9",10:"md:grid-cols-10",11:"md:grid-cols-11",12:"md:grid-cols-12"},o={0:"lg:grid-cols-none",1:"lg:grid-cols-1",2:"lg:grid-cols-2",3:"lg:grid-cols-3",4:"lg:grid-cols-4",5:"lg:grid-cols-5",6:"lg:grid-cols-6",7:"lg:grid-cols-7",8:"lg:grid-cols-8",9:"lg:grid-cols-9",10:"lg:grid-cols-10",11:"lg:grid-cols-11",12:"lg:grid-cols-12"};e.s(["colSpan",0,{1:"col-span-1",2:"col-span-2",3:"col-span-3",4:"col-span-4",5:"col-span-5",6:"col-span-6",7:"col-span-7",8:"col-span-8",9:"col-span-9",10:"col-span-10",11:"col-span-11",12:"col-span-12",13:"col-span-13"},"colSpanLg",0,{1:"lg:col-span-1",2:"lg:col-span-2",3:"lg:col-span-3",4:"lg:col-span-4",5:"lg:col-span-5",6:"lg:col-span-6",7:"lg:col-span-7",8:"lg:col-span-8",9:"lg:col-span-9",10:"lg:col-span-10",11:"lg:col-span-11",12:"lg:col-span-12",13:"lg:col-span-13"},"colSpanMd",0,{1:"md:col-span-1",2:"md:col-span-2",3:"md:col-span-3",4:"md:col-span-4",5:"md:col-span-5",6:"md:col-span-6",7:"md:col-span-7",8:"md:col-span-8",9:"md:col-span-9",10:"md:col-span-10",11:"md:col-span-11",12:"md:col-span-12",13:"md:col-span-13"},"colSpanSm",0,{1:"sm:col-span-1",2:"sm:col-span-2",3:"sm:col-span-3",4:"sm:col-span-4",5:"sm:col-span-5",6:"sm:col-span-6",7:"sm:col-span-7",8:"sm:col-span-8",9:"sm:col-span-9",10:"sm:col-span-10",11:"sm:col-span-11",12:"sm:col-span-12",13:"sm:col-span-13"},"gridCols",0,a,"gridColsLg",0,o,"gridColsMd",0,n,"gridColsSm",0,i],46757);let c=(0,t.makeClassName)("Grid"),d=(e,l)=>e&&Object.keys(l).includes(String(e))?l[e]:"",m=r.default.forwardRef((e,t)=>{let{numItems:m=1,numItemsSm:u,numItemsMd:g,numItemsLg:p,children:h,className:x}=e,f=(0,l.__rest)(e,["numItems","numItemsSm","numItemsMd","numItemsLg","children","className"]),y=d(m,a),b=d(u,i),v=d(g,n),j=d(p,o),w=(0,s.tremorTwMerge)(y,b,v,j);return r.default.createElement("div",Object.assign({ref:t,className:(0,s.tremorTwMerge)(c("root"),"grid",w,x)},f),h)});m.displayName="Grid",e.s(["Grid",0,m],350967)},981339,e=>{"use strict";var l=e.i(185793);e.s(["Skeleton",()=>l.default])},500727,e=>{"use strict";var l=e.i(266027),s=e.i(243652),t=e.i(602869),r=e.i(135214);let a=(0,s.createQueryKeys)("mcpServers");e.s(["useMCPServers",0,e=>{let{accessToken:s}=(0,r.default)();return(0,l.useQuery)({queryKey:a.list(e?{filters:{teamId:e}}:void 0),queryFn:async()=>await (0,t.fetchMCPServers)(s,e),enabled:!!s})}])},699857,e=>{"use strict";var l=e.i(266027),s=e.i(243652),t=e.i(602869),r=e.i(135214);let a=(0,s.createQueryKeys)("mcpToolsets");e.s(["useMCPToolsets",0,()=>{let{accessToken:e}=(0,r.default)();return(0,l.useQuery)({queryKey:a.list(),queryFn:async()=>await (0,t.fetchMCPToolsets)(e),enabled:!!e})}])},916940,e=>{"use strict";var l=e.i(843476),s=e.i(271645),t=e.i(199133),r=e.i(602869);e.s(["default",0,({onChange:e,value:a,className:i,accessToken:n,placeholder:o="Select vector stores",disabled:c=!1})=>{let[d,m]=(0,s.useState)([]),[u,g]=(0,s.useState)(!1);return(0,s.useEffect)(()=>{(async()=>{if(n){g(!0);try{let e=await (0,r.vectorStoreListCall)(n);e.data&&m(e.data)}catch(e){console.error("Error fetching vector stores:",e)}finally{g(!1)}}})()},[n]),(0,l.jsx)("div",{children:(0,l.jsx)(t.Select,{mode:"multiple",placeholder:o,onChange:e,value:a,loading:u,className:i,allowClear:!0,options:d.map(e=>({label:`${e.vector_store_name||e.vector_store_id} (${e.vector_store_id})`,value:e.vector_store_id,title:e.vector_store_description||e.vector_store_id})),optionFilterProp:"label",showSearch:!0,style:{width:"100%"},disabled:c})})}])},75921,e=>{"use strict";var l=e.i(843476),s=e.i(266027),t=e.i(243652),r=e.i(602869),a=e.i(135214);let i=(0,t.createQueryKeys)("mcpAccessGroups");var n=e.i(500727),o=e.i(699857),c=e.i(199133),d=e.i(234713);let m="toolset:";e.s(["default",0,({onChange:e,value:t,className:u,accessToken:g,placeholder:p="Select MCP servers",disabled:h=!1,teamId:x,allowNoMcpServers:f=!1,allowAllProxyMcpServers:y=!1})=>{let{data:b=[],isLoading:v}=(0,n.useMCPServers)(x),{data:j=[],isLoading:w}=(()=>{let{accessToken:e}=(0,a.default)();return(0,s.useQuery)({queryKey:i.list({}),queryFn:async()=>await (0,r.fetchMCPAccessGroups)(e),enabled:!!e})})(),{data:N=[],isLoading:S}=(0,o.useMCPToolsets)(),k=new Set(j),_=[...j.map(e=>({label:e,value:e,type:"accessGroup",searchText:`${e} Access Group`})),...b.map(e=>({label:`${e.server_name||e.server_id} (${e.server_id})`,value:e.server_id,type:"server",searchText:`${e.server_name||e.server_id} ${e.server_id} MCP Server`})),...N.map(e=>({label:e.toolset_name,value:`${m}${e.toolset_id}`,type:"toolset",searchText:`${e.toolset_name} ${e.toolset_id} Toolset`}))],C={accessGroup:"#52c41a",server:"#1890ff",toolset:"#722ed1"},M={accessGroup:"Access Group",server:"MCP Server",toolset:"Toolset"},E=[...t?.servers||[],...t?.accessGroups||[],...(t?.toolsets||[]).map(e=>`${m}${e}`)],L=f&&E.includes(d.NO_MCP_SERVERS_SENTINEL),R=E.includes(d.ALL_PROXY_MCP_SERVERS_SENTINEL);return(0,l.jsx)("div",{children:(0,l.jsxs)(c.Select,{mode:"multiple",placeholder:p,onChange:l=>{if(y&&l.includes(d.ALL_PROXY_MCP_SERVERS_SENTINEL))return void e({servers:[d.ALL_PROXY_MCP_SERVERS_SENTINEL],accessGroups:[],toolsets:[]});if(f&&l.includes(d.NO_MCP_SERVERS_SENTINEL))return void e({servers:[d.NO_MCP_SERVERS_SENTINEL],accessGroups:[],toolsets:[]});let s=l.filter(e=>e.startsWith(m)).map(e=>e.slice(m.length)),t=l.filter(e=>!e.startsWith(m));e({servers:t.filter(e=>!k.has(e)),accessGroups:t.filter(e=>k.has(e)),toolsets:s})},value:E,loading:v||w||S,className:u,allowClear:!0,showSearch:!0,style:{width:"100%"},disabled:h,filterOption:(e,l)=>l?.value===d.NO_MCP_SERVERS_SENTINEL||l?.value===d.ALL_PROXY_MCP_SERVERS_SENTINEL||(_.find(e=>e.value===l?.value)?.searchText||"").toLowerCase().includes(e.toLowerCase()),children:[(y||R)&&(0,l.jsx)(c.Select.Option,{value:d.ALL_PROXY_MCP_SERVERS_SENTINEL,label:"All Proxy MCP Servers",children:(0,l.jsx)("span",{style:{color:"#1890ff",fontWeight:500},children:"All Proxy MCP Servers"})},d.ALL_PROXY_MCP_SERVERS_SENTINEL),f&&(0,l.jsx)(c.Select.Option,{value:d.NO_MCP_SERVERS_SENTINEL,label:"No MCP Servers",children:(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,l.jsx)("span",{style:{flex:1},children:"No MCP Servers"}),(0,l.jsx)("span",{style:{color:"#8c8c8c",fontSize:"12px",fontWeight:500,opacity:.8},children:"Block all"})]})},d.NO_MCP_SERVERS_SENTINEL),_.map(e=>(0,l.jsx)(c.Select.Option,{value:e.value,label:e.label,disabled:L||R,children:(0,l.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,l.jsx)("span",{style:{display:"inline-block",width:8,height:8,borderRadius:"50%",background:C[e.type],flexShrink:0}}),(0,l.jsx)("span",{style:{flex:1},children:e.label}),(0,l.jsx)("span",{style:{color:C[e.type],fontSize:"12px",fontWeight:500,opacity:.8},children:M[e.type]})]})},e.value))]})})}],75921)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/02j-r.3jw.7le.js b/litellm/proxy/_experimental/out/_next/static/chunks/02j-r.3jw.7le.js deleted file mode 100644 index 126c5975733..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/02j-r.3jw.7le.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,9314,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(981339),a=e.i(645526),r=e.i(599724),i=e.i(263147);e.s(["default",0,({value:e,onChange:n,placeholder:o="Select access groups",disabled:d=!1,style:c,className:u,showLabel:m=!1,labelText:p="Access Group",allowClear:g=!0})=>{let{data:h,isLoading:x,isError:y}=(0,i.useAccessGroups)();if(x)return(0,t.jsxs)("div",{children:[m&&(0,t.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(a.TeamOutlined,{className:"mr-2"})," ",p]}),(0,t.jsx)(l.Skeleton.Input,{active:!0,block:!0,style:{height:32,...c}})]});let f=(h??[]).map(e=>({label:(0,t.jsxs)("span",{children:[(0,t.jsx)("span",{className:"font-medium",children:e.access_group_name})," ",(0,t.jsxs)("span",{className:"text-gray-400 text-xs",children:["(",e.access_group_id,")"]})]}),value:e.access_group_id,selectedLabel:e.access_group_name,searchText:`${e.access_group_name} ${e.access_group_id}`}));return(0,t.jsxs)("div",{children:[m&&(0,t.jsxs)(r.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(a.TeamOutlined,{className:"mr-2"})," ",p]}),(0,t.jsx)(s.Select,{mode:"multiple",value:e,placeholder:o,onChange:n,disabled:d,allowClear:g,showSearch:!0,style:{width:"100%",...c},className:`rounded-md ${u??""}`,notFoundContent:y?(0,t.jsx)("span",{className:"text-red-500",children:"Failed to load access groups"}):"No access groups found",filterOption:(e,t)=>(f.find(e=>e.value===t?.value)?.searchText??"").toLowerCase().includes(e.toLowerCase()),optionLabelProp:"selectedLabel",options:f.map(e=>({label:e.label,value:e.value,selectedLabel:e.selectedLabel}))})]})}])},552130,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(602869);e.s(["default",0,({onChange:e,value:r,className:i,accessToken:n,placeholder:o="Select agents",disabled:d=!1})=>{let[c,u]=(0,s.useState)([]),[m,p]=(0,s.useState)([]),[g,h]=(0,s.useState)(!1);(0,s.useEffect)(()=>{(async()=>{if(n){h(!0);try{let e=await (0,a.getAgentsList)(n),t=e?.agents||[];u(t);let s=new Set;t.forEach(e=>{let t=e.agent_access_groups;t&&Array.isArray(t)&&t.forEach(e=>s.add(e))}),p(Array.from(s))}catch(e){console.error("Error fetching agents:",e)}finally{h(!1)}}})()},[n]);let x=[...m.map(e=>({label:e,value:`group:${e}`,isAccessGroup:!0,searchText:`${e} Access Group`})),...c.map(e=>({label:`${e.agent_name||e.agent_id}`,value:e.agent_id,isAccessGroup:!1,searchText:`${e.agent_name||e.agent_id} ${e.agent_id} Agent`}))],y=[...r?.agents||[],...(r?.accessGroups||[]).map(e=>`group:${e}`)];return(0,t.jsx)("div",{children:(0,t.jsx)(l.Select,{mode:"multiple",placeholder:o,onChange:t=>{e({agents:t.filter(e=>!e.startsWith("group:")),accessGroups:t.filter(e=>e.startsWith("group:")).map(e=>e.replace("group:",""))})},value:y,loading:g,className:i,allowClear:!0,showSearch:!0,style:{width:"100%"},disabled:d,filterOption:(e,t)=>(x.find(e=>e.value===t?.value)?.searchText||"").toLowerCase().includes(e.toLowerCase()),children:x.map(e=>(0,t.jsx)(l.Select.Option,{value:e.value,label:e.label,children:(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:"8px"},children:[(0,t.jsx)("span",{style:{display:"inline-block",width:8,height:8,borderRadius:"50%",background:e.isAccessGroup?"#52c41a":"#722ed1",flexShrink:0}}),(0,t.jsx)("span",{style:{flex:1},children:e.label}),(0,t.jsx)("span",{style:{color:e.isAccessGroup?"#52c41a":"#722ed1",fontSize:"12px",fontWeight:500,opacity:.8},children:e.isAccessGroup?"Access Group":"Agent"})]})},e.value))})})}])},844565,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(602869);e.s(["default",0,({onChange:e,value:r,className:i,accessToken:n,placeholder:o="Select pass through routes",disabled:d=!1,teamId:c})=>{let[u,m]=(0,s.useState)([]),[p,g]=(0,s.useState)(!1);return(0,s.useEffect)(()=>{(async()=>{if(n){g(!0);try{let e=await (0,a.getPassThroughEndpointsCall)(n,c);if(e.endpoints){let t=e.endpoints.flatMap(e=>{let t=e.path,s=e.methods;return s&&s.length>0?s.map(e=>({label:`${e} ${t}`,value:t})):[{label:t,value:t}]});m(t)}}catch(e){console.error("Error fetching pass through routes:",e)}finally{g(!1)}}})()},[n,c]),(0,t.jsx)(l.Select,{mode:"tags",placeholder:o,onChange:e,value:r,loading:p,className:i,allowClear:!0,options:u,optionFilterProp:"label",showSearch:!0,style:{width:"100%"},disabled:d})}])},810757,477386,e=>{"use strict";var t=e.i(271645);let s=t.forwardRef(function(e,s){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z"}),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15 12a3 3 0 11-6 0 3 3 0 016 0z"}))});e.s(["CogIcon",0,s],810757);let l=t.forwardRef(function(e,s){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:s},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M18.364 18.364A9 9 0 005.636 5.636m12.728 12.728A9 9 0 015.636 5.636m12.728 12.728L5.636 5.636"}))});e.s(["BanIcon",0,l],477386)},557662,e=>{"use strict";let t="/ui/assets/logos/",s=[{id:"arize",displayName:"Arize",logo:`${t}arize.png`,supports_key_team_logging:!0,dynamic_params:{arize_api_key:"password",arize_space_id:"password"},description:"Arize Logging Integration"},{id:"braintrust",displayName:"Braintrust",logo:`${t}braintrust.png`,supports_key_team_logging:!1,dynamic_params:{braintrust_api_key:"password",braintrust_project_name:"text"},description:"Braintrust Logging Integration"},{id:"custom_callback_api",displayName:"Custom Callback API",logo:`${t}custom.svg`,supports_key_team_logging:!0,dynamic_params:{custom_callback_api_url:"text",custom_callback_api_headers:"text"},description:"Custom Callback API Logging Integration"},{id:"galileo",displayName:"Galileo",logo:`${t}galileo.ico`,supports_key_team_logging:!1,dynamic_params:{GALILEO_API_KEY:"password",GALILEO_PROJECT_ID:"text",GALILEO_LOG_STREAM_ID:"text",GALILEO_BASE_URL:"text",GALILEO_USERNAME:"text",GALILEO_PASSWORD:"password"},description:"Galileo AI Observability Integration"},{id:"datadog",displayName:"Datadog",logo:`${t}datadog.png`,supports_key_team_logging:!1,dynamic_params:{dd_api_key:"password",dd_site:"text"},description:"Datadog Logging Integration"},{id:"lago",displayName:"Lago",logo:`${t}lago.svg`,supports_key_team_logging:!1,dynamic_params:{lago_api_url:"text",lago_api_key:"password"},description:"Lago Billing Logging Integration"},{id:"langfuse",displayName:"Langfuse",logo:`${t}langfuse.png`,supports_key_team_logging:!0,dynamic_params:{langfuse_public_key:"text",langfuse_secret_key:"password",langfuse_host:"text"},description:"Langfuse v2 Logging Integration"},{id:"langfuse_otel",displayName:"Langfuse OTEL",logo:`${t}langfuse.png`,supports_key_team_logging:!0,dynamic_params:{langfuse_public_key:"text",langfuse_secret_key:"password",langfuse_host:"text"},description:"Langfuse v3 OTEL Logging Integration"},{id:"langsmith",displayName:"LangSmith",logo:`${t}langsmith.png`,supports_key_team_logging:!0,dynamic_params:{langsmith_api_key:"password",langsmith_project:"text",langsmith_base_url:"text",langsmith_sampling_rate:"number"},description:"Langsmith Logging Integration"},{id:"openmeter",displayName:"OpenMeter",logo:`${t}openmeter.png`,supports_key_team_logging:!1,dynamic_params:{openmeter_api_key:"password",openmeter_base_url:"text"},description:"OpenMeter Logging Integration"},{id:"otel",displayName:"Open Telemetry",logo:`${t}otel.png`,supports_key_team_logging:!1,dynamic_params:{otel_endpoint:"text",otel_headers:"text"},description:"OpenTelemetry Logging Integration"},{id:"s3",displayName:"S3",logo:`${t}aws.svg`,supports_key_team_logging:!1,dynamic_params:{s3_bucket_name:"text",aws_access_key_id:"password",aws_secret_access_key:"password",aws_region:"text"},description:"S3 Bucket (AWS) Logging Integration"},{id:"SQS",displayName:"SQS",logo:`${t}aws.svg`,supports_key_team_logging:!1,dynamic_params:{sqs_queue_url:"text",aws_access_key_id:"password",aws_secret_access_key:"password",aws_region:"text"},description:"SQS Queue (AWS) Logging Integration"}],l=s.reduce((e,t)=>(e[t.displayName]=t,e),{}),a=s.reduce((e,t)=>(e[t.displayName]=t.id,e),{}),r=s.reduce((e,t)=>(e[t.id]=t.displayName,e),{});e.s(["callbackInfo",0,l,"callback_map",0,a,"mapDisplayToInternalNames",0,e=>e.map(e=>a[e]||e),"mapInternalToDisplayNames",0,e=>e.map(e=>r[e]||e),"reverse_callback_map",0,r])},390605,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(602869),a=e.i(599724),r=e.i(482725),i=e.i(91739),n=e.i(500727),o=e.i(531516),d=e.i(696609);e.s(["default",0,({accessToken:e,selectedServers:c,toolPermissions:u,onChange:m,disabled:p=!1})=>{let{data:g=[]}=(0,n.useMCPServers)(),[h,x]=(0,s.useState)({}),[y,f]=(0,s.useState)({}),[b,_]=(0,s.useState)({}),[j,v]=(0,s.useState)({}),w=(0,s.useRef)(u);(0,s.useEffect)(()=>{w.current=u},[u]);let N=(0,s.useMemo)(()=>0===c.length?[]:g.filter(e=>c.includes(e.server_id)),[g,c]),k=async(e,t)=>{f(t=>({...t,[e]:!0})),_(t=>({...t,[e]:""}));try{let s=await (0,l.listMCPTools)(t,e);if(s.error)_(t=>({...t,[e]:s.message||"Failed to fetch tools"})),x(t=>({...t,[e]:[]}));else{let t=s.tools||[];x(s=>({...s,[e]:t}));let l=w.current;if(!l[e]&&t.length>0){let s=t.filter(e=>"delete"!==(0,d.classifyToolOp)(e.name,e.description||"")).map(e=>e.name);m({...l,[e]:s})}}}catch(t){console.error(`Error fetching tools for server ${e}:`,t),_(t=>({...t,[e]:"Failed to fetch tools"})),x(t=>({...t,[e]:[]}))}finally{f(t=>({...t,[e]:!1}))}};(0,s.useEffect)(()=>{N.forEach(t=>{h[t.server_id]||y[t.server_id]||k(t.server_id,e)})},[N,e]);let S=(e,t)=>{m({...u,[e]:t})};return 0===c.length?null:(0,t.jsx)("div",{className:"space-y-4",children:N.map(e=>{let s=e.server_name||e.alias||e.server_id,l=h[e.server_id]||[],n=u[e.server_id]||[],d=y[e.server_id],c=b[e.server_id],g=j[e.server_id]??"crud";return(0,t.jsxs)("div",{className:"border rounded-lg bg-gray-50",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between p-4 border-b bg-white rounded-t-lg",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(a.Text,{className:"font-semibold text-gray-900",children:s}),e.description&&(0,t.jsx)(a.Text,{className:"text-sm text-gray-500",children:e.description})]}),(0,t.jsxs)("div",{className:"flex items-center gap-3",children:[!p&&l.length>0&&(0,t.jsx)(i.Radio.Group,{value:g,onChange:t=>v(s=>({...s,[e.server_id]:t.target.value})),size:"small",optionType:"button",buttonStyle:"solid",options:[{label:"Risk Groups",value:"crud"},{label:"Flat List",value:"flat"}]}),!p&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("button",{type:"button",className:"text-sm text-blue-600 hover:text-blue-700 font-medium",onClick:()=>{var t;let s;return s=h[t=e.server_id]||[],void m({...u,[t]:s.map(e=>e.name)})},disabled:d,children:"Select All"}),(0,t.jsx)("button",{type:"button",className:"text-sm text-blue-600 hover:text-blue-700 font-medium",onClick:()=>{var t;return t=e.server_id,void m({...u,[t]:[]})},disabled:d,children:"Deselect All"})]})]})]}),(0,t.jsxs)("div",{className:"p-4",children:[d&&(0,t.jsxs)("div",{className:"flex items-center justify-center py-8",children:[(0,t.jsx)(r.Spin,{size:"large"}),(0,t.jsx)(a.Text,{className:"ml-3 text-gray-500",children:"Loading tools..."})]}),c&&!d&&(0,t.jsxs)("div",{className:"p-4 bg-red-50 border border-red-200 rounded-lg text-center",children:[(0,t.jsx)(a.Text,{className:"text-red-600 font-medium",children:"Unable to load tools"}),(0,t.jsx)(a.Text,{className:"text-sm text-red-500 mt-1",children:c})]}),!d&&!c&&l.length>0&&"crud"===g&&(0,t.jsx)(o.default,{tools:l,value:u[e.server_id]?n:void 0,onChange:t=>S(e.server_id,t),readOnly:p}),!d&&!c&&l.length>0&&"flat"===g&&(0,t.jsx)("div",{className:"space-y-2",children:l.map(s=>{let l=n.includes(s.name);return(0,t.jsxs)("div",{className:"flex items-start gap-2",children:[(0,t.jsx)("input",{type:"checkbox",checked:l,onChange:()=>{if(p)return;let t=l?n.filter(e=>e!==s.name):[...n,s.name];S(e.server_id,t)},disabled:p,className:"mt-0.5"}),(0,t.jsx)("div",{className:"flex-1 min-w-0",children:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(a.Text,{className:"font-medium text-gray-900",children:s.name}),(0,t.jsxs)(a.Text,{className:"text-sm text-gray-500",children:["- ",s.description||"No description"]})]})})]},s.name)})}),!d&&!c&&0===l.length&&(0,t.jsx)("div",{className:"text-center py-6",children:(0,t.jsx)(a.Text,{className:"text-gray-500",children:"No tools available"})})]})]},e.server_id)})})}])},266484,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(592968),a=e.i(312361),r=e.i(827252),i=e.i(994388),n=e.i(304967),o=e.i(779241),d=e.i(988297),c=e.i(68155),u=e.i(810757),m=e.i(477386),p=e.i(557662),g=e.i(555987),h=e.i(435451);let{Option:x}=s.Select;e.s(["default",0,({value:e=[],onChange:y,disabledCallbacks:f=[],onDisabledCallbacksChange:b})=>{let _=Object.entries(p.callbackInfo).filter(([e,t])=>t.supports_key_team_logging).map(([e,t])=>e),j=Object.keys(p.callbackInfo),v=e=>{y?.(e)},w=(t,s,l)=>{let a=[...e];if("callback_name"===s){let e=p.callback_map[l]||l;a[t]={...a[t],[s]:e,callback_vars:{}}}else a[t]={...a[t],[s]:l};v(a)},N=(t,s,l)=>{let a=[...e];a[t]={...a[t],callback_vars:{...a[t].callback_vars,[s]:l}},v(a)};return(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(m.BanIcon,{className:"w-5 h-5 text-red-500"}),(0,t.jsx)("span",{className:"text-base font-semibold text-gray-800",children:"Disabled Callbacks"}),(0,t.jsx)(l.Tooltip,{title:"Select callbacks to disable for this key. Disabled callbacks will not receive any logging data.",children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Disabled Callbacks"}),(0,t.jsx)(s.Select,{mode:"multiple",placeholder:"Select callbacks to disable",value:f,onChange:e=>{let t=(0,p.mapDisplayToInternalNames)(e);b?.(t)},style:{width:"100%"},optionLabelProp:"label",children:j.map(e=>{let s=(0,g.resolveLogoSrc)(p.callbackInfo[e]?.logo),a=p.callbackInfo[e]?.description;return(0,t.jsx)(x,{value:e,label:e,children:(0,t.jsx)(l.Tooltip,{title:a,placement:"right",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[s&&(0,t.jsx)("img",{src:s,alt:e,className:"w-4 h-4 object-contain",onError:t=>{let s=t.target,l=s.parentElement;if(l){let t=document.createElement("div");t.className="w-4 h-4 rounded-full bg-gray-200 flex items-center justify-center text-xs",t.textContent=e.charAt(0),l.replaceChild(t,s)}}}),(0,t.jsx)("span",{children:e})]})})},e)})}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Select callbacks that should be disabled for this key. These callbacks will not receive any logging data."})]})]}),(0,t.jsx)(a.Divider,{}),(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(u.CogIcon,{className:"w-5 h-5 text-blue-500"}),(0,t.jsx)("span",{className:"text-base font-semibold text-gray-800",children:"Logging Integrations"}),(0,t.jsx)(l.Tooltip,{title:"Configure callback logging integrations for this team.",children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help"})})]}),(0,t.jsx)(i.Button,{variant:"secondary",onClick:()=>{v([...e,{callback_name:"",callback_type:"success",callback_vars:{}}])},icon:d.PlusIcon,size:"sm",className:"hover:border-blue-400 hover:text-blue-500",type:"button",children:"Add Integration"})]}),(0,t.jsx)("div",{className:"space-y-4",children:e.map((a,d)=>{let u=a.callback_name?Object.entries(p.callback_map).find(([e,t])=>t===a.callback_name)?.[0]:void 0,m=u?(0,g.resolveLogoSrc)(p.callbackInfo[u]?.logo):null;return(0,t.jsxs)(n.Card,{className:"border border-gray-200 shadow-xs hover:shadow-md transition-shadow duration-200",decoration:"top",decorationColor:"blue",children:[(0,t.jsxs)("div",{className:"flex justify-between items-start mb-4",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[m&&(0,t.jsx)("img",{src:m,alt:u,className:"w-5 h-5 object-contain"}),(0,t.jsxs)("span",{className:"text-sm font-medium",children:[u||"New Integration"," Configuration"]})]}),(0,t.jsx)(i.Button,{variant:"light",onClick:()=>{v(e.filter((e,t)=>t!==d))},icon:c.TrashIcon,size:"xs",color:"red",className:"hover:bg-red-50",type:"button",children:"Remove"})]}),(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Integration Type"}),(0,t.jsx)(s.Select,{value:u,placeholder:"Select integration",onChange:e=>w(d,"callback_name",e),className:"w-full",optionLabelProp:"label",children:_.map(e=>{let s=(0,g.resolveLogoSrc)(p.callbackInfo[e]?.logo),a=p.callbackInfo[e]?.description;return(0,t.jsx)(x,{value:e,label:e,children:(0,t.jsx)(l.Tooltip,{title:a,placement:"right",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[s&&(0,t.jsx)("img",{src:s,alt:e,className:"w-4 h-4 object-contain",onError:t=>{let s=t.target,l=s.parentElement;if(l){let t=document.createElement("div");t.className="w-4 h-4 rounded-full bg-gray-200 flex items-center justify-center text-xs",t.textContent=e.charAt(0),l.replaceChild(t,s)}}}),(0,t.jsx)("span",{children:e})]})})},e)})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("label",{className:"text-sm font-medium text-gray-700",children:"Event Type"}),(0,t.jsxs)(s.Select,{value:a.callback_type,onChange:e=>w(d,"callback_type",e),className:"w-full",children:[(0,t.jsx)(x,{value:"success",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-green-500 rounded-full"}),(0,t.jsx)("span",{children:"Success Only"})]})}),(0,t.jsx)(x,{value:"failure",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-red-500 rounded-full"}),(0,t.jsx)("span",{children:"Failure Only"})]})}),(0,t.jsx)(x,{value:"success_and_failure",children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-blue-500 rounded-full"}),(0,t.jsx)("span",{children:"Success & Failure"})]})})]})]})]}),((e,s)=>{if(!e.callback_name)return null;let a=Object.entries(p.callback_map).find(([t,s])=>s===e.callback_name)?.[0];if(!a)return null;let i=p.callbackInfo[a]?.dynamic_params||{};return 0===Object.keys(i).length?null:(0,t.jsxs)("div",{className:"mt-6 pt-4 border-t border-gray-100",children:[(0,t.jsxs)("div",{className:"flex items-center space-x-2 mb-4",children:[(0,t.jsx)("div",{className:"w-3 h-3 bg-blue-100 rounded-full flex items-center justify-center",children:(0,t.jsx)("div",{className:"w-1.5 h-1.5 bg-blue-500 rounded-full"})}),(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Integration Parameters"})]}),(0,t.jsx)("div",{className:"grid grid-cols-1 gap-4",children:Object.entries(i).map(([a,i])=>(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 capitalize flex items-center space-x-1",children:[(0,t.jsx)("span",{children:a.replace(/_/g," ")}),(0,t.jsx)(l.Tooltip,{title:`Environment variable reference recommended: os.environ/${a.toUpperCase()}`,children:(0,t.jsx)(r.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})}),"password"===i&&(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800",children:"Sensitive"}),"number"===i&&(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800",children:"Number"})]}),"number"===i&&(0,t.jsx)("span",{className:"text-xs text-gray-500",children:"Value must be between 0 and 1"}),"number"===i?(0,t.jsx)(h.default,{step:.01,width:400,placeholder:`os.environ/${a.toUpperCase()}`,value:e.callback_vars[a]||"",onChange:e=>N(s,a,e.target.value)}):(0,t.jsx)(o.TextInput,{type:"password"===i?"password":"text",placeholder:`os.environ/${a.toUpperCase()}`,value:e.callback_vars[a]||"",onChange:e=>N(s,a,e.target.value)})]},a))})]})})(a,d)]})]},d)})}),0===e.length&&(0,t.jsxs)("div",{className:"text-center py-12 text-gray-500 border-2 border-dashed border-gray-200 rounded-lg bg-gray-50/50",children:[(0,t.jsx)(u.CogIcon,{className:"w-12 h-12 text-gray-300 mb-3 mx-auto"}),(0,t.jsx)("div",{className:"text-base font-medium mb-1",children:"No logging integrations configured"}),(0,t.jsx)("div",{className:"text-sm text-gray-400",children:'Click "Add Integration" to configure logging for this team'})]})]})}])},460285,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(404206),a=e.i(723731),r=e.i(653824),i=e.i(881073),n=e.i(197647),o=e.i(602869),d=e.i(158392),c=e.i(419470),u=e.i(695411);let m=(0,s.forwardRef)(({accessToken:e,value:m,onChange:p,modelData:g},h)=>{let[x,y]=(0,s.useState)({routerSettings:{},selectedStrategy:null,enableTagFiltering:!1}),[f,b]=(0,s.useState)([]),[_,j]=(0,s.useState)([]),[v,w]=(0,s.useState)([]),[N,k]=(0,s.useState)([]),[S,C]=(0,s.useState)({}),[T,I]=(0,s.useState)({}),A=(0,s.useRef)(!1),L=(0,s.useRef)(null);(0,s.useEffect)(()=>{let e=m?.router_settings?JSON.stringify({routing_strategy:m.router_settings.routing_strategy,fallbacks:m.router_settings.fallbacks,enable_tag_filtering:m.router_settings.enable_tag_filtering}):null;if(A.current&&e===L.current){A.current=!1;return}if(A.current&&e!==L.current&&(A.current=!1),e!==L.current)if(L.current=e,m?.router_settings){let e=m.router_settings,{fallbacks:t,...s}=e;y({routerSettings:s,selectedStrategy:e.routing_strategy||null,enableTagFiltering:e.enable_tag_filtering??!1});let l=e.fallbacks||[];b(l),j(l&&0!==l.length?l.map((e,t)=>{let[s,l]=Object.entries(e)[0];return{id:(t+1).toString(),primaryModel:s||null,fallbackModels:l||[]}}):[{id:"1",primaryModel:null,fallbackModels:[]}])}else y({routerSettings:{},selectedStrategy:null,enableTagFiltering:!1}),b([]),j([{id:"1",primaryModel:null,fallbackModels:[]}])},[m]),(0,s.useEffect)(()=>{e&&(0,o.getRouterSettingsCall)(e).then(e=>{if(e.fields){let t={};e.fields.forEach(e=>{t[e.field_name]={ui_field_name:e.ui_field_name,field_description:e.field_description,options:e.options,link:e.link}}),C(t);let s=e.fields.find(e=>"routing_strategy"===e.field_name);s?.options&&k(s.options),e.routing_strategy_descriptions&&I(e.routing_strategy_descriptions)}})},[e]),(0,s.useEffect)(()=>{e&&(async()=>{try{let t=await (0,u.fetchAvailableModels)(e);w(t)}catch(e){console.error("Error fetching model info for fallbacks:",e)}})()},[e]);let F=()=>{let e=new Set(["allowed_fails","cooldown_time","num_retries","timeout","retry_after"]),t=new Set(["model_group_alias","retry_policy"]),s=Object.fromEntries(Object.entries({...x.routerSettings,enable_tag_filtering:x.enableTagFiltering,routing_strategy:x.selectedStrategy,fallbacks:f.length>0?f:null}).map(([s,l])=>{if("routing_strategy_args"!==s&&"routing_strategy"!==s&&"enable_tag_filtering"!==s&&"fallbacks"!==s){let a=document.querySelector(`input[name="${s}"]`);if(a){if(void 0!==a.value&&""!==a.value){let r=((s,l,a)=>{if(null==l)return a;let r=String(l).trim();if(""===r||"null"===r.toLowerCase())return null;if(e.has(s)){let e=Number(r);return Number.isNaN(e)?a:e}if(t.has(s)){if(""===r)return null;try{return JSON.parse(r)}catch{return a}}return"true"===r.toLowerCase()||"false"!==r.toLowerCase()&&r})(s,a.value,l);return[s,r]}return[s,null]}}else if("routing_strategy"===s)return[s,x.selectedStrategy];else if("enable_tag_filtering"===s)return[s,x.enableTagFiltering];else if("fallbacks"===s)return[s,f.length>0?f:null];else if("routing_strategy_args"===s&&"latency-based-routing"===x.selectedStrategy){let e=document.querySelector('input[name="lowest_latency_buffer"]'),t=document.querySelector('input[name="ttl"]'),s={};return e?.value&&(s.lowest_latency_buffer=Number(e.value)),t?.value&&(s.ttl=Number(t.value)),["routing_strategy_args",Object.keys(s).length>0?s:null]}return[s,l]}).filter(e=>null!=e)),l=(e,t=!1)=>null==e||"object"==typeof e&&!Array.isArray(e)&&0===Object.keys(e).length||t&&("number"!=typeof e||Number.isNaN(e))?null:e;return{routing_strategy:l(s.routing_strategy),allowed_fails:l(s.allowed_fails,!0),cooldown_time:l(s.cooldown_time,!0),num_retries:l(s.num_retries,!0),timeout:l(s.timeout,!0),retry_after:l(s.retry_after,!0),fallbacks:f.length>0?f:null,context_window_fallbacks:l(s.context_window_fallbacks),retry_policy:l(s.retry_policy),model_group_alias:l(s.model_group_alias),enable_tag_filtering:x.enableTagFiltering,routing_strategy_args:l(s.routing_strategy_args)}};(0,s.useEffect)(()=>{if(!p)return;let e=setTimeout(()=>{A.current=!0,p({router_settings:F()})},100);return()=>clearTimeout(e)},[x,f]);let M=Array.from(new Set(v.map(e=>e.model_group))).sort();return((0,s.useImperativeHandle)(h,()=>({getValue:()=>({router_settings:F()})})),e)?(0,t.jsx)("div",{className:"w-full",children:(0,t.jsxs)(r.TabGroup,{className:"w-full",children:[(0,t.jsxs)(i.TabList,{variant:"line",defaultValue:"1",className:"px-8 pt-4",children:[(0,t.jsx)(n.Tab,{value:"1",children:"Loadbalancing"}),(0,t.jsx)(n.Tab,{value:"2",children:"Fallbacks"})]}),(0,t.jsxs)(a.TabPanels,{className:"px-8 py-6",children:[(0,t.jsx)(l.TabPanel,{children:(0,t.jsx)(d.default,{value:x,onChange:y,routerFieldsMetadata:S,availableRoutingStrategies:N,routingStrategyDescriptions:T})}),(0,t.jsx)(l.TabPanel,{children:(0,t.jsx)(c.FallbackSelectionForm,{groups:_,onGroupsChange:e=>{j(e),b(e.filter(e=>e.primaryModel&&e.fallbackModels.length>0).map(e=>({[e.primaryModel]:e.fallbackModels})))},availableModels:M,maxGroups:5})})]})]})}):null});m.displayName="RouterSettingsAccordion",e.s(["default",0,m])},207082,e=>{"use strict";var t=e.i(619273),s=e.i(266027),l=e.i(243652),a=e.i(602869),r=e.i(431703),i=e.i(135214);let n=(0,l.createQueryKeys)("keys"),o=async(e,t,s,l={})=>{try{let i=(0,a.getProxyBaseUrl)(),n=new URLSearchParams(Object.entries({team_id:l.teamID,project_id:l.projectID,agent_id:l.agentID,organization_id:l.organizationID,key_alias:l.selectedKeyAlias,key_hash:l.keyHash,user_id:l.userID,page:t,size:s,sort_by:l.sortBy,sort_order:l.sortOrder,expand:l.expand,status:l.status,return_full_object:"true",include_team_keys:"true",include_created_by_keys:"true",substring_matching:"true"}).filter(([,e])=>null!=e).map(([e,t])=>[e,String(t)])),o=`${i?`${i}/key/list`:"/key/list"}?${n}`,d=await fetch(o,{method:"GET",headers:{[(0,a.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!d.ok){let e=await d.json(),t=(0,r.deriveErrorMessage)(e);throw(0,a.handleError)(t),Error(t)}return await d.json()}catch(e){throw console.error("Failed to list keys:",e),e}},d=(0,l.createQueryKeys)("deletedKeys");e.s(["keyKeys",0,n,"useDeletedKeys",0,(e,l,a={})=>{let{accessToken:r}=(0,i.default)();return(0,s.useQuery)({queryKey:d.list({page:e,limit:l,...a}),queryFn:async()=>await o(r,e,l,{...a,status:"deleted"}),enabled:!!r,staleTime:3e4,placeholderData:t.keepPreviousData})},"useKeys",0,(e,l,a={})=>{let{accessToken:r}=(0,i.default)();return(0,s.useQuery)({queryKey:n.list({page:e,limit:l,...a}),queryFn:async()=>await o(r,e,l,a),enabled:!!r,staleTime:3e4,placeholderData:t.keepPreviousData})}])},510674,e=>{"use strict";var t=e.i(266027),s=e.i(243652),l=e.i(602869),a=e.i(431703),r=e.i(135214),i=e.i(708347);let n=(0,s.createQueryKeys)("projects"),o=[...i.all_admin_roles,...i.internalUserRoles],d=async e=>{let t=(0,l.getProxyBaseUrl)(),s=`${t}/project/list`,r=await fetch(s,{method:"GET",headers:{[(0,l.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!r.ok){let e=await r.json(),t=(0,a.deriveErrorMessage)(e);throw(0,l.handleError)(t),Error(t)}return r.json()};e.s(["projectKeys",0,n,"useProjects",0,()=>{let{accessToken:e,userRole:s}=(0,r.default)();return(0,t.useQuery)({queryKey:n.list({}),queryFn:async()=>d(e),enabled:!!e&&o.includes(s)})}])},392110,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(199133),a=e.i(592968),r=e.i(312361),i=e.i(790848),n=e.i(536916),o=e.i(827252),d=e.i(779241);let{Option:c}=l.Select;e.s(["default",0,({form:e,autoRotationEnabled:u,onAutoRotationChange:m,rotationInterval:p,onRotationIntervalChange:g,isCreateMode:h=!1,neverExpire:x=!1,onNeverExpireChange:y})=>{let f=p&&!["7d","30d","90d","180d","365d"].includes(p),[b,_]=(0,s.useState)(f),[j,v]=(0,s.useState)(f?p:""),[w,N]=(0,s.useState)(e?.getFieldValue?.("duration")||"");return(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Key Expiry Settings"}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Expire Key"}),(0,t.jsx)(a.Tooltip,{title:"Set when this key should expire. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days). Leave empty to keep the current expiry unchanged.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})}),!h&&y&&(0,t.jsx)(n.Checkbox,{checked:x,onChange:t=>{let s=t.target.checked;y(s),s&&(N(""),e&&"function"==typeof e.setFieldValue?e.setFieldValue("duration",""):e&&"function"==typeof e.setFieldsValue&&e.setFieldsValue({duration:""}))},className:"ml-2 text-sm font-normal text-gray-600",children:"Never Expire"})]}),(0,t.jsx)(d.TextInput,{name:"duration",placeholder:h?"e.g., 30d or leave empty to never expire":"e.g., 30d",className:"w-full",value:w,onValueChange:t=>{N(t),e&&"function"==typeof e.setFieldValue?e.setFieldValue("duration",t):e&&"function"==typeof e.setFieldsValue&&e.setFieldsValue({duration:t})},disabled:!h&&x})]})]}),(0,t.jsx)(r.Divider,{}),(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Auto-Rotation Settings"}),(0,t.jsxs)("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Enable Auto-Rotation"}),(0,t.jsx)(a.Tooltip,{title:"Key will automatically regenerate at the specified interval for enhanced security.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})})]}),(0,t.jsx)(i.Switch,{checked:u,onChange:m,size:"default",className:u?"":"bg-gray-400"})]}),u&&(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("label",{className:"text-sm font-medium text-gray-700 flex items-center space-x-1",children:[(0,t.jsx)("span",{children:"Rotation Interval"}),(0,t.jsx)(a.Tooltip,{title:"How often the key should be automatically rotated. Choose the interval that best fits your security requirements.",children:(0,t.jsx)(o.InfoCircleOutlined,{className:"text-gray-400 cursor-help text-xs"})})]}),(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)(l.Select,{value:b?"custom":p,onChange:e=>{"custom"===e?_(!0):(_(!1),v(""),g(e))},className:"w-full",placeholder:"Select interval",children:[(0,t.jsx)(c,{value:"7d",children:"7 days"}),(0,t.jsx)(c,{value:"30d",children:"30 days"}),(0,t.jsx)(c,{value:"90d",children:"90 days"}),(0,t.jsx)(c,{value:"180d",children:"180 days"}),(0,t.jsx)(c,{value:"365d",children:"365 days"}),(0,t.jsx)(c,{value:"custom",children:"Custom interval"})]}),b&&(0,t.jsxs)("div",{className:"space-y-1",children:[(0,t.jsx)(d.TextInput,{value:j,onChange:e=>{let t=e.target.value;v(t),g(t)},placeholder:"e.g., 1s, 5m, 2h, 14d"}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Supported formats: seconds (s), minutes (m), hours (h), days (d)"})]})]})]})]}),u&&(0,t.jsx)("div",{className:"bg-blue-50 p-3 rounded-md text-sm text-blue-700",children:"When rotation occurs, you'll receive a notification with the new key. The old key will be deactivated after a brief grace period."})]})]})}])},939510,e=>{"use strict";var t=e.i(843476),s=e.i(808613),l=e.i(199133),a=e.i(592968),r=e.i(827252);let{Option:i}=l.Select;e.s(["default",0,({type:e,name:n,showDetailedDescriptions:o=!0,className:d="",initialValue:c=null,form:u,onChange:m})=>{let p=e.toUpperCase(),g=e.toLowerCase(),h=`Select 'guaranteed_throughput' to prevent overallocating ${p} limit when the key belongs to a Team with specific ${p} limits.`;return(0,t.jsx)(s.Form.Item,{label:(0,t.jsxs)("span",{children:[p," Rate Limit Type"," ",(0,t.jsx)(a.Tooltip,{title:h,children:(0,t.jsx)(r.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:n,initialValue:c,className:d,children:(0,t.jsx)(l.Select,{defaultValue:o?"default":void 0,placeholder:"Select rate limit type",style:{width:"100%"},optionLabelProp:o?"label":void 0,onChange:e=>{u&&u.setFieldValue(n,e),m&&m(e)},children:o?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i,{value:"best_effort_throughput",label:"Default",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Default"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["Best effort throughput - no error if we're overallocating ",g," (Team/Key Limits checked at runtime)."]})]})}),(0,t.jsx)(i,{value:"guaranteed_throughput",label:"Guaranteed throughput",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Guaranteed throughput"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["Guaranteed throughput - raise an error if we're overallocating ",g," (also checks model-specific limits)"]})]})}),(0,t.jsx)(i,{value:"dynamic",label:"Dynamic",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)("div",{style:{fontWeight:500},children:"Dynamic"}),(0,t.jsxs)("div",{style:{fontSize:"11px",color:"#6b7280",marginTop:"2px"},children:["If the key has a set ",p," (e.g. 2 ",p,") and there are no 429 errors, it can dynamically exceed the limit when the model being called is not erroring."]})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i,{value:"best_effort_throughput",children:"Best effort throughput"}),(0,t.jsx)(i,{value:"guaranteed_throughput",children:"Guaranteed throughput"}),(0,t.jsx)(i,{value:"dynamic",children:"Dynamic"})]})})})}])},363256,e=>{"use strict";var t=e.i(843476),s=e.i(199133);let{Text:l}=e.i(898586).Typography;e.s(["default",0,({organizations:e,value:a,onChange:r,disabled:i,loading:n,style:o})=>(0,t.jsx)(s.Select,{showSearch:!0,placeholder:"All Organizations",value:a,onChange:r,disabled:i,loading:n,allowClear:!0,style:{minWidth:280,...o},filterOption:(t,s)=>{if(!s)return!1;let l=e?.find(e=>e.organization_id===s.key);if(!l)return!1;let a=t.toLowerCase().trim(),r=(l.organization_alias||"").toLowerCase(),i=(l.organization_id||"").toLowerCase();return r.includes(a)||i.includes(a)},children:e?.map(e=>(0,t.jsxs)(s.Select.Option,{value:e.organization_id,children:[(0,t.jsx)("span",{className:"font-medium",children:e.organization_alias})," ",(0,t.jsxs)(l,{type:"secondary",children:["(",e.organization_id,")"]})]},e.organization_id))})])},128233,319312,e=>{"use strict";var t=e.i(843476),s=e.i(464571),l=e.i(199133),a=e.i(592968),r=e.i(425063),i=e.i(107233),n=e.i(37727),o=e.i(271645);e.s(["BudgetFallbacksEditor",0,function({value:e,onChange:d,availableModels:c}){let[u,m]=(0,o.useState)(()=>{let t;return 0===(t=Object.keys(e)).length?[]:t.map((t,s)=>({id:String(s+1),primaryModel:t,fallbackModels:e[t]}))}),p=e=>{m(e),d(Object.fromEntries(e.filter(e=>null!==e.primaryModel&&e.fallbackModels.length>0).map(e=>[e.primaryModel,e.fallbackModels])))},g=()=>{p([...u,{id:Date.now().toString(),primaryModel:null,fallbackModels:[]}])},h=(e,t)=>{p(u.map(s=>s.id===e?{...s,...t}:s))},x=new Set(u.map(e=>e.primaryModel).filter(Boolean));return 0===u.length?(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"text-xs text-gray-500 mb-2",children:"When a model exceeds its per-model budget, requests automatically reroute to fallback models"}),(0,t.jsx)(s.Button,{size:"small",onClick:g,icon:(0,t.jsx)(i.Plus,{className:"w-3 h-3"}),children:"Add Budget Fallback"})]}):(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"When a model exceeds its per-model budget, requests automatically reroute to fallback models"}),u.map(e=>{let s=c.filter(t=>t===e.primaryModel||!x.has(t)),i=c.filter(t=>t!==e.primaryModel);return(0,t.jsxs)("div",{className:"relative rounded-lg border border-gray-200 bg-gray-50 p-4",children:[(0,t.jsx)("button",{type:"button",onClick:()=>{var t;return t=e.id,void p(u.filter(e=>e.id!==t))},className:"absolute top-2 right-2 text-gray-400 hover:text-red-500 transition-colors p-1",children:(0,t.jsx)(n.X,{className:"w-4 h-4"})}),(0,t.jsxs)("div",{className:"mb-3",children:[(0,t.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Primary Model"}),(0,t.jsx)(l.Select,{className:"w-full",placeholder:"Select model",value:e.primaryModel,onChange:t=>{let s=e.fallbackModels.filter(e=>e!==t);h(e.id,{primaryModel:t,fallbackModels:s})},showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:s.map(e=>({label:e,value:e})),getPopupContainer:e=>e.parentElement||document.body})]}),(0,t.jsx)("div",{className:"flex items-center justify-center -my-1 mb-2",children:(0,t.jsxs)("div",{className:"bg-amber-50 text-amber-600 px-3 py-0.5 rounded-full text-[10px] font-bold border border-amber-100 flex items-center gap-1",children:[(0,t.jsx)(r.ArrowDown,{className:"w-3 h-3"}),"IF BUDGET EXCEEDED, TRY"]})}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs font-medium text-gray-600 mb-1",children:"Fallback Models"}),(0,t.jsx)(l.Select,{mode:"multiple",className:"w-full",placeholder:e.primaryModel?"Select fallback models":"Select a primary model first",value:e.fallbackModels,onChange:t=>h(e.id,{fallbackModels:t}),disabled:!e.primaryModel,showSearch:!0,filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:i.map(e=>({label:e,value:e})),getPopupContainer:e=>e.parentElement||document.body,maxTagCount:"responsive",maxTagPlaceholder:e=>(0,t.jsx)(a.Tooltip,{styles:{root:{pointerEvents:"none"}},title:e.map(({value:e})=>e).join(", "),children:(0,t.jsxs)("span",{children:["+",e.length," more"]})})}),e.fallbackModels.length>1&&(0,t.jsx)("div",{className:"text-[10px] text-gray-400 mt-1 ml-1",children:"Tried in order; first model still within its own budget is used"})]})]},e.id)}),(0,t.jsx)(s.Button,{size:"small",onClick:g,icon:(0,t.jsx)(i.Plus,{className:"w-3 h-3"}),children:"Add Budget Fallback"})]})}],128233);var d=e.i(28651);let c=[{value:"1h",label:"Hourly",resetHint:"Resets every hour"},{value:"24h",label:"Daily",resetHint:"Resets daily at midnight UTC"},{value:"7d",label:"Weekly",resetHint:"Resets every Sunday at midnight UTC"},{value:"30d",label:"Monthly",resetHint:"Resets on the 1st of every month at midnight UTC"}];e.s(["BudgetWindowsEditor",0,function({value:e,onChange:a}){let r=(t,s,l)=>{a(e.map((e,a)=>a===t?{...e,[s]:l}:e))};return(0,t.jsxs)("div",{children:[e.map((i,n)=>{let o=c.find(e=>e.value===i.budget_duration)?.resetHint;return(0,t.jsxs)("div",{style:{marginBottom:12},children:[(0,t.jsxs)("div",{style:{display:"flex",gap:8,alignItems:"center"},children:[(0,t.jsx)(l.Select,{value:i.budget_duration,onChange:e=>r(n,"budget_duration",e),style:{width:130},options:c.map(e=>({value:e.value,label:e.label}))}),(0,t.jsx)(d.InputNumber,{step:.01,min:0,precision:2,value:i.max_budget??void 0,onChange:e=>r(n,"max_budget",e??null),placeholder:"Max spend ($)",style:{width:160},prefix:"$"}),(0,t.jsx)(s.Button,{type:"text",danger:!0,size:"small",onClick:()=>{a(e.filter((e,t)=>t!==n))},style:{padding:"0 4px"},children:"✕"})]}),o&&(0,t.jsxs)("div",{style:{fontSize:11,color:"#888",marginTop:3,marginLeft:2},children:["↻ ",o]})]},n)}),(0,t.jsx)(s.Button,{size:"small",onClick:t=>{t.preventDefault(),a([...e,{budget_duration:"24h",max_budget:null}])},children:"+ Add Budget Window"})]})}],319312)},109034,e=>{"use strict";var t=e.i(266027),s=e.i(243652),l=e.i(602869),a=e.i(135214);let r=(0,s.createQueryKeys)("tags");e.s(["useTags",0,()=>{let{accessToken:e,userId:s,userRole:i}=(0,a.default)();return(0,t.useQuery)({queryKey:r.list({}),queryFn:async()=>await (0,l.tagListCall)(e),enabled:!!(e&&s&&i)})}])},533882,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(250980),a=e.i(797672),r=e.i(68155),i=e.i(304967),n=e.i(629569),o=e.i(599724),d=e.i(269200),c=e.i(427612),u=e.i(64848),m=e.i(942232),p=e.i(496020),g=e.i(977572),h=e.i(992619),x=e.i(727749);e.s(["default",0,({accessToken:e,initialModelAliases:y={},onAliasUpdate:f,showExampleConfig:b=!0})=>{let[_,j]=(0,s.useState)([]),[v,w]=(0,s.useState)({aliasName:"",targetModel:""}),[N,k]=(0,s.useState)(null);(0,s.useEffect)(()=>{j(Object.entries(y).map(([e,t],s)=>({id:`${s}-${e}`,aliasName:e,targetModel:t})))},[y]);let S=()=>{if(!N)return;if(!N.aliasName||!N.targetModel)return void x.default.fromBackend("Please provide both alias name and target model");if(_.some(e=>e.id!==N.id&&e.aliasName===N.aliasName))return void x.default.fromBackend("An alias with this name already exists");let e=_.map(e=>e.id===N.id?N:e);j(e),k(null);let t={};e.forEach(e=>{t[e.aliasName]=e.targetModel}),f&&f(t),x.default.success("Alias updated successfully")},C=()=>{k(null)},T=_.reduce((e,t)=>(e[t.aliasName]=t.targetModel,e),{});return(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsxs)("div",{className:"mb-6",children:[(0,t.jsx)(o.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Add New Alias"}),(0,t.jsxs)("div",{className:"grid grid-cols-3 gap-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Alias Name"}),(0,t.jsx)("input",{type:"text",value:v.aliasName,onChange:e=>w({...v,aliasName:e.target.value}),placeholder:"e.g., gpt-4o",className:"w-full px-3 py-2 border border-gray-300 rounded-md text-sm"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Target Model"}),(0,t.jsx)(h.default,{accessToken:e,value:v.targetModel,placeholder:"Select target model",onChange:e=>w({...v,targetModel:e}),showLabel:!1})]}),(0,t.jsx)("div",{className:"flex items-end",children:(0,t.jsxs)("button",{onClick:()=>{if(!v.aliasName||!v.targetModel)return void x.default.fromBackend("Please provide both alias name and target model");if(_.some(e=>e.aliasName===v.aliasName))return void x.default.fromBackend("An alias with this name already exists");let e=[..._,{id:`${Date.now()}-${v.aliasName}`,aliasName:v.aliasName,targetModel:v.targetModel}];j(e),w({aliasName:"",targetModel:""});let t={};e.forEach(e=>{t[e.aliasName]=e.targetModel}),f&&f(t),x.default.success("Alias added successfully")},disabled:!v.aliasName||!v.targetModel,className:`flex items-center px-4 py-2 rounded-md text-sm ${!v.aliasName||!v.targetModel?"bg-gray-300 text-gray-500 cursor-not-allowed":"bg-green-600 text-white hover:bg-green-700"}`,children:[(0,t.jsx)(l.PlusCircleIcon,{className:"w-4 h-4 mr-1"}),"Add Alias"]})})]})]}),(0,t.jsx)(o.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Manage Existing Aliases"}),(0,t.jsx)("div",{className:"rounded-lg custom-border relative mb-6",children:(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(d.Table,{className:"[&_td]:py-0.5 [&_th]:py-1",children:[(0,t.jsx)(c.TableHead,{children:(0,t.jsxs)(p.TableRow,{children:[(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Alias Name"}),(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Target Model"}),(0,t.jsx)(u.TableHeaderCell,{className:"py-1 h-8",children:"Actions"})]})}),(0,t.jsxs)(m.TableBody,{children:[_.map(s=>(0,t.jsx)(p.TableRow,{className:"h-8",children:N&&N.id===s.id?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(g.TableCell,{className:"py-0.5",children:(0,t.jsx)("input",{type:"text",value:N.aliasName,onChange:e=>k({...N,aliasName:e.target.value}),className:"w-full px-2 py-1 border border-gray-300 rounded-md text-sm"})}),(0,t.jsx)(g.TableCell,{className:"py-0.5",children:(0,t.jsx)(h.default,{accessToken:e,value:N.targetModel,onChange:e=>k({...N,targetModel:e}),showLabel:!1,style:{height:"32px"}})}),(0,t.jsx)(g.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:S,className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:"Save"}),(0,t.jsx)("button",{onClick:C,className:"text-xs bg-gray-50 text-gray-600 px-2 py-1 rounded-sm hover:bg-gray-100",children:"Cancel"})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(g.TableCell,{className:"py-0.5 text-sm text-gray-900",children:s.aliasName}),(0,t.jsx)(g.TableCell,{className:"py-0.5 text-sm text-gray-500",children:s.targetModel}),(0,t.jsx)(g.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:()=>{k({...s})},className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:(0,t.jsx)(a.PencilIcon,{className:"w-3 h-3"})}),(0,t.jsx)("button",{onClick:()=>{var e;let t,l;return e=s.id,j(t=_.filter(t=>t.id!==e)),l={},void(t.forEach(e=>{l[e.aliasName]=e.targetModel}),f&&f(l),x.default.success("Alias deleted successfully"))},className:"text-xs bg-red-50 text-red-600 px-2 py-1 rounded-sm hover:bg-red-100",children:(0,t.jsx)(r.TrashIcon,{className:"w-3 h-3"})})]})})]})},s.id)),0===_.length&&(0,t.jsx)(p.TableRow,{children:(0,t.jsx)(g.TableCell,{colSpan:3,className:"py-0.5 text-sm text-gray-500 text-center",children:"No aliases added yet. Add a new alias above."})})]})]})})}),b&&(0,t.jsxs)(i.Card,{children:[(0,t.jsx)(n.Title,{className:"mb-4",children:"Configuration Example"}),(0,t.jsx)(o.Text,{className:"text-gray-600 mb-4",children:"Here's how your current aliases would look in the config:"}),(0,t.jsx)("div",{className:"bg-gray-100 rounded-lg p-4 font-mono text-sm",children:(0,t.jsxs)("div",{className:"text-gray-700",children:["model_aliases:",0===Object.keys(T).length?(0,t.jsxs)("span",{className:"text-gray-500",children:[(0,t.jsx)("br",{}),"  # No aliases configured yet"]}):Object.entries(T).map(([e,s])=>(0,t.jsxs)("span",{children:[(0,t.jsx)("br",{}),'  "',e,'": "',s,'"']},e))]})})]})]})}])},651904,e=>{"use strict";var t=e.i(843476),s=e.i(599724),l=e.i(266484);e.s(["default",0,function({value:e,onChange:a,premiumUser:r=!1,disabledCallbacks:i=[],onDisabledCallbacksChange:n}){return r?(0,t.jsx)(l.default,{value:e,onChange:a,disabledCallbacks:i,onDisabledCallbacksChange:n}):(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{className:"flex flex-wrap gap-2 mb-3",children:[(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50",children:"✨ langfuse-logging"}),(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50",children:"✨ datadog-logging"})]}),(0,t.jsx)("div",{className:"p-3 bg-yellow-50 border border-yellow-200 rounded-lg",children:(0,t.jsxs)(s.Text,{className:"text-sm text-yellow-800",children:["Setting Key/Team logging settings is a LiteLLM Enterprise feature. Global Logging Settings are available for all free users. Get a trial key"," ",(0,t.jsx)("a",{href:"https://www.litellm.ai/#pricing",target:"_blank",rel:"noopener noreferrer",className:"underline",children:"here"}),"."]})})]})}])},575260,e=>{"use strict";var t=e.i(843476),s=e.i(199133),l=e.i(482725),a=e.i(56456);e.s(["default",0,({projects:e,value:r,onChange:i,disabled:n,loading:o,teamId:d})=>{let c=d?e?.filter(e=>e.team_id===d):e;return(0,t.jsx)(s.Select,{showSearch:!0,placeholder:"Search or select a project",value:r,onChange:i,disabled:n,loading:o,allowClear:!0,notFoundContent:o?(0,t.jsx)(l.Spin,{indicator:(0,t.jsx)(a.LoadingOutlined,{spin:!0}),size:"small"}):void 0,filterOption:(e,t)=>{if(!t)return!1;let s=c?.find(e=>e.project_id===t.key);if(!s)return!1;let l=e.toLowerCase().trim(),a=(s.project_alias||"").toLowerCase(),r=(s.project_id||"").toLowerCase();return a.includes(l)||r.includes(l)},optionFilterProp:"children",children:!o&&c?.map(e=>(0,t.jsxs)(s.Select.Option,{value:e.project_id,children:[(0,t.jsx)("span",{className:"font-medium",children:e.project_alias||e.project_id})," ",(0,t.jsxs)("span",{className:"text-gray-500",children:["(",e.project_id,")"]})]},e.project_id))})}])},364769,e=>{"use strict";var t=e.i(843476),s=e.i(271645),l=e.i(237016),a=e.i(464571),r=e.i(888259);e.s(["default",0,({apiKey:e})=>{let[i,n]=(0,s.useState)(!1);return(0,t.jsxs)("div",{children:[(0,t.jsxs)("p",{className:"mb-2",children:["Please save this secret key somewhere safe and accessible. For security reasons,"," ",(0,t.jsx)("b",{children:"you will not be able to view it again"})," through your LiteLLM account. If you lose this secret key, you will need to generate a new one."]}),(0,t.jsx)("p",{className:"text-sm text-gray-600 mt-3 mb-1",children:"Virtual Key:"}),(0,t.jsx)("div",{style:{background:"#f8f8f8",padding:"10px",borderRadius:"5px",marginBottom:"10px"},children:(0,t.jsx)("pre",{style:{wordWrap:"break-word",whiteSpace:"normal",margin:0},children:e})}),(0,t.jsx)(l.CopyToClipboard,{text:e,onCopy:()=>{n(!0),r.default.success("Key copied to clipboard"),setTimeout(()=>n(!1),2e3)},children:(0,t.jsx)(a.Button,{type:"primary",style:{marginTop:12},children:i?"Copied!":"Copy Virtual Key"})})]})}])},702597,e=>{"use strict";var t=e.i(843476),s=e.i(207082),l=e.i(109799),a=e.i(510674),r=e.i(109034),i=e.i(292639),n=e.i(135214),o=e.i(500330),d=e.i(827252),c=e.i(912598),u=e.i(677667),m=e.i(130643),p=e.i(898667),g=e.i(994388),h=e.i(309426),x=e.i(350967),y=e.i(599724),f=e.i(779241),b=e.i(629569),_=e.i(464571),j=e.i(808613),v=e.i(311451),w=e.i(212931),N=e.i(91739),k=e.i(199133),S=e.i(790848),C=e.i(262218),T=e.i(592968),I=e.i(898586),A=e.i(374009),L=e.i(271645),F=e.i(708347),M=e.i(552130),O=e.i(557662),E=e.i(9314),P=e.i(860585),B=e.i(82946),$=e.i(392110),R=e.i(533882),D=e.i(844565),V=e.i(651904),z=e.i(939510),U=e.i(460285),G=e.i(663435),K=e.i(363256),q=e.i(575260),W=e.i(371455),H=e.i(128233),Q=e.i(319312),J=e.i(355619),Y=e.i(75921),X=e.i(234713),Z=e.i(390605),ee=e.i(727749),et=e.i(602869),es=e.i(364769),el=e.i(435451),ea=e.i(916940);let{Option:er}=k.Select,ei=async(e,t,s,l)=>{try{if(null===e||null===t)return[];if(null!==s)return(await (0,et.modelAvailableCall)(s,e,t,!0,l,!0)).data.map(e=>e.id);return[]}catch(e){return console.error("Error fetching user models:",e),[]}},en=async(e,t,s,l)=>{try{if(null===e||null===t)return;if(null!==s){let a=(await (0,et.modelAvailableCall)(s,e,t)).data.map(e=>e.id);l(a)}}catch(e){console.error("Error fetching user models:",e)}};e.s(["default",0,({team:e,teams:eo,data:ed,addKey:ec,autoOpenCreate:eu,prefillData:em})=>{let{accessToken:ep,userId:eg,userRole:eh,premiumUser:ex}=(0,n.default)(),ey=ex||null!=eh&&F.rolesWithWriteAccess.includes(eh),{data:ef,isLoading:eb}=(0,l.useOrganizations)(),{data:e_,isLoading:ej}=(0,a.useProjects)(),{data:ev}=(0,i.useUISettings)(),{data:ew}=(0,r.useTags)(),eN=!!ev?.values?.enable_projects_ui,ek=!!ev?.values?.disable_custom_api_keys,eS=ew?Object.values(ew).map(e=>({value:e.name,label:e.name})):[],eC=(0,c.useQueryClient)(),[eT]=j.Form.useForm(),[eI,eA]=(0,L.useState)(!1),[eL,eF]=(0,L.useState)(null),[eM,eO]=(0,L.useState)(null),[eE,eP]=(0,L.useState)([]),[eB,e$]=(0,L.useState)([]),[eR,eD]=(0,L.useState)("you"),[eV,ez]=(0,L.useState)(!1),[eU,eG]=(0,L.useState)(null),[eK,eq]=(0,L.useState)([]),[eW,eH]=(0,L.useState)([]),[eQ,eJ]=(0,L.useState)([]),[eY,eX]=(0,L.useState)([]),[eZ,e0]=(0,L.useState)(e),[e1,e2]=(0,L.useState)(null),[e4,e3]=(0,L.useState)(null),[e5,e6]=(0,L.useState)(!1),[e7,e9]=(0,L.useState)(null),[e8,te]=(0,L.useState)({}),[tt,ts]=(0,L.useState)([]),[tl,ta]=(0,L.useState)(!1),[tr,ti]=(0,L.useState)([]),[tn,to]=(0,L.useState)([]),[td,tc]=(0,L.useState)("llm_api"),[tu,tm]=(0,L.useState)({}),[tp,tg]=(0,L.useState)(!1),[th,tx]=(0,L.useState)("30d"),[ty,tf]=(0,L.useState)(null),[tb,t_]=(0,L.useState)([]),[tj,tv]=(0,L.useState)({}),[tw,tN]=(0,L.useState)(0),[tk,tS]=(0,L.useState)(0),[tC,tT]=(0,L.useState)([]),[tI,tA]=(0,L.useState)(null),tL=()=>{eA(!1),eT.resetFields(),eX([]),to([]),tc("llm_api"),tm({}),tg(!1),tx("30d"),tf(null),tS(e=>e+1),tA(null),e2(null),e3(null),t_([]),tv({}),tN(e=>e+1)},tF=()=>{eA(!1),eF(null),e0(null),eT.resetFields(),eX([]),to([]),tc("llm_api"),tm({}),tg(!1),tx("30d"),tf(null),tS(e=>e+1),tA(null),e2(null),e3(null),t_([]),tv({}),tN(e=>e+1)};(0,L.useEffect)(()=>{eg&&eh&&ep&&en(eg,eh,ep,eP)},[ep,eg,eh]),(0,L.useEffect)(()=>{ep&&(0,et.getAgentsList)(ep).then(e=>tT(e?.agents||[])).catch(()=>tT([]))},[ep]),(0,L.useEffect)(()=>{let e=async()=>{try{let e=(await (0,et.getPoliciesList)(ep)).policies.map(e=>e.policy_name);eH(e)}catch(e){console.error("Failed to fetch policies:",e)}},t=async()=>{try{let e=await (0,et.getPromptsList)(ep);eJ(e.prompts.map(e=>e.prompt_id))}catch(e){console.error("Failed to fetch prompts:",e)}};(async()=>{try{let e=(await (0,et.getGuardrailsList)(ep)).guardrails.map(e=>e.guardrail_name);eq(e)}catch(e){console.error("Failed to fetch guardrails:",e)}})(),e(),t()},[ep]),(0,L.useEffect)(()=>{(async()=>{try{if(ep){let e=sessionStorage.getItem("possibleUserRoles");if(e)te(JSON.parse(e));else{let e=await (0,et.getPossibleUserRoles)(ep);sessionStorage.setItem("possibleUserRoles",JSON.stringify(e)),te(e)}}}catch(e){console.error("Error fetching possible user roles:",e)}})()},[ep]),(0,L.useEffect)(()=>{if(eu&&!eV&&eo&&eh&&F.rolesWithWriteAccess.includes(eh)&&(eA(!0),ez(!0),em)){if(em.owned_by&&("another_user"===em.owned_by&&"Admin"!==eh?eD("you"):eD(em.owned_by)),em.team_id){let e=eo?.find(e=>e.team_id===em.team_id)||null;e&&(e0(e),eT.setFieldsValue({team_id:em.team_id}))}em.key_alias&&eT.setFieldsValue({key_alias:em.key_alias}),em.models&&em.models.length>0&&eG(em.models),em.key_type&&(tc(em.key_type),eT.setFieldsValue({key_type:em.key_type}))}},[eu,em,eo,eV,eT,eh]);let tM=eB.includes("no-default-models")&&!eZ,tO=async e=>{try{let t,l=e?.key_alias??"",a=e?.team_id??null;if((ed?.filter(e=>e.team_id===a).map(e=>e.key_alias)??[]).includes(l))throw Error(`Key alias ${l} already exists for team with ID ${a}, please provide another key alias`);if(ee.default.info("Making API Call"),eA(!0),"you"===eR)e.user_id=eg;else if("agent"===eR){if(!tI)return void ee.default.fromBackend("Please select an agent");e.agent_id=tI}let r={};try{r=JSON.parse(e.metadata||"{}")}catch(e){console.error("Error parsing metadata:",e)}if("service_account"===eR&&(r.service_account_id=e.key_alias),eY.length>0&&(r={...r,logging:eY.filter(e=>e.callback_name)}),tn.length>0){let e=(0,O.mapDisplayToInternalNames)(tn);r={...r,litellm_disabled_callbacks:e}}if(tp&&(e.auto_rotate=!0,e.rotation_interval=th),e.duration&&""!==e.duration.trim()||(e.duration=null),e.metadata=JSON.stringify(r),e.disable_global_guardrails||delete e.disable_global_guardrails,e.allowed_vector_store_ids&&e.allowed_vector_store_ids.length>0&&(e.object_permission={vector_stores:e.allowed_vector_store_ids},delete e.allowed_vector_store_ids),e.allowed_mcp_servers_and_groups&&(e.allowed_mcp_servers_and_groups.servers?.length>0||e.allowed_mcp_servers_and_groups.accessGroups?.length>0)){e.object_permission||(e.object_permission={});let{servers:t,accessGroups:s}=e.allowed_mcp_servers_and_groups;t&&t.length>0&&(e.object_permission.mcp_servers=t),s&&s.length>0&&(e.object_permission.mcp_access_groups=s),delete e.allowed_mcp_servers_and_groups}let i=e.mcp_tool_permissions||{};if(Object.keys(i).length>0&&(e.object_permission||(e.object_permission={}),e.object_permission.mcp_tool_permissions=i),delete e.mcp_tool_permissions,e.allowed_mcp_access_groups&&e.allowed_mcp_access_groups.length>0&&(e.object_permission||(e.object_permission={}),e.object_permission.mcp_access_groups=e.allowed_mcp_access_groups,delete e.allowed_mcp_access_groups),e.allowed_agents_and_groups&&(e.allowed_agents_and_groups.agents?.length>0||e.allowed_agents_and_groups.accessGroups?.length>0)){e.object_permission||(e.object_permission={});let{agents:t,accessGroups:s}=e.allowed_agents_and_groups;t&&t.length>0&&(e.object_permission.agents=t),s&&s.length>0&&(e.object_permission.agent_access_groups=s),delete e.allowed_agents_and_groups}Object.keys(tu).length>0&&(e.aliases=JSON.stringify(tu)),ty?.router_settings&&Object.values(ty.router_settings).some(e=>null!=e&&""!==e)&&(e.router_settings=ty.router_settings);let n=tb.filter(e=>e.budget_duration&&null!==e.max_budget&&void 0!==e.max_budget);n.length>0&&(e.budget_limits=n),Object.keys(tj).length>0&&(e.budget_fallbacks=tj),t="service_account"===eR?await (0,et.keyCreateServiceAccountCall)(ep,e):await (0,et.keyCreateCall)(ep,eg,e),ec(t),eC.invalidateQueries({queryKey:s.keyKeys.lists()}),eF(t.key),eO(t.soft_budget),ee.default.success("Virtual Key Created"),eT.resetFields(),t_([]),tv({}),tN(e=>e+1),localStorage.removeItem("userData"+eg)}catch(t){let e=(e=>{let t;if(!(t=!e||"object"!=typeof e||e instanceof Error?String(e):JSON.stringify(e)).includes("/key/generate")&&!t.includes("KeyManagementRoutes.KEY_GENERATE"))return`Error creating the key: ${e}`;let s=t;try{if(!e||"object"!=typeof e||e instanceof Error){let e=t.match(/\{[\s\S]*\}/);if(e){let t=JSON.parse(e[0]),l=t?.error||t;l?.message&&(s=l.message)}}else{let t=e?.error||e;t?.message&&(s=t.message)}}catch(e){}return t.includes("team_member_permission_error")||s.includes("Team member does not have permissions")?"Team member does not have permission to generate key for this team. Ask your proxy admin to configure the team member permission settings.":`Error creating the key: ${e}`})(t);ee.default.fromBackend(e)}};(0,L.useEffect)(()=>{if(e4){let e=e_?.find(e=>e.project_id===e4);e$(e?.models??[]),eT.setFieldValue("models",[]);return}eg&&eh&&ep&&ei(eg,eh,ep,eZ?.team_id??null).then(e=>{e$(Array.from(new Set([...eZ?.models??[],...e])))}),eU||eT.setFieldValue("models",[]),eT.setFieldValue("allowed_mcp_servers_and_groups",{servers:[],accessGroups:[]})},[eZ,e4,ep,eg,eh,eT]),(0,L.useEffect)(()=>{if(!eU||0===eU.length||!eB||0===eB.length)return;let e=eU.filter(e=>eB.includes(e));e.length>0&&eT.setFieldsValue({models:e}),eG(null)},[eU,eB,eT]),(0,L.useEffect)(()=>{if(!e4||!eo)return;let e=e_?.find(e=>e.project_id===e4);if(!e?.team_id||eZ?.team_id===e.team_id)return;let t=eo.find(t=>t.team_id===e.team_id)||null;t&&(e0(t),eT.setFieldValue("team_id",t.team_id))},[eo,e4,e_]);let tE=async e=>{if(!e)return void ts([]);ta(!0);try{let t=new URLSearchParams;if(t.append("user_email",e),null==ep)return;let s=(await (0,et.userFilterUICall)(ep,t)).map(e=>({label:`${e.user_email} (${e.user_id})`,value:e.user_id,user:e}));ts(s)}catch(e){console.error("Error fetching users:",e),ee.default.fromBackend("Failed to search for users")}finally{ta(!1)}},tP=(0,L.useCallback)((0,A.default)(e=>tE(e),300),[ep]);return(0,t.jsxs)("div",{children:[eh&&F.rolesWithWriteAccess.includes(eh)&&(0,t.jsx)(g.Button,{className:"mx-auto",onClick:()=>eA(!0),"data-testid":"create-key-button",children:"+ Create New Key"}),(0,t.jsx)(w.Modal,{open:eI,width:1e3,footer:null,onOk:tL,onCancel:tF,children:(0,t.jsxs)(j.Form,{form:eT,onFinish:tO,labelCol:{span:8},wrapperCol:{span:16},labelAlign:"left",children:[(0,t.jsxs)("div",{className:"mb-8",children:[(0,t.jsx)(b.Title,{className:"mb-4",children:"Key Ownership"}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Owned By"," ",(0,t.jsx)(T.Tooltip,{title:"Select who will own this Virtual Key",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),className:"mb-4",children:(0,t.jsxs)(N.Radio.Group,{onChange:e=>eD(e.target.value),value:eR,children:[(0,t.jsx)(N.Radio,{value:"you",children:"You"}),(0,t.jsx)(N.Radio,{value:"service_account",children:"Service Account"}),"Admin"===eh&&(0,t.jsx)(N.Radio,{value:"another_user",children:"Another User"}),(0,t.jsxs)(N.Radio,{value:"agent",children:["Agent ",(0,t.jsx)(C.Tag,{color:"purple",children:"New"})]})]})}),"another_user"===eR&&(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["User ID"," ",(0,t.jsx)(T.Tooltip,{title:"The user who will own this key and be responsible for its usage",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"user_id",className:"mt-4",rules:[{required:"another_user"===eR,message:"Please input the user ID of the user you are assigning the key to"}],children:(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{style:{display:"flex",marginBottom:"8px"},children:[(0,t.jsx)(k.Select,{showSearch:!0,placeholder:"Type email to search for users",filterOption:!1,onSearch:e=>{tP(e)},onSelect:(e,t)=>{let s;return s=t.user,void eT.setFieldsValue({user_id:s.user_id})},options:tt,loading:tl,allowClear:!0,style:{width:"100%"},notFoundContent:tl?"Searching...":"No users found"}),(0,t.jsx)(_.Button,{onClick:()=>e6(!0),style:{marginLeft:"8px"},children:"Create User"})]}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"Search by email to find users"})]})}),"agent"===eR&&(0,t.jsxs)("div",{className:"mt-4 p-4 bg-purple-50 border border-purple-200 rounded-md",children:[(0,t.jsx)("div",{className:"mb-3",children:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700",children:["Select Agent ",(0,t.jsx)("span",{className:"text-red-500",children:"*"})]})}),(0,t.jsx)(k.Select,{showSearch:!0,placeholder:"Select an agent",style:{width:"100%"},value:tI,onChange:e=>tA(e),filterOption:(e,t)=>t?.label?.toLowerCase().includes(e.toLowerCase()),options:tC.map(e=>({label:e.agent_name||e.agent_id,value:e.agent_id}))}),(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-2",children:"This key will be used by the selected agent to make requests to LiteLLM"})]}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Organization"," ",(0,t.jsx)(T.Tooltip,{title:"The organization this key belongs to. Selecting an organization filters the available teams.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"organization_id",className:"mt-4",children:(0,t.jsx)(K.default,{organizations:ef,loading:eb,disabled:"Admin"!==eh,onChange:e=>{e2(e||null),e0(null),e3(null),eT.setFieldValue("team_id",void 0),eT.setFieldValue("project_id",void 0)}})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Team"," ",(0,t.jsx)(T.Tooltip,{title:"The team this key belongs to, which determines available models and budget limits",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"team_id",initialValue:e?e.team_id:null,className:"mt-4",rules:[{required:"service_account"===eR,message:"Please select a team for the service account"}],help:"service_account"===eR?"required":"",children:(0,t.jsx)(G.default,{disabled:null!==e4,organizationId:e1,onTeamSelect:e=>{e0(e),e3(null),eT.setFieldValue("project_id",void 0),e?.organization_id?(e2(e.organization_id),eT.setFieldValue("organization_id",e.organization_id)):e||(e2(null),eT.setFieldValue("organization_id",void 0))}})}),eN&&(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Project"," ",(0,t.jsx)(T.Tooltip,{title:"Assign this key to a project. Selecting a project will lock the team to the project's team.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"project_id",className:"mt-4",children:(0,t.jsx)(q.default,{projects:e_,teamId:eZ?.team_id,loading:ej||!eo,onChange:e=>{if(!e){e3(null),e0(null),eT.setFieldValue("team_id",void 0);return}e3(e)}})})]}),tM&&(0,t.jsx)("div",{className:"mb-8 p-4 bg-blue-50 border border-blue-200 rounded-md",children:(0,t.jsx)(y.Text,{className:"text-blue-800 text-sm",children:"Please select a team to continue configuring your Virtual Key. If you do not see any teams, please contact your Proxy Admin to either provide you with access to models or to add you to a team."})}),!tM&&(0,t.jsxs)("div",{className:"mb-8",children:[(0,t.jsx)(b.Title,{className:"mb-4",children:"Key Details"}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["you"===eR||"another_user"===eR?"Key Name":"Service Account ID"," ",(0,t.jsx)(T.Tooltip,{title:"you"===eR||"another_user"===eR?"A descriptive name to identify this key":"Unique identifier for this service account",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"key_alias",rules:[{required:!0,message:`Please input a ${"you"===eR?"key name":"service account ID"}`}],help:"required",children:(0,t.jsx)(f.TextInput,{placeholder:""})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Models"," ",(0,t.jsx)(T.Tooltip,{title:"Select which models this key can access. Choose 'All Team Models' to grant access to all models available to the team. Leave empty to allow access to all models.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"models",rules:[],help:"management"===td||"read_only"===td?"Models field is disabled for this key type":"optional - leave empty to allow access to all models",className:"mt-4",children:(0,t.jsxs)(k.Select,{mode:"multiple",placeholder:"Select models",style:{width:"100%"},disabled:"management"===td||"read_only"===td,onChange:e=>{e.includes("all-team-models")&&eT.setFieldsValue({models:["all-team-models"]})},children:[!e4&&(0,t.jsx)(er,{value:"all-team-models",children:"All Team Models"},"all-team-models"),eB.map(e=>(0,t.jsx)(er,{value:e,children:(0,J.getModelDisplayName)(e)},e))]})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Key Type"," ",(0,t.jsx)(T.Tooltip,{title:"Select the type of key to determine what routes and operations this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"key_type",initialValue:"llm_api",className:"mt-4",children:(0,t.jsxs)(k.Select,{defaultValue:"llm_api",placeholder:"Select key type",style:{width:"100%"},optionLabelProp:"label",onChange:e=>{tc(e),("management"===e||"read_only"===e)&&eT.setFieldsValue({models:[]})},children:[(0,t.jsx)(er,{value:"llm_api",label:"AI APIs",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"AI APIs"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call only AI API routes (chat/completions, embeddings, etc.)"})]})}),(0,t.jsx)(er,{value:"management",label:"Management",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"Management"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call only management routes (user/team/key management)"})]})}),(0,t.jsx)(er,{value:"default",label:"Full Access",children:(0,t.jsxs)("div",{style:{padding:"4px 0"},children:[(0,t.jsx)(I.Typography.Text,{strong:!0,children:"Full Access"}),(0,t.jsx)(I.Typography.Paragraph,{type:"secondary",style:{fontSize:11,margin:"2px 0 0"},children:"Can call all routes (AI APIs, Management, and read-only)"})]})})]})})]}),!tM&&(0,t.jsx)("div",{className:"mb-8",children:(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)(b.Title,{className:"m-0",children:"Optional Settings"})}),(0,t.jsxs)(m.AccordionBody,{children:[(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Max Budget (USD)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum amount in USD this key can spend. When reached, the key will be blocked from making further requests",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"max_budget",help:`Budget cannot exceed team max budget: $${e?.max_budget!==null&&e?.max_budget!==void 0?e?.max_budget:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.max_budget&&s>e.max_budget)throw Error(`Budget cannot exceed team max budget: $${(0,o.formatNumberWithCommas)(e.max_budget,4)}`)}}],children:(0,t.jsx)(el.default,{step:.01,precision:2,width:200})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Reset Budget"," ",(0,t.jsx)(T.Tooltip,{title:"How often the budget should reset. For example, setting 'daily' will reset the budget every 24 hours",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"budget_duration",help:`Team Reset Budget: ${e?.budget_duration!==null&&e?.budget_duration!==void 0?e?.budget_duration:"None"}`,children:(0,t.jsx)(P.default,{onChange:e=>eT.setFieldValue("budget_duration",e)})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Budget Windows"," ",(0,t.jsx)(T.Tooltip,{title:"Set multiple independent budget windows (e.g., hourly $10 AND monthly $200). Each window tracks spend separately and resets on its own schedule.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)(Q.BudgetWindowsEditor,{value:tb,onChange:t_})}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Budget Fallbacks"," ",(0,t.jsx)(T.Tooltip,{title:"When a model exceeds its per-model budget (model_max_budget), requests automatically reroute to fallback models instead of failing. Configure per-model budgets in Advanced Settings.",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),children:(0,t.jsx)(H.BudgetFallbacksEditor,{value:tj,onChange:tv,availableModels:eB},tw)}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Tokens per minute Limit (TPM)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum number of tokens this key can process per minute. Helps control usage and costs",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"tpm_limit",help:`TPM cannot exceed team TPM limit: ${e?.tpm_limit!==null&&e?.tpm_limit!==void 0?e?.tpm_limit:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.tpm_limit&&s>e.tpm_limit)throw Error(`TPM limit cannot exceed team TPM limit: ${e.tpm_limit}`)}}],children:(0,t.jsx)(el.default,{step:1,width:400})}),(0,t.jsx)(z.default,{type:"tpm",name:"tpm_limit_type",className:"mt-4",initialValue:null,form:eT,showDetailedDescriptions:!0}),(0,t.jsx)(j.Form.Item,{className:"mt-4",label:(0,t.jsxs)("span",{children:["Requests per minute Limit (RPM)"," ",(0,t.jsx)(T.Tooltip,{title:"Maximum number of API requests this key can make per minute. Helps prevent abuse and manage load",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"rpm_limit",help:`RPM cannot exceed team RPM limit: ${e?.rpm_limit!==null&&e?.rpm_limit!==void 0?e?.rpm_limit:"unlimited"}`,rules:[{validator:async(t,s)=>{if(s&&e&&null!==e.rpm_limit&&s>e.rpm_limit)throw Error(`RPM limit cannot exceed team RPM limit: ${e.rpm_limit}`)}}],children:(0,t.jsx)(el.default,{step:1,width:400})}),(0,t.jsx)(z.default,{type:"rpm",name:"rpm_limit_type",className:"mt-4",initialValue:null,form:eT,showDetailedDescriptions:!0}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Guardrails"," ",(0,t.jsx)(T.Tooltip,{title:"Apply safety guardrails to this key to filter content or enforce policies",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"guardrails",className:"mt-4",help:ey?"Select existing guardrails or enter new ones":"Premium feature - Upgrade to set guardrails by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ey,placeholder:ey?"Select or enter guardrails":"Premium feature - Upgrade to set guardrails by key",options:eK.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Disable Global Guardrails"," ",(0,t.jsx)(T.Tooltip,{title:"When enabled, this key will bypass any guardrails configured to run on every request (global guardrails)",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"disable_global_guardrails",className:"mt-4",valuePropName:"checked",help:ey?"Bypass global guardrails for this key":"Premium feature - Upgrade to disable global guardrails by key",children:(0,t.jsx)(S.Switch,{disabled:!ey,checkedChildren:"Yes",unCheckedChildren:"No"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Policies"," ",(0,t.jsx)(T.Tooltip,{title:"Apply policies to this key to control guardrails and other settings",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"policies",className:"mt-4",help:ex?"Select existing policies or enter new ones":"Premium feature - Upgrade to set policies by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ex,placeholder:ex?"Select or enter policies":"Premium feature - Upgrade to set policies by key",options:eW.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Prompts"," ",(0,t.jsx)(T.Tooltip,{title:"Allow this key to use specific prompt templates",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/prompt_management",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"prompts",className:"mt-4",help:ex?"Select existing prompts or enter new ones":"Premium feature - Upgrade to set prompts by key",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},disabled:!ex,placeholder:ex?"Select or enter prompts":"Premium feature - Upgrade to set prompts by key",options:eQ.map(e=>({value:e,label:e}))})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Access Groups"," ",(0,t.jsx)(T.Tooltip,{title:"Assign access groups to this key. Access groups control which models, MCP servers, and agents this key can use",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"access_group_ids",className:"mt-4",help:"Select access groups to assign to this key",children:(0,t.jsx)(E.default,{placeholder:"Select access groups (optional)"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Pass Through Routes"," ",(0,t.jsx)(T.Tooltip,{title:"Allow this key to use specific pass through routes",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/pass_through",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"allowed_passthrough_routes",className:"mt-4",help:ex?"Select existing pass through routes or enter new ones":"Premium feature - Upgrade to set pass through routes by key",children:(0,t.jsx)(D.default,{onChange:e=>eT.setFieldValue("allowed_passthrough_routes",e),value:eT.getFieldValue("allowed_passthrough_routes"),accessToken:ep,placeholder:ex?"Select or enter pass through routes":"Premium feature - Upgrade to set pass through routes by key",disabled:!ex,teamId:eZ?eZ.team_id:null})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Vector Stores"," ",(0,t.jsx)(T.Tooltip,{title:"Select which vector stores this key can access. If none selected, the key will have access to all available vector stores",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_vector_store_ids",className:"mt-4",help:"Select vector stores this key can access. Leave empty for access to all vector stores",children:(0,t.jsx)(ea.default,{onChange:e=>eT.setFieldValue("allowed_vector_store_ids",e),value:eT.getFieldValue("allowed_vector_store_ids"),accessToken:ep,placeholder:"Select vector stores (optional)"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Metadata"," ",(0,t.jsx)(T.Tooltip,{title:"JSON object with additional information about this key. Used for tracking or custom logic",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"metadata",className:"mt-4",children:(0,t.jsx)(v.Input.TextArea,{rows:4,placeholder:"Enter metadata as JSON"})}),(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Tags"," ",(0,t.jsx)(T.Tooltip,{title:"Tags for tracking spend and/or doing tag-based routing. Used for analytics and filtering",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"tags",className:"mt-4",help:"Tags for tracking spend and/or doing tag-based routing.",children:(0,t.jsx)(k.Select,{mode:"tags",style:{width:"100%"},placeholder:"Select or enter tags",tokenSeparators:[","],options:eS})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"MCP Settings"})}),(0,t.jsxs)(m.AccordionBody,{children:[(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed MCP Servers"," ",(0,t.jsx)(T.Tooltip,{title:"Select which MCP servers or access groups this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_mcp_servers_and_groups",help:"Select MCP servers or access groups this key can access",children:(0,t.jsx)(Y.default,{onChange:e=>eT.setFieldValue("allowed_mcp_servers_and_groups",e),value:eT.getFieldValue("allowed_mcp_servers_and_groups"),accessToken:ep,teamId:eZ?.team_id??null,placeholder:"Select MCP servers or access groups (optional)",allowNoMcpServers:!0})}),(0,t.jsx)(j.Form.Item,{name:"mcp_tool_permissions",initialValue:{},hidden:!0,children:(0,t.jsx)(v.Input,{type:"hidden"})}),(0,t.jsx)(j.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.allowed_mcp_servers_and_groups!==t.allowed_mcp_servers_and_groups||e.mcp_tool_permissions!==t.mcp_tool_permissions,children:()=>(0,t.jsx)("div",{className:"mt-6",children:(0,t.jsx)(Z.default,{accessToken:ep,selectedServers:(eT.getFieldValue("allowed_mcp_servers_and_groups")?.servers||[]).filter(e=>e!==X.NO_MCP_SERVERS_SENTINEL),toolPermissions:eT.getFieldValue("mcp_tool_permissions")||{},onChange:e=>eT.setFieldsValue({mcp_tool_permissions:e})})})})]})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Agent Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)(j.Form.Item,{label:(0,t.jsxs)("span",{children:["Allowed Agents"," ",(0,t.jsx)(T.Tooltip,{title:"Select which agents or access groups this key can access",children:(0,t.jsx)(d.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"allowed_agents_and_groups",help:"Select agents or access groups this key can access",children:(0,t.jsx)(M.default,{onChange:e=>eT.setFieldValue("allowed_agents_and_groups",e),value:eT.getFieldValue("allowed_agents_and_groups"),accessToken:ep,placeholder:"Select agents or access groups (optional)"})})})]}),ex?(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Logging Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(V.default,{value:eY,onChange:eX,premiumUser:!0,disabledCallbacks:tn,onDisabledCallbacksChange:to})})})]}):(0,t.jsx)(T.Tooltip,{title:(0,t.jsxs)("span",{children:["Key-level logging settings is an enterprise feature, get in touch -",(0,t.jsx)("a",{href:"https://www.litellm.ai/enterprise",target:"_blank",children:"https://www.litellm.ai/enterprise"})]}),placement:"top",children:(0,t.jsxs)("div",{style:{position:"relative"},children:[(0,t.jsx)("div",{style:{opacity:.5},children:(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Logging Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(V.default,{value:eY,onChange:eX,premiumUser:!1,disabledCallbacks:tn,onDisabledCallbacksChange:to})})})]})}),(0,t.jsx)("div",{style:{position:"absolute",inset:0,cursor:"not-allowed"}})]})}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Router Settings"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4 w-full",children:(0,t.jsx)(U.default,{accessToken:ep||"",value:ty||void 0,onChange:tf,modelData:eE.length>0?{data:eE.map(e=>({model_name:e}))}:void 0},tk)})})]},`router-settings-accordion-${tk}`),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Model Aliases"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsx)(y.Text,{className:"text-sm text-gray-600 mb-4",children:"Create custom aliases for models that can be used in API calls. This allows you to create shortcuts for specific models."}),(0,t.jsx)(R.default,{accessToken:ep,initialModelAliases:tu,onAliasUpdate:tm,showExampleConfig:!1})]})})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsx)("b",{children:"Key Lifecycle"})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)($.default,{form:eT,autoRotationEnabled:tp,onAutoRotationChange:tg,rotationInterval:th,onRotationIntervalChange:tx,isCreateMode:!0})})}),(0,t.jsx)(j.Form.Item,{name:"duration",hidden:!0,initialValue:null,children:(0,t.jsx)(v.Input,{})})]}),(0,t.jsxs)(u.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(p.AccordionHeader,{children:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)("b",{children:"Advanced Settings"}),(0,t.jsx)(T.Tooltip,{title:(0,t.jsxs)("span",{children:["Learn more about advanced settings in our"," ",(0,t.jsx)("a",{href:et.proxyBaseUrl?`${et.proxyBaseUrl}/#/key%20management/generate_key_fn_key_generate_post`:"/#/key%20management/generate_key_fn_key_generate_post",target:"_blank",rel:"noopener noreferrer",className:"text-blue-400 hover:text-blue-300",children:"documentation"})]}),children:(0,t.jsx)(d.InfoCircleOutlined,{className:"text-gray-400 hover:text-gray-300 cursor-help"})})]})}),(0,t.jsx)(m.AccordionBody,{children:(0,t.jsx)(B.default,{schemaComponent:"GenerateKeyRequest",form:eT,excludedFields:["key_alias","team_id","organization_id","models","duration","metadata","tags","guardrails","max_budget","budget_duration","tpm_limit","rpm_limit",...ek?["key"]:[]]})})]})]})]})}),(0,t.jsx)("div",{style:{textAlign:"right",marginTop:"10px"},children:(0,t.jsx)(_.Button,{htmlType:"submit",disabled:tM,style:{opacity:tM?.5:1},children:"Create Key"})})]})}),e5&&(0,t.jsx)(w.Modal,{title:"Create New User",open:e5,onCancel:()=>e6(!1),footer:null,width:800,children:(0,t.jsx)(W.CreateUserButton,{userID:eg,accessToken:ep,teams:eo,possibleUIRoles:e8,onUserCreated:e=>{e9(e),eT.setFieldsValue({user_id:e}),e6(!1)},isEmbedded:!0})}),eL&&(0,t.jsx)(w.Modal,{open:eI,onOk:tL,onCancel:tF,footer:null,children:(0,t.jsxs)(x.Grid,{numItems:1,className:"gap-2 w-full",children:[(0,t.jsx)(b.Title,{children:"Save your Key"}),(0,t.jsx)(h.Col,{numColSpan:1,children:null!=eL?(0,t.jsx)(es.default,{apiKey:eL}):(0,t.jsx)(y.Text,{children:"Key being created, this might take 30s"})})]})})]})},"fetchTeamModels",0,ei,"fetchUserModels",0,en],702597)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/02jakvkccxpfw.js b/litellm/proxy/_experimental/out/_next/static/chunks/02jakvkccxpfw.js deleted file mode 100644 index 81de72e6c80..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/02jakvkccxpfw.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,916925,e=>{"use strict";var t,a=e.i(555987),l=((t={}).A2A_Agent="A2A Agent",t.AI21="Ai21",t.AI21_CHAT="Ai21 Chat",t.AIML="AI/ML API",t.AIOHTTP_OPENAI="Aiohttp Openai",t.Anthropic="Anthropic",t.ANTHROPIC_TEXT="Anthropic Text",t.AssemblyAI="AssemblyAI",t.AUTO_ROUTER="Auto Router",t.Bedrock="Amazon Bedrock",t.BedrockMantle="Amazon Bedrock Mantle",t.SageMaker="AWS SageMaker",t.Azure="Azure",t.Azure_AI_Studio="Azure AI Foundry (Studio)",t.AZURE_TEXT="Azure Text",t.BASETEN="Baseten",t.BYTEZ="Bytez",t.Cerebras="Cerebras",t.CLARIFAI="Clarifai",t.CLOUDFLARE="Cloudflare",t.CODESTRAL="Codestral",t.Cohere="Cohere",t.COHERE_CHAT="Cohere Chat",t.COMETAPI="Cometapi",t.COMPACTIFAI="Compactifai",t.Cursor="Cursor",t.Dashscope="Dashscope",t.Databricks="Databricks (Qwen API)",t.DATAROBOT="Datarobot",t.DeepInfra="DeepInfra",t.Deepgram="Deepgram",t.Deepseek="Deepseek",t.DOCKER_MODEL_RUNNER="Docker Model Runner",t.DOTPROMPT="Dotprompt",t.ElevenLabs="ElevenLabs",t.EMPOWER="Empower",t.FalAI="Fal AI",t.FEATHERLESS_AI="Featherless Ai",t.FireworksAI="Fireworks AI",t.FRIENDLIAI="Friendliai",t.GALADRIEL="Galadriel",t.GITHUB_COPILOT="Github Copilot",t.Google_AI_Studio="Google AI Studio",t.GradientAI="GradientAI",t.Groq="Groq",t.HEROKU="Heroku",t.Hosted_Vllm="vllm",t.HUGGINGFACE="Huggingface",t.HYPERBOLIC="Hyperbolic",t.Infinity="Infinity",t.JinaAI="Jina AI",t.LAMBDA_AI="Lambda Ai",t.LEMONADE="Lemonade",t.LLAMAFILE="Llamafile",t.LM_STUDIO="Lm Studio",t.LLAMA="Meta Llama",t.MARITALK="Maritalk",t.MiniMax="MiniMax",t.MistralAI="Mistral AI",t.MOONSHOT="Moonshot",t.MORPH="Morph",t.NEBIUS="Nebius",t.NLP_CLOUD="Nlp Cloud",t.NOVITA="Novita",t.NSCALE="Nscale",t.NVIDIA_NIM="Nvidia Nim",t.Ollama="Ollama",t.OLLAMA_CHAT="Ollama Chat",t.OOBABOOGA="Oobabooga",t.OpenAI="OpenAI",t.OPENAI_LIKE="Openai Like",t.OpenAI_Compatible="OpenAI-Compatible Chat Completions (Together AI, vLLM, etc.)",t.OpenAI_Text="OpenAI Text Completion",t.OpenAI_Text_Compatible="OpenAI-Compatible Completions (legacy /v1/completions)",t.Openrouter="Openrouter",t.Oracle="Oracle Cloud Infrastructure (OCI)",t.OVHCLOUD="Ovhcloud",t.Perplexity="Perplexity",t.PETALS="Petals",t.PG_VECTOR="Pg Vector",t.PREDIBASE="Predibase",t.RECRAFT="Recraft",t.REPLICATE="Replicate",t.RunwayML="RunwayML",t.SAGEMAKER_LEGACY="Sagemaker",t.Sambanova="Sambanova",t.SAP="SAP Generative AI Hub",t.Snowflake="Snowflake",t.Soniox="Soniox",t.TEXT_COMPLETION_CODESTRAL="Text-Completion-Codestral",t.TogetherAI="TogetherAI",t.TOPAZ="Topaz",t.Triton="Triton",t.V0="V0",t.VERCEL_AI_GATEWAY="Vercel Ai Gateway",t.Vertex_AI="Vertex AI (Anthropic, Gemini, etc.)",t.VERTEX_AI_BETA="Vertex Ai Beta",t.VLLM="Vllm",t.VolcEngine="VolcEngine",t.Voyage="Voyage AI",t.WANDB="Wandb",t.WATSONX="Watsonx",t.WATSONX_TEXT="Watsonx Text",t.xAI="xAI",t.XINFERENCE="Xinference",t.ZAI="Z.AI (Zhipu AI)",t);let n={A2A_Agent:"a2a_agent",AI21:"ai21",AI21_CHAT:"ai21_chat",AIML:"aiml",AIOHTTP_OPENAI:"aiohttp_openai",Anthropic:"anthropic",ANTHROPIC_TEXT:"anthropic_text",AssemblyAI:"assemblyai",AUTO_ROUTER:"auto_router",Azure:"azure",Azure_AI_Studio:"azure_ai",AZURE_TEXT:"azure_text",BASETEN:"baseten",Bedrock:"bedrock",BedrockMantle:"bedrock_mantle",BYTEZ:"bytez",Cerebras:"cerebras",CLARIFAI:"clarifai",CLOUDFLARE:"cloudflare",CODESTRAL:"codestral",Cohere:"cohere",COHERE_CHAT:"cohere_chat",COMETAPI:"cometapi",COMPACTIFAI:"compactifai",Cursor:"cursor",Dashscope:"dashscope",Databricks:"databricks",DATAROBOT:"datarobot",DeepInfra:"deepinfra",Deepgram:"deepgram",Deepseek:"deepseek",DOCKER_MODEL_RUNNER:"docker_model_runner",DOTPROMPT:"dotprompt",ElevenLabs:"elevenlabs",EMPOWER:"empower",FalAI:"fal_ai",FEATHERLESS_AI:"featherless_ai",FireworksAI:"fireworks_ai",FRIENDLIAI:"friendliai",GALADRIEL:"galadriel",GITHUB_COPILOT:"github_copilot",Google_AI_Studio:"gemini",GradientAI:"gradient_ai",Groq:"groq",HEROKU:"heroku",Hosted_Vllm:"hosted_vllm",HUGGINGFACE:"huggingface",HYPERBOLIC:"hyperbolic",Infinity:"infinity",JinaAI:"jina_ai",LAMBDA_AI:"lambda_ai",LEMONADE:"lemonade",LLAMAFILE:"llamafile",LLAMA:"meta_llama",LM_STUDIO:"lm_studio",MARITALK:"maritalk",MiniMax:"minimax",MistralAI:"mistral",MOONSHOT:"moonshot",MORPH:"morph",NEBIUS:"nebius",NLP_CLOUD:"nlp_cloud",NOVITA:"novita",NSCALE:"nscale",NVIDIA_NIM:"nvidia_nim",Ollama:"ollama",OLLAMA_CHAT:"ollama_chat",OOBABOOGA:"oobabooga",OpenAI:"openai",OPENAI_LIKE:"openai_like",OpenAI_Compatible:"openai",OpenAI_Text:"text-completion-openai",OpenAI_Text_Compatible:"text-completion-openai",Openrouter:"openrouter",Oracle:"oci",OVHCLOUD:"ovhcloud",Perplexity:"perplexity",PETALS:"petals",PG_VECTOR:"pg_vector",PREDIBASE:"predibase",RECRAFT:"recraft",REPLICATE:"replicate",RunwayML:"runwayml",SAGEMAKER_LEGACY:"sagemaker",SageMaker:"sagemaker_chat",Sambanova:"sambanova",SAP:"sap",Snowflake:"snowflake",Soniox:"soniox",TEXT_COMPLETION_CODESTRAL:"text-completion-codestral",TogetherAI:"together_ai",TOPAZ:"topaz",Triton:"triton",V0:"v0",VERCEL_AI_GATEWAY:"vercel_ai_gateway",Vertex_AI:"vertex_ai",VERTEX_AI_BETA:"vertex_ai_beta",VLLM:"vllm",VolcEngine:"volcengine",Voyage:"voyage",WANDB:"wandb",WATSONX:"watsonx",WATSONX_TEXT:"watsonx_text",xAI:"xai",XINFERENCE:"xinference",ZAI:"zai"},r=new Set(["bedrock_mantle"]),o="/ui/assets/logos/",i={"A2A Agent":`${o}a2a_agent.png`,Ai21:`${o}ai21.svg`,"Ai21 Chat":`${o}ai21.svg`,"AI/ML API":`${o}aiml_api.svg`,"Aiohttp Openai":`${o}openai_small.svg`,Anthropic:`${o}anthropic.svg`,"Anthropic Text":`${o}anthropic.svg`,AssemblyAI:`${o}assemblyai_small.png`,Azure:`${o}microsoft_azure.svg`,"Azure AI Foundry (Studio)":`${o}microsoft_azure.svg`,"Azure Text":`${o}microsoft_azure.svg`,Baseten:`${o}baseten.svg`,"Amazon Bedrock":`${o}bedrock.svg`,"Amazon Bedrock Mantle":`${o}bedrock.svg`,"AWS SageMaker":`${o}bedrock.svg`,Cerebras:`${o}cerebras.svg`,Cloudflare:`${o}cloudflare.svg`,Codestral:`${o}mistral.svg`,Cohere:`${o}cohere.svg`,"Cohere Chat":`${o}cohere.svg`,Cometapi:`${o}cometapi.svg`,Cursor:`${o}cursor.svg`,"Databricks (Qwen API)":`${o}databricks.svg`,Dashscope:`${o}dashscope.svg`,Deepseek:`${o}deepseek.svg`,Deepgram:`${o}deepgram.png`,DeepInfra:`${o}deepinfra.png`,ElevenLabs:`${o}elevenlabs.png`,"Fal AI":`${o}fal_ai.jpg`,"Featherless Ai":`${o}featherless.svg`,"Fireworks AI":`${o}fireworks.svg`,Friendliai:`${o}friendli.svg`,"Github Copilot":`${o}github_copilot.svg`,"Google AI Studio":`${o}google.svg`,GradientAI:`${o}gradientai.svg`,Groq:`${o}groq.svg`,vllm:`${o}vllm.png`,Huggingface:`${o}huggingface.svg`,Hyperbolic:`${o}hyperbolic.svg`,Infinity:`${o}infinity.png`,"Jina AI":`${o}jina.png`,"Lambda Ai":`${o}lambda.svg`,"Lm Studio":`${o}lmstudio.svg`,"Meta Llama":`${o}meta_llama.svg`,MiniMax:`${o}minimax.svg`,"Mistral AI":`${o}mistral.svg`,Moonshot:`${o}moonshot.svg`,Morph:`${o}morph.svg`,Nebius:`${o}nebius.svg`,Novita:`${o}novita.svg`,"Nvidia Nim":`${o}nvidia_nim.svg`,Ollama:`${o}ollama.svg`,"Ollama Chat":`${o}ollama.svg`,Oobabooga:`${o}openai_small.svg`,OpenAI:`${o}openai_small.svg`,"Openai Like":`${o}openai_small.svg`,"OpenAI Text Completion":`${o}openai_small.svg`,"OpenAI-Compatible Completions (legacy /v1/completions)":`${o}openai_small.svg`,"OpenAI-Compatible Chat Completions (Together AI, vLLM, etc.)":`${o}openai_small.svg`,Openrouter:`${o}openrouter.svg`,"Oracle Cloud Infrastructure (OCI)":`${o}oracle.svg`,Perplexity:`${o}perplexity-ai.svg`,Recraft:`${o}recraft.svg`,Replicate:`${o}replicate.svg`,RunwayML:`${o}runwayml.png`,Sagemaker:`${o}bedrock.svg`,Sambanova:`${o}sambanova.svg`,"SAP Generative AI Hub":`${o}sap.png`,Snowflake:`${o}snowflake.svg`,Soniox:`${o}soniox.svg`,"Text-Completion-Codestral":`${o}mistral.svg`,TogetherAI:`${o}togetherai.svg`,Topaz:`${o}topaz.svg`,Triton:`${o}nvidia_triton.png`,V0:`${o}v0.svg`,"Vercel Ai Gateway":`${o}vercel.svg`,"Vertex AI (Anthropic, Gemini, etc.)":`${o}google.svg`,"Vertex Ai Beta":`${o}google.svg`,Vllm:`${o}vllm.png`,VolcEngine:`${o}volcengine.png`,"Voyage AI":`${o}voyage.webp`,Watsonx:`${o}watsonx.svg`,"Watsonx Text":`${o}watsonx.svg`,xAI:`${o}xai.svg`,Xinference:`${o}xinference.svg`};e.s(["Providers",()=>l,"getPlaceholder",0,e=>{if("AI/ML API"===e)return"aiml/flux-pro/v1.1";if("Vertex AI (Anthropic, Gemini, etc.)"===e)return"gemini-pro";if("Anthropic"==e)return"claude-3-opus";if("Amazon Bedrock"==e)return"claude-3-opus";if("AWS SageMaker"==e)return"sagemaker/jumpstart-dft-meta-textgeneration-llama-2-7b";else if("Google AI Studio"==e)return"gemini-pro";else if("Azure AI Foundry (Studio)"==e)return"azure_ai/command-r-plus";else if("Azure"==e)return"my-deployment";else if("Oracle Cloud Infrastructure (OCI)"==e)return"oci/xai.grok-4";else if("Snowflake"==e)return"snowflake/mistral-7b";else if("Voyage AI"==e)return"voyage/";else if("Jina AI"==e)return"jina_ai/";else if("VolcEngine"==e)return"volcengine/";else if("DeepInfra"==e)return"deepinfra/";else if("Fal AI"==e)return"fal_ai/fal-ai/flux-pro/v1.1-ultra";else if("RunwayML"==e)return"runwayml/gen4_turbo";else if("Watsonx"===e)return"watsonx/ibm/granite-3-3-8b-instruct";else if("Cursor"===e)return"cursor/claude-4-sonnet";else if("Z.AI (Zhipu AI)"===e)return"zai/glm-4.5";else return"gpt-3.5-turbo"},"getProviderLogoAndName",0,e=>{if(!e)return{logo:"",displayName:"-"};if("gemini"===e.toLowerCase()){let e="Google AI Studio";return{logo:(0,a.resolveLogoSrc)(i[e])??"",displayName:e}}let t=Object.keys(n).find(t=>n[t].toLowerCase()===e.toLowerCase())??Object.keys(n).find(t=>t.toLowerCase()===e.toLowerCase());if(!t)return{logo:"",displayName:e};let r=l[t];return{logo:(0,a.resolveLogoSrc)(i[r])??"",displayName:r}},"getProviderModels",0,(e,t)=>{let a=n[e],l=[];return e&&"object"==typeof t&&(Object.entries(t).forEach(([e,t])=>{if(null!==t&&"object"==typeof t&&"litellm_provider"in t){let n=t.litellm_provider,o="string"==typeof n&&(n.startsWith(`${a}_`)||n.startsWith(`${a}-`));(n===a||o&&!r.has(n))&&l.push(e)}}),"Cohere"==e&&Object.entries(t).forEach(([e,t])=>{null!==t&&"object"==typeof t&&"litellm_provider"in t&&"cohere_chat"===t.litellm_provider&&l.push(e)}),"AWS SageMaker"==e&&Object.entries(t).forEach(([e,t])=>{null!==t&&"object"==typeof t&&"litellm_provider"in t&&"sagemaker_chat"===t.litellm_provider&&l.push(e)})),l},"providerLogoMap",0,i,"provider_map",0,n])},91979,e=>{"use strict";e.i(247167);var t=e.i(931067),a=e.i(271645);let l={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M909.1 209.3l-56.4 44.1C775.8 155.1 656.2 92 521.9 92 290 92 102.3 279.5 102 511.5 101.7 743.7 289.8 932 521.9 932c181.3 0 335.8-115 394.6-276.1 1.5-4.2-.7-8.9-4.9-10.3l-56.7-19.5a8 8 0 00-10.1 4.8c-1.8 5-3.8 10-5.9 14.9-17.3 41-42.1 77.8-73.7 109.4A344.77 344.77 0 01655.9 829c-42.3 17.9-87.4 27-133.8 27-46.5 0-91.5-9.1-133.8-27A341.5 341.5 0 01279 755.2a342.16 342.16 0 01-73.7-109.4c-17.9-42.4-27-87.4-27-133.9s9.1-91.5 27-133.9c17.3-41 42.1-77.8 73.7-109.4 31.6-31.6 68.4-56.4 109.3-73.8 42.3-17.9 87.4-27 133.8-27 46.5 0 91.5 9.1 133.8 27a341.5 341.5 0 01109.3 73.8c9.9 9.9 19.2 20.4 27.8 31.4l-60.2 47a8 8 0 003 14.1l175.6 43c5 1.2 9.9-2.6 9.9-7.7l.8-180.9c-.1-6.6-7.8-10.3-13-6.2z"}}]},name:"reload",theme:"outlined"};var n=e.i(9583),r=a.forwardRef(function(e,r){return a.createElement(n.default,(0,t.default)({},e,{ref:r,icon:l}))});e.s(["ReloadOutlined",0,r],91979)},608856,e=>{"use strict";e.i(247167);var t=e.i(271645),a=e.i(343794),l=e.i(209428),n=e.i(392221),r=e.i(951160),o=e.i(174428),i=t.createContext(null),s=t.createContext({}),c=e.i(211577),u=e.i(931067),d=e.i(361275),m=e.i(404948),p=e.i(244009),f=e.i(703923),g=e.i(611935),h=["prefixCls","className","containerRef"];let v=function(e){var l=e.prefixCls,n=e.className,r=e.containerRef,o=(0,f.default)(e,h),i=t.useContext(s).panel,c=(0,g.useComposeRef)(i,r);return t.createElement("div",(0,u.default)({className:(0,a.default)("".concat(l,"-content"),n),role:"dialog",ref:c},(0,p.default)(e,{aria:!0}),{"aria-modal":"true"},o))};var A=e.i(883110);function b(e){return"string"==typeof e&&String(Number(e))===e?((0,A.default)(!1,"Invalid value type of `width` or `height` which should be number type instead."),Number(e)):e}var y={width:0,height:0,overflow:"hidden",outline:"none",position:"absolute"},x=t.forwardRef(function(e,r){var o,s,f,g=e.prefixCls,h=e.open,A=e.placement,x=e.inline,C=e.push,I=e.forceRender,w=e.autoFocus,O=e.keyboard,E=e.classNames,S=e.rootClassName,k=e.rootStyle,_=e.zIndex,L=e.className,$=e.id,T=e.style,M=e.motion,N=e.width,R=e.height,j=e.children,D=e.mask,P=e.maskClosable,z=e.maskMotion,H=e.maskClassName,B=e.maskStyle,F=e.afterOpenChange,V=e.onClose,G=e.onMouseEnter,K=e.onMouseOver,U=e.onMouseLeave,W=e.onClick,X=e.onKeyDown,q=e.onKeyUp,Q=e.styles,Y=e.drawerRender,Z=t.useRef(),J=t.useRef(),ee=t.useRef();t.useImperativeHandle(r,function(){return Z.current}),t.useEffect(function(){if(h&&w){var e;null==(e=Z.current)||e.focus({preventScroll:!0})}},[h]);var et=t.useState(!1),ea=(0,n.default)(et,2),el=ea[0],en=ea[1],er=t.useContext(i),eo=null!=(o=null!=(s=null==(f="boolean"==typeof C?C?{}:{distance:0}:C||{})?void 0:f.distance)?s:null==er?void 0:er.pushDistance)?o:180,ei=t.useMemo(function(){return{pushDistance:eo,push:function(){en(!0)},pull:function(){en(!1)}}},[eo]);t.useEffect(function(){var e,t;h?null==er||null==(e=er.push)||e.call(er):null==er||null==(t=er.pull)||t.call(er)},[h]),t.useEffect(function(){return function(){var e;null==er||null==(e=er.pull)||e.call(er)}},[]);var es=t.createElement(d.default,(0,u.default)({key:"mask"},z,{visible:D&&h}),function(e,n){var r=e.className,o=e.style;return t.createElement("div",{className:(0,a.default)("".concat(g,"-mask"),r,null==E?void 0:E.mask,H),style:(0,l.default)((0,l.default)((0,l.default)({},o),B),null==Q?void 0:Q.mask),onClick:P&&h?V:void 0,ref:n})}),ec="function"==typeof M?M(A):M,eu={};if(el&&eo)switch(A){case"top":eu.transform="translateY(".concat(eo,"px)");break;case"bottom":eu.transform="translateY(".concat(-eo,"px)");break;case"left":eu.transform="translateX(".concat(eo,"px)");break;default:eu.transform="translateX(".concat(-eo,"px)")}"left"===A||"right"===A?eu.width=b(N):eu.height=b(R);var ed={onMouseEnter:G,onMouseOver:K,onMouseLeave:U,onClick:W,onKeyDown:X,onKeyUp:q},em=t.createElement(d.default,(0,u.default)({key:"panel"},ec,{visible:h,forceRender:I,onVisibleChanged:function(e){null==F||F(e)},removeOnLeave:!1,leavedClassName:"".concat(g,"-content-wrapper-hidden")}),function(n,r){var o=n.className,i=n.style,s=t.createElement(v,(0,u.default)({id:$,containerRef:r,prefixCls:g,className:(0,a.default)(L,null==E?void 0:E.content),style:(0,l.default)((0,l.default)({},T),null==Q?void 0:Q.content)},(0,p.default)(e,{aria:!0}),ed),j);return t.createElement("div",(0,u.default)({className:(0,a.default)("".concat(g,"-content-wrapper"),null==E?void 0:E.wrapper,o),style:(0,l.default)((0,l.default)((0,l.default)({},eu),i),null==Q?void 0:Q.wrapper)},(0,p.default)(e,{data:!0})),Y?Y(s):s)}),ep=(0,l.default)({},k);return _&&(ep.zIndex=_),t.createElement(i.Provider,{value:ei},t.createElement("div",{className:(0,a.default)(g,"".concat(g,"-").concat(A),S,(0,c.default)((0,c.default)({},"".concat(g,"-open"),h),"".concat(g,"-inline"),x)),style:ep,tabIndex:-1,ref:Z,onKeyDown:function(e){var t,a,l=e.keyCode,n=e.shiftKey;switch(l){case m.default.TAB:l===m.default.TAB&&(n||document.activeElement!==ee.current?n&&document.activeElement===J.current&&(null==(a=ee.current)||a.focus({preventScroll:!0})):null==(t=J.current)||t.focus({preventScroll:!0}));break;case m.default.ESC:V&&O&&(e.stopPropagation(),V(e))}}},es,t.createElement("div",{tabIndex:0,ref:J,style:y,"aria-hidden":"true","data-sentinel":"start"}),em,t.createElement("div",{tabIndex:0,ref:ee,style:y,"aria-hidden":"true","data-sentinel":"end"})))});let C=function(e){var a=e.open,i=e.prefixCls,c=e.placement,u=e.autoFocus,d=e.keyboard,m=e.width,p=e.mask,f=void 0===p||p,g=e.maskClosable,h=e.getContainer,v=e.forceRender,A=e.afterOpenChange,b=e.destroyOnClose,y=e.onMouseEnter,C=e.onMouseOver,I=e.onMouseLeave,w=e.onClick,O=e.onKeyDown,E=e.onKeyUp,S=e.panelRef,k=t.useState(!1),_=(0,n.default)(k,2),L=_[0],$=_[1],T=t.useState(!1),M=(0,n.default)(T,2),N=M[0],R=M[1];(0,o.default)(function(){R(!0)},[]);var j=!!N&&void 0!==a&&a,D=t.useRef(),P=t.useRef();(0,o.default)(function(){j&&(P.current=document.activeElement)},[j]);var z=t.useMemo(function(){return{panel:S}},[S]);if(!v&&!L&&!j&&b)return null;var H=(0,l.default)((0,l.default)({},e),{},{open:j,prefixCls:void 0===i?"rc-drawer":i,placement:void 0===c?"right":c,autoFocus:void 0===u||u,keyboard:void 0===d||d,width:void 0===m?378:m,mask:f,maskClosable:void 0===g||g,inline:!1===h,afterOpenChange:function(e){var t,a;$(e),null==A||A(e),e||!P.current||null!=(t=D.current)&&t.contains(P.current)||null==(a=P.current)||a.focus({preventScroll:!0})},ref:D},{onMouseEnter:y,onMouseOver:C,onMouseLeave:I,onClick:w,onKeyDown:O,onKeyUp:E});return t.createElement(s.Provider,{value:z},t.createElement(r.default,{open:j||v||L,autoDestroy:!1,getContainer:h,autoLock:f&&(j||L)},t.createElement(x,H)))};var I=e.i(981444),w=e.i(617206),O=e.i(122767),E=e.i(613541),S=e.i(340010),k=e.i(242064),_=e.i(922611),L=e.i(563113),$=e.i(185793);let T=e=>{var l,n,r,o;let i,{prefixCls:s,ariaId:c,title:u,footer:d,extra:m,closable:p,loading:f,onClose:g,headerStyle:h,bodyStyle:v,footerStyle:A,children:b,classNames:y,styles:x}=e,C=(0,k.useComponentConfig)("drawer");i=!1===p?void 0:void 0===p||!0===p?"start":(null==p?void 0:p.placement)==="end"?"end":"start";let I=t.useCallback(e=>t.createElement("button",{type:"button",onClick:g,className:(0,a.default)(`${s}-close`,{[`${s}-close-${i}`]:"end"===i})},e),[g,s,i]),[w,O]=(0,L.useClosable)((0,L.pickClosable)(e),(0,L.pickClosable)(C),{closable:!0,closeIconRender:I});return t.createElement(t.Fragment,null,u||w?t.createElement("div",{style:Object.assign(Object.assign(Object.assign({},null==(r=C.styles)?void 0:r.header),h),null==x?void 0:x.header),className:(0,a.default)(`${s}-header`,{[`${s}-header-close-only`]:w&&!u&&!m},null==(o=C.classNames)?void 0:o.header,null==y?void 0:y.header)},t.createElement("div",{className:`${s}-header-title`},"start"===i&&O,u&&t.createElement("div",{className:`${s}-title`,id:c},u)),m&&t.createElement("div",{className:`${s}-extra`},m),"end"===i&&O):null,t.createElement("div",{className:(0,a.default)(`${s}-body`,null==y?void 0:y.body,null==(l=C.classNames)?void 0:l.body),style:Object.assign(Object.assign(Object.assign({},null==(n=C.styles)?void 0:n.body),v),null==x?void 0:x.body)},f?t.createElement($.default,{active:!0,title:!1,paragraph:{rows:5},className:`${s}-body-skeleton`}):b),(()=>{var e,l;if(!d)return null;let n=`${s}-footer`;return t.createElement("div",{className:(0,a.default)(n,null==(e=C.classNames)?void 0:e.footer,null==y?void 0:y.footer),style:Object.assign(Object.assign(Object.assign({},null==(l=C.styles)?void 0:l.footer),A),null==x?void 0:x.footer)},d)})())};e.i(296059);var M=e.i(915654),N=e.i(183293),R=e.i(246422),j=e.i(838378);let D=(e,t)=>({"&-enter, &-appear":Object.assign(Object.assign({},e),{"&-active":t}),"&-leave":Object.assign(Object.assign({},t),{"&-active":e})}),P=(e,t)=>Object.assign({"&-enter, &-appear, &-leave":{"&-start":{transition:"none"},"&-active":{transition:`all ${t}`}}},D({opacity:e},{opacity:1})),z=(0,R.genStyleHooks)("Drawer",e=>{let t=(0,j.mergeToken)(e,{});return[(e=>{let{borderRadiusSM:t,componentCls:a,zIndexPopup:l,colorBgMask:n,colorBgElevated:r,motionDurationSlow:o,motionDurationMid:i,paddingXS:s,padding:c,paddingLG:u,fontSizeLG:d,lineHeightLG:m,lineWidth:p,lineType:f,colorSplit:g,marginXS:h,colorIcon:v,colorIconHover:A,colorBgTextHover:b,colorBgTextActive:y,colorText:x,fontWeightStrong:C,footerPaddingBlock:I,footerPaddingInline:w,calc:O}=e,E=`${a}-content-wrapper`;return{[a]:{position:"fixed",inset:0,zIndex:l,pointerEvents:"none",color:x,"&-pure":{position:"relative",background:r,display:"flex",flexDirection:"column",[`&${a}-left`]:{boxShadow:e.boxShadowDrawerLeft},[`&${a}-right`]:{boxShadow:e.boxShadowDrawerRight},[`&${a}-top`]:{boxShadow:e.boxShadowDrawerUp},[`&${a}-bottom`]:{boxShadow:e.boxShadowDrawerDown}},"&-inline":{position:"absolute"},[`${a}-mask`]:{position:"absolute",inset:0,zIndex:l,background:n,pointerEvents:"auto"},[E]:{position:"absolute",zIndex:l,maxWidth:"100vw",transition:`all ${o}`,"&-hidden":{display:"none"}},[`&-left > ${E}`]:{top:0,bottom:0,left:{_skip_check_:!0,value:0},boxShadow:e.boxShadowDrawerLeft},[`&-right > ${E}`]:{top:0,right:{_skip_check_:!0,value:0},bottom:0,boxShadow:e.boxShadowDrawerRight},[`&-top > ${E}`]:{top:0,insetInline:0,boxShadow:e.boxShadowDrawerUp},[`&-bottom > ${E}`]:{bottom:0,insetInline:0,boxShadow:e.boxShadowDrawerDown},[`${a}-content`]:{display:"flex",flexDirection:"column",width:"100%",height:"100%",overflow:"auto",background:r,pointerEvents:"auto"},[`${a}-header`]:{display:"flex",flex:0,alignItems:"center",padding:`${(0,M.unit)(c)} ${(0,M.unit)(u)}`,fontSize:d,lineHeight:m,borderBottom:`${(0,M.unit)(p)} ${f} ${g}`,"&-title":{display:"flex",flex:1,alignItems:"center",minWidth:0,minHeight:0}},[`${a}-extra`]:{flex:"none"},[`${a}-close`]:Object.assign({display:"inline-flex",width:O(d).add(s).equal(),height:O(d).add(s).equal(),borderRadius:t,justifyContent:"center",alignItems:"center",color:v,fontWeight:C,fontSize:d,fontStyle:"normal",lineHeight:1,textAlign:"center",textTransform:"none",textDecoration:"none",background:"transparent",border:0,cursor:"pointer",transition:`all ${i}`,textRendering:"auto",[`&${a}-close-end`]:{marginInlineStart:h},[`&:not(${a}-close-end)`]:{marginInlineEnd:h},"&:hover":{color:A,backgroundColor:b,textDecoration:"none"},"&:active":{backgroundColor:y}},(0,N.genFocusStyle)(e)),[`${a}-title`]:{flex:1,margin:0,fontWeight:e.fontWeightStrong,fontSize:d,lineHeight:m},[`${a}-body`]:{flex:1,minWidth:0,minHeight:0,padding:u,overflow:"auto",[`${a}-body-skeleton`]:{width:"100%",height:"100%",display:"flex",justifyContent:"center"}},[`${a}-footer`]:{flexShrink:0,padding:`${(0,M.unit)(I)} ${(0,M.unit)(w)}`,borderTop:`${(0,M.unit)(p)} ${f} ${g}`},"&-rtl":{direction:"rtl"}}}})(t),(e=>{let{componentCls:t,motionDurationSlow:a}=e;return{[t]:{[`${t}-mask-motion`]:P(0,a),[`${t}-panel-motion`]:["left","right","top","bottom"].reduce((e,t)=>{let l;return Object.assign(Object.assign({},e),{[`&-${t}`]:[P(.7,a),D({transform:(l="100%",({left:`translateX(-${l})`,right:`translateX(${l})`,top:`translateY(-${l})`,bottom:`translateY(${l})`})[t])},{transform:"none"})]})},{})}}})(t)]},e=>({zIndexPopup:e.zIndexPopupBase,footerPaddingBlock:e.paddingXS,footerPaddingInline:e.padding}));var H=function(e,t){var a={};for(var l in e)Object.prototype.hasOwnProperty.call(e,l)&&0>t.indexOf(l)&&(a[l]=e[l]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var n=0,l=Object.getOwnPropertySymbols(e);nt.indexOf(l[n])&&Object.prototype.propertyIsEnumerable.call(e,l[n])&&(a[l[n]]=e[l[n]]);return a};let B={distance:180},F=e=>{let{rootClassName:l,width:n,height:r,size:o="default",mask:i=!0,push:s=B,open:c,afterOpenChange:u,onClose:d,prefixCls:m,getContainer:p,panelRef:f=null,style:h,className:v,"aria-labelledby":A,visible:b,afterVisibleChange:y,maskStyle:x,drawerStyle:L,contentWrapperStyle:$,destroyOnClose:M,destroyOnHidden:N}=e,R=H(e,["rootClassName","width","height","size","mask","push","open","afterOpenChange","onClose","prefixCls","getContainer","panelRef","style","className","aria-labelledby","visible","afterVisibleChange","maskStyle","drawerStyle","contentWrapperStyle","destroyOnClose","destroyOnHidden"]),j=(0,I.default)(),D=R.title?j:void 0,{getPopupContainer:P,getPrefixCls:F,direction:V,className:G,style:K,classNames:U,styles:W}=(0,k.useComponentConfig)("drawer"),X=F("drawer",m),[q,Q,Y]=z(X),Z=void 0===p&&P?()=>P(document.body):p,J=(0,a.default)({"no-mask":!i,[`${X}-rtl`]:"rtl"===V},l,Q,Y),ee=t.useMemo(()=>null!=n?n:"large"===o?736:378,[n,o]),et=t.useMemo(()=>null!=r?r:"large"===o?736:378,[r,o]),ea={motionName:(0,E.getTransitionName)(X,"mask-motion"),motionAppear:!0,motionEnter:!0,motionLeave:!0,motionDeadline:500},el=(0,_.usePanelRef)(),en=(0,g.composeRef)(f,el),[er,eo]=(0,O.useZIndex)("Drawer",R.zIndex),{classNames:ei={},styles:es={}}=R;return q(t.createElement(w.default,{form:!0,space:!0},t.createElement(S.default.Provider,{value:eo},t.createElement(C,Object.assign({prefixCls:X,onClose:d,maskMotion:ea,motion:e=>({motionName:(0,E.getTransitionName)(X,`panel-motion-${e}`),motionAppear:!0,motionEnter:!0,motionLeave:!0,motionDeadline:500})},R,{classNames:{mask:(0,a.default)(ei.mask,U.mask),content:(0,a.default)(ei.content,U.content),wrapper:(0,a.default)(ei.wrapper,U.wrapper)},styles:{mask:Object.assign(Object.assign(Object.assign({},es.mask),x),W.mask),content:Object.assign(Object.assign(Object.assign({},es.content),L),W.content),wrapper:Object.assign(Object.assign(Object.assign({},es.wrapper),$),W.wrapper)},open:null!=c?c:b,mask:i,push:s,width:ee,height:et,style:Object.assign(Object.assign({},K),h),className:(0,a.default)(G,v),rootClassName:J,getContainer:Z,afterOpenChange:null!=u?u:y,panelRef:en,zIndex:er,"aria-labelledby":null!=A?A:D,destroyOnClose:null!=N?N:M}),t.createElement(T,Object.assign({prefixCls:X},R,{ariaId:D,onClose:d}))))))};F._InternalPanelDoNotUseOrYouWillBeFired=e=>{let{prefixCls:l,style:n,className:r,placement:o="right"}=e,i=H(e,["prefixCls","style","className","placement"]),{getPrefixCls:s}=t.useContext(k.ConfigContext),c=s("drawer",l),[u,d,m]=z(c),p=(0,a.default)(c,`${c}-pure`,`${c}-${o}`,d,m,r);return u(t.createElement("div",{className:p,style:n},t.createElement(T,Object.assign({prefixCls:c},i))))},e.s(["Drawer",0,F],608856)},195116,e=>{"use strict";let t=(0,e.i(475254).default)("wrench",[["path",{d:"M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z",key:"cbrjhi"}]]);e.s(["Wrench",0,t],195116)},149121,e=>{"use strict";var t=e.i(843476),a=e.i(271645),l=e.i(152990),n=e.i(682830),r=e.i(269200),o=e.i(427612),i=e.i(64848),s=e.i(942232),c=e.i(496020),u=e.i(977572);e.s(["DataTable",0,function({data:e=[],columns:d,onRowClick:m,renderSubComponent:p,renderChildRows:f,getRowCanExpand:g,isLoading:h=!1,loadingMessage:v="🚅 Loading logs...",noDataMessage:A="No logs found",enableSorting:b=!1}){let y=!!(p||f)&&!!g,x=d.some(e=>void 0!==e.size),[C,I]=(0,a.useState)([]),w=(0,l.useReactTable)({data:e,columns:d,...b&&{state:{sorting:C},onSortingChange:I,enableSortingRemoval:!1},...y&&{getRowCanExpand:g},getRowId:(e,t)=>e?.request_id??String(t),getCoreRowModel:(0,n.getCoreRowModel)(),...b&&{getSortedRowModel:(0,n.getSortedRowModel)()},...y&&{getExpandedRowModel:(0,n.getExpandedRowModel)()}}),O=x?{minWidth:w.getCenterTotalSize()}:{minWidth:"400px"};return(0,t.jsx)("div",{className:"rounded-lg custom-border overflow-x-auto w-full max-w-full box-border",children:(0,t.jsxs)(r.Table,{className:x?"[&_td]:py-0.5 [&_th]:py-1 [&_table]:table-fixed":"[&_td]:py-0.5 [&_th]:py-1 table-fixed w-full box-border",style:O,children:[(0,t.jsx)(o.TableHead,{children:w.getHeaderGroups().map(e=>(0,t.jsx)(c.TableRow,{children:e.headers.map(e=>{let a=b&&e.column.getCanSort(),n=e.column.getIsSorted();return(0,t.jsx)(i.TableHeaderCell,{className:`py-1 h-8 ${a?"cursor-pointer select-none hover:bg-gray-50":""}`,style:x?{width:e.getSize()}:void 0,onClick:a?e.column.getToggleSortingHandler():void 0,children:e.isPlaceholder?null:(0,t.jsxs)("div",{className:"flex items-center gap-1",children:[(0,l.flexRender)(e.column.columnDef.header,e.getContext()),a&&(0,t.jsx)("span",{className:"text-gray-400",children:"asc"===n?"↑":"desc"===n?"↓":"⇅"})]})},e.id)})},e.id))}),(0,t.jsx)(s.TableBody,{children:h?(0,t.jsx)(c.TableRow,{children:(0,t.jsx)(u.TableCell,{colSpan:d.length,className:"h-8 text-center",children:(0,t.jsx)("div",{className:"text-center text-gray-500",children:(0,t.jsx)("p",{children:v})})})}):w.getRowModel().rows.length>0?w.getRowModel().rows.map(e=>(0,t.jsxs)(a.Fragment,{children:[(0,t.jsx)(c.TableRow,{className:`h-8 ${m?"cursor-pointer hover:bg-gray-50":""}`,onClick:()=>m?.(e.original),children:e.getVisibleCells().map(e=>(0,t.jsx)(u.TableCell,{className:"py-0.5 max-h-8 overflow-hidden text-ellipsis whitespace-nowrap",style:x?{width:e.column.getSize()}:void 0,children:(0,l.flexRender)(e.column.columnDef.cell,e.getContext())},e.id))}),y&&e.getIsExpanded()&&f&&f({row:e}),y&&e.getIsExpanded()&&p&&!f&&(0,t.jsx)(c.TableRow,{children:(0,t.jsx)(u.TableCell,{colSpan:e.getVisibleCells().length,className:"p-0",children:(0,t.jsx)("div",{className:"w-full max-w-full overflow-hidden box-border",children:p({row:e})})})})]},e.id)):(0,t.jsx)(c.TableRow,{children:(0,t.jsx)(u.TableCell,{colSpan:d.length,className:"h-8 text-center",children:(0,t.jsx)("div",{className:"text-center text-gray-500",children:(0,t.jsx)("p",{children:A})})})})})]})})}])},95684,e=>{"use strict";var t=e.i(165370);e.s(["Pagination",()=>t.default])},836991,e=>{"use strict";var t=e.i(271645);let a=t.forwardRef(function(e,a){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:a},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M6 18L18 6M6 6l12 12"}))});e.s(["XIcon",0,a],836991)},446891,e=>{"use strict";var t=e.i(843476),a=e.i(464571),l=e.i(326373),n=e.i(94629),r=e.i(360820),o=e.i(871943),i=e.i(836991);e.s(["TableHeaderSortDropdown",0,({sortState:e,onSortChange:s})=>{let c=[{key:"asc",label:"Ascending",icon:(0,t.jsx)(r.ChevronUpIcon,{className:"h-4 w-4"})},{key:"desc",label:"Descending",icon:(0,t.jsx)(o.ChevronDownIcon,{className:"h-4 w-4"})},{key:"reset",label:"Reset",icon:(0,t.jsx)(i.XIcon,{className:"h-4 w-4"})}];return(0,t.jsx)(l.Dropdown,{menu:{items:c,onClick:({key:e})=>{"asc"===e?s("asc"):"desc"===e?s("desc"):"reset"===e&&s(!1)},selectable:!0,selectedKeys:e?[e]:[]},trigger:["click"],autoAdjustOverflow:!0,children:(0,t.jsx)(a.Button,{type:"text",onClick:e=>e.stopPropagation(),icon:"asc"===e?(0,t.jsx)(r.ChevronUpIcon,{className:"h-4 w-4"}):"desc"===e?(0,t.jsx)(o.ChevronDownIcon,{className:"h-4 w-4"}):(0,t.jsx)(n.SwitchVerticalIcon,{className:"h-4 w-4"}),className:e?"text-blue-500 hover:text-blue-600":"text-gray-400 hover:text-blue-500"})})}])},362024,e=>{"use strict";var t=e.i(988122);e.s(["Collapse",()=>t.default])},240647,e=>{"use strict";var t=e.i(286612);e.s(["RightOutlined",()=>t.default])},245704,e=>{"use strict";e.i(247167);var t=e.i(931067),a=e.i(271645);let l={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M699 353h-46.9c-10.2 0-19.9 4.9-25.9 13.3L469 584.3l-71.2-98.8c-6-8.3-15.6-13.3-25.9-13.3H325c-6.5 0-10.3 7.4-6.5 12.7l124.6 172.8a31.8 31.8 0 0051.7 0l210.6-292c3.9-5.3.1-12.7-6.4-12.7z"}},{tag:"path",attrs:{d:"M512 64C264.6 64 64 264.6 64 512s200.6 448 448 448 448-200.6 448-448S759.4 64 512 64zm0 820c-205.4 0-372-166.6-372-372s166.6-372 372-372 372 166.6 372 372-166.6 372-372 372z"}}]},name:"check-circle",theme:"outlined"};var n=e.i(9583),r=a.forwardRef(function(e,r){return a.createElement(n.default,(0,t.default)({},e,{ref:r,icon:l}))});e.s(["CheckCircleOutlined",0,r],245704)},149192,e=>{"use strict";var t=e.i(864517);e.s(["CloseOutlined",()=>t.default])},518617,e=>{"use strict";e.i(247167);var t=e.i(931067),a=e.i(271645);let l={icon:{tag:"svg",attrs:{"fill-rule":"evenodd",viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M512 64c247.4 0 448 200.6 448 448S759.4 960 512 960 64 759.4 64 512 264.6 64 512 64zm0 76c-205.4 0-372 166.6-372 372s166.6 372 372 372 372-166.6 372-372-166.6-372-372-372zm128.01 198.83c.03 0 .05.01.09.06l45.02 45.01a.2.2 0 01.05.09.12.12 0 010 .07c0 .02-.01.04-.05.08L557.25 512l127.87 127.86a.27.27 0 01.05.06v.02a.12.12 0 010 .07c0 .03-.01.05-.05.09l-45.02 45.02a.2.2 0 01-.09.05.12.12 0 01-.07 0c-.02 0-.04-.01-.08-.05L512 557.25 384.14 685.12c-.04.04-.06.05-.08.05a.12.12 0 01-.07 0c-.03 0-.05-.01-.09-.05l-45.02-45.02a.2.2 0 01-.05-.09.12.12 0 010-.07c0-.02.01-.04.06-.08L466.75 512 338.88 384.14a.27.27 0 01-.05-.06l-.01-.02a.12.12 0 010-.07c0-.03.01-.05.05-.09l45.02-45.02a.2.2 0 01.09-.05.12.12 0 01.07 0c.02 0 .04.01.08.06L512 466.75l127.86-127.86c.04-.05.06-.06.08-.06a.12.12 0 01.07 0z"}}]},name:"close-circle",theme:"outlined"};var n=e.i(9583),r=a.forwardRef(function(e,r){return a.createElement(n.default,(0,t.default)({},e,{ref:r,icon:l}))});e.s(["CloseCircleOutlined",0,r],518617)},657150,e=>{"use strict";let t=(0,e.i(475254).default)("bot",[["path",{d:"M12 8V4H8",key:"hb8ula"}],["rect",{width:"16",height:"12",x:"4",y:"8",rx:"2",key:"enze0r"}],["path",{d:"M2 14h2",key:"vft8re"}],["path",{d:"M20 14h2",key:"4cs60a"}],["path",{d:"M15 13v2",key:"1xurst"}],["path",{d:"M9 13v2",key:"rq6x2g"}]]);e.s(["default",0,t])},531245,782273,793916,e=>{"use strict";var t=e.i(657150);e.s(["Bot",()=>t.default],531245),e.i(247167);var a=e.i(931067),l=e.i(271645);let n={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M625.9 115c-5.9 0-11.9 1.6-17.4 5.3L254 352H90c-8.8 0-16 7.2-16 16v288c0 8.8 7.2 16 16 16h164l354.5 231.7c5.5 3.6 11.6 5.3 17.4 5.3 16.7 0 32.1-13.3 32.1-32.1V147.1c0-18.8-15.4-32.1-32.1-32.1zM586 803L293.4 611.7l-18-11.7H146V424h129.4l17.9-11.7L586 221v582zm348-327H806c-8.8 0-16 7.2-16 16v40c0 8.8 7.2 16 16 16h128c8.8 0 16-7.2 16-16v-40c0-8.8-7.2-16-16-16zm-41.9 261.8l-110.3-63.7a15.9 15.9 0 00-21.7 5.9l-19.9 34.5c-4.4 7.6-1.8 17.4 5.8 21.8L856.3 800a15.9 15.9 0 0021.7-5.9l19.9-34.5c4.4-7.6 1.7-17.4-5.8-21.8zM760 344a15.9 15.9 0 0021.7 5.9L892 286.2c7.6-4.4 10.2-14.2 5.8-21.8L878 230a15.9 15.9 0 00-21.7-5.9L746 287.8a15.99 15.99 0 00-5.8 21.8L760 344z"}}]},name:"sound",theme:"outlined"};var r=e.i(9583),o=l.forwardRef(function(e,t){return l.createElement(r.default,(0,a.default)({},e,{ref:t,icon:n}))});e.s(["SoundOutlined",0,o],782273);let i={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M842 454c0-4.4-3.6-8-8-8h-60c-4.4 0-8 3.6-8 8 0 140.3-113.7 254-254 254S258 594.3 258 454c0-4.4-3.6-8-8-8h-60c-4.4 0-8 3.6-8 8 0 168.7 126.6 307.9 290 327.6V884H326.7c-13.7 0-24.7 14.3-24.7 32v36c0 4.4 2.8 8 6.2 8h407.6c3.4 0 6.2-3.6 6.2-8v-36c0-17.7-11-32-24.7-32H548V782.1c165.3-18 294-158 294-328.1zM512 624c93.9 0 170-75.2 170-168V232c0-92.8-76.1-168-170-168s-170 75.2-170 168v224c0 92.8 76.1 168 170 168zm-94-392c0-50.6 41.9-92 94-92s94 41.4 94 92v224c0 50.6-41.9 92-94 92s-94-41.4-94-92V232z"}}]},name:"audio",theme:"outlined"};var s=l.forwardRef(function(e,t){return l.createElement(r.default,(0,a.default)({},e,{ref:t,icon:i}))});e.s(["AudioOutlined",0,s],793916)},94629,e=>{"use strict";var t=e.i(271645);let a=t.forwardRef(function(e,a){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:a},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M7 16V4m0 0L3 8m4-4l4 4m6 0v12m0 0l4-4m-4 4l-4-4"}))});e.s(["SwitchVerticalIcon",0,a],94629)},166406,e=>{"use strict";var t=e.i(190144);e.s(["CopyOutlined",()=>t.default])},447566,e=>{"use strict";e.i(247167);var t=e.i(931067),a=e.i(271645);let l={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M872 474H286.9l350.2-304c5.6-4.9 2.2-14-5.2-14h-88.5c-3.9 0-7.6 1.4-10.5 3.9L155 487.8a31.96 31.96 0 000 48.3L535.1 866c1.5 1.3 3.3 2 5.2 2h91.5c7.4 0 10.8-9.2 5.2-14L286.9 550H872c4.4 0 8-3.6 8-8v-60c0-4.4-3.6-8-8-8z"}}]},name:"arrow-left",theme:"outlined"};var n=e.i(9583),r=a.forwardRef(function(e,r){return a.createElement(n.default,(0,t.default)({},e,{ref:r,icon:l}))});e.s(["ArrowLeftOutlined",0,r],447566)},969550,e=>{"use strict";var t=e.i(843476),a=e.i(271645);let l=a.forwardRef(function(e,t){return a.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),a.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M3 4a1 1 0 011-1h16a1 1 0 011 1v2.586a1 1 0 01-.293.707l-6.414 6.414a1 1 0 00-.293.707V17l-4 4v-6.586a1 1 0 00-.293-.707L3.293 7.293A1 1 0 013 6.586V4z"}))});var n=e.i(464571),r=e.i(311451),o=e.i(199133),i=e.i(374009);e.s(["default",0,({options:e,onApplyFilters:s,onResetFilters:c,initialValues:u={},buttonLabel:d="Filters"})=>{let[m,p]=(0,a.useState)(!1),[f,g]=(0,a.useState)(u),[h,v]=(0,a.useState)({}),[A,b]=(0,a.useState)({}),[y,x]=(0,a.useState)({}),[C,I]=(0,a.useState)({}),w=(0,a.useCallback)((0,i.default)(async(e,t)=>{if(t.isSearchable&&t.searchFn){b(e=>({...e,[t.name]:!0}));try{let a=await t.searchFn(e);v(e=>({...e,[t.name]:a}))}catch(e){console.error("Error searching:",e),v(e=>({...e,[t.name]:[]}))}finally{b(e=>({...e,[t.name]:!1}))}}},300),[]),O=(0,a.useCallback)(async e=>{if(e.isSearchable&&e.searchFn&&!e.loading&&!C[e.name]){b(t=>({...t,[e.name]:!0})),I(t=>({...t,[e.name]:!0}));try{let t=await e.searchFn("");v(a=>({...a,[e.name]:t}))}catch(t){console.error("Error loading initial options:",t),v(t=>({...t,[e.name]:[]}))}finally{b(t=>({...t,[e.name]:!1}))}}},[C]);(0,a.useEffect)(()=>{m&&e.forEach(e=>{e.isSearchable&&!C[e.name]&&O(e)})},[m,e,O,C]);let E=(e,t)=>{let a={...f,[e]:t};g(a),s(a)};return(0,t.jsxs)("div",{className:"w-full",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2 mb-6",children:[(0,t.jsx)(n.Button,{icon:(0,t.jsx)(l,{className:"h-4 w-4"}),onClick:()=>p(!m),className:"flex items-center gap-2",children:d}),(0,t.jsx)(n.Button,{onClick:()=>{let t={};e.forEach(e=>{t[e.name]=""}),g(t),c()},children:"Reset Filters"})]}),m&&(0,t.jsx)("div",{className:"grid grid-cols-3 gap-x-6 gap-y-4 mb-6",children:e.map(e=>{let a,l=A[e.name]||e.loading;return(0,t.jsxs)("div",{className:"flex flex-col gap-2",children:[(0,t.jsx)("label",{className:"text-sm text-gray-600",children:e.label||e.name}),e.isSearchable?(0,t.jsx)(o.Select,{showSearch:!0,className:"w-full",placeholder:`Search ${e.label||e.name}...`,value:f[e.name]||void 0,onChange:t=>E(e.name,t),onOpenChange:t=>{t&&e.isSearchable&&!C[e.name]&&O(e)},onSearch:t=>{x(a=>({...a,[e.name]:t})),e.searchFn&&w(t,e)},filterOption:!1,loading:l,options:h[e.name]||[],allowClear:!0,notFoundContent:l?"Loading...":"No results found"}):e.options?(0,t.jsx)(o.Select,{className:"w-full",placeholder:`Select ${e.label||e.name}...`,value:f[e.name]||void 0,onChange:t=>E(e.name,t),allowClear:!0,children:e.options.map(e=>(0,t.jsx)(o.Select.Option,{value:e.value,children:e.label},e.value))}):e.customComponent?(a=e.customComponent,(0,t.jsx)(a,{value:f[e.name]||void 0,onChange:t=>E(e.name,t??""),placeholder:`Select ${e.label||e.name}...`,allFilters:f})):(0,t.jsx)(r.Input,{className:"w-full",placeholder:`Enter ${e.label||e.name}...`,value:f[e.name]||"",onChange:t=>E(e.name,t.target.value),allowClear:!0})]},e.name)})})]})}],969550)},50882,e=>{"use strict";var t=e.i(843476),a=e.i(621482),l=e.i(243652),n=e.i(602869),r=e.i(135214);let o=(0,l.createQueryKeys)("infiniteKeyAliases");var i=e.i(56456),s=e.i(152473),c=e.i(199133),u=e.i(271645);e.s(["PaginatedKeyAliasSelect",0,({value:e,onChange:l,placeholder:d="Select a key alias",style:m,pageSize:p=50,allowClear:f=!0,disabled:g=!1,allFilters:h})=>{let[v,A]=(0,u.useState)(""),[b,y]=(0,s.useDebouncedState)("",{wait:300}),{data:x,fetchNextPage:C,hasNextPage:I,isFetchingNextPage:w,isLoading:O}=((e=50,t,l)=>{let{accessToken:i}=(0,r.default)();return(0,a.useInfiniteQuery)({queryKey:o.list({filters:{size:e,...t&&{search:t},...l&&{team_id:l}}}),queryFn:async({pageParam:a})=>await (0,n.keyAliasesCall)(i,a,e,t,l),initialPageParam:1,getNextPageParam:e=>{if(e.current_page{if(!x?.pages)return[];let e=new Set,t=[];for(let a of x.pages)for(let l of a.aliases)!l||e.has(l)||(e.add(l),t.push({label:l,value:l}));return t},[x]);return(0,t.jsx)(c.Select,{value:e||void 0,onChange:e=>{l?.(e??"")},placeholder:d,style:{width:"100%",...m},allowClear:f,disabled:g,showSearch:!0,filterOption:!1,onSearch:e=>{A(e),y(e)},searchValue:v,onPopupScroll:e=>{let t=e.currentTarget;(t.scrollTop+t.clientHeight)/t.scrollHeight>=.8&&I&&!w&&C()},loading:O,notFoundContent:O?(0,t.jsx)(i.LoadingOutlined,{spin:!0}):"No key aliases found",options:E,popupRender:e=>(0,t.jsxs)(t.Fragment,{children:[e,w&&(0,t.jsx)("div",{style:{textAlign:"center",padding:8},children:(0,t.jsx)(i.LoadingOutlined,{spin:!0})})]})})}],50882)},307582,e=>{"use strict";var t=e.i(843476);e.s(["TimeCell",0,({utcTime:e})=>(0,t.jsx)("span",{style:{fontFamily:"monospace",width:"180px",display:"inline-block"},children:(e=>{try{return new Date(e).toLocaleString("en-US",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",hour12:!0}).replace(",","")}catch(e){return"Error converting time"}})(e)})])},700514,e=>{"use strict";var t=e.i(271645);e.s(["defaultPageSize",0,25,"useBaseUrl",0,()=>{let[e,a]=(0,t.useState)("http://localhost:4000");return(0,t.useEffect)(()=>{{let{protocol:e,host:t}=window.location;a(`${e}//${t}`)}},[]),e}])},625901,e=>{"use strict";var t=e.i(266027),a=e.i(621482),l=e.i(243652),n=e.i(602869),r=e.i(135214);let o=(0,l.createQueryKeys)("models"),i=(0,l.createQueryKeys)("modelHub"),s=(0,l.createQueryKeys)("allProxyModels");(0,l.createQueryKeys)("selectedTeamModels");let c=(0,l.createQueryKeys)("infiniteModels"),u=(0,l.createQueryKeys)("userModels");e.s(["useAllProxyModels",0,()=>{let{accessToken:e,userId:a,userRole:l}=(0,r.default)();return(0,t.useQuery)({queryKey:s.list({}),queryFn:async()=>await (0,n.modelAvailableCall)(e,a,l,!0,null,!0,!1,"expand"),enabled:!!(e&&a&&l)})},"useInfiniteModelInfo",0,(e=50,t)=>{let{accessToken:l,userId:o,userRole:i}=(0,r.default)();return(0,a.useInfiniteQuery)({queryKey:c.list({filters:{...o&&{userId:o},...i&&{userRole:i},size:e,...t&&{search:t}}}),queryFn:async({pageParam:a})=>await (0,n.modelInfoCall)(l,o,i,a,e,t),initialPageParam:1,getNextPageParam:e=>{if(e.current_page{let{accessToken:e}=(0,r.default)();return(0,t.useQuery)({queryKey:i.list({}),queryFn:async()=>await (0,n.modelHubCall)(e),enabled:!!e})},"useModelsInfo",0,(e=1,a=50,l,i,s,c,u)=>{let{accessToken:d,userId:m,userRole:p}=(0,r.default)();return(0,t.useQuery)({queryKey:o.list({filters:{...m&&{userId:m},...p&&{userRole:p},page:e,size:a,...l&&{search:l},...i&&{modelId:i},...s&&{teamId:s},...c&&{sortBy:c},...u&&{sortOrder:u}}}),queryFn:async()=>await (0,n.modelInfoCall)(d,m,p,e,a,l,i,s,c,u),enabled:!!(d&&m&&p)})},"useUserModels",0,()=>{let{accessToken:e,userId:a,userRole:l}=(0,r.default)();return(0,t.useQuery)({queryKey:u.list({}),queryFn:async()=>(await (0,n.modelAvailableCall)(e,a,l)).data.map(e=>e.id),enabled:!!(e&&a&&l)})}])},633627,e=>{"use strict";var t=e.i(602869);let a=(e,t,a,l)=>{for(let n of e){let e=n?.key_alias;e&&"string"==typeof e&&t.add(e.trim());let r=n?.organization_id??n?.org_id;r&&"string"==typeof r&&a.add(r.trim());let o=n?.user_id;if(o&&"string"==typeof o){let e=n?.user?.user_email||o;l.set(o,e)}}},l=async(e,l)=>{if(!e||!l)return{keyAliases:[],organizationIds:[],userIds:[]};try{let n=new Set,r=new Set,o=new Map,i=await (0,t.keyListCall)(e,null,l,null,null,null,1,100,null,null,"user",null),s=i?.keys||[],c=i?.total_pages??1;a(s,n,r,o);let u=Math.min(c,10)-1;if(u>0){let i=Array.from({length:u},(a,n)=>(0,t.keyListCall)(e,null,l,null,null,null,n+2,100,null,null,"user",null));for(let e of(await Promise.allSettled(i)))"fulfilled"===e.status&&a(e.value?.keys||[],n,r,o)}return{keyAliases:Array.from(n).sort(),organizationIds:Array.from(r).sort(),userIds:Array.from(o.entries()).map(([e,t])=>({id:e,email:t}))}}catch(e){return console.error("Error fetching team filter options:",e),{keyAliases:[],organizationIds:[],userIds:[]}}},n=async(e,a)=>{if(!e)return[];try{let l=[],n=1,r=!0;for(;r;){let o=await (0,t.teamListCall)(e,a||null,null);l=[...l,...o],n{"use strict";var t=e.i(843476),a=e.i(482725),l=e.i(56456);e.s(["AntDLoadingSpinner",0,function({size:e,fontSize:n}){let r=(0,t.jsx)(l.LoadingOutlined,{style:n?{fontSize:n}:void 0,spin:!0});return(0,t.jsx)(a.Spin,{indicator:r,size:e})}])}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/02ucg1k1-nq5m.js b/litellm/proxy/_experimental/out/_next/static/chunks/02ucg1k1-nq5m.js new file mode 100644 index 00000000000..6c495536a98 --- /dev/null +++ b/litellm/proxy/_experimental/out/_next/static/chunks/02ucg1k1-nq5m.js @@ -0,0 +1,17 @@ +(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,185793,e=>{"use strict";e.i(247167);var t=e.i(271645),l=e.i(343794),n=e.i(242064),a=e.i(529681);let r=e=>{let{prefixCls:n,className:a,style:r,size:i,shape:o}=e,s=(0,l.default)({[`${n}-lg`]:"large"===i,[`${n}-sm`]:"small"===i}),d=(0,l.default)({[`${n}-circle`]:"circle"===o,[`${n}-square`]:"square"===o,[`${n}-round`]:"round"===o}),c=t.useMemo(()=>"number"==typeof i?{width:i,height:i,lineHeight:`${i}px`}:{},[i]);return t.createElement("span",{className:(0,l.default)(n,s,d,a),style:Object.assign(Object.assign({},c),r)})};e.i(296059);var i=e.i(694758),o=e.i(915654),s=e.i(246422),d=e.i(838378);let c=new i.Keyframes("ant-skeleton-loading",{"0%":{backgroundPosition:"100% 50%"},"100%":{backgroundPosition:"0 50%"}}),u=e=>({height:e,lineHeight:(0,o.unit)(e)}),g=e=>Object.assign({width:e},u(e)),m=(e,t)=>Object.assign({width:t(e).mul(5).equal(),minWidth:t(e).mul(5).equal()},u(e)),b=e=>Object.assign({width:e},u(e)),p=(e,t,l)=>{let{skeletonButtonCls:n}=e;return{[`${l}${n}-circle`]:{width:t,minWidth:t,borderRadius:"50%"},[`${l}${n}-round`]:{borderRadius:t}}},f=(e,t)=>Object.assign({width:t(e).mul(2).equal(),minWidth:t(e).mul(2).equal()},u(e)),h=(0,s.genStyleHooks)("Skeleton",e=>{let{componentCls:t,calc:l}=e;return(e=>{let{componentCls:t,skeletonAvatarCls:l,skeletonTitleCls:n,skeletonParagraphCls:a,skeletonButtonCls:r,skeletonInputCls:i,skeletonImageCls:o,controlHeight:s,controlHeightLG:d,controlHeightSM:u,gradientFromColor:h,padding:y,marginSM:$,borderRadius:x,titleHeight:v,blockRadius:j,paragraphLiHeight:O,controlHeightXS:C,paragraphMarginTop:S}=e;return{[t]:{display:"table",width:"100%",[`${t}-header`]:{display:"table-cell",paddingInlineEnd:y,verticalAlign:"top",[l]:Object.assign({display:"inline-block",verticalAlign:"top",background:h},g(s)),[`${l}-circle`]:{borderRadius:"50%"},[`${l}-lg`]:Object.assign({},g(d)),[`${l}-sm`]:Object.assign({},g(u))},[`${t}-content`]:{display:"table-cell",width:"100%",verticalAlign:"top",[n]:{width:"100%",height:v,background:h,borderRadius:j,[`+ ${a}`]:{marginBlockStart:u}},[a]:{padding:0,"> li":{width:"100%",height:O,listStyle:"none",background:h,borderRadius:j,"+ li":{marginBlockStart:C}}},[`${a}> li:last-child:not(:first-child):not(:nth-child(2))`]:{width:"61%"}},[`&-round ${t}-content`]:{[`${n}, ${a} > li`]:{borderRadius:x}}},[`${t}-with-avatar ${t}-content`]:{[n]:{marginBlockStart:$,[`+ ${a}`]:{marginBlockStart:S}}},[`${t}${t}-element`]:Object.assign(Object.assign(Object.assign(Object.assign({display:"inline-block",width:"auto"},(e=>{let{borderRadiusSM:t,skeletonButtonCls:l,controlHeight:n,controlHeightLG:a,controlHeightSM:r,gradientFromColor:i,calc:o}=e;return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({[l]:Object.assign({display:"inline-block",verticalAlign:"top",background:i,borderRadius:t,width:o(n).mul(2).equal(),minWidth:o(n).mul(2).equal()},f(n,o))},p(e,n,l)),{[`${l}-lg`]:Object.assign({},f(a,o))}),p(e,a,`${l}-lg`)),{[`${l}-sm`]:Object.assign({},f(r,o))}),p(e,r,`${l}-sm`))})(e)),(e=>{let{skeletonAvatarCls:t,gradientFromColor:l,controlHeight:n,controlHeightLG:a,controlHeightSM:r}=e;return{[t]:Object.assign({display:"inline-block",verticalAlign:"top",background:l},g(n)),[`${t}${t}-circle`]:{borderRadius:"50%"},[`${t}${t}-lg`]:Object.assign({},g(a)),[`${t}${t}-sm`]:Object.assign({},g(r))}})(e)),(e=>{let{controlHeight:t,borderRadiusSM:l,skeletonInputCls:n,controlHeightLG:a,controlHeightSM:r,gradientFromColor:i,calc:o}=e;return{[n]:Object.assign({display:"inline-block",verticalAlign:"top",background:i,borderRadius:l},m(t,o)),[`${n}-lg`]:Object.assign({},m(a,o)),[`${n}-sm`]:Object.assign({},m(r,o))}})(e)),(e=>{let{skeletonImageCls:t,imageSizeBase:l,gradientFromColor:n,borderRadiusSM:a,calc:r}=e;return{[t]:Object.assign(Object.assign({display:"inline-flex",alignItems:"center",justifyContent:"center",verticalAlign:"middle",background:n,borderRadius:a},b(r(l).mul(2).equal())),{[`${t}-path`]:{fill:"#bfbfbf"},[`${t}-svg`]:Object.assign(Object.assign({},b(l)),{maxWidth:r(l).mul(4).equal(),maxHeight:r(l).mul(4).equal()}),[`${t}-svg${t}-svg-circle`]:{borderRadius:"50%"}}),[`${t}${t}-circle`]:{borderRadius:"50%"}}})(e)),[`${t}${t}-block`]:{width:"100%",[r]:{width:"100%"},[i]:{width:"100%"}},[`${t}${t}-active`]:{[` + ${n}, + ${a} > li, + ${l}, + ${r}, + ${i}, + ${o} + `]:Object.assign({},{background:e.skeletonLoadingBackground,backgroundSize:"400% 100%",animationName:c,animationDuration:e.skeletonLoadingMotionDuration,animationTimingFunction:"ease",animationIterationCount:"infinite"})}}})((0,d.mergeToken)(e,{skeletonAvatarCls:`${t}-avatar`,skeletonTitleCls:`${t}-title`,skeletonParagraphCls:`${t}-paragraph`,skeletonButtonCls:`${t}-button`,skeletonInputCls:`${t}-input`,skeletonImageCls:`${t}-image`,imageSizeBase:l(e.controlHeight).mul(1.5).equal(),borderRadius:100,skeletonLoadingBackground:`linear-gradient(90deg, ${e.gradientFromColor} 25%, ${e.gradientToColor} 37%, ${e.gradientFromColor} 63%)`,skeletonLoadingMotionDuration:"1.4s"}))},e=>{let{colorFillContent:t,colorFill:l}=e;return{color:t,colorGradientEnd:l,gradientFromColor:t,gradientToColor:l,titleHeight:e.controlHeight/2,blockRadius:e.borderRadiusSM,paragraphMarginTop:e.marginLG+e.marginXXS,paragraphLiHeight:e.controlHeight/2}},{deprecatedTokens:[["color","gradientFromColor"],["colorGradientEnd","gradientToColor"]]}),y=e=>{let{prefixCls:n,className:a,style:r,rows:i=0}=e,o=Array.from({length:i}).map((l,n)=>t.createElement("li",{key:n,style:{width:((e,t)=>{let{width:l,rows:n=2}=t;return Array.isArray(l)?l[e]:n-1===e?l:void 0})(n,e)}}));return t.createElement("ul",{className:(0,l.default)(n,a),style:r},o)},$=({prefixCls:e,className:n,width:a,style:r})=>t.createElement("h3",{className:(0,l.default)(e,n),style:Object.assign({width:a},r)});function x(e){return e&&"object"==typeof e?e:{}}let v=e=>{let{prefixCls:a,loading:i,className:o,rootClassName:s,style:d,children:c,avatar:u=!1,title:g=!0,paragraph:m=!0,active:b,round:p}=e,{getPrefixCls:f,direction:v,className:j,style:O}=(0,n.useComponentConfig)("skeleton"),C=f("skeleton",a),[S,w,N]=h(C);if(i||!("loading"in e)){let e,n,a=!!u,i=!!g,c=!!m;if(a){let l=Object.assign(Object.assign({prefixCls:`${C}-avatar`},i&&!c?{size:"large",shape:"square"}:{size:"large",shape:"circle"}),x(u));e=t.createElement("div",{className:`${C}-header`},t.createElement(r,Object.assign({},l)))}if(i||c){let e,l;if(i){let l=Object.assign(Object.assign({prefixCls:`${C}-title`},!a&&c?{width:"38%"}:a&&c?{width:"50%"}:{}),x(g));e=t.createElement($,Object.assign({},l))}if(c){let e,n=Object.assign(Object.assign({prefixCls:`${C}-paragraph`},(e={},a&&i||(e.width="61%"),!a&&i?e.rows=3:e.rows=2,e)),x(m));l=t.createElement(y,Object.assign({},n))}n=t.createElement("div",{className:`${C}-content`},e,l)}let f=(0,l.default)(C,{[`${C}-with-avatar`]:a,[`${C}-active`]:b,[`${C}-rtl`]:"rtl"===v,[`${C}-round`]:p},j,o,s,w,N);return S(t.createElement("div",{className:f,style:Object.assign(Object.assign({},O),d)},e,n))}return null!=c?c:null};v.Button=e=>{let{prefixCls:i,className:o,rootClassName:s,active:d,block:c=!1,size:u="default"}=e,{getPrefixCls:g}=t.useContext(n.ConfigContext),m=g("skeleton",i),[b,p,f]=h(m),y=(0,a.default)(e,["prefixCls"]),$=(0,l.default)(m,`${m}-element`,{[`${m}-active`]:d,[`${m}-block`]:c},o,s,p,f);return b(t.createElement("div",{className:$},t.createElement(r,Object.assign({prefixCls:`${m}-button`,size:u},y))))},v.Avatar=e=>{let{prefixCls:i,className:o,rootClassName:s,active:d,shape:c="circle",size:u="default"}=e,{getPrefixCls:g}=t.useContext(n.ConfigContext),m=g("skeleton",i),[b,p,f]=h(m),y=(0,a.default)(e,["prefixCls","className"]),$=(0,l.default)(m,`${m}-element`,{[`${m}-active`]:d},o,s,p,f);return b(t.createElement("div",{className:$},t.createElement(r,Object.assign({prefixCls:`${m}-avatar`,shape:c,size:u},y))))},v.Input=e=>{let{prefixCls:i,className:o,rootClassName:s,active:d,block:c,size:u="default"}=e,{getPrefixCls:g}=t.useContext(n.ConfigContext),m=g("skeleton",i),[b,p,f]=h(m),y=(0,a.default)(e,["prefixCls"]),$=(0,l.default)(m,`${m}-element`,{[`${m}-active`]:d,[`${m}-block`]:c},o,s,p,f);return b(t.createElement("div",{className:$},t.createElement(r,Object.assign({prefixCls:`${m}-input`,size:u},y))))},v.Image=e=>{let{prefixCls:a,className:r,rootClassName:i,style:o,active:s}=e,{getPrefixCls:d}=t.useContext(n.ConfigContext),c=d("skeleton",a),[u,g,m]=h(c),b=(0,l.default)(c,`${c}-element`,{[`${c}-active`]:s},r,i,g,m);return u(t.createElement("div",{className:b},t.createElement("div",{className:(0,l.default)(`${c}-image`,r),style:o},t.createElement("svg",{viewBox:"0 0 1098 1024",xmlns:"http://www.w3.org/2000/svg",className:`${c}-image-svg`},t.createElement("title",null,"Image placeholder"),t.createElement("path",{d:"M365.714286 329.142857q0 45.714286-32.036571 77.677714t-77.677714 32.036571-77.677714-32.036571-32.036571-77.677714 32.036571-77.677714 77.677714-32.036571 77.677714 32.036571 32.036571 77.677714zM950.857143 548.571429l0 256-804.571429 0 0-109.714286 182.857143-182.857143 91.428571 91.428571 292.571429-292.571429zM1005.714286 146.285714l-914.285714 0q-7.460571 0-12.873143 5.412571t-5.412571 12.873143l0 694.857143q0 7.460571 5.412571 12.873143t12.873143 5.412571l914.285714 0q7.460571 0 12.873143-5.412571t5.412571-12.873143l0-694.857143q0-7.460571-5.412571-12.873143t-12.873143-5.412571zM1097.142857 164.571429l0 694.857143q0 37.741714-26.843429 64.585143t-64.585143 26.843429l-914.285714 0q-37.741714 0-64.585143-26.843429t-26.843429-64.585143l0-694.857143q0-37.741714 26.843429-64.585143t64.585143-26.843429l914.285714 0q37.741714 0 64.585143 26.843429t26.843429 64.585143z",className:`${c}-image-path`})))))},v.Node=e=>{let{prefixCls:a,className:r,rootClassName:i,style:o,active:s,children:d}=e,{getPrefixCls:c}=t.useContext(n.ConfigContext),u=c("skeleton",a),[g,m,b]=h(u),p=(0,l.default)(u,`${u}-element`,{[`${u}-active`]:s},m,r,i,b);return g(t.createElement("div",{className:p},t.createElement("div",{className:(0,l.default)(`${u}-image`,r),style:o},d)))},e.s(["default",0,v],185793)},922611,e=>{"use strict";var t=e.i(271645),l=e.i(175066);function n(){}let a=t.createContext({add:n,remove:n});e.s(["usePanelRef",0,function(e){let n=t.useContext(a),r=t.useRef(null);return(0,l.default)(t=>{if(t){let l=e?t.querySelector(e):t;l&&(n.add(l),r.current=l)}else n.remove(r.current)})}])},500330,e=>{"use strict";var t=e.i(727749);let l=(e,t=0,l=!1,n=!0)=>{if(null==e||!Number.isFinite(e)||0===e&&!n)return"-";let a={minimumFractionDigits:t,maximumFractionDigits:t};if(!l)return e.toLocaleString("en-US",a);let r=e<0?"-":"",i=Math.abs(e),o=i,s="";return i>=1e6?(o=i/1e6,s="M"):i>=1e3&&(o=i/1e3,s="K"),`${r}${o.toLocaleString("en-US",a)}${s}`},n=async(e,l="Copied to clipboard")=>{if(!e)return!1;if(!navigator||!navigator.clipboard||!navigator.clipboard.writeText)return a(e,l);try{return await navigator.clipboard.writeText(e),t.default.success(l),!0}catch(t){return console.error("Clipboard API failed: ",t),a(e,l)}},a=(e,l)=>{try{let n=document.createElement("textarea");n.value=e,n.style.position="fixed",n.style.left="-999999px",n.style.top="-999999px",n.setAttribute("readonly",""),document.body.appendChild(n),n.focus(),n.select();let a=document.execCommand("copy");if(document.body.removeChild(n),a)return t.default.success(l),!0;throw Error("execCommand failed")}catch(e){return t.default.fromBackend("Failed to copy to clipboard"),console.error("Failed to copy: ",e),!1}};e.s(["copyToClipboard",0,n,"formatNumberWithCommas",0,l,"getSpendString",0,(e,t=6)=>{if(null==e||!Number.isFinite(e)||0===e)return"-";let n=l(e,t,!1,!1);if(0===Number(n.replace(/,/g,""))){let e=(1/10**t).toFixed(t);return`< $${e}`}return`$${n}`},"updateExistingKeys",0,function(e,t){let l=structuredClone(e);for(let[e,n]of Object.entries(t))e in l&&(l[e]=n);return l}])},112179,581070,e=>{"use strict";var t=e.i(843476),l=e.i(487486),n=e.i(115504),a=e.i(746798);function r({content:e,trigger:l}){return(0,t.jsx)(a.TooltipProvider,{delay:300,children:(0,t.jsxs)(a.Tooltip,{children:[(0,t.jsx)(a.TooltipTrigger,{render:l}),(0,t.jsx)(a.TooltipContent,{children:e})]})})}e.s(["CellTooltip",0,r],581070);let i={success:"border-green-200 bg-green-50 text-green-600",error:"border-red-200 bg-red-50 text-red-600",warning:"border-amber-200 bg-amber-50 text-amber-600",neutral:"border-gray-200 bg-gray-50 text-gray-600",info:"border-blue-200 bg-blue-50 text-blue-600"};e.s(["StatusBadge",0,function({tone:e,label:a,tooltip:o,dataTestId:s}){let d=(0,t.jsx)(l.Badge,{variant:"outline","data-testid":s,className:(0,n.cn)("whitespace-nowrap font-normal",i[e]),children:a});return o?(0,t.jsx)(r,{content:o,trigger:d}):d}],112179)},199931,e=>{"use strict";let t=(0,e.i(475254).default)("waypoints",[["circle",{cx:"12",cy:"4.5",r:"2.5",key:"r5ysbb"}],["path",{d:"m10.2 6.3-3.9 3.9",key:"1nzqf6"}],["circle",{cx:"4.5",cy:"12",r:"2.5",key:"jydg6v"}],["path",{d:"M7 12h10",key:"b7w52i"}],["circle",{cx:"19.5",cy:"12",r:"2.5",key:"1piiel"}],["path",{d:"m13.8 17.7 3.9-3.9",key:"1wyg1y"}],["circle",{cx:"12",cy:"19.5",r:"2.5",key:"13o1pw"}]]);e.s(["Waypoints",0,t],199931)},625901,e=>{"use strict";var t=e.i(266027),l=e.i(621482),n=e.i(243652),a=e.i(602869),r=e.i(135214);let i=(0,n.createQueryKeys)("models"),o=(0,n.createQueryKeys)("modelHub"),s=(0,n.createQueryKeys)("autoRouterModelGroups"),d=(0,n.createQueryKeys)("allProxyModels");(0,n.createQueryKeys)("selectedTeamModels");let c=(0,n.createQueryKeys)("infiniteModels"),u=(0,n.createQueryKeys)("userModels"),g=new Set,m=e=>!!e?.litellm_params?.model?.startsWith("auto_router/"),b=e=>new Set(e.filter(m).map(e=>e.model_name).filter(e=>!!e)),p=async(e,t,l)=>{let n=await (0,a.modelInfoCall)(e,t,l,1,1e3),r=n?.total_pages??1;return[n,...await Promise.all(Array.from({length:Math.max(0,r-1)},(n,r)=>(0,a.modelInfoCall)(e,t,l,r+2,1e3)))].flatMap(e=>e?.data??[])};e.s(["useAllProxyModels",0,()=>{let{accessToken:e,userId:l,userRole:n}=(0,r.default)();return(0,t.useQuery)({queryKey:d.list({}),queryFn:async()=>await (0,a.modelAvailableCall)(e,l,n,!0,null,!0,!1,"expand"),enabled:!!(e&&l&&n)})},"useAutoRouterModelGroups",0,()=>{let{accessToken:e,userId:l,userRole:n}=(0,r.default)(),{data:a}=(0,t.useQuery)({queryKey:s.list({filters:{...l&&{userId:l},...n&&{userRole:n}}}),queryFn:async()=>await p(e,l,n),enabled:!!(e&&l&&n),select:b});return a??g},"useInfiniteModelInfo",0,(e=50,t)=>{let{accessToken:n,userId:i,userRole:o}=(0,r.default)();return(0,l.useInfiniteQuery)({queryKey:c.list({filters:{...i&&{userId:i},...o&&{userRole:o},size:e,...t&&{search:t}}}),queryFn:async({pageParam:l})=>await (0,a.modelInfoCall)(n,i,o,l,e,t),initialPageParam:1,getNextPageParam:e=>{if(e.current_page{let{accessToken:e}=(0,r.default)();return(0,t.useQuery)({queryKey:o.list({}),queryFn:async()=>await (0,a.modelHubCall)(e),enabled:!!e})},"useModelsInfo",0,(e=1,l=50,n,o,s,d,c)=>{let{accessToken:u,userId:g,userRole:m}=(0,r.default)();return(0,t.useQuery)({queryKey:i.list({filters:{...g&&{userId:g},...m&&{userRole:m},page:e,size:l,...n&&{search:n},...o&&{modelId:o},...s&&{teamId:s},...d&&{sortBy:d},...c&&{sortOrder:c}}}),queryFn:async()=>await (0,a.modelInfoCall)(u,g,m,e,l,n,o,s,d,c),enabled:!!(u&&g&&m)})},"useUserModels",0,()=>{let{accessToken:e,userId:l,userRole:n}=(0,r.default)();return(0,t.useQuery)({queryKey:u.list({}),queryFn:async()=>(await (0,a.modelAvailableCall)(e,l,n)).data.map(e=>e.id),enabled:!!(e&&l&&n)})}])},548151,200208,399536,997422,146512,e=>{"use strict";var t=e.i(843476),l=e.i(271645),n=e.i(199931),a=e.i(625901),r=e.i(487486),i=e.i(115504);let o=new Set,s=(0,l.createContext)(o);function d(e){let t=(0,l.useContext)(s);return!!e&&t.has(e)}e.s(["AutoRouterIcon",0,function({size:e=12,className:l}){return(0,t.jsx)(n.Waypoints,{size:e,className:l,"aria-hidden":!0})},"AutoRouterModelGroupsProvider",0,function({children:e}){let l=(0,a.useAutoRouterModelGroups)();return(0,t.jsx)(s.Provider,{value:l,children:e})},"AutoRouterTag",0,function({modelGroup:e,className:l}){return d(e)?(0,t.jsxs)(r.Badge,{variant:"secondary",title:`Routed by auto-router "${e}"`,className:(0,i.cn)("gap-1.5 px-2.5 py-1 text-sm font-normal text-foreground",l),children:[(0,t.jsx)(n.Waypoints,{"aria-hidden":!0}),e]}):null},"useIsAutoRoutedModelGroup",0,d],548151);var c=e.i(581070);let u=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"],g=e=>String(e).padStart(2,"0"),m=(e,t)=>"date"===t?`${u[e.getMonth()]} ${e.getDate()}, ${e.getFullYear()}`:`${u[e.getMonth()]} ${e.getDate()}, ${g(e.getHours())}:${g(e.getMinutes())}:${g(e.getSeconds())}`;e.s(["DateCell",0,function({value:e,precision:l="datetime",fallback:n="-"}){let a,r,i,o=e?new Date(e):null;return!o||Number.isNaN(o.getTime())?(0,t.jsx)("span",{className:"text-muted-foreground",children:n}):(0,t.jsx)(c.CellTooltip,{content:(a=Intl.DateTimeFormat().resolvedOptions().timeZone,r=`${u[o.getMonth()]} ${o.getDate()}, ${o.getFullYear()}`,i=`${g(o.getHours())}:${g(o.getMinutes())}:${g(o.getSeconds())}`,`${r}, ${i} (${a})`),trigger:(0,t.jsx)("span",{className:"whitespace-nowrap",children:m(o,l)})})},"formatCellDate",0,m],200208);var b=e.i(174886),p=e.i(500330);let f={pill:{base:"font-mono text-xs font-normal px-2 py-0.5 rounded-md text-left bg-blue-50 text-blue-500",clickable:"hover:bg-blue-100 cursor-pointer"},plain:{base:"font-mono text-xs text-left",clickable:"hover:text-blue-600 cursor-pointer"}};e.s(["IdCell",0,function({value:e,variant:l="pill",onClick:n,copyable:a=!1,truncate:r=!0,fallback:o="-",tooltip:s,disabled:d=!1,dataTestId:u,className:g}){if(!e)return(0,t.jsx)("span",{className:"text-muted-foreground",children:o});let m=!!n&&!d,h=(0,i.cn)(f[l].base,m&&f[l].clickable,r&&"block max-w-[15ch] truncate",d&&"opacity-50",g),y=m?(0,t.jsx)("button",{type:"button",className:h,"data-testid":u,onClick:()=>n(e),children:e}):(0,t.jsx)("span",{className:h,"data-testid":u,children:e}),$=(0,t.jsx)(c.CellTooltip,{content:s??e,trigger:y});return a?(0,t.jsxs)("span",{className:"inline-flex max-w-full items-center gap-1",children:[$,(0,t.jsx)("button",{type:"button","aria-label":"Copy ID",className:"shrink-0 cursor-pointer text-muted-foreground hover:text-foreground",onClick:t=>{t.stopPropagation(),(0,p.copyToClipboard)(e)},children:(0,t.jsx)(b.Copy,{className:"size-3"})})]}):$}],399536);var h=e.i(463059);e.s(["IdentityCell",0,function({title:e,subtitle:l,badge:n,onClick:a,className:r,titleClassName:o}){let s=(0,t.jsxs)("div",{className:"flex min-w-0 flex-col gap-0.5",children:[(0,t.jsx)("span",{className:(0,i.cn)("truncate text-sm font-medium text-foreground",o),children:e}),(null!=l&&""!==l||null!=n)&&(0,t.jsxs)("span",{className:"flex min-w-0 items-center gap-2",children:[null!=l&&""!==l&&(0,t.jsx)("span",{className:"truncate font-mono text-xs text-muted-foreground",children:l}),n]})]});return null!=a?(0,t.jsxs)("button",{type:"button",onClick:a,className:(0,i.cn)("group -mx-2 flex w-[calc(100%+1rem)] cursor-pointer items-center gap-2 rounded-md px-2 py-1 text-left transition-colors hover:bg-muted",r),children:[s,(0,t.jsx)(h.ChevronRight,{className:"ml-auto size-4 shrink-0 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100"})]}):(0,t.jsx)("div",{className:(0,i.cn)("min-w-0",r),children:s})}],997422);let y={hasModelAccess:!1,label:"Management"},$={hasModelAccess:!1,label:"Read-only"},x={hasModelAccess:!1,label:"SCIM"},v={hasModelAccess:!0,label:null},j=e=>e.startsWith("/scim"),O=(e,t)=>1===e.length&&e[0]===t;e.s(["deriveKeyModelScope",0,(e,t)=>"management"===t?y:"read_only"===t?$:Array.isArray(e)&&0!==e.length?e.every(j)?x:O(e,"management_routes")?y:O(e,"info_routes")?$:v:v],146512)},355619,e=>{"use strict";var t=e.i(602869);let l=async(e,l,n)=>{try{if(null===e||null===l)return;if(null!==n){let a=(await (0,t.modelAvailableCall)(n,e,l,!0,null,!0)).data.map(e=>e.id),r=[],i=[];return a.forEach(e=>{e.endsWith("/*")?r.push(e):i.push(e)}),[...r,...i]}}catch(e){console.error("Error fetching user models:",e)}};e.s(["excludeProxyWideSentinel",0,e=>e.filter(e=>"all-proxy-models"!==e),"fetchAvailableModelsForTeamOrKey",0,l,"getModelDisplayName",0,e=>{if("all-proxy-models"===e)return"All Proxy Models";if(e.endsWith("/*")){let t=e.replace("/*","");return`All ${t} models`}return e},"hasAllModelsSentinel",0,e=>e.includes("all-proxy-models")||e.includes("all-team-models"),"unfurlWildcardModelsInList",0,(e,t)=>{let l=[],n=[];return e.forEach(e=>{if(e.endsWith("/*")){let a=e.replace("/*",""),r=t.filter(e=>e.startsWith(a+"/"));n.push(...r),l.push(e)}else n.push(e)}),[...l,...n].filter((e,t,l)=>l.indexOf(e)===t)}])},622826,547227,964471,630500,e=>{"use strict";e.i(548151);var t=e.i(581070);e.i(200208),e.i(399536),e.i(997422);var l=e.i(843476),n=e.i(146512),a=e.i(355619),r=e.i(487486);let i="all-proxy-models",o=e=>{if(e===i)return"All Proxy Models";let t=(0,a.getModelDisplayName)(e);return t.length>30?`${t.slice(0,30)}...`:t};e.s(["ModelsCell",0,function({models:e,maxVisible:a=3,allowedRoutes:s,keyType:d}){if(!Array.isArray(e)||0===e.length){let e=(0,n.deriveKeyModelScope)(s,d);return e.hasModelAccess?(0,l.jsx)(r.Badge,{variant:"secondary",children:"All Proxy Models"}):(0,l.jsx)(t.CellTooltip,{content:`Scoped to ${e.label} routes; this key cannot call any models`,trigger:(0,l.jsx)(r.Badge,{variant:"secondary",className:"cursor-default",children:"No model access"})})}let c=e.slice(0,a),u=e.slice(a);return(0,l.jsxs)("div",{className:"flex flex-wrap items-center gap-1",children:[c.map((e,t)=>(0,l.jsx)(r.Badge,{variant:e===i?"secondary":"outline",children:o(e)},t)),u.length>0&&(0,l.jsx)(t.CellTooltip,{content:(0,l.jsx)("div",{className:"flex max-w-[280px] flex-col gap-0.5",children:u.map((e,t)=>(0,l.jsx)("span",{children:o(e)},t))}),trigger:(0,l.jsxs)(r.Badge,{variant:"outline",className:"cursor-default",children:["+",u.length," more"]})})]})}],547227);var s=e.i(500330);e.s(["MoneyCell",0,function({value:e,decimals:t=4,emptyText:n="-",showZero:a=!1}){return null==e||Number.isNaN(e)?(0,l.jsx)("span",{className:"text-muted-foreground",children:n}):0===e?a?(0,l.jsx)("span",{className:"whitespace-nowrap",children:`$${(0,s.formatNumberWithCommas)(0,t,!1,!0)}`}):(0,l.jsx)("span",{className:"text-muted-foreground",children:"-"}):(0,l.jsx)("span",{className:"whitespace-nowrap",children:(0,s.getSpendString)(e,t)})}],964471);var d=e.i(944835);e.s(["SpendBudgetCell",0,function({spend:e,maxBudget:t,teamMaxBudget:n}){let a="number"!=typeof e||Number.isNaN(e)?0:e,r=t??n??null,i=null==t&&null!=n,o="number"==typeof r&&r>0,c=o?a/r*100:0,u=a>0?(0,s.getSpendString)(a,4):"$0.00",g=null===r?"· Unlimited":`of $${(0,s.formatNumberWithCommas)(r)}${i?" (Team)":""}`;return(0,l.jsxs)("div",{className:"flex min-w-[130px] flex-col gap-1",children:[(0,l.jsxs)("div",{className:"whitespace-nowrap text-xs",children:[(0,l.jsx)("span",{className:"font-medium tabular-nums text-foreground",children:u})," ",(0,l.jsx)("span",{className:"text-muted-foreground",children:g})]}),o&&(0,l.jsx)(d.Meter,{value:a,max:r,"aria-valuetext":`${u} of $${(0,s.formatNumberWithCommas)(r)}`,children:(0,l.jsx)(d.MeterTrack,{children:(0,l.jsx)(d.MeterIndicator,{tone:c>100?"over":c>=80?"warning":"default"})})})]})}],630500),e.i(112179),e.s([],622826)},233565,e=>{"use strict";var t=e.i(246349);e.s(["ChevronRightIcon",()=>t.default])},270377,e=>{"use strict";e.i(247167);var t=e.i(931067),l=e.i(271645);let n={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M512 64C264.6 64 64 264.6 64 512s200.6 448 448 448 448-200.6 448-448S759.4 64 512 64zm0 820c-205.4 0-372-166.6-372-372s166.6-372 372-372 372 166.6 372 372-166.6 372-372 372z"}},{tag:"path",attrs:{d:"M464 688a48 48 0 1096 0 48 48 0 10-96 0zm24-112h48c4.4 0 8-3.6 8-8V296c0-4.4-3.6-8-8-8h-48c-4.4 0-8 3.6-8 8v272c0 4.4 3.6 8 8 8z"}}]},name:"exclamation-circle",theme:"outlined"};var a=e.i(9583),r=l.forwardRef(function(e,r){return l.createElement(a.default,(0,t.default)({},e,{ref:r,icon:n}))});e.s(["ExclamationCircleOutlined",0,r],270377)},175712,e=>{"use strict";e.i(247167);var t=e.i(271645),l=e.i(343794),n=e.i(529681),a=e.i(242064),r=e.i(517455),i=e.i(185793),o=e.i(721369),s=function(e,t){var l={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(l[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var a=0,n=Object.getOwnPropertySymbols(e);at.indexOf(n[a])&&Object.prototype.propertyIsEnumerable.call(e,n[a])&&(l[n[a]]=e[n[a]]);return l};let d=e=>{var{prefixCls:n,className:r,hoverable:i=!0}=e,o=s(e,["prefixCls","className","hoverable"]);let{getPrefixCls:d}=t.useContext(a.ConfigContext),c=d("card",n),u=(0,l.default)(`${c}-grid`,r,{[`${c}-grid-hoverable`]:i});return t.createElement("div",Object.assign({},o,{className:u}))};e.i(296059);var c=e.i(915654),u=e.i(183293),g=e.i(246422),m=e.i(838378);let b=(0,g.genStyleHooks)("Card",e=>{let t=(0,m.mergeToken)(e,{cardShadow:e.boxShadowCard,cardHeadPadding:e.padding,cardPaddingBase:e.paddingLG,cardActionsIconSize:e.fontSize});return[(e=>{let{componentCls:t,cardShadow:l,cardHeadPadding:n,colorBorderSecondary:a,boxShadowTertiary:r,bodyPadding:i,extraColor:o}=e;return{[t]:Object.assign(Object.assign({},(0,u.resetComponent)(e)),{position:"relative",background:e.colorBgContainer,borderRadius:e.borderRadiusLG,[`&:not(${t}-bordered)`]:{boxShadow:r},[`${t}-head`]:(e=>{let{antCls:t,componentCls:l,headerHeight:n,headerPadding:a,tabsMarginBottom:r}=e;return Object.assign(Object.assign({display:"flex",justifyContent:"center",flexDirection:"column",minHeight:n,marginBottom:-1,padding:`0 ${(0,c.unit)(a)}`,color:e.colorTextHeading,fontWeight:e.fontWeightStrong,fontSize:e.headerFontSize,background:e.headerBg,borderBottom:`${(0,c.unit)(e.lineWidth)} ${e.lineType} ${e.colorBorderSecondary}`,borderRadius:`${(0,c.unit)(e.borderRadiusLG)} ${(0,c.unit)(e.borderRadiusLG)} 0 0`},(0,u.clearFix)()),{"&-wrapper":{width:"100%",display:"flex",alignItems:"center"},"&-title":Object.assign(Object.assign({display:"inline-block",flex:1},u.textEllipsis),{[` + > ${l}-typography, + > ${l}-typography-edit-content + `]:{insetInlineStart:0,marginTop:0,marginBottom:0}}),[`${t}-tabs-top`]:{clear:"both",marginBottom:r,color:e.colorText,fontWeight:"normal",fontSize:e.fontSize,"&-bar":{borderBottom:`${(0,c.unit)(e.lineWidth)} ${e.lineType} ${e.colorBorderSecondary}`}}})})(e),[`${t}-extra`]:{marginInlineStart:"auto",color:o,fontWeight:"normal",fontSize:e.fontSize},[`${t}-body`]:{padding:i,borderRadius:`0 0 ${(0,c.unit)(e.borderRadiusLG)} ${(0,c.unit)(e.borderRadiusLG)}`},[`${t}-grid`]:(e=>{let{cardPaddingBase:t,colorBorderSecondary:l,cardShadow:n,lineWidth:a}=e;return{width:"33.33%",padding:t,border:0,borderRadius:0,boxShadow:` + ${(0,c.unit)(a)} 0 0 0 ${l}, + 0 ${(0,c.unit)(a)} 0 0 ${l}, + ${(0,c.unit)(a)} ${(0,c.unit)(a)} 0 0 ${l}, + ${(0,c.unit)(a)} 0 0 0 ${l} inset, + 0 ${(0,c.unit)(a)} 0 0 ${l} inset; + `,transition:`all ${e.motionDurationMid}`,"&-hoverable:hover":{position:"relative",zIndex:1,boxShadow:n}}})(e),[`${t}-cover`]:{"> *":{display:"block",width:"100%",borderRadius:`${(0,c.unit)(e.borderRadiusLG)} ${(0,c.unit)(e.borderRadiusLG)} 0 0`}},[`${t}-actions`]:(e=>{let{componentCls:t,iconCls:l,actionsLiMargin:n,cardActionsIconSize:a,colorBorderSecondary:r,actionsBg:i}=e;return Object.assign(Object.assign({margin:0,padding:0,listStyle:"none",background:i,borderTop:`${(0,c.unit)(e.lineWidth)} ${e.lineType} ${r}`,display:"flex",borderRadius:`0 0 ${(0,c.unit)(e.borderRadiusLG)} ${(0,c.unit)(e.borderRadiusLG)}`},(0,u.clearFix)()),{"& > li":{margin:n,color:e.colorTextDescription,textAlign:"center","> span":{position:"relative",display:"block",minWidth:e.calc(e.cardActionsIconSize).mul(2).equal(),fontSize:e.fontSize,lineHeight:e.lineHeight,cursor:"pointer","&:hover":{color:e.colorPrimary,transition:`color ${e.motionDurationMid}`},[`a:not(${t}-btn), > ${l}`]:{display:"inline-block",width:"100%",color:e.colorIcon,lineHeight:(0,c.unit)(e.fontHeight),transition:`color ${e.motionDurationMid}`,"&:hover":{color:e.colorPrimary}},[`> ${l}`]:{fontSize:a,lineHeight:(0,c.unit)(e.calc(a).mul(e.lineHeight).equal())}},"&:not(:last-child)":{borderInlineEnd:`${(0,c.unit)(e.lineWidth)} ${e.lineType} ${r}`}}})})(e),[`${t}-meta`]:Object.assign(Object.assign({margin:`${(0,c.unit)(e.calc(e.marginXXS).mul(-1).equal())} 0`,display:"flex"},(0,u.clearFix)()),{"&-avatar":{paddingInlineEnd:e.padding},"&-detail":{overflow:"hidden",flex:1,"> div:not(:last-child)":{marginBottom:e.marginXS}},"&-title":Object.assign({color:e.colorTextHeading,fontWeight:e.fontWeightStrong,fontSize:e.fontSizeLG},u.textEllipsis),"&-description":{color:e.colorTextDescription}})}),[`${t}-bordered`]:{border:`${(0,c.unit)(e.lineWidth)} ${e.lineType} ${a}`,[`${t}-cover`]:{marginTop:-1,marginInlineStart:-1,marginInlineEnd:-1}},[`${t}-hoverable`]:{cursor:"pointer",transition:`box-shadow ${e.motionDurationMid}, border-color ${e.motionDurationMid}`,"&:hover":{borderColor:"transparent",boxShadow:l}},[`${t}-contain-grid`]:{borderRadius:`${(0,c.unit)(e.borderRadiusLG)} ${(0,c.unit)(e.borderRadiusLG)} 0 0 `,[`${t}-body`]:{display:"flex",flexWrap:"wrap"},[`&:not(${t}-loading) ${t}-body`]:{marginBlockStart:e.calc(e.lineWidth).mul(-1).equal(),marginInlineStart:e.calc(e.lineWidth).mul(-1).equal(),padding:0}},[`${t}-contain-tabs`]:{[`> div${t}-head`]:{minHeight:0,[`${t}-head-title, ${t}-extra`]:{paddingTop:n}}},[`${t}-type-inner`]:(e=>{let{componentCls:t,colorFillAlter:l,headerPadding:n,bodyPadding:a}=e;return{[`${t}-head`]:{padding:`0 ${(0,c.unit)(n)}`,background:l,"&-title":{fontSize:e.fontSize}},[`${t}-body`]:{padding:`${(0,c.unit)(e.padding)} ${(0,c.unit)(a)}`}}})(e),[`${t}-loading`]:(e=>{let{componentCls:t}=e;return{overflow:"hidden",[`${t}-body`]:{userSelect:"none"}}})(e),[`${t}-rtl`]:{direction:"rtl"}}})(t),(e=>{let{componentCls:t,bodyPaddingSM:l,headerPaddingSM:n,headerHeightSM:a,headerFontSizeSM:r}=e;return{[`${t}-small`]:{[`> ${t}-head`]:{minHeight:a,padding:`0 ${(0,c.unit)(n)}`,fontSize:r,[`> ${t}-head-wrapper`]:{[`> ${t}-extra`]:{fontSize:e.fontSize}}},[`> ${t}-body`]:{padding:l}},[`${t}-small${t}-contain-tabs`]:{[`> ${t}-head`]:{[`${t}-head-title, ${t}-extra`]:{paddingTop:0,display:"flex",alignItems:"center"}}}}})(t)]},e=>{var t,l;return{headerBg:"transparent",headerFontSize:e.fontSizeLG,headerFontSizeSM:e.fontSize,headerHeight:e.fontSizeLG*e.lineHeightLG+2*e.padding,headerHeightSM:e.fontSize*e.lineHeight+2*e.paddingXS,actionsBg:e.colorBgContainer,actionsLiMargin:`${e.paddingSM}px 0`,tabsMarginBottom:-e.padding-e.lineWidth,extraColor:e.colorText,bodyPaddingSM:12,headerPaddingSM:12,bodyPadding:null!=(t=e.bodyPadding)?t:e.paddingLG,headerPadding:null!=(l=e.headerPadding)?l:e.paddingLG}});var p=e.i(792812),f=function(e,t){var l={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(l[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var a=0,n=Object.getOwnPropertySymbols(e);at.indexOf(n[a])&&Object.prototype.propertyIsEnumerable.call(e,n[a])&&(l[n[a]]=e[n[a]]);return l};let h=e=>{let{actionClasses:l,actions:n=[],actionStyle:a}=e;return t.createElement("ul",{className:l,style:a},n.map((e,l)=>{let a=`action-${l}`;return t.createElement("li",{style:{width:`${100/n.length}%`},key:a},t.createElement("span",null,e))}))},y=t.forwardRef((e,s)=>{let c,{prefixCls:u,className:g,rootClassName:m,style:y,extra:$,headStyle:x={},bodyStyle:v={},title:j,loading:O,bordered:C,variant:S,size:w,type:N,cover:k,actions:E,tabList:M,children:T,activeTabKey:B,defaultActiveTabKey:z,tabBarExtraContent:P,hoverable:A,tabProps:I={},classNames:R,styles:L}=e,H=f(e,["prefixCls","className","rootClassName","style","extra","headStyle","bodyStyle","title","loading","bordered","variant","size","type","cover","actions","tabList","children","activeTabKey","defaultActiveTabKey","tabBarExtraContent","hoverable","tabProps","classNames","styles"]),{getPrefixCls:W,direction:q,card:F}=t.useContext(a.ConfigContext),[G]=(0,p.default)("card",S,C),D=e=>{var t;return(0,l.default)(null==(t=null==F?void 0:F.classNames)?void 0:t[e],null==R?void 0:R[e])},K=e=>{var t;return Object.assign(Object.assign({},null==(t=null==F?void 0:F.styles)?void 0:t[e]),null==L?void 0:L[e])},X=t.useMemo(()=>{let e=!1;return t.Children.forEach(T,t=>{(null==t?void 0:t.type)===d&&(e=!0)}),e},[T]),Q=W("card",u),[_,U,J]=b(Q),Y=t.createElement(i.default,{loading:!0,active:!0,paragraph:{rows:4},title:!1},T),V=void 0!==B,Z=Object.assign(Object.assign({},I),{[V?"activeKey":"defaultActiveKey"]:V?B:z,tabBarExtraContent:P}),ee=(0,r.default)(w),et=ee&&"default"!==ee?ee:"large",el=M?t.createElement(o.default,Object.assign({size:et},Z,{className:`${Q}-head-tabs`,onChange:t=>{var l;null==(l=e.onTabChange)||l.call(e,t)},items:M.map(e=>{var{tab:t}=e;return Object.assign({label:t},f(e,["tab"]))})})):null;if(j||$||el){let e=(0,l.default)(`${Q}-head`,D("header")),n=(0,l.default)(`${Q}-head-title`,D("title")),a=(0,l.default)(`${Q}-extra`,D("extra")),r=Object.assign(Object.assign({},x),K("header"));c=t.createElement("div",{className:e,style:r},t.createElement("div",{className:`${Q}-head-wrapper`},j&&t.createElement("div",{className:n,style:K("title")},j),$&&t.createElement("div",{className:a,style:K("extra")},$)),el)}let en=(0,l.default)(`${Q}-cover`,D("cover")),ea=k?t.createElement("div",{className:en,style:K("cover")},k):null,er=(0,l.default)(`${Q}-body`,D("body")),ei=Object.assign(Object.assign({},v),K("body")),eo=t.createElement("div",{className:er,style:ei},O?Y:T),es=(0,l.default)(`${Q}-actions`,D("actions")),ed=(null==E?void 0:E.length)?t.createElement(h,{actionClasses:es,actionStyle:K("actions"),actions:E}):null,ec=(0,n.default)(H,["onTabChange"]),eu=(0,l.default)(Q,null==F?void 0:F.className,{[`${Q}-loading`]:O,[`${Q}-bordered`]:"borderless"!==G,[`${Q}-hoverable`]:A,[`${Q}-contain-grid`]:X,[`${Q}-contain-tabs`]:null==M?void 0:M.length,[`${Q}-${ee}`]:ee,[`${Q}-type-${N}`]:!!N,[`${Q}-rtl`]:"rtl"===q},g,m,U,J),eg=Object.assign(Object.assign({},null==F?void 0:F.style),y);return _(t.createElement("div",Object.assign({ref:s},ec,{className:eu,style:eg}),c,ea,eo,ed))});var $=function(e,t){var l={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(l[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var a=0,n=Object.getOwnPropertySymbols(e);at.indexOf(n[a])&&Object.prototype.propertyIsEnumerable.call(e,n[a])&&(l[n[a]]=e[n[a]]);return l};y.Grid=d,y.Meta=e=>{let{prefixCls:n,className:r,avatar:i,title:o,description:s}=e,d=$(e,["prefixCls","className","avatar","title","description"]),{getPrefixCls:c}=t.useContext(a.ConfigContext),u=c("card",n),g=(0,l.default)(`${u}-meta`,r),m=i?t.createElement("div",{className:`${u}-meta-avatar`},i):null,b=o?t.createElement("div",{className:`${u}-meta-title`},o):null,p=s?t.createElement("div",{className:`${u}-meta-description`},s):null,f=b||p?t.createElement("div",{className:`${u}-meta-detail`},b,p):null;return t.createElement("div",Object.assign({},d,{className:g}),m,f)},e.s(["Card",0,y],175712)},869216,e=>{"use strict";e.i(247167);var t=e.i(271645),l=e.i(343794),n=e.i(908206),a=e.i(242064),r=e.i(517455),i=e.i(150073);let o={xxl:3,xl:3,lg:3,md:3,sm:2,xs:1},s=t.default.createContext({});var d=e.i(876556),c=function(e,t){var l={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(l[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var a=0,n=Object.getOwnPropertySymbols(e);at.indexOf(n[a])&&Object.prototype.propertyIsEnumerable.call(e,n[a])&&(l[n[a]]=e[n[a]]);return l},u=function(e,t){var l={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(l[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var a=0,n=Object.getOwnPropertySymbols(e);at.indexOf(n[a])&&Object.prototype.propertyIsEnumerable.call(e,n[a])&&(l[n[a]]=e[n[a]]);return l};let g=e=>{let{itemPrefixCls:n,component:a,span:r,className:i,style:o,labelStyle:d,contentStyle:c,bordered:u,label:g,content:m,colon:b,type:p,styles:f}=e,{classNames:h}=t.useContext(s),y=Object.assign(Object.assign({},d),null==f?void 0:f.label),$=Object.assign(Object.assign({},c),null==f?void 0:f.content);if(u)return t.createElement(a,{colSpan:r,style:o,className:(0,l.default)(i,{[`${n}-item-${p}`]:"label"===p||"content"===p,[null==h?void 0:h.label]:(null==h?void 0:h.label)&&"label"===p,[null==h?void 0:h.content]:(null==h?void 0:h.content)&&"content"===p})},null!=g&&t.createElement("span",{style:y},g),null!=m&&t.createElement("span",{style:$},m));return t.createElement(a,{colSpan:r,style:o,className:(0,l.default)(`${n}-item`,i)},t.createElement("div",{className:`${n}-item-container`},null!=g&&t.createElement("span",{style:y,className:(0,l.default)(`${n}-item-label`,null==h?void 0:h.label,{[`${n}-item-no-colon`]:!b})},g),null!=m&&t.createElement("span",{style:$,className:(0,l.default)(`${n}-item-content`,null==h?void 0:h.content)},m)))};function m(e,{colon:l,prefixCls:n,bordered:a},{component:r,type:i,showLabel:o,showContent:s,labelStyle:d,contentStyle:c,styles:u}){return e.map(({label:e,children:m,prefixCls:b=n,className:p,style:f,labelStyle:h,contentStyle:y,span:$=1,key:x,styles:v},j)=>"string"==typeof r?t.createElement(g,{key:`${i}-${x||j}`,className:p,style:f,styles:{label:Object.assign(Object.assign(Object.assign(Object.assign({},d),null==u?void 0:u.label),h),null==v?void 0:v.label),content:Object.assign(Object.assign(Object.assign(Object.assign({},c),null==u?void 0:u.content),y),null==v?void 0:v.content)},span:$,colon:l,component:r,itemPrefixCls:b,bordered:a,label:o?e:null,content:s?m:null,type:i}):[t.createElement(g,{key:`label-${x||j}`,className:p,style:Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},d),null==u?void 0:u.label),f),h),null==v?void 0:v.label),span:1,colon:l,component:r[0],itemPrefixCls:b,bordered:a,label:e,type:"label"}),t.createElement(g,{key:`content-${x||j}`,className:p,style:Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},c),null==u?void 0:u.content),f),y),null==v?void 0:v.content),span:2*$-1,component:r[1],itemPrefixCls:b,bordered:a,content:m,type:"content"})])}let b=e=>{let l=t.useContext(s),{prefixCls:n,vertical:a,row:r,index:i,bordered:o}=e;return a?t.createElement(t.Fragment,null,t.createElement("tr",{key:`label-${i}`,className:`${n}-row`},m(r,e,Object.assign({component:"th",type:"label",showLabel:!0},l))),t.createElement("tr",{key:`content-${i}`,className:`${n}-row`},m(r,e,Object.assign({component:"td",type:"content",showContent:!0},l)))):t.createElement("tr",{key:i,className:`${n}-row`},m(r,e,Object.assign({component:o?["th","td"]:"td",type:"item",showLabel:!0,showContent:!0},l)))};e.i(296059);var p=e.i(915654),f=e.i(183293),h=e.i(246422),y=e.i(838378);let $=(0,h.genStyleHooks)("Descriptions",e=>(e=>{let{componentCls:t,extraColor:l,itemPaddingBottom:n,itemPaddingEnd:a,colonMarginRight:r,colonMarginLeft:i,titleMarginBottom:o}=e;return{[t]:Object.assign(Object.assign(Object.assign({},(0,f.resetComponent)(e)),(e=>{let{componentCls:t,labelBg:l}=e;return{[`&${t}-bordered`]:{[`> ${t}-view`]:{border:`${(0,p.unit)(e.lineWidth)} ${e.lineType} ${e.colorSplit}`,"> table":{tableLayout:"auto"},[`${t}-row`]:{borderBottom:`${(0,p.unit)(e.lineWidth)} ${e.lineType} ${e.colorSplit}`,"&:first-child":{"> th:first-child, > td:first-child":{borderStartStartRadius:e.borderRadiusLG}},"&:last-child":{borderBottom:"none","> th:first-child, > td:first-child":{borderEndStartRadius:e.borderRadiusLG}},[`> ${t}-item-label, > ${t}-item-content`]:{padding:`${(0,p.unit)(e.padding)} ${(0,p.unit)(e.paddingLG)}`,borderInlineEnd:`${(0,p.unit)(e.lineWidth)} ${e.lineType} ${e.colorSplit}`,"&:last-child":{borderInlineEnd:"none"}},[`> ${t}-item-label`]:{color:e.colorTextSecondary,backgroundColor:l,"&::after":{display:"none"}}}},[`&${t}-middle`]:{[`${t}-row`]:{[`> ${t}-item-label, > ${t}-item-content`]:{padding:`${(0,p.unit)(e.paddingSM)} ${(0,p.unit)(e.paddingLG)}`}}},[`&${t}-small`]:{[`${t}-row`]:{[`> ${t}-item-label, > ${t}-item-content`]:{padding:`${(0,p.unit)(e.paddingXS)} ${(0,p.unit)(e.padding)}`}}}}}})(e)),{"&-rtl":{direction:"rtl"},[`${t}-header`]:{display:"flex",alignItems:"center",marginBottom:o},[`${t}-title`]:Object.assign(Object.assign({},f.textEllipsis),{flex:"auto",color:e.titleColor,fontWeight:e.fontWeightStrong,fontSize:e.fontSizeLG,lineHeight:e.lineHeightLG}),[`${t}-extra`]:{marginInlineStart:"auto",color:l,fontSize:e.fontSize},[`${t}-view`]:{width:"100%",borderRadius:e.borderRadiusLG,table:{width:"100%",tableLayout:"fixed",borderCollapse:"collapse"}},[`${t}-row`]:{"> th, > td":{paddingBottom:n,paddingInlineEnd:a},"> th:last-child, > td:last-child":{paddingInlineEnd:0},"&:last-child":{borderBottom:"none","> th, > td":{paddingBottom:0}}},[`${t}-item-label`]:{color:e.labelColor,fontWeight:"normal",fontSize:e.fontSize,lineHeight:e.lineHeight,textAlign:"start","&::after":{content:'":"',position:"relative",top:-.5,marginInline:`${(0,p.unit)(i)} ${(0,p.unit)(r)}`},[`&${t}-item-no-colon::after`]:{content:'""'}},[`${t}-item-no-label`]:{"&::after":{margin:0,content:'""'}},[`${t}-item-content`]:{display:"table-cell",flex:1,color:e.contentColor,fontSize:e.fontSize,lineHeight:e.lineHeight,wordBreak:"break-word",overflowWrap:"break-word"},[`${t}-item`]:{paddingBottom:0,verticalAlign:"top","&-container":{display:"flex",[`${t}-item-label`]:{display:"inline-flex",alignItems:"baseline"},[`${t}-item-content`]:{display:"inline-flex",alignItems:"baseline",minWidth:"1em"}}},"&-middle":{[`${t}-row`]:{"> th, > td":{paddingBottom:e.paddingSM}}},"&-small":{[`${t}-row`]:{"> th, > td":{paddingBottom:e.paddingXS}}}})}})((0,y.mergeToken)(e,{})),e=>({labelBg:e.colorFillAlter,labelColor:e.colorTextTertiary,titleColor:e.colorText,titleMarginBottom:e.fontSizeSM*e.lineHeightSM,itemPaddingBottom:e.padding,itemPaddingEnd:e.padding,colonMarginRight:e.marginXS,colonMarginLeft:e.marginXXS/2,contentColor:e.colorText,extraColor:e.colorText}));var x=function(e,t){var l={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&0>t.indexOf(n)&&(l[n]=e[n]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var a=0,n=Object.getOwnPropertySymbols(e);at.indexOf(n[a])&&Object.prototype.propertyIsEnumerable.call(e,n[a])&&(l[n[a]]=e[n[a]]);return l};let v=e=>{let g,{prefixCls:m,title:p,extra:f,column:h,colon:y=!0,bordered:v,layout:j,children:O,className:C,rootClassName:S,style:w,size:N,labelStyle:k,contentStyle:E,styles:M,items:T,classNames:B}=e,z=x(e,["prefixCls","title","extra","column","colon","bordered","layout","children","className","rootClassName","style","size","labelStyle","contentStyle","styles","items","classNames"]),{getPrefixCls:P,direction:A,className:I,style:R,classNames:L,styles:H}=(0,a.useComponentConfig)("descriptions"),W=P("descriptions",m),q=(0,i.default)(),F=t.useMemo(()=>{var e;return"number"==typeof h?h:null!=(e=(0,n.matchScreen)(q,Object.assign(Object.assign({},o),h)))?e:3},[q,h]),G=(g=t.useMemo(()=>T||(0,d.default)(O).map(e=>Object.assign(Object.assign({},null==e?void 0:e.props),{key:e.key})),[T,O]),t.useMemo(()=>g.map(e=>{var{span:t}=e,l=c(e,["span"]);return"filled"===t?Object.assign(Object.assign({},l),{filled:!0}):Object.assign(Object.assign({},l),{span:"number"==typeof t?t:(0,n.matchScreen)(q,t)})}),[g,q])),D=(0,r.default)(N),K=((e,l)=>{let[n,a]=(0,t.useMemo)(()=>{let t,n,a,r;return t=[],n=[],a=!1,r=0,l.filter(e=>e).forEach(l=>{let{filled:i}=l,o=u(l,["filled"]);if(i){n.push(o),t.push(n),n=[],r=0;return}let s=e-r;(r+=l.span||1)>=e?(r>e?(a=!0,n.push(Object.assign(Object.assign({},o),{span:s}))):n.push(o),t.push(n),n=[],r=0):n.push(o)}),n.length>0&&t.push(n),[t=t.map(t=>{let l=t.reduce((e,t)=>e+(t.span||1),0);if(l({labelStyle:k,contentStyle:E,styles:{content:Object.assign(Object.assign({},H.content),null==M?void 0:M.content),label:Object.assign(Object.assign({},H.label),null==M?void 0:M.label)},classNames:{label:(0,l.default)(L.label,null==B?void 0:B.label),content:(0,l.default)(L.content,null==B?void 0:B.content)}}),[k,E,M,B,L,H]);return X(t.createElement(s.Provider,{value:U},t.createElement("div",Object.assign({className:(0,l.default)(W,I,L.root,null==B?void 0:B.root,{[`${W}-${D}`]:D&&"default"!==D,[`${W}-bordered`]:!!v,[`${W}-rtl`]:"rtl"===A},C,S,Q,_),style:Object.assign(Object.assign(Object.assign(Object.assign({},R),H.root),null==M?void 0:M.root),w)},z),(p||f)&&t.createElement("div",{className:(0,l.default)(`${W}-header`,L.header,null==B?void 0:B.header),style:Object.assign(Object.assign({},H.header),null==M?void 0:M.header)},p&&t.createElement("div",{className:(0,l.default)(`${W}-title`,L.title,null==B?void 0:B.title),style:Object.assign(Object.assign({},H.title),null==M?void 0:M.title)},p),f&&t.createElement("div",{className:(0,l.default)(`${W}-extra`,L.extra,null==B?void 0:B.extra),style:Object.assign(Object.assign({},H.extra),null==M?void 0:M.extra)},f)),t.createElement("div",{className:`${W}-view`},t.createElement("table",null,t.createElement("tbody",null,K.map((e,l)=>t.createElement(b,{key:l,index:l,colon:y,prefixCls:W,vertical:"vertical"===j,bordered:v,row:e}))))))))};v.Item=({children:e})=>e,e.s(["Descriptions",0,v],869216)},368869,e=>{"use strict";e.i(296059);var t=e.i(868297),l=e.i(732961),n=e.i(289882),a=e.i(170517),r=e.i(628882),i=e.i(320890),o=e.i(104458),s=e.i(722319),d=e.i(8398),c=e.i(279728);e.i(765846);var u=e.i(602716),g=e.i(328052),m=e.i(135551);let b=(e,t)=>new m.FastColor(e).setA(t).toRgbString(),p=(e,t)=>new m.FastColor(e).lighten(t).toHexString(),f=e=>{let t=(0,u.generate)(e,{theme:"dark"});return{1:t[0],2:t[1],3:t[2],4:t[3],5:t[6],6:t[5],7:t[4],8:t[6],9:t[5],10:t[4]}},h=(e,t)=>{let l=e||"#000",n=t||"#fff";return{colorBgBase:l,colorTextBase:n,colorText:b(n,.85),colorTextSecondary:b(n,.65),colorTextTertiary:b(n,.45),colorTextQuaternary:b(n,.25),colorFill:b(n,.18),colorFillSecondary:b(n,.12),colorFillTertiary:b(n,.08),colorFillQuaternary:b(n,.04),colorBgSolid:b(n,.95),colorBgSolidHover:b(n,1),colorBgSolidActive:b(n,.9),colorBgElevated:p(l,12),colorBgContainer:p(l,8),colorBgLayout:p(l,0),colorBgSpotlight:p(l,26),colorBgBlur:b(n,.04),colorBorder:p(l,26),colorBorderSecondary:p(l,19)}},y={defaultSeed:i.defaultConfig.token,useToken:function(){let[e,t,l]=(0,o.useToken)();return{theme:e,token:t,hashId:l}},defaultAlgorithm:s.default,darkAlgorithm:(e,t)=>{let l=Object.keys(a.defaultPresetColors).map(t=>{let l=(0,u.generate)(e[t],{theme:"dark"});return Array.from({length:10},()=>1).reduce((e,n,a)=>(e[`${t}-${a+1}`]=l[a],e[`${t}${a+1}`]=l[a],e),{})}).reduce((e,t)=>e=Object.assign(Object.assign({},e),t),{}),n=null!=t?t:(0,s.default)(e),r=(0,g.default)(e,{generateColorPalettes:f,generateNeutralColorPalettes:h});return Object.assign(Object.assign(Object.assign(Object.assign({},n),l),r),{colorPrimaryBg:r.colorPrimaryBorder,colorPrimaryBgHover:r.colorPrimaryBorderHover})},compactAlgorithm:(e,t)=>{let l=null!=t?t:(0,s.default)(e),n=l.fontSizeSM,a=l.controlHeight-4;return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},l),function(e){let{sizeUnit:t,sizeStep:l}=e,n=l-2;return{sizeXXL:t*(n+10),sizeXL:t*(n+6),sizeLG:t*(n+2),sizeMD:t*(n+2),sizeMS:t*(n+1),size:t*n,sizeSM:t*n,sizeXS:t*(n-1),sizeXXS:t*(n-1)}}(null!=t?t:e)),(0,c.default)(n)),{controlHeight:a}),(0,d.default)(Object.assign(Object.assign({},l),{controlHeight:a})))},getDesignToken:e=>{let i=(null==e?void 0:e.algorithm)?(0,t.createTheme)(e.algorithm):n.default,o=Object.assign(Object.assign({},a.default),null==e?void 0:e.token);return(0,l.getComputedToken)(o,{override:null==e?void 0:e.token},i,r.default)},defaultConfig:i.defaultConfig,_internalContext:i.DesignTokenContext};e.s(["theme",0,y],368869)},127952,e=>{"use strict";var t=e.i(843476),l=e.i(560445),n=e.i(175712),a=e.i(869216),r=e.i(311451),i=e.i(212931),o=e.i(898586),s=e.i(368869),d=e.i(270377),c=e.i(271645);e.s(["default",0,function({isOpen:e,title:u,alertMessage:g,message:m,resourceInformationTitle:b,resourceInformation:p,onCancel:f,onOk:h,confirmLoading:y,requiredConfirmation:$}){let{Title:x,Text:v}=o.Typography,{token:j}=s.theme.useToken(),[O,C]=(0,c.useState)("");return(0,c.useEffect)(()=>{e&&C("")},[e]),(0,t.jsx)(i.Modal,{title:u,open:e,onOk:h,onCancel:f,confirmLoading:y,okText:y?"Deleting...":"Delete",cancelText:"Cancel",okButtonProps:{danger:!0,disabled:!!$&&O!==$||y},cancelButtonProps:{disabled:y},children:(0,t.jsxs)("div",{className:"space-y-4",children:[g&&(0,t.jsx)(l.Alert,{message:g,type:"warning"}),(0,t.jsx)(n.Card,{title:b,className:"mt-4",styles:{body:{padding:"16px"},header:{backgroundColor:j.colorErrorBg,borderColor:j.colorErrorBorder}},style:{backgroundColor:j.colorErrorBg,borderColor:j.colorErrorBorder},children:(0,t.jsx)(a.Descriptions,{column:1,size:"small",children:p&&p.map(({label:e,value:l,...n})=>(0,t.jsx)(a.Descriptions.Item,{label:(0,t.jsx)("span",{className:"font-semibold",children:e}),children:(0,t.jsx)(v,{...n,children:l??"-"})},e))})}),(0,t.jsx)("div",{children:(0,t.jsx)(v,{children:m})}),$&&(0,t.jsxs)("div",{className:"mb-6 mt-4 pt-4 border-t border-gray-200 dark:border-gray-700",children:[(0,t.jsxs)(v,{className:"block text-base font-medium text-gray-700 dark:text-gray-300 mb-2",children:[(0,t.jsx)(v,{children:"Type "}),(0,t.jsx)(v,{strong:!0,type:"danger",children:$}),(0,t.jsx)(v,{children:" to confirm deletion:"})]}),(0,t.jsx)(r.Input,{value:O,onChange:e=>C(e.target.value),placeholder:$,className:"rounded-md",prefix:(0,t.jsx)(d.ExclamationCircleOutlined,{style:{color:j.colorError}}),autoFocus:!0})]})]})})}])}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/030xj-a9q0ur8.js b/litellm/proxy/_experimental/out/_next/static/chunks/030xj-a9q0ur8.js new file mode 100644 index 00000000000..6ce670e2c9a --- /dev/null +++ b/litellm/proxy/_experimental/out/_next/static/chunks/030xj-a9q0ur8.js @@ -0,0 +1,68 @@ +(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,678784,e=>{"use strict";var t=e.i(678745);e.s(["CheckIcon",()=>t.default])},545356,e=>{"use strict";var t=e.i(271645);let o=t.createContext({register:()=>{},unregister:()=>{},subscribeMapChange:()=>()=>{},elementsRef:{current:[]},nextIndexRef:{current:0}});e.s(["CompositeListContext",0,o,"useCompositeListContext",0,function(){return t.useContext(o)}])},53687,e=>{"use strict";var t=e.i(271645),o=e.i(921374),r=e.i(667865),n=e.i(146376),a=e.i(545356),i=e.i(843476);function l(){return new Map}function s(){return new Set}function u(e,t){let o=e.compareDocumentPosition(t);return o&Node.DOCUMENT_POSITION_FOLLOWING||o&Node.DOCUMENT_POSITION_CONTAINED_BY?-1:o&Node.DOCUMENT_POSITION_PRECEDING||o&Node.DOCUMENT_POSITION_CONTAINS?1:0}e.s(["CompositeList",0,function(e){let{children:c,elementsRef:d,labelsRef:h,onMapChange:p}=e,f=(0,r.useStableCallback)(p),g=t.useRef(0),b=(0,o.useRefWithInit)(s).current,m=(0,o.useRefWithInit)(l).current,[v,k]=t.useState(0),x=t.useRef(v),y=(0,r.useStableCallback)((e,t)=>{m.set(e,t??null),x.current+=1,k(x.current)}),C=(0,r.useStableCallback)(e=>{m.delete(e),x.current+=1,k(x.current)}),w=t.useMemo(()=>{let e=new Map;return Array.from(m.keys()).filter(e=>e.isConnected).sort(u).forEach((t,o)=>{let r=m.get(t)??{};e.set(t,{...r,index:o})}),e},[m,v]);(0,n.useIsoLayoutEffect)(()=>{if("function"!=typeof MutationObserver||0===w.size)return;let e=new MutationObserver(e=>{let t=new Set,o=e=>t.has(e)?t.delete(e):t.add(e);e.forEach(e=>{e.removedNodes.forEach(o),e.addedNodes.forEach(o)}),0===t.size&&(x.current+=1,k(x.current))});return w.forEach((t,o)=>{o.parentElement&&e.observe(o.parentElement,{childList:!0})}),()=>{e.disconnect()}},[w]),(0,n.useIsoLayoutEffect)(()=>{x.current===v&&(d.current.length!==w.size&&(d.current.length=w.size),h&&h.current.length!==w.size&&(h.current.length=w.size),g.current=w.size),f(w)},[f,w,d,h,v]),(0,n.useIsoLayoutEffect)(()=>()=>{d.current=[]},[d]),(0,n.useIsoLayoutEffect)(()=>()=>{h&&(h.current=[])},[h]);let R=(0,r.useStableCallback)(e=>(b.add(e),()=>{b.delete(e)}));(0,n.useIsoLayoutEffect)(()=>{b.forEach(e=>e(w))},[b,w]);let S=t.useMemo(()=>({register:y,unregister:C,subscribeMapChange:R,elementsRef:d,labelsRef:h,nextIndexRef:g}),[y,C,R,d,h,g]);return(0,i.jsx)(a.CompositeListContext.Provider,{value:S,children:c})}])},673553,e=>{"use strict";var t,o=e.i(271645),r=e.i(146376),n=e.i(545356);let a=((t={})[t.None=0]="None",t[t.GuessFromOrder=1]="GuessFromOrder",t);e.s(["IndexGuessBehavior",0,a,"useCompositeListItem",0,function(e={}){let{label:t,metadata:i,textRef:l,indexGuessBehavior:s,index:u}=e,{register:c,unregister:d,subscribeMapChange:h,elementsRef:p,labelsRef:f,nextIndexRef:g}=(0,n.useCompositeListContext)(),b=o.useRef(-1),[m,v]=o.useState(u??(s===a.GuessFromOrder?()=>{if(-1===b.current){let e=g.current;g.current+=1,b.current=e}return b.current}:-1)),k=o.useRef(null),x=o.useCallback(e=>{if(k.current=e,-1!==m&&null!==e&&(p.current[m]=e,f)){let o=void 0!==t;f.current[m]=o?t:l?.current?.textContent??e.textContent}},[m,p,f,t,l]);return(0,r.useIsoLayoutEffect)(()=>{if(null!=u)return;let e=k.current;if(e)return c(e,i),()=>{d(e)}},[u,c,d,i]),(0,r.useIsoLayoutEffect)(()=>{if(null==u)return h(e=>{let t=k.current?e.get(k.current)?.index:null;null!=t&&v(t)})},[u,h,v]),{ref:x,index:m}}])},395530,e=>{"use strict";var t=e.i(271645),o=e.i(828918),r=e.i(838452),n=e.i(673553);e.s(["useCompositeItem",0,function(e={}){let{highlightItemOnHover:a,highlightedIndex:i,onHighlightedIndexChange:l}=(0,r.useCompositeRootContext)(),{ref:s,index:u}=(0,n.useCompositeListItem)(e),c=i===u,d=t.useRef(null),h=(0,o.useMergedRefs)(s,d);return{compositeProps:{tabIndex:c?0:-1,onFocus(){l(u)},onMouseMove(){let e=d.current;if(!a||!e)return;let t=e.hasAttribute("disabled")||"true"===e.ariaDisabled;c||t||e.focus()}},compositeRef:h,index:u}}])},590803,e=>{"use strict";e.s(["isElementDisabled",0,function(e){return null==e||e.hasAttribute("disabled")||"true"===e.getAttribute("aria-disabled")}])},677572,370359,405934,e=>{"use strict";var t,o,r,n=e.i(843476);e.s([],559657),e.i(559657),e.i(247167);var a=e.i(271645),i=e.i(951437),l=e.i(146376),s=e.i(667865),u=e.i(552245),c=e.i(53687),d=e.i(733332);let h=a.createContext(void 0);function p(){let e=a.useContext(h);if(void 0===e)throw Error((0,d.default)(64));return e}let f=((t={}).activationDirection="data-activation-direction",t.orientation="data-orientation",t),g={tabActivationDirection:e=>({[f.activationDirection]:e})};var b=e.i(675606),m=e.i(56434);let v=a.forwardRef(function(e,t){let{className:o,defaultValue:r=0,onValueChange:d,orientation:p="horizontal",render:f,value:v,style:x,...y}=e,C=void 0!==e.defaultValue,w=a.useRef([]),[R,S]=a.useState(()=>new Map),[I,E]=(0,i.useControlled)({controlled:v,default:r,name:"Tabs",state:"value"}),T=void 0!==v,[_,O]=a.useState(()=>new Map),A=a.useRef(void 0),L=a.useCallback(e=>{if(void 0===e)return null;for(let[t,o]of _.entries())if(null!=o&&e===(o.value??o.index))return t;return null},[_]),[M,N]=a.useState(()=>({previousValue:I,tabActivationDirection:"none"})),{previousValue:z,tabActivationDirection:j}=M,D=j,P=!1;z!==I&&(D=k(z,I,p,_),P=null!=z&&null!=I&&null==L(I));let W=P?z:I,H=z!==W||j!==D;(0,l.useIsoLayoutEffect)(()=>{H&&N({previousValue:W,tabActivationDirection:D})},[W,H,D]);let B=(0,s.useStableCallback)((e,t)=>{t.activationDirection=k(I,e,p,_),d?.(e,t),t.isCanceled||E(e)}),F=(0,s.useStableCallback)((e,t)=>{d?.(e,(0,b.createChangeEventDetails)(t,void 0,void 0,{activationDirection:"none"}))}),V=(0,s.useStableCallback)((e,t)=>{S(o=>{if(o.get(e)===t)return o;let r=new Map(o);return r.set(e,t),r})}),Y=(0,s.useStableCallback)((e,t)=>{S(o=>{if(!o.has(e)||o.get(e)!==t)return o;let r=new Map(o);return r.delete(e),r})}),K=a.useCallback(e=>R.get(e),[R]),U=a.useCallback(e=>{for(let t of _.values())if(e===t?.value)return t?.id},[_]),$=a.useMemo(()=>({getTabElementBySelectedValue:L,getTabIdByPanelValue:U,getTabPanelIdByValue:K,onValueChange:B,orientation:p,registerMountedTabPanel:V,setTabMap:O,unregisterMountedTabPanel:Y,tabActivationDirection:D,value:I}),[L,U,K,B,p,V,O,Y,D,I]),q=a.useMemo(()=>{for(let e of _.values())if(null!=e&&e.value===I)return e},[_,I]),G=a.useMemo(()=>{for(let e of _.values())if(null!=e&&!e.disabled)return e.value},[_]),X=a.useRef(!C),J=a.useRef(r),Z=a.useRef(C),Q=a.useRef(!1);(0,l.useIsoLayoutEffect)(()=>{if(T)return;function e(e,t){E(e),N(t=>t.previousValue===e&&"none"===t.tabActivationDirection?t:{previousValue:e,tabActivationDirection:"none"}),F(e,t),X.current=!1}if(0===_.size){Q.current&&null!==I&&!A.current?.isConnected&&e(null,m.REASONS.missing);return}Q.current=!0,A.current=_.keys().next().value;let t=q?.disabled,o=null==q&&null!==I;if(t||I!==J.current||(Z.current=!1),Z.current&&t&&I===J.current)return;let r=X.current;if(t||o){let o=G??null;if(I===o){X.current=!1;return}let n=m.REASONS.missing;r?n=m.REASONS.initial:t&&(n=m.REASONS.disabled),e(o,n);return}r&&null!=q&&(F(I,m.REASONS.initial),X.current=!1)},[G,T,F,q,E,_,I]);let ee={orientation:p,tabActivationDirection:D},et=(0,u.useRenderElement)("div",e,{state:ee,ref:t,props:y,stateAttributesMapping:g});return(0,n.jsx)(h.Provider,{value:$,children:(0,n.jsx)(c.CompositeList,{elementsRef:w,children:et})})});function k(e,t,o,r){if(null==e||null==t)return"none";let n=null,a=null;for(let[o,i]of r.entries()){if(null==i)continue;let r=i.value??i.index;if(e===r&&(n=o),t===r&&(a=o),null!=n&&null!=a)break}if(null==n||null==a)return n!==a&&("number"==typeof e||"string"==typeof e)&&typeof e==typeof t?"horizontal"===o?t>e?"right":"left":t>e?"down":"up":"none";let i=n.getBoundingClientRect(),l=a.getBoundingClientRect();if("horizontal"===o){if(l.lefti.left)return"right"}else{if(l.topi.top)return"down"}return"none"}var x=e.i(108868),y=e.i(788015),C=e.i(540886);let w="data-composite-item-active";e.s(["ACTIVE_COMPOSITE_ITEM",0,w],370359);var R=e.i(395530);let S=a.createContext(void 0);function I(){let e=a.useContext(S);if(void 0===e)throw Error((0,d.default)(65));return e}var E=e.i(647554);let T=a.forwardRef(function(e,t){let{className:o,disabled:r=!1,render:n,value:i,id:s,nativeButton:c=!0,style:d,...h}=e,{value:f,getTabPanelIdByValue:v,orientation:k,tabActivationDirection:S}=p(),{activateOnFocus:T,highlightedTabIndex:_,onTabActivation:O,registerTabResizeObserverElement:A,setHighlightedTabIndex:L,tabsListElement:M}=I(),N=(0,y.useBaseUiId)(s),z=a.useMemo(()=>({disabled:r,id:N,value:i}),[r,N,i]),{compositeProps:j,compositeRef:D,index:P}=(0,R.useCompositeItem)({metadata:z}),W=i===f,H=a.useRef(!1),B=a.useRef(null);(0,l.useIsoLayoutEffect)(()=>{let e=B.current;if(e)return A(e)},[A]),(0,l.useIsoLayoutEffect)(()=>{if(H.current){H.current=!1;return}if(W&&P>-1&&_!==P){if(null!=M){let e=(0,E.activeElement)((0,x.ownerDocument)(M));if(e&&(0,E.contains)(M,e))return}r||L(P)}},[W,P,_,L,r,M]);let{getButtonProps:F,buttonRef:V}=(0,C.useButton)({disabled:r,native:c,focusableWhenDisabled:!0}),Y=v(i),K=a.useRef(!1),U=a.useRef(!1);return(0,u.useRenderElement)("button",e,{state:{disabled:r,active:W,orientation:k,tabActivationDirection:S},ref:[t,V,D,B],props:[j,{role:"tab","aria-controls":Y,"aria-selected":W,id:N,onClick:function(e){W||r||O(i,(0,b.createChangeEventDetails)(m.REASONS.none,e.nativeEvent,void 0,{activationDirection:"none"}))},onFocus:function(e){W||(P>-1&&!r&&L(P),!r&&T&&(!K.current||K.current&&U.current)&&O(i,(0,b.createChangeEventDetails)(m.REASONS.none,e.nativeEvent,void 0,{activationDirection:"none"})))},onPointerDown:function(e){W||r||(K.current=!0,e.button&&0!==e.button||(U.current=!0,(0,x.ownerDocument)(e.currentTarget).addEventListener("pointerup",function(){K.current=!1,U.current=!1},{once:!0})))},[w]:W?"":void 0,onKeyDownCapture(){H.current=!0}},h,F],stateAttributesMapping:g})});var _=e.i(73364),O=e.i(802239),A=e.i(956789);function L(){return A.NOOP}function M(){return!1}function N(){return!0}let z=((o={}).activeTabLeft="--active-tab-left",o.activeTabRight="--active-tab-right",o.activeTabTop="--active-tab-top",o.activeTabBottom="--active-tab-bottom",o.activeTabWidth="--active-tab-width",o.activeTabHeight="--active-tab-height",o);var j=e.i(172410);let D={...g,activeTabPosition:()=>null,activeTabSize:()=>null},P=a.forwardRef(function(e,t){let{className:o,render:r,renderBeforeHydration:i=!1,style:l,...s}=e,{nonce:c}=(0,j.useCSPContext)(),{getTabElementBySelectedValue:d,orientation:h,tabActivationDirection:f,value:g}=p(),{tabsListElement:b,registerIndicatorUpdateListener:m}=I(),v=(0,O.useSyncExternalStore)(L,M,N),k=function(){let[,e]=a.useState({});return a.useCallback(()=>{e({})},[])}();a.useEffect(()=>m(k),[m,k]);let x=0,y=0,C=0,w=0,R=0,S=0,E=!1;if(null!=g&&null!=b){let e=d(g);if(null!=e){E=!0;let{width:t,height:o}=(0,_.getCssDimensions)(e),{width:r,height:n}=(0,_.getCssDimensions)(b),a=e.getBoundingClientRect(),i=b.getBoundingClientRect(),l=r>0?i.width/r:1,s=n>0?i.height/n:1;if(Math.abs(l)>Number.EPSILON&&Math.abs(s)>Number.EPSILON){let e=a.left-i.left,t=a.top-i.top;x=e/l+b.scrollLeft-b.clientLeft,C=t/s+b.scrollTop-b.clientTop}else x=e.offsetLeft,C=e.offsetTop;R=t,S=o,y=b.scrollWidth-x-R,w=b.scrollHeight-C-S}}let T=E?{left:x,right:y,top:C,bottom:w}:null,A=E?{width:R,height:S}:null,P=E?{[z.activeTabLeft]:`${x}px`,[z.activeTabRight]:`${y}px`,[z.activeTabTop]:`${C}px`,[z.activeTabBottom]:`${w}px`,[z.activeTabWidth]:`${R}px`,[z.activeTabHeight]:`${S}px`}:void 0,W=E&&R>0&&S>0,H=(0,u.useRenderElement)("span",e,{state:{orientation:h,activeTabPosition:T,activeTabSize:A,tabActivationDirection:f},ref:t,props:[{role:"presentation",style:P,hidden:!W},s,{suppressHydrationWarning:!0}],stateAttributesMapping:D});return null==g?null:(0,n.jsxs)(a.Fragment,{children:[H,v&&i&&(0,n.jsx)("script",{nonce:c,dangerouslySetInnerHTML:{__html:'!function(){const t=document.currentScript.previousElementSibling;if(!t)return;const e=t.closest(\'[role="tablist"]\');if(!e)return;const i=e.querySelector("[data-active]");if(!i)return;if(0===i.offsetWidth||0===e.offsetWidth)return;let o=0,n=0,h=0,l=0,r=0,f=0;function s(t){const e=getComputedStyle(t);let i=parseFloat(e.width)||0,o=parseFloat(e.height)||0;return(Math.round(i)!==t.offsetWidth||Math.round(o)!==t.offsetHeight)&&(i=t.offsetWidth,o=t.offsetHeight),{width:i,height:o}}if(null!=i&&null!=e){const{width:t,height:c}=s(i),{width:u,height:d}=s(e),a=i.getBoundingClientRect(),g=e.getBoundingClientRect(),p=u>0?g.width/u:1,b=d>0?g.height/d:1;if(Math.abs(p)>Number.EPSILON&&Math.abs(b)>Number.EPSILON){const t=a.left-g.left,i=a.top-g.top;o=t/p+e.scrollLeft-e.clientLeft,h=i/b+e.scrollTop-e.clientTop}else o=i.offsetLeft,h=i.offsetTop;r=t,f=c,n=e.scrollWidth-o-r,l=e.scrollHeight-h-f}function c(e,i){t.style.setProperty(`--active-tab-${e}`,`${i}px`)}c("left",o),c("right",n),c("top",h),c("bottom",l),c("width",r),c("height",f),r>0&&f>0&&t.removeAttribute("hidden")}();'},suppressHydrationWarning:!0})]})});var W=e.i(144394),H=e.i(209407),B=e.i(137584),F=e.i(223910),V=e.i(673553);let Y=((r={}).index="data-index",r.activationDirection="data-activation-direction",r.orientation="data-orientation",r.hidden="data-hidden",r[r.startingStyle=H.TransitionStatusDataAttributes.startingStyle]="startingStyle",r[r.endingStyle=H.TransitionStatusDataAttributes.endingStyle]="endingStyle",r),K={...g,...H.transitionStatusMapping},U=a.forwardRef(function(e,t){let{className:o,value:r,render:n,keepMounted:i=!1,style:s,...c}=e,{value:d,getTabIdByPanelValue:h,orientation:f,tabActivationDirection:g,registerMountedTabPanel:b,unregisterMountedTabPanel:m}=p(),v=(0,y.useBaseUiId)(),k=a.useMemo(()=>({id:v,value:r}),[v,r]),{ref:x,index:C}=(0,V.useCompositeListItem)({metadata:k}),w=r===d,{mounted:R,transitionStatus:S,setMounted:I}=(0,F.useTransitionStatus)(w),E=!R,T=h(r),_=a.useRef(null),O=(0,u.useRenderElement)("div",e,{state:{hidden:E,orientation:f,tabActivationDirection:g,transitionStatus:S},ref:[t,x,_],props:[{"aria-labelledby":T,hidden:E,id:v,role:"tabpanel",tabIndex:w?0:-1,inert:(0,W.inertValue)(!w),[Y.index]:C},c],stateAttributesMapping:K});return((0,B.useOpenChangeComplete)({open:w,ref:_,onComplete(){w||I(!1)}}),(0,l.useIsoLayoutEffect)(()=>{if((!E||i)&&null!=v)return b(r,v),()=>{m(r,v)}},[E,i,r,v,b,m]),i||R)?O:null});var $=e.i(590803),q=e.i(828918),G=e.i(673327),X=e.i(621082);let J=[];var Z=e.i(838452),Q=e.i(872855);function ee(e){let{render:t,className:o,style:r,refs:i=A.EMPTY_ARRAY,props:d=A.EMPTY_ARRAY,state:h=A.EMPTY_OBJECT,stateAttributesMapping:p,highlightedIndex:f,onHighlightedIndexChange:g,orientation:b,grid:m,loopFocus:v,onLoop:k,enableHomeAndEndKeys:x,onMapChange:y,stopEventPropagation:C=!0,rootRef:R,disabledIndices:S,modifierKeys:I,highlightItemOnHover:T=!1,tag:_="div",...O}=e,{props:L,highlightedIndex:M,onHighlightedIndexChange:N,elementsRef:z,onMapChange:j,relayKeyboardEvent:D}=function(e){let{loopFocus:t=!0,orientation:o="both",grid:r,onLoop:n,direction:i,highlightedIndex:u,onHighlightedIndexChange:c,rootRef:d,enableHomeAndEndKeys:h=!1,stopEventPropagation:p=!1,disabledIndices:f,modifierKeys:g=J}=e,[b,m]=a.useState(0),v=null!=r,k=a.useRef(null),x=(0,q.useMergedRefs)(k,d),y=a.useRef([]),C=a.useRef(!1),R=u??b,S=(0,s.useStableCallback)((e,t=!1)=>{if((c??m)(e),t){let t=y.current[e];(0,G.scrollIntoViewIfNeeded)(k.current,t,i,o)}}),I=(0,s.useStableCallback)(e=>{if(0===e.size||C.current)return;C.current=!0;let t=Array.from(e.keys()),r=t.find(e=>e?.hasAttribute(w))??null,n=r?t.indexOf(r):-1;if(-1!==n)S(n);else if((0,X.isListIndexDisabled)(t,R,f)){let e=(0,X.findNonDisabledListIndex)(t,{disabledIndices:f});(0,X.isIndexOutOfListBounds)(t,e)||S(e)}(0,G.scrollIntoViewIfNeeded)(k.current,r,i,o)});(0,l.useIsoLayoutEffect)(()=>{if(null==f||null!=u||!C.current)return;let e=y.current;if((0,X.isListIndexDisabled)(e,R,f)){let t=(0,X.findNonDisabledListIndex)(e,{disabledIndices:f});(0,X.isIndexOutOfListBounds)(e,t)||S(t)}},[f,u,R,y,S]);let T=(0,s.useStableCallback)((e,t,o)=>n?n(e,t,o,y):o),_=(0,s.useStableCallback)(e=>{let a=h?G.COMPOSITE_KEYS:G.ARROW_KEYS;if(!a.has(e.key)||function(e,t){for(let o of G.MODIFIER_KEYS.values())if(!t.includes(o)&&e.getModifierState(o))return!0;return!1}(e,g)||!k.current)return;let l="rtl"===i,s=l?G.ARROW_LEFT:G.ARROW_RIGHT,u={horizontal:s,vertical:G.ARROW_DOWN,both:s}[o],c=l?G.ARROW_RIGHT:G.ARROW_LEFT,d={horizontal:c,vertical:G.ARROW_UP,both:c}[o],b=(0,E.getTarget)(e.nativeEvent);if(null!=b&&(0,G.isNativeInput)(b)&&!(0,$.isElementDisabled)(b)){let t=b.selectionStart,o=b.selectionEnd,r=b.value??"";if(null==t||e.shiftKey||t!==o||e.key!==d&&t0)return}let m=R,x=(0,X.getMinListIndex)(y,f),C=(0,X.getMaxListIndex)(y,f);null!=r&&(m=r({disabledIndices:f,elementsRef:y,event:e,highlightedIndex:R,loopFocus:t,maxIndex:C,minIndex:x,onLoop:T,orientation:o,rtl:l}));let w={horizontal:[s],vertical:[G.ARROW_DOWN],both:[s,G.ARROW_DOWN]}[o],I={horizontal:[c],vertical:[G.ARROW_UP],both:[c,G.ARROW_UP]}[o],_=v?a:({horizontal:h?G.HORIZONTAL_KEYS_WITH_EXTRA_KEYS:G.HORIZONTAL_KEYS,vertical:h?G.VERTICAL_KEYS_WITH_EXTRA_KEYS:G.VERTICAL_KEYS,both:a})[o];h&&(e.key===G.HOME?m=x:e.key===G.END&&(m=C)),m===R&&(w.includes(e.key)||I.includes(e.key))&&(t&&m===C&&w.includes(e.key)?(m=x,n&&(m=n(e,R,m,y))):t&&m===x&&I.includes(e.key)?(m=C,n&&(m=n(e,R,m,y))):m=(0,X.findNonDisabledListIndex)(y.current,{startingIndex:m,decrement:I.includes(e.key),disabledIndices:f})),m===R||(0,X.isIndexOutOfListBounds)(y.current,m)||(p&&e.stopPropagation(),_.has(e.key)&&e.preventDefault(),S(m,!0),queueMicrotask(()=>{y.current[m]?.focus()}))});return{props:{ref:x,onFocus(e){let t=k.current,o=(0,E.getTarget)(e.nativeEvent);t&&null!=o&&(0,G.isNativeInput)(o)&&o.setSelectionRange(0,o.value.length??0)},onKeyDown:_},highlightedIndex:R,onHighlightedIndexChange:S,elementsRef:y,disabledIndices:f,onMapChange:I,relayKeyboardEvent:_}}({grid:m,loopFocus:v,onLoop:k,orientation:b,highlightedIndex:f,onHighlightedIndexChange:g,rootRef:R,stopEventPropagation:C,enableHomeAndEndKeys:x,direction:(0,Q.useDirection)(),disabledIndices:S,modifierKeys:I}),P=(0,u.useRenderElement)(_,e,{state:h,ref:i,props:[L,...d,O],stateAttributesMapping:p}),W=a.useMemo(()=>({highlightedIndex:M,onHighlightedIndexChange:N,highlightItemOnHover:T,relayKeyboardEvent:D}),[M,N,T,D]);return(0,n.jsx)(Z.CompositeRootContext.Provider,{value:W,children:(0,n.jsx)(c.CompositeList,{elementsRef:z,onMapChange:e=>{y?.(e),j(e)},children:P})})}e.s(["CompositeRoot",0,ee],405934);let et=a.forwardRef(function(e,t){let{activateOnFocus:o=!1,className:r,loopFocus:i=!0,render:u,style:c,...d}=e,{onValueChange:h,orientation:f,value:b,setTabMap:m,tabActivationDirection:v}=p(),[k,x]=a.useState(0),[y,C]=a.useState(null),w=a.useRef(new Set),R=a.useRef(new Set),I=a.useRef(null);(0,l.useIsoLayoutEffect)(()=>{if("u"{w.current.forEach(e=>{e()})});return I.current=e,y&&e.observe(y),R.current.forEach(t=>{e.observe(t)}),()=>{e.disconnect(),I.current=null}},[y]);let E=(0,s.useStableCallback)(e=>(w.current.add(e),()=>{w.current.delete(e)})),T=(0,s.useStableCallback)(e=>(R.current.add(e),I.current?.observe(e),()=>{R.current.delete(e),I.current?.unobserve(e)})),_=(0,s.useStableCallback)((e,t)=>{e!==b&&h(e,t)}),O=a.useMemo(()=>({activateOnFocus:o,highlightedTabIndex:k,registerIndicatorUpdateListener:E,registerTabResizeObserverElement:T,onTabActivation:_,setHighlightedTabIndex:x,tabsListElement:y}),[o,k,E,T,_,x,y]);return(0,n.jsx)(S.Provider,{value:O,children:(0,n.jsx)(ee,{render:u,className:r,style:c,state:{orientation:f,tabActivationDirection:v},refs:[t,C],props:[{"aria-orientation":"vertical"===f?"vertical":void 0,role:"tablist"},d],stateAttributesMapping:g,highlightedIndex:k,enableHomeAndEndKeys:!0,loopFocus:i,orientation:f,onHighlightedIndexChange:x,onMapChange:m,disabledIndices:A.EMPTY_ARRAY})})});e.s(["Indicator",0,P,"List",0,et,"Panel",0,U,"Root",0,v,"Tab",0,T],69281);var eo=e.i(69281),eo=eo,er=e.i(115504);let en=(0,er.cva)({base:"group/tabs-list inline-flex w-fit items-center justify-center rounded-lg p-[3px] text-muted-foreground group-data-horizontal/tabs:h-9 group-data-vertical/tabs:h-fit group-data-vertical/tabs:flex-col data-[variant=line]:rounded-none",variants:{variant:{default:"bg-muted",line:"gap-1 bg-transparent"}},defaultVariants:{variant:"default"}});e.s(["Tabs",0,function({className:e,orientation:t="horizontal",...o}){return(0,n.jsx)(eo.Root,{"data-slot":"tabs","data-orientation":t,className:(0,er.cn)("group/tabs flex gap-2 data-horizontal:flex-col",e),...o})},"TabsContent",0,function({className:e,...t}){return(0,n.jsx)(eo.Panel,{"data-slot":"tabs-content",className:(0,er.cn)("flex-1 text-sm outline-none",e),...t})},"TabsList",0,function({className:e,variant:t="default",...o}){return(0,n.jsx)(eo.List,{"data-slot":"tabs-list","data-variant":t,className:(0,er.cn)(en({variant:t}),e),...o})},"TabsTrigger",0,function({className:e,...t}){return(0,n.jsx)(eo.Tab,{"data-slot":"tabs-trigger",className:(0,er.cn)("relative inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 rounded-md border border-transparent px-2 py-1 text-sm font-medium whitespace-nowrap text-foreground/60 transition-all group-data-vertical/tabs:w-full group-data-vertical/tabs:justify-start hover:text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-1 focus-visible:outline-ring disabled:pointer-events-none disabled:opacity-50 has-data-[icon=inline-end]:pr-1.5 has-data-[icon=inline-start]:pl-1.5 aria-disabled:pointer-events-none aria-disabled:opacity-50 dark:text-muted-foreground dark:hover:text-foreground group-data-[variant=default]/tabs-list:data-active:shadow-sm group-data-[variant=line]/tabs-list:data-active:shadow-none [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4","group-data-[variant=line]/tabs-list:bg-transparent group-data-[variant=line]/tabs-list:data-active:bg-transparent dark:group-data-[variant=line]/tabs-list:data-active:border-transparent dark:group-data-[variant=line]/tabs-list:data-active:bg-transparent","data-active:bg-background data-active:text-foreground dark:data-active:border-input dark:data-active:bg-input/30 dark:data-active:text-foreground","after:absolute after:bg-foreground after:opacity-0 after:transition-opacity group-data-horizontal/tabs:after:inset-x-0 group-data-horizontal/tabs:after:bottom-[-5px] group-data-horizontal/tabs:after:h-0.5 group-data-vertical/tabs:after:inset-y-0 group-data-vertical/tabs:after:-right-1 group-data-vertical/tabs:after:w-0.5 group-data-[variant=line]/tabs-list:data-active:after:opacity-100",e),...t})}],677572)},541202,e=>{"use strict";var t=e.i(843476),o=e.i(522016),r=e.i(560445);e.s(["DeprecationBanner",0,({featureName:e})=>(0,t.jsx)(r.Alert,{message:`${e} is on a draft deprecation list`,description:(0,t.jsxs)(t.Fragment,{children:[`${e} is one of several experimental features we're considering removing, potentially as early as September 1, 2026. This list is a draft and is not final. If you rely on this feature, please share feedback on the `,(0,t.jsx)(o.default,{href:"https://github.com/BerriAI/litellm/discussions/32090",target:"_blank",rel:"noopener noreferrer",children:"deprecation discussion"}),"."]}),type:"info",showIcon:!0,closable:!0,style:{marginBottom:16}})])},466828,e=>{"use strict";var t=e.i(843476),o=e.i(271645),r=e.i(678784);let n=(0,e.i(475254).default)("clipboard",[["rect",{width:"8",height:"4",x:"8",y:"2",rx:"1",ry:"1",key:"tgr4d6"}],["path",{d:"M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2",key:"116196"}]]);var a=e.i(650056);let i={'code[class*="language-"]':{background:"hsl(230, 1%, 98%)",color:"hsl(230, 8%, 24%)",fontFamily:'"Fira Code", "Fira Mono", Menlo, Consolas, "DejaVu Sans Mono", monospace',direction:"ltr",textAlign:"left",whiteSpace:"pre",wordSpacing:"normal",wordBreak:"normal",lineHeight:"1.5",MozTabSize:"2",OTabSize:"2",tabSize:"2",WebkitHyphens:"none",MozHyphens:"none",msHyphens:"none",hyphens:"none"},'pre[class*="language-"]':{background:"hsl(230, 1%, 98%)",color:"hsl(230, 8%, 24%)",fontFamily:'"Fira Code", "Fira Mono", Menlo, Consolas, "DejaVu Sans Mono", monospace',direction:"ltr",textAlign:"left",whiteSpace:"pre",wordSpacing:"normal",wordBreak:"normal",lineHeight:"1.5",MozTabSize:"2",OTabSize:"2",tabSize:"2",WebkitHyphens:"none",MozHyphens:"none",msHyphens:"none",hyphens:"none",padding:"1em",margin:"0.5em 0",overflow:"auto",borderRadius:"0.3em"},'code[class*="language-"]::-moz-selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},'code[class*="language-"] *::-moz-selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},'pre[class*="language-"] *::-moz-selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},'code[class*="language-"]::selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},'code[class*="language-"] *::selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},'pre[class*="language-"] *::selection':{background:"hsl(230, 1%, 90%)",color:"inherit"},':not(pre) > code[class*="language-"]':{padding:"0.2em 0.3em",borderRadius:"0.3em",whiteSpace:"normal"},comment:{color:"hsl(230, 4%, 64%)",fontStyle:"italic"},prolog:{color:"hsl(230, 4%, 64%)"},cdata:{color:"hsl(230, 4%, 64%)"},doctype:{color:"hsl(230, 8%, 24%)"},punctuation:{color:"hsl(230, 8%, 24%)"},entity:{color:"hsl(230, 8%, 24%)",cursor:"help"},"attr-name":{color:"hsl(35, 99%, 36%)"},"class-name":{color:"hsl(35, 99%, 36%)"},boolean:{color:"hsl(35, 99%, 36%)"},constant:{color:"hsl(35, 99%, 36%)"},number:{color:"hsl(35, 99%, 36%)"},atrule:{color:"hsl(35, 99%, 36%)"},keyword:{color:"hsl(301, 63%, 40%)"},property:{color:"hsl(5, 74%, 59%)"},tag:{color:"hsl(5, 74%, 59%)"},symbol:{color:"hsl(5, 74%, 59%)"},deleted:{color:"hsl(5, 74%, 59%)"},important:{color:"hsl(5, 74%, 59%)"},selector:{color:"hsl(119, 34%, 47%)"},string:{color:"hsl(119, 34%, 47%)"},char:{color:"hsl(119, 34%, 47%)"},builtin:{color:"hsl(119, 34%, 47%)"},inserted:{color:"hsl(119, 34%, 47%)"},regex:{color:"hsl(119, 34%, 47%)"},"attr-value":{color:"hsl(119, 34%, 47%)"},"attr-value > .token.punctuation":{color:"hsl(119, 34%, 47%)"},variable:{color:"hsl(221, 87%, 60%)"},operator:{color:"hsl(221, 87%, 60%)"},function:{color:"hsl(221, 87%, 60%)"},url:{color:"hsl(198, 99%, 37%)"},"attr-value > .token.punctuation.attr-equals":{color:"hsl(230, 8%, 24%)"},"special-attr > .token.attr-value > .token.value.css":{color:"hsl(230, 8%, 24%)"},".language-css .token.selector":{color:"hsl(5, 74%, 59%)"},".language-css .token.property":{color:"hsl(230, 8%, 24%)"},".language-css .token.function":{color:"hsl(198, 99%, 37%)"},".language-css .token.url > .token.function":{color:"hsl(198, 99%, 37%)"},".language-css .token.url > .token.string.url":{color:"hsl(119, 34%, 47%)"},".language-css .token.important":{color:"hsl(301, 63%, 40%)"},".language-css .token.atrule .token.rule":{color:"hsl(301, 63%, 40%)"},".language-javascript .token.operator":{color:"hsl(301, 63%, 40%)"},".language-javascript .token.template-string > .token.interpolation > .token.interpolation-punctuation.punctuation":{color:"hsl(344, 84%, 43%)"},".language-json .token.operator":{color:"hsl(230, 8%, 24%)"},".language-json .token.null.keyword":{color:"hsl(35, 99%, 36%)"},".language-markdown .token.url":{color:"hsl(230, 8%, 24%)"},".language-markdown .token.url > .token.operator":{color:"hsl(230, 8%, 24%)"},".language-markdown .token.url-reference.url > .token.string":{color:"hsl(230, 8%, 24%)"},".language-markdown .token.url > .token.content":{color:"hsl(221, 87%, 60%)"},".language-markdown .token.url > .token.url":{color:"hsl(198, 99%, 37%)"},".language-markdown .token.url-reference.url":{color:"hsl(198, 99%, 37%)"},".language-markdown .token.blockquote.punctuation":{color:"hsl(230, 4%, 64%)",fontStyle:"italic"},".language-markdown .token.hr.punctuation":{color:"hsl(230, 4%, 64%)",fontStyle:"italic"},".language-markdown .token.code-snippet":{color:"hsl(119, 34%, 47%)"},".language-markdown .token.bold .token.content":{color:"hsl(35, 99%, 36%)"},".language-markdown .token.italic .token.content":{color:"hsl(301, 63%, 40%)"},".language-markdown .token.strike .token.content":{color:"hsl(5, 74%, 59%)"},".language-markdown .token.strike .token.punctuation":{color:"hsl(5, 74%, 59%)"},".language-markdown .token.list.punctuation":{color:"hsl(5, 74%, 59%)"},".language-markdown .token.title.important > .token.punctuation":{color:"hsl(5, 74%, 59%)"},bold:{fontWeight:"bold"},italic:{fontStyle:"italic"},namespace:{Opacity:"0.8"},"token.tab:not(:empty):before":{color:"hsla(230, 8%, 24%, 0.2)"},"token.cr:before":{color:"hsla(230, 8%, 24%, 0.2)"},"token.lf:before":{color:"hsla(230, 8%, 24%, 0.2)"},"token.space:before":{color:"hsla(230, 8%, 24%, 0.2)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item":{marginRight:"0.4em"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > button":{background:"hsl(230, 1%, 90%)",color:"hsl(230, 6%, 44%)",padding:"0.1em 0.4em",borderRadius:"0.3em"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > a":{background:"hsl(230, 1%, 90%)",color:"hsl(230, 6%, 44%)",padding:"0.1em 0.4em",borderRadius:"0.3em"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > span":{background:"hsl(230, 1%, 90%)",color:"hsl(230, 6%, 44%)",padding:"0.1em 0.4em",borderRadius:"0.3em"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > button:hover":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > button:focus":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > a:hover":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > a:focus":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > span:hover":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},"div.code-toolbar > .toolbar.toolbar > .toolbar-item > span:focus":{background:"hsl(230, 1%, 78%)",color:"hsl(230, 8%, 24%)"},".line-highlight.line-highlight":{background:"hsla(230, 8%, 24%, 0.05)"},".line-highlight.line-highlight:before":{background:"hsl(230, 1%, 90%)",color:"hsl(230, 8%, 24%)",padding:"0.1em 0.6em",borderRadius:"0.3em",boxShadow:"0 2px 0 0 rgba(0, 0, 0, 0.2)"},".line-highlight.line-highlight[data-end]:after":{background:"hsl(230, 1%, 90%)",color:"hsl(230, 8%, 24%)",padding:"0.1em 0.6em",borderRadius:"0.3em",boxShadow:"0 2px 0 0 rgba(0, 0, 0, 0.2)"},"pre[id].linkable-line-numbers.linkable-line-numbers span.line-numbers-rows > span:hover:before":{backgroundColor:"hsla(230, 8%, 24%, 0.05)"},".line-numbers.line-numbers .line-numbers-rows":{borderRightColor:"hsla(230, 8%, 24%, 0.2)"},".command-line .command-line-prompt":{borderRightColor:"hsla(230, 8%, 24%, 0.2)"},".line-numbers .line-numbers-rows > span:before":{color:"hsl(230, 1%, 62%)"},".command-line .command-line-prompt > span:before":{color:"hsl(230, 1%, 62%)"},".rainbow-braces .token.token.punctuation.brace-level-1":{color:"hsl(5, 74%, 59%)"},".rainbow-braces .token.token.punctuation.brace-level-5":{color:"hsl(5, 74%, 59%)"},".rainbow-braces .token.token.punctuation.brace-level-9":{color:"hsl(5, 74%, 59%)"},".rainbow-braces .token.token.punctuation.brace-level-2":{color:"hsl(119, 34%, 47%)"},".rainbow-braces .token.token.punctuation.brace-level-6":{color:"hsl(119, 34%, 47%)"},".rainbow-braces .token.token.punctuation.brace-level-10":{color:"hsl(119, 34%, 47%)"},".rainbow-braces .token.token.punctuation.brace-level-3":{color:"hsl(221, 87%, 60%)"},".rainbow-braces .token.token.punctuation.brace-level-7":{color:"hsl(221, 87%, 60%)"},".rainbow-braces .token.token.punctuation.brace-level-11":{color:"hsl(221, 87%, 60%)"},".rainbow-braces .token.token.punctuation.brace-level-4":{color:"hsl(301, 63%, 40%)"},".rainbow-braces .token.token.punctuation.brace-level-8":{color:"hsl(301, 63%, 40%)"},".rainbow-braces .token.token.punctuation.brace-level-12":{color:"hsl(301, 63%, 40%)"},"pre.diff-highlight > code .token.token.deleted:not(.prefix)":{backgroundColor:"hsla(353, 100%, 66%, 0.15)"},"pre > code.diff-highlight .token.token.deleted:not(.prefix)":{backgroundColor:"hsla(353, 100%, 66%, 0.15)"},"pre.diff-highlight > code .token.token.deleted:not(.prefix)::-moz-selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre.diff-highlight > code .token.token.deleted:not(.prefix) *::-moz-selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre > code.diff-highlight .token.token.deleted:not(.prefix)::-moz-selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre > code.diff-highlight .token.token.deleted:not(.prefix) *::-moz-selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre.diff-highlight > code .token.token.deleted:not(.prefix)::selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre.diff-highlight > code .token.token.deleted:not(.prefix) *::selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre > code.diff-highlight .token.token.deleted:not(.prefix)::selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre > code.diff-highlight .token.token.deleted:not(.prefix) *::selection":{backgroundColor:"hsla(353, 95%, 66%, 0.25)"},"pre.diff-highlight > code .token.token.inserted:not(.prefix)":{backgroundColor:"hsla(137, 100%, 55%, 0.15)"},"pre > code.diff-highlight .token.token.inserted:not(.prefix)":{backgroundColor:"hsla(137, 100%, 55%, 0.15)"},"pre.diff-highlight > code .token.token.inserted:not(.prefix)::-moz-selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre.diff-highlight > code .token.token.inserted:not(.prefix) *::-moz-selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre > code.diff-highlight .token.token.inserted:not(.prefix)::-moz-selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre > code.diff-highlight .token.token.inserted:not(.prefix) *::-moz-selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre.diff-highlight > code .token.token.inserted:not(.prefix)::selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre.diff-highlight > code .token.token.inserted:not(.prefix) *::selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre > code.diff-highlight .token.token.inserted:not(.prefix)::selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},"pre > code.diff-highlight .token.token.inserted:not(.prefix) *::selection":{backgroundColor:"hsla(135, 73%, 55%, 0.25)"},".prism-previewer.prism-previewer:before":{borderColor:"hsl(0, 0, 95%)"},".prism-previewer-gradient.prism-previewer-gradient div":{borderColor:"hsl(0, 0, 95%)",borderRadius:"0.3em"},".prism-previewer-color.prism-previewer-color:before":{borderRadius:"0.3em"},".prism-previewer-easing.prism-previewer-easing:before":{borderRadius:"0.3em"},".prism-previewer.prism-previewer:after":{borderTopColor:"hsl(0, 0, 95%)"},".prism-previewer-flipped.prism-previewer-flipped.after":{borderBottomColor:"hsl(0, 0, 95%)"},".prism-previewer-angle.prism-previewer-angle:before":{background:"hsl(0, 0%, 100%)"},".prism-previewer-time.prism-previewer-time:before":{background:"hsl(0, 0%, 100%)"},".prism-previewer-easing.prism-previewer-easing":{background:"hsl(0, 0%, 100%)"},".prism-previewer-angle.prism-previewer-angle circle":{stroke:"hsl(230, 8%, 24%)",strokeOpacity:"1"},".prism-previewer-time.prism-previewer-time circle":{stroke:"hsl(230, 8%, 24%)",strokeOpacity:"1"},".prism-previewer-easing.prism-previewer-easing circle":{stroke:"hsl(230, 8%, 24%)",fill:"transparent"},".prism-previewer-easing.prism-previewer-easing path":{stroke:"hsl(230, 8%, 24%)"},".prism-previewer-easing.prism-previewer-easing line":{stroke:"hsl(230, 8%, 24%)"}};e.s(["default",0,({code:e,language:l})=>{let[s,u]=(0,o.useState)(!1);return(0,t.jsxs)("div",{className:"relative rounded-lg border border-gray-200 overflow-hidden",children:[(0,t.jsx)("button",{onClick:()=>{navigator.clipboard.writeText(e),u(!0),setTimeout(()=>u(!1),2e3)},className:"absolute top-3 right-3 p-2 rounded-md bg-gray-100 hover:bg-gray-200 text-gray-600 z-10","aria-label":"Copy code",children:s?(0,t.jsx)(r.CheckIcon,{size:16}):(0,t.jsx)(n,{size:16})}),(0,t.jsx)(a.Prism,{language:l,style:i,customStyle:{margin:0,padding:"1.5rem",borderRadius:"0.5rem",fontSize:"0.9rem",backgroundColor:"#fafafa"},showLineNumbers:!0,children:e})]})}],466828)},191905,e=>{"use strict";var t=e.i(843476),o=e.i(466828),r=e.i(677572),n=e.i(778917),a=e.i(115504);let i=({href:e,className:o})=>(0,t.jsxs)("a",{href:e,target:"_blank",rel:"noopener noreferrer",title:"Open documentation in a new tab",className:(0,a.cn)("inline-flex items-center gap-2 rounded-xl border border-zinc-200 bg-white/80 px-3.5 py-2 text-sm font-medium text-zinc-700 shadow-xs","hover:bg-white focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-blue-500 active:translate-y-[0.5px]",o),children:[(0,t.jsx)("span",{children:"API Reference Docs"}),(0,t.jsx)(n.ExternalLink,{"aria-hidden":!0,className:"h-4 w-4 opacity-80"}),(0,t.jsx)("span",{className:"sr-only",children:"(opens in a new tab)"})]}),l=({proxySettings:e})=>{let n="",a=e?.LITELLM_UI_API_DOC_BASE_URL;return a&&a.trim()?n=a:e?.PROXY_BASE_URL&&(n=e.PROXY_BASE_URL),(0,t.jsx)("div",{className:"grid grid-cols-1 gap-2 p-8 h-[80vh] w-full mt-2",children:(0,t.jsxs)("div",{className:"mb-5",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between",children:[(0,t.jsx)("h1",{className:"text-2xl font-semibold text-foreground",children:"OpenAI Compatible Proxy: API Reference"}),(0,t.jsx)(i,{className:"ml-3 shrink-0",href:"https://docs.litellm.ai/docs/proxy/user_keys"})]}),(0,t.jsxs)("p",{className:"mt-2 mb-2 text-sm text-muted-foreground",children:["LiteLLM is OpenAI Compatible. This means your API Key works with the OpenAI SDK. Just replace the base_url to point to your litellm proxy. Example Below"," "]}),(0,t.jsxs)(r.Tabs,{defaultValue:"openai",children:[(0,t.jsxs)(r.TabsList,{variant:"line",className:"border-b rounded-none w-full justify-start h-auto p-0",children:[(0,t.jsx)(r.TabsTrigger,{value:"openai",className:"rounded-none px-4 py-2 flex-none",children:"OpenAI Python SDK"}),(0,t.jsx)(r.TabsTrigger,{value:"llamaindex",className:"rounded-none px-4 py-2 flex-none",children:"LlamaIndex"}),(0,t.jsx)(r.TabsTrigger,{value:"langchain",className:"rounded-none px-4 py-2 flex-none",children:"Langchain Py"})]}),(0,t.jsx)(r.TabsContent,{value:"openai",children:(0,t.jsx)(o.default,{language:"python",code:`import openai +client = openai.OpenAI( + api_key="your_api_key", + base_url="${n}" # LiteLLM Proxy is OpenAI compatible, Read More: https://docs.litellm.ai/docs/proxy/user_keys +) + +response = client.chat.completions.create( + model="gpt-3.5-turbo", # model to send to the proxy + messages = [ + { + "role": "user", + "content": "this is a test request, write a short poem" + } + ] +) + +print(response)`})}),(0,t.jsx)(r.TabsContent,{value:"llamaindex",children:(0,t.jsx)(o.default,{language:"python",code:`import os, dotenv + +from llama_index.llms import AzureOpenAI +from llama_index.embeddings import AzureOpenAIEmbedding +from llama_index import VectorStoreIndex, SimpleDirectoryReader, ServiceContext + +llm = AzureOpenAI( + engine="azure-gpt-3.5", # model_name on litellm proxy + temperature=0.0, + azure_endpoint="${n}", # litellm proxy endpoint + api_key="sk-1234", # litellm proxy API Key + api_version="2023-07-01-preview", +) + +embed_model = AzureOpenAIEmbedding( + deployment_name="azure-embedding-model", + azure_endpoint="${n}", + api_key="sk-1234", + api_version="2023-07-01-preview", +) + +documents = SimpleDirectoryReader("llama_index_data").load_data() +service_context = ServiceContext.from_defaults(llm=llm, embed_model=embed_model) +index = VectorStoreIndex.from_documents(documents, service_context=service_context) + +query_engine = index.as_query_engine() +response = query_engine.query("What did the author do growing up?") +print(response)`})}),(0,t.jsx)(r.TabsContent,{value:"langchain",children:(0,t.jsx)(o.default,{language:"python",code:`from langchain.chat_models import ChatOpenAI +from langchain.prompts.chat import ( + ChatPromptTemplate, + HumanMessagePromptTemplate, + SystemMessagePromptTemplate, +) +from langchain.schema import HumanMessage, SystemMessage + +chat = ChatOpenAI( + openai_api_base="${n}", + model = "gpt-3.5-turbo", + temperature=0.1 +) + +messages = [ + SystemMessage( + content="You are a helpful assistant that im using to make a test request to." + ), + HumanMessage( + content="test from litellm. tell me why it's amazing in 1 sentence" + ), +] +response = chat(messages) + +print(response)`})})]})]})})};var s=e.i(541202),u=e.i(135214),c=e.i(592392);e.s(["default",0,()=>{let{accessToken:e}=(0,u.default)(),o=(0,c.default)(e);return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.DeprecationBanner,{featureName:"The API Reference tab"}),(0,t.jsx)(l,{proxySettings:o})]})}],191905)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/033clseufop6o.js b/litellm/proxy/_experimental/out/_next/static/chunks/033clseufop6o.js deleted file mode 100644 index 3bcc0cb1811..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/033clseufop6o.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,447566,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M872 474H286.9l350.2-304c5.6-4.9 2.2-14-5.2-14h-88.5c-3.9 0-7.6 1.4-10.5 3.9L155 487.8a31.96 31.96 0 000 48.3L535.1 866c1.5 1.3 3.3 2 5.2 2h91.5c7.4 0 10.8-9.2 5.2-14L286.9 550H872c4.4 0 8-3.6 8-8v-60c0-4.4-3.6-8-8-8z"}}]},name:"arrow-left",theme:"outlined"};var s=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(s.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["ArrowLeftOutlined",0,o],447566)},599724,936325,e=>{"use strict";var t=e.i(95779),r=e.i(444755),a=e.i(673706),s=e.i(271645);let o=s.default.forwardRef((e,o)=>{let{color:l,className:i,children:n}=e;return s.default.createElement("p",{ref:o,className:(0,r.tremorTwMerge)("text-tremor-default",l?(0,a.getColorClassNames)(l,t.colorPalette.text).textColor:(0,r.tremorTwMerge)("text-tremor-content","dark:text-dark-tremor-content"),i)},n)});o.displayName="Text",e.s(["default",0,o],936325),e.s(["Text",0,o],599724)},994388,e=>{"use strict";var t=e.i(290571),r=e.i(829087),a=e.i(271645);let s=["preEnter","entering","entered","preExit","exiting","exited","unmounted"],o=e=>({_s:e,status:s[e],isEnter:e<3,isMounted:6!==e,isResolved:2===e||e>4}),l=e=>e?6:5,i=(e,t,r,a,s)=>{clearTimeout(a.current);let l=o(e);t(l),r.current=l,s&&s({current:l})};var n=e.i(480731),d=e.i(444755),c=e.i(673706);let u=e=>{var r=(0,t.__rest)(e,[]);return a.default.createElement("svg",Object.assign({},r,{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24",fill:"currentColor"}),a.default.createElement("path",{fill:"none",d:"M0 0h24v24H0z"}),a.default.createElement("path",{d:"M18.364 5.636L16.95 7.05A7 7 0 1 0 19 12h2a9 9 0 1 1-2.636-6.364z"}))};var m=e.i(95779);let g={xs:{height:"h-4",width:"w-4"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-6",width:"w-6"},xl:{height:"h-6",width:"w-6"}},h=(e,t)=>{switch(e){case"primary":return{textColor:t?(0,c.getColorClassNames)("white").textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",hoverTextColor:t?(0,c.getColorClassNames)("white").textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:t?(0,c.getColorClassNames)(t,m.colorPalette.background).bgColor:"bg-tremor-brand dark:bg-dark-tremor-brand",hoverBgColor:t?(0,c.getColorClassNames)(t,m.colorPalette.darkBackground).hoverBgColor:"hover:bg-tremor-brand-emphasis dark:hover:bg-dark-tremor-brand-emphasis",borderColor:t?(0,c.getColorClassNames)(t,m.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand",hoverBorderColor:t?(0,c.getColorClassNames)(t,m.colorPalette.darkBorder).hoverBorderColor:"hover:border-tremor-brand-emphasis dark:hover:border-dark-tremor-brand-emphasis"};case"secondary":return{textColor:t?(0,c.getColorClassNames)(t,m.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",hoverTextColor:t?(0,c.getColorClassNames)(t,m.colorPalette.text).textColor:"hover:text-tremor-brand-emphasis dark:hover:text-dark-tremor-brand-emphasis",bgColor:(0,c.getColorClassNames)("transparent").bgColor,hoverBgColor:t?(0,d.tremorTwMerge)((0,c.getColorClassNames)(t,m.colorPalette.background).hoverBgColor,"hover:bg-opacity-20 dark:hover:bg-opacity-20"):"hover:bg-tremor-brand-faint dark:hover:bg-dark-tremor-brand-faint",borderColor:t?(0,c.getColorClassNames)(t,m.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand"};case"light":return{textColor:t?(0,c.getColorClassNames)(t,m.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",hoverTextColor:t?(0,c.getColorClassNames)(t,m.colorPalette.darkText).hoverTextColor:"hover:text-tremor-brand-emphasis dark:hover:text-dark-tremor-brand-emphasis",bgColor:(0,c.getColorClassNames)("transparent").bgColor,borderColor:"",hoverBorderColor:""}}},p=(0,c.makeClassName)("Button"),f=({loading:e,iconSize:t,iconPosition:r,Icon:s,needMargin:o,transitionStatus:l})=>{let i=o?r===n.HorizontalPositions.Left?(0,d.tremorTwMerge)("-ml-1","mr-1.5"):(0,d.tremorTwMerge)("-mr-1","ml-1.5"):"",c=(0,d.tremorTwMerge)("w-0 h-0"),m={default:c,entering:c,entered:t,exiting:t,exited:c};return e?a.default.createElement(u,{className:(0,d.tremorTwMerge)(p("icon"),"animate-spin shrink-0",i,m.default,m[l]),style:{transition:"width 150ms"}}):a.default.createElement(s,{className:(0,d.tremorTwMerge)(p("icon"),"shrink-0",t,i)})},b=a.default.forwardRef((e,s)=>{let{icon:u,iconPosition:m=n.HorizontalPositions.Left,size:b=n.Sizes.SM,color:x,variant:v="primary",disabled:w,loading:C=!1,loadingText:y,children:k,tooltip:N,className:T}=e,M=(0,t.__rest)(e,["icon","iconPosition","size","color","variant","disabled","loading","loadingText","children","tooltip","className"]),S=C||w,E=void 0!==u||C,R=C&&y,j=!(!k&&!R),P=(0,d.tremorTwMerge)(g[b].height,g[b].width),O="light"!==v?(0,d.tremorTwMerge)("rounded-tremor-default border","shadow-tremor-input","dark:shadow-dark-tremor-input"):"",L=h(v,x),z=("light"!==v?{xs:{paddingX:"px-2.5",paddingY:"py-1.5",fontSize:"text-xs"},sm:{paddingX:"px-4",paddingY:"py-2",fontSize:"text-sm"},md:{paddingX:"px-4",paddingY:"py-2",fontSize:"text-md"},lg:{paddingX:"px-4",paddingY:"py-2.5",fontSize:"text-lg"},xl:{paddingX:"px-4",paddingY:"py-3",fontSize:"text-xl"}}:{xs:{paddingX:"",paddingY:"",fontSize:"text-xs"},sm:{paddingX:"",paddingY:"",fontSize:"text-sm"},md:{paddingX:"",paddingY:"",fontSize:"text-md"},lg:{paddingX:"",paddingY:"",fontSize:"text-lg"},xl:{paddingX:"",paddingY:"",fontSize:"text-xl"}})[b],{tooltipProps:_,getReferenceProps:B}=(0,r.useTooltip)(300),[H,I]=(({enter:e=!0,exit:t=!0,preEnter:r,preExit:s,timeout:n,initialEntered:d,mountOnEnter:c,unmountOnExit:u,onStateChange:m}={})=>{let[g,h]=(0,a.useState)(()=>o(d?2:l(c))),p=(0,a.useRef)(g),f=(0,a.useRef)(0),[b,x]="object"==typeof n?[n.enter,n.exit]:[n,n],v=(0,a.useCallback)(()=>{let e=((e,t)=>{switch(e){case 1:case 0:return 2;case 4:case 3:return l(t)}})(p.current._s,u);e&&i(e,h,p,f,m)},[m,u]);return[g,(0,a.useCallback)(a=>{let o=e=>{switch(i(e,h,p,f,m),e){case 1:b>=0&&(f.current=((...e)=>setTimeout(...e))(v,b));break;case 4:x>=0&&(f.current=((...e)=>setTimeout(...e))(v,x));break;case 0:case 3:f.current=((...e)=>setTimeout(...e))(()=>{isNaN(document.body.offsetTop)||o(e+1)},0)}},n=p.current.isEnter;"boolean"!=typeof a&&(a=!n),a?n||o(e?+!r:2):n&&o(t?s?3:4:l(u))},[v,m,e,t,r,s,b,x,u]),v]})({timeout:50});return(0,a.useEffect)(()=>{I(C)},[C]),a.default.createElement("button",Object.assign({ref:(0,c.mergeRefs)([s,_.refs.setReference]),className:(0,d.tremorTwMerge)(p("root"),"shrink-0 inline-flex justify-center items-center group font-medium outline-none",O,z.paddingX,z.paddingY,z.fontSize,L.textColor,L.bgColor,L.borderColor,L.hoverBorderColor,S?"opacity-50 cursor-not-allowed":(0,d.tremorTwMerge)(h(v,x).hoverTextColor,h(v,x).hoverBgColor,h(v,x).hoverBorderColor),T),disabled:S},B,M),a.default.createElement(r.default,Object.assign({text:N},_)),E&&m!==n.HorizontalPositions.Right?a.default.createElement(f,{loading:C,iconSize:P,iconPosition:m,Icon:u,transitionStatus:H.status,needMargin:j}):null,R||k?a.default.createElement("span",{className:(0,d.tremorTwMerge)(p("text"),"text-tremor-default whitespace-nowrap")},R?y:k):null,E&&m===n.HorizontalPositions.Right?a.default.createElement(f,{loading:C,iconSize:P,iconPosition:m,Icon:u,transitionStatus:H.status,needMargin:j}):null)});b.displayName="Button",e.s(["Button",0,b],994388)},304967,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(480731),s=e.i(95779),o=e.i(444755),l=e.i(673706);let i=(0,l.makeClassName)("Card"),n=r.default.forwardRef((e,n)=>{let{decoration:d="",decorationColor:c,children:u,className:m}=e,g=(0,t.__rest)(e,["decoration","decorationColor","children","className"]);return r.default.createElement("div",Object.assign({ref:n,className:(0,o.tremorTwMerge)(i("root"),"relative w-full text-left ring-1 rounded-tremor-default p-6","bg-tremor-background ring-tremor-ring shadow-tremor-card","dark:bg-dark-tremor-background dark:ring-dark-tremor-ring dark:shadow-dark-tremor-card",c?(0,l.getColorClassNames)(c,s.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand",(e=>{if(!e)return"";switch(e){case a.HorizontalPositions.Left:return"border-l-4";case a.VerticalPositions.Top:return"border-t-4";case a.HorizontalPositions.Right:return"border-r-4";case a.VerticalPositions.Bottom:return"border-b-4";default:return""}})(d),m)},g),u)});n.displayName="Card",e.s(["Card",0,n],304967)},629569,e=>{"use strict";var t=e.i(290571),r=e.i(95779),a=e.i(444755),s=e.i(673706),o=e.i(271645);let l=o.default.forwardRef((e,l)=>{let{color:i,children:n,className:d}=e,c=(0,t.__rest)(e,["color","children","className"]);return o.default.createElement("p",Object.assign({ref:l,className:(0,a.tremorTwMerge)("font-medium text-tremor-title",i?(0,s.getColorClassNames)(i,r.colorPalette.darkText).textColor:"text-tremor-content-strong dark:text-dark-tremor-content-strong",d)},c),n)});l.displayName="Title",e.s(["Title",0,l],629569)},653496,e=>{"use strict";var t=e.i(721369);e.s(["Tabs",()=>t.default])},536916,e=>{"use strict";var t=e.i(374276);e.s(["Checkbox",()=>t.default])},954616,e=>{"use strict";var t=e.i(271645),r=e.i(114272),a=e.i(540143),s=e.i(915823),o=e.i(619273),l=class extends s.Subscribable{#e;#t=void 0;#r;#a;constructor(e,t){super(),this.#e=e,this.setOptions(t),this.bindMethods(),this.#s()}bindMethods(){this.mutate=this.mutate.bind(this),this.reset=this.reset.bind(this)}setOptions(e){let t=this.options;this.options=this.#e.defaultMutationOptions(e),(0,o.shallowEqualObjects)(this.options,t)||this.#e.getMutationCache().notify({type:"observerOptionsUpdated",mutation:this.#r,observer:this}),t?.mutationKey&&this.options.mutationKey&&(0,o.hashKey)(t.mutationKey)!==(0,o.hashKey)(this.options.mutationKey)?this.reset():this.#r?.state.status==="pending"&&this.#r.setOptions(this.options)}onUnsubscribe(){this.hasListeners()||this.#r?.removeObserver(this)}onMutationUpdate(e){this.#s(),this.#o(e)}getCurrentResult(){return this.#t}reset(){this.#r?.removeObserver(this),this.#r=void 0,this.#s(),this.#o()}mutate(e,t){return this.#a=t,this.#r?.removeObserver(this),this.#r=this.#e.getMutationCache().build(this.#e,this.options),this.#r.addObserver(this),this.#r.execute(e)}#s(){let e=this.#r?.state??(0,r.getDefaultState)();this.#t={...e,isPending:"pending"===e.status,isSuccess:"success"===e.status,isError:"error"===e.status,isIdle:"idle"===e.status,mutate:this.mutate,reset:this.reset}}#o(e){a.notifyManager.batch(()=>{if(this.#a&&this.hasListeners()){let t=this.#t.variables,r=this.#t.context,a={client:this.#e,meta:this.options.meta,mutationKey:this.options.mutationKey};if(e?.type==="success"){try{this.#a.onSuccess?.(e.data,t,r,a)}catch(e){Promise.reject(e)}try{this.#a.onSettled?.(e.data,null,t,r,a)}catch(e){Promise.reject(e)}}else if(e?.type==="error"){try{this.#a.onError?.(e.error,t,r,a)}catch(e){Promise.reject(e)}try{this.#a.onSettled?.(void 0,e.error,t,r,a)}catch(e){Promise.reject(e)}}}this.listeners.forEach(e=>{e(this.#t)})})}},i=e.i(912598);e.s(["useMutation",0,function(e,r){let s=(0,i.useQueryClient)(r),[n]=t.useState(()=>new l(s,e));t.useEffect(()=>{n.setOptions(e)},[n,e]);let d=t.useSyncExternalStore(t.useCallback(e=>n.subscribe(a.notifyManager.batchCalls(e)),[n]),()=>n.getCurrentResult(),()=>n.getCurrentResult()),c=t.useCallback((e,t)=>{n.mutate(e,t).catch(o.noop)},[n]);if(d.error&&(0,o.shouldThrowError)(n.options.throwOnError,[d.error]))throw d.error;return{...d,mutate:c,mutateAsync:d.mutate}}],954616)},597440,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M360 184h-8c4.4 0 8-3.6 8-8v8h304v-8c0 4.4 3.6 8 8 8h-8v72h72v-80c0-35.3-28.7-64-64-64H352c-35.3 0-64 28.7-64 64v80h72v-72zm504 72H160c-17.7 0-32 14.3-32 32v32c0 4.4 3.6 8 8 8h60.4l24.7 523c1.6 34.1 29.8 61 63.9 61h454c34.2 0 62.3-26.8 63.9-61l24.7-523H888c4.4 0 8-3.6 8-8v-32c0-17.7-14.3-32-32-32zM731.3 840H292.7l-24.2-512h487l-24.2 512z"}}]},name:"delete",theme:"outlined"};var s=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(s.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["default",0,o],597440)},955135,e=>{"use strict";var t=e.i(597440);e.s(["DeleteOutlined",()=>t.default])},646563,e=>{"use strict";var t=e.i(959013);e.s(["PlusOutlined",()=>t.default])},91739,e=>{"use strict";var t=e.i(544195);e.s(["Radio",()=>t.default])},482725,e=>{"use strict";var t=e.i(244451);e.s(["Spin",()=>t.default])},500330,e=>{"use strict";var t=e.i(727749);let r=(e,t=0,r=!1,a=!0)=>{if(null==e||!Number.isFinite(e)||0===e&&!a)return"-";let s={minimumFractionDigits:t,maximumFractionDigits:t};if(!r)return e.toLocaleString("en-US",s);let o=e<0?"-":"",l=Math.abs(e),i=l,n="";return l>=1e6?(i=l/1e6,n="M"):l>=1e3&&(i=l/1e3,n="K"),`${o}${i.toLocaleString("en-US",s)}${n}`},a=async(e,r="Copied to clipboard")=>{if(!e)return!1;if(!navigator||!navigator.clipboard||!navigator.clipboard.writeText)return s(e,r);try{return await navigator.clipboard.writeText(e),t.default.success(r),!0}catch(t){return console.error("Clipboard API failed: ",t),s(e,r)}},s=(e,r)=>{try{let a=document.createElement("textarea");a.value=e,a.style.position="fixed",a.style.left="-999999px",a.style.top="-999999px",a.setAttribute("readonly",""),document.body.appendChild(a),a.focus(),a.select();let s=document.execCommand("copy");if(document.body.removeChild(a),s)return t.default.success(r),!0;throw Error("execCommand failed")}catch(e){return t.default.fromBackend("Failed to copy to clipboard"),console.error("Failed to copy: ",e),!1}};e.s(["copyToClipboard",0,a,"formatNumberWithCommas",0,r,"getSpendString",0,(e,t=6)=>{if(null==e||!Number.isFinite(e)||0===e)return"-";let a=r(e,t,!1,!1);if(0===Number(a.replace(/,/g,""))){let e=(1/10**t).toFixed(t);return`< $${e}`}return`$${a}`},"updateExistingKeys",0,function(e,t){let r=structuredClone(e);for(let[e,a]of Object.entries(t))e in r&&(r[e]=a);return r}])},211576,e=>{"use strict";var t=e.i(131757);e.s(["Col",()=>t.default])},178654,e=>{"use strict";let t=e.i(211576).Col;e.s(["Col",0,t],178654)},621192,e=>{"use strict";let t=e.i(264042).Row;e.s(["Row",0,t],621192)},988297,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M12 4v16m8-8H4"}))});e.s(["PlusIcon",0,r],988297)},246349,e=>{"use strict";let t=(0,e.i(475254).default)("chevron-right",[["path",{d:"m9 18 6-6-6-6",key:"mthhwq"}]]);e.s(["default",0,t])},695411,e=>{"use strict";var t=e.i(602869);let r=async e=>{try{let r=await (0,t.modelHubCall)(e);if(r?.data.length>0){let e=r.data.map(e=>({model_group:e.model_group,mode:e?.mode}));return e.sort((e,t)=>e.model_group.localeCompare(t.model_group)),e}return[]}catch(e){throw console.error("Error fetching model info:",e),e}};e.s(["fetchAvailableModels",0,r])},555987,e=>{"use strict";var t=e.i(221688),r=e.i(950643);let a=/^(https?:|data:|blob:|\/\/)/i;e.s(["resolveLogoSrc",0,(e,s=t.serverRootPath)=>{if(e){let t;return a.test(e)?e:(t=(0,r.normalizeRootPath)(s),`${t}${e.startsWith("/")?e:`/${e}`}`)}}])},269200,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("Table"),o=r.default.forwardRef((e,o)=>{let{children:l,className:i}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement("div",{className:(0,a.tremorTwMerge)(s("root"),"overflow-auto",i)},r.default.createElement("table",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("table"),"w-full text-tremor-default","text-tremor-content","dark:text-dark-tremor-content")},n),l))});o.displayName="Table",e.s(["Table",0,o],269200)},427612,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("TableHead"),o=r.default.forwardRef((e,o)=>{let{children:l,className:i}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("thead",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("root"),"text-left","text-tremor-content","dark:text-dark-tremor-content",i)},n),l))});o.displayName="TableHead",e.s(["TableHead",0,o],427612)},64848,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("TableHeaderCell"),o=r.default.forwardRef((e,o)=>{let{children:l,className:i}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("th",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("root"),"whitespace-nowrap text-left font-semibold top-0 px-4 py-3.5","text-tremor-content-strong","dark:text-dark-tremor-content-strong",i)},n),l))});o.displayName="TableHeaderCell",e.s(["TableHeaderCell",0,o],64848)},942232,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("TableBody"),o=r.default.forwardRef((e,o)=>{let{children:l,className:i}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("tbody",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("root"),"align-top divide-y","divide-tremor-border","dark:divide-dark-tremor-border",i)},n),l))});o.displayName="TableBody",e.s(["TableBody",0,o],942232)},496020,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("TableRow"),o=r.default.forwardRef((e,o)=>{let{children:l,className:i}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("tr",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("row"),i)},n),l))});o.displayName="TableRow",e.s(["TableRow",0,o],496020)},977572,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("TableCell"),o=r.default.forwardRef((e,o)=>{let{children:l,className:i}=e,n=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("td",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("root"),"align-middle whitespace-nowrap text-left p-4",i)},n),l))});o.displayName="TableCell",e.s(["TableCell",0,o],977572)},68155,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"}))});e.s(["TrashIcon",0,r],68155)},797672,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z"}))});e.s(["PencilIcon",0,r],797672)},992619,e=>{"use strict";var t=e.i(843476),r=e.i(271645),a=e.i(779241),s=e.i(599724),o=e.i(199133),l=e.i(983561),i=e.i(695411);e.s(["default",0,({accessToken:e,value:n,placeholder:d="Select a Model",onChange:c,disabled:u=!1,style:m,className:g,showLabel:h=!0,labelText:p="Select Model"})=>{let[f,b]=(0,r.useState)(n),[x,v]=(0,r.useState)(!1),[w,C]=(0,r.useState)([]),y=(0,r.useRef)(null);return(0,r.useEffect)(()=>{b(n)},[n]),(0,r.useEffect)(()=>{e&&(async()=>{try{let t=await (0,i.fetchAvailableModels)(e);t.length>0&&C(t)}catch(e){console.error("Error fetching model info:",e)}})()},[e]),(0,t.jsxs)("div",{children:[h&&(0,t.jsxs)(s.Text,{className:"font-medium block mb-2 text-gray-700 flex items-center",children:[(0,t.jsx)(l.RobotOutlined,{className:"mr-2"})," ",p]}),(0,t.jsx)(o.Select,{value:f,placeholder:d,onChange:e=>{"custom"===e?(v(!0),b(void 0)):(v(!1),b(e),c&&c(e))},options:[...Array.from(new Set(w.map(e=>e.model_group))).map((e,t)=>({value:e,label:e,key:t})),{value:"custom",label:"Enter custom model",key:"custom"}],style:{width:"100%",...m},showSearch:!0,className:`rounded-md ${g||""}`,disabled:u}),x&&(0,t.jsx)(a.TextInput,{className:"mt-2",placeholder:"Enter custom model name",onValueChange:e=>{y.current&&clearTimeout(y.current),y.current=setTimeout(()=>{b(e),c&&c(e)},500)},disabled:u})]})}])},350967,46757,e=>{"use strict";var t=e.i(290571),r=e.i(444755),a=e.i(673706),s=e.i(271645);let o={0:"grid-cols-none",1:"grid-cols-1",2:"grid-cols-2",3:"grid-cols-3",4:"grid-cols-4",5:"grid-cols-5",6:"grid-cols-6",7:"grid-cols-7",8:"grid-cols-8",9:"grid-cols-9",10:"grid-cols-10",11:"grid-cols-11",12:"grid-cols-12"},l={0:"sm:grid-cols-none",1:"sm:grid-cols-1",2:"sm:grid-cols-2",3:"sm:grid-cols-3",4:"sm:grid-cols-4",5:"sm:grid-cols-5",6:"sm:grid-cols-6",7:"sm:grid-cols-7",8:"sm:grid-cols-8",9:"sm:grid-cols-9",10:"sm:grid-cols-10",11:"sm:grid-cols-11",12:"sm:grid-cols-12"},i={0:"md:grid-cols-none",1:"md:grid-cols-1",2:"md:grid-cols-2",3:"md:grid-cols-3",4:"md:grid-cols-4",5:"md:grid-cols-5",6:"md:grid-cols-6",7:"md:grid-cols-7",8:"md:grid-cols-8",9:"md:grid-cols-9",10:"md:grid-cols-10",11:"md:grid-cols-11",12:"md:grid-cols-12"},n={0:"lg:grid-cols-none",1:"lg:grid-cols-1",2:"lg:grid-cols-2",3:"lg:grid-cols-3",4:"lg:grid-cols-4",5:"lg:grid-cols-5",6:"lg:grid-cols-6",7:"lg:grid-cols-7",8:"lg:grid-cols-8",9:"lg:grid-cols-9",10:"lg:grid-cols-10",11:"lg:grid-cols-11",12:"lg:grid-cols-12"};e.s(["colSpan",0,{1:"col-span-1",2:"col-span-2",3:"col-span-3",4:"col-span-4",5:"col-span-5",6:"col-span-6",7:"col-span-7",8:"col-span-8",9:"col-span-9",10:"col-span-10",11:"col-span-11",12:"col-span-12",13:"col-span-13"},"colSpanLg",0,{1:"lg:col-span-1",2:"lg:col-span-2",3:"lg:col-span-3",4:"lg:col-span-4",5:"lg:col-span-5",6:"lg:col-span-6",7:"lg:col-span-7",8:"lg:col-span-8",9:"lg:col-span-9",10:"lg:col-span-10",11:"lg:col-span-11",12:"lg:col-span-12",13:"lg:col-span-13"},"colSpanMd",0,{1:"md:col-span-1",2:"md:col-span-2",3:"md:col-span-3",4:"md:col-span-4",5:"md:col-span-5",6:"md:col-span-6",7:"md:col-span-7",8:"md:col-span-8",9:"md:col-span-9",10:"md:col-span-10",11:"md:col-span-11",12:"md:col-span-12",13:"md:col-span-13"},"colSpanSm",0,{1:"sm:col-span-1",2:"sm:col-span-2",3:"sm:col-span-3",4:"sm:col-span-4",5:"sm:col-span-5",6:"sm:col-span-6",7:"sm:col-span-7",8:"sm:col-span-8",9:"sm:col-span-9",10:"sm:col-span-10",11:"sm:col-span-11",12:"sm:col-span-12",13:"sm:col-span-13"},"gridCols",0,o,"gridColsLg",0,n,"gridColsMd",0,i,"gridColsSm",0,l],46757);let d=(0,a.makeClassName)("Grid"),c=(e,t)=>e&&Object.keys(t).includes(String(e))?t[e]:"",u=s.default.forwardRef((e,a)=>{let{numItems:u=1,numItemsSm:m,numItemsMd:g,numItemsLg:h,children:p,className:f}=e,b=(0,t.__rest)(e,["numItems","numItemsSm","numItemsMd","numItemsLg","children","className"]),x=c(u,o),v=c(m,l),w=c(g,i),C=c(h,n),y=(0,r.tremorTwMerge)(x,v,w,C);return s.default.createElement("div",Object.assign({ref:a,className:(0,r.tremorTwMerge)(d("root"),"grid",y,f)},b),p)});u.displayName="Grid",e.s(["Grid",0,u],350967)},981339,e=>{"use strict";var t=e.i(185793);e.s(["Skeleton",()=>t.default])},500727,e=>{"use strict";var t=e.i(266027),r=e.i(243652),a=e.i(602869),s=e.i(135214);let o=(0,r.createQueryKeys)("mcpServers");e.s(["useMCPServers",0,e=>{let{accessToken:r}=(0,s.default)();return(0,t.useQuery)({queryKey:o.list(e?{filters:{teamId:e}}:void 0),queryFn:async()=>await (0,a.fetchMCPServers)(r,e),enabled:!!r})}])},699857,e=>{"use strict";var t=e.i(266027),r=e.i(243652),a=e.i(602869),s=e.i(135214);let o=(0,r.createQueryKeys)("mcpToolsets");e.s(["useMCPToolsets",0,()=>{let{accessToken:e}=(0,s.default)();return(0,t.useQuery)({queryKey:o.list(),queryFn:async()=>await (0,a.fetchMCPToolsets)(e),enabled:!!e})}])},841947,e=>{"use strict";let t=(0,e.i(475254).default)("x",[["path",{d:"M18 6 6 18",key:"1bl5f8"}],["path",{d:"m6 6 12 12",key:"d8bk6v"}]]);e.s(["default",0,t])},361653,e=>{"use strict";let t=(0,e.i(475254).default)("circle-alert",[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["line",{x1:"12",x2:"12",y1:"8",y2:"12",key:"1pkeuh"}],["line",{x1:"12",x2:"12.01",y1:"16",y2:"16",key:"4dfq90"}]]);e.s(["default",0,t])},409797,e=>{"use strict";var t=e.i(631171);e.s(["ChevronDownIcon",()=>t.default])},531516,696609,e=>{"use strict";var t=e.i(843476),r=e.i(271645),a=e.i(536916),s=e.i(599724),o=e.i(409797),l=e.i(246349),l=l;let i=/\b(delete|remove|destroy|purge|drop|erase|unlink)\b/i,n=/\b(create|add|insert|new|post|submit|register|make|generate|write|upload)\b/i,d=/\b(update|edit|modify|change|patch|put|set|rename|move|transform)\b/i,c=/\b(get|read|list|fetch|search|find|query|retrieve|show|view|check|describe|info)\b/i;function u(e,t=""){let r=e.toLowerCase();if(c.test(r))return"read";if(i.test(r))return"delete";if(d.test(r))return"update";if(n.test(r))return"create";if(t){let e=t.toLowerCase();if(c.test(e))return"read";if(i.test(e))return"delete";if(d.test(e))return"update";if(n.test(e))return"create"}return"unknown"}function m(e){let t={read:[],create:[],update:[],delete:[],unknown:[]};for(let r of e)t[u(r.name,r.description)].push(r);return t}let g={read:{label:"Read",description:"Safe operations — fetch, list, search. No side effects.",risk:"low"},create:{label:"Create",description:"Add new resources — insert, upload, register.",risk:"medium"},update:{label:"Update",description:"Modify existing resources — edit, patch, rename.",risk:"medium"},delete:{label:"Delete",description:"Destructive operations — remove, purge, destroy.",risk:"high"},unknown:{label:"Other",description:"Operations that could not be automatically classified.",risk:"unknown"}};e.s(["CRUD_GROUP_META",0,g,"classifyToolOp",0,u,"groupToolsByCrud",0,m],696609);let h=["read","create","update","delete","unknown"],p={low:"bg-green-100 text-green-800",medium:"bg-yellow-100 text-yellow-800",high:"bg-red-100 text-red-800 font-semibold",unknown:"bg-gray-100 text-gray-700"},f={read:"border-green-200",create:"border-blue-200",update:"border-yellow-200",delete:"border-red-300",unknown:"border-gray-200"},b={read:"bg-green-50",create:"bg-blue-50",update:"bg-yellow-50",delete:"bg-red-50",unknown:"bg-gray-50"};e.s(["default",0,({tools:e,value:i,onChange:n,readOnly:d=!1,searchFilter:c=""})=>{let[u,x]=(0,r.useState)({read:!1,create:!1,update:!1,delete:!1,unknown:!0}),v=(0,r.useMemo)(()=>m(e),[e]),w=(0,r.useMemo)(()=>new Set(void 0===i?e.map(e=>e.name):i),[i,e]),C=e=>{if(d)return;let t=new Set(w);t.has(e)?t.delete(e):t.add(e),n(Array.from(t))};return 0===e.length?null:(0,t.jsx)("div",{className:"space-y-3",children:h.map(e=>{let r,i=v[e];if(0===i.length)return null;if(c){let e=c.toLowerCase();if(!i.some(t=>t.name.toLowerCase().includes(e)||(t.description??"").toLowerCase().includes(e)))return null}let m=g[e],h=(r=v[e]).length>0&&r.every(e=>w.has(e.name)),y=(e=>{let t=v[e];if(0===t.length)return!1;let r=t.filter(e=>w.has(e.name)).length;return r>0&&r{x(t=>({...t,[e]:!t[e]}))},children:[k?(0,t.jsx)(l.default,{className:"w-4 h-4 text-gray-500 shrink-0"}):(0,t.jsx)(o.ChevronDownIcon,{className:"w-4 h-4 text-gray-500 shrink-0"}),(0,t.jsx)("span",{className:"font-semibold text-gray-900 text-sm",children:m.label}),(0,t.jsx)("span",{className:`text-xs px-2 py-0.5 rounded-full ${p[m.risk]}`,children:"high"===m.risk?"High Risk":"medium"===m.risk?"Medium Risk":"low"===m.risk?"Safe":"Unclassified"}),(0,t.jsxs)("span",{className:"text-xs text-gray-500 ml-1",children:[i.filter(e=>w.has(e.name)).length,"/",i.length," allowed"]})]}),!d&&(0,t.jsxs)("div",{className:"flex items-center gap-2 ml-4",children:[(0,t.jsx)(s.Text,{className:"text-xs text-gray-500",children:h?"All on":y?"Partial":"All off"}),(0,t.jsx)(a.Checkbox,{checked:h,indeterminate:y,onChange:t=>((e,t)=>{if(d)return;let r=new Set(w);for(let a of v[e])t?r.add(a.name):r.delete(a.name);n(Array.from(r))})(e,t.target.checked),onClick:e=>e.stopPropagation()})]})]}),!k&&(0,t.jsx)("div",{className:"px-4 pt-2 pb-1 text-xs text-gray-500 bg-white border-b border-gray-100",children:m.description}),!k&&(0,t.jsx)("div",{className:"bg-white divide-y divide-gray-50",children:i.filter(e=>!c||e.name.toLowerCase().includes(c.toLowerCase())||(e.description??"").toLowerCase().includes(c.toLowerCase())).map(e=>{let r,o=(r=e.name,w.has(r));return(0,t.jsxs)("div",{className:`flex items-start gap-3 px-4 py-2.5 transition-colors hover:bg-gray-50 ${!d?"cursor-pointer":""} ${o?"":"opacity-60"}`,onClick:()=>C(e.name),children:[(0,t.jsx)(a.Checkbox,{checked:o,onChange:()=>C(e.name),disabled:d,onClick:e=>e.stopPropagation()}),(0,t.jsxs)("div",{className:"flex-1 min-w-0",children:[(0,t.jsx)(s.Text,{className:"font-medium text-gray-900 text-sm",children:e.name}),e.description&&(0,t.jsx)(s.Text,{className:"text-xs text-gray-500 mt-0.5 leading-snug",children:e.description})]}),(0,t.jsx)("span",{className:`text-xs px-1.5 py-0.5 rounded shrink-0 ${o?"bg-green-100 text-green-700":"bg-gray-100 text-gray-500"}`,children:o?"on":"off"})]},e.name)})})]},e)})})}],531516)},962944,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M848 359.3H627.7L825.8 109c4.1-5.3.4-13-6.3-13H436c-2.8 0-5.5 1.5-6.9 4L170 547.5c-3.1 5.3.7 12 6.9 12h174.4l-89.4 357.6c-1.9 7.8 7.5 13.3 13.3 7.7L853.5 373c5.2-4.9 1.7-13.7-5.5-13.7zM378.2 732.5l60.3-241H281.1l189.6-327.4h224.6L487 427.4h211L378.2 732.5z"}}]},name:"thunderbolt",theme:"outlined"};var s=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(s.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["ThunderboltOutlined",0,o],962944)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/035i-tbvd3z7s.js b/litellm/proxy/_experimental/out/_next/static/chunks/035i-tbvd3z7s.js deleted file mode 100644 index 7e8cf73121d..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/035i-tbvd3z7s.js +++ /dev/null @@ -1,10 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,664307,e=>{"use strict";var t=e.i(843476),l=e.i(602869),s=e.i(266027),a=e.i(243652),r=e.i(135214);let i=(0,a.createQueryKeys)("credentials"),o=()=>{let{accessToken:e}=(0,r.default)();return(0,s.useQuery)({queryKey:i.list({}),queryFn:async()=>await (0,l.credentialListCall)(e),enabled:!!e})};var n=e.i(368670),d=e.i(625901),c=e.i(292639),m=e.i(954616),u=e.i(785242),h=e.i(152990),p=e.i(682830),x=e.i(271645),g=e.i(269200),f=e.i(427612),_=e.i(64848),j=e.i(942232),y=e.i(496020),b=e.i(977572),v=e.i(446891);function N({data:e=[],columns:l,isLoading:s=!1,sorting:a=[],onSortingChange:r,pagination:i,onPaginationChange:o,enablePagination:n=!1,onRowClick:d}){let[c]=x.default.useState("onChange"),[m,u]=x.default.useState({}),[w,C]=x.default.useState({}),k=(0,h.useReactTable)({data:e,columns:l,state:{sorting:a,columnSizing:m,columnVisibility:w,...n&&i?{pagination:i}:{}},columnResizeMode:c,onSortingChange:r,onColumnSizingChange:u,onColumnVisibilityChange:C,...n&&o?{onPaginationChange:o}:{},getCoreRowModel:(0,p.getCoreRowModel)(),...n?{getPaginationRowModel:(0,p.getPaginationRowModel)()}:{},enableSorting:!0,enableColumnResizing:!0,manualSorting:!0,defaultColumn:{minSize:40,maxSize:500}});return(0,t.jsx)("div",{className:"rounded-lg custom-border relative",children:(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsx)("div",{className:"relative min-w-full",children:(0,t.jsxs)(g.Table,{className:"[&_td]:py-2 [&_th]:py-2",style:{width:k.getTotalSize(),minWidth:"100%",tableLayout:"fixed"},children:[(0,t.jsx)(f.TableHead,{children:k.getHeaderGroups().map(e=>(0,t.jsx)(y.TableRow,{children:e.headers.map(e=>(0,t.jsxs)(_.TableHeaderCell,{className:`py-1 h-8 relative ${"actions"===e.id?"sticky right-0 bg-white shadow-[-4px_0_8px_-6px_rgba(0,0,0,0.1)] w-[120px] ml-8":""} ${e.column.columnDef.meta?.className||""}`,style:{width:"actions"===e.id?120:e.getSize(),position:"actions"===e.id?"sticky":"relative",right:"actions"===e.id?0:"auto"},children:[(0,t.jsxs)("div",{className:"flex items-center justify-between gap-2",children:[(0,t.jsx)("div",{className:"flex items-center",children:e.isPlaceholder?null:(0,h.flexRender)(e.column.columnDef.header,e.getContext())}),"actions"!==e.id&&e.column.getCanSort()&&r&&(0,t.jsx)(v.TableHeaderSortDropdown,{sortState:!1!==e.column.getIsSorted()&&e.column.getIsSorted(),onSortChange:t=>{!1===t?r([]):r([{id:e.column.id,desc:"desc"===t}])},columnId:e.column.id})]}),e.column.getCanResize()&&(0,t.jsx)("div",{onMouseDown:e.getResizeHandler(),onTouchStart:e.getResizeHandler(),className:`absolute right-0 top-0 h-full w-2 cursor-col-resize select-none touch-none ${e.column.getIsResizing()?"bg-blue-500":"hover:bg-blue-200"}`})]},e.id))},e.id))}),(0,t.jsx)(j.TableBody,{children:s?(0,t.jsx)(y.TableRow,{children:(0,t.jsx)(b.TableCell,{colSpan:l.length,className:"h-8 text-center",children:(0,t.jsx)("div",{className:"text-center text-gray-500",children:(0,t.jsx)("p",{children:"🚅 Loading models..."})})})}):k.getRowModel().rows.length>0?k.getRowModel().rows.map(e=>(0,t.jsx)(y.TableRow,{className:d?"cursor-pointer hover:bg-gray-50":"",onClick:()=>d?.(e.original),children:e.getVisibleCells().map(e=>(0,t.jsx)(b.TableCell,{className:`py-0.5 overflow-hidden ${"actions"===e.column.id?"sticky right-0 bg-white shadow-[-4px_0_8px_-6px_rgba(0,0,0,0.1)] w-[120px] ml-8":""} ${e.column.columnDef.meta?.className||""}`,style:{width:"actions"===e.column.id?120:e.column.getSize(),position:"actions"===e.column.id?"sticky":"relative",right:"actions"===e.column.id?0:"auto"},children:(0,h.flexRender)(e.column.columnDef.cell,e.getContext())},e.id))},e.id)):(0,t.jsx)(y.TableRow,{children:(0,t.jsx)(b.TableCell,{colSpan:l.length,className:"h-8 text-center",children:(0,t.jsx)("div",{className:"text-center text-gray-500",children:(0,t.jsx)("p",{children:"No models found"})})})})})]})})})})}var w=e.i(751904),C=e.i(827252),k=e.i(772345),S=e.i(68155),T=e.i(389083),I=e.i(994388),F=e.i(752978),P=e.i(312361),M=e.i(525720),A=e.i(282786),E=e.i(770914),L=e.i(790848),O=e.i(592968),R=e.i(898586),B=e.i(418371);let{Text:z,Title:q}=R.Typography,V=(0,t.jsxs)(E.Space,{direction:"vertical",size:12,children:[(0,t.jsx)(z,{strong:!0,style:{fontSize:13},children:"Credential types"}),(0,t.jsxs)(E.Space,{direction:"vertical",size:8,children:[(0,t.jsx)(M.Flex,{align:"center",gap:8,children:(0,t.jsxs)(E.Space,{direction:"vertical",children:[(0,t.jsxs)(M.Flex,{align:"center",gap:8,children:[(0,t.jsx)(k.SyncOutlined,{style:{color:"#1890ff"}}),(0,t.jsx)(q,{level:5,style:{margin:0,color:"#1890ff"},children:"Reusable"})]}),(0,t.jsx)(z,{type:"secondary",children:"Credentials saved in LiteLLM that can be added to models repeatedly."})]})}),(0,t.jsx)(P.Divider,{size:"small"}),(0,t.jsx)(M.Flex,{align:"center",gap:8,children:(0,t.jsxs)(E.Space,{direction:"vertical",size:8,children:[(0,t.jsxs)(M.Flex,{align:"center",gap:8,children:[(0,t.jsx)(w.EditOutlined,{style:{color:"#8c8c8c",fontSize:14,flexShrink:0}}),(0,t.jsx)(q,{level:5,style:{margin:0},children:"Manual"})]}),(0,t.jsx)(z,{type:"secondary",children:"Credentials added directly during model creation or defined in the config file."})]})})]})]}),D=e=>e?.model_info?.team_public_model_name?e.model_info.team_public_model_name:e?.model_name||"-";var H=e.i(127952),G=e.i(727749),U=e.i(313603),$=e.i(912598),K=e.i(350967),J=e.i(404206),W=e.i(906579),Q=e.i(464571),Y=e.i(199133),X=e.i(981339),Z=e.i(153472);let ee=async(e,t)=>{let s=(0,l.getProxyBaseUrl)(),a=s?`${s}/config/field/update`:"/config/field/update",r=await fetch(a,{method:"POST",headers:{[(0,l.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"},body:JSON.stringify({field_name:"store_model_in_db",field_value:t.store_model_in_db,config_type:"general_settings"})});if(!r.ok){let e=await r.json().catch(()=>({}));throw Error(e?.error?.message||e?.message||e?.detail||"Failed to update model storage settings")}return await r.json()};var et=e.i(190702),el=e.i(808613),es=e.i(212931);let ea=({isVisible:e,onCancel:l,onSuccess:s})=>{let[a]=el.Form.useForm(),{mutateAsync:i,isPending:o}=(()=>{let{accessToken:e}=(0,r.default)();return(0,m.useMutation)({mutationFn:async t=>{if(!e)throw Error("Access token is required");return await ee(e,t)}})})(),{data:n,isLoading:d,refetch:c}=(0,Z.useProxyConfig)(Z.ConfigType.GENERAL_SETTINGS);(0,x.useEffect)(()=>{e&&c()},[e,c]);let u=(0,x.useMemo)(()=>{if(!n)return{store_model_in_db:!1};let e=n.find(e=>"store_model_in_db"===e.field_name);return{store_model_in_db:e?.field_value??!1}},[n]),h=async e=>{try{await i(e,{onSuccess:()=>{G.default.success("Model storage settings updated successfully"),c(),s?.()},onError:e=>{G.default.fromBackend("Failed to save model storage settings: "+(0,et.parseErrorMessage)(e))}})}catch(e){G.default.fromBackend("Failed to save model storage settings: "+(0,et.parseErrorMessage)(e))}},p=()=>{a.resetFields(),l()};return(0,t.jsx)(es.Modal,{title:(0,t.jsx)(R.Typography.Title,{level:5,children:"Model Settings"}),open:e,footer:(0,t.jsxs)(E.Space,{children:[(0,t.jsx)(Q.Button,{onClick:p,disabled:o||d,children:"Cancel"}),(0,t.jsx)(Q.Button,{type:"primary",loading:o,disabled:d,onClick:()=>a.submit(),children:o?"Saving...":"Save Settings"})]}),onCancel:p,children:(0,t.jsx)(el.Form,{form:a,layout:"horizontal",onFinish:h,initialValues:u,children:(0,t.jsx)(el.Form.Item,{label:"Store Model in DB",name:"store_model_in_db",tooltip:n?.find(e=>"store_model_in_db"===e.field_name)?.field_description||"If enabled, models and config are stored in and loaded from the database.",valuePropName:"checked",children:d?(0,t.jsx)(X.Skeleton.Input,{active:!0,block:!0}):(0,t.jsx)(L.Switch,{})})},n?JSON.stringify(u):"loading")})};var er=e.i(374009);let ei=(e,t)=>{if(!e?.data)return{data:[]};let l=JSON.parse(JSON.stringify(e.data));for(let e=0;e"model"!==e&&"api_base"!==e))),l[e].provider=o,l[e].input_cost=n,l[e].output_cost=d,l[e].litellm_model_name=a,null!=l[e].input_cost&&(l[e].input_cost=(1e6*Number(l[e].input_cost)).toFixed(2)),null!=l[e].output_cost&&(l[e].output_cost=(1e6*Number(l[e].output_cost)).toFixed(2)),l[e].max_tokens=c,l[e].max_input_tokens=m,l[e].api_base=s?.litellm_params?.api_base,l[e].cleanedLitellmParams=u}return{data:l}},{Text:eo}=R.Typography,en=({selectedModelGroup:e,setSelectedModelGroup:s,availableModelGroups:a,availableModelAccessGroups:i,setSelectedModelId:o,setSelectedTeamId:c})=>{let{data:m,isLoading:h}=(0,n.useModelCostMap)(),{accessToken:p,userId:g,userRole:f,premiumUser:_}=(0,r.default)(),{data:j,isLoading:y}=(0,u.useTeams)(),b=(0,$.useQueryClient)(),[v,P]=(0,x.useState)(""),[R,q]=(0,x.useState)(""),[Z,ee]=(0,x.useState)("current_team"),[et,el]=(0,x.useState)("personal"),[es,en]=(0,x.useState)(!1),[ed,ec]=(0,x.useState)(null),[em,eu]=(0,x.useState)(new Set),[eh,ep]=(0,x.useState)(1),[ex]=(0,x.useState)(50),[eg,ef]=(0,x.useState)({pageIndex:0,pageSize:50}),[e_,ej]=(0,x.useState)([]),[ey,eb]=(0,x.useState)(!1),ev=(0,x.useMemo)(()=>(0,er.default)(e=>{q(e),ep(1),ef(e=>({...e,pageIndex:0}))},200),[]);(0,x.useEffect)(()=>(ev(v),()=>{ev.cancel()}),[v,ev]);let eN="personal"===et?void 0:et.team_id,ew=(0,x.useMemo)(()=>{if(0===e_.length)return;let e=e_[0];return({input_cost:"costs",model_info_db_model:"status",model_info_created_by:"created_at",model_info_updated_at:"updated_at"})[e.id]||e.id},[e_]),eC=(0,x.useMemo)(()=>{if(0!==e_.length)return e_[0].desc?"desc":"asc"},[e_]),{data:ek,isLoading:eS,refetch:eT}=(0,d.useModelsInfo)(eh,ex,R||void 0,void 0,eN,ew,eC),eI=eS||h,eF=e=>null!=m&&"object"==typeof m&&e in m?m[e].litellm_provider:"openai",eP=(0,x.useMemo)(()=>ek?ei(ek,eF):{data:[]},[ek,m]),[eM,eA]=(0,x.useState)(null),[eE,eL]=(0,x.useState)(!1),eO=(0,x.useMemo)(()=>ek?{total_count:ek.total_count??0,current_page:ek.current_page??1,total_pages:ek.total_pages??1,size:ek.size??ex}:{total_count:0,current_page:1,total_pages:1,size:ex},[ek,ex]),eR=(0,x.useMemo)(()=>eP&&eP.data&&0!==eP.data.length?eP.data.filter(t=>{let l="all"===e||t.model_name===e||!e||"wildcard"===e&&t.model_name?.includes("*"),s="all"===ed||t.model_info.access_groups?.includes(ed)||!ed;return l&&s}):[],[eP,e,ed]);(0,x.useEffect)(()=>{ef(e=>({...e,pageIndex:0})),ep(1)},[e,ed]),(0,x.useEffect)(()=>{ep(1),ef(e=>({...e,pageIndex:0}))},[eN]),(0,x.useEffect)(()=>{ep(1),ef(e=>({...e,pageIndex:0}))},[e_]);let eB=(0,x.useMemo)(()=>eM&&eP?.data?eP.data.find(e=>e.model_info.id===eM):null,[eM,eP]),ez=async()=>{if(p&&eM)try{eL(!0),await (0,l.modelDeleteCall)(p,eM),G.default.success("Model deleted successfully"),b.invalidateQueries({queryKey:["models","list"]}),eT()}catch(e){console.error("Error deleting model:",e),G.default.fromBackend(e)}finally{eL(!1),eA(null)}},[eq,eV]=(0,x.useState)(null),eD=async(e,t)=>{if(p)try{eV(e),await (0,l.modelPatchUpdateCall)(p,{blocked:t},e),G.default.success(t?"Model paused":"Model resumed"),b.invalidateQueries({queryKey:["models","list"]})}catch(e){console.error("Error toggling model pause state:",e),G.default.fromBackend(e)}finally{eV(null)}};return(0,t.jsxs)(J.TabPanel,{children:[(0,t.jsx)(K.Grid,{children:(0,t.jsx)("div",{className:"flex flex-col space-y-4",children:(0,t.jsxs)("div",{className:"bg-white rounded-lg shadow-sm",children:[(0,t.jsxs)("div",{className:"border-b px-6 py-4 bg-gray-50",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between",children:[(0,t.jsxs)("div",{className:"flex items-center gap-4",children:[(0,t.jsx)(eo,{className:"text-lg font-semibold text-gray-900",children:"Current Team:"}),(0,t.jsx)("div",{className:"w-80",children:eI?(0,t.jsx)(X.Skeleton.Input,{active:!0,block:!0,size:"large"}):(0,t.jsx)(Y.Select,{style:{width:"100%"},size:"large",defaultValue:"personal",value:"personal"===et?"personal":et.team_id,onChange:e=>{if("personal"===e)el("personal"),ep(1),ef(e=>({...e,pageIndex:0}));else{let t=j?.find(t=>t.team_id===e);t&&(el(t),ep(1),ef(e=>({...e,pageIndex:0})))}},loading:y,options:[{value:"personal",label:(0,t.jsxs)(E.Space,{direction:"horizontal",align:"center",children:[(0,t.jsx)(W.Badge,{color:"blue",size:"small"}),(0,t.jsx)(eo,{style:{fontSize:16},children:"Personal"})]})},...j?.filter(e=>e.team_id).map(e=>({value:e.team_id,label:(0,t.jsxs)(E.Space,{direction:"horizontal",align:"center",children:[(0,t.jsx)(W.Badge,{color:"green",size:"small"}),(0,t.jsx)(eo,{ellipsis:!0,style:{fontSize:16},children:e.team_alias?e.team_alias:e.team_id})]})}))??[]]})})]}),(0,t.jsxs)("div",{className:"flex items-center gap-4",children:[(0,t.jsx)(eo,{className:"text-lg font-semibold text-gray-900",children:"View:"}),(0,t.jsx)("div",{className:"w-64",children:eI?(0,t.jsx)(X.Skeleton.Input,{active:!0,block:!0,size:"large"}):(0,t.jsx)(Y.Select,{style:{width:"100%"},size:"large",defaultValue:"current_team",value:Z,onChange:e=>ee(e),options:[{value:"current_team",label:(0,t.jsxs)(E.Space,{direction:"horizontal",align:"center",children:[(0,t.jsx)(W.Badge,{color:"purple",size:"small"}),(0,t.jsx)(eo,{style:{fontSize:16},children:"Current Team Models"})]})},{value:"all",label:(0,t.jsxs)(E.Space,{direction:"horizontal",align:"center",children:[(0,t.jsx)(W.Badge,{color:"gray",size:"small"}),(0,t.jsx)(eo,{style:{fontSize:16},children:"All Available Models"})]})}]})})]})]}),"current_team"===Z&&(0,t.jsxs)("div",{className:"flex items-start gap-2 mt-3",children:[(0,t.jsx)(C.InfoCircleOutlined,{className:"text-gray-400 mt-0.5 shrink-0 text-xs"}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"personal"===et?(0,t.jsxs)("span",{children:["To access these models: Create a Virtual Key without selecting a team on the"," ",(0,t.jsx)("a",{href:"/public?login=success&page=api-keys",className:"text-gray-600 hover:text-gray-800 underline",children:"Virtual Keys page"})]}):(0,t.jsxs)("span",{children:['To access these models: Create a Virtual Key and select Team as "',"string"!=typeof et?et.team_alias||et.team_id:"",'" on the'," ",(0,t.jsx)("a",{href:"/public?login=success&page=api-keys",className:"text-gray-600 hover:text-gray-800 underline",children:"Virtual Keys page"})]})})]})]}),(0,t.jsx)("div",{className:"border-b px-6 py-4",children:(0,t.jsxs)("div",{className:"flex flex-col space-y-4",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between gap-3",children:[(0,t.jsxs)("div",{className:"flex flex-wrap items-center gap-3",children:[(0,t.jsxs)("div",{className:"relative w-64",children:[(0,t.jsx)("input",{type:"text",placeholder:"Search model names...","data-testid":"model-search-input",className:"w-full px-3 py-2 pl-8 border rounded-md text-sm focus:outline-hidden focus:ring-2 focus:ring-blue-500 focus:border-blue-500",value:v,onChange:e=>P(e.target.value)}),(0,t.jsx)("svg",{className:"absolute left-2.5 top-2.5 h-4 w-4 text-gray-500",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24",children:(0,t.jsx)("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:2,d:"M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"})})]}),(0,t.jsxs)("button",{className:`px-3 py-2 text-sm border rounded-md hover:bg-gray-50 flex items-center gap-2 ${es?"bg-gray-100":""}`,onClick:()=>en(!es),children:[(0,t.jsx)("svg",{className:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24",children:(0,t.jsx)("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:2,d:"M3 4a1 1 0 011-1h16a1 1 0 011 1v2.586a1 1 0 01-.293.707l-6.414 6.414a1 1 0 00-.293.707V17l-4 4v-6.586a1 1 0 00-.293-.707L3.293 7.293A1 1 0 013 6.586V4z"})}),"Filters"]}),(0,t.jsxs)("button",{className:"px-3 py-2 text-sm border rounded-md hover:bg-gray-50 flex items-center gap-2",onClick:()=>{P(""),s("all"),ec(null),el("personal"),ee("current_team"),ep(1),ef({pageIndex:0,pageSize:50}),ej([])},children:[(0,t.jsx)("svg",{className:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24",children:(0,t.jsx)("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:2,d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"})}),"Reset Filters"]})]}),(0,t.jsx)(Q.Button,{icon:(0,t.jsx)(U.SettingOutlined,{}),onClick:()=>eb(!0),title:"Model Settings"})]}),es&&(0,t.jsxs)("div",{className:"flex flex-wrap items-center gap-3 mt-3",children:[(0,t.jsx)("div",{className:"w-64",children:(0,t.jsx)(Y.Select,{className:"w-full",value:e??"all",onChange:e=>s("all"===e?"all":e),placeholder:"Filter by Public Model Name",showSearch:!0,options:[{value:"all",label:"All Models"},{value:"wildcard",label:"Wildcard Models (*)"},...a.map((e,t)=>({value:e,label:e}))]})}),(0,t.jsx)("div",{className:"w-64",children:(0,t.jsx)(Y.Select,{className:"w-full",value:ed??"all",onChange:e=>ec("all"===e?null:e),placeholder:"Filter by Model Access Group",showSearch:!0,options:[{value:"all",label:"All Model Access Groups"},...i.map((e,t)=>({value:e,label:e}))]})})]}),(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[eI?(0,t.jsx)(X.Skeleton.Input,{active:!0,style:{width:184,height:20}}):(0,t.jsx)("span",{"data-testid":"models-results-count",className:"text-sm text-gray-700",children:eO.total_count>0?`Showing ${(eh-1)*ex+1} - ${Math.min(eh*ex,eO.total_count)} of ${eO.total_count} results`:"Showing 0 results"}),(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[eI?(0,t.jsx)(X.Skeleton.Button,{active:!0,style:{width:84,height:30}}):(0,t.jsx)("button",{onClick:()=>{ep(eh-1),ef(e=>({...e,pageIndex:0}))},disabled:1===eh,className:`px-3 py-1 text-sm border rounded-md ${1===eh?"bg-gray-100 text-gray-400 cursor-not-allowed":"hover:bg-gray-50"}`,children:"Previous"}),eI?(0,t.jsx)(X.Skeleton.Button,{active:!0,style:{width:56,height:30}}):(0,t.jsx)("button",{onClick:()=>{ep(eh+1),ef(e=>({...e,pageIndex:0}))},disabled:eh>=eO.total_pages,className:`px-3 py-1 text-sm border rounded-md ${eh>=eO.total_pages?"bg-gray-100 text-gray-400 cursor-not-allowed":"hover:bg-gray-50"}`,children:"Next"})]})]})]})}),(0,t.jsx)(N,{columns:[{header:()=>(0,t.jsx)("span",{className:"text-sm font-semibold",children:"Model ID"}),accessorKey:"model_info.id",enableSorting:!1,size:130,minSize:80,cell:({row:e})=>{let l=e.original;return(0,t.jsx)(O.Tooltip,{title:l.model_info.id,children:(0,t.jsx)(z,{ellipsis:!0,className:"text-blue-500 bg-blue-50 hover:bg-blue-100 text-xs cursor-pointer w-full block",style:{fontSize:14,padding:"1px 8px"},onClick:e=>{e.stopPropagation(),o(l.model_info.id)},children:l.model_info.id})})}},{header:()=>(0,t.jsx)("span",{className:"text-sm font-semibold",children:"Model Information"}),accessorKey:"model_name",size:250,minSize:120,cell:({row:e})=>{let l=e.original,s=D(e.original)||"-",a=(0,t.jsxs)(E.Space,{direction:"vertical",size:12,style:{minWidth:220},children:[(0,t.jsxs)(M.Flex,{align:"center",gap:8,children:[(0,t.jsx)(B.ProviderLogo,{provider:l.provider}),(0,t.jsx)(z,{type:"secondary",style:{fontSize:12},ellipsis:!0,children:l.provider||"Unknown provider"})]}),(0,t.jsxs)(E.Space,{direction:"vertical",size:6,children:[(0,t.jsxs)(E.Space,{direction:"vertical",size:2,style:{width:"100%"},children:[(0,t.jsx)(z,{type:"secondary",style:{fontSize:11},children:"Public Model Name"}),(0,t.jsx)(z,{strong:!0,style:{fontSize:13,maxWidth:480},ellipsis:!0,title:s,children:s})]}),(0,t.jsxs)(E.Space,{direction:"vertical",size:2,children:[(0,t.jsx)(z,{type:"secondary",style:{fontSize:11},children:"LiteLLM Model Name"}),(0,t.jsx)(z,{style:{fontSize:13},copyable:{text:l.litellm_model_name||"-"},ellipsis:!0,title:l.litellm_model_name||"-",children:l.litellm_model_name||"-"})]})]})]});return(0,t.jsx)(A.Popover,{content:a,placement:"right",arrow:{pointAtCenter:!0},styles:{root:{maxWidth:500}},children:(0,t.jsxs)("div",{className:"flex items-start space-x-2 min-w-0 w-full cursor-pointer",children:[(0,t.jsx)("div",{className:"shrink-0 mt-0.5",children:l.provider?(0,t.jsx)(B.ProviderLogo,{provider:l.provider}):(0,t.jsx)("div",{className:"w-4 h-4 rounded-full bg-gray-200 flex items-center justify-center text-xs",children:"-"})}),(0,t.jsxs)("div",{className:"flex flex-col min-w-0 flex-1",children:[(0,t.jsx)(z,{ellipsis:!0,className:"text-gray-900",style:{fontSize:12,fontWeight:500,lineHeight:"16px"},children:s}),(0,t.jsx)(z,{ellipsis:!0,type:"secondary",style:{fontSize:12,lineHeight:"16px",marginTop:2},children:l.litellm_model_name||"-"})]})]})})}},{header:()=>(0,t.jsxs)("span",{className:"flex items-center gap-1",children:[(0,t.jsx)("span",{className:"text-sm font-semibold",children:"Credentials"}),(0,t.jsx)(A.Popover,{content:V,placement:"bottom",arrow:{pointAtCenter:!0},children:(0,t.jsx)(C.InfoCircleOutlined,{className:"cursor-pointer text-gray-400 hover:text-gray-600",style:{fontSize:12}})})]}),accessorKey:"litellm_credential_name",enableSorting:!1,size:180,minSize:100,cell:({row:e})=>{let l=e.original,s=l.litellm_params?.litellm_credential_name,a=!!s;return(0,t.jsx)("div",{className:"flex items-center space-x-2 min-w-0 w-full",children:a?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(k.SyncOutlined,{className:"shrink-0",style:{color:"#1890ff",fontSize:14}}),(0,t.jsx)("span",{className:"text-xs truncate text-blue-600",title:s,children:s})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(w.EditOutlined,{className:"shrink-0",style:{color:"#8c8c8c",fontSize:14}}),(0,t.jsx)("span",{className:"text-xs text-gray-500",children:"Manual"})]})})}},{header:()=>(0,t.jsx)("span",{className:"text-sm font-semibold",children:"Created By"}),accessorKey:"model_info.created_by",sortingFn:"datetime",size:160,minSize:100,cell:({row:e})=>{let l=e.original,s=!l.model_info?.db_model,a=l.model_info.created_by,r=l.model_info.created_at?new Date(l.model_info.created_at).toLocaleDateString():null;return(0,t.jsxs)("div",{className:"flex flex-col min-w-0 w-full",children:[(0,t.jsx)("div",{className:"text-xs font-medium text-gray-900 truncate",title:s?"Defined in config":a||"Unknown",children:s?"Defined in config":a||"Unknown"}),(0,t.jsx)("div",{className:"text-xs text-gray-500 truncate mt-0.5",title:s?"Config file":r||"Unknown date",children:s?"-":r||"Unknown date"})]})}},{header:()=>(0,t.jsx)("span",{className:"text-sm font-semibold",children:"Updated At"}),accessorKey:"model_info.updated_at",sortingFn:"datetime",size:120,minSize:80,cell:({row:e})=>{let l=e.original;return(0,t.jsx)("span",{className:"text-xs",children:l.model_info.updated_at?new Date(l.model_info.updated_at).toLocaleDateString():"-"})}},{header:()=>(0,t.jsx)("span",{className:"text-sm font-semibold",children:"Costs"}),accessorKey:"input_cost",size:120,minSize:80,cell:({row:e})=>{let l=e.original,s=l.input_cost,a=l.output_cost;return null==s&&null==a?(0,t.jsx)("div",{className:"w-full",children:(0,t.jsx)("span",{className:"text-xs text-gray-400",children:"-"})}):(0,t.jsx)(O.Tooltip,{title:"Cost per 1M tokens",children:(0,t.jsxs)("div",{className:"flex flex-col min-w-0 w-full",children:[null!=s&&(0,t.jsxs)("div",{className:"text-xs font-medium text-gray-900 truncate",children:["In: $",s]}),null!=a&&(0,t.jsxs)("div",{className:"text-xs text-gray-500 truncate mt-0.5",children:["Out: $",a]})]})})}},{header:()=>(0,t.jsx)("span",{className:"text-sm font-semibold",children:"Team ID"}),accessorKey:"model_info.team_id",enableSorting:!1,size:130,minSize:80,cell:({row:e})=>{let l=e.original;return l.model_info.team_id?(0,t.jsx)("div",{className:"overflow-hidden w-full",children:(0,t.jsx)(O.Tooltip,{title:l.model_info.team_id,children:(0,t.jsxs)(I.Button,{size:"xs",variant:"light",className:"font-mono text-blue-500 bg-blue-50 hover:bg-blue-100 text-xs font-normal px-2 py-0.5 text-left overflow-hidden truncate w-full",onClick:e=>{e.stopPropagation(),c(l.model_info.team_id)},children:[l.model_info.team_id.slice(0,7),"..."]})})}):"-"}},{header:()=>(0,t.jsx)("span",{className:"text-sm font-semibold",children:"Model Access Group"}),accessorKey:"model_info.model_access_group",enableSorting:!1,size:180,minSize:100,cell:({row:e})=>{let l=e.original,s=l.model_info.access_groups;if(!s||0===s.length)return"-";let a=l.model_info.id,r=em.has(a),i=s.length>1;return(0,t.jsxs)("div",{className:"flex items-center gap-1 overflow-hidden w-full",children:[(0,t.jsx)(T.Badge,{size:"xs",color:"blue",className:"text-xs px-1.5 py-0.5 h-5 leading-tight shrink-0",children:s[0]}),(r||!i&&2===s.length)&&s.slice(1).map((e,l)=>(0,t.jsx)(T.Badge,{size:"xs",color:"blue",className:"text-xs px-1.5 py-0.5 h-5 leading-tight shrink-0",children:e},l+1)),i&&(0,t.jsx)("button",{onClick:e=>{let t;e.stopPropagation(),t=new Set(em),r?t.delete(a):t.add(a),eu(t)},className:"text-xs text-blue-600 hover:text-blue-800 px-1 py-0.5 rounded-sm hover:bg-blue-50 h-5 leading-tight shrink-0 whitespace-nowrap",children:r?"−":`+${s.length-1}`})]})}},{header:()=>(0,t.jsx)("span",{className:"text-sm font-semibold",children:"Status"}),accessorKey:"model_info.db_model",size:120,minSize:80,cell:({row:e})=>{let l=e.original;return(0,t.jsx)("div",{className:` - inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium - ${l.model_info.db_model?"bg-blue-50 text-blue-600":"bg-gray-100 text-gray-600"} - `,children:l.model_info.db_model?"DB Model":"Config Model"})}},{id:"actions",header:()=>(0,t.jsx)("span",{className:"text-sm font-semibold",children:"Actions"}),size:100,minSize:80,enableResizing:!1,cell:({row:e})=>{let l=e.original,s="Admin"===f||l.model_info?.created_by===g,a=!l.model_info?.db_model,r="Admin"===f,i=l.model_info?.blocked===!0,o=!a&&r&&!!eD,n=eq===l.model_info?.id;return(0,t.jsxs)("div",{className:"flex items-center justify-end gap-2 pr-4",children:[(0,t.jsx)(O.Tooltip,{title:a?"Config models cannot be paused from the dashboard. Pause is DB-backed.":r?i?"Resume model — restore normal routing.":"Pause model — stop routing requests until resumed.":"Only proxy admins can pause or resume a model.",children:(0,t.jsx)(L.Switch,{size:"small",checked:!i,disabled:!o||n,loading:n,"aria-label":i?"Resume model":"Pause model",onClick:(e,t)=>{t.stopPropagation()},onChange:e=>{let t=l.model_info?.id;o&&eD&&t&&eD(t,!e)}})}),a?(0,t.jsx)(O.Tooltip,{title:"Config model cannot be deleted on the dashboard. Please delete it from the config file.",children:(0,t.jsx)(F.Icon,{icon:S.TrashIcon,size:"sm",className:"opacity-50 cursor-not-allowed"})}):(0,t.jsx)(O.Tooltip,{title:"Delete model",children:(0,t.jsx)(F.Icon,{icon:S.TrashIcon,size:"sm",onClick:e=>{e.stopPropagation(),s&&eA&&eA(l.model_info.id)},className:s?"cursor-pointer hover:text-red-600":"opacity-50 cursor-not-allowed"})})]})}}],data:eR,isLoading:eS,sorting:e_,onSortingChange:ej,pagination:eg,onPaginationChange:ef,enablePagination:!0,onRowClick:e=>o(e.model_info.id)})]})})}),(0,t.jsx)(H.default,{isOpen:!!eM,title:"Delete Model",alertMessage:"This action cannot be undone.",message:"Are you sure you want to delete this model?",resourceInformationTitle:"Model Information",resourceInformation:eB?[{label:"Model Name",value:eB.model_name||"Not Set"},{label:"LiteLLM Model Name",value:eB.litellm_model_name||"Not Set"},{label:"Provider",value:eB.provider||"Not Set"},{label:"Created By",value:eB.model_info?.created_by||"Not Set"}]:[],onCancel:()=>eA(null),onOk:ez,confirmLoading:eE}),(0,t.jsx)(ea,{isVisible:ey,onCancel:()=>eb(!1),onSuccess:()=>eb(!1)})]})};var ed=e.i(206929),ec=e.i(35983),em=e.i(599724),eu=e.i(629569),eh=e.i(28651);let ep={"BadRequestError (400)":"BadRequestErrorRetries","AuthenticationError (401)":"AuthenticationErrorRetries","TimeoutError (408)":"TimeoutErrorRetries","RateLimitError (429)":"RateLimitErrorRetries","ContentPolicyViolationError (400)":"ContentPolicyViolationErrorRetries","InternalServerError (500)":"InternalServerErrorRetries"},ex=({selectedModelGroup:e,setSelectedModelGroup:l,availableModelGroups:s,globalRetryPolicy:a,setGlobalRetryPolicy:r,defaultRetry:i,modelGroupRetryPolicy:o,setModelGroupRetryPolicy:n,handleSaveRetrySettings:d,isSaving:c=!1})=>{let m="global"===e,u=(t,l)=>{n(s=>{let a={...s?.[e]??{}};return null==l?delete a[t]:a[t]=l,{...s??{},[e]:a}})};return(0,t.jsxs)(J.TabPanel,{children:[(0,t.jsx)("div",{className:"flex items-center gap-4 mb-6",children:(0,t.jsxs)("div",{className:"flex items-center",children:[(0,t.jsx)(em.Text,{children:"Retry Policy Scope:"}),(0,t.jsxs)(ed.Select,{className:"ml-2 w-48",value:m?"global":e||s[0],onValueChange:e=>l(e),children:[(0,t.jsx)(ec.SelectItem,{value:"global",children:"Global Default"}),s.map((e,l)=>(0,t.jsx)(ec.SelectItem,{value:e,children:e},l))]})]})}),m?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(eu.Title,{children:"Global Retry Policy"}),(0,t.jsx)(em.Text,{className:"mb-6",children:"Default retry settings applied to all model groups unless overridden"})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)(eu.Title,{children:["Retry Policy for ",e]}),(0,t.jsx)(em.Text,{className:"mb-6",children:"Model-specific retry settings. Falls back to global defaults if not set."})]}),(0,t.jsx)("table",{children:(0,t.jsx)("tbody",{children:Object.entries(ep).map(([l,s],n)=>{let d=a?.[s]??i,c=m?void 0:o?.[e]?.[s],h=null!=c;return(0,t.jsxs)("tr",{className:"flex justify-between items-center mt-2",children:[(0,t.jsxs)("td",{children:[(0,t.jsx)(em.Text,{children:l}),!m&&(0,t.jsxs)(em.Text,{className:"text-xs text-gray-500 ml-2",children:["(Global: ",d,")"]})]}),(0,t.jsxs)("td",{className:"flex items-center gap-2",children:[(0,t.jsx)(eh.InputNumber,{className:"ml-5",value:m?d:h?c:null,placeholder:m?void 0:String(d),min:0,step:1,onChange:e=>m?void(null!=e&&r(t=>({...t??{},[s]:e}))):u(s,e)}),!m&&h&&(0,t.jsx)(I.Button,{variant:"light",size:"xs",onClick:()=>u(s,null),children:"Reset"})]})]},n)})})}),(0,t.jsx)(I.Button,{className:"mt-6 mr-8",onClick:d,loading:c,disabled:c,children:"Save"})]})};var eg=e.i(883552),ef=e.i(262218),e_=e.i(175712),ej=e.i(91979),ey=e.i(637235),eb=e.i(724154);e.i(247167);var ev=e.i(931067);let eN={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M811.4 418.7C765.6 297.9 648.9 212 512.2 212S258.8 297.8 213 418.6C127.3 441.1 64 519.1 64 612c0 110.5 89.5 200 199.9 200h496.2C870.5 812 960 722.5 960 612c0-92.7-63.1-170.7-148.6-193.3zm36.3 281a123.07 123.07 0 01-87.6 36.3H263.9c-33.1 0-64.2-12.9-87.6-36.3A123.3 123.3 0 01140 612c0-28 9.1-54.3 26.2-76.3a125.7 125.7 0 0166.1-43.7l37.9-9.9 13.9-36.6c8.6-22.8 20.6-44.1 35.7-63.4a245.6 245.6 0 0152.4-49.9c41.1-28.9 89.5-44.2 140-44.2s98.9 15.3 140 44.2c19.9 14 37.5 30.8 52.4 49.9 15.1 19.3 27.1 40.7 35.7 63.4l13.8 36.5 37.8 10c54.3 14.5 92.1 63.8 92.1 120 0 33.1-12.9 64.3-36.3 87.7z"}}]},name:"cloud",theme:"outlined"};var ew=e.i(9583),eC=x.forwardRef(function(e,t){return x.createElement(ew.default,(0,ev.default)({},e,{ref:t,icon:eN}))}),ek=e.i(210612),eS=e.i(285027);let{Text:eT}=R.Typography,eI=({accessToken:e,onReloadSuccess:s,buttonText:a="Reload Price Data",showIcon:r=!0,size:i="middle",type:o="primary",className:n=""})=>{let[d,c]=(0,x.useState)(!1),[m,u]=(0,x.useState)(!1),[h,p]=(0,x.useState)(!1),[g,f]=(0,x.useState)(!1),[_,j]=(0,x.useState)(6),[y,b]=(0,x.useState)(null),[v,N]=(0,x.useState)(!1),[w,k]=(0,x.useState)(null),[S,T]=(0,x.useState)(!1);(0,x.useEffect)(()=>{I(),F();let e=setInterval(()=>{I(),F()},3e4);return()=>clearInterval(e)},[e]);let I=async()=>{if(e){N(!0);try{let t=await (0,l.getModelCostMapReloadStatus)(e);b(t)}catch(e){console.error("Failed to fetch reload status:",e),b({scheduled:!1,interval_hours:null,last_run:null,next_run:null})}finally{N(!1)}}},F=async()=>{if(e){T(!0);try{let t=await (0,l.getModelCostMapSource)(e);k(t)}catch(e){console.error("Failed to fetch cost map source info:",e)}finally{T(!1)}}},M=async()=>{if(!e)return void G.default.fromBackend("No access token available");c(!0);try{let t=await (0,l.reloadModelCostMap)(e);"success"===t.status?(G.default.success(`Price data reloaded successfully! ${t.models_count||0} models updated.`),s?.(),await I(),await F()):G.default.fromBackend("Failed to reload price data")}catch(e){console.error("Error reloading price data:",e),G.default.fromBackend("Failed to reload price data. Please try again.")}finally{c(!1)}},A=async()=>{if(!e)return void G.default.fromBackend("No access token available");if(_<=0)return void G.default.fromBackend("Hours must be greater than 0");u(!0);try{let t=await (0,l.scheduleModelCostMapReload)(e,_);"success"===t.status?(G.default.success(`Periodic reload scheduled for every ${_} hours`),f(!1),await I()):G.default.fromBackend("Failed to schedule periodic reload")}catch(e){console.error("Error scheduling reload:",e),G.default.fromBackend("Failed to schedule periodic reload. Please try again.")}finally{u(!1)}},L=async()=>{if(!e)return void G.default.fromBackend("No access token available");p(!0);try{let t=await (0,l.cancelModelCostMapReload)(e);"success"===t.status?(G.default.success("Periodic reload cancelled successfully"),await I()):G.default.fromBackend("Failed to cancel periodic reload")}catch(e){console.error("Error cancelling reload:",e),G.default.fromBackend("Failed to cancel periodic reload. Please try again.")}finally{p(!1)}},R=e=>{if(!e)return"Never";try{return new Date(e).toLocaleString()}catch{return e}};return(0,t.jsxs)("div",{className:n,children:[(0,t.jsxs)(E.Space,{direction:"horizontal",size:"middle",style:{marginBottom:16},children:[(0,t.jsx)(eg.Popconfirm,{title:"Hard Refresh Price Data",description:"This will immediately fetch the latest pricing information from the remote source. Continue?",onConfirm:M,okText:"Yes",cancelText:"No",okButtonProps:{style:{backgroundColor:"#6366f1",borderColor:"#6366f1",color:"white",fontWeight:"500",borderRadius:"0.375rem",padding:"0.375rem 0.75rem",height:"auto",fontSize:"0.875rem",lineHeight:"1.25rem",transition:"all 0.2s ease-in-out"},onMouseEnter:e=>{e.currentTarget.style.backgroundColor="#4f46e5"},onMouseLeave:e=>{e.currentTarget.style.backgroundColor="#6366f1"}},children:(0,t.jsx)(Q.Button,{type:o,size:i,loading:d,icon:r?(0,t.jsx)(ej.ReloadOutlined,{}):void 0,style:{backgroundColor:"#6366f1",borderColor:"#6366f1",color:"white",fontWeight:"500",borderRadius:"0.375rem",padding:"0.375rem 0.75rem",height:"auto",fontSize:"0.875rem",lineHeight:"1.25rem",transition:"all 0.2s ease-in-out"},onMouseEnter:e=>{e.currentTarget.style.backgroundColor="#4f46e5"},onMouseLeave:e=>{e.currentTarget.style.backgroundColor="#6366f1"},children:a})}),y?.scheduled?(0,t.jsx)(Q.Button,{type:"default",size:i,danger:!0,icon:(0,t.jsx)(eb.StopOutlined,{}),loading:h,onClick:L,style:{borderColor:"#ff4d4f",color:"#ff4d4f",fontWeight:"500",borderRadius:"0.375rem",padding:"0.375rem 0.75rem",height:"auto",fontSize:"0.875rem",lineHeight:"1.25rem"},children:"Cancel Periodic Reload"}):(0,t.jsx)(Q.Button,{type:"default",size:i,icon:(0,t.jsx)(ey.ClockCircleOutlined,{}),onClick:()=>f(!0),style:{borderColor:"#d9d9d9",color:"#6366f1",fontWeight:"500",borderRadius:"0.375rem",padding:"0.375rem 0.75rem",height:"auto",fontSize:"0.875rem",lineHeight:"1.25rem"},children:"Set Up Periodic Reload"})]}),w&&(0,t.jsx)(e_.Card,{size:"small",style:{backgroundColor:"remote"===w.source?"#f0f7ff":"#fff8f0",border:`1px solid ${"remote"===w.source?"#bae0ff":"#ffd591"}`,borderRadius:8,marginBottom:12},children:(0,t.jsxs)(E.Space,{direction:"vertical",size:"small",style:{width:"100%"},children:[(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:8},children:["remote"===w.source?(0,t.jsx)(eC,{style:{color:"#1677ff",fontSize:16}}):(0,t.jsx)(ek.DatabaseOutlined,{style:{color:"#fa8c16",fontSize:16}}),(0,t.jsx)(eT,{strong:!0,style:{fontSize:"13px"},children:"Pricing Data Source"}),(0,t.jsx)(ef.Tag,{color:"remote"===w.source?"blue":"orange",style:{marginLeft:"auto",fontWeight:600,textTransform:"uppercase",fontSize:"11px"},children:"remote"===w.source?"Remote":"Local"})]}),(0,t.jsx)(P.Divider,{style:{margin:"6px 0"}}),(0,t.jsxs)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"center"},children:[(0,t.jsx)(eT,{type:"secondary",style:{fontSize:"12px"},children:"Models loaded:"}),(0,t.jsx)(eT,{strong:!0,style:{fontSize:"12px"},children:w.model_count.toLocaleString()})]}),w.url&&(0,t.jsxs)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"flex-start",gap:8},children:[(0,t.jsx)(eT,{type:"secondary",style:{fontSize:"12px",whiteSpace:"nowrap"},children:"remote"===w.source?"Loaded from:":"Attempted URL:"}),(0,t.jsx)(O.Tooltip,{title:w.url,children:(0,t.jsx)(eT,{style:{fontSize:"11px",maxWidth:240,overflow:"hidden",textOverflow:"ellipsis",whiteSpace:"nowrap",display:"block",color:"#1677ff",cursor:"default"},children:w.url})})]}),w.is_env_forced&&(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",gap:6,marginTop:2},children:[(0,t.jsx)(C.InfoCircleOutlined,{style:{color:"#fa8c16",fontSize:12}}),(0,t.jsxs)(eT,{type:"secondary",style:{fontSize:"11px"},children:["Local mode forced via ",(0,t.jsx)("code",{children:"LITELLM_LOCAL_MODEL_COST_MAP=True"})]})]}),w.fallback_reason&&(0,t.jsxs)("div",{style:{display:"flex",alignItems:"flex-start",gap:6,backgroundColor:"#fff7e6",border:"1px solid #ffd591",borderRadius:4,padding:"4px 8px",marginTop:2},children:[(0,t.jsx)(eS.WarningOutlined,{style:{color:"#fa8c16",fontSize:12,marginTop:2}}),(0,t.jsxs)(eT,{style:{fontSize:"11px",color:"#614700"},children:["Fell back to local: ",w.fallback_reason]})]})]})}),y&&(0,t.jsx)(e_.Card,{size:"small",style:{backgroundColor:"#f8f9fa",border:"1px solid #e9ecef",borderRadius:8},children:(0,t.jsxs)(E.Space,{direction:"vertical",size:"small",style:{width:"100%"},children:[y.scheduled?(0,t.jsx)("div",{children:(0,t.jsxs)(ef.Tag,{color:"green",icon:(0,t.jsx)(ey.ClockCircleOutlined,{}),children:["Scheduled every ",y.interval_hours," hours"]})}):(0,t.jsx)(eT,{type:"secondary",children:"No periodic reload scheduled"}),(0,t.jsxs)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"center"},children:[(0,t.jsx)(eT,{type:"secondary",style:{fontSize:"12px"},children:"Last run:"}),(0,t.jsx)(eT,{style:{fontSize:"12px"},children:R(y.last_run)})]}),y.scheduled&&(0,t.jsxs)(t.Fragment,{children:[y.next_run&&(0,t.jsxs)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"center"},children:[(0,t.jsx)(eT,{type:"secondary",style:{fontSize:"12px"},children:"Next run:"}),(0,t.jsx)(eT,{style:{fontSize:"12px"},children:R(y.next_run)})]}),(0,t.jsxs)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"center"},children:[(0,t.jsx)(eT,{type:"secondary",style:{fontSize:"12px"},children:"Status:"}),(0,t.jsx)(ef.Tag,{color:y?.scheduled?y.last_run?"success":"processing":"default",children:y?.scheduled?y.last_run?"Active":"Ready":"Not scheduled"})]})]})]})}),(0,t.jsxs)(es.Modal,{title:"Set Up Periodic Reload",open:g,onOk:A,onCancel:()=>f(!1),confirmLoading:m,okText:"Schedule",cancelText:"Cancel",okButtonProps:{style:{backgroundColor:"#6366f1",borderColor:"#6366f1",color:"white"}},children:[(0,t.jsx)("div",{style:{marginBottom:16},children:(0,t.jsx)(eT,{children:"Set up automatic reload of price data every:"})}),(0,t.jsx)("div",{style:{marginBottom:16},children:(0,t.jsx)(eh.InputNumber,{min:1,max:168,value:_,onChange:e=>j(e||6),addonAfter:"hours",style:{width:"100%"}})}),(0,t.jsx)("div",{children:(0,t.jsxs)(eT,{type:"secondary",children:["This will automatically fetch the latest pricing data from the remote source every ",_," hours."]})})]})]})},eF=()=>{let{accessToken:e}=(0,r.default)(),{refetch:l}=(0,n.useModelCostMap)();return(0,t.jsx)(J.TabPanel,{children:(0,t.jsxs)("div",{className:"p-6",children:[(0,t.jsxs)("div",{className:"mb-6",children:[(0,t.jsx)(eu.Title,{children:"Price Data Management"}),(0,t.jsx)(em.Text,{className:"text-tremor-content",children:"Manage model pricing data and configure automatic reload schedules"})]}),(0,t.jsx)(eI,{accessToken:e,onReloadSuccess:()=>{l()},buttonText:"Reload Price Data",size:"middle",type:"primary",className:"w-full"})]})})};var eP=e.i(916925);let eM=async(e,t,l)=>{try{let t=e.model_mappings||[];if("model_mappings"in e&&delete e.model_mappings,e.model&&e.model.includes("all-wildcard")){let l=e.custom_llm_provider,s=(eP.provider_map[l]??l.toLowerCase())+"/*";e.model_name=s,t.push({public_name:s,litellm_model:s}),e.model=s}let l=[];for(let s of t){let t={},a={},r=s.public_name;for(let[l,r]of(t.model=s.litellm_model,void 0!==e.input_cost_per_token&&null!==e.input_cost_per_token&&""!==e.input_cost_per_token&&(e.input_cost_per_token=Number(e.input_cost_per_token)/1e6),void 0!==e.output_cost_per_token&&null!==e.output_cost_per_token&&""!==e.output_cost_per_token&&(e.output_cost_per_token=Number(e.output_cost_per_token)/1e6),void 0!==e.cache_read_input_token_cost&&null!==e.cache_read_input_token_cost&&""!==e.cache_read_input_token_cost?e.cache_read_input_token_cost=Number(e.cache_read_input_token_cost)/1e6:void 0!==e.input_cost_per_token&&null!==e.input_cost_per_token&&""!==e.input_cost_per_token?e.cache_read_input_token_cost=Number(e.input_cost_per_token):delete e.cache_read_input_token_cost,void 0!==e.cache_creation_input_token_cost&&null!==e.cache_creation_input_token_cost&&""!==e.cache_creation_input_token_cost?e.cache_creation_input_token_cost=Number(e.cache_creation_input_token_cost)/1e6:delete e.cache_creation_input_token_cost,t.model=s.litellm_model,Object.entries(e)))if(""!==r&&"custom_pricing"!==l&&"pricing_model"!==l&&"cache_control"!==l)if("model_name"==l)t.model=r;else if("custom_llm_provider"==l)t.custom_llm_provider=eP.provider_map[r]??r.toLowerCase();else if("model"==l)continue;else if("base_model"===l)a[l]=r;else if("team_id"===l)a.team_id=r;else if("model_access_group"===l)a.access_groups=r;else if("mode"==l)a.mode=r,delete t.mode;else if("custom_model_name"===l)t.model=r;else if("litellm_extra_params"==l){let e={};if(r&&void 0!=r){try{e=JSON.parse(r),"litellm_credential_name"in e&&delete e.litellm_credential_name}catch(e){throw G.default.fromBackend("Failed to parse LiteLLM Extra Params: "+e),Error("Failed to parse litellm_extra_params: "+e)}for(let[l,s]of Object.entries(e))t[l]=s}}else if("model_info_params"==l){let e={};if(r&&void 0!=r){try{e=JSON.parse(r)}catch(e){throw G.default.fromBackend("Failed to parse LiteLLM Extra Params: "+e),Error("Failed to parse litellm_extra_params: "+e)}for(let[t,l]of Object.entries(e))a[t]=l}}else if("input_cost_per_token"===l||"output_cost_per_token"===l||"input_cost_per_second"===l||"cache_read_input_token_cost"===l||"cache_creation_input_token_cost"===l){null!=r&&""!==r&&(t[l]=Number(r));continue}else t[l]=r;l.push({litellmParamsObj:t,modelInfoObj:a,modelName:r})}return l}catch(e){G.default.fromBackend("Failed to create model: "+e)}},eA=async(e,t,s,a)=>{try{let r=await eM(e,t,s);if(!r||0===r.length)return;for(let e of r){let{litellmParamsObj:s,modelInfoObj:a,modelName:r}=e,i={model_name:r,litellm_params:s,model_info:a};await (0,l.modelCreateCall)(t,i)}a&&a(),s.resetFields()}catch(e){G.default.fromBackend("Failed to add model: "+e)}};var eE=e.i(591935),eL=e.i(304967),eO=e.i(779241);let eR=(0,a.createQueryKeys)("providerFields"),eB=()=>(0,s.useQuery)({queryKey:eR.list({}),queryFn:async()=>await (0,l.getProviderCreateMetadata)(),staleTime:864e5,gcTime:864e5});var ez=e.i(519756),eq=e.i(178654),eV=e.i(311451),eD=e.i(621192),eH=e.i(515831);let{Link:eG}=R.Typography,eU=e=>{let t="password"===e.field_type?"password":"select"===e.field_type?"select":"upload"===e.field_type?"upload":"textarea"===e.field_type?"textarea":"text";return{key:e.key,label:e.label,placeholder:e.placeholder??void 0,tooltip:e.tooltip??void 0,required:e.required??!1,type:t,options:e.options??void 0,defaultValue:e.default_value??void 0}},e$={},eK=({selectedProvider:e,uploadProps:l})=>{let s=eP.Providers[e],a=el.Form.useFormInstance(),{data:r,isLoading:i,error:o}=eB(),n=x.default.useMemo(()=>{if(!r)return null;let e={};return r.forEach(t=>{let l=t.provider_display_name,s=t.credential_fields.map(eU);e[l]=s,t.provider&&(e[t.provider]=s),t.litellm_provider&&(e[t.litellm_provider]=s)}),e},[r]);x.default.useEffect(()=>{n&&Object.assign(e$,n)},[n]);let d=x.default.useMemo(()=>{let t=e$[s]??e$[e];if(t)return t;if(!r)return[];let l=r.find(t=>t.provider_display_name===s||t.provider===e||t.litellm_provider===e);if(!l)return[];let a=l.credential_fields.map(eU);return e$[l.provider_display_name]=a,l.provider&&(e$[l.provider]=a),l.litellm_provider&&(e$[l.litellm_provider]=a),a},[s,e,r]),c=x.default.useMemo(()=>d.some(e=>"api_version"===e.key),[d]),m=x.default.useRef(null),u=x.default.useCallback(e=>{if(!c)return;let t=(e=>{let t=e.indexOf("?");if(-1===t)return null;let l=new URLSearchParams(e.slice(t+1).split("#")[0]);return l.get("api_version")||l.get("api-version")})(e.target.value);if(t){m.current=t,a.setFieldsValue({api_version:t});return}a.getFieldValue("api_version")===m.current&&a.setFieldsValue({api_version:""}),m.current=null},[a,c]),h={name:"file",accept:".json",beforeUpload:e=>{if("application/json"===e.type){let t=new FileReader;t.onload=e=>{if(e.target){let t=e.target.result;a.setFieldsValue({vertex_credentials:t})}},t.readAsText(e)}return!1}};return(0,t.jsxs)(t.Fragment,{children:[i&&0===d.length&&(0,t.jsx)(eD.Row,{children:(0,t.jsx)(eq.Col,{span:24,children:(0,t.jsx)(em.Text,{className:"mb-2",children:"Loading provider fields..."})})}),o&&0===d.length&&(0,t.jsx)(eD.Row,{children:(0,t.jsx)(eq.Col,{span:24,children:(0,t.jsx)(em.Text,{className:"mb-2 text-red-500",children:o instanceof Error?o.message:"Failed to load provider credential fields"})})}),d.map(e=>(0,t.jsxs)(x.default.Fragment,{children:[(0,t.jsx)(el.Form.Item,{label:e.label,name:e.key,rules:e.required?[{required:!0,message:"Required"}]:void 0,tooltip:e.tooltip,className:"vertex_credentials"===e.key?"mb-0":void 0,children:"select"===e.type?(0,t.jsx)(Y.Select,{placeholder:e.placeholder,defaultValue:e.defaultValue,children:e.options?.map(e=>(0,t.jsx)(Y.Select.Option,{value:e,children:e},e))}):"upload"===e.type?(0,t.jsx)(eH.Upload,{...h,onChange:e=>{l?.onChange&&l.onChange(e)},children:(0,t.jsx)(Q.Button,{icon:(0,t.jsx)(ez.UploadOutlined,{}),children:"Click to Upload"})}):"textarea"===e.type?(0,t.jsx)(eV.Input.TextArea,{placeholder:e.placeholder,defaultValue:e.defaultValue,rows:6,style:{fontFamily:"monospace",fontSize:"12px"}}):(0,t.jsx)(eO.TextInput,{placeholder:e.placeholder,type:"password"===e.type?"password":"text",defaultValue:e.defaultValue,onChange:"api_base"===e.key?u:void 0})}),"vertex_credentials"===e.key&&(0,t.jsx)(eD.Row,{children:(0,t.jsx)(eq.Col,{children:(0,t.jsx)(em.Text,{className:"mb-3 mt-1",children:"Give a gcp service account(.json file)"})})}),"base_model"===e.key&&(0,t.jsxs)(eD.Row,{children:[(0,t.jsx)(eq.Col,{span:10}),(0,t.jsx)(eq.Col,{span:10,children:(0,t.jsxs)(em.Text,{className:"mb-2",children:["The actual model your azure deployment uses. Used for accurate cost tracking. Select name from"," ",(0,t.jsx)(eG,{href:"https://github.com/BerriAI/litellm/blob/main/model_prices_and_context_window.json",target:"_blank",children:"here"})]})})]})]},e.key))]})};var eJ=e.i(555987);function eW(e,t,l){let s=e.getFieldValue("credential_name");e.resetFields(),void 0!==s&&e.setFieldValue("credential_name",s),l(t),e.setFieldValue("custom_llm_provider",t)}let{Link:eQ}=R.Typography,eY=({open:e,onCancel:l,onAddCredential:s,uploadProps:a})=>{let[r]=el.Form.useForm(),[i,o]=(0,x.useState)(eP.Providers.OpenAI);return(0,t.jsx)(es.Modal,{title:"Add New Credential",open:e,onCancel:()=>{l(),r.resetFields()},footer:null,width:600,children:(0,t.jsxs)(el.Form,{form:r,onFinish:e=>{s(Object.entries(e).reduce((e,[t,l])=>(""!==l&&null!=l&&(e[t]=l),e),{})),r.resetFields()},layout:"vertical",children:[(0,t.jsx)(el.Form.Item,{label:"Credential Name:",name:"credential_name",rules:[{required:!0,message:"Credential name is required"}],children:(0,t.jsx)(eO.TextInput,{placeholder:"Enter a friendly name for these credentials"})}),(0,t.jsx)(el.Form.Item,{rules:[{required:!0,message:"Required"}],label:"Provider:",name:"custom_llm_provider",tooltip:"Helper to auto-populate provider specific fields",children:(0,t.jsx)(Y.Select,{showSearch:!0,onChange:e=>{eW(r,e,o)},children:Object.entries(eP.Providers).map(([e,l])=>(0,t.jsx)(Y.Select.Option,{value:e,children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("img",{src:(0,eJ.resolveLogoSrc)(eP.providerLogoMap[l]),alt:`${e} logo`,className:"w-5 h-5",onError:e=>{let t=e.target,s=t.parentElement;if(s){let e=document.createElement("div");e.className="w-5 h-5 rounded-full bg-gray-200 flex items-center justify-center text-xs",e.textContent=l.charAt(0),s.replaceChild(e,t)}}}),(0,t.jsx)("span",{children:l})]})},e))})}),(0,t.jsx)(eK,{selectedProvider:i,uploadProps:a}),(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsx)(O.Tooltip,{title:"Get help on our github",children:(0,t.jsx)(eQ,{href:"https://github.com/BerriAI/litellm/issues",children:"Need Help?"})}),(0,t.jsxs)("div",{children:[(0,t.jsx)(Q.Button,{onClick:()=>{l(),r.resetFields()},style:{marginRight:10},children:"Cancel"}),(0,t.jsx)(Q.Button,{htmlType:"submit",children:"Add Credential"})]})]})]})})},{Link:eX}=R.Typography;function eZ({open:e,onCancel:l,onUpdateCredential:s,uploadProps:a,existingCredential:r}){let[i]=el.Form.useForm(),[o,n]=(0,x.useState)(eP.Providers.Anthropic);return(0,x.useEffect)(()=>{if(r){let e=Object.entries(r.credential_values||{}).reduce((e,[t,l])=>(e[t]=l??null,e),{});i.setFieldsValue({credential_name:r.credential_name,custom_llm_provider:r.credential_info.custom_llm_provider,...e}),n(r.credential_info.custom_llm_provider)}},[r]),(0,t.jsx)(es.Modal,{title:"Edit Credential",open:e,onCancel:()=>{l(),i.resetFields()},footer:null,width:600,destroyOnHidden:!0,children:(0,t.jsxs)(el.Form,{form:i,onFinish:e=>{s(Object.entries(e).reduce((e,[t,l])=>(""!==l&&null!=l&&(e[t]=l),e),{})),i.resetFields()},layout:"vertical",children:[(0,t.jsx)(el.Form.Item,{label:"Credential Name:",name:"credential_name",rules:[{required:!0,message:"Credential name is required"}],initialValue:r?.credential_name,children:(0,t.jsx)(eO.TextInput,{placeholder:"Enter a friendly name for these credentials",disabled:!!r?.credential_name})}),(0,t.jsx)(el.Form.Item,{rules:[{required:!0,message:"Required"}],label:"Provider:",name:"custom_llm_provider",tooltip:"Helper to auto-populate provider specific fields",children:(0,t.jsx)(Y.Select,{showSearch:!0,onChange:e=>{eW(i,e,n)},children:Object.entries(eP.Providers).map(([e,l])=>(0,t.jsx)(Y.Select.Option,{value:e,children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("img",{src:(0,eJ.resolveLogoSrc)(eP.providerLogoMap[l]),alt:`${e} logo`,className:"w-5 h-5",onError:e=>{let t=e.target,s=t.parentElement;if(s){let e=document.createElement("div");e.className="w-5 h-5 rounded-full bg-gray-200 flex items-center justify-center text-xs",e.textContent=l.charAt(0),s.replaceChild(e,t)}}}),(0,t.jsx)("span",{children:l})]})},e))})}),(0,t.jsx)(eK,{selectedProvider:o,uploadProps:a}),(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsx)(O.Tooltip,{title:"Get help on our github",children:(0,t.jsx)(eX,{href:"https://github.com/BerriAI/litellm/issues",children:"Need Help?"})}),(0,t.jsxs)("div",{children:[(0,t.jsx)(Q.Button,{onClick:()=>{l(),i.resetFields()},style:{marginRight:10},children:"Cancel"}),(0,t.jsx)(Q.Button,{htmlType:"submit",children:"Update Credential"})]})]})]})})}var e0=e.i(708347);let e1=({uploadProps:e})=>{let{accessToken:s,userRole:a}=(0,r.default)(),i=(0,e0.isProxyAdminRole)(a??""),{data:n,refetch:d}=o(),c=n?.credentials||[],[m,u]=(0,x.useState)(!1),[h,p]=(0,x.useState)(!1),[v,N]=(0,x.useState)(null),[w,C]=(0,x.useState)(null),[k,F]=(0,x.useState)(!1),[P,M]=(0,x.useState)(!1),[A]=el.Form.useForm(),E=["credential_name","custom_llm_provider"],L=async e=>{if(!s)return;let t=Object.entries(e).filter(([e])=>!E.includes(e)).reduce((e,[t,l])=>({...e,[t]:l}),{}),a={credential_name:e.credential_name,credential_values:t,credential_info:{custom_llm_provider:e.custom_llm_provider}};await (0,l.credentialUpdateCall)(s,e.credential_name,a),G.default.success("Credential updated successfully"),p(!1),await d()},O=async e=>{if(!s)return;let t=Object.entries(e).filter(([e])=>!E.includes(e)).reduce((e,[t,l])=>({...e,[t]:l}),{}),a={credential_name:e.credential_name,credential_values:t,credential_info:{custom_llm_provider:e.custom_llm_provider}};await (0,l.credentialCreateCall)(s,a),G.default.success("Credential added successfully"),u(!1),await d()},R=async()=>{if(s&&w){M(!0);try{await (0,l.credentialDeleteCall)(s,w.credential_name),G.default.success("Credential deleted successfully"),await d()}catch(e){G.default.error("Failed to delete credential")}finally{C(null),F(!1),M(!1)}}};return(0,t.jsxs)("div",{className:"w-full mx-auto flex-auto overflow-y-auto p-2",children:[i&&(0,t.jsx)(I.Button,{onClick:()=>u(!0),children:"Add Credential"}),(0,t.jsx)("div",{className:"flex justify-between items-center mt-4 mb-4",children:(0,t.jsx)(em.Text,{children:"Configured credentials for different AI providers. Add and manage your API credentials."})}),(0,t.jsx)(eL.Card,{children:(0,t.jsxs)(g.Table,{children:[(0,t.jsx)(f.TableHead,{children:(0,t.jsxs)(y.TableRow,{children:[(0,t.jsx)(_.TableHeaderCell,{children:"Credential Name"}),(0,t.jsx)(_.TableHeaderCell,{children:"Provider"}),(0,t.jsx)(_.TableHeaderCell,{children:"Actions"})]})}),(0,t.jsx)(j.TableBody,{children:c&&0!==c.length?c.map((e,l)=>{var s;let a,r;return(0,t.jsxs)(y.TableRow,{children:[(0,t.jsx)(b.TableCell,{children:e.credential_name}),(0,t.jsx)(b.TableCell,{children:(s=e.credential_info?.custom_llm_provider||"-",r=(a={openai:"blue",azure:"indigo",anthropic:"purple",default:"gray"})[s.toLowerCase()]||a.default,(0,t.jsx)(T.Badge,{color:r,size:"xs",children:s}))}),(0,t.jsx)(b.TableCell,{children:i?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(I.Button,{icon:eE.PencilAltIcon,variant:"light",size:"sm",onClick:()=>{N(e),p(!0)}}),(0,t.jsx)(I.Button,{icon:S.TrashIcon,variant:"light",size:"sm",onClick:()=>{C(e),F(!0)},className:"ml-2"})]}):null})]},l)}):(0,t.jsx)(y.TableRow,{children:(0,t.jsx)(b.TableCell,{colSpan:4,className:"text-center py-4 text-gray-500",children:"No credentials configured"})})})]})}),m&&(0,t.jsx)(eY,{onAddCredential:O,open:m,onCancel:()=>u(!1),uploadProps:e}),h&&(0,t.jsx)(eZ,{open:h,existingCredential:v,onUpdateCredential:L,uploadProps:e,onCancel:()=>p(!1)}),(0,t.jsx)(H.default,{isOpen:k,onCancel:()=>{C(null),F(!1)},onOk:R,title:"Delete Credential?",message:"Are you sure you want to delete this credential? This action cannot be undone and may break existing integrations.",resourceInformationTitle:"Credential Information",resourceInformation:[{label:"Credential Name",value:w?.credential_name},{label:"Provider",value:w?.credential_info?.custom_llm_provider||"-"}],confirmLoading:P,requiredConfirmation:w?.credential_name})]})};var e2=e.i(278587),e4=e.i(309426),e5=e.i(197647),e6=e.i(653824),e3=e.i(881073),e8=e.i(723731),e7=e.i(475647),e9=e.i(91739),te=e.i(437902),tt=e.i(166406);let{Text:tl}=R.Typography,ts=({formValues:e,accessToken:s,testMode:a,modelName:r="this model",onClose:i,onTestComplete:o})=>{var n,d,c;let m,u,[h,p]=x.default.useState(null),[g,f]=x.default.useState(null),[_,j]=x.default.useState(null),[y,b]=x.default.useState(!0),[v,N]=x.default.useState(!1),[w,k]=x.default.useState(!1),S=async()=>{b(!0),k(!1),p(null),f(null),j(null),N(!1),await new Promise(e=>setTimeout(e,100));try{let t=await eM(e,s,null);if(!t){p("Failed to prepare model data. Please check your form inputs."),N(!1),b(!1);return}let{litellmParamsObj:a,modelInfoObj:r,modelName:i}=t[0],o=await (0,l.testConnectionRequest)(s,a,r,r?.mode);if("success"===o.status)G.default.success("Connection test successful!"),p(null),N(!0);else{let e=o.result?.error||o.message||"Unknown error";p(e),f(a),j(o.result?.raw_request_typed_dict),N(!1)}}catch(e){console.error("Test connection error:",e),p(e instanceof Error?e.message:String(e)),N(!1)}finally{b(!1),o&&o()}};x.default.useEffect(()=>{let e=setTimeout(()=>{S()},200);return()=>clearTimeout(e)},[]);let T=e=>e?e.split("stack trace:")[0].trim().replace(/^litellm\.(.*?)Error: /,""):"Unknown error",I="string"==typeof h?T(h):h?.message?T(h.message):"Unknown error",F=_?(n=_.raw_request_api_base,d=_.raw_request_body,c=_.raw_request_headers||{},m=JSON.stringify(d,null,2).split("\n").map(e=>` ${e}`).join("\n"),u=Object.entries(c).map(([e,t])=>`-H '${e}: ${t}'`).join(" \\\n "),`curl -X POST \\ - ${n} \\ - ${u?`${u} \\ - `:""}-H 'Content-Type: application/json' \\ - -d '{ -${m} - }'`):"";return(0,t.jsxs)("div",{style:{padding:"24px",borderRadius:"8px",backgroundColor:"#fff"},children:[y?(0,t.jsxs)("div",{style:{textAlign:"center",padding:"32px 20px"},className:"jsx-dc9a0e2d897fe63b",children:[(0,t.jsx)("div",{style:{marginBottom:"16px"},className:"jsx-dc9a0e2d897fe63b loading-spinner",children:(0,t.jsx)("div",{style:{border:"3px solid #f3f3f3",borderTop:"3px solid #1890ff",borderRadius:"50%",width:"30px",height:"30px",animation:"spin 1s linear infinite",margin:"0 auto"},className:"jsx-dc9a0e2d897fe63b"})}),(0,t.jsxs)(tl,{style:{fontSize:"16px"},children:["Testing connection to ",r,"..."]}),(0,t.jsx)(te.default,{id:"dc9a0e2d897fe63b",children:"@keyframes spin{0%{transform:rotate(0)}to{transform:rotate(360deg)}}"})]}):v?(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",justifyContent:"center",padding:"32px 20px"},children:[(0,t.jsx)("div",{style:{color:"#52c41a",fontSize:"24px",display:"flex",alignItems:"center"},children:(0,t.jsx)("svg",{viewBox:"64 64 896 896",focusable:"false","data-icon":"check-circle",width:"1em",height:"1em",fill:"currentColor","aria-hidden":"true",children:(0,t.jsx)("path",{d:"M512 64C264.6 64 64 264.6 64 512s200.6 448 448 448 448-200.6 448-448S759.4 64 512 64zm193.5 301.7l-210.6 292a31.8 31.8 0 01-51.7 0L318.5 484.9c-3.8-5.3 0-12.7 6.5-12.7h46.9c10.2 0 19.9 4.9 25.9 13.3l71.2 98.8 157.2-218c6-8.3 15.6-13.3 25.9-13.3H699c6.5 0 10.3 7.4 6.5 12.7z"})})}),(0,t.jsxs)(tl,{"data-testid":"connection-success-msg",type:"success",style:{fontSize:"18px",fontWeight:500,marginLeft:"10px"},children:["Connection to ",r," successful!"]})]}):(0,t.jsx)(t.Fragment,{children:(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{style:{display:"flex",alignItems:"center",marginBottom:"20px"},children:[(0,t.jsx)(eS.WarningOutlined,{style:{color:"#ff4d4f",fontSize:"24px",marginRight:"12px"}}),(0,t.jsxs)(tl,{"data-testid":"connection-failure-msg",type:"danger",style:{fontSize:"18px",fontWeight:500},children:["Connection to ",r," failed"]})]}),(0,t.jsxs)("div",{style:{backgroundColor:"#fff2f0",border:"1px solid #ffccc7",borderRadius:"8px",padding:"16px",marginBottom:"20px",boxShadow:"0 1px 2px rgba(0, 0, 0, 0.03)"},children:[(0,t.jsxs)(tl,{strong:!0,style:{display:"block",marginBottom:"8px"},children:["Error:"," "]}),(0,t.jsx)(tl,{type:"danger",style:{fontSize:"14px",lineHeight:"1.5"},children:I}),h&&(0,t.jsx)("div",{style:{marginTop:"12px"},children:(0,t.jsx)(Q.Button,{type:"link",onClick:()=>k(!w),style:{paddingLeft:0,height:"auto"},children:w?"Hide Details":"Show Details"})})]}),w&&(0,t.jsxs)("div",{style:{marginBottom:"20px"},children:[(0,t.jsx)(tl,{strong:!0,style:{display:"block",marginBottom:"8px",fontSize:"15px"},children:"Troubleshooting Details"}),(0,t.jsx)("pre",{style:{backgroundColor:"#f5f5f5",padding:"16px",borderRadius:"8px",fontSize:"13px",maxHeight:"200px",overflow:"auto",border:"1px solid #e8e8e8",lineHeight:"1.5"},children:"string"==typeof h?h:JSON.stringify(h,null,2)})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(tl,{strong:!0,style:{display:"block",marginBottom:"8px",fontSize:"15px"},children:"API Request"}),(0,t.jsx)("pre",{style:{backgroundColor:"#f5f5f5",padding:"16px",borderRadius:"8px",fontSize:"13px",maxHeight:"250px",overflow:"auto",border:"1px solid #e8e8e8",lineHeight:"1.5"},children:F||"No request data available"}),(0,t.jsx)(Q.Button,{style:{marginTop:"8px"},icon:(0,t.jsx)(tt.CopyOutlined,{}),onClick:()=>{navigator.clipboard.writeText(F||""),G.default.success("Copied to clipboard")},children:"Copy to Clipboard"})]})]})}),(0,t.jsx)(P.Divider,{style:{margin:"24px 0 16px"}}),(0,t.jsx)("div",{style:{display:"flex",justifyContent:"space-between",alignItems:"center"},children:(0,t.jsx)(Q.Button,{type:"link",href:"https://docs.litellm.ai/docs/providers",target:"_blank",icon:(0,t.jsx)(C.InfoCircleOutlined,{}),children:"View Documentation"})})]})},ta=async(e,t,s,a)=>{try{let r;"complexity_router"===e.model_type?r={model_name:e.auto_router_name,litellm_params:{model:"auto_router/complexity_router",complexity_router_config:e.complexity_router_config,complexity_router_default_model:e.auto_router_default_model},model_info:{}}:(r={model_name:e.auto_router_name,litellm_params:{model:`auto_router/${e.auto_router_name}`,auto_router_config:JSON.stringify(e.auto_router_config),auto_router_default_model:e.auto_router_default_model},model_info:{}},e.auto_router_embedding_model&&"custom"!==e.auto_router_embedding_model?r.litellm_params.auto_router_embedding_model=e.auto_router_embedding_model:e.custom_embedding_model&&(r.litellm_params.auto_router_embedding_model=e.custom_embedding_model)),e.team_id&&(r.model_info.team_id=e.team_id),e.model_access_group&&e.model_access_group.length>0&&(r.model_info.access_groups=e.model_access_group),await (0,l.modelCreateCall)(t,r);let i="complexity_router"===e.model_type?"Complexity Router":"Semantic Router";G.default.success(`Successfully created ${i}: ${e.auto_router_name}`),s.resetFields(),a&&a()}catch(e){console.error("Failed to add auto router:",e),G.default.fromBackend("Failed to add auto router: "+e)}};var tr=e.i(695411),ti=e.i(955135),to=e.i(646563),tn=e.i(362024),td=e.i(21548);let{Text:tc}=R.Typography,{TextArea:tm}=eV.Input,tu=({modelInfo:e,value:l,onChange:s})=>{let[a,r]=(0,x.useState)([]),[i,o]=(0,x.useState)(!1),[n,d]=(0,x.useState)([]);(0,x.useEffect)(()=>{let e=l?.routes;if(e){let t=[];r(l=>e.map((e,s)=>{let a=l[s],r=a?.id||e.id||`route-${s}-${Date.now()}`;return t.push(r),{id:r,model:e.name||e.model||"",utterances:e.utterances||[],description:e.description||"",score_threshold:e.score_threshold??.5}})),d(t)}else r([]),d([])},[l]);let c=(e,t,l)=>{let s=a.map(s=>s.id===e?{...s,[t]:l}:s);r(s),m(s)},m=e=>{let t={routes:e.map(e=>({name:e.model,utterances:e.utterances,description:e.description,score_threshold:e.score_threshold}))};s?.(t)},u=e.map(e=>({value:e.model_group,label:e.model_group}));return(0,t.jsxs)("div",{className:"w-full max-w-none",children:[(0,t.jsxs)(M.Flex,{justify:"space-between",align:"center",gap:"middle",style:{width:"100%",marginBottom:24},children:[(0,t.jsxs)(E.Space,{align:"center",children:[(0,t.jsx)(R.Typography.Title,{level:4,style:{margin:0},children:"Routes Configuration"}),(0,t.jsx)(O.Tooltip,{title:"Configure routing logic to automatically select the best model based on user input patterns",children:(0,t.jsx)(C.InfoCircleOutlined,{className:"text-gray-400"})})]}),(0,t.jsx)(Q.Button,{type:"primary",icon:(0,t.jsx)(to.PlusOutlined,{}),onClick:()=>{let e=`route-${Date.now()}`,t=[...a,{id:e,model:"",utterances:[],description:"",score_threshold:.5}];r(t),m(t),d(t=>[...t,e])},className:"bg-blue-600 hover:bg-blue-700",children:"Add Route"})]}),0===a.length?(0,t.jsx)(e_.Card,{children:(0,t.jsx)(td.Empty,{description:'No routes configured. Click "Add Route" to get started.'})}):(0,t.jsx)(tn.Collapse,{activeKey:n,onChange:e=>d(Array.isArray(e)?e:[e].filter(Boolean)),style:{width:"100%"},items:a.map((e,l)=>({key:e.id,label:(0,t.jsxs)(tc,{style:{fontSize:16},children:["Route ",l+1,": ",e.model||"Unnamed"]}),extra:(0,t.jsx)(Q.Button,{type:"text",danger:!0,size:"small",icon:(0,t.jsx)(ti.DeleteOutlined,{}),onClick:t=>{var l;let s;t.stopPropagation(),l=e.id,r(s=a.filter(e=>e.id!==l)),m(s),d(e=>e.filter(e=>e!==l))}}),children:(0,t.jsxs)(e_.Card,{children:[(0,t.jsxs)("div",{className:"mb-4 w-full",children:[(0,t.jsx)(tc,{className:"text-sm font-medium mb-2 block",children:"Model"}),(0,t.jsx)(Y.Select,{value:e.model,onChange:t=>c(e.id,"model",t),placeholder:"Select model",showSearch:!0,style:{width:"100%"},options:u})]}),(0,t.jsxs)("div",{className:"mb-4 w-full",children:[(0,t.jsx)(tc,{className:"text-sm font-medium mb-2 block",children:"Description"}),(0,t.jsx)(tm,{value:e.description,onChange:t=>c(e.id,"description",t.target.value),placeholder:"Describe when this route should be used...",rows:2,style:{width:"100%"}})]}),(0,t.jsxs)("div",{className:"mb-4 w-full",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2 mb-2",children:[(0,t.jsx)(tc,{className:"text-sm font-medium",children:"Score Threshold"}),(0,t.jsx)(O.Tooltip,{title:"Minimum similarity score to route to this model (0-1)",children:(0,t.jsx)(C.InfoCircleOutlined,{className:"text-gray-400"})})]}),(0,t.jsx)(eh.InputNumber,{value:e.score_threshold,onChange:t=>c(e.id,"score_threshold",t||0),min:0,max:1,step:.1,style:{width:"100%"},placeholder:"0.5"})]}),(0,t.jsxs)("div",{className:"w-full",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2 mb-2",children:[(0,t.jsx)(tc,{className:"text-sm font-medium",children:"Example Utterances"}),(0,t.jsx)(O.Tooltip,{title:"Training examples for this route. Type an utterance and press Enter to add it.",children:(0,t.jsx)(C.InfoCircleOutlined,{className:"text-gray-400"})})]}),(0,t.jsx)(tc,{className:"text-xs text-gray-500 mb-2",children:"Type an utterance and press Enter to add it. You can also paste multiple lines."}),(0,t.jsx)(Y.Select,{mode:"tags",value:e.utterances,onChange:t=>c(e.id,"utterances",t),placeholder:"Type an utterance and press Enter...",style:{width:"100%"},tokenSeparators:["\n"],maxTagCount:"responsive",allowClear:!0})]})]},e.id)}))}),(0,t.jsx)(P.Divider,{}),(0,t.jsxs)("div",{className:"flex justify-between items-center mb-4 w-full",children:[(0,t.jsx)(tc,{className:"text-lg font-semibold",children:"JSON Preview"}),(0,t.jsx)(Q.Button,{type:"link",onClick:()=>o(!i),className:"text-blue-600 p-0",children:i?"Hide":"Show"})]}),i&&(0,t.jsx)(e_.Card,{className:"bg-gray-50 w-full",children:(0,t.jsx)("pre",{className:"text-sm overflow-auto max-h-64 w-full",children:JSON.stringify({routes:a.map(e=>({name:e.model,utterances:e.utterances,description:e.description,score_threshold:e.score_threshold}))},null,2)})})]})},{Text:th}=R.Typography,tp={SIMPLE:{label:"Simple",description:"Basic questions, greetings, simple factual queries",examples:'"Hello!", "What is Python?", "Thanks!"'},MEDIUM:{label:"Medium",description:"Standard queries requiring some reasoning or explanation",examples:'"Explain how REST APIs work", "Debug this error"'},COMPLEX:{label:"Complex",description:"Technical, multi-part requests requiring deep knowledge",examples:'"Design a microservices architecture", "Implement a rate limiter"'},REASONING:{label:"Reasoning",description:"Chain-of-thought, analysis, explicit reasoning requests",examples:'"Think step by step...", "Analyze the pros and cons..."'}},tx=({modelInfo:e,value:l,onChange:s})=>{let a=e.map(e=>({value:e.model_group,label:e.model_group}));return(0,t.jsxs)("div",{className:"w-full max-w-none",children:[(0,t.jsxs)(E.Space,{align:"center",style:{marginBottom:16},children:[(0,t.jsx)(R.Typography.Title,{level:4,style:{margin:0},children:"Complexity Tier Configuration"}),(0,t.jsx)(O.Tooltip,{title:"Map each complexity tier to a model. Simple queries use cheaper/faster models, complex queries use more capable models.",children:(0,t.jsx)(C.InfoCircleOutlined,{className:"text-gray-400"})})]}),(0,t.jsx)(th,{type:"secondary",style:{display:"block",marginBottom:24},children:"The complexity router automatically classifies requests by complexity using rule-based scoring (no API calls, <1ms latency). Configure which model handles each tier."}),(0,t.jsx)(e_.Card,{children:Object.keys(tp).map((e,r)=>{let i=tp[e];return(0,t.jsxs)("div",{children:[r>0&&(0,t.jsx)(P.Divider,{style:{margin:"16px 0"}}),(0,t.jsxs)("div",{className:"mb-4",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2 mb-2",children:[(0,t.jsxs)(th,{strong:!0,style:{fontSize:16},children:[i.label," Tier"]}),(0,t.jsx)(O.Tooltip,{title:i.description,children:(0,t.jsx)(C.InfoCircleOutlined,{className:"text-gray-400"})})]}),(0,t.jsxs)(th,{type:"secondary",style:{display:"block",marginBottom:8,fontSize:12},children:["Examples: ",i.examples]}),(0,t.jsx)(Y.Select,{value:l[e],onChange:t=>{s({...l,[e]:t})},placeholder:`Select model for ${i.label.toLowerCase()} queries`,showSearch:!0,style:{width:"100%"},options:a})]})]},e)})}),(0,t.jsx)(P.Divider,{}),(0,t.jsxs)(e_.Card,{className:"bg-gray-50",children:[(0,t.jsx)(th,{strong:!0,style:{display:"block",marginBottom:8},children:"How Classification Works"}),(0,t.jsx)(th,{type:"secondary",style:{fontSize:13},children:"The router scores each request across 7 dimensions: token count, code presence, reasoning markers, technical terms, simple indicators, multi-step patterns, and question complexity. The weighted score determines the tier:"}),(0,t.jsxs)("ul",{style:{marginTop:8,marginBottom:0,paddingLeft:20,fontSize:13,color:"rgba(0, 0, 0, 0.45)"},children:[(0,t.jsxs)("li",{children:[(0,t.jsx)("strong",{children:"SIMPLE"}),": Score < 0.15"]}),(0,t.jsxs)("li",{children:[(0,t.jsx)("strong",{children:"MEDIUM"}),": Score 0.15 - 0.35"]}),(0,t.jsxs)("li",{children:[(0,t.jsx)("strong",{children:"COMPLEX"}),": Score 0.35 - 0.60"]}),(0,t.jsxs)("li",{children:[(0,t.jsx)("strong",{children:"REASONING"}),": Score > 0.60 (or 2+ reasoning markers)"]})]})]})]})};var tg=e.i(962944),tf=e.i(539677);let{Title:t_,Link:tj}=R.Typography,ty=({form:e,handleOk:s,accessToken:a,userRole:r})=>{let[i,o]=(0,x.useState)(!1),[n,d]=(0,x.useState)(!1),[c,m]=(0,x.useState)(""),[u,h]=(0,x.useState)([]),[p,g]=(0,x.useState)([]),[f,_]=(0,x.useState)(!1),[j,y]=(0,x.useState)(!1),[b,v]=(0,x.useState)("complexity"),[N,w]=(0,x.useState)(null),[C,k]=(0,x.useState)({SIMPLE:"",MEDIUM:"",COMPLEX:"",REASONING:""});(0,x.useEffect)(()=>{(async()=>{h((await (0,l.modelAvailableCall)(a,"","",!1,null,!0,!0)).data.map(e=>e.id))})()},[a]),(0,x.useEffect)(()=>{(async()=>{try{let e=await (0,tr.fetchAvailableModels)(a);g(e)}catch(e){console.error("Error fetching model info for auto router:",e)}})()},[a]);let S=e0.all_admin_roles.includes(r),T=async()=>{d(!0),m(`test-${Date.now()}`),o(!0)},I=()=>{let t=e.getFieldsValue();if(!t.auto_router_name)return void G.default.fromBackend("Please enter an Auto Router Name");if("complexity"===b){if(0===Object.values(C).filter(Boolean).length)return void G.default.fromBackend("Please select at least one model for a complexity tier");let l=C.MEDIUM||C.SIMPLE||C.COMPLEX||C.REASONING;e.setFieldsValue({custom_llm_provider:"auto_router",model:t.auto_router_name,api_key:"not_required_for_auto_router",auto_router_default_model:l}),e.validateFields(["auto_router_name"]).then(r=>{ta({...r,auto_router_name:t.auto_router_name,auto_router_default_model:l,model_type:"complexity_router",complexity_router_config:{tiers:C},model_access_group:t.model_access_group},a,e,s)}).catch(e=>{console.error("Validation failed:",e),G.default.fromBackend("Please fill in all required fields")})}else{if(!t.auto_router_default_model)return void G.default.fromBackend("Please select a Default Model");if(e.setFieldsValue({custom_llm_provider:"auto_router",model:t.auto_router_name,api_key:"not_required_for_auto_router"}),!N||!N.routes||0===N.routes.length)return void G.default.fromBackend("Please configure at least one route for the auto router");if(N.routes.filter(e=>!e.name||!e.description||0===e.utterances.length).length>0)return void G.default.fromBackend("Please ensure all routes have a target model, description, and at least one utterance");e.validateFields().then(t=>{ta({...t,auto_router_config:N,model_type:"semantic_router"},a,e,s)}).catch(e=>{console.error("Validation failed:",e);let t=e.errorFields||[];if(t.length>0){let e=t.map(e=>{let t=e.name[0];return({auto_router_name:"Auto Router Name",auto_router_default_model:"Default Model",auto_router_embedding_model:"Embedding Model"})[t]||t});G.default.fromBackend(`Please fill in the following required fields: ${e.join(", ")}`)}else G.default.fromBackend("Please fill in all required fields")})}};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(t_,{level:2,children:"Add Auto Router"}),(0,t.jsx)(em.Text,{className:"text-gray-600 mb-6",children:"Create an auto router that automatically selects the best model based on request complexity or semantic matching."}),(0,t.jsx)(e_.Card,{className:"mb-4",children:(0,t.jsxs)("div",{className:"mb-4",children:[(0,t.jsx)(em.Text,{className:"text-sm font-medium mb-2 block",children:"Router Type"}),(0,t.jsx)(e9.Radio.Group,{value:b,onChange:e=>v(e.target.value),className:"w-full",children:(0,t.jsxs)(E.Space,{direction:"vertical",className:"w-full",children:[(0,t.jsxs)(e9.Radio,{value:"complexity",className:"w-full",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(tg.ThunderboltOutlined,{className:"text-yellow-500"}),(0,t.jsx)("span",{className:"font-medium",children:"Complexity Router"}),(0,t.jsx)(W.Badge,{count:"Recommended",style:{backgroundColor:"#52c41a",fontSize:"10px",padding:"0 6px"}})]}),(0,t.jsxs)("div",{className:"text-xs text-gray-500 ml-6 mt-1",children:["Automatically routes based on request complexity. No training data needed — just pick 4 models and go.",(0,t.jsx)("br",{}),(0,t.jsx)("span",{className:"text-green-600",children:"✓ Zero API calls"})," ·"," ",(0,t.jsx)("span",{className:"text-green-600",children:"✓ <1ms latency"})," ·"," ",(0,t.jsx)("span",{className:"text-green-600",children:"✓ No cost"})]})]}),(0,t.jsxs)(e9.Radio,{value:"semantic",className:"w-full mt-2",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(tf.BranchesOutlined,{className:"text-blue-500"}),(0,t.jsx)("span",{className:"font-medium",children:"Semantic Router"})]}),(0,t.jsx)("div",{className:"text-xs text-gray-500 ml-6 mt-1",children:"Routes based on semantic similarity to example utterances. Requires embedding model and training examples."})]})]})})]})}),(0,t.jsx)(e_.Card,{children:(0,t.jsxs)(el.Form,{form:e,onFinish:I,labelCol:{span:10},wrapperCol:{span:16},labelAlign:"left",children:[(0,t.jsx)(el.Form.Item,{rules:[{required:!0,message:"Auto router name is required"}],label:"Auto Router Name",name:"auto_router_name",tooltip:"Unique name for this auto router configuration",labelCol:{span:10},labelAlign:"left",children:(0,t.jsx)(eO.TextInput,{placeholder:"e.g., smart_router, auto_router_1"})}),"complexity"===b?(0,t.jsx)("div",{className:"w-full mb-4",children:(0,t.jsx)(tx,{modelInfo:p,value:C,onChange:e=>{k(e)}})}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("div",{className:"w-full mb-4",children:(0,t.jsx)(tu,{modelInfo:p,value:N,onChange:t=>{w(t),e.setFieldValue("auto_router_config",t)}})}),(0,t.jsx)(el.Form.Item,{rules:[{required:"semantic"===b,message:"Default model is required"}],label:"Default Model",name:"auto_router_default_model",tooltip:"Fallback model to use when auto routing logic cannot determine the best model",labelCol:{span:10},labelAlign:"left",children:(0,t.jsx)(Y.Select,{placeholder:"Select a default model",onChange:e=>{_("custom"===e)},options:[...Array.from(new Set(p.map(e=>e.model_group))).map(e=>({value:e,label:e})),{value:"custom",label:"Enter custom model name"}],style:{width:"100%"},showSearch:!0})}),(0,t.jsx)(el.Form.Item,{label:"Embedding Model",name:"auto_router_embedding_model",tooltip:"Optional: Embedding model to use for semantic routing decisions",labelCol:{span:10},labelAlign:"left",children:(0,t.jsx)(Y.Select,{value:e.getFieldValue("auto_router_embedding_model"),placeholder:"Select an embedding model (optional)",onChange:t=>{y("custom"===t),e.setFieldValue("auto_router_embedding_model",t)},options:[...Array.from(new Set(p.map(e=>e.model_group))).map(e=>({value:e,label:e})),{value:"custom",label:"Enter custom model name"}],style:{width:"100%"},showSearch:!0,allowClear:!0})})]}),(0,t.jsxs)("div",{className:"flex items-center my-4",children:[(0,t.jsx)("div",{className:"grow border-t border-gray-200"}),(0,t.jsx)("span",{className:"px-4 text-gray-500 text-sm",children:"Additional Settings"}),(0,t.jsx)("div",{className:"grow border-t border-gray-200"})]}),S&&(0,t.jsx)(el.Form.Item,{label:"Model Access Group",name:"model_access_group",className:"mb-4",tooltip:"Use model access groups to control who can access this auto router",children:(0,t.jsx)(Y.Select,{mode:"tags",showSearch:!0,placeholder:"Select existing groups or type to create new ones",optionFilterProp:"children",tokenSeparators:[","],options:u.map(e=>({value:e,label:e})),maxTagCount:"responsive",allowClear:!0})}),(0,t.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,t.jsx)(O.Tooltip,{title:"Get help on our github",children:(0,t.jsx)(R.Typography.Link,{href:"https://github.com/BerriAI/litellm/issues",children:"Need Help?"})}),(0,t.jsxs)("div",{className:"space-x-2",children:[(0,t.jsx)(Q.Button,{onClick:T,loading:n,children:"Test Connection"}),(0,t.jsx)(Q.Button,{type:"primary",onClick:()=>{I()},children:"Add Auto Router"})]})]})]})}),(0,t.jsx)(es.Modal,{title:"Connection Test Results",open:i,onCancel:()=>{o(!1),d(!1)},footer:[(0,t.jsx)(Q.Button,{onClick:()=>{o(!1),d(!1)},children:"Close"},"close")],width:700,children:i&&(0,t.jsx)(ts,{formValues:e.getFieldsValue(),accessToken:a,testMode:"chat",modelName:e.getFieldValue("auto_router_name"),onClose:()=>{o(!1),d(!1)},onTestComplete:()=>d(!1)},c)})]})};var tb=e.i(838932),tv=e.i(109034),tN=e.i(793130),tw=e.i(560445),tC=e.i(663435),tk=e.i(677667),tS=e.i(898667),tT=e.i(130643),tI=e.i(635432),tF=e.i(564897),tP=e.i(435451);let{Text:tM}=R.Typography,tA=({form:e,showCacheControl:l,onCacheControlChange:s})=>{let a=t=>{let l=e.getFieldValue("litellm_extra_params");try{let s=l?JSON.parse(l):{};t.length>0?s.cache_control_injection_points=t:delete s.cache_control_injection_points,Object.keys(s).length>0?e.setFieldValue("litellm_extra_params",JSON.stringify(s,null,2)):e.setFieldValue("litellm_extra_params","")}catch(e){console.error("Error updating cache control points:",e)}};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(el.Form.Item,{label:"Cache Control Injection Points",name:"cache_control",valuePropName:"checked",className:"mb-4",tooltip:"Tell litellm where to inject cache control checkpoints. You can specify either by role (to apply to all messages of that role) or by specific message index.",children:(0,t.jsx)(L.Switch,{onChange:s,className:"bg-gray-600"})}),l&&(0,t.jsxs)("div",{className:"ml-6 pl-4 border-l-2 border-gray-200",children:[(0,t.jsx)(tM,{className:"text-sm text-gray-500 block mb-4",children:"Providers like Anthropic, Bedrock API require users to specify where to inject cache control checkpoints, litellm can automatically add them for you as a cost saving feature."}),(0,t.jsx)(el.Form.List,{name:"cache_control_injection_points",initialValue:[{location:"message"}],children:(l,{add:s,remove:r})=>(0,t.jsxs)(t.Fragment,{children:[l.map((s,i)=>(0,t.jsxs)("div",{className:"flex items-center mb-4 gap-4",children:[(0,t.jsx)(el.Form.Item,{...s,label:"Type",name:[s.name,"location"],initialValue:"message",className:"mb-0",style:{width:"180px"},children:(0,t.jsx)(Y.Select,{disabled:!0,options:[{value:"message",label:"Message"}]})}),(0,t.jsx)(el.Form.Item,{...s,label:"Role",name:[s.name,"role"],className:"mb-0",style:{width:"180px"},tooltip:"LiteLLM will mark all messages of this role as cacheable",children:(0,t.jsx)(Y.Select,{placeholder:"Select a role",allowClear:!0,options:[{value:"user",label:"User"},{value:"system",label:"System"},{value:"assistant",label:"Assistant"}],onChange:()=>{a(e.getFieldValue("cache_control_points"))}})}),(0,t.jsx)(el.Form.Item,{...s,label:"Index",name:[s.name,"index"],className:"mb-0",style:{width:"180px"},tooltip:"(Optional) If set litellm will mark the message at this index as cacheable",children:(0,t.jsx)(tP.default,{type:"number",placeholder:"Optional",step:1,onChange:()=>{a(e.getFieldValue("cache_control_points"))}})}),l.length>1&&(0,t.jsx)(tF.MinusCircleOutlined,{className:"text-red-500 cursor-pointer text-lg ml-12",onClick:()=>{r(s.name),setTimeout(()=>{a(e.getFieldValue("cache_control_points"))},0)}})]},s.key)),(0,t.jsx)(el.Form.Item,{children:(0,t.jsxs)("button",{type:"button",className:"flex items-center justify-center w-full border border-dashed border-gray-300 py-2 px-4 text-gray-600 hover:text-blue-600 hover:border-blue-300 transition-all rounded-sm",onClick:()=>s(),children:[(0,t.jsx)(to.PlusOutlined,{className:"mr-2"}),"Add Injection Point"]})})]})})]})]})};var tE=e.i(916940),tL=e.i(122550);let{Link:tO}=R.Typography,tR=({showAdvancedSettings:e,setShowAdvancedSettings:l,teams:s,guardrailsList:a,tagsList:r,accessToken:i})=>{let[o]=el.Form.useForm(),[n,d]=x.default.useState(!1),[c,m]=x.default.useState("per_token"),[u,h]=x.default.useState(!1),p=(e,t)=>t&&(isNaN(Number(t))||0>Number(t))?Promise.reject("Please enter a valid positive number"):Promise.resolve();return(0,t.jsx)(t.Fragment,{children:(0,t.jsxs)(tk.Accordion,{className:"mt-2 mb-4",children:[(0,t.jsx)(tS.AccordionHeader,{children:(0,t.jsx)("b",{children:"Advanced Settings"})}),(0,t.jsx)(tT.AccordionBody,{children:(0,t.jsxs)("div",{className:"bg-white rounded-lg",children:[(0,t.jsx)(el.Form.Item,{label:"Custom Pricing",name:"custom_pricing",valuePropName:"checked",className:"mb-4",children:(0,t.jsx)(L.Switch,{onChange:e=>{d(e),e||o.setFieldsValue({input_cost_per_token:void 0,output_cost_per_token:void 0,cache_read_input_token_cost:void 0,cache_creation_input_token_cost:void 0,input_cost_per_second:void 0})},className:"bg-gray-600"})}),(0,t.jsx)(el.Form.Item,{label:(0,t.jsxs)("span",{children:["Attached Knowledge Bases (RAG)"," ",(0,t.jsx)(O.Tooltip,{title:"Vector stores to use for RAG. Every request to this model will automatically retrieve context from these knowledge bases.",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/completion/knowledgebase",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(C.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"vector_store_ids",className:"mt-4",help:"Select vector stores to attach. Requests to this model will automatically use these for RAG. Set up vector stores in Tools > Vector Stores.",children:(0,t.jsx)(tE.default,{onChange:()=>{},accessToken:i,placeholder:"Select knowledge bases (optional)"})}),(0,t.jsx)(el.Form.Item,{label:(0,t.jsxs)("span",{children:["Guardrails"," ",(0,t.jsx)(O.Tooltip,{title:"Apply safety guardrails to this key to filter content or enforce policies",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(C.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"guardrails",className:"mt-4",help:"Select existing guardrails. Go to 'Guardrails' tab to create new guardrails.",children:(0,t.jsx)(Y.Select,{mode:"tags",style:{width:"100%"},placeholder:"Select or enter guardrails",options:a.map(e=>({value:e,label:e}))})}),(0,t.jsx)(el.Form.Item,{label:"Tags",name:"tags",className:"mb-4",children:(0,t.jsx)(Y.Select,{mode:"tags",style:{width:"100%"},placeholder:"Select or enter tags",options:Object.values(r).map(e=>({value:e.name,label:e.name,title:e.description||e.name}))})}),n&&(0,t.jsxs)("div",{className:"ml-6 pl-4 border-l-2 border-gray-200",children:[(0,t.jsx)(el.Form.Item,{label:"Pricing Model",name:"pricing_model",className:"mb-4",children:(0,t.jsx)(Y.Select,{defaultValue:"per_token",onChange:e=>m(e),options:[{value:"per_token",label:"Per Million Tokens"},{value:"per_second",label:"Per Second"}]})}),"per_token"===c?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(el.Form.Item,{label:"Input Cost (per 1M tokens)",name:"input_cost_per_token",rules:[{validator:p}],className:"mb-4",children:(0,t.jsx)(eO.TextInput,{})}),(0,t.jsx)(el.Form.Item,{label:"Output Cost (per 1M tokens)",name:"output_cost_per_token",rules:[{validator:p}],className:"mb-4",children:(0,t.jsx)(eO.TextInput,{})}),(0,t.jsx)(el.Form.Item,{label:"Cache Read Cost (per 1M tokens)",name:"cache_read_input_token_cost",rules:[{validator:p}],tooltip:"If left blank, defaults to Input Cost.",className:"mb-4",children:(0,t.jsx)(eO.TextInput,{placeholder:"Defaults to Input Cost if blank"})}),(0,t.jsx)(el.Form.Item,{label:"Cache Write Cost (per 1M tokens)",name:"cache_creation_input_token_cost",rules:[{validator:p}],tooltip:"If left blank, defaults to Input Cost (the backend falls back to input_cost_per_token when no cache-write rate is set).",className:"mb-4",children:(0,t.jsx)(eO.TextInput,{placeholder:"Defaults to Input Cost if blank"})})]}):(0,t.jsx)(el.Form.Item,{label:"Cost Per Second",name:"input_cost_per_second",rules:[{validator:p}],className:"mb-4",children:(0,t.jsx)(eO.TextInput,{})})]}),(0,t.jsx)(el.Form.Item,{label:"Use in pass through routes",name:"use_in_pass_through",valuePropName:"checked",className:"mb-4 mt-4",tooltip:(0,t.jsxs)("span",{children:["Allow using these credentials in pass through routes."," ",(0,t.jsx)(tO,{href:"https://docs.litellm.ai/docs/pass_through/vertex_ai",target:"_blank",children:"Learn more"})]}),children:(0,t.jsx)(L.Switch,{onChange:e=>{let t=o.getFieldValue("litellm_extra_params");try{let l=t?JSON.parse(t):{};e?l.use_in_pass_through=!0:delete l.use_in_pass_through,Object.keys(l).length>0?o.setFieldValue("litellm_extra_params",JSON.stringify(l,null,2)):o.setFieldValue("litellm_extra_params","")}catch(t){e?o.setFieldValue("litellm_extra_params",JSON.stringify({use_in_pass_through:!0},null,2)):o.setFieldValue("litellm_extra_params","")}},className:"bg-gray-600"})}),(0,t.jsx)(tA,{form:o,showCacheControl:u,onCacheControlChange:e=>{if(h(e),!e){let e=o.getFieldValue("litellm_extra_params");try{let t=e?JSON.parse(e):{};delete t.cache_control_injection_points,Object.keys(t).length>0?o.setFieldValue("litellm_extra_params",JSON.stringify(t,null,2)):o.setFieldValue("litellm_extra_params","")}catch(e){o.setFieldValue("litellm_extra_params","")}}}}),(0,t.jsx)(el.Form.Item,{label:"LiteLLM Params",name:"litellm_extra_params",tooltip:"Optional litellm params used for making a litellm.completion() call.",className:"mb-4 mt-4",rules:[{validator:tL.formItemValidateJSON}],children:(0,t.jsx)(tI.default,{rows:4,placeholder:'{ "rpm": 100, "timeout": 0, "stream_timeout": 0 }'})}),(0,t.jsxs)(eD.Row,{className:"mb-4",children:[(0,t.jsx)(eq.Col,{span:10}),(0,t.jsx)(eq.Col,{span:10,children:(0,t.jsxs)(em.Text,{className:"text-gray-600 text-sm",children:["Pass JSON of litellm supported params"," ",(0,t.jsx)(tO,{href:"https://docs.litellm.ai/docs/completion/input",target:"_blank",children:"litellm.completion() call"})]})})]}),(0,t.jsx)(el.Form.Item,{label:"Model Info",name:"model_info_params",tooltip:"Optional model info params. Returned when calling `/model/info` endpoint.",className:"mb-0",rules:[{validator:tL.formItemValidateJSON}],children:(0,t.jsx)(tI.default,{rows:4,placeholder:'{ "mode": "chat" }'})})]})})]})})};var tB=e.i(291542),tz=e.i(750113);let tq=({content:e,children:l,width:s="auto",className:a=""})=>{let[r,i]=(0,x.useState)(!1),[o,n]=(0,x.useState)("top"),d=(0,x.useRef)(null);return(0,t.jsxs)("div",{className:"relative inline-block",ref:d,children:[l||(0,t.jsx)(tz.QuestionCircleOutlined,{className:"ml-1 text-gray-500 cursor-help",onMouseEnter:()=>{if(d.current){let e=d.current.getBoundingClientRect(),t=e.top,l=window.innerHeight-e.bottom;t<300&&l>300?n("bottom"):n("top")}i(!0)},onMouseLeave:()=>i(!1)}),r&&(0,t.jsxs)("div",{className:`absolute left-1/2 -translate-x-1/2 z-50 bg-black/90 text-white p-2 rounded-md text-sm font-normal shadow-lg ${a}`,style:{["top"===o?"bottom":"top"]:"100%",width:s,marginBottom:"top"===o?"8px":"0",marginTop:"bottom"===o?"8px":"0"},children:[e,(0,t.jsx)("div",{className:"absolute left-1/2 -translate-x-1/2 w-0 h-0",style:{top:"top"===o?"100%":"auto",bottom:"bottom"===o?"100%":"auto",borderTop:"top"===o?"6px solid rgba(0, 0, 0, 0.9)":"6px solid transparent",borderBottom:"bottom"===o?"6px solid rgba(0, 0, 0, 0.9)":"6px solid transparent",borderLeft:"6px solid transparent",borderRight:"6px solid transparent"}})]})]})},tV=()=>{let e=el.Form.useFormInstance(),[l,s]=(0,x.useState)(0),a=el.Form.useWatch("model",e)||[],r=Array.isArray(a)?a:[a],i=el.Form.useWatch("custom_model_name",e),o=!r.includes("all-wildcard"),n=el.Form.useWatch("custom_llm_provider",e);if((0,x.useEffect)(()=>{if(i&&r.includes("custom")){let t=(e.getFieldValue("model_mappings")||[]).map(e=>"custom"===e.public_name||"custom"===e.litellm_model?n===eP.Providers.Azure?{public_name:i,litellm_model:`azure/${i}`}:{public_name:i,litellm_model:i}:e);e.setFieldValue("model_mappings",t),s(e=>e+1)}},[i,r,n,e]),(0,x.useEffect)(()=>{if(r.length>0&&!r.includes("all-wildcard")){let t=e.getFieldValue("model_mappings")||[];if(t.length!==r.length||!r.every(e=>t.some(t=>"custom"===e?"custom"===t.litellm_model||t.litellm_model===i:n===eP.Providers.Azure?t.litellm_model===`azure/${e}`:t.litellm_model===e))){let t=r.map(e=>"custom"===e&&i?n===eP.Providers.Azure?{public_name:i,litellm_model:`azure/${i}`}:{public_name:i,litellm_model:i}:n===eP.Providers.Azure?{public_name:e,litellm_model:`azure/${e}`}:{public_name:e,litellm_model:e});e.setFieldValue("model_mappings",t),s(e=>e+1)}}},[r,i,n,e]),!o)return null;let d=(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("div",{className:"mb-2 font-normal",children:"The name you specify in your API calls to LiteLLM Proxy"}),(0,t.jsxs)("div",{className:"mb-2 font-normal",children:[(0,t.jsx)("strong",{children:"Example:"})," If you name your public model"," ",(0,t.jsx)("code",{className:"bg-gray-700 px-1 py-0.5 rounded-sm text-xs",children:"example-name"}),", and choose"," ",(0,t.jsx)("code",{className:"bg-gray-700 px-1 py-0.5 rounded-sm text-xs",children:"openai/qwen-plus-latest"})," as the LiteLLM model"]}),(0,t.jsxs)("div",{className:"mb-2 font-normal",children:[(0,t.jsx)("strong",{children:"Usage:"})," You make an API call to the LiteLLM proxy with"," ",(0,t.jsx)("code",{className:"bg-gray-700 px-1 py-0.5 rounded-sm text-xs",children:'model = "example-name"'})]}),(0,t.jsxs)("div",{className:"font-normal",children:[(0,t.jsx)("strong",{children:"Result:"})," LiteLLM sends"," ",(0,t.jsx)("code",{className:"bg-gray-700 px-1 py-0.5 rounded-sm text-xs",children:"qwen-plus-latest"})," to the provider"]})]}),c=(0,t.jsx)("div",{children:"The model name LiteLLM will send to the LLM API"}),m=[{title:(0,t.jsxs)("span",{className:"flex items-center",children:["Public Model Name",(0,t.jsx)(tq,{content:d,width:"500px"})]}),dataIndex:"public_name",key:"public_name",render:(l,s,a)=>(0,t.jsx)(eO.TextInput,{value:l,onChange:t=>{let l=t.target.value,s=[...e.getFieldValue("model_mappings")],r=n===eP.Providers.Anthropic,i=l.endsWith("-1m"),o=e.getFieldValue("litellm_extra_params"),d=!o||""===o.trim(),c=l;if(r&&i&&d){let t=JSON.stringify({extra_headers:{"anthropic-beta":"context-1m-2025-08-07"}},null,2);e.setFieldValue("litellm_extra_params",t),c=l.slice(0,-3)}s[a].public_name=c,e.setFieldValue("model_mappings",s)}})},{title:(0,t.jsxs)("span",{className:"flex items-center",children:["LiteLLM Model Name",(0,t.jsx)(tq,{content:c,width:"360px"})]}),dataIndex:"litellm_model",key:"litellm_model"}];return(0,t.jsx)(t.Fragment,{children:(0,t.jsx)(el.Form.Item,{label:"Model Mappings",name:"model_mappings",tooltip:"Map public model names to LiteLLM model names for load balancing",labelCol:{span:10},wrapperCol:{span:16},labelAlign:"left",rules:[{required:!0,validator:async(e,t)=>{if(!t||0===t.length)throw Error("At least one model mapping is required");if(t.filter(e=>!e.public_name||""===e.public_name.trim()).length>0)throw Error("All model mappings must have valid public names")}}],children:(0,t.jsx)(tB.Table,{dataSource:e.getFieldValue("model_mappings"),columns:m,pagination:!1,size:"small"},l)})})},tD=({selectedProvider:e,providerModels:l,getPlaceholder:s})=>{let a=el.Form.useFormInstance(),r=t=>{let l=t.target.value,s=(a.getFieldValue("model_mappings")||[]).map(t=>"custom"===t.public_name||"custom"===t.litellm_model?e===eP.Providers.Azure?{public_name:l,litellm_model:`azure/${l}`}:{public_name:l,litellm_model:l}:t);a.setFieldsValue({model_mappings:s})};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)(el.Form.Item,{label:"LiteLLM Model Name(s)",tooltip:"The model name LiteLLM will send to the LLM API",className:"mb-0",children:[(0,t.jsx)(el.Form.Item,{name:"model",rules:[{required:!0,message:`Please enter ${e===eP.Providers.Azure?"a deployment name":"at least one model"}.`}],noStyle:!0,children:e===eP.Providers.Azure||e===eP.Providers.OpenAI_Compatible||e===eP.Providers.Ollama?(0,t.jsx)(t.Fragment,{children:(0,t.jsx)(eO.TextInput,{placeholder:s(e),onChange:e===eP.Providers.Azure?e=>{let t=e.target.value,l=t?[{public_name:t,litellm_model:`azure/${t}`}]:[];a.setFieldsValue({model:t,model_mappings:l})}:void 0})}):l.length>0?(0,t.jsx)(Y.Select,{"data-testid":"model-name-select",mode:"multiple",allowClear:!0,showSearch:!0,placeholder:"Select models",onChange:t=>{let l=Array.isArray(t)?t:[t];if(l.includes("all-wildcard"))a.setFieldsValue({model_name:void 0,model_mappings:[]});else if(JSON.stringify(a.getFieldValue("model"))!==JSON.stringify(l)){let t=l.map(t=>e===eP.Providers.Azure?{public_name:t,litellm_model:`azure/${t}`}:{public_name:t,litellm_model:t});a.setFieldsValue({model:l,model_mappings:t})}},optionFilterProp:"children",filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:[{label:"Custom Model Name (Enter below)",value:"custom"},{label:`All ${e} Models (Wildcard)`,value:"all-wildcard"},...l.map(e=>({label:e,value:e}))],style:{width:"100%"}}):(0,t.jsx)(eO.TextInput,{placeholder:s(e)})}),(0,t.jsx)(el.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.model!==t.model,children:({getFieldValue:l})=>{let s=l("model")||[];return(Array.isArray(s)?s:[s]).includes("custom")&&(0,t.jsx)(el.Form.Item,{name:"custom_model_name",rules:[{required:!0,message:"Please enter a custom model name."}],className:"mt-2",children:(0,t.jsx)(eO.TextInput,{placeholder:e===eP.Providers.Azure?"Enter Azure deployment name":"Enter custom model name",onChange:r})})}})]}),(0,t.jsxs)(eD.Row,{children:[(0,t.jsx)(eq.Col,{span:10}),(0,t.jsx)(eq.Col,{span:14,children:(0,t.jsx)(em.Text,{className:"mb-3 mt-1",children:e===eP.Providers.Azure?"Your deployment name will be saved as the public model name, and LiteLLM will use 'azure/deployment-name' internally":"The model name LiteLLM will send to the LLM API"})})]})]})},tH=[{value:"chat",label:"Chat - /chat/completions"},{value:"completion",label:"Completion - /completions"},{value:"embedding",label:"Embedding - /embeddings"},{value:"audio_speech",label:"Audio Speech - /audio/speech"},{value:"audio_transcription",label:"Audio Transcription - /audio/transcriptions"},{value:"image_generation",label:"Image Generation - /images/generations"},{value:"video_generation",label:"Video Generation - /videos"},{value:"rerank",label:"Rerank - /rerank"},{value:"realtime",label:"Realtime - /realtime"},{value:"batch",label:"Batch - /batch"},{value:"ocr",label:"OCR - /ocr"}],{Title:tG,Link:tU}=R.Typography,t$=({form:e,handleOk:s,selectedProvider:a,setSelectedProvider:i,providerModels:o,setProviderModelsFn:n,getPlaceholder:d,uploadProps:c,showAdvancedSettings:m,setShowAdvancedSettings:u,teams:h,credentials:p})=>{let[g,f]=(0,x.useState)("chat"),[_,j]=(0,x.useState)(!1),[y,b]=(0,x.useState)(!1),[v,N]=(0,x.useState)(""),{accessToken:w,userRole:C,premiumUser:k,userId:S}=(0,r.default)(),{data:T,isLoading:I,error:F}=eB(),{data:P}=(0,tb.useGuardrails)(),M=P?.guardrails.map(e=>e.guardrail_name),{data:A,isLoading:E,error:L}=(0,tv.useTags)(),z=async()=>{b(!0),N(`test-${Date.now()}`),j(!0)},[q,V]=(0,x.useState)(!1),[D,H]=(0,x.useState)([]),[G,U]=(0,x.useState)(null);(0,x.useEffect)(()=>{(async()=>{H((await (0,l.modelAvailableCall)(w,"","",!1,null,!0,!0)).data.map(e=>e.id))})()},[w]);let $=(0,x.useMemo)(()=>T?[...T].sort((e,t)=>e.provider_display_name.localeCompare(t.provider_display_name)):[],[T]),K=F?F instanceof Error?F.message:"Failed to load providers":null,J=e0.all_admin_roles.includes(C),W=(0,e0.isUserTeamAdminForAnyTeam)(h,S);return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(tG,{level:2,children:"Add Model"}),(0,t.jsx)(e_.Card,{children:(0,t.jsx)(el.Form,{form:e,onFinish:async e=>{await s().then(()=>{U(null)})},onFinishFailed:e=>{},labelCol:{span:10},wrapperCol:{span:16},labelAlign:"left",children:(0,t.jsxs)(t.Fragment,{children:[W&&!J&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(el.Form.Item,{label:"Select Team",name:"team_id",rules:[{required:!0,message:"Please select a team to continue"}],tooltip:"Select the team for which you want to add this model",children:(0,t.jsx)(tC.default,{onChange:e=>{U(e)}})}),!G&&(0,t.jsx)(tw.Alert,{message:"Team Selection Required",description:"As a team admin, you need to select your team first before adding models.",type:"info",showIcon:!0,className:"mb-4"})]}),(J||W&&G)&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(el.Form.Item,{rules:[{required:!0,message:"Required"}],label:"Provider:",name:"custom_llm_provider",tooltip:"E.g. OpenAI, Azure OpenAI, Anthropic, Bedrock, etc.",labelCol:{span:10},labelAlign:"left",children:(0,t.jsxs)(Y.Select,{virtual:!1,showSearch:!0,loading:I,placeholder:I?"Loading providers...":"Select a provider",optionFilterProp:"data-label",onChange:t=>{i(t),n(t),e.setFieldsValue({custom_llm_provider:t}),e.setFieldsValue({model:[],model_name:void 0})},children:[K&&0===$.length&&(0,t.jsx)(Y.Select.Option,{value:"",children:K},"__error"),$.map(e=>{let l=e.provider_display_name,s=e.provider;return eP.providerLogoMap[l],(0,t.jsx)(Y.Select.Option,{value:s,"data-label":l,children:(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)(B.ProviderLogo,{provider:s,className:"w-5 h-5"}),(0,t.jsx)("span",{children:l})]})},s)})]})}),(0,t.jsx)(tD,{selectedProvider:a,providerModels:o,getPlaceholder:d}),(0,t.jsx)(tV,{}),(0,t.jsx)(el.Form.Item,{label:"Mode",name:"mode",className:"mb-1",children:(0,t.jsx)(Y.Select,{style:{width:"100%"},value:g,onChange:e=>f(e),options:tH})}),(0,t.jsxs)(eD.Row,{children:[(0,t.jsx)(eq.Col,{span:10}),(0,t.jsx)(eq.Col,{span:10,children:(0,t.jsxs)(em.Text,{className:"mb-5 mt-1",children:[(0,t.jsx)("strong",{children:"Optional"})," - LiteLLM endpoint to use when health checking this model"," ",(0,t.jsx)(tU,{href:"https://docs.litellm.ai/docs/proxy/health#health",target:"_blank",children:"Learn more"})]})})]}),(0,t.jsx)("div",{className:"mb-4",children:(0,t.jsx)(R.Typography.Text,{className:"text-sm text-gray-500 mb-2",children:"Either select existing credentials OR enter new provider credentials below"})}),(0,t.jsx)(el.Form.Item,{label:"Existing Credentials",name:"litellm_credential_name",initialValue:null,children:(0,t.jsx)(Y.Select,{showSearch:!0,placeholder:"Select or search for existing credentials",optionFilterProp:"children",filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:[{value:null,label:"None"},...p.map(e=>({value:e.credential_name,label:e.credential_name}))],allowClear:!0})}),(0,t.jsx)(el.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.litellm_credential_name!==t.litellm_credential_name||e.provider!==t.provider,children:({getFieldValue:e})=>e("litellm_credential_name")?null:(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)("div",{className:"flex items-center my-4",children:[(0,t.jsx)("div",{className:"grow border-t border-gray-200"}),(0,t.jsx)("span",{className:"px-4 text-gray-500 text-sm",children:"OR"}),(0,t.jsx)("div",{className:"grow border-t border-gray-200"})]}),(0,t.jsx)(eK,{selectedProvider:a,uploadProps:c})]})}),(0,t.jsxs)("div",{className:"flex items-center my-4",children:[(0,t.jsx)("div",{className:"grow border-t border-gray-200"}),(0,t.jsx)("span",{className:"px-4 text-gray-500 text-sm",children:"Additional Model Info Settings"}),(0,t.jsx)("div",{className:"grow border-t border-gray-200"})]}),(J||!W)&&(0,t.jsx)(el.Form.Item,{label:"Team-BYOK Model",tooltip:"Only use this model + credential combination for this team. Useful when teams want to onboard their own OpenAI keys.",className:"mb-4",children:(0,t.jsx)(O.Tooltip,{title:k?"":"This is an enterprise-only feature. Upgrade to premium to restrict model+credential combinations to a specific team.",placement:"top",children:(0,t.jsx)(tN.Switch,{checked:q,onChange:t=>{V(t),t||e.setFieldValue("team_id",void 0)},disabled:!k})})}),q&&(J||!W)&&(0,t.jsx)(el.Form.Item,{label:"Select Team",name:"team_id",className:"mb-4",tooltip:"Only keys for this team will be able to call this model.",rules:[{required:q&&!J,message:"Please select a team."}],children:(0,t.jsx)(tC.default,{disabled:!k})}),J&&(0,t.jsx)(t.Fragment,{children:(0,t.jsx)(el.Form.Item,{label:"Model Access Group",name:"model_access_group",className:"mb-4",tooltip:"Use model access groups to give users access to select models, and add new ones to the group over time.",children:(0,t.jsx)(Y.Select,{mode:"tags",showSearch:!0,placeholder:"Select existing groups or type to create new ones",optionFilterProp:"children",tokenSeparators:[","],options:D.map(e=>({value:e,label:e})),maxTagCount:"responsive",allowClear:!0})})}),(0,t.jsx)(tR,{showAdvancedSettings:m,setShowAdvancedSettings:u,teams:h,guardrailsList:M||[],tagsList:A||{},accessToken:w||""})]}),(0,t.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,t.jsx)(O.Tooltip,{title:"Get help on our github",children:(0,t.jsx)(R.Typography.Link,{href:"https://github.com/BerriAI/litellm/issues",children:"Need Help?"})}),(0,t.jsxs)("div",{className:"space-x-2",children:[(0,t.jsx)(Q.Button,{"data-testid":"test-connect-btn",onClick:z,loading:y,children:"Test Connect"}),(0,t.jsx)(Q.Button,{"data-testid":"add-model-btn",htmlType:"submit",children:"Add Model"})]})]})]})})}),(0,t.jsx)(es.Modal,{title:"Connection Test Results",open:_,onCancel:()=>{j(!1),b(!1)},footer:[(0,t.jsx)(Q.Button,{onClick:()=>{j(!1),b(!1)},children:"Close"},"close")],width:700,children:_&&(0,t.jsx)(ts,{formValues:e.getFieldsValue(),accessToken:w,testMode:g,modelName:e.getFieldValue("model_name")||e.getFieldValue("model"),onClose:()=>{j(!1),b(!1)},onTestComplete:()=>b(!1)},v)})]})},tK=({form:e,handleOk:l,selectedProvider:s,setSelectedProvider:a,providerModels:r,setProviderModelsFn:i,getPlaceholder:o,uploadProps:n,showAdvancedSettings:d,setShowAdvancedSettings:c,teams:m,credentials:u,accessToken:h,userRole:p})=>{let[x]=el.Form.useForm();return(0,t.jsx)(t.Fragment,{children:(0,t.jsxs)(e6.TabGroup,{className:"w-full",children:[(0,t.jsxs)(e3.TabList,{className:"mb-4",children:[(0,t.jsx)(e5.Tab,{children:"Add Model"}),(0,t.jsx)(e5.Tab,{children:"Add Auto Router"})]}),(0,t.jsxs)(e8.TabPanels,{children:[(0,t.jsx)(J.TabPanel,{children:(0,t.jsx)(t$,{form:e,handleOk:l,selectedProvider:s,setSelectedProvider:a,providerModels:r,setProviderModelsFn:i,getPlaceholder:o,uploadProps:n,showAdvancedSettings:d,setShowAdvancedSettings:c,teams:m,credentials:u})}),(0,t.jsx)(J.TabPanel,{children:(0,t.jsx)(ty,{form:x,handleOk:()=>{x.validateFields().then(e=>{ta(e,h,x,l)}).catch(e=>{console.error("Validation failed:",e)})},accessToken:h,userRole:p})})]})]})})};var tJ=e.i(798496),tW=e.i(536916),tQ=e.i(502275),tY=e.i(122577);let tX=[{pattern:/Missing .* API Key/i,replacement:"Missing API Key"},{pattern:/Connection timeout/i,replacement:"Connection timeout"},{pattern:/Network.*not.*ok/i,replacement:"Network connection failed"},{pattern:/403.*Forbidden/i,replacement:"Access forbidden - check API key permissions"},{pattern:/401.*Unauthorized/i,replacement:"Unauthorized - invalid API key"},{pattern:/429.*rate limit/i,replacement:"Rate limit exceeded"},{pattern:/500.*Internal Server Error/i,replacement:"Provider internal server error"},{pattern:/litellm\.AuthenticationError/i,replacement:"Authentication failed"},{pattern:/litellm\.RateLimitError/i,replacement:"Rate limit exceeded"},{pattern:/litellm\.APIError/i,replacement:"API error"}],tZ=({accessToken:e,modelData:s,all_models_on_proxy:a,getDisplayModelName:r,setSelectedModelId:i,teams:o,isLoading:n=!1,paginationMeta:d,currentPage:c=1,pageSize:m=50,onPageChange:u})=>{let h,p,g,f,[_,j]=(0,x.useState)({}),[y,b]=(0,x.useState)([]),[v,N]=(0,x.useState)(!1),[w,C]=(0,x.useState)(!1),[k,S]=(0,x.useState)(null),[F,P]=(0,x.useState)(!1),[M,A]=(0,x.useState)(null);(0,x.useRef)(null),(0,x.useEffect)(()=>{e&&s?.data&&(async()=>{let t={};s.data.forEach(e=>{let l=e.model_info?.id;l&&(t[l]={status:"none",lastCheck:"None",lastSuccess:"None",loading:!1,error:void 0,fullError:void 0,successResponse:void 0})});try{let a=await (0,l.latestHealthChecksCall)(e);a&&a.latest_health_checks&&"object"==typeof a.latest_health_checks&&Object.entries(a.latest_health_checks).forEach(([e,l])=>{if(!l||!s.data.some(t=>t.model_info?.id===e))return;let a=l.error_message||void 0;t[e]={status:l.status||"unknown",lastCheck:l.checked_at?new Date(l.checked_at).toLocaleString():"None",lastSuccess:"healthy"===l.status&&l.checked_at?new Date(l.checked_at).toLocaleString():"None",loading:!1,error:a?E(a):void 0,fullError:a,successResponse:"healthy"===l.status?l:void 0}})}catch(e){console.warn("Failed to load health check history (using default states):",e)}j(t)})()},[e,s]);let E=e=>{if(!e)return"Health check failed";let t="string"==typeof e?e:JSON.stringify(e),l=t.match(/(\w+Error):\s*(\d{3})/i);if(l)return`${l[1]}: ${l[2]}`;let s=t.match(/(AuthenticationError|RateLimitError|BadRequestError|InternalServerError|TimeoutError|NotFoundError|ForbiddenError|ServiceUnavailableError|BadGatewayError|ContentPolicyViolationError|\w+Error)/i),a=t.match(/\b(400|401|403|404|408|429|500|502|503|504)\b/);if(s&&a)return`${s[1]}: ${a[1]}`;if(a){let e=a[1];return`${({400:"BadRequestError",401:"AuthenticationError",403:"ForbiddenError",404:"NotFoundError",408:"TimeoutError",429:"RateLimitError",500:"InternalServerError",502:"BadGatewayError",503:"ServiceUnavailableError",504:"GatewayTimeoutError"})[e]}: ${e}`}if(s){let e=s[1],t={AuthenticationError:"401",RateLimitError:"429",BadRequestError:"400",InternalServerError:"500",TimeoutError:"408",NotFoundError:"404",ForbiddenError:"403",ServiceUnavailableError:"503",BadGatewayError:"502",GatewayTimeoutError:"504",ContentPolicyViolationError:"400"}[e];return t?`${e}: ${t}`:e}for(let{pattern:e,replacement:l}of tX)if(e.test(t))return l;if(/missing.*api.*key|invalid.*key|unauthorized/i.test(t))return"AuthenticationError: 401";if(/rate.*limit|too.*many.*requests/i.test(t))return"RateLimitError: 429";if(/timeout|timed.*out/i.test(t))return"TimeoutError: 408";if(/not.*found/i.test(t))return"NotFoundError: 404";if(/forbidden|access.*denied/i.test(t))return"ForbiddenError: 403";if(/internal.*server.*error/i.test(t))return"InternalServerError: 500";let r=t.replace(/[\n\r]+/g," ").replace(/\s+/g," ").trim(),i=r.split(/[.!?]/),o=i[0]?.trim();return o&&o.length>0?o.length>100?o.substring(0,97)+"...":o:r.length>100?r.substring(0,97)+"...":r},L=async t=>{if(e){j(e=>({...e,[t]:{...e[t],loading:!0,status:"checking"}}));try{let s=await (0,l.individualModelHealthCheckCall)(e,t),a=new Date().toLocaleString();if(s.unhealthy_count>0&&s.unhealthy_endpoints&&s.unhealthy_endpoints.length>0){let e=s.unhealthy_endpoints[0]?.error||"Health check failed",l=E(e);j(s=>({...s,[t]:{status:"unhealthy",lastCheck:a,lastSuccess:s[t]?.lastSuccess||"None",loading:!1,error:l,fullError:e}}))}else j(e=>({...e,[t]:{status:"healthy",lastCheck:a,lastSuccess:a,loading:!1,successResponse:s}}));try{let s=await (0,l.latestHealthChecksCall)(e),a=s.latest_health_checks?.[t];if(a){let e=a.error_message||void 0;j(l=>({...l,[t]:{status:a.status||l[t]?.status||"unknown",lastCheck:a.checked_at?new Date(a.checked_at).toLocaleString():l[t]?.lastCheck||"None",lastSuccess:"healthy"===a.status&&a.checked_at?new Date(a.checked_at).toLocaleString():l[t]?.lastSuccess||"None",loading:!1,error:e?E(e):l[t]?.error,fullError:e||l[t]?.fullError,successResponse:"healthy"===a.status?a:l[t]?.successResponse}}))}}catch(e){}}catch(a){let e=new Date().toLocaleString(),l=a instanceof Error?a.message:String(a),s=E(l);j(a=>({...a,[t]:{status:"unhealthy",lastCheck:e,lastSuccess:a[t]?.lastSuccess||"None",loading:!1,error:s,fullError:l}}))}}},R=async()=>{let t=y.length>0?y:a,s=t.reduce((e,t)=>(e[t]={..._[t],loading:!0,status:"checking"},e),{});j(e=>({...e,...s}));let r={},i=t.map(async t=>{if(e)try{let s=await (0,l.individualModelHealthCheckCall)(e,t);r[t]=s;let a=new Date().toLocaleString();if(s.unhealthy_count>0&&s.unhealthy_endpoints&&s.unhealthy_endpoints.length>0){let e=s.unhealthy_endpoints[0]?.error||"Health check failed",l=E(e);j(s=>({...s,[t]:{status:"unhealthy",lastCheck:a,lastSuccess:s[t]?.lastSuccess||"None",loading:!1,error:l,fullError:e}}))}else j(e=>({...e,[t]:{status:"healthy",lastCheck:a,lastSuccess:a,loading:!1,successResponse:s}}))}catch(a){console.error(`Health check failed for model id ${t}:`,a);let e=new Date().toLocaleString(),l=a instanceof Error?a.message:String(a),s=E(l);j(a=>({...a,[t]:{status:"unhealthy",lastCheck:e,lastSuccess:a[t]?.lastSuccess||"None",loading:!1,error:s,fullError:l}}))}});await Promise.allSettled(i);try{if(!e)return;let s=await (0,l.latestHealthChecksCall)(e);s.latest_health_checks&&Object.entries(s.latest_health_checks).forEach(([e,l])=>{if(t.includes(e)&&l){let t=l.error_message||void 0;j(s=>{let a=s[e];return{...s,[e]:{status:l.status||a?.status||"unknown",lastCheck:l.checked_at?new Date(l.checked_at).toLocaleString():a?.lastCheck||"None",lastSuccess:"healthy"===l.status&&l.checked_at?new Date(l.checked_at).toLocaleString():a?.lastSuccess||"None",loading:!1,error:t?E(t):a?.error,fullError:t||a?.fullError,successResponse:"healthy"===l.status?l:a?.successResponse}}})}})}catch(e){console.warn("Failed to fetch updated health statuses from database (non-critical):",e)}},B=e=>{N(e),e?b(a):b([])},z=e=>{b([]),N(!1),j({}),u?.(e)},q=()=>{C(!1),S(null)},V=()=>{P(!1),A(null)},D=(s?.data??[]).map(e=>{let t=e.model_info?.id,l=(t?_[t]:null)||{status:"none",lastCheck:"None",loading:!1};return{model_name:e.model_name,model_info:e.model_info,provider:e.provider,litellm_model_name:e.litellm_model_name,health_status:l.status,last_check:l.lastCheck,last_success:l.lastSuccess||"None",health_loading:l.loading,health_error:l.error,health_full_error:l.fullError}}),H=!!(d&&u),G=d?.total_count??0,U=d?.total_pages??1,$=d?.current_page??c,K=d?.size??m,J=H&&G>0?($-1)*K+1:0,W=H?Math.min($*K,G):0;return(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"mb-6",children:(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(eu.Title,{children:"Model Health Status"}),(0,t.jsx)(em.Text,{className:"text-gray-600 mt-1",children:"Run health checks on individual models to verify they are working correctly"})]}),(0,t.jsxs)("div",{className:"flex items-center gap-3",children:[y.length>0&&(0,t.jsx)(I.Button,{size:"sm",variant:"light",onClick:()=>B(!1),className:"px-3 py-1 text-sm",children:"Clear Selection"}),(0,t.jsx)(I.Button,{size:"sm",variant:"secondary",onClick:R,disabled:Object.values(_).some(e=>e.loading),className:"px-3 py-1 text-sm",children:y.length>0&&y.length0?`Showing ${J} - ${W} of ${G} results`:"Showing 0 results"}),(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("button",{onClick:()=>z(c-1),disabled:n||1===c,className:`px-3 py-1 text-sm border rounded-md ${n||1===c?"bg-gray-100 text-gray-400 cursor-not-allowed":"hover:bg-gray-50"}`,children:"Previous"}),(0,t.jsx)("button",{onClick:()=>z(c+1),disabled:n||c>=U,className:`px-3 py-1 text-sm border rounded-md ${n||c>=U?"bg-gray-100 text-gray-400 cursor-not-allowed":"hover:bg-gray-50"}`,children:"Next"})]})]}),(0,t.jsx)(tJ.ModelDataTable,{columns:(h=(e,t)=>{t?b(t=>[...t,e]):(b(t=>t.filter(t=>t!==e)),N(!1))},p=e=>{switch(e){case"healthy":return(0,t.jsx)(T.Badge,{color:"emerald",children:"healthy"});case"unhealthy":return(0,t.jsx)(T.Badge,{color:"red",children:"unhealthy"});case"checking":return(0,t.jsx)(T.Badge,{color:"blue",children:"checking"});case"none":return(0,t.jsx)(T.Badge,{color:"gray",children:"none"});default:return(0,t.jsx)(T.Badge,{color:"gray",children:"unknown"})}},g=(e,t,l)=>{S({modelName:e,cleanedError:t,fullError:l}),C(!0)},f=(e,t)=>{A({modelName:e,response:t}),P(!0)},[{header:()=>(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(tW.Checkbox,{checked:v,indeterminate:y.length>0&&!v,onChange:e=>B(e.target.checked),onClick:e=>e.stopPropagation()}),(0,t.jsx)("span",{children:"Model ID"})]}),accessorKey:"model_info.id",enableSorting:!0,sortingFn:"alphanumeric",cell:({row:e})=>{let l=e.original,s=l.model_info?.id??"",a=y.includes(s);return(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(tW.Checkbox,{checked:a,onChange:e=>h(s,e.target.checked),onClick:e=>e.stopPropagation()}),(0,t.jsx)(O.Tooltip,{title:l.model_info.id,children:(0,t.jsx)("div",{className:"font-mono text-blue-500 bg-blue-50 hover:bg-blue-100 text-xs font-normal px-2 py-0.5 text-left w-full truncate whitespace-nowrap cursor-pointer max-w-[15ch]",onClick:()=>i&&i(l.model_info.id),children:l.model_info.id})})]})}},{header:"Model Name",accessorKey:"model_name",enableSorting:!0,sortingFn:"alphanumeric",cell:({row:e})=>{let l=e.original,s=r(l)||l.model_name;return(0,t.jsx)("div",{className:"font-medium text-sm",children:(0,t.jsx)(O.Tooltip,{title:s,children:(0,t.jsx)("div",{className:"truncate max-w-[200px]",children:s})})})}},{header:"Team Alias",accessorKey:"model_info.team_id",enableSorting:!0,sortingFn:"alphanumeric",cell:({row:e})=>{let l=e.original,s=l.model_info?.team_id;if(!s)return(0,t.jsx)("span",{className:"text-gray-400 text-sm",children:"-"});let a=o?.find(e=>e.team_id===s),r=a?.team_alias||s;return(0,t.jsx)("div",{className:"text-sm",children:(0,t.jsx)(O.Tooltip,{title:r,children:(0,t.jsx)("div",{className:"truncate max-w-[150px]",children:r})})})}},{header:"Health Status",accessorKey:"health_status",enableSorting:!0,sortingFn:(e,t,l)=>{let s=e.getValue("health_status")||"unknown",a=t.getValue("health_status")||"unknown",r={healthy:0,checking:1,unknown:2,unhealthy:3};return(r[s]??4)-(r[a]??4)},cell:({row:e})=>{let l=e.original,s={status:l.health_status,loading:l.health_loading,error:l.health_error};if(s.loading)return(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsxs)("div",{className:"flex space-x-1",children:[(0,t.jsx)("div",{className:"w-2 h-2 bg-indigo-500 rounded-full animate-pulse"}),(0,t.jsx)("div",{className:"w-2 h-2 bg-indigo-500 rounded-full animate-pulse",style:{animationDelay:"0.2s"}}),(0,t.jsx)("div",{className:"w-2 h-2 bg-indigo-500 rounded-full animate-pulse",style:{animationDelay:"0.4s"}})]}),(0,t.jsx)(em.Text,{className:"text-gray-600 text-sm",children:"Checking..."})]});let a=l.model_info?.id??"",i=r(l)||l.model_name,o="healthy"===s.status&&_[a]?.successResponse;return(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[p(s.status),o&&f&&(0,t.jsx)(O.Tooltip,{title:"View response details",placement:"top",children:(0,t.jsx)("button",{onClick:()=>f(i,_[a]?.successResponse),className:"p-1 text-green-600 hover:text-green-800 hover:bg-green-50 rounded-sm cursor-pointer transition-colors",children:(0,t.jsx)(tQ.InformationCircleIcon,{className:"h-4 w-4"})})})]})}},{header:"Error Details",accessorKey:"health_error",enableSorting:!1,cell:({row:e})=>{let l=e.original,s=l.model_info?.id??"",a=r(l)||l.model_name,i=_[s];if(!i?.error)return(0,t.jsx)(em.Text,{className:"text-gray-400 text-sm",children:"No errors"});let o=i.error,n=i.fullError||i.error;return(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("div",{className:"max-w-[200px]",children:(0,t.jsx)(O.Tooltip,{title:o,placement:"top",children:(0,t.jsx)(em.Text,{className:"text-red-600 text-sm truncate",children:o})})}),g&&n!==o&&(0,t.jsx)(O.Tooltip,{title:"View full error details",placement:"top",children:(0,t.jsx)("button",{onClick:()=>g(a,o,n),className:"p-1 text-red-600 hover:text-red-800 hover:bg-red-50 rounded-sm cursor-pointer transition-colors",children:(0,t.jsx)(tQ.InformationCircleIcon,{className:"h-4 w-4"})})})]})}},{header:"Last Check",accessorKey:"last_check",enableSorting:!0,sortingFn:(e,t,l)=>{let s=e.getValue("last_check")||"Never checked",a=t.getValue("last_check")||"Never checked";if("Never checked"===s&&"Never checked"===a)return 0;if("Never checked"===s)return 1;if("Never checked"===a)return -1;if("Check in progress..."===s&&"Check in progress..."===a)return 0;if("Check in progress..."===s)return -1;if("Check in progress..."===a)return 1;let r=new Date(s),i=new Date(a);return isNaN(r.getTime())&&isNaN(i.getTime())?0:isNaN(r.getTime())?1:isNaN(i.getTime())?-1:i.getTime()-r.getTime()},cell:({row:e})=>{let l=e.original;return(0,t.jsx)(em.Text,{className:"text-gray-600 text-sm",children:l.health_loading?"Check in progress...":l.last_check})}},{header:"Last Success",accessorKey:"last_success",enableSorting:!0,sortingFn:(e,t,l)=>{let s=e.getValue("last_success")||"Never succeeded",a=t.getValue("last_success")||"Never succeeded";if("Never succeeded"===s&&"Never succeeded"===a)return 0;if("Never succeeded"===s)return 1;if("Never succeeded"===a)return -1;if("None"===s&&"None"===a)return 0;if("None"===s)return 1;if("None"===a)return -1;let r=new Date(s),i=new Date(a);return isNaN(r.getTime())&&isNaN(i.getTime())?0:isNaN(r.getTime())?1:isNaN(i.getTime())?-1:i.getTime()-r.getTime()},cell:({row:e})=>{let l=e.original,s=_[l.model_info?.id??""],a=s?.lastSuccess||"None";return(0,t.jsx)(em.Text,{className:"text-gray-600 text-sm",children:a})}},{header:"Actions",id:"actions",cell:({row:e})=>{let l=e.original,s=l.model_info?.id??"",a=l.health_status&&"none"!==l.health_status,r=l.health_loading?"Checking...":a?"Re-run Health Check":"Run Health Check";return(0,t.jsx)(O.Tooltip,{title:r,placement:"top",children:(0,t.jsx)("button",{"data-testid":"run-health-check-btn",className:`p-2 rounded-md transition-colors ${l.health_loading?"text-gray-400 cursor-not-allowed bg-gray-100":"text-indigo-600 hover:text-indigo-700 hover:bg-indigo-50"}`,onClick:()=>{l.health_loading||L(s)},disabled:l.health_loading,children:l.health_loading?(0,t.jsxs)("div",{className:"flex space-x-1",children:[(0,t.jsx)("div",{className:"w-1 h-1 bg-gray-400 rounded-full animate-pulse"}),(0,t.jsx)("div",{className:"w-1 h-1 bg-gray-400 rounded-full animate-pulse",style:{animationDelay:"0.2s"}}),(0,t.jsx)("div",{className:"w-1 h-1 bg-gray-400 rounded-full animate-pulse",style:{animationDelay:"0.4s"}})]}):a?(0,t.jsx)(e2.RefreshIcon,{className:"h-4 w-4"}):(0,t.jsx)(tY.PlayIcon,{className:"h-4 w-4"})})})},enableSorting:!1}]),data:D,isLoading:n})]}),(0,t.jsx)(es.Modal,{title:k?`Health Check Error - ${k.modelName}`:"Error Details",open:w,onCancel:q,footer:[(0,t.jsx)(Q.Button,{onClick:q,children:"Close"},"close")],width:800,children:k&&(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Error:"}),(0,t.jsx)("div",{className:"mt-2 p-3 bg-red-50 border border-red-200 rounded-md",children:(0,t.jsx)(em.Text,{className:"text-red-800",children:k.cleanedError})})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Full Error Details:"}),(0,t.jsx)("div",{className:"mt-2 p-3 bg-gray-50 border border-gray-200 rounded-md max-h-96 overflow-y-auto",children:(0,t.jsx)("pre",{className:"text-sm text-gray-800 whitespace-pre-wrap",children:k.fullError})})]})]})}),(0,t.jsx)(es.Modal,{title:M?`Health Check Response - ${M.modelName}`:"Response Details",open:F,onCancel:V,footer:[(0,t.jsx)(Q.Button,{onClick:V,children:"Close"},"close")],width:800,children:M&&(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Status:"}),(0,t.jsx)("div",{className:"mt-2 p-3 bg-green-50 border border-green-200 rounded-md",children:(0,t.jsx)(em.Text,{className:"text-green-800",children:"Health check passed successfully"})})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Response Details:"}),(0,t.jsx)("div",{className:"mt-2 p-3 bg-gray-50 border border-gray-200 rounded-md max-h-96 overflow-y-auto",children:(0,t.jsx)("pre",{className:"text-sm text-gray-800 whitespace-pre-wrap",children:JSON.stringify(M.response,null,2)})})]})]})})]})};var t0=e.i(250980),t1=e.i(797672),t2=e.i(871943),t4=e.i(502547);let t5=({accessToken:e,initialModelGroupAlias:s={},onAliasUpdate:a})=>{let[r,i]=(0,x.useState)([]),[o,n]=(0,x.useState)({aliasName:"",targetModelGroup:""}),[d,c]=(0,x.useState)(null),[m,u]=(0,x.useState)(!0);(0,x.useEffect)(()=>{i(Object.entries(s).map(([e,t],l)=>({id:`${l}-${e}`,aliasName:e,targetModelGroup:"string"==typeof t?t:t?.model??""})))},[s]);let h=async t=>{if(!e)return console.error("Access token is missing"),!1;try{let s={};return t.forEach(e=>{s[e.aliasName]=e.targetModelGroup}),await (0,l.setCallbacksCall)(e,{router_settings:{model_group_alias:s}}),a&&a(s),!0}catch(e){return console.error("Failed to save model group alias settings:",e),G.default.fromBackend("Failed to save model group alias settings"),!1}},p=async()=>{if(!o.aliasName||!o.targetModelGroup)return void G.default.fromBackend("Please provide both alias name and target model group");if(r.some(e=>e.aliasName===o.aliasName))return void G.default.fromBackend("An alias with this name already exists");let e=[...r,{id:`${Date.now()}-${o.aliasName}`,aliasName:o.aliasName,targetModelGroup:o.targetModelGroup}];await h(e)&&(i(e),n({aliasName:"",targetModelGroup:""}),G.default.success("Alias added successfully"))},v=async()=>{if(!d)return;if(!d.aliasName||!d.targetModelGroup)return void G.default.fromBackend("Please provide both alias name and target model group");if(r.some(e=>e.id!==d.id&&e.aliasName===d.aliasName))return void G.default.fromBackend("An alias with this name already exists");let e=r.map(e=>e.id===d.id?d:e);await h(e)&&(i(e),c(null),G.default.success("Alias updated successfully"))},N=()=>{c(null)},w=async e=>{let t=r.filter(t=>t.id!==e);await h(t)&&(i(t),G.default.success("Alias deleted successfully"))},C=r.reduce((e,t)=>(e[t.aliasName]=t.targetModelGroup,e),{});return(0,t.jsxs)(eL.Card,{className:"mb-6",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between cursor-pointer",onClick:()=>u(!m),children:[(0,t.jsxs)("div",{className:"flex flex-col",children:[(0,t.jsx)(eu.Title,{className:"mb-0",children:"Model Group Alias Settings"}),(0,t.jsx)("p",{className:"text-sm text-gray-500",children:"Create aliases for your model groups to simplify API calls. For example, you can create an alias 'gpt-4o' that points to 'gpt-4o-mini-openai' model group."})]}),(0,t.jsx)("div",{className:"flex items-center",children:m?(0,t.jsx)(t2.ChevronDownIcon,{className:"w-5 h-5 text-gray-500"}):(0,t.jsx)(t4.ChevronRightIcon,{className:"w-5 h-5 text-gray-500"})})]}),m&&(0,t.jsxs)("div",{className:"mt-4",children:[(0,t.jsxs)("div",{className:"mb-6",children:[(0,t.jsx)(em.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Add New Alias"}),(0,t.jsxs)("div",{className:"grid grid-cols-3 gap-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Alias Name"}),(0,t.jsx)("input",{type:"text",value:o.aliasName,onChange:e=>n({...o,aliasName:e.target.value}),placeholder:"e.g., gpt-4o",className:"w-full px-3 py-2 border border-gray-300 rounded-md text-sm"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"block text-xs text-gray-500 mb-1",children:"Target Model Group"}),(0,t.jsx)("input",{type:"text",value:o.targetModelGroup,onChange:e=>n({...o,targetModelGroup:e.target.value}),placeholder:"e.g., gpt-4o-mini-openai",className:"w-full px-3 py-2 border border-gray-300 rounded-md text-sm"})]}),(0,t.jsx)("div",{className:"flex items-end",children:(0,t.jsxs)("button",{onClick:p,disabled:!o.aliasName||!o.targetModelGroup,className:`flex items-center px-4 py-2 rounded-md text-sm ${!o.aliasName||!o.targetModelGroup?"bg-gray-300 text-gray-500 cursor-not-allowed":"bg-green-600 text-white hover:bg-green-700"}`,children:[(0,t.jsx)(t0.PlusCircleIcon,{className:"w-4 h-4 mr-1"}),"Add Alias"]})})]})]}),(0,t.jsx)(em.Text,{className:"text-sm font-medium text-gray-700 mb-2",children:"Manage Existing Aliases"}),(0,t.jsx)("div",{className:"rounded-lg custom-border relative mb-6",children:(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(g.Table,{className:"[&_td]:py-0.5 [&_th]:py-1",children:[(0,t.jsx)(f.TableHead,{children:(0,t.jsxs)(y.TableRow,{children:[(0,t.jsx)(_.TableHeaderCell,{className:"py-1 h-8",children:"Alias Name"}),(0,t.jsx)(_.TableHeaderCell,{className:"py-1 h-8",children:"Target Model Group"}),(0,t.jsx)(_.TableHeaderCell,{className:"py-1 h-8",children:"Actions"})]})}),(0,t.jsxs)(j.TableBody,{children:[r.map(e=>(0,t.jsx)(y.TableRow,{className:"h-8",children:d&&d.id===e.id?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(b.TableCell,{className:"py-0.5",children:(0,t.jsx)("input",{type:"text",value:d.aliasName,onChange:e=>c({...d,aliasName:e.target.value}),className:"w-full px-2 py-1 border border-gray-300 rounded-md text-sm"})}),(0,t.jsx)(b.TableCell,{className:"py-0.5",children:(0,t.jsx)("input",{type:"text",value:d.targetModelGroup,onChange:e=>c({...d,targetModelGroup:e.target.value}),className:"w-full px-2 py-1 border border-gray-300 rounded-md text-sm"})}),(0,t.jsx)(b.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:v,className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:"Save"}),(0,t.jsx)("button",{onClick:N,className:"text-xs bg-gray-50 text-gray-600 px-2 py-1 rounded-sm hover:bg-gray-100",children:"Cancel"})]})})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(b.TableCell,{className:"py-0.5 text-sm text-gray-900",children:e.aliasName}),(0,t.jsx)(b.TableCell,{className:"py-0.5 text-sm text-gray-500",children:e.targetModelGroup}),(0,t.jsx)(b.TableCell,{className:"py-0.5 whitespace-nowrap",children:(0,t.jsxs)("div",{className:"flex space-x-2",children:[(0,t.jsx)("button",{onClick:()=>{c({...e})},className:"text-xs bg-blue-50 text-blue-600 px-2 py-1 rounded-sm hover:bg-blue-100",children:(0,t.jsx)(t1.PencilIcon,{className:"w-3 h-3"})}),(0,t.jsx)("button",{onClick:()=>w(e.id),className:"text-xs bg-red-50 text-red-600 px-2 py-1 rounded-sm hover:bg-red-100",children:(0,t.jsx)(S.TrashIcon,{className:"w-3 h-3"})})]})})]})},e.id)),0===r.length&&(0,t.jsx)(y.TableRow,{children:(0,t.jsx)(b.TableCell,{colSpan:3,className:"py-0.5 text-sm text-gray-500 text-center",children:"No aliases added yet. Add a new alias above."})})]})]})})}),(0,t.jsxs)(eL.Card,{children:[(0,t.jsx)(eu.Title,{className:"mb-4",children:"Configuration Example"}),(0,t.jsx)(em.Text,{className:"text-gray-600 mb-4",children:"Here's how your current aliases would look in the config.yaml:"}),(0,t.jsx)("div",{className:"bg-gray-100 rounded-lg p-4 font-mono text-sm",children:(0,t.jsxs)("div",{className:"text-gray-700",children:["router_settings:",(0,t.jsx)("br",{}),"  model_group_alias:",0===Object.keys(C).length?(0,t.jsxs)("span",{className:"text-gray-500",children:[(0,t.jsx)("br",{}),"    # No aliases configured yet"]}):Object.entries(C).map(([e,l])=>(0,t.jsxs)("span",{children:[(0,t.jsx)("br",{}),'    "',e,'": "',l,'"']},e))]})})]})]})]})};var t6=e.i(530212);let t3=x.forwardRef(function(e,t){return x.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),x.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"}))});var t8=e.i(678784),t7=e.i(118366),t9=e.i(500330);let le=({isVisible:e,onCancel:s,onSuccess:a,modelData:r,accessToken:i,userRole:o})=>{let[n]=el.Form.useForm(),[d,c]=(0,x.useState)(!1),[m,u]=(0,x.useState)([]),[h,p]=(0,x.useState)([]),[g,f]=(0,x.useState)(!1),[_,j]=(0,x.useState)(!1),[y,b]=(0,x.useState)(null);(0,x.useEffect)(()=>{e&&r&&v()},[e,r]),(0,x.useEffect)(()=>{let t=async()=>{if(i)try{let e=await (0,l.modelAvailableCall)(i,"","",!1,null,!0,!0);u(e.data.map(e=>e.id))}catch(e){console.error("Error fetching model access groups:",e)}},s=async()=>{if(i)try{let e=await (0,tr.fetchAvailableModels)(i);p(e)}catch(e){console.error("Error fetching model info:",e)}};e&&(t(),s())},[e,i]);let v=()=>{try{let e=null;r.litellm_params?.auto_router_config&&(e="string"==typeof r.litellm_params.auto_router_config?JSON.parse(r.litellm_params.auto_router_config):r.litellm_params.auto_router_config),b(e),n.setFieldsValue({auto_router_name:r.model_name,auto_router_default_model:r.litellm_params?.auto_router_default_model||"",auto_router_embedding_model:r.litellm_params?.auto_router_embedding_model||"",model_access_group:r.model_info?.access_groups||[]});let t=new Set(h.map(e=>e.model_group));f(!t.has(r.litellm_params?.auto_router_default_model)),j(!t.has(r.litellm_params?.auto_router_embedding_model))}catch(e){console.error("Error parsing auto router config:",e),G.default.fromBackend("Error loading auto router configuration")}},N=async()=>{try{c(!0);let e=await n.validateFields(),t={...r.litellm_params,auto_router_config:JSON.stringify(y),auto_router_default_model:e.auto_router_default_model,auto_router_embedding_model:e.auto_router_embedding_model||void 0},o={...r.model_info,access_groups:e.model_access_group||[]},d={model_name:e.auto_router_name,litellm_params:t,model_info:o};await (0,l.modelPatchUpdateCall)(i,d,r.model_info.id);let m={...r,model_name:e.auto_router_name,litellm_params:t,model_info:o};G.default.success("Auto router configuration updated successfully"),a(m),s()}catch(e){console.error("Error updating auto router:",e),G.default.fromBackend("Failed to update auto router configuration")}finally{c(!1)}},w=h.map(e=>({value:e.model_group,label:e.model_group}));return(0,t.jsx)(es.Modal,{title:"Edit Auto Router Configuration",open:e,onCancel:s,footer:[(0,t.jsx)(Q.Button,{onClick:s,children:"Cancel"},"cancel"),(0,t.jsx)(Q.Button,{loading:d,onClick:N,children:"Save Changes"},"submit")],width:1e3,destroyOnHidden:!0,children:(0,t.jsxs)("div",{className:"space-y-6",children:[(0,t.jsx)(em.Text,{className:"text-gray-600",children:"Edit the auto router configuration including routing logic, default models, and access settings."}),(0,t.jsxs)(el.Form,{form:n,layout:"vertical",className:"space-y-4",children:[(0,t.jsx)(el.Form.Item,{label:"Auto Router Name",name:"auto_router_name",rules:[{required:!0,message:"Auto router name is required"}],children:(0,t.jsx)(eO.TextInput,{placeholder:"e.g., auto_router_1, smart_routing"})}),(0,t.jsx)("div",{className:"w-full",children:(0,t.jsx)(tu,{modelInfo:h,value:y,onChange:e=>{b(e)}})}),(0,t.jsx)(el.Form.Item,{label:"Default Model",name:"auto_router_default_model",rules:[{required:!0,message:"Default model is required"}],children:(0,t.jsx)(Y.Select,{placeholder:"Select a default model",onChange:e=>{f("custom"===e)},options:[...w,{value:"custom",label:"Enter custom model name"}],showSearch:!0})}),(0,t.jsx)(el.Form.Item,{label:"Embedding Model",name:"auto_router_embedding_model",children:(0,t.jsx)(Y.Select,{placeholder:"Select an embedding model (optional)",onChange:e=>{j("custom"===e)},options:[...w,{value:"custom",label:"Enter custom model name"}],showSearch:!0,allowClear:!0})}),"Admin"===o&&(0,t.jsx)(el.Form.Item,{label:"Model Access Groups",name:"model_access_group",tooltip:"Control who can access this auto router",children:(0,t.jsx)(Y.Select,{mode:"tags",showSearch:!0,placeholder:"Select existing groups or type to create new ones",optionFilterProp:"children",tokenSeparators:[","],options:m.map(e=>({value:e,label:e})),maxTagCount:"responsive",allowClear:!0})})]})]})})},{Title:lt,Link:ll}=R.Typography,ls=({isVisible:e,onCancel:l,onAddCredential:s,existingCredential:a,setIsCredentialModalOpen:r})=>{let[i]=el.Form.useForm();return(0,t.jsx)(es.Modal,{title:"Reuse Credentials",open:e,onCancel:()=>{l(),i.resetFields()},footer:null,width:600,children:(0,t.jsxs)(el.Form,{form:i,onFinish:e=>{s(e),i.resetFields(),r(!1)},layout:"vertical",children:[(0,t.jsx)(el.Form.Item,{label:"Credential Name:",name:"credential_name",rules:[{required:!0,message:"Credential name is required"}],initialValue:a?.credential_name,children:(0,t.jsx)(eO.TextInput,{placeholder:"Enter a friendly name for these credentials"})}),Object.entries(a?.credential_values||{}).map(([e,l])=>(0,t.jsx)(el.Form.Item,{label:e,name:e,initialValue:l,children:(0,t.jsx)(eO.TextInput,{placeholder:`Enter ${e}`,disabled:!0})},e)),(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsx)(O.Tooltip,{title:"Get help on our github",children:(0,t.jsx)(ll,{href:"https://github.com/BerriAI/litellm/issues",children:"Need Help?"})}),(0,t.jsxs)("div",{children:[(0,t.jsx)(Q.Button,{onClick:()=>{l(),i.resetFields()},style:{marginRight:10},children:"Cancel"}),(0,t.jsx)(Q.Button,{htmlType:"submit",children:"Reuse Credentials"})]})]})]})})},{Text:la}=R.Typography;function lr({open:e,onCancel:s,accessToken:a,modelId:r,onUpdated:i}){let[o]=el.Form.useForm(),[n,d]=(0,x.useState)(!1),c=()=>{o.resetFields(),s()},m=async e=>{let t=e.api_key?.trim();if(!t)return void G.default.fromBackend("Enter a new API key");d(!0);try{await (0,l.modelPatchUpdateCall)(a,{litellm_params:{api_key:t},model_info:{id:r}},r),G.default.success("API key updated"),o.resetFields(),i(),s()}catch(e){console.error("Error updating API key:",e),G.default.fromBackend("Failed to update API key")}finally{d(!1)}};return(0,t.jsxs)(es.Modal,{title:"Update API Key",open:e,onCancel:c,footer:null,width:520,destroyOnHidden:!0,children:[(0,t.jsx)(la,{className:"block mb-4 text-gray-500",children:"Update this model's API key. Only the new key is sent; the rest of the deployment configuration is left untouched."}),(0,t.jsx)(tw.Alert,{type:"warning",showIcon:!0,className:"mb-4",message:"Only the API key is rotated here. Models that authenticate with an Azure AD token, AWS credentials, or a Vertex service-account JSON aren't supported yet; update those from the model's LiteLLM Params for now."}),(0,t.jsxs)(el.Form,{form:o,onFinish:m,layout:"vertical",children:[(0,t.jsx)(el.Form.Item,{label:"New API Key",name:"api_key",rules:[{required:!0,message:"Enter a new API key"}],children:(0,t.jsx)(eV.Input.Password,{placeholder:"Enter the new API key",autoComplete:"new-password"})}),(0,t.jsxs)("div",{className:"flex justify-end items-center mt-4",children:[(0,t.jsx)(Q.Button,{onClick:c,style:{marginRight:10},children:"Cancel"}),(0,t.jsx)(Q.Button,{type:"primary",htmlType:"submit",loading:n,children:"Update API Key"})]})]})]})}let li=e=>"string"==typeof e&&/\*{2,}/.test(e);function lo({modelId:e,onClose:s,accessToken:a,userID:r,userRole:i,onModelUpdate:o,modelAccessGroups:c}){let m,[u]=el.Form.useForm(),h=(0,$.useQueryClient)(),[p,g]=(0,x.useState)(null),[f,_]=(0,x.useState)(!1),[j,y]=(0,x.useState)(!1),[b,v]=(0,x.useState)(!1),[N,w]=(0,x.useState)(!1),[k,T]=(0,x.useState)(!1),[F,P]=(0,x.useState)(!1),[M,A]=(0,x.useState)(!1),[E,L]=(0,x.useState)(null),[R,B]=(0,x.useState)(!1),[z,q]=(0,x.useState)({}),[V,U]=(0,x.useState)(!1),[W,X]=(0,x.useState)([]),[Z,ee]=(0,x.useState)({}),[et,ea]=(0,x.useState)([]),{data:er,isLoading:eo}=(0,d.useModelsInfo)(1,50,void 0,e),{data:en}=(0,n.useModelCostMap)(),{data:ed}=(0,d.useModelHub)(),ec=e=>null!=en&&"object"==typeof en&&e in en?en[e].litellm_provider:"openai",eh=(0,x.useMemo)(()=>er?.data&&0!==er.data.length&&ei(er,ec).data[0]||null,[er,en]),ep=("Admin"===i||eh?.model_info?.created_by===r)&&eh?.model_info?.db_model,ex="Admin"===i,eg=eh?.litellm_params?.auto_router_config!=null,ef=eh?.litellm_params?.litellm_credential_name!=null&&eh?.litellm_params?.litellm_credential_name!=void 0;(0,x.useEffect)(()=>{if(eh&&!p){let e=eh;e.litellm_model_name||(e={...e,litellm_model_name:e?.litellm_params?.litellm_model_name??e?.litellm_params?.model??e?.model_info?.key??null}),g(e),e?.litellm_params?.cache_control_injection_points&&B(!0)}},[eh,p]),(0,x.useEffect)(()=>{let t=async()=>{if(!a||eh)return;let t=(await (0,l.modelInfoV1Call)(a,e)).data[0];t&&!t.litellm_model_name&&(t={...t,litellm_model_name:t?.litellm_params?.litellm_model_name??t?.litellm_params?.model??t?.model_info?.key??null}),g(t),t?.litellm_params?.cache_control_injection_points&&B(!0)},s=async()=>{if(a)try{let e=(await (0,l.getGuardrailsList)(a)).guardrails.map(e=>e.guardrail_name);X(e)}catch(e){console.error("Failed to fetch guardrails:",e)}},r=async()=>{if(a)try{let e=await (0,l.tagListCall)(a);ee(e)}catch(e){console.error("Failed to fetch tags:",e)}},i=async()=>{if(a)try{let e=await (0,l.credentialListCall)(a);ea(e.credentials||[])}catch(e){console.error("Failed to fetch credentials:",e)}};(async()=>{if(!a||ef)return;let t=await (0,l.credentialGetCall)(a,null,e);L({credential_name:t.credential_name,credential_values:t.credential_values,credential_info:t.credential_info})})(),t(),s(),r(),i()},[a,e]);let e_=async t=>{if(!a)return;let s={credential_name:t.credential_name,model_id:e,credential_info:{custom_llm_provider:p.litellm_params?.custom_llm_provider}};G.default.info("Storing credential.."),await (0,l.credentialCreateCall)(a,s),G.default.success("Credential stored successfully")},ej=async t=>{try{let s;if(!a)return;P(!0);let r={};try{r=t.litellm_extra_params?JSON.parse(t.litellm_extra_params):{},delete r.litellm_credential_name}catch(e){G.default.fromBackend("Invalid JSON in LiteLLM Params"),P(!1);return}let i={...t.litellm_params,...r,model:t.litellm_model_name,api_base:t.api_base,custom_llm_provider:t.custom_llm_provider,organization:t.organization,tpm:t.tpm,rpm:t.rpm,max_retries:t.max_retries,timeout:t.timeout,stream_timeout:t.stream_timeout,tags:t.tags};u.isFieldTouched("input_cost")&&(void 0!==t.input_cost&&null!==t.input_cost&&""!==t.input_cost?i.input_cost_per_token=Number(t.input_cost)/1e6:i.input_cost_per_token=null),u.isFieldTouched("output_cost")&&(void 0!==t.output_cost&&null!==t.output_cost&&""!==t.output_cost?i.output_cost_per_token=Number(t.output_cost)/1e6:i.output_cost_per_token=null),(u.isFieldTouched("cache_read_cost")||u.isFieldTouched("input_cost"))&&(void 0!==t.cache_read_cost&&null!==t.cache_read_cost&&""!==t.cache_read_cost?i.cache_read_input_token_cost=Number(t.cache_read_cost)/1e6:u.isFieldTouched("cache_read_cost")?i.cache_read_input_token_cost=null:void 0!==i.input_cost_per_token&&null!==i.input_cost_per_token&&(i.cache_read_input_token_cost=i.input_cost_per_token)),u.isFieldTouched("cache_write_cost")&&(void 0!==t.cache_write_cost&&null!==t.cache_write_cost&&""!==t.cache_write_cost?i.cache_creation_input_token_cost=Number(t.cache_write_cost)/1e6:i.cache_creation_input_token_cost=null),t.litellm_credential_name?i.litellm_credential_name=t.litellm_credential_name:delete i.litellm_credential_name,t.guardrails&&(i.guardrails=t.guardrails),t.vector_store_ids?.length>0?i.vector_store_ids=t.vector_store_ids:void 0!==t.vector_store_ids?i.vector_store_ids=[]:delete i.vector_store_ids,t.cache_control&&t.cache_control_injection_points?.length>0?i.cache_control_injection_points=t.cache_control_injection_points:delete i.cache_control_injection_points;try{s=t.model_info?JSON.parse(t.model_info):eh.model_info,t.model_access_group&&(s={...s,access_groups:t.model_access_group}),void 0!==t.health_check_model&&(s={...s,health_check_model:t.health_check_model})}catch(e){G.default.fromBackend("Invalid JSON in Model Info");return}let n=Object.fromEntries(Object.entries(i).filter(([,e])=>!li(e))),d={model_name:t.model_name,litellm_params:n,model_info:s};await (0,l.modelPatchUpdateCall)(a,d,e);let c={...p,model_name:t.model_name,litellm_model_name:t.litellm_model_name,litellm_params:n,model_info:s};g(c),o&&o(c),G.default.success("Model settings updated successfully"),T(!1),A(!1)}catch(e){console.error("Error updating model:",e),G.default.fromBackend("Failed to update model settings")}finally{P(!1)}};if(eo)return(0,t.jsxs)("div",{className:"p-4",children:[(0,t.jsx)(I.Button,{icon:t6.ArrowLeftIcon,variant:"light",onClick:s,className:"mb-4",children:"Back to Models"}),(0,t.jsx)(em.Text,{children:"Loading..."})]});if(!eh)return(0,t.jsxs)("div",{className:"p-4",children:[(0,t.jsx)(I.Button,{icon:t6.ArrowLeftIcon,variant:"light",onClick:s,className:"mb-4",children:"Back to Models"}),(0,t.jsx)(em.Text,{children:"Model not found"})]});let ey=async()=>{if(a)try{G.default.info("Testing connection...");let e=await (0,l.testConnectionRequest)(a,{custom_llm_provider:p.litellm_params.custom_llm_provider,litellm_credential_name:p.litellm_params.litellm_credential_name,model:p.litellm_model_name},{id:p.model_info?.id,mode:p.model_info?.mode},p.model_info?.mode);if("success"===e.status)G.default.success("Connection test successful!");else throw Error(e?.result?.error||e?.message||"Unknown error")}catch(e){e instanceof Error?G.default.error("Error testing connection: "+(0,tL.truncateString)(e.message,100)):G.default.error("Error testing connection: "+String(e))}},eb=async()=>{try{if(y(!0),!a)return;await (0,l.modelDeleteCall)(a,e),G.default.success("Model deleted successfully"),o&&o({deleted:!0,model_info:{id:e}}),s()}catch(e){console.error("Error deleting the model:",e),G.default.fromBackend("Failed to delete model")}finally{y(!1),_(!1)}},ev=async(e,t)=>{await (0,t9.copyToClipboard)(e)&&(q(e=>({...e,[t]:!0})),setTimeout(()=>{q(e=>({...e,[t]:!1}))},2e3))},eN=eh.litellm_model_name.includes("*");return(0,t.jsxs)("div",{className:"p-4",children:[(0,t.jsxs)("div",{className:"flex justify-between items-center mb-6",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(I.Button,{icon:t6.ArrowLeftIcon,variant:"light",onClick:s,className:"mb-4",children:"Back to Models"}),(0,t.jsxs)(eu.Title,{children:["Public Model Name: ",D(eh)]}),(0,t.jsxs)("div",{className:"flex items-center cursor-pointer",children:[(0,t.jsx)(em.Text,{className:"text-gray-500 font-mono",children:eh.model_info.id}),(0,t.jsx)(Q.Button,{type:"text",size:"small",icon:z["model-id"]?(0,t.jsx)(t8.CheckIcon,{size:12}):(0,t.jsx)(t7.CopyIcon,{size:12}),onClick:()=>ev(eh.model_info.id,"model-id"),className:`left-2 z-10 transition-all duration-200 ${z["model-id"]?"text-green-600 bg-green-50 border-green-200":"text-gray-500 hover:text-gray-700 hover:bg-gray-100"}`})]})]}),(0,t.jsxs)("div",{className:"flex gap-2",children:[(0,t.jsx)(Q.Button,{icon:(0,t.jsx)(e2.RefreshIcon,{className:"h-4 w-4"}),onClick:ey,className:"flex items-center gap-2","data-testid":"test-connection-button",children:"Test Connection"}),(0,t.jsx)(Q.Button,{icon:(0,t.jsx)(t3,{className:"h-4 w-4"}),onClick:()=>w(!0),className:"flex items-center",disabled:!ep,"data-testid":"update-api-key-button",children:"Update API Key"}),(0,t.jsx)(Q.Button,{icon:(0,t.jsx)(t3,{className:"h-4 w-4"}),onClick:()=>v(!0),className:"flex items-center",disabled:!ex,"data-testid":"reuse-credentials-button",children:"Re-use Credentials"}),(0,t.jsx)(Q.Button,{danger:!0,icon:(0,t.jsx)(S.TrashIcon,{className:"h-4 w-4"}),onClick:()=>_(!0),className:"flex items-center",disabled:!ep,"data-testid":"delete-model-button",children:"Delete Model"})]})]}),(0,t.jsxs)(e6.TabGroup,{children:[(0,t.jsxs)(e3.TabList,{className:"mb-6",children:[(0,t.jsx)(e5.Tab,{children:"Overview"}),(0,t.jsx)(e5.Tab,{children:"Raw JSON"})]}),(0,t.jsxs)(e8.TabPanels,{children:[(0,t.jsxs)(J.TabPanel,{children:[(0,t.jsxs)(K.Grid,{numItems:1,numItemsSm:2,numItemsLg:3,className:"gap-6 mb-6",children:[(0,t.jsxs)(eL.Card,{children:[(0,t.jsx)(em.Text,{children:"Provider"}),(0,t.jsxs)("div",{className:"mt-2 flex items-center space-x-2",children:[eh.provider&&(0,t.jsx)("img",{src:(0,eP.getProviderLogoAndName)(eh.provider).logo,alt:`${eh.provider} logo`,className:"w-4 h-4",onError:e=>{let t=e.currentTarget,l=t.parentElement;if(l&&l.contains(t))try{let e=document.createElement("div");e.className="w-4 h-4 rounded-full bg-gray-200 flex items-center justify-center text-xs",e.textContent=eh.provider?.charAt(0)||"-",l.replaceChild(e,t)}catch(e){console.error("Failed to replace provider logo fallback:",e)}}}),(0,t.jsx)(eu.Title,{children:eh.provider||"Not Set"})]})]}),(0,t.jsxs)(eL.Card,{children:[(0,t.jsx)(em.Text,{children:"LiteLLM Model"}),(0,t.jsx)("div",{className:"mt-2 overflow-hidden",children:(0,t.jsx)(O.Tooltip,{title:eh.litellm_model_name||"Not Set",children:(0,t.jsx)("div",{className:"break-all text-sm font-medium leading-relaxed cursor-pointer",children:eh.litellm_model_name||"Not Set"})})})]}),(0,t.jsxs)(eL.Card,{children:[(0,t.jsx)(em.Text,{children:"Pricing"}),(0,t.jsxs)("div",{className:"mt-2",children:[(0,t.jsxs)(em.Text,{children:["Input: $",eh.input_cost,"/1M tokens"]}),(0,t.jsxs)(em.Text,{children:["Output: $",eh.output_cost,"/1M tokens"]})]})]})]}),(0,t.jsxs)("div",{className:"mb-6 text-sm text-gray-500 flex items-center gap-x-6",children:[(0,t.jsxs)("div",{className:"flex items-center gap-x-2",children:[(0,t.jsx)("svg",{className:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24",children:(0,t.jsx)("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:"2",d:"M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z"})}),"Created At"," ",eh.model_info.created_at?new Date(eh.model_info.created_at).toLocaleDateString("en-US",{month:"short",day:"numeric",year:"numeric"}):"Not Set"]}),(0,t.jsxs)("div",{className:"flex items-center gap-x-2",children:[(0,t.jsx)("svg",{className:"w-4 h-4",fill:"none",stroke:"currentColor",viewBox:"0 0 24 24",children:(0,t.jsx)("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:"2",d:"M16 7a4 4 0 11-8 0 4 4 0 018 0zM12 14a7 7 0 00-7 7h14a7 7 0 00-7-7z"})}),"Created By ",eh.model_info.created_by||"Not Set"]})]}),(0,t.jsxs)(eL.Card,{children:[(0,t.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,t.jsx)(eu.Title,{children:"Model Settings"}),(0,t.jsxs)("div",{className:"flex gap-2",children:[eg&&ep&&!M&&(0,t.jsx)(I.Button,{onClick:()=>U(!0),className:"flex items-center",children:"Edit Auto Router"}),ep?!M&&(0,t.jsx)(I.Button,{onClick:()=>A(!0),className:"flex items-center",children:"Edit Settings"}):(0,t.jsx)(O.Tooltip,{title:"Only DB models can be edited. You must be an admin or the creator of the model to edit it.",children:(0,t.jsx)(C.InfoCircleOutlined,{})})]})]}),p?(0,t.jsx)(el.Form,{form:u,onFinish:ej,initialValues:{model_name:p.model_name,litellm_model_name:p.litellm_model_name,api_base:p.litellm_params.api_base,custom_llm_provider:p.litellm_params.custom_llm_provider,organization:p.litellm_params.organization,tpm:p.litellm_params.tpm,rpm:p.litellm_params.rpm,max_retries:p.litellm_params.max_retries,timeout:p.litellm_params.timeout,stream_timeout:p.litellm_params.stream_timeout,input_cost:p.litellm_params.input_cost_per_token?1e6*p.litellm_params.input_cost_per_token:p.model_info?.input_cost_per_token*1e6||null,output_cost:p.litellm_params?.output_cost_per_token?1e6*p.litellm_params.output_cost_per_token:p.model_info?.output_cost_per_token*1e6||null,cache_read_cost:p.litellm_params?.cache_read_input_token_cost!==void 0&&p.litellm_params?.cache_read_input_token_cost!==null?1e6*p.litellm_params.cache_read_input_token_cost:p.model_info?.cache_read_input_token_cost!==void 0&&p.model_info?.cache_read_input_token_cost!==null?1e6*p.model_info.cache_read_input_token_cost:null,cache_write_cost:p.litellm_params?.cache_creation_input_token_cost!==void 0&&p.litellm_params?.cache_creation_input_token_cost!==null?1e6*p.litellm_params.cache_creation_input_token_cost:p.model_info?.cache_creation_input_token_cost!==void 0&&p.model_info?.cache_creation_input_token_cost!==null?1e6*p.model_info.cache_creation_input_token_cost:null,cache_control:!!p.litellm_params?.cache_control_injection_points,cache_control_injection_points:p.litellm_params?.cache_control_injection_points||[],model_access_group:Array.isArray(p.model_info?.access_groups)?p.model_info.access_groups:[],guardrails:Array.isArray(p.litellm_params?.guardrails)?p.litellm_params.guardrails:[],vector_store_ids:Array.isArray(p.litellm_params?.vector_store_ids)&&p.litellm_params.vector_store_ids.length>0?p.litellm_params.vector_store_ids:void 0,tags:Array.isArray(p.litellm_params?.tags)?p.litellm_params.tags:[],health_check_model:eN?p.model_info?.health_check_model:null,litellm_credential_name:p.litellm_params?.litellm_credential_name||"",litellm_extra_params:JSON.stringify(Object.fromEntries(Object.entries(p.litellm_params||{}).filter(([e,t])=>"litellm_credential_name"!==e&&!li(t))),null,2)},layout:"vertical",onValuesChange:()=>T(!0),children:(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Model Name"}),M?(0,t.jsx)(el.Form.Item,{name:"model_name",className:"mb-0",children:(0,t.jsx)(eO.TextInput,{placeholder:"Enter model name"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.model_name})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"LiteLLM Model Name"}),M?(0,t.jsx)(el.Form.Item,{name:"litellm_model_name",className:"mb-0",children:(0,t.jsx)(eO.TextInput,{placeholder:"Enter LiteLLM model name"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_model_name})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Input Cost (per 1M tokens)"}),M?(0,t.jsx)(el.Form.Item,{name:"input_cost",className:"mb-0",children:(0,t.jsx)(tP.default,{placeholder:"Enter input cost"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p?.litellm_params?.input_cost_per_token?(p.litellm_params?.input_cost_per_token*1e6).toFixed(4):p?.model_info?.input_cost_per_token?(1e6*p.model_info.input_cost_per_token).toFixed(4):"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Output Cost (per 1M tokens)"}),M?(0,t.jsx)(el.Form.Item,{name:"output_cost",className:"mb-0",children:(0,t.jsx)(tP.default,{placeholder:"Enter output cost"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p?.litellm_params?.output_cost_per_token?(1e6*p.litellm_params.output_cost_per_token).toFixed(4):p?.model_info?.output_cost_per_token?(1e6*p.model_info.output_cost_per_token).toFixed(4):"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Cache Read Cost (per 1M tokens)"}),M?(0,t.jsx)(el.Form.Item,{name:"cache_read_cost",className:"mb-0",tooltip:"If left blank on save, defaults to Input Cost.",children:(0,t.jsx)(tP.default,{placeholder:"Defaults to Input Cost if blank"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p?.litellm_params?.cache_read_input_token_cost!==void 0&&p?.litellm_params?.cache_read_input_token_cost!==null?(1e6*p.litellm_params.cache_read_input_token_cost).toFixed(4):p?.model_info?.cache_read_input_token_cost!==void 0&&p?.model_info?.cache_read_input_token_cost!==null?(1e6*p.model_info.cache_read_input_token_cost).toFixed(4):"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Cache Write Cost (per 1M tokens)"}),M?(0,t.jsx)(el.Form.Item,{name:"cache_write_cost",className:"mb-0",tooltip:"If left blank on save, defaults to Input Cost (backend falls back to input_cost_per_token).",children:(0,t.jsx)(tP.default,{placeholder:"Defaults to Input Cost if blank"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p?.litellm_params?.cache_creation_input_token_cost!==void 0&&p?.litellm_params?.cache_creation_input_token_cost!==null?(1e6*p.litellm_params.cache_creation_input_token_cost).toFixed(4):p?.model_info?.cache_creation_input_token_cost!==void 0&&p?.model_info?.cache_creation_input_token_cost!==null?(1e6*p.model_info.cache_creation_input_token_cost).toFixed(4):"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"API Base"}),M?(0,t.jsx)(el.Form.Item,{name:"api_base",className:"mb-0",children:(0,t.jsx)(eO.TextInput,{placeholder:"Enter API base"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.api_base||"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Custom LLM Provider"}),M?(0,t.jsx)(el.Form.Item,{name:"custom_llm_provider",className:"mb-0",children:(0,t.jsx)(eO.TextInput,{placeholder:"Enter custom LLM provider"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.custom_llm_provider||"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Organization"}),M?(0,t.jsx)(el.Form.Item,{name:"organization",className:"mb-0",children:(0,t.jsx)(eO.TextInput,{placeholder:"Enter organization"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.organization||"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"TPM (Tokens per Minute)"}),M?(0,t.jsx)(el.Form.Item,{name:"tpm",className:"mb-0",children:(0,t.jsx)(tP.default,{placeholder:"Enter TPM"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.tpm||"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"RPM (Requests per Minute)"}),M?(0,t.jsx)(el.Form.Item,{name:"rpm",className:"mb-0",children:(0,t.jsx)(tP.default,{placeholder:"Enter RPM"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.rpm||"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Max Retries"}),M?(0,t.jsx)(el.Form.Item,{name:"max_retries",className:"mb-0",children:(0,t.jsx)(tP.default,{placeholder:"Enter max retries"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.max_retries||"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Timeout (seconds)"}),M?(0,t.jsx)(el.Form.Item,{name:"timeout",className:"mb-0",children:(0,t.jsx)(tP.default,{placeholder:"Enter timeout"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.timeout||"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Stream Timeout (seconds)"}),M?(0,t.jsx)(el.Form.Item,{name:"stream_timeout",className:"mb-0",children:(0,t.jsx)(tP.default,{placeholder:"Enter stream timeout"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.stream_timeout||"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Model Access Groups"}),M?(0,t.jsx)(el.Form.Item,{name:"model_access_group",className:"mb-0",children:(0,t.jsx)(Y.Select,{mode:"tags",showSearch:!0,placeholder:"Select existing groups or type to create new ones",optionFilterProp:"children",tokenSeparators:[","],maxTagCount:"responsive",allowClear:!0,style:{width:"100%"},options:c?.map(e=>({value:e,label:e}))})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.model_info?.access_groups?Array.isArray(p.model_info.access_groups)?p.model_info.access_groups.length>0?(0,t.jsx)("div",{className:"flex flex-wrap gap-1",children:p.model_info.access_groups.map((e,l)=>(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-1 rounded-full text-xs font-medium bg-blue-100 text-blue-800",children:e},l))}):"No groups assigned":p.model_info.access_groups:"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsxs)(em.Text,{className:"font-medium",children:["Guardrails",(0,t.jsx)(O.Tooltip,{title:"Apply safety guardrails to this model to filter content or enforce policies",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(C.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),M?(0,t.jsx)(el.Form.Item,{name:"guardrails",className:"mb-0",children:(0,t.jsx)(Y.Select,{mode:"tags",showSearch:!0,placeholder:"Select existing guardrails or type to create new ones",optionFilterProp:"children",tokenSeparators:[","],maxTagCount:"responsive",allowClear:!0,style:{width:"100%"},options:W.map(e=>({value:e,label:e}))})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.guardrails?Array.isArray(p.litellm_params.guardrails)?p.litellm_params.guardrails.length>0?(0,t.jsx)("div",{className:"flex flex-wrap gap-1",children:p.litellm_params.guardrails.map((e,l)=>(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-1 rounded-full text-xs font-medium bg-green-100 text-green-800",children:e},l))}):"No guardrails assigned":p.litellm_params.guardrails:"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsxs)(em.Text,{className:"font-medium",children:["Attached Knowledge Bases (RAG)",(0,t.jsx)(O.Tooltip,{title:"Vector stores used for RAG. Every request to this model will automatically retrieve context from these knowledge bases.",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/completion/knowledgebase",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(C.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),M?(0,t.jsx)(el.Form.Item,{name:"vector_store_ids",className:"mb-0",children:(0,t.jsx)(tE.default,{onChange:()=>{},accessToken:a||"",placeholder:"Select knowledge bases (optional)"})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.vector_store_ids?Array.isArray(p.litellm_params.vector_store_ids)?p.litellm_params.vector_store_ids.length>0?(0,t.jsx)("div",{className:"flex flex-wrap gap-1",children:p.litellm_params.vector_store_ids.map((e,l)=>(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-1 rounded-full text-xs font-medium bg-blue-100 text-blue-800",children:e},l))}):"No knowledge bases attached":String(p.litellm_params.vector_store_ids):"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Tags"}),M?(0,t.jsx)(el.Form.Item,{name:"tags",className:"mb-0",children:(0,t.jsx)(Y.Select,{mode:"tags",showSearch:!0,placeholder:"Select existing tags or type to create new ones",optionFilterProp:"children",tokenSeparators:[","],maxTagCount:"responsive",allowClear:!0,style:{width:"100%"},options:Object.values(Z).map(e=>({value:e.name,label:e.name,title:e.description||e.name}))})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.tags?Array.isArray(p.litellm_params.tags)?p.litellm_params.tags.length>0?(0,t.jsx)("div",{className:"flex flex-wrap gap-1",children:p.litellm_params.tags.map((e,l)=>(0,t.jsx)("span",{className:"inline-flex items-center px-2 py-1 rounded-full text-xs font-medium bg-purple-100 text-purple-800",children:e},l))}):"No tags assigned":p.litellm_params.tags:"Not Set"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Existing Credentials"}),M?(0,t.jsx)(el.Form.Item,{name:"litellm_credential_name",className:"mb-0",children:(0,t.jsx)(Y.Select,{showSearch:!0,placeholder:"Select or search for existing credentials",optionFilterProp:"children",filterOption:(e,t)=>(t?.label??"").toLowerCase().includes(e.toLowerCase()),options:[{value:"",label:"None"},...et.map(e=>({value:e.credential_name,label:e.credential_name}))],allowClear:!0})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.litellm_credential_name||"Manual"})]}),eN&&(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Health Check Model"}),M?(0,t.jsx)(el.Form.Item,{name:"health_check_model",className:"mb-0",children:(0,t.jsx)(Y.Select,{showSearch:!0,placeholder:"Select existing health check model",optionFilterProp:"children",allowClear:!0,options:(m=eh.litellm_model_name.split("/")[0],ed?.data?.filter(e=>e.providers?.includes(m)&&e.model_group!==eh.litellm_model_name).map(e=>({value:e.model_group,label:e.model_group}))||[])})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.model_info?.health_check_model||"Not Set"})]}),M?(0,t.jsx)(tA,{form:u,showCacheControl:R,onCacheControlChange:e=>B(e)}):(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Cache Control"}),(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:p.litellm_params?.cache_control_injection_points?(0,t.jsxs)("div",{children:[(0,t.jsx)("p",{children:"Enabled"}),(0,t.jsx)("div",{className:"mt-2",children:p.litellm_params.cache_control_injection_points.map((e,l)=>(0,t.jsxs)("div",{className:"text-sm text-gray-600 mb-1",children:["Location: ",e.location,",",e.role&&(0,t.jsxs)("span",{children:[" Role: ",e.role]}),void 0!==e.index&&(0,t.jsxs)("span",{children:[" Index: ",e.index]})]},l))})]}):"Disabled"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Model Info"}),M?(0,t.jsx)(el.Form.Item,{name:"model_info",className:"mb-0",children:(0,t.jsx)(eV.Input.TextArea,{rows:4,placeholder:'{"gpt-4": 100, "claude-v1": 200}',defaultValue:JSON.stringify(eh.model_info,null,2)})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:(0,t.jsx)("pre",{className:"bg-gray-100 p-2 rounded-sm text-xs overflow-auto mt-1",children:JSON.stringify(p.model_info,null,2)})})]}),(0,t.jsxs)("div",{children:[(0,t.jsxs)(em.Text,{className:"font-medium",children:["LiteLLM Params",(0,t.jsx)(O.Tooltip,{title:"Optional litellm params used for making a litellm.completion() call. Some params are automatically added by LiteLLM.",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/completion/input",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(C.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),M?(0,t.jsx)(el.Form.Item,{name:"litellm_extra_params",rules:[{validator:tL.formItemValidateJSON}],children:(0,t.jsx)(eV.Input.TextArea,{rows:4,placeholder:'{ "rpm": 100, "timeout": 0, "stream_timeout": 0 }'})}):(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:(0,t.jsx)("pre",{className:"bg-gray-100 p-2 rounded-sm text-xs overflow-auto mt-1",children:JSON.stringify(p.litellm_params,null,2)})})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Team ID"}),(0,t.jsx)("div",{className:"mt-1 p-2 bg-gray-50 rounded-sm",children:eh.model_info.team_id||"Not Set"})]})]}),M&&(0,t.jsxs)("div",{className:"mt-6 flex justify-end gap-2",children:[(0,t.jsx)(I.Button,{variant:"secondary",onClick:()=>{u.resetFields(),T(!1),A(!1)},disabled:F,children:"Cancel"}),(0,t.jsx)(I.Button,{variant:"primary",onClick:()=>u.submit(),loading:F,children:"Save Changes"})]})]})}):(0,t.jsx)(em.Text,{children:"Loading..."})]})]}),(0,t.jsx)(J.TabPanel,{children:(0,t.jsx)(eL.Card,{children:(0,t.jsx)("pre",{className:"bg-gray-100 p-4 rounded-sm text-xs overflow-auto",children:JSON.stringify(eh,null,2)})})})]})]}),(0,t.jsx)(H.default,{isOpen:f,title:"Delete Model",alertMessage:"This action cannot be undone.",message:"Are you sure you want to delete this model?",resourceInformationTitle:"Model Information",resourceInformation:[{label:"Model Name",value:eh?.model_name||"Not Set"},{label:"LiteLLM Model Name",value:eh?.litellm_model_name||"Not Set"},{label:"Provider",value:eh?.provider||"Not Set"},{label:"Created By",value:eh?.model_info?.created_by||"Not Set"}],onCancel:()=>_(!1),onOk:eb,confirmLoading:j}),b&&!ef?(0,t.jsx)(ls,{isVisible:b,onCancel:()=>v(!1),onAddCredential:e_,existingCredential:E,setIsCredentialModalOpen:v}):(0,t.jsx)(es.Modal,{open:b,onCancel:()=>v(!1),title:"Using Existing Credential",children:(0,t.jsx)(em.Text,{children:eh.litellm_params.litellm_credential_name})}),N&&a&&(0,t.jsx)(lr,{open:N,onCancel:()=>w(!1),accessToken:a,modelId:e,onUpdated:()=>{h.invalidateQueries({queryKey:["models","list"]})}}),(0,t.jsx)(le,{isVisible:V,onCancel:()=>U(!1),onSuccess:e=>{g(e),o&&o(e)},modelData:p||eh,accessToken:a||"",userRole:i||""})]})}var ln=e.i(37091),ld=e.i(218129);let lc=({value:e={},onChange:l})=>{let[s,a]=(0,x.useState)(Object.entries(e)),r=(e,t,r)=>{let i=[...s];i[e]=[t,r],a(i),l?.(Object.fromEntries(i))};return(0,t.jsxs)("div",{children:[s.map(([e,i],o)=>(0,t.jsxs)(E.Space,{style:{display:"flex",marginBottom:8},align:"center",children:[(0,t.jsx)(eO.TextInput,{placeholder:"Header Name",value:e,onChange:e=>r(o,e.target.value,i)}),(0,t.jsx)(eO.TextInput,{placeholder:"Header Value",value:i,onChange:t=>r(o,e,t.target.value)}),(0,t.jsx)("div",{style:{display:"flex",alignItems:"center",justifyContent:"center",height:"100%"},children:(0,t.jsx)(tF.MinusCircleOutlined,{onClick:()=>{let e;a(e=s.filter((e,t)=>t!==o)),l?.(Object.fromEntries(e))},style:{cursor:"pointer"}})})]},o)),(0,t.jsx)(Q.Button,{type:"dashed",onClick:()=>{a([...s,["",""]])},icon:(0,t.jsx)(to.PlusOutlined,{}),children:"Add Header"})]})},lm=({value:e={},onChange:l})=>{let[s,a]=(0,x.useState)(Object.entries(e)),r=(e,t,r)=>{let i=[...s];i[e]=[t,r],a(i),l?.(Object.fromEntries(i))};return(0,t.jsxs)("div",{children:[s.map(([e,i],o)=>(0,t.jsxs)(E.Space,{style:{display:"flex",marginBottom:8},align:"center",children:[(0,t.jsx)(eO.TextInput,{placeholder:"Parameter Name (e.g., version)",value:e,onChange:e=>r(o,e.target.value,i)}),(0,t.jsx)(eO.TextInput,{placeholder:"Parameter Value (e.g., v1)",value:i,onChange:t=>r(o,e,t.target.value)}),(0,t.jsx)("div",{style:{display:"flex",alignItems:"center",justifyContent:"center",height:"100%"},children:(0,t.jsx)(tF.MinusCircleOutlined,{onClick:()=>{let e;a(e=s.filter((e,t)=>t!==o)),l?.(Object.fromEntries(e))},style:{cursor:"pointer"}})})]},o)),(0,t.jsx)(Q.Button,{type:"dashed",onClick:()=>{a([...s,["",""]])},icon:(0,t.jsx)(to.PlusOutlined,{}),children:"Add Query Parameter"})]})};var lu=e.i(240647);let{Title:lh,Text:lp}=R.Typography,lx=({pathValue:e,targetValue:s,includeSubpath:a})=>{let r=(0,l.getProxyBaseUrl)();return e&&s?(0,t.jsxs)(e_.Card,{className:"p-5",children:[(0,t.jsx)(lh,{level:5,className:"text-lg font-semibold text-gray-900 mb-2",children:"Route Preview"}),(0,t.jsx)(lp,{type:"secondary",className:"text-gray-600 mb-5",style:{display:"block"},children:"How your requests will be routed"}),(0,t.jsxs)("div",{className:"space-y-5",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"text-base font-semibold text-gray-900 mb-3",children:"Basic routing:"}),(0,t.jsxs)("div",{className:"flex items-center gap-4",children:[(0,t.jsxs)("div",{className:"flex-1 bg-gray-50 border border-gray-200 rounded-lg p-3",children:[(0,t.jsx)("div",{className:"text-sm text-gray-600 mb-2",children:"Your endpoint"}),(0,t.jsx)("code",{className:"font-mono text-sm text-gray-900",children:e?`${r}${e}`:""})]}),(0,t.jsx)("div",{className:"text-gray-400",children:(0,t.jsx)(lu.RightOutlined,{className:"text-lg"})}),(0,t.jsxs)("div",{className:"flex-1 bg-gray-50 border border-gray-200 rounded-lg p-3",children:[(0,t.jsx)("div",{className:"text-sm text-gray-600 mb-2",children:"Forwards to"}),(0,t.jsx)("code",{className:"font-mono text-sm text-gray-900",children:s})]})]})]}),a&&(0,t.jsx)(t.Fragment,{children:(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"text-base font-semibold text-gray-900 mb-3",children:"With subpaths:"}),(0,t.jsxs)("div",{className:"flex items-center gap-4",children:[(0,t.jsxs)("div",{className:"flex-1 bg-gray-50 border border-gray-200 rounded-lg p-3",children:[(0,t.jsx)("div",{className:"text-sm text-gray-600 mb-2",children:"Your endpoint + subpath"}),(0,t.jsxs)("code",{className:"font-mono text-sm text-gray-900",children:[e&&`${r}${e}`,(0,t.jsx)("span",{className:"text-blue-600",children:"/v1/text-to-image/base/model"})]})]}),(0,t.jsx)("div",{className:"text-gray-400",children:(0,t.jsx)(lu.RightOutlined,{className:"text-lg"})}),(0,t.jsxs)("div",{className:"flex-1 bg-gray-50 border border-gray-200 rounded-lg p-3",children:[(0,t.jsx)("div",{className:"text-sm text-gray-600 mb-2",children:"Forwards to"}),(0,t.jsxs)("code",{className:"font-mono text-sm text-gray-900",children:[s,(0,t.jsx)("span",{className:"text-blue-600",children:"/v1/text-to-image/base/model"})]})]})]}),(0,t.jsxs)("div",{className:"mt-3 text-sm text-gray-600",children:["Any path after ",e," will be appended to the target URL"]})]})}),!a&&(0,t.jsx)("div",{className:"mt-4 p-3 bg-blue-50 rounded-md border border-blue-200",children:(0,t.jsxs)("div",{className:"flex items-start",children:[(0,t.jsx)(C.InfoCircleOutlined,{className:"text-blue-500 mt-0.5 mr-2 shrink-0"}),(0,t.jsxs)("div",{className:"text-sm text-blue-700",children:[(0,t.jsx)("span",{className:"font-medium",children:"Not seeing the routing you wanted?"})," Try enabling - Include Subpaths - above - this allows subroutes like"," ",(0,t.jsx)("code",{className:"bg-blue-100 px-1 py-0.5 rounded-sm font-mono text-xs",children:"/api/v1/models"})," to be forwarded automatically."]})]})})]})]}):null},lg=({premiumUser:e,authEnabled:l,onAuthChange:s})=>(0,t.jsxs)(eL.Card,{className:"p-6",children:[(0,t.jsx)(eu.Title,{className:"text-lg font-semibold text-gray-900 mb-2",children:"Security"}),(0,t.jsx)(ln.Subtitle,{className:"text-gray-600 mb-4",children:"When enabled, requests to this endpoint will require a valid LiteLLM Virtual Key"}),e?(0,t.jsx)(el.Form.Item,{name:"auth",valuePropName:"checked",className:"mb-0",children:(0,t.jsx)(L.Switch,{checked:l,onChange:e=>{s(e)}})}):(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{className:"flex items-center mb-3",children:[(0,t.jsx)(L.Switch,{disabled:!0,checked:!1,style:{outline:"2px solid #d1d5db",outlineOffset:"2px"}}),(0,t.jsx)("span",{className:"ml-2 text-sm text-gray-400",children:"Authentication (Premium)"})]}),(0,t.jsx)("div",{className:"p-3 bg-yellow-50 border border-yellow-200 rounded-lg",children:(0,t.jsxs)(em.Text,{className:"text-sm text-yellow-800",children:["Setting authentication for pass-through endpoints is a LiteLLM Enterprise feature. Get a trial key"," ",(0,t.jsx)("a",{href:"https://www.litellm.ai/#pricing",target:"_blank",rel:"noopener noreferrer",className:"underline",children:"here"}),"."]})})]})]});var lf=e.i(891547);let l_=({accessToken:e,value:l={},onChange:s,disabled:a=!1})=>{let[r,i]=(0,x.useState)(Object.keys(l)),[o,n]=(0,x.useState)(l);(0,x.useEffect)(()=>{n(l),i(Object.keys(l))},[l]);let d=(e,t,l)=>{let a=o[e]||{},r={...o,[e]:{...a,[t]:l.length>0?l:void 0}};r[e]?.request_fields||r[e]?.response_fields||(r[e]=null),n(r),s&&s(r)};return(0,t.jsxs)(eL.Card,{className:"p-6",children:[(0,t.jsx)(eu.Title,{className:"text-lg font-semibold text-gray-900 mb-2",children:"Guardrails"}),(0,t.jsx)(ln.Subtitle,{className:"text-gray-600 mb-6",children:"Configure guardrails to enforce policies on requests and responses. Guardrails are opt-in for passthrough endpoints."}),(0,t.jsx)(tw.Alert,{message:(0,t.jsxs)("span",{children:["Field-Level Targeting"," ",(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/pass_through_guardrails#field-level-targeting",target:"_blank",rel:"noopener noreferrer",className:"text-blue-600 hover:text-blue-800 underline",children:"(Learn More)"})]}),description:(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsx)("div",{children:"Optionally specify which fields to check. If left empty, the entire request/response is sent to the guardrail."}),(0,t.jsxs)("div",{className:"text-xs space-y-1 mt-2",children:[(0,t.jsx)("div",{className:"font-medium",children:"Common Examples:"}),(0,t.jsxs)("div",{children:["• ",(0,t.jsx)("code",{className:"bg-gray-100 px-1 rounded-sm",children:"query"})," - Single field"]}),(0,t.jsxs)("div",{children:["• ",(0,t.jsx)("code",{className:"bg-gray-100 px-1 rounded-sm",children:"documents[*].text"})," - All text in documents array"]}),(0,t.jsxs)("div",{children:["• ",(0,t.jsx)("code",{className:"bg-gray-100 px-1 rounded-sm",children:"messages[*].content"})," - All message contents"]})]})]}),type:"info",showIcon:!0,className:"mb-4"}),(0,t.jsx)(el.Form.Item,{label:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700 flex items-center",children:["Select Guardrails",(0,t.jsx)(O.Tooltip,{title:"Choose which guardrails should run on this endpoint. Org/team/key level guardrails will also be included.",children:(0,t.jsx)(C.InfoCircleOutlined,{className:"ml-2 text-blue-400 hover:text-blue-600 cursor-help"})})]}),children:(0,t.jsx)(lf.default,{accessToken:e,value:r,onChange:e=>{i(e);let t={};e.forEach(e=>{t[e]=o[e]||null}),n(t),s&&s(t)},disabled:a})}),r.length>0&&(0,t.jsxs)("div",{className:"mt-6 space-y-4",children:[(0,t.jsxs)("div",{className:"flex items-center justify-between mb-3",children:[(0,t.jsx)("div",{className:"text-sm font-medium text-gray-700",children:"Field Targeting (Optional)"}),(0,t.jsx)("div",{className:"text-xs text-gray-500",children:"💡 Tip: Leave empty to check entire payload"})]}),r.map(e=>(0,t.jsxs)(eL.Card,{className:"p-4 bg-gray-50",children:[(0,t.jsx)("div",{className:"text-sm font-medium text-gray-900 mb-3",children:e}),(0,t.jsxs)("div",{className:"space-y-3",children:[(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{className:"flex items-center justify-between mb-1",children:[(0,t.jsxs)("label",{className:"text-xs text-gray-600 flex items-center",children:["Request Fields (pre_call)",(0,t.jsx)(O.Tooltip,{title:(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"font-medium mb-1",children:"Specify which request fields to check"}),(0,t.jsxs)("div",{className:"text-xs space-y-1",children:[(0,t.jsx)("div",{children:"Examples:"}),(0,t.jsx)("div",{children:"• query"}),(0,t.jsx)("div",{children:"• documents[*].text"}),(0,t.jsx)("div",{children:"• messages[*].content"})]})]}),children:(0,t.jsx)(C.InfoCircleOutlined,{className:"ml-1 text-gray-400"})})]}),(0,t.jsxs)("div",{className:"flex gap-1",children:[(0,t.jsx)("button",{type:"button",onClick:()=>{let t=o[e]?.request_fields||[];d(e,"request_fields",[...t,"query"])},className:"text-xs px-2 py-1 bg-white border border-gray-300 rounded-sm hover:bg-gray-50",disabled:a,children:"+ query"}),(0,t.jsx)("button",{type:"button",onClick:()=>{let t=o[e]?.request_fields||[];d(e,"request_fields",[...t,"documents[*]"])},className:"text-xs px-2 py-1 bg-white border border-gray-300 rounded-sm hover:bg-gray-50",disabled:a,children:"+ documents[*]"})]})]}),(0,t.jsx)(Y.Select,{mode:"tags",style:{width:"100%"},placeholder:"Type field name or use + buttons above (e.g., query, documents[*].text)",value:o[e]?.request_fields||[],onChange:t=>d(e,"request_fields",t),disabled:a,tokenSeparators:[","]})]}),(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{className:"flex items-center justify-between mb-1",children:[(0,t.jsxs)("label",{className:"text-xs text-gray-600 flex items-center",children:["Response Fields (post_call)",(0,t.jsx)(O.Tooltip,{title:(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"font-medium mb-1",children:"Specify which response fields to check"}),(0,t.jsxs)("div",{className:"text-xs space-y-1",children:[(0,t.jsx)("div",{children:"Examples:"}),(0,t.jsx)("div",{children:"• results[*].text"}),(0,t.jsx)("div",{children:"• choices[*].message.content"})]})]}),children:(0,t.jsx)(C.InfoCircleOutlined,{className:"ml-1 text-gray-400"})})]}),(0,t.jsx)("div",{className:"flex gap-1",children:(0,t.jsx)("button",{type:"button",onClick:()=>{let t=o[e]?.response_fields||[];d(e,"response_fields",[...t,"results[*]"])},className:"text-xs px-2 py-1 bg-white border border-gray-300 rounded-sm hover:bg-gray-50",disabled:a,children:"+ results[*]"})})]}),(0,t.jsx)(Y.Select,{mode:"tags",style:{width:"100%"},placeholder:"Type field name or use + buttons above (e.g., results[*].text)",value:o[e]?.response_fields||[],onChange:t=>d(e,"response_fields",t),disabled:a,tokenSeparators:[","]})]})]})]},e))]})]})},{Option:lj}=Y.Select,ly=["GET","POST","PUT","DELETE","PATCH"],lb=({accessToken:e,setPassThroughItems:s,passThroughItems:a,premiumUser:r=!1})=>{let[i]=el.Form.useForm(),[o,n]=(0,x.useState)(!1),[d,c]=(0,x.useState)(!1),[m,u]=(0,x.useState)(""),[h,p]=(0,x.useState)(""),[g,f]=(0,x.useState)(""),[_,j]=(0,x.useState)(!0),[y,b]=(0,x.useState)(!1),[v,N]=(0,x.useState)([]),[w,k]=(0,x.useState)({}),S=()=>{i.resetFields(),p(""),f(""),j(!0),N([]),k({}),n(!1)},T=async t=>{c(!0);try{!r&&"auth"in t&&delete t.auth,w&&Object.keys(w).length>0&&(t.guardrails=w),v&&v.length>0&&(t.methods=v);let o=(await (0,l.createPassThroughEndpoint)(e,t)).endpoints[0],d=[...a,o];s(d),G.default.success("Pass-through endpoint created successfully"),i.resetFields(),p(""),f(""),j(!0),N([]),k({}),n(!1)}catch(e){G.default.fromBackend("Error creating pass-through endpoint: "+e)}finally{c(!1)}};return(0,t.jsxs)("div",{children:[(0,t.jsx)(I.Button,{className:"mx-auto mb-4 mt-4",onClick:()=>n(!0),children:"+ Add Pass-Through Endpoint"}),(0,t.jsx)(es.Modal,{title:(0,t.jsxs)("div",{className:"flex items-center space-x-3 pb-4 border-b border-gray-100",children:[(0,t.jsx)(ld.ApiOutlined,{className:"text-xl text-blue-500"}),(0,t.jsx)("h2",{className:"text-xl font-semibold text-gray-900",children:"Add Pass-Through Endpoint"})]}),open:o,width:1e3,onCancel:S,footer:null,className:"top-8",styles:{body:{padding:"24px"},header:{padding:"24px 24px 0 24px",border:"none"}},children:(0,t.jsxs)("div",{className:"mt-6",children:[(0,t.jsx)(tw.Alert,{message:"What is a Pass-Through Endpoint?",description:"Route requests from your LiteLLM proxy to any external API. Perfect for custom models, image generation APIs, or any service you want to proxy through LiteLLM.",type:"info",showIcon:!0,className:"mb-6"}),(0,t.jsxs)(el.Form,{form:i,onFinish:T,layout:"vertical",className:"space-y-6",initialValues:{include_subpath:!0,path:h,target:g},children:[(0,t.jsxs)(eL.Card,{className:"p-5",children:[(0,t.jsx)(eu.Title,{className:"text-lg font-semibold text-gray-900 mb-2",children:"Route Configuration"}),(0,t.jsx)(ln.Subtitle,{className:"text-gray-600 mb-5",children:"Configure how requests to your domain will be forwarded to the target API"}),(0,t.jsxs)("div",{className:"space-y-5",children:[(0,t.jsx)(el.Form.Item,{label:(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Path Prefix"}),name:"path",rules:[{required:!0,message:"Path is required",pattern:/^\//}],extra:(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-1",children:"Example: /bria, /adobe-photoshop, /elasticsearch"}),className:"mb-4",children:(0,t.jsx)("div",{className:"flex items-center",children:(0,t.jsx)(eO.TextInput,{placeholder:"bria",value:h,onChange:e=>{var t;let l;return l=t=e.target.value,void(t&&!t.startsWith("/")&&(l="/"+t),p(l),i.setFieldsValue({path:l}))},className:"flex-1"})})}),(0,t.jsx)(el.Form.Item,{label:(0,t.jsx)("span",{className:"text-sm font-medium text-gray-700",children:"Target URL"}),name:"target",rules:[{required:!0,message:"Target URL is required"},{type:"url",message:"Please enter a valid URL"}],extra:(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-1",children:"Example:https://engine.prod.bria-api.com"}),className:"mb-4",children:(0,t.jsx)(eO.TextInput,{placeholder:"https://engine.prod.bria-api.com",value:g,onChange:e=>{f(e.target.value),i.setFieldsValue({target:e.target.value})}})}),(0,t.jsx)(el.Form.Item,{label:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700 flex items-center",children:["HTTP Methods (Optional)",(0,t.jsx)(O.Tooltip,{title:"Select specific HTTP methods. Leave empty to support all methods (GET, POST, PUT, DELETE, PATCH). Useful when the same path needs different targets for different methods.",children:(0,t.jsx)(C.InfoCircleOutlined,{className:"ml-2 text-blue-400 hover:text-blue-600 cursor-help"})})]}),name:"methods",extra:(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-1",children:0===v.length?"All HTTP methods supported (default)":`Only ${v.join(", ")} requests will be routed to this endpoint`}),className:"mb-4",children:(0,t.jsx)(Y.Select,{mode:"multiple",placeholder:"Select methods (leave empty for all)",value:v,onChange:N,allowClear:!0,style:{width:"100%"},children:ly.map(e=>(0,t.jsx)(lj,{value:e,children:e},e))})}),(0,t.jsxs)("div",{className:"flex items-center justify-between py-3",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("div",{className:"text-sm font-medium text-gray-700",children:"Include Subpaths"}),(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-0.5",children:"Forward all subpaths to the target API (recommended for REST APIs)"})]}),(0,t.jsx)(el.Form.Item,{name:"include_subpath",valuePropName:"checked",className:"mb-0",children:(0,t.jsx)(tN.Switch,{checked:_,onChange:j})})]})]})]}),(0,t.jsx)(lx,{pathValue:h,targetValue:g,includeSubpath:_}),(0,t.jsxs)(eL.Card,{className:"p-6",children:[(0,t.jsx)(eu.Title,{className:"text-lg font-semibold text-gray-900 mb-2",children:"Headers"}),(0,t.jsx)(ln.Subtitle,{className:"text-gray-600 mb-6",children:"Add headers that will be sent with every request to the target API"}),(0,t.jsx)(el.Form.Item,{label:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700 flex items-center",children:["Authentication Headers",(0,t.jsx)(O.Tooltip,{title:"Authentication and other headers to forward with requests",children:(0,t.jsx)(C.InfoCircleOutlined,{className:"ml-2 text-blue-400 hover:text-blue-600 cursor-help"})})]}),name:"headers",rules:[{required:!0,message:"Please configure the headers"}],extra:(0,t.jsxs)("div",{className:"text-xs text-gray-500 mt-2",children:[(0,t.jsx)("div",{className:"font-medium mb-1",children:"Add authentication tokens and other required headers"}),(0,t.jsx)("div",{children:"Common examples: auth_token, Authorization, x-api-key"})]}),children:(0,t.jsx)(lc,{})})]}),(0,t.jsxs)(eL.Card,{className:"p-6",children:[(0,t.jsx)(eu.Title,{className:"text-lg font-semibold text-gray-900 mb-2",children:"Default Query Parameters"}),(0,t.jsx)(ln.Subtitle,{className:"text-gray-600 mb-6",children:"Add query parameters that will be automatically sent with every request to the target API"}),(0,t.jsx)(el.Form.Item,{label:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700 flex items-center",children:["Default Query Parameters (Optional)",(0,t.jsx)(O.Tooltip,{title:"Query parameters that will be added to all requests. Clients can override these by providing their own values.",children:(0,t.jsx)(C.InfoCircleOutlined,{className:"ml-2 text-blue-400 hover:text-blue-600 cursor-help"})})]}),name:"default_query_params",extra:(0,t.jsxs)("div",{className:"text-xs text-gray-500 mt-2",children:[(0,t.jsx)("div",{className:"font-medium mb-1",children:"Parameters are sent with all GET, POST, PUT, PATCH requests"}),(0,t.jsx)("div",{children:"Client parameters override defaults. Examples: version=v1, format=json, key=default"})]}),children:(0,t.jsx)(lm,{})})]}),(0,t.jsx)(lg,{premiumUser:r,authEnabled:y,onAuthChange:e=>{b(e),i.setFieldsValue({auth:e})}}),(0,t.jsx)(l_,{accessToken:e,value:w,onChange:k}),(0,t.jsxs)(eL.Card,{className:"p-6",children:[(0,t.jsx)(eu.Title,{className:"text-lg font-semibold text-gray-900 mb-2",children:"Performance"}),(0,t.jsx)(ln.Subtitle,{className:"text-gray-600 mb-6",children:"Configure upstream request timeout for this endpoint"}),(0,t.jsx)(el.Form.Item,{label:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700 flex items-center",children:["Request Timeout (seconds)",(0,t.jsx)(O.Tooltip,{title:"Max time to wait for the upstream API to respond. Leave empty to use general_settings.pass_through_request_timeout (default 600s).",children:(0,t.jsx)(C.InfoCircleOutlined,{className:"ml-2 text-gray-400 hover:text-gray-600"})})]}),name:"timeout",extra:(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-2",children:"Use a higher value for slow upstream APIs (e.g. 1200 for long-running LLM calls)"}),children:(0,t.jsx)(tP.default,{min:1,step:1,precision:0,placeholder:"600",size:"large"})})]}),(0,t.jsxs)(eL.Card,{className:"p-6",children:[(0,t.jsx)(eu.Title,{className:"text-lg font-semibold text-gray-900 mb-2",children:"Billing"}),(0,t.jsx)(ln.Subtitle,{className:"text-gray-600 mb-6",children:"Optional cost tracking for this endpoint"}),(0,t.jsx)(el.Form.Item,{label:(0,t.jsxs)("span",{className:"text-sm font-medium text-gray-700 flex items-center",children:["Cost Per Request (USD)",(0,t.jsx)(O.Tooltip,{title:"Optional: Track costs for requests to this endpoint",children:(0,t.jsx)(C.InfoCircleOutlined,{className:"ml-2 text-gray-400 hover:text-gray-600"})})]}),name:"cost_per_request",extra:(0,t.jsx)("div",{className:"text-xs text-gray-500 mt-2",children:"The cost charged for each request through this endpoint"}),children:(0,t.jsx)(tP.default,{min:0,step:.001,precision:4,placeholder:"2.0000",size:"large"})})]}),(0,t.jsxs)("div",{className:"flex items-center justify-end space-x-3 pt-6 border-t border-gray-100",children:[(0,t.jsx)(I.Button,{variant:"secondary",onClick:S,children:"Cancel"}),(0,t.jsx)(I.Button,{variant:"primary",loading:d,onClick:()=>{i.submit()},children:d?"Creating...":"Add Pass-Through Endpoint"})]})]})]})})]})};var lv=e.i(286536),lN=e.i(77705);let lw=["GET","POST","PUT","DELETE","PATCH"],{Option:lC}=Y.Select,lk=({value:e})=>{let[l,s]=(0,x.useState)(!1),a=JSON.stringify(e,null,2);return(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("pre",{className:"font-mono text-xs bg-gray-50 p-2 rounded-sm max-w-md overflow-auto",children:l?a:"••••••••"}),(0,t.jsx)("button",{onClick:()=>s(!l),className:"p-1 hover:bg-gray-100 rounded-sm",type:"button",children:l?(0,t.jsx)(lN.EyeOff,{className:"w-4 h-4 text-gray-500"}):(0,t.jsx)(lv.Eye,{className:"w-4 h-4 text-gray-500"})})]})},lS=({endpointData:e,onClose:s,accessToken:a,isAdmin:r,premiumUser:i=!1,onEndpointUpdated:o})=>{let[n,d]=(0,x.useState)(e),[c,m]=(0,x.useState)(!1),[u,h]=(0,x.useState)(!1),[p,g]=(0,x.useState)(e?.auth||!1),[f,_]=(0,x.useState)(e?.methods||[]),[j,y]=(0,x.useState)(e?.guardrails||{}),[b]=el.Form.useForm(),v=async e=>{try{if(!a||!n?.id)return;let t={};if(e.headers)try{t="string"==typeof e.headers?JSON.parse(e.headers):e.headers}catch(e){G.default.fromBackend("Invalid JSON format for headers");return}let s={path:n.path,target:e.target,headers:t,include_subpath:e.include_subpath,cost_per_request:e.cost_per_request,timeout:e.timeout,auth:i?e.auth:void 0,methods:f&&f.length>0?f:void 0,guardrails:j&&Object.keys(j).length>0?j:void 0};await (0,l.updatePassThroughEndpoint)(a,n.id,s),d({...n,...s}),h(!1),o&&o()}catch(e){console.error("Error updating endpoint:",e),G.default.fromBackend("Failed to update pass through endpoint")}},N=async()=>{try{if(!a||!n?.id)return;await (0,l.deletePassThroughEndpointsCall)(a,n.id),G.default.success("Pass through endpoint deleted successfully"),s(),o&&o()}catch(e){console.error("Error deleting endpoint:",e),G.default.fromBackend("Failed to delete pass through endpoint")}};return c?(0,t.jsx)("div",{className:"p-4",children:"Loading..."}):n?(0,t.jsxs)("div",{className:"p-4",children:[(0,t.jsx)("div",{className:"flex justify-between items-center mb-6",children:(0,t.jsxs)("div",{children:[(0,t.jsx)(Q.Button,{onClick:s,className:"mb-4",children:"← Back"}),(0,t.jsxs)(eu.Title,{children:["Pass Through Endpoint: ",n.path]}),(0,t.jsx)(em.Text,{className:"text-gray-500 font-mono",children:n.id})]})}),(0,t.jsxs)(e6.TabGroup,{children:[(0,t.jsxs)(e3.TabList,{className:"mb-4",children:[(0,t.jsx)(e5.Tab,{children:"Overview"},"overview"),r?(0,t.jsx)(e5.Tab,{children:"Settings"},"settings"):(0,t.jsx)(t.Fragment,{})]}),(0,t.jsxs)(e8.TabPanels,{children:[(0,t.jsxs)(J.TabPanel,{children:[(0,t.jsxs)(K.Grid,{numItems:1,numItemsSm:2,numItemsLg:3,className:"gap-6",children:[(0,t.jsxs)(eL.Card,{children:[(0,t.jsx)(em.Text,{children:"Path"}),(0,t.jsx)("div",{className:"mt-2",children:(0,t.jsx)(eu.Title,{className:"font-mono",children:n.path})})]}),(0,t.jsxs)(eL.Card,{children:[(0,t.jsx)(em.Text,{children:"Target"}),(0,t.jsx)("div",{className:"mt-2",children:(0,t.jsx)(eu.Title,{children:n.target})})]}),(0,t.jsxs)(eL.Card,{children:[(0,t.jsx)(em.Text,{children:"Configuration"}),(0,t.jsxs)("div",{className:"mt-2 space-y-2",children:[(0,t.jsx)("div",{children:(0,t.jsx)(T.Badge,{color:n.include_subpath?"green":"gray",children:n.include_subpath?"Include Subpath":"Exact Path"})}),(0,t.jsx)("div",{children:(0,t.jsx)(T.Badge,{color:n.auth?"blue":"gray",children:n.auth?"Auth Required":"No Auth"})}),n.methods&&n.methods.length>0&&(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"text-xs text-gray-500",children:"HTTP Methods:"}),(0,t.jsx)("div",{className:"flex flex-wrap gap-1 mt-1",children:n.methods.map(e=>(0,t.jsx)(T.Badge,{color:"indigo",size:"sm",children:e},e))})]}),(!n.methods||0===n.methods.length)&&(0,t.jsx)("div",{children:(0,t.jsx)(em.Text,{className:"text-xs text-gray-500",children:"All HTTP methods supported"})}),void 0!==n.cost_per_request&&(0,t.jsx)("div",{children:(0,t.jsxs)(em.Text,{children:["Cost per request: $",n.cost_per_request]})})]})]})]}),(0,t.jsx)("div",{className:"mt-6",children:(0,t.jsx)(lx,{pathValue:n.path,targetValue:n.target,includeSubpath:n.include_subpath||!1})}),n.headers&&Object.keys(n.headers).length>0&&(0,t.jsxs)(eL.Card,{className:"mt-6",children:[(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Headers"}),(0,t.jsxs)(T.Badge,{color:"blue",children:[Object.keys(n.headers).length," headers configured"]})]}),(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(lk,{value:n.headers})})]}),n.guardrails&&Object.keys(n.guardrails).length>0&&(0,t.jsxs)(eL.Card,{className:"mt-6",children:[(0,t.jsxs)("div",{className:"flex justify-between items-center",children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Guardrails"}),(0,t.jsxs)(T.Badge,{color:"purple",children:[Object.keys(n.guardrails).length," guardrails configured"]})]}),(0,t.jsx)("div",{className:"mt-4 space-y-2",children:Object.entries(n.guardrails).map(([e,l])=>(0,t.jsxs)("div",{className:"p-3 bg-gray-50 rounded-sm",children:[(0,t.jsx)("div",{className:"font-medium text-sm",children:e}),l&&(l.request_fields||l.response_fields)&&(0,t.jsxs)("div",{className:"mt-2 text-xs text-gray-600 space-y-1",children:[l.request_fields&&(0,t.jsxs)("div",{children:["Request fields: ",l.request_fields.join(", ")]}),l.response_fields&&(0,t.jsxs)("div",{children:["Response fields: ",l.response_fields.join(", ")]})]}),!l&&(0,t.jsx)("div",{className:"text-xs text-gray-600 mt-1",children:"Uses entire payload"})]},e))})]})]}),r&&(0,t.jsx)(J.TabPanel,{children:(0,t.jsxs)(eL.Card,{children:[(0,t.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,t.jsx)(eu.Title,{children:"Pass Through Endpoint Settings"}),(0,t.jsx)("div",{className:"space-x-2",children:!u&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(I.Button,{onClick:()=>h(!0),children:"Edit Settings"}),(0,t.jsx)(I.Button,{onClick:N,variant:"secondary",color:"red",children:"Delete Endpoint"})]})})]}),u?(0,t.jsxs)(el.Form,{form:b,onFinish:v,initialValues:{target:n.target,headers:n.headers?JSON.stringify(n.headers,null,2):"",include_subpath:n.include_subpath||!1,cost_per_request:n.cost_per_request,timeout:n.timeout,auth:n.auth||!1,methods:n.methods||[]},layout:"vertical",children:[(0,t.jsx)(el.Form.Item,{label:"Target URL",name:"target",rules:[{required:!0,message:"Please input a target URL"}],children:(0,t.jsx)(eO.TextInput,{placeholder:"https://api.example.com"})}),(0,t.jsx)(el.Form.Item,{label:"Headers (JSON)",name:"headers",children:(0,t.jsx)(eV.Input.TextArea,{rows:5,placeholder:'{"Authorization": "Bearer your-token", "Content-Type": "application/json"}'})}),(0,t.jsx)(el.Form.Item,{label:"HTTP Methods (Optional)",name:"methods",extra:0===f.length?"All HTTP methods supported (default)":`Only ${f.join(", ")} requests will be routed to this endpoint`,children:(0,t.jsx)(Y.Select,{mode:"multiple",placeholder:"Select methods (leave empty for all)",value:f,onChange:_,allowClear:!0,style:{width:"100%"},children:lw.map(e=>(0,t.jsx)(lC,{value:e,children:e},e))})}),(0,t.jsx)(el.Form.Item,{label:"Include Subpath",name:"include_subpath",valuePropName:"checked",children:(0,t.jsx)(L.Switch,{})}),(0,t.jsx)(el.Form.Item,{label:"Cost per Request",name:"cost_per_request",children:(0,t.jsx)(eh.InputNumber,{min:0,step:.01,precision:2,placeholder:"0.00",addonBefore:"$"})}),(0,t.jsx)(el.Form.Item,{label:"Request Timeout (seconds)",name:"timeout",extra:"Max time to wait for upstream response. Leave empty to use the global pass_through_request_timeout (default 600s).",children:(0,t.jsx)(eh.InputNumber,{min:1,step:1,precision:0,placeholder:"600",style:{width:"100%"}})}),(0,t.jsx)(lg,{premiumUser:i,authEnabled:p,onAuthChange:e=>{g(e),b.setFieldsValue({auth:e})}}),(0,t.jsx)("div",{className:"mt-4",children:(0,t.jsx)(l_,{accessToken:a||"",value:j,onChange:y})}),(0,t.jsxs)("div",{className:"flex justify-end gap-2 mt-6",children:[(0,t.jsx)(Q.Button,{onClick:()=>h(!1),children:"Cancel"}),(0,t.jsx)(I.Button,{children:"Save Changes"})]})]}):(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Path"}),(0,t.jsx)("div",{className:"font-mono",children:n.path})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Target URL"}),(0,t.jsx)("div",{children:n.target})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Include Subpath"}),(0,t.jsx)(T.Badge,{color:n.include_subpath?"green":"gray",children:n.include_subpath?"Yes":"No"})]}),void 0!==n.cost_per_request&&(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Cost per Request"}),(0,t.jsxs)("div",{children:["$",n.cost_per_request]})]}),void 0!==n.timeout&&null!==n.timeout&&(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Request Timeout"}),(0,t.jsxs)("div",{children:[n.timeout,"s"]})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Authentication Required"}),(0,t.jsx)(T.Badge,{color:n.auth?"green":"gray",children:n.auth?"Yes":"No"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(em.Text,{className:"font-medium",children:"Headers"}),n.headers&&Object.keys(n.headers).length>0?(0,t.jsx)("div",{className:"mt-2",children:(0,t.jsx)(lk,{value:n.headers})}):(0,t.jsx)("div",{className:"text-gray-500",children:"No headers configured"})]})]})]})})]})]})]}):(0,t.jsx)("div",{className:"p-4",children:"Pass through endpoint not found"})};var lT=e.i(149121);let lI=({value:e})=>{let[l,s]=(0,x.useState)(!1),a=JSON.stringify(e);return(0,t.jsxs)("div",{className:"flex items-center space-x-2",children:[(0,t.jsx)("span",{className:"font-mono text-xs",children:l?a:"••••••••"}),(0,t.jsx)("button",{onClick:()=>s(!l),className:"p-1 hover:bg-gray-100 rounded-sm",type:"button",children:l?(0,t.jsx)(lN.EyeOff,{className:"w-4 h-4 text-gray-500"}):(0,t.jsx)(lv.Eye,{className:"w-4 h-4 text-gray-500"})})]})},lF=({accessToken:e,userRole:s,userID:a,modelData:r,premiumUser:i})=>{let[o,n]=(0,x.useState)([]),[d,c]=(0,x.useState)(null),[m,u]=(0,x.useState)(!1),[h,p]=(0,x.useState)(null);(0,x.useEffect)(()=>{e&&s&&a&&(0,l.getPassThroughEndpointsCall)(e).then(e=>{n(e.endpoints)})},[e,s,a]);let g=async e=>{p(e),u(!0)},f=async()=>{if(null!=h&&e){try{await (0,l.deletePassThroughEndpointsCall)(e,h);let t=o.filter(e=>e.id!==h);n(t),G.default.success("Endpoint deleted successfully.")}catch(e){console.error("Error deleting the endpoint:",e),G.default.fromBackend("Error deleting the endpoint: "+e)}u(!1),p(null)}},_=[{header:"ID",accessorKey:"id",cell:e=>(0,t.jsx)(O.Tooltip,{title:e.row.original.id,children:(0,t.jsx)("div",{className:"font-mono text-blue-500 bg-blue-50 hover:bg-blue-100 text-xs font-normal px-2 py-0.5 text-left w-full truncate whitespace-nowrap cursor-pointer max-w-[15ch]",onClick:()=>e.row.original.id&&c(e.row.original.id),children:e.row.original.id})})},{header:"Path",accessorKey:"path"},{header:"Target",accessorKey:"target",cell:e=>(0,t.jsx)(em.Text,{children:e.getValue()})},{header:()=>(0,t.jsxs)("div",{className:"flex items-center gap-1",children:[(0,t.jsx)("span",{children:"Methods"}),(0,t.jsx)(O.Tooltip,{title:"HTTP methods supported by this endpoint",children:(0,t.jsx)(tQ.InformationCircleIcon,{className:"w-4 h-4 text-gray-400 cursor-help"})})]}),accessorKey:"methods",cell:e=>{let l=e.getValue();return l&&0!==l.length?(0,t.jsx)("div",{className:"flex flex-wrap gap-1",children:l.map(e=>(0,t.jsx)(W.Badge,{color:"indigo",className:"text-xs",children:e},e))}):(0,t.jsx)(W.Badge,{color:"blue",children:"ALL"})}},{header:()=>(0,t.jsxs)("div",{className:"flex items-center gap-1",children:[(0,t.jsx)("span",{children:"Authentication"}),(0,t.jsx)(O.Tooltip,{title:"LiteLLM Virtual Key required to call endpoint",children:(0,t.jsx)(tQ.InformationCircleIcon,{className:"w-4 h-4 text-gray-400 cursor-help"})})]}),accessorKey:"auth",cell:e=>(0,t.jsx)(W.Badge,{color:e.getValue()?"green":"gray",children:e.getValue()?"Yes":"No"})},{header:"Headers",accessorKey:"headers",cell:e=>(0,t.jsx)(lI,{value:e.getValue()||{}})},{header:"Actions",id:"actions",cell:({row:e})=>(0,t.jsxs)("div",{className:"flex space-x-1",children:[(0,t.jsx)(F.Icon,{icon:eE.PencilAltIcon,size:"sm",onClick:()=>e.original.id&&c(e.original.id),title:"Edit"}),(0,t.jsx)(F.Icon,{icon:S.TrashIcon,size:"sm",onClick:()=>{var t;return t=e.original.id,e.index,void g(t)},title:"Delete"})]})}];if(!e)return null;if(d){let a=o.find(e=>e.id===d);return a?(0,t.jsx)(lS,{endpointData:a,onClose:()=>c(null),accessToken:e,isAdmin:"Admin"===s||"admin"===s,premiumUser:i,onEndpointUpdated:()=>{e&&(0,l.getPassThroughEndpointsCall)(e).then(e=>{n(e.endpoints)})}}):(0,t.jsx)("div",{children:"Endpoint not found"})}return(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(eu.Title,{children:"Pass Through Endpoints"}),(0,t.jsx)(em.Text,{className:"text-tremor-content",children:"Configure and manage your pass-through endpoints"})]}),(0,t.jsx)(lb,{accessToken:e,setPassThroughItems:n,passThroughItems:o,premiumUser:i}),(0,t.jsx)(lT.DataTable,{data:o,columns:_,renderSubComponent:()=>(0,t.jsx)("div",{}),getRowCanExpand:()=>!1,isLoading:!1,noDataMessage:"No pass-through endpoints configured"}),m&&(0,t.jsx)("div",{className:"fixed z-10 inset-0 overflow-y-auto",children:(0,t.jsxs)("div",{className:"flex items-end justify-center min-h-screen pt-4 px-4 pb-20 text-center sm:block sm:p-0",children:[(0,t.jsx)("div",{className:"fixed inset-0 transition-opacity","aria-hidden":"true",children:(0,t.jsx)("div",{className:"absolute inset-0 bg-gray-500 opacity-75"})}),(0,t.jsx)("span",{className:"hidden sm:inline-block sm:align-middle sm:h-screen","aria-hidden":"true",children:"​"}),(0,t.jsxs)("div",{className:"inline-block align-bottom bg-white rounded-lg text-left overflow-hidden shadow-xl transform transition-all sm:my-8 sm:align-middle sm:max-w-lg sm:w-full",children:[(0,t.jsx)("div",{className:"bg-white px-4 pt-5 pb-4 sm:p-6 sm:pb-4",children:(0,t.jsx)("div",{className:"sm:flex sm:items-start",children:(0,t.jsxs)("div",{className:"mt-3 text-center sm:mt-0 sm:ml-4 sm:text-left",children:[(0,t.jsx)("h3",{className:"text-lg leading-6 font-medium text-gray-900",children:"Delete Pass-Through Endpoint"}),(0,t.jsx)("div",{className:"mt-2",children:(0,t.jsx)("p",{className:"text-sm text-gray-500",children:"Are you sure you want to delete this pass-through endpoint? This action cannot be undone."})})]})})}),(0,t.jsxs)("div",{className:"bg-gray-50 px-4 py-3 sm:px-6 sm:flex sm:flex-row-reverse",children:[(0,t.jsx)(I.Button,{onClick:f,color:"red",className:"ml-2",children:"Delete"}),(0,t.jsx)(I.Button,{onClick:()=>{u(!1),p(null)},children:"Cancel"})]})]})]})})]})};var lP=e.i(56567);let lM=({premiumUser:e,teams:s})=>{let a,i,{accessToken:u,token:h,userRole:p,userId:g}=(0,r.default)(),[f]=el.Form.useForm(),[_,j]=(0,x.useState)(""),[y,b]=(0,x.useState)([]),[v,N]=(0,x.useState)(eP.Providers.Anthropic),[w,C]=(0,x.useState)(null),[k,S]=(0,x.useState)("global"),[T,I]=(0,x.useState)(null),[P,M]=(0,x.useState)(null),[A,E]=(0,x.useState)(0),[L,O]=(0,x.useState)({}),[R,B]=(0,x.useState)(!1),[z,q]=(0,x.useState)(null),[V,H]=(0,x.useState)(null),[U,W]=(0,x.useState)(0),[Q,Y]=(0,x.useState)(1),[X,Z]=(0,x.useState)(()=>"true"!==localStorage.getItem("hideMissingProviderBanner")),ee=(0,$.useQueryClient)(),{data:et,isLoading:es,refetch:ea}=(0,d.useModelsInfo)(),{data:er,isLoading:eo}=(0,d.useModelsInfo)(Q,50),{data:ed,isLoading:ec}=(0,n.useModelCostMap)(),{data:em,isLoading:eu}=o(),eh=em?.credentials||[],{data:ep,isLoading:eg}=(0,c.useUISettings)(),ef=(0,m.useMutation)({mutationFn:async e=>{if(!u)throw Error("Access token is required");return(0,l.setCallbacksCall)(u,{router_settings:e})}}),e_=(0,x.useMemo)(()=>{if(!et?.data)return[];let e=new Set;for(let t of et.data)e.add(t.model_name);return Array.from(e).sort()},[et?.data]),ej=(0,x.useMemo)(()=>{if(!et?.data)return[];let e=new Set;for(let t of et.data){let l=t.model_info;if(l?.access_groups)for(let t of l.access_groups)e.add(t)}return Array.from(e)},[et?.data]),ey=(0,x.useMemo)(()=>et?.data?et.data.map(e=>e.model_name):[],[et?.data]),eb=(0,x.useMemo)(()=>er?.data?er.data.map(e=>e.model_info?.id).filter(e=>!!e):[],[er?.data]),ev=e=>null!=ed&&"object"==typeof ed&&e in ed?ed[e].litellm_provider:"openai",eN=(0,x.useMemo)(()=>et?.data?ei(et,ev):{data:[]},[et?.data,ev]),ew=(0,x.useMemo)(()=>er?.data?ei(er,ev):{data:[]},[er?.data,ev]),eC=(0,x.useMemo)(()=>({total_count:er?.total_count??0,current_page:er?.current_page??Q,total_pages:er?.total_pages??1,size:er?.size??50}),[er,Q]),ek=p&&(0,e0.isProxyAdminRole)(p),eS=p&&e0.internalUserRoles.includes(p),eT=g&&(0,e0.isUserTeamAdminForAnyTeam)(s,g),eI=eS&&ep?.values?.disable_model_add_for_internal_users===!0,eM={name:"file",accept:".json",pastable:!1,beforeUpload:e=>{if("application/json"===e.type){let t=new FileReader;t.onload=e=>{if(e.target){let t=e.target.result;f.setFieldsValue({vertex_credentials:t})}},t.readAsText(e)}return!1},onChange(e){"done"===e.file.status?G.default.success(`${e.file.name} file uploaded successfully`):"error"===e.file.status&&G.default.fromBackend(`${e.file.name} file upload failed.`)}},eE=()=>{j(new Date().toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})),Y(1),ee.invalidateQueries({queryKey:["models","list"]}),ea()},eL=(0,x.useCallback)(async()=>{if(!u||!g||!p)return null;try{return(await (0,l.getCallbacksCall)(u,g,p)).router_settings}catch(e){return console.error("Error fetching model data:",e),null}},[u,g,p]),eO=(0,x.useCallback)(e=>{I(e.model_group_retry_policy??null),M(e.retry_policy??null),E(e.num_retries??2),O(e.model_group_alias||{})},[]),eR=(0,x.useCallback)(async()=>{let e=await eL();e&&eO(e)},[eL,eO]);(0,x.useEffect)(()=>{if(!u||!h||!p||!g||!et)return;let e=!0;return(async()=>{let t=await eL();e&&t&&eO(t)})(),()=>{e=!1}},[u,h,p,g,et,eL,eO]);let eB=async()=>{try{let e=await f.validateFields();await eA(e,u,f,eE)}catch(t){let e=t.errorFields?.map(e=>`${e.name.join(".")}: ${e.errors.join(", ")}`).join(" | ")||"Unknown validation error";G.default.fromBackend(`Please fill in the following required fields: ${e}`)}};return(Object.keys(eP.Providers).find(e=>eP.Providers[e]===v),V)?(0,t.jsx)("div",{className:"w-full h-full",children:(0,t.jsx)(lP.default,{teamId:V,onClose:()=>H(null),accessToken:u,is_team_admin:"Admin"===p,is_proxy_admin:"Proxy Admin"===p,userModels:ey,editTeam:!1,onUpdate:eE,premiumUser:e})}):(0,t.jsx)("div",{className:"w-full mx-4 h-[75vh]",children:(0,t.jsx)(K.Grid,{numItems:1,className:"gap-2 p-8 w-full mt-2",children:(0,t.jsxs)(e4.Col,{numColSpan:1,className:"flex flex-col gap-2",children:[(0,t.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)("h2",{className:"text-lg font-semibold",children:"Model Management"}),e0.all_admin_roles.includes(p)?(0,t.jsx)("p",{className:"text-sm text-gray-600",children:"Add and manage models for the proxy"}):(0,t.jsx)("p",{className:"text-sm text-gray-600",children:"Add models for teams you are an admin for."})]}),!X&&(0,t.jsxs)("a",{href:"https://models.litellm.ai/?request=true",target:"_blank",rel:"noopener noreferrer",className:"inline-flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium text-[#6366f1] hover:text-[#5558e3] border border-[#6366f1] hover:border-[#5558e3] rounded-lg transition-colors",children:[(0,t.jsx)(e7.PlusCircleOutlined,{style:{fontSize:"12px"}}),"Request Provider"]})]}),X&&(0,t.jsxs)("div",{className:"mb-4 px-4 py-3 bg-blue-50 rounded-lg border border-blue-100 flex items-center gap-4",children:[(0,t.jsx)("div",{className:"shrink-0 w-10 h-10 bg-white rounded-full flex items-center justify-center border border-blue-200",children:(0,t.jsx)(e7.PlusCircleOutlined,{style:{fontSize:"18px",color:"#6366f1"}})}),(0,t.jsxs)("div",{className:"flex-1 min-w-0",children:[(0,t.jsx)("h4",{className:"text-gray-900 font-semibold text-sm m-0",children:"Missing a provider?"}),(0,t.jsx)("p",{className:"text-gray-500 text-xs m-0 mt-0.5",children:"The LiteLLM engineering team is constantly adding support for new LLM models, providers, endpoints. If you don't see the one you need, let us know and we'll prioritize it."})]}),(0,t.jsxs)("a",{href:"https://models.litellm.ai/?request=true",target:"_blank",rel:"noopener noreferrer",className:"shrink-0 inline-flex items-center gap-2 px-4 py-2 bg-[#6366f1] hover:bg-[#5558e3] text-white text-sm font-medium rounded-lg transition-colors",children:["Request Provider",(0,t.jsx)("svg",{xmlns:"http://www.w3.org/2000/svg",className:"h-4 w-4",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",strokeWidth:2,children:(0,t.jsx)("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"})})]}),(0,t.jsx)("button",{onClick:()=>{Z(!1),localStorage.setItem("hideMissingProviderBanner","true")},className:"shrink-0 p-1 text-gray-400 hover:text-gray-600 hover:bg-gray-100 rounded-full transition-colors","aria-label":"Dismiss banner",children:(0,t.jsx)("svg",{xmlns:"http://www.w3.org/2000/svg",className:"h-5 w-5",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",strokeWidth:2,children:(0,t.jsx)("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M6 18L18 6M6 6l12 12"})})})]}),z&&!(es||ec||eu||eg)?(0,t.jsx)(lo,{modelId:z,onClose:()=>{q(null)},accessToken:u,userID:g,userRole:p,onModelUpdate:e=>{ee.invalidateQueries({queryKey:["models","list"]}),eE()},modelAccessGroups:ej}):(a=e0.all_admin_roles.includes(p),i=[{tab:(0,t.jsx)(e5.Tab,{children:a?"All Models":"Your Models"},"all-models"),panel:(0,t.jsx)(en,{selectedModelGroup:w,setSelectedModelGroup:C,availableModelGroups:e_,availableModelAccessGroups:ej,setSelectedModelId:q,setSelectedTeamId:H},"all-models")}],(ek||!eI&&eT)&&i.push({tab:(0,t.jsx)(e5.Tab,{children:"Add Model"},"add-model"),panel:(0,t.jsx)(J.TabPanel,{className:"h-full",children:(0,t.jsx)(tK,{form:f,handleOk:eB,selectedProvider:v,setSelectedProvider:N,providerModels:y,setProviderModelsFn:e=>{b((0,eP.getProviderModels)(e,ed))},getPlaceholder:eP.getPlaceholder,uploadProps:eM,showAdvancedSettings:R,setShowAdvancedSettings:B,teams:s,credentials:eh,accessToken:u,userRole:p})},"add-model")}),a&&i.push({tab:(0,t.jsx)(e5.Tab,{children:"LLM Credentials"},"llm-credentials"),panel:(0,t.jsx)(J.TabPanel,{children:(0,t.jsx)(e1,{uploadProps:eM})},"llm-credentials")},{tab:(0,t.jsx)(e5.Tab,{children:"Pass-Through Endpoints"},"pass-through"),panel:(0,t.jsx)(J.TabPanel,{children:(0,t.jsx)(lF,{accessToken:u,userRole:p,userID:g,modelData:eN,premiumUser:e})},"pass-through")},{tab:(0,t.jsx)(e5.Tab,{children:"Health Status"},"health-status"),panel:(0,t.jsx)(J.TabPanel,{children:(0,t.jsx)(tZ,{accessToken:u,modelData:ew,all_models_on_proxy:eb,getDisplayModelName:D,setSelectedModelId:q,teams:s,isLoading:eo,paginationMeta:eC,currentPage:Q,pageSize:50,onPageChange:Y})},"health-status")},{tab:(0,t.jsx)(e5.Tab,{children:"Model Retry Settings"},"model-retry-settings"),panel:(0,t.jsx)(ex,{selectedModelGroup:k,setSelectedModelGroup:S,availableModelGroups:e_,globalRetryPolicy:P,setGlobalRetryPolicy:M,defaultRetry:A,modelGroupRetryPolicy:T,setModelGroupRetryPolicy:I,handleSaveRetrySettings:()=>{ef.mutate({retry_policy:P,model_group_retry_policy:T},{onSuccess:()=>{G.default.success("Retry settings saved successfully"),eR()},onError:()=>{G.default.fromBackend("Failed to save retry settings")}})},isSaving:ef.isPending},"model-retry-settings")},{tab:(0,t.jsx)(e5.Tab,{children:"Model Group Alias"},"model-group-alias"),panel:(0,t.jsx)(J.TabPanel,{children:(0,t.jsx)(t5,{accessToken:u,initialModelGroupAlias:L,onAliasUpdate:O})},"model-group-alias")},{tab:(0,t.jsx)(e5.Tab,{children:"Price Data Reload"},"price-data-reload"),panel:(0,t.jsx)(eF,{},"price-data-reload")}),(0,t.jsxs)(e6.TabGroup,{index:U,onIndexChange:W,className:"gap-2 h-[75vh] w-full ",children:[(0,t.jsxs)(e3.TabList,{className:"flex justify-between mt-2 w-full items-center",children:[(0,t.jsx)("div",{className:"flex",children:i.map(e=>e.tab)}),(0,t.jsxs)("div",{className:"flex items-center space-x-2 self-center",children:[_&&(0,t.jsxs)("span",{className:"text-xs text-gray-500",children:["Last Refreshed: ",_]}),(0,t.jsx)(F.Icon,{icon:e2.RefreshIcon,variant:"shadow",size:"xs",className:"cursor-pointer",onClick:eE})]})]}),(0,t.jsx)(e8.TabPanels,{children:i.map(e=>e.panel)})]}))]})})})};e.s(["default",0,function(){let{premiumUser:e}=(0,r.default)(),{data:l}=(0,u.useTeams)();return(0,t.jsx)(lM,{premiumUser:e,teams:l??null})}],664307)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/039aof7m9ej57.js b/litellm/proxy/_experimental/out/_next/static/chunks/039aof7m9ej57.js deleted file mode 100644 index 364718dd62e..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/039aof7m9ej57.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,166406,e=>{"use strict";var t=e.i(190144);e.s(["CopyOutlined",()=>t.default])},447566,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M872 474H286.9l350.2-304c5.6-4.9 2.2-14-5.2-14h-88.5c-3.9 0-7.6 1.4-10.5 3.9L155 487.8a31.96 31.96 0 000 48.3L535.1 866c1.5 1.3 3.3 2 5.2 2h91.5c7.4 0 10.8-9.2 5.2-14L286.9 550H872c4.4 0 8-3.6 8-8v-60c0-4.4-3.6-8-8-8z"}}]},name:"arrow-left",theme:"outlined"};var s=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(s.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["ArrowLeftOutlined",0,o],447566)},871943,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 9l-7 7-7-7"}))});e.s(["ChevronDownIcon",0,r],871943)},360820,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M5 15l7-7 7 7"}))});e.s(["ChevronUpIcon",0,r],360820)},269200,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("Table"),o=r.default.forwardRef((e,o)=>{let{children:l,className:n}=e,i=(0,t.__rest)(e,["children","className"]);return r.default.createElement("div",{className:(0,a.tremorTwMerge)(s("root"),"overflow-auto",n)},r.default.createElement("table",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("table"),"w-full text-tremor-default","text-tremor-content","dark:text-dark-tremor-content")},i),l))});o.displayName="Table",e.s(["Table",0,o],269200)},427612,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("TableHead"),o=r.default.forwardRef((e,o)=>{let{children:l,className:n}=e,i=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("thead",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("root"),"text-left","text-tremor-content","dark:text-dark-tremor-content",n)},i),l))});o.displayName="TableHead",e.s(["TableHead",0,o],427612)},496020,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("TableRow"),o=r.default.forwardRef((e,o)=>{let{children:l,className:n}=e,i=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("tr",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("row"),n)},i),l))});o.displayName="TableRow",e.s(["TableRow",0,o],496020)},64848,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("TableHeaderCell"),o=r.default.forwardRef((e,o)=>{let{children:l,className:n}=e,i=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("th",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("root"),"whitespace-nowrap text-left font-semibold top-0 px-4 py-3.5","text-tremor-content-strong","dark:text-dark-tremor-content-strong",n)},i),l))});o.displayName="TableHeaderCell",e.s(["TableHeaderCell",0,o],64848)},942232,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("TableBody"),o=r.default.forwardRef((e,o)=>{let{children:l,className:n}=e,i=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("tbody",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("root"),"align-top divide-y","divide-tremor-border","dark:divide-dark-tremor-border",n)},i),l))});o.displayName="TableBody",e.s(["TableBody",0,o],942232)},977572,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(444755);let s=(0,e.i(673706).makeClassName)("TableCell"),o=r.default.forwardRef((e,o)=>{let{children:l,className:n}=e,i=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("td",Object.assign({ref:o,className:(0,a.tremorTwMerge)(s("root"),"align-middle whitespace-nowrap text-left p-4",n)},i),l))});o.displayName="TableCell",e.s(["TableCell",0,o],977572)},68155,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"}))});e.s(["TrashIcon",0,r],68155)},278587,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"}))});e.s(["RefreshIcon",0,r],278587)},502547,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M9 5l7 7-7 7"}))});e.s(["ChevronRightIcon",0,r],502547)},263147,e=>{"use strict";var t=e.i(266027),r=e.i(243652),a=e.i(602869),s=e.i(431703),o=e.i(708347),l=e.i(135214);let n=(0,r.createQueryKeys)("accessGroups"),i=async e=>{let t=(0,a.getProxyBaseUrl)(),r=`${t}/v1/access_group`,o=await fetch(r,{method:"GET",headers:{[(0,a.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(!o.ok){let e=await o.json(),t=(0,s.deriveErrorMessage)(e);throw(0,a.handleError)(t),Error(t)}return o.json()};e.s(["accessGroupKeys",0,n,"useAccessGroups",0,()=>{let{accessToken:e,userRole:r}=(0,l.default)();return(0,t.useQuery)({queryKey:n.list({}),queryFn:async()=>i(e),enabled:!!e&&o.all_admin_roles.includes(r||"")})}])},304911,e=>{"use strict";var t=e.i(843476),r=e.i(262218);let{Text:a}=e.i(898586).Typography;e.s(["default",0,function({userId:e}){return"default_user_id"===e?(0,t.jsx)(r.Tag,{color:"blue",children:"Default Proxy Admin"}):(0,t.jsx)(a,{children:e})}])},384767,e=>{"use strict";var t=e.i(843476),r=e.i(599724),a=e.i(271645),s=e.i(389083);let o=a.forwardRef(function(e,t){return a.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),a.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M4 7v10c0 2.21 3.582 4 8 4s8-1.79 8-4V7M4 7c0 2.21 3.582 4 8 4s8-1.79 8-4M4 7c0-2.21 3.582-4 8-4s8 1.79 8 4m0 5c0 2.21-3.582 4-8 4s-8-1.79-8-4"}))});var l=e.i(602869);let n=function({vectorStores:e,accessToken:n}){let[i,c]=(0,a.useState)([]);return(0,a.useEffect)(()=>{(async()=>{if(n&&0!==e.length)try{let e=await (0,l.vectorStoreListCall)(n);e.data&&c(e.data.map(e=>({vector_store_id:e.vector_store_id,vector_store_name:e.vector_store_name})))}catch(e){console.error("Error fetching vector stores:",e)}})()},[n,e.length]),(0,t.jsxs)("div",{className:"space-y-3",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(o,{className:"h-4 w-4 text-blue-600"}),(0,t.jsx)(r.Text,{className:"font-semibold text-gray-900",children:"Vector Stores"}),(0,t.jsx)(s.Badge,{color:"blue",size:"xs",children:e.length})]}),e.length>0?(0,t.jsx)("div",{className:"flex flex-wrap gap-2",children:e.map((e,r)=>{let a;return(0,t.jsx)("div",{className:"inline-flex items-center px-3 py-1.5 rounded-lg bg-blue-50 border border-blue-200 text-blue-800 text-sm font-medium",children:(a=i.find(t=>t.vector_store_id===e))?`${a.vector_store_name||a.vector_store_id} (${a.vector_store_id})`:e},r)})}):(0,t.jsxs)("div",{className:"flex items-center gap-2 px-3 py-2 rounded-lg bg-gray-50 border border-gray-200",children:[(0,t.jsx)(o,{className:"h-4 w-4 text-gray-400"}),(0,t.jsx)(r.Text,{className:"text-gray-500 text-sm",children:"No vector stores configured"})]})]})},i=a.forwardRef(function(e,t){return a.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),a.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M5 12h14M5 12a2 2 0 01-2-2V6a2 2 0 012-2h14a2 2 0 012 2v4a2 2 0 01-2 2M5 12a2 2 0 00-2 2v4a2 2 0 002 2h14a2 2 0 002-2v-4a2 2 0 00-2-2m-2-4h.01M17 16h.01"}))});var c=e.i(871943),d=e.i(502547),m=e.i(592968),u=e.i(234713);let g=function({mcpServers:e,mcpAccessGroups:o=[],mcpToolPermissions:n={},mcpToolsets:g=[],accessToken:h}){let[f,p]=(0,a.useState)([]),[x,v]=(0,a.useState)([]),[b,w]=(0,a.useState)(new Set),[N,y]=(0,a.useState)(new Set);(0,a.useEffect)(()=>{(async()=>{if(h&&e.length>0)try{let e=await (0,l.fetchMCPServers)(h);e&&Array.isArray(e)?p(e):e.data&&Array.isArray(e.data)&&p(e.data)}catch(e){console.error("Error fetching MCP servers:",e)}})()},[h,e.length]),(0,a.useEffect)(()=>{(async()=>{if(h&&g.length>0)try{let e=await (0,l.fetchMCPToolsets)(h),t=Array.isArray(e)?e.filter(e=>g.includes(e.toolset_id)):[];v(t)}catch(e){console.error("Error fetching toolsets:",e)}})()},[h,g.length]);let C=e.includes(u.NO_MCP_SERVERS_SENTINEL),j=e.includes(u.ALL_PROXY_MCP_SERVERS_SENTINEL),k=[...e.filter(e=>e!==u.NO_MCP_SERVERS_SENTINEL&&e!==u.ALL_PROXY_MCP_SERVERS_SENTINEL).map(e=>({type:"server",value:e})),...o.map(e=>({type:"accessGroup",value:e}))],T=k.length+g.length;return(0,t.jsxs)("div",{className:"space-y-3",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(i,{className:"h-4 w-4 text-blue-600"}),(0,t.jsx)(r.Text,{className:"font-semibold text-gray-900",children:"MCP Servers"}),(0,t.jsx)(s.Badge,{color:C?"red":"blue",size:"xs",children:C?"Blocked":j?"All":T})]}),C?(0,t.jsxs)("div",{className:"flex items-center gap-2 px-3 py-2 rounded-lg bg-red-50 border border-red-200",children:[(0,t.jsx)(i,{className:"h-4 w-4 text-red-400"}),(0,t.jsx)(r.Text,{className:"text-red-700 text-sm",children:"No MCP servers — this key is blocked from all MCP servers, including its team's servers"})]}):j?(0,t.jsxs)("div",{className:"flex items-center gap-2 px-3 py-2 rounded-lg bg-blue-50 border border-blue-200",children:[(0,t.jsx)(i,{className:"h-4 w-4 text-blue-400"}),(0,t.jsx)(r.Text,{className:"text-blue-700 text-sm",children:"All Proxy MCP Servers"})]}):T>0?(0,t.jsxs)("div",{className:"max-h-[400px] overflow-y-auto space-y-2 pr-1",children:[k.map((e,r)=>{let a="server"===e.type?n[e.value]:void 0,s=a&&a.length>0,o=b.has(e.value);return(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("div",{onClick:()=>{var t;return s&&(t=e.value,void w(e=>{let r=new Set(e);return r.has(t)?r.delete(t):r.add(t),r}))},className:`flex items-center gap-3 py-2 px-3 rounded-lg border border-gray-200 transition-all ${s?"cursor-pointer hover:bg-gray-50 hover:border-gray-300":"bg-white"}`,children:[(0,t.jsx)("div",{className:"flex items-center gap-2 flex-1 min-w-0",children:"server"===e.type?(0,t.jsx)(m.Tooltip,{title:`Full ID: ${e.value}`,placement:"top",children:(0,t.jsxs)("div",{className:"inline-flex items-center gap-2 min-w-0",children:[(0,t.jsx)("span",{className:"inline-block w-1.5 h-1.5 bg-blue-500 rounded-full shrink-0"}),(0,t.jsx)("span",{className:"text-sm font-medium text-gray-900 truncate",children:(e=>{let t=f.find(t=>t.server_id===e);if(t){let r=e.length>7?`${e.slice(0,3)}...${e.slice(-4)}`:e;return`${t.alias} (${r})`}return e})(e.value)})]})}):(0,t.jsxs)("div",{className:"inline-flex items-center gap-2 min-w-0",children:[(0,t.jsx)("span",{className:"inline-block w-1.5 h-1.5 bg-green-500 rounded-full shrink-0"}),(0,t.jsx)("span",{className:"text-sm font-medium text-gray-900 truncate",children:e.value}),(0,t.jsx)("span",{className:"ml-1 px-1.5 py-0.5 text-[9px] font-semibold text-green-600 bg-green-50 border border-green-200 rounded-sm uppercase tracking-wide shrink-0",children:"Group"})]})}),s&&(0,t.jsxs)("div",{className:"flex items-center gap-1 shrink-0 whitespace-nowrap",children:[(0,t.jsx)("span",{className:"text-xs font-medium text-gray-600",children:a.length}),(0,t.jsx)("span",{className:"text-xs text-gray-500",children:1===a.length?"tool":"tools"}),o?(0,t.jsx)(c.ChevronDownIcon,{className:"h-3.5 w-3.5 text-gray-400 ml-0.5"}):(0,t.jsx)(d.ChevronRightIcon,{className:"h-3.5 w-3.5 text-gray-400 ml-0.5"})]})]}),s&&o&&(0,t.jsx)("div",{className:"ml-4 pl-4 border-l-2 border-blue-200 pb-1",children:(0,t.jsx)("div",{className:"flex flex-wrap gap-1.5",children:a.map((e,r)=>(0,t.jsx)("span",{className:"inline-flex items-center px-2.5 py-1 rounded-lg bg-blue-50 border border-blue-200 text-blue-800 text-xs font-medium",children:e},r))})})]},r)}),g.length>0&&g.map((e,r)=>{let a=x.find(t=>t.toolset_id===e),s=N.has(e),o=a?.tools.length??0;return(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("div",{onClick:()=>o>0&&void y(t=>{let r=new Set(t);return r.has(e)?r.delete(e):r.add(e),r}),className:`flex items-center gap-3 py-2 px-3 rounded-lg border border-purple-200 transition-all ${o>0?"cursor-pointer hover:bg-purple-50 hover:border-purple-300":"bg-white"}`,children:[(0,t.jsxs)("div",{className:"flex items-center gap-2 flex-1 min-w-0",children:[(0,t.jsx)("span",{className:"inline-block w-1.5 h-1.5 bg-purple-500 rounded-full shrink-0"}),(0,t.jsx)("span",{className:"text-sm font-medium text-gray-900 truncate",children:a?.toolset_name??e}),(0,t.jsx)("span",{className:"ml-1 px-1.5 py-0.5 text-[9px] font-semibold text-purple-600 bg-purple-50 border border-purple-200 rounded-sm uppercase tracking-wide shrink-0",children:"Toolset"})]}),o>0&&(0,t.jsxs)("div",{className:"flex items-center gap-1 shrink-0 whitespace-nowrap",children:[(0,t.jsx)("span",{className:"text-xs font-medium text-gray-600",children:o}),(0,t.jsx)("span",{className:"text-xs text-gray-500",children:1===o?"tool":"tools"}),s?(0,t.jsx)(c.ChevronDownIcon,{className:"h-3.5 w-3.5 text-gray-400 ml-0.5"}):(0,t.jsx)(d.ChevronRightIcon,{className:"h-3.5 w-3.5 text-gray-400 ml-0.5"})]})]}),o>0&&s&&a&&(0,t.jsx)("div",{className:"ml-4 pl-4 border-l-2 border-purple-200 pb-1",children:(0,t.jsx)("div",{className:"flex flex-wrap gap-1.5",children:a.tools.map((e,r)=>(0,t.jsxs)("span",{className:"inline-flex items-center px-2.5 py-1 rounded-lg bg-purple-50 border border-purple-200 text-purple-800 text-xs font-medium",children:[(0,t.jsxs)("span",{className:"text-purple-400 mr-1 text-[10px]",children:[e.server_id.slice(0,6),"…"]}),e.tool_name]},r))})})]},`toolset-${r}`)})]}):(0,t.jsxs)("div",{className:"flex items-center gap-2 px-3 py-2 rounded-lg bg-gray-50 border border-gray-200",children:[(0,t.jsx)(i,{className:"h-4 w-4 text-gray-400"}),(0,t.jsx)(r.Text,{className:"text-gray-500 text-sm",children:"No MCP servers, access groups, or toolsets configured"})]})]})},h=a.forwardRef(function(e,t){return a.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),a.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M17 20h5v-2a3 3 0 00-5.356-1.857M17 20H7m10 0v-2c0-.656-.126-1.283-.356-1.857M7 20H2v-2a3 3 0 015.356-1.857M7 20v-2c0-.656.126-1.283.356-1.857m0 0a5.002 5.002 0 019.288 0M15 7a3 3 0 11-6 0 3 3 0 016 0zm6 3a2 2 0 11-4 0 2 2 0 014 0zM7 10a2 2 0 11-4 0 2 2 0 014 0z"}))}),f=function({agents:e,agentAccessGroups:o=[],accessToken:n}){let[i,c]=(0,a.useState)([]);(0,a.useEffect)(()=>{(async()=>{if(n&&e.length>0)try{let e=await (0,l.getAgentsList)(n);e&&e.agents&&Array.isArray(e.agents)&&c(e.agents)}catch(e){console.error("Error fetching agents:",e)}})()},[n,e.length]);let d=[...e.map(e=>({type:"agent",value:e})),...o.map(e=>({type:"accessGroup",value:e}))],u=d.length;return(0,t.jsxs)("div",{className:"space-y-3",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(h,{className:"h-4 w-4 text-purple-600"}),(0,t.jsx)(r.Text,{className:"font-semibold text-gray-900",children:"Agents"}),(0,t.jsx)(s.Badge,{color:"purple",size:"xs",children:u})]}),u>0?(0,t.jsx)("div",{className:"max-h-[400px] overflow-y-auto space-y-2 pr-1",children:d.map((e,r)=>(0,t.jsx)("div",{className:"space-y-2",children:(0,t.jsx)("div",{className:"flex items-center gap-3 py-2 px-3 rounded-lg border border-gray-200 bg-white",children:(0,t.jsx)("div",{className:"flex items-center gap-2 flex-1 min-w-0",children:"agent"===e.type?(0,t.jsx)(m.Tooltip,{title:`Full ID: ${e.value}`,placement:"top",children:(0,t.jsxs)("div",{className:"inline-flex items-center gap-2 min-w-0",children:[(0,t.jsx)("span",{className:"inline-block w-1.5 h-1.5 bg-purple-500 rounded-full shrink-0"}),(0,t.jsx)("span",{className:"text-sm font-medium text-gray-900 truncate",children:(e=>{let t=i.find(t=>t.agent_id===e);if(t){let r=e.length>7?`${e.slice(0,3)}...${e.slice(-4)}`:e;return`${t.agent_name} (${r})`}return e})(e.value)})]})}):(0,t.jsxs)("div",{className:"inline-flex items-center gap-2 min-w-0",children:[(0,t.jsx)("span",{className:"inline-block w-1.5 h-1.5 bg-green-500 rounded-full shrink-0"}),(0,t.jsx)("span",{className:"text-sm font-medium text-gray-900 truncate",children:e.value}),(0,t.jsx)("span",{className:"ml-1 px-1.5 py-0.5 text-[9px] font-semibold text-green-600 bg-green-50 border border-green-200 rounded-sm uppercase tracking-wide shrink-0",children:"Group"})]})})})},r))}):(0,t.jsxs)("div",{className:"flex items-center gap-2 px-3 py-2 rounded-lg bg-gray-50 border border-gray-200",children:[(0,t.jsx)(h,{className:"h-4 w-4 text-gray-400"}),(0,t.jsx)(r.Text,{className:"text-gray-500 text-sm",children:"No agents or access groups configured"})]})]})};e.s(["default",0,function({objectPermission:e,variant:a="card",className:s="",accessToken:o}){let l=e?.vector_stores||[],i=e?.mcp_servers||[],c=e?.mcp_access_groups||[],d=e?.mcp_tool_permissions||{},m=e?.mcp_toolsets||[],u=e?.agents||[],h=e?.agent_access_groups||[],p=e?.search_tools||[],x=(0,t.jsxs)("div",{className:"card"===a?"grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6":"space-y-4",children:[(0,t.jsx)(n,{vectorStores:l,accessToken:o}),(0,t.jsx)(g,{mcpServers:i,mcpAccessGroups:c,mcpToolPermissions:d,mcpToolsets:m,accessToken:o}),(0,t.jsx)(f,{agents:u,agentAccessGroups:h,accessToken:o}),(0,t.jsxs)("div",{className:"rounded-md border border-gray-100 p-4",children:[(0,t.jsx)(r.Text,{className:"text-sm font-medium text-gray-800",children:"Search tools"}),0===p.length?(0,t.jsx)(r.Text,{className:"mt-1 block text-xs text-gray-500",children:"No restriction — all configured search tools are allowed for this team."}):(0,t.jsx)(r.Text,{className:"mt-1 block text-xs text-gray-700",children:p.join(", ")})]})]});return"card"===a?(0,t.jsxs)("div",{className:`bg-white border border-gray-200 rounded-lg p-6 ${s}`,children:[(0,t.jsx)("div",{className:"flex items-center gap-2 mb-6",children:(0,t.jsxs)("div",{children:[(0,t.jsx)(r.Text,{className:"font-semibold text-gray-900",children:"Object Permissions"}),(0,t.jsx)(r.Text,{className:"text-xs text-gray-500",children:"Access control for Vector Stores and MCP Servers"})]})}),x]}):(0,t.jsxs)("div",{className:`${s}`,children:[(0,t.jsx)(r.Text,{className:"font-medium text-gray-900 mb-3",children:"Object Permissions"}),x]})}],384767)},637235,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M512 64C264.6 64 64 264.6 64 512s200.6 448 448 448 448-200.6 448-448S759.4 64 512 64zm0 820c-205.4 0-372-166.6-372-372s166.6-372 372-372 372 166.6 372 372-166.6 372-372 372z"}},{tag:"path",attrs:{d:"M686.7 638.6L544.1 535.5V288c0-4.4-3.6-8-8-8H488c-4.4 0-8 3.6-8 8v275.4c0 2.6 1.2 5 3.3 6.5l165.4 120.6c3.6 2.6 8.6 1.8 11.2-1.7l28.6-39c2.6-3.7 1.8-8.7-1.8-11.2z"}}]},name:"clock-circle",theme:"outlined"};var s=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(s.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["ClockCircleOutlined",0,o],637235)},597440,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M360 184h-8c4.4 0 8-3.6 8-8v8h304v-8c0 4.4 3.6 8 8 8h-8v72h72v-80c0-35.3-28.7-64-64-64H352c-35.3 0-64 28.7-64 64v80h72v-72zm504 72H160c-17.7 0-32 14.3-32 32v32c0 4.4 3.6 8 8 8h60.4l24.7 523c1.6 34.1 29.8 61 63.9 61h454c34.2 0 62.3-26.8 63.9-61l24.7-523H888c4.4 0 8-3.6 8-8v-32c0-17.7-14.3-32-32-32zM731.3 840H292.7l-24.2-512h487l-24.2 512z"}}]},name:"delete",theme:"outlined"};var s=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(s.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["default",0,o],597440)},955135,e=>{"use strict";var t=e.i(597440);e.s(["DeleteOutlined",()=>t.default])},646563,e=>{"use strict";var t=e.i(959013);e.s(["PlusOutlined",()=>t.default])},599724,936325,e=>{"use strict";var t=e.i(95779),r=e.i(444755),a=e.i(673706),s=e.i(271645);let o=s.default.forwardRef((e,o)=>{let{color:l,className:n,children:i}=e;return s.default.createElement("p",{ref:o,className:(0,r.tremorTwMerge)("text-tremor-default",l?(0,a.getColorClassNames)(l,t.colorPalette.text).textColor:(0,r.tremorTwMerge)("text-tremor-content","dark:text-dark-tremor-content"),n)},i)});o.displayName="Text",e.s(["default",0,o],936325),e.s(["Text",0,o],599724)},994388,e=>{"use strict";var t=e.i(290571),r=e.i(829087),a=e.i(271645);let s=["preEnter","entering","entered","preExit","exiting","exited","unmounted"],o=e=>({_s:e,status:s[e],isEnter:e<3,isMounted:6!==e,isResolved:2===e||e>4}),l=e=>e?6:5,n=(e,t,r,a,s)=>{clearTimeout(a.current);let l=o(e);t(l),r.current=l,s&&s({current:l})};var i=e.i(480731),c=e.i(444755),d=e.i(673706);let m=e=>{var r=(0,t.__rest)(e,[]);return a.default.createElement("svg",Object.assign({},r,{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24",fill:"currentColor"}),a.default.createElement("path",{fill:"none",d:"M0 0h24v24H0z"}),a.default.createElement("path",{d:"M18.364 5.636L16.95 7.05A7 7 0 1 0 19 12h2a9 9 0 1 1-2.636-6.364z"}))};var u=e.i(95779);let g={xs:{height:"h-4",width:"w-4"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-6",width:"w-6"},xl:{height:"h-6",width:"w-6"}},h=(e,t)=>{switch(e){case"primary":return{textColor:t?(0,d.getColorClassNames)("white").textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",hoverTextColor:t?(0,d.getColorClassNames)("white").textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:t?(0,d.getColorClassNames)(t,u.colorPalette.background).bgColor:"bg-tremor-brand dark:bg-dark-tremor-brand",hoverBgColor:t?(0,d.getColorClassNames)(t,u.colorPalette.darkBackground).hoverBgColor:"hover:bg-tremor-brand-emphasis dark:hover:bg-dark-tremor-brand-emphasis",borderColor:t?(0,d.getColorClassNames)(t,u.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand",hoverBorderColor:t?(0,d.getColorClassNames)(t,u.colorPalette.darkBorder).hoverBorderColor:"hover:border-tremor-brand-emphasis dark:hover:border-dark-tremor-brand-emphasis"};case"secondary":return{textColor:t?(0,d.getColorClassNames)(t,u.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",hoverTextColor:t?(0,d.getColorClassNames)(t,u.colorPalette.text).textColor:"hover:text-tremor-brand-emphasis dark:hover:text-dark-tremor-brand-emphasis",bgColor:(0,d.getColorClassNames)("transparent").bgColor,hoverBgColor:t?(0,c.tremorTwMerge)((0,d.getColorClassNames)(t,u.colorPalette.background).hoverBgColor,"hover:bg-opacity-20 dark:hover:bg-opacity-20"):"hover:bg-tremor-brand-faint dark:hover:bg-dark-tremor-brand-faint",borderColor:t?(0,d.getColorClassNames)(t,u.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand"};case"light":return{textColor:t?(0,d.getColorClassNames)(t,u.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",hoverTextColor:t?(0,d.getColorClassNames)(t,u.colorPalette.darkText).hoverTextColor:"hover:text-tremor-brand-emphasis dark:hover:text-dark-tremor-brand-emphasis",bgColor:(0,d.getColorClassNames)("transparent").bgColor,borderColor:"",hoverBorderColor:""}}},f=(0,d.makeClassName)("Button"),p=({loading:e,iconSize:t,iconPosition:r,Icon:s,needMargin:o,transitionStatus:l})=>{let n=o?r===i.HorizontalPositions.Left?(0,c.tremorTwMerge)("-ml-1","mr-1.5"):(0,c.tremorTwMerge)("-mr-1","ml-1.5"):"",d=(0,c.tremorTwMerge)("w-0 h-0"),u={default:d,entering:d,entered:t,exiting:t,exited:d};return e?a.default.createElement(m,{className:(0,c.tremorTwMerge)(f("icon"),"animate-spin shrink-0",n,u.default,u[l]),style:{transition:"width 150ms"}}):a.default.createElement(s,{className:(0,c.tremorTwMerge)(f("icon"),"shrink-0",t,n)})},x=a.default.forwardRef((e,s)=>{let{icon:m,iconPosition:u=i.HorizontalPositions.Left,size:x=i.Sizes.SM,color:v,variant:b="primary",disabled:w,loading:N=!1,loadingText:y,children:C,tooltip:j,className:k}=e,T=(0,t.__rest)(e,["icon","iconPosition","size","color","variant","disabled","loading","loadingText","children","tooltip","className"]),E=N||w,_=void 0!==m||N,M=N&&y,S=!(!C&&!M),P=(0,c.tremorTwMerge)(g[x].height,g[x].width),R="light"!==b?(0,c.tremorTwMerge)("rounded-tremor-default border","shadow-tremor-input","dark:shadow-dark-tremor-input"):"",L=h(b,v),z=("light"!==b?{xs:{paddingX:"px-2.5",paddingY:"py-1.5",fontSize:"text-xs"},sm:{paddingX:"px-4",paddingY:"py-2",fontSize:"text-sm"},md:{paddingX:"px-4",paddingY:"py-2",fontSize:"text-md"},lg:{paddingX:"px-4",paddingY:"py-2.5",fontSize:"text-lg"},xl:{paddingX:"px-4",paddingY:"py-3",fontSize:"text-xl"}}:{xs:{paddingX:"",paddingY:"",fontSize:"text-xs"},sm:{paddingX:"",paddingY:"",fontSize:"text-sm"},md:{paddingX:"",paddingY:"",fontSize:"text-md"},lg:{paddingX:"",paddingY:"",fontSize:"text-lg"},xl:{paddingX:"",paddingY:"",fontSize:"text-xl"}})[x],{tooltipProps:B,getReferenceProps:$}=(0,r.useTooltip)(300),[O,H]=(({enter:e=!0,exit:t=!0,preEnter:r,preExit:s,timeout:i,initialEntered:c,mountOnEnter:d,unmountOnExit:m,onStateChange:u}={})=>{let[g,h]=(0,a.useState)(()=>o(c?2:l(d))),f=(0,a.useRef)(g),p=(0,a.useRef)(0),[x,v]="object"==typeof i?[i.enter,i.exit]:[i,i],b=(0,a.useCallback)(()=>{let e=((e,t)=>{switch(e){case 1:case 0:return 2;case 4:case 3:return l(t)}})(f.current._s,m);e&&n(e,h,f,p,u)},[u,m]);return[g,(0,a.useCallback)(a=>{let o=e=>{switch(n(e,h,f,p,u),e){case 1:x>=0&&(p.current=((...e)=>setTimeout(...e))(b,x));break;case 4:v>=0&&(p.current=((...e)=>setTimeout(...e))(b,v));break;case 0:case 3:p.current=((...e)=>setTimeout(...e))(()=>{isNaN(document.body.offsetTop)||o(e+1)},0)}},i=f.current.isEnter;"boolean"!=typeof a&&(a=!i),a?i||o(e?+!r:2):i&&o(t?s?3:4:l(m))},[b,u,e,t,r,s,x,v,m]),b]})({timeout:50});return(0,a.useEffect)(()=>{H(N)},[N]),a.default.createElement("button",Object.assign({ref:(0,d.mergeRefs)([s,B.refs.setReference]),className:(0,c.tremorTwMerge)(f("root"),"shrink-0 inline-flex justify-center items-center group font-medium outline-none",R,z.paddingX,z.paddingY,z.fontSize,L.textColor,L.bgColor,L.borderColor,L.hoverBorderColor,E?"opacity-50 cursor-not-allowed":(0,c.tremorTwMerge)(h(b,v).hoverTextColor,h(b,v).hoverBgColor,h(b,v).hoverBorderColor),k),disabled:E},$,T),a.default.createElement(r.default,Object.assign({text:j},B)),_&&u!==i.HorizontalPositions.Right?a.default.createElement(p,{loading:N,iconSize:P,iconPosition:u,Icon:m,transitionStatus:O.status,needMargin:S}):null,M||C?a.default.createElement("span",{className:(0,c.tremorTwMerge)(f("text"),"text-tremor-default whitespace-nowrap")},M?y:C):null,_&&u===i.HorizontalPositions.Right?a.default.createElement(p,{loading:N,iconSize:P,iconPosition:u,Icon:m,transitionStatus:O.status,needMargin:S}):null)});x.displayName="Button",e.s(["Button",0,x],994388)},304967,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(480731),s=e.i(95779),o=e.i(444755),l=e.i(673706);let n=(0,l.makeClassName)("Card"),i=r.default.forwardRef((e,i)=>{let{decoration:c="",decorationColor:d,children:m,className:u}=e,g=(0,t.__rest)(e,["decoration","decorationColor","children","className"]);return r.default.createElement("div",Object.assign({ref:i,className:(0,o.tremorTwMerge)(n("root"),"relative w-full text-left ring-1 rounded-tremor-default p-6","bg-tremor-background ring-tremor-ring shadow-tremor-card","dark:bg-dark-tremor-background dark:ring-dark-tremor-ring dark:shadow-dark-tremor-card",d?(0,l.getColorClassNames)(d,s.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand",(e=>{if(!e)return"";switch(e){case a.HorizontalPositions.Left:return"border-l-4";case a.VerticalPositions.Top:return"border-t-4";case a.HorizontalPositions.Right:return"border-r-4";case a.VerticalPositions.Bottom:return"border-b-4";default:return""}})(c),u)},g),m)});i.displayName="Card",e.s(["Card",0,i],304967)},629569,e=>{"use strict";var t=e.i(290571),r=e.i(95779),a=e.i(444755),s=e.i(673706),o=e.i(271645);let l=o.default.forwardRef((e,l)=>{let{color:n,children:i,className:c}=e,d=(0,t.__rest)(e,["color","children","className"]);return o.default.createElement("p",Object.assign({ref:l,className:(0,a.tremorTwMerge)("font-medium text-tremor-title",n?(0,s.getColorClassNames)(n,r.colorPalette.darkText).textColor:"text-tremor-content-strong dark:text-dark-tremor-content-strong",c)},d),i)});l.displayName="Title",e.s(["Title",0,l],629569)},653496,e=>{"use strict";var t=e.i(721369);e.s(["Tabs",()=>t.default])},536916,e=>{"use strict";var t=e.i(374276);e.s(["Checkbox",()=>t.default])},891547,e=>{"use strict";var t=e.i(843476),r=e.i(271645),a=e.i(199133),s=e.i(602869);e.s(["default",0,({onChange:e,value:o,className:l,accessToken:n,disabled:i})=>{let[c,d]=(0,r.useState)([]),[m,u]=(0,r.useState)(!1);return(0,r.useEffect)(()=>{(async()=>{if(n){u(!0);try{let e=await (0,s.getGuardrailsList)(n);e.guardrails&&d(e.guardrails)}catch(e){console.error("Error fetching guardrails:",e)}finally{u(!1)}}})()},[n]),(0,t.jsx)("div",{children:(0,t.jsx)(a.Select,{mode:"multiple",disabled:i,placeholder:i?"Setting guardrails is a premium feature.":"Select guardrails",onChange:t=>{e(t)},value:o,loading:m,className:l,allowClear:!0,options:c.map(e=>({label:`${e.guardrail_name}`,value:e.guardrail_name})),optionFilterProp:"label",showSearch:!0,style:{width:"100%"}})})}])},921511,e=>{"use strict";var t=e.i(843476),r=e.i(271645),a=e.i(199133),s=e.i(602869);function o(e){return e.filter(e=>(e.version_status??"draft")!=="draft").map(e=>{var t;let r=e.version_number??1,a=e.version_status??"draft";return{label:`${e.policy_name} — v${r} (${a})${e.description?` — ${e.description}`:""}`,value:"production"===a?e.policy_name:e.policy_id?(t=e.policy_id,`policy_${t}`):e.policy_name}})}e.s(["default",0,({onChange:e,value:l,className:n,accessToken:i,disabled:c,onPoliciesLoaded:d})=>{let[m,u]=(0,r.useState)([]),[g,h]=(0,r.useState)(!1);return(0,r.useEffect)(()=>{(async()=>{if(i){h(!0);try{let e=await (0,s.getPoliciesList)(i);e.policies&&(u(e.policies),d?.(e.policies))}catch(e){console.error("Error fetching policies:",e)}finally{h(!1)}}})()},[i,d]),(0,t.jsx)("div",{children:(0,t.jsx)(a.Select,{mode:"multiple",disabled:c,placeholder:c?"Setting policies is a premium feature.":"Select policies (production or published versions)",onChange:t=>{e(t)},value:l,loading:g,className:n,allowClear:!0,options:o(m),optionFilterProp:"label",showSearch:!0,style:{width:"100%"}})})},"getPolicyOptionEntries",0,o])},530212,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10 19l-7-7m0 0l7-7m-7 7h18"}))});e.s(["ArrowLeftIcon",0,r],530212)},482725,e=>{"use strict";var t=e.i(244451);e.s(["Spin",()=>t.default])},555987,e=>{"use strict";var t=e.i(221688),r=e.i(950643);let a=/^(https?:|data:|blob:|\/\/)/i;e.s(["resolveLogoSrc",0,(e,s=t.serverRootPath)=>{if(e){let t;return a.test(e)?e:(t=(0,r.normalizeRootPath)(s),`${t}${e.startsWith("/")?e:`/${e}`}`)}}])},500330,e=>{"use strict";var t=e.i(727749);let r=(e,t=0,r=!1,a=!0)=>{if(null==e||!Number.isFinite(e)||0===e&&!a)return"-";let s={minimumFractionDigits:t,maximumFractionDigits:t};if(!r)return e.toLocaleString("en-US",s);let o=e<0?"-":"",l=Math.abs(e),n=l,i="";return l>=1e6?(n=l/1e6,i="M"):l>=1e3&&(n=l/1e3,i="K"),`${o}${n.toLocaleString("en-US",s)}${i}`},a=async(e,r="Copied to clipboard")=>{if(!e)return!1;if(!navigator||!navigator.clipboard||!navigator.clipboard.writeText)return s(e,r);try{return await navigator.clipboard.writeText(e),t.default.success(r),!0}catch(t){return console.error("Clipboard API failed: ",t),s(e,r)}},s=(e,r)=>{try{let a=document.createElement("textarea");a.value=e,a.style.position="fixed",a.style.left="-999999px",a.style.top="-999999px",a.setAttribute("readonly",""),document.body.appendChild(a),a.focus(),a.select();let s=document.execCommand("copy");if(document.body.removeChild(a),s)return t.default.success(r),!0;throw Error("execCommand failed")}catch(e){return t.default.fromBackend("Failed to copy to clipboard"),console.error("Failed to copy: ",e),!1}};e.s(["copyToClipboard",0,a,"formatNumberWithCommas",0,r,"getSpendString",0,(e,t=6)=>{if(null==e||!Number.isFinite(e)||0===e)return"-";let a=r(e,t,!1,!1);if(0===Number(a.replace(/,/g,""))){let e=(1/10**t).toFixed(t);return`< $${e}`}return`$${a}`},"updateExistingKeys",0,function(e,t){let r=structuredClone(e);for(let[e,a]of Object.entries(t))e in r&&(r[e]=a);return r}])},91739,e=>{"use strict";var t=e.i(544195);e.s(["Radio",()=>t.default])},211576,e=>{"use strict";var t=e.i(131757);e.s(["Col",()=>t.default])},178654,e=>{"use strict";let t=e.i(211576).Col;e.s(["Col",0,t],178654)},621192,e=>{"use strict";let t=e.i(264042).Row;e.s(["Row",0,t],621192)},962944,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M848 359.3H627.7L825.8 109c4.1-5.3.4-13-6.3-13H436c-2.8 0-5.5 1.5-6.9 4L170 547.5c-3.1 5.3.7 12 6.9 12h174.4l-89.4 357.6c-1.9 7.8 7.5 13.3 13.3 7.7L853.5 373c5.2-4.9 1.7-13.7-5.5-13.7zM378.2 732.5l60.3-241H281.1l189.6-327.4h224.6L487 427.4h211L378.2 732.5z"}}]},name:"thunderbolt",theme:"outlined"};var s=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(s.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["ThunderboltOutlined",0,o],962944)},72713,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M880 184H712v-64c0-4.4-3.6-8-8-8h-56c-4.4 0-8 3.6-8 8v64H384v-64c0-4.4-3.6-8-8-8h-56c-4.4 0-8 3.6-8 8v64H144c-17.7 0-32 14.3-32 32v664c0 17.7 14.3 32 32 32h736c17.7 0 32-14.3 32-32V216c0-17.7-14.3-32-32-32zm-40 656H184V460h656v380zM184 392V256h128v48c0 4.4 3.6 8 8 8h56c4.4 0 8-3.6 8-8v-48h256v48c0 4.4 3.6 8 8 8h56c4.4 0 8-3.6 8-8v-48h128v136H184z"}}]},name:"calendar",theme:"outlined"};var s=e.i(9583),o=r.forwardRef(function(e,o){return r.createElement(s.default,(0,t.default)({},e,{ref:o,icon:a}))});e.s(["CalendarOutlined",0,o],72713)},439189,435684,96226,497245,e=>{"use strict";function t(e){let t=Object.prototype.toString.call(e);return e instanceof Date||"object"==typeof e&&"[object Date]"===t?new e.constructor(+e):new Date("number"==typeof e||"[object Number]"===t||"string"==typeof e||"[object String]"===t?e:NaN)}function r(e,t){return e instanceof Date?new e.constructor(t):new Date(t)}e.s(["toDate",0,t],435684),e.s(["constructFrom",0,r],96226),e.s(["addDays",0,function(e,a){let s=t(e);return isNaN(a)?r(e,NaN):(a&&s.setDate(s.getDate()+a),s)}],439189),e.s(["addMonths",0,function(e,a){let s=t(e);if(isNaN(a))return r(e,NaN);if(!a)return s;let o=s.getDate(),l=r(e,s.getTime());return(l.setMonth(s.getMonth()+a+1,0),o>=l.getDate())?l:(s.setFullYear(l.getFullYear(),l.getMonth(),o),s)}],497245)},24529,e=>{"use strict";var t=e.i(439189),r=e.i(497245),a=e.i(96226),s=e.i(435684);function o(e,o){let{years:l=0,months:n=0,weeks:i=0,days:c=0,hours:d=0,minutes:m=0,seconds:u=0}=o,g=(0,s.toDate)(e),h=n||l?(0,r.addMonths)(g,n+12*l):g,f=c||i?(0,t.addDays)(h,c+7*i):h;return(0,a.constructFrom)(e,f.getTime()+1e3*(u+60*(m+60*d)))}let l=/[zZ]$|[+-]\d{2}:?\d{2}$/;function n(e){return Date.parse(l.test(e)?e:`${e}Z`)}e.s(["calculateExpiryPreviewFromDuration",0,function(e){if(!e)return null;try{let t,r=parseInt(e);if(Number.isNaN(r))throw Error("Invalid duration format");let a=new Date;if(e.endsWith("mo"))t=o(a,{months:r});else if(e.endsWith("s"))t=o(a,{seconds:r});else if(e.endsWith("m"))t=o(a,{minutes:r});else if(e.endsWith("h"))t=o(a,{hours:r});else if(e.endsWith("d"))t=o(a,{days:r});else if(e.endsWith("w"))t=o(a,{weeks:r});else throw Error("Invalid duration format");return t.toLocaleString()}catch{return null}},"formatExpiresUtc",0,function(e){let t=n(e);return Number.isNaN(t)?e:new Date(t).toLocaleString()},"isKeyExpired",0,function(e){if(!e)return!1;let t=n(e);return!Number.isNaN(t)&&t{"use strict";var t=e.i(616303);e.s(["Empty",()=>t.default])},94629,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M7 16V4m0 0L3 8m4-4l4 4m6 0v12m0 0l4-4m-4 4l-4-4"}))});e.s(["SwitchVerticalIcon",0,r],94629)},728889,e=>{"use strict";var t=e.i(290571),r=e.i(271645),o=e.i(829087),a=e.i(480731),s=e.i(444755),n=e.i(673706),i=e.i(95779);let l={xs:{paddingX:"px-1.5",paddingY:"py-1.5"},sm:{paddingX:"px-1.5",paddingY:"py-1.5"},md:{paddingX:"px-2",paddingY:"py-2"},lg:{paddingX:"px-2",paddingY:"py-2"},xl:{paddingX:"px-2.5",paddingY:"py-2.5"}},d={xs:{height:"h-3",width:"w-3"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-7",width:"w-7"},xl:{height:"h-9",width:"w-9"}},c={simple:{rounded:"",border:"",ring:"",shadow:""},light:{rounded:"rounded-tremor-default",border:"",ring:"",shadow:""},shadow:{rounded:"rounded-tremor-default",border:"border",ring:"",shadow:"shadow-tremor-card dark:shadow-dark-tremor-card"},solid:{rounded:"rounded-tremor-default",border:"border-2",ring:"ring-1",shadow:""},outlined:{rounded:"rounded-tremor-default",border:"border",ring:"ring-2",shadow:""}},u=(0,n.makeClassName)("Icon"),m=r.default.forwardRef((e,m)=>{let{icon:g,variant:h="simple",tooltip:b,size:f=a.Sizes.SM,color:p,className:C}=e,w=(0,t.__rest)(e,["icon","variant","tooltip","size","color","className"]),k=((e,t)=>{switch(e){case"simple":return{textColor:t?(0,n.getColorClassNames)(t,i.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:"",borderColor:"",ringColor:""};case"light":return{textColor:t?(0,n.getColorClassNames)(t,i.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,s.tremorTwMerge)((0,n.getColorClassNames)(t,i.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand-muted dark:bg-dark-tremor-brand-muted",borderColor:"",ringColor:""};case"shadow":return{textColor:t?(0,n.getColorClassNames)(t,i.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,s.tremorTwMerge)((0,n.getColorClassNames)(t,i.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:"border-tremor-border dark:border-dark-tremor-border",ringColor:""};case"solid":return{textColor:t?(0,n.getColorClassNames)(t,i.colorPalette.text).textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:t?(0,s.tremorTwMerge)((0,n.getColorClassNames)(t,i.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand dark:bg-dark-tremor-brand",borderColor:"border-tremor-brand-inverted dark:border-dark-tremor-brand-inverted",ringColor:"ring-tremor-ring dark:ring-dark-tremor-ring"};case"outlined":return{textColor:t?(0,n.getColorClassNames)(t,i.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,s.tremorTwMerge)((0,n.getColorClassNames)(t,i.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:t?(0,n.getColorClassNames)(t,i.colorPalette.ring).borderColor:"border-tremor-brand-subtle dark:border-dark-tremor-brand-subtle",ringColor:t?(0,s.tremorTwMerge)((0,n.getColorClassNames)(t,i.colorPalette.ring).ringColor,"ring-opacity-40"):"ring-tremor-brand-muted dark:ring-dark-tremor-brand-muted"}}})(h,p),{tooltipProps:x,getReferenceProps:v}=(0,o.useTooltip)();return r.default.createElement("span",Object.assign({ref:(0,n.mergeRefs)([m,x.refs.setReference]),className:(0,s.tremorTwMerge)(u("root"),"inline-flex shrink-0 items-center justify-center",k.bgColor,k.textColor,k.borderColor,k.ringColor,c[h].rounded,c[h].border,c[h].shadow,c[h].ring,l[f].paddingX,l[f].paddingY,C)},v,w),r.default.createElement(o.default,Object.assign({text:b},x)),r.default.createElement(g,{className:(0,s.tremorTwMerge)(u("icon"),"shrink-0",d[f].height,d[f].width)}))});m.displayName="Icon",e.s(["default",0,m],728889)},752978,e=>{"use strict";var t=e.i(728889);e.s(["Icon",()=>t.default])},360820,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M5 15l7-7 7 7"}))});e.s(["ChevronUpIcon",0,r],360820)},871943,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 9l-7 7-7-7"}))});e.s(["ChevronDownIcon",0,r],871943)},994388,e=>{"use strict";var t=e.i(290571),r=e.i(829087),o=e.i(271645);let a=["preEnter","entering","entered","preExit","exiting","exited","unmounted"],s=e=>({_s:e,status:a[e],isEnter:e<3,isMounted:6!==e,isResolved:2===e||e>4}),n=e=>e?6:5,i=(e,t,r,o,a)=>{clearTimeout(o.current);let n=s(e);t(n),r.current=n,a&&a({current:n})};var l=e.i(480731),d=e.i(444755),c=e.i(673706);let u=e=>{var r=(0,t.__rest)(e,[]);return o.default.createElement("svg",Object.assign({},r,{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24",fill:"currentColor"}),o.default.createElement("path",{fill:"none",d:"M0 0h24v24H0z"}),o.default.createElement("path",{d:"M18.364 5.636L16.95 7.05A7 7 0 1 0 19 12h2a9 9 0 1 1-2.636-6.364z"}))};var m=e.i(95779);let g={xs:{height:"h-4",width:"w-4"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-6",width:"w-6"},xl:{height:"h-6",width:"w-6"}},h=(e,t)=>{switch(e){case"primary":return{textColor:t?(0,c.getColorClassNames)("white").textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",hoverTextColor:t?(0,c.getColorClassNames)("white").textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:t?(0,c.getColorClassNames)(t,m.colorPalette.background).bgColor:"bg-tremor-brand dark:bg-dark-tremor-brand",hoverBgColor:t?(0,c.getColorClassNames)(t,m.colorPalette.darkBackground).hoverBgColor:"hover:bg-tremor-brand-emphasis dark:hover:bg-dark-tremor-brand-emphasis",borderColor:t?(0,c.getColorClassNames)(t,m.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand",hoverBorderColor:t?(0,c.getColorClassNames)(t,m.colorPalette.darkBorder).hoverBorderColor:"hover:border-tremor-brand-emphasis dark:hover:border-dark-tremor-brand-emphasis"};case"secondary":return{textColor:t?(0,c.getColorClassNames)(t,m.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",hoverTextColor:t?(0,c.getColorClassNames)(t,m.colorPalette.text).textColor:"hover:text-tremor-brand-emphasis dark:hover:text-dark-tremor-brand-emphasis",bgColor:(0,c.getColorClassNames)("transparent").bgColor,hoverBgColor:t?(0,d.tremorTwMerge)((0,c.getColorClassNames)(t,m.colorPalette.background).hoverBgColor,"hover:bg-opacity-20 dark:hover:bg-opacity-20"):"hover:bg-tremor-brand-faint dark:hover:bg-dark-tremor-brand-faint",borderColor:t?(0,c.getColorClassNames)(t,m.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand"};case"light":return{textColor:t?(0,c.getColorClassNames)(t,m.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",hoverTextColor:t?(0,c.getColorClassNames)(t,m.colorPalette.darkText).hoverTextColor:"hover:text-tremor-brand-emphasis dark:hover:text-dark-tremor-brand-emphasis",bgColor:(0,c.getColorClassNames)("transparent").bgColor,borderColor:"",hoverBorderColor:""}}},b=(0,c.makeClassName)("Button"),f=({loading:e,iconSize:t,iconPosition:r,Icon:a,needMargin:s,transitionStatus:n})=>{let i=s?r===l.HorizontalPositions.Left?(0,d.tremorTwMerge)("-ml-1","mr-1.5"):(0,d.tremorTwMerge)("-mr-1","ml-1.5"):"",c=(0,d.tremorTwMerge)("w-0 h-0"),m={default:c,entering:c,entered:t,exiting:t,exited:c};return e?o.default.createElement(u,{className:(0,d.tremorTwMerge)(b("icon"),"animate-spin shrink-0",i,m.default,m[n]),style:{transition:"width 150ms"}}):o.default.createElement(a,{className:(0,d.tremorTwMerge)(b("icon"),"shrink-0",t,i)})},p=o.default.forwardRef((e,a)=>{let{icon:u,iconPosition:m=l.HorizontalPositions.Left,size:p=l.Sizes.SM,color:C,variant:w="primary",disabled:k,loading:x=!1,loadingText:v,children:N,tooltip:y,className:M}=e,T=(0,t.__rest)(e,["icon","iconPosition","size","color","variant","disabled","loading","loadingText","children","tooltip","className"]),E=x||k,R=void 0!==u||x,P=x&&v,O=!(!N&&!P),j=(0,d.tremorTwMerge)(g[p].height,g[p].width),S="light"!==w?(0,d.tremorTwMerge)("rounded-tremor-default border","shadow-tremor-input","dark:shadow-dark-tremor-input"):"",z=h(w,C),L=("light"!==w?{xs:{paddingX:"px-2.5",paddingY:"py-1.5",fontSize:"text-xs"},sm:{paddingX:"px-4",paddingY:"py-2",fontSize:"text-sm"},md:{paddingX:"px-4",paddingY:"py-2",fontSize:"text-md"},lg:{paddingX:"px-4",paddingY:"py-2.5",fontSize:"text-lg"},xl:{paddingX:"px-4",paddingY:"py-3",fontSize:"text-xl"}}:{xs:{paddingX:"",paddingY:"",fontSize:"text-xs"},sm:{paddingX:"",paddingY:"",fontSize:"text-sm"},md:{paddingX:"",paddingY:"",fontSize:"text-md"},lg:{paddingX:"",paddingY:"",fontSize:"text-lg"},xl:{paddingX:"",paddingY:"",fontSize:"text-xl"}})[p],{tooltipProps:B,getReferenceProps:_}=(0,r.useTooltip)(300),[H,X]=(({enter:e=!0,exit:t=!0,preEnter:r,preExit:a,timeout:l,initialEntered:d,mountOnEnter:c,unmountOnExit:u,onStateChange:m}={})=>{let[g,h]=(0,o.useState)(()=>s(d?2:n(c))),b=(0,o.useRef)(g),f=(0,o.useRef)(0),[p,C]="object"==typeof l?[l.enter,l.exit]:[l,l],w=(0,o.useCallback)(()=>{let e=((e,t)=>{switch(e){case 1:case 0:return 2;case 4:case 3:return n(t)}})(b.current._s,u);e&&i(e,h,b,f,m)},[m,u]);return[g,(0,o.useCallback)(o=>{let s=e=>{switch(i(e,h,b,f,m),e){case 1:p>=0&&(f.current=((...e)=>setTimeout(...e))(w,p));break;case 4:C>=0&&(f.current=((...e)=>setTimeout(...e))(w,C));break;case 0:case 3:f.current=((...e)=>setTimeout(...e))(()=>{isNaN(document.body.offsetTop)||s(e+1)},0)}},l=b.current.isEnter;"boolean"!=typeof o&&(o=!l),o?l||s(e?+!r:2):l&&s(t?a?3:4:n(u))},[w,m,e,t,r,a,p,C,u]),w]})({timeout:50});return(0,o.useEffect)(()=>{X(x)},[x]),o.default.createElement("button",Object.assign({ref:(0,c.mergeRefs)([a,B.refs.setReference]),className:(0,d.tremorTwMerge)(b("root"),"shrink-0 inline-flex justify-center items-center group font-medium outline-none",S,L.paddingX,L.paddingY,L.fontSize,z.textColor,z.bgColor,z.borderColor,z.hoverBorderColor,E?"opacity-50 cursor-not-allowed":(0,d.tremorTwMerge)(h(w,C).hoverTextColor,h(w,C).hoverBgColor,h(w,C).hoverBorderColor),M),disabled:E},_,T),o.default.createElement(r.default,Object.assign({text:y},B)),R&&m!==l.HorizontalPositions.Right?o.default.createElement(f,{loading:x,iconSize:j,iconPosition:m,Icon:u,transitionStatus:H.status,needMargin:O}):null,P||N?o.default.createElement("span",{className:(0,d.tremorTwMerge)(b("text"),"text-tremor-default whitespace-nowrap")},P?v:N):null,R&&m===l.HorizontalPositions.Right?o.default.createElement(f,{loading:x,iconSize:j,iconPosition:m,Icon:u,transitionStatus:H.status,needMargin:O}):null)});p.displayName="Button",e.s(["Button",0,p],994388)},304967,e=>{"use strict";var t=e.i(290571),r=e.i(271645),o=e.i(480731),a=e.i(95779),s=e.i(444755),n=e.i(673706);let i=(0,n.makeClassName)("Card"),l=r.default.forwardRef((e,l)=>{let{decoration:d="",decorationColor:c,children:u,className:m}=e,g=(0,t.__rest)(e,["decoration","decorationColor","children","className"]);return r.default.createElement("div",Object.assign({ref:l,className:(0,s.tremorTwMerge)(i("root"),"relative w-full text-left ring-1 rounded-tremor-default p-6","bg-tremor-background ring-tremor-ring shadow-tremor-card","dark:bg-dark-tremor-background dark:ring-dark-tremor-ring dark:shadow-dark-tremor-card",c?(0,n.getColorClassNames)(c,a.colorPalette.border).borderColor:"border-tremor-brand dark:border-dark-tremor-brand",(e=>{if(!e)return"";switch(e){case o.HorizontalPositions.Left:return"border-l-4";case o.VerticalPositions.Top:return"border-t-4";case o.HorizontalPositions.Right:return"border-r-4";case o.VerticalPositions.Bottom:return"border-b-4";default:return""}})(d),m)},g),u)});l.displayName="Card",e.s(["Card",0,l],304967)},269200,e=>{"use strict";var t=e.i(290571),r=e.i(271645),o=e.i(444755);let a=(0,e.i(673706).makeClassName)("Table"),s=r.default.forwardRef((e,s)=>{let{children:n,className:i}=e,l=(0,t.__rest)(e,["children","className"]);return r.default.createElement("div",{className:(0,o.tremorTwMerge)(a("root"),"overflow-auto",i)},r.default.createElement("table",Object.assign({ref:s,className:(0,o.tremorTwMerge)(a("table"),"w-full text-tremor-default","text-tremor-content","dark:text-dark-tremor-content")},l),n))});s.displayName="Table",e.s(["Table",0,s],269200)},942232,e=>{"use strict";var t=e.i(290571),r=e.i(271645),o=e.i(444755);let a=(0,e.i(673706).makeClassName)("TableBody"),s=r.default.forwardRef((e,s)=>{let{children:n,className:i}=e,l=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("tbody",Object.assign({ref:s,className:(0,o.tremorTwMerge)(a("root"),"align-top divide-y","divide-tremor-border","dark:divide-dark-tremor-border",i)},l),n))});s.displayName="TableBody",e.s(["TableBody",0,s],942232)},977572,e=>{"use strict";var t=e.i(290571),r=e.i(271645),o=e.i(444755);let a=(0,e.i(673706).makeClassName)("TableCell"),s=r.default.forwardRef((e,s)=>{let{children:n,className:i}=e,l=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("td",Object.assign({ref:s,className:(0,o.tremorTwMerge)(a("root"),"align-middle whitespace-nowrap text-left p-4",i)},l),n))});s.displayName="TableCell",e.s(["TableCell",0,s],977572)},427612,e=>{"use strict";var t=e.i(290571),r=e.i(271645),o=e.i(444755);let a=(0,e.i(673706).makeClassName)("TableHead"),s=r.default.forwardRef((e,s)=>{let{children:n,className:i}=e,l=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("thead",Object.assign({ref:s,className:(0,o.tremorTwMerge)(a("root"),"text-left","text-tremor-content","dark:text-dark-tremor-content",i)},l),n))});s.displayName="TableHead",e.s(["TableHead",0,s],427612)},64848,e=>{"use strict";var t=e.i(290571),r=e.i(271645),o=e.i(444755);let a=(0,e.i(673706).makeClassName)("TableHeaderCell"),s=r.default.forwardRef((e,s)=>{let{children:n,className:i}=e,l=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("th",Object.assign({ref:s,className:(0,o.tremorTwMerge)(a("root"),"whitespace-nowrap text-left font-semibold top-0 px-4 py-3.5","text-tremor-content-strong","dark:text-dark-tremor-content-strong",i)},l),n))});s.displayName="TableHeaderCell",e.s(["TableHeaderCell",0,s],64848)},496020,e=>{"use strict";var t=e.i(290571),r=e.i(271645),o=e.i(444755);let a=(0,e.i(673706).makeClassName)("TableRow"),s=r.default.forwardRef((e,s)=>{let{children:n,className:i}=e,l=(0,t.__rest)(e,["children","className"]);return r.default.createElement(r.default.Fragment,null,r.default.createElement("tr",Object.assign({ref:s,className:(0,o.tremorTwMerge)(a("row"),i)},l),n))});s.displayName="TableRow",e.s(["TableRow",0,s],496020)},68155,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"}))});e.s(["TrashIcon",0,r],68155)},530212,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10 19l-7-7m0 0l7-7m-7 7h18"}))});e.s(["ArrowLeftIcon",0,r],530212)},91739,e=>{"use strict";var t=e.i(544195);e.s(["Radio",()=>t.default])},482725,e=>{"use strict";var t=e.i(244451);e.s(["Spin",()=>t.default])},536916,e=>{"use strict";var t=e.i(374276);e.s(["Checkbox",()=>t.default])},988297,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M12 4v16m8-8H4"}))});e.s(["PlusIcon",0,r],988297)},797672,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z"}))});e.s(["PencilIcon",0,r],797672)},954616,e=>{"use strict";var t=e.i(271645),r=e.i(114272),o=e.i(540143),a=e.i(915823),s=e.i(619273),n=class extends a.Subscribable{#e;#t=void 0;#r;#o;constructor(e,t){super(),this.#e=e,this.setOptions(t),this.bindMethods(),this.#a()}bindMethods(){this.mutate=this.mutate.bind(this),this.reset=this.reset.bind(this)}setOptions(e){let t=this.options;this.options=this.#e.defaultMutationOptions(e),(0,s.shallowEqualObjects)(this.options,t)||this.#e.getMutationCache().notify({type:"observerOptionsUpdated",mutation:this.#r,observer:this}),t?.mutationKey&&this.options.mutationKey&&(0,s.hashKey)(t.mutationKey)!==(0,s.hashKey)(this.options.mutationKey)?this.reset():this.#r?.state.status==="pending"&&this.#r.setOptions(this.options)}onUnsubscribe(){this.hasListeners()||this.#r?.removeObserver(this)}onMutationUpdate(e){this.#a(),this.#s(e)}getCurrentResult(){return this.#t}reset(){this.#r?.removeObserver(this),this.#r=void 0,this.#a(),this.#s()}mutate(e,t){return this.#o=t,this.#r?.removeObserver(this),this.#r=this.#e.getMutationCache().build(this.#e,this.options),this.#r.addObserver(this),this.#r.execute(e)}#a(){let e=this.#r?.state??(0,r.getDefaultState)();this.#t={...e,isPending:"pending"===e.status,isSuccess:"success"===e.status,isError:"error"===e.status,isIdle:"idle"===e.status,mutate:this.mutate,reset:this.reset}}#s(e){o.notifyManager.batch(()=>{if(this.#o&&this.hasListeners()){let t=this.#t.variables,r=this.#t.context,o={client:this.#e,meta:this.options.meta,mutationKey:this.options.mutationKey};if(e?.type==="success"){try{this.#o.onSuccess?.(e.data,t,r,o)}catch(e){Promise.reject(e)}try{this.#o.onSettled?.(e.data,null,t,r,o)}catch(e){Promise.reject(e)}}else if(e?.type==="error"){try{this.#o.onError?.(e.error,t,r,o)}catch(e){Promise.reject(e)}try{this.#o.onSettled?.(void 0,e.error,t,r,o)}catch(e){Promise.reject(e)}}}this.listeners.forEach(e=>{e(this.#t)})})}},i=e.i(912598);e.s(["useMutation",0,function(e,r){let a=(0,i.useQueryClient)(r),[l]=t.useState(()=>new n(a,e));t.useEffect(()=>{l.setOptions(e)},[l,e]);let d=t.useSyncExternalStore(t.useCallback(e=>l.subscribe(o.notifyManager.batchCalls(e)),[l]),()=>l.getCurrentResult(),()=>l.getCurrentResult()),c=t.useCallback((e,t)=>{l.mutate(e,t).catch(s.noop)},[l]);if(d.error&&(0,s.shouldThrowError)(l.options.throwOnError,[d.error]))throw d.error;return{...d,mutate:c,mutateAsync:d.mutate}}],954616)},220508,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"}))});e.s(["CheckCircleIcon",0,r],220508)},888288,e=>{"use strict";var t=e.i(271645);e.s(["default",0,(e,r)=>{let o=void 0!==r,[a,s]=(0,t.useState)(e);return[o?r:a,e=>{o||s(e)}]}])},240647,e=>{"use strict";var t=e.i(286612);e.s(["RightOutlined",()=>t.default])},245704,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let o={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M699 353h-46.9c-10.2 0-19.9 4.9-25.9 13.3L469 584.3l-71.2-98.8c-6-8.3-15.6-13.3-25.9-13.3H325c-6.5 0-10.3 7.4-6.5 12.7l124.6 172.8a31.8 31.8 0 0051.7 0l210.6-292c3.9-5.3.1-12.7-6.4-12.7z"}},{tag:"path",attrs:{d:"M512 64C264.6 64 64 264.6 64 512s200.6 448 448 448 448-200.6 448-448S759.4 64 512 64zm0 820c-205.4 0-372-166.6-372-372s166.6-372 372-372 372 166.6 372 372-166.6 372-372 372z"}}]},name:"check-circle",theme:"outlined"};var a=e.i(9583),s=r.forwardRef(function(e,s){return r.createElement(a.default,(0,t.default)({},e,{ref:s,icon:o}))});e.s(["CheckCircleOutlined",0,s],245704)},518617,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let o={icon:{tag:"svg",attrs:{"fill-rule":"evenodd",viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M512 64c247.4 0 448 200.6 448 448S759.4 960 512 960 64 759.4 64 512 264.6 64 512 64zm0 76c-205.4 0-372 166.6-372 372s166.6 372 372 372 372-166.6 372-372-166.6-372-372-372zm128.01 198.83c.03 0 .05.01.09.06l45.02 45.01a.2.2 0 01.05.09.12.12 0 010 .07c0 .02-.01.04-.05.08L557.25 512l127.87 127.86a.27.27 0 01.05.06v.02a.12.12 0 010 .07c0 .03-.01.05-.05.09l-45.02 45.02a.2.2 0 01-.09.05.12.12 0 01-.07 0c-.02 0-.04-.01-.08-.05L512 557.25 384.14 685.12c-.04.04-.06.05-.08.05a.12.12 0 01-.07 0c-.03 0-.05-.01-.09-.05l-45.02-45.02a.2.2 0 01-.05-.09.12.12 0 010-.07c0-.02.01-.04.06-.08L466.75 512 338.88 384.14a.27.27 0 01-.05-.06l-.01-.02a.12.12 0 010-.07c0-.03.01-.05.05-.09l45.02-45.02a.2.2 0 01.09-.05.12.12 0 01.07 0c.02 0 .04.01.08.06L512 466.75l127.86-127.86c.04-.05.06-.06.08-.06a.12.12 0 01.07 0z"}}]},name:"close-circle",theme:"outlined"};var a=e.i(9583),s=r.forwardRef(function(e,s){return r.createElement(a.default,(0,t.default)({},e,{ref:s,icon:o}))});e.s(["CloseCircleOutlined",0,s],518617)},848725,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M15 12a3 3 0 11-6 0 3 3 0 016 0z"}),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z"}))});e.s(["EyeIcon",0,r],848725)},78085,e=>{"use strict";var t=e.i(290571),r=e.i(103471),o=e.i(888288),a=e.i(271645),s=e.i(444755),n=e.i(673706);let i=(0,n.makeClassName)("Textarea"),l=a.default.forwardRef((e,l)=>{let{value:d,defaultValue:c="",placeholder:u="Type...",error:m=!1,errorMessage:g,disabled:h=!1,className:b,onChange:f,onValueChange:p,autoHeight:C=!1}=e,w=(0,t.__rest)(e,["value","defaultValue","placeholder","error","errorMessage","disabled","className","onChange","onValueChange","autoHeight"]),[k,x]=(0,o.default)(c,d),v=(0,a.useRef)(null),N=(0,r.hasValue)(k);return(0,a.useEffect)(()=>{let e=v.current;if(C&&e){e.style.height="60px";let t=e.scrollHeight;e.style.height=t+"px"}},[C,v,k]),a.default.createElement(a.default.Fragment,null,a.default.createElement("textarea",Object.assign({ref:(0,n.mergeRefs)([v,l]),value:k,placeholder:u,disabled:h,className:(0,s.tremorTwMerge)(i("Textarea"),"w-full flex items-center outline-none rounded-tremor-default px-3 py-2 text-tremor-default focus:ring-2 transition duration-100 border","shadow-tremor-input focus:border-tremor-brand-subtle focus:ring-tremor-brand-muted","dark:shadow-dark-tremor-input focus:dark:border-dark-tremor-brand-subtle focus:dark:ring-dark-tremor-brand-muted",(0,r.getSelectButtonColors)(N,h,m),h?"placeholder:text-tremor-content-subtle dark:placeholder:text-dark-tremor-content-subtle":"placeholder:text-tremor-content dark:placeholder:text-dark-tremor-content",b),"data-testid":"text-area",onChange:e=>{null==f||f(e),x(e.target.value),null==p||p(e.target.value)}},w)),m&&g?a.default.createElement("p",{className:(0,s.tremorTwMerge)(i("errorMessage"),"text-sm text-red-500 mt-1")},g):null)});l.displayName="Textarea",e.s(["Textarea",0,l],78085)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/041lbypm7ppd8.js b/litellm/proxy/_experimental/out/_next/static/chunks/041lbypm7ppd8.js deleted file mode 100644 index 13e6ee51abf..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/041lbypm7ppd8.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,726330,e=>{"use strict";var t,n=e.i(271645),r=e.i(981140),o=e.i(248425),a=e.i(820783),i=e.i(30207),s=e.i(683986),u=e.i(843476),c="dismissableLayer.update",l=n.createContext({layers:new Set,layersWithOutsidePointerEventsDisabled:new Set,branches:new Set,dismissableSurfaces:new Set}),d=n.forwardRef((e,d)=>{let{disableOutsidePointerEvents:p=!1,deferPointerDownOutside:m=!1,onEscapeKeyDown:h,onPointerDownOutside:g,onFocusOutside:E,onInteractOutside:y,onDismiss:b,...w}=e,C=n.useContext(l),[R,D]=n.useState(null),S=R?.ownerDocument??globalThis?.document,[,P]=n.useState({}),L=(0,a.useComposedRefs)(d,D),x=Array.from(C.layers),[T]=[...C.layersWithOutsidePointerEventsDisabled].slice(-1),_=x.indexOf(T),k=R?x.indexOf(R):-1,N=C.layersWithOutsidePointerEventsDisabled.size>0,O=k>=_,F=n.useRef(!1),M=function(e,t){let{ownerDocument:r=globalThis?.document,deferPointerDownOutside:o=!1,isDeferredPointerDownOutsideRef:a,dismissableSurfaces:s}=t,u=(0,i.useCallbackRef)(e),c=n.useRef(!1),l=n.useRef(!1),d=n.useRef(new Map),f=n.useRef(()=>{});return n.useEffect(()=>{function e(){l.current=!1,a.current=!1,d.current.clear()}function t(e){if(!l.current)return;let t=e.target;t instanceof Node&&[...s].some(e=>e.contains(t))||d.current.set(e.type,!0),"click"===e.type&&window.setTimeout(()=>{l.current&&f.current()},0)}function n(e){l.current&&d.current.set(e.type,!1)}let i=t=>{if(t.target&&!c.current){let n=function(){r.removeEventListener("click",f.current);let t=Array.from(d.current.values()).some(Boolean);e(),t||v("dismissableLayer.pointerDownOutside",u,i,{discrete:!0})},i={originalEvent:t};l.current=!0,a.current=o&&0===t.button,d.current.clear(),o&&0===t.button?(r.removeEventListener("click",f.current),f.current=n,r.addEventListener("click",f.current,{once:!0})):n()}else r.removeEventListener("click",f.current),e();c.current=!1},p=["pointerup","mousedown","mouseup","touchstart","touchend","click"];for(let e of p)r.addEventListener(e,t,!0),r.addEventListener(e,n);let m=window.setTimeout(()=>{r.addEventListener("pointerdown",i)},0);return()=>{for(let e of(window.clearTimeout(m),r.removeEventListener("pointerdown",i),r.removeEventListener("click",f.current),p))r.removeEventListener(e,t,!0),r.removeEventListener(e,n)}},[r,u,o,a,s]),{onPointerDownCapture:()=>c.current=!0}}(e=>{let t=e.target;if(!(t instanceof Node))return;let n=[...C.branches].some(e=>e.contains(t));O&&!n&&(g?.(e),y?.(e),e.defaultPrevented||b?.())},{ownerDocument:S,deferPointerDownOutside:m,isDeferredPointerDownOutsideRef:F,dismissableSurfaces:C.dismissableSurfaces}),I=function(e,t=globalThis?.document){let r=(0,i.useCallbackRef)(e),o=n.useRef(!1);return n.useEffect(()=>{let e=e=>{e.target&&!o.current&&v("dismissableLayer.focusOutside",r,{originalEvent:e},{discrete:!1})};return t.addEventListener("focusin",e),()=>t.removeEventListener("focusin",e)},[t,r]),{onFocusCapture:()=>o.current=!0,onBlurCapture:()=>o.current=!1}}(e=>{if(m&&F.current)return;let t=e.target;![...C.branches].some(e=>e.contains(t))&&(E?.(e),y?.(e),e.defaultPrevented||b?.())},S),j=!!R&&k===x.length-1,A=(0,s.useEffectEvent)(e=>{"Escape"===e.key&&(h?.(e),!e.defaultPrevented&&b&&(e.preventDefault(),b()))});return n.useEffect(()=>{if(j)return S.addEventListener("keydown",A,{capture:!0}),()=>S.removeEventListener("keydown",A,{capture:!0})},[S,j]),n.useEffect(()=>{if(R)return p&&(0===C.layersWithOutsidePointerEventsDisabled.size&&(t=S.body.style.pointerEvents,S.body.style.pointerEvents="none"),C.layersWithOutsidePointerEventsDisabled.add(R)),C.layers.add(R),f(),()=>{p&&(C.layersWithOutsidePointerEventsDisabled.delete(R),0===C.layersWithOutsidePointerEventsDisabled.size&&(S.body.style.pointerEvents=t))}},[R,S,p,C]),n.useEffect(()=>()=>{R&&(C.layers.delete(R),C.layersWithOutsidePointerEventsDisabled.delete(R),f())},[R,C]),n.useEffect(()=>{let e=()=>P({});return document.addEventListener(c,e),()=>document.removeEventListener(c,e)},[]),(0,u.jsx)(o.Primitive.div,{...w,ref:L,style:{pointerEvents:N?O?"auto":"none":void 0,...e.style},onFocusCapture:(0,r.composeEventHandlers)(e.onFocusCapture,I.onFocusCapture),onBlurCapture:(0,r.composeEventHandlers)(e.onBlurCapture,I.onBlurCapture),onPointerDownCapture:(0,r.composeEventHandlers)(e.onPointerDownCapture,M.onPointerDownCapture)})});function f(){let e=new CustomEvent(c);document.dispatchEvent(e)}function v(e,t,n,{discrete:r}){let a=n.originalEvent.target,i=new CustomEvent(e,{bubbles:!1,cancelable:!0,detail:n});t&&a.addEventListener(e,t,{once:!0}),r?(0,o.dispatchDiscreteCustomEvent)(a,i):a.dispatchEvent(i)}d.displayName="DismissableLayer",n.forwardRef((e,t)=>{let r=n.useContext(l),i=n.useRef(null),s=(0,a.useComposedRefs)(t,i);return n.useEffect(()=>{let e=i.current;if(e)return r.branches.add(e),()=>{r.branches.delete(e)}},[r.branches]),(0,u.jsx)(o.Primitive.div,{...e,ref:s})}).displayName="DismissableLayerBranch",e.s(["DismissableLayer",0,d,"useDismissableLayerSurface",0,function(){let e=n.useContext(l),[t,r]=n.useState(null);return n.useEffect(()=>{if(t)return e.dismissableSurfaces.add(t),()=>{e.dismissableSurfaces.delete(t)}},[t,e.dismissableSurfaces]),r}])},765491,774606,e=>{"use strict";let t;var n=e.i(271645),r=e.i(820783),o=e.i(248425),a=e.i(30207),i=e.i(843476),s="focusScope.autoFocusOnMount",u="focusScope.autoFocusOnUnmount",c={bubbles:!1,cancelable:!0},l=n.forwardRef((e,t)=>{let{loop:l=!1,trapped:m=!1,onMountAutoFocus:h,onUnmountAutoFocus:g,...E}=e,[y,b]=n.useState(null),w=(0,a.useCallbackRef)(h),C=(0,a.useCallbackRef)(g),R=n.useRef(null),D=(0,r.useComposedRefs)(t,b),S=n.useRef({paused:!1,pause(){this.paused=!0},resume(){this.paused=!1}}).current;n.useEffect(()=>{if(m){let e=function(e){if(S.paused||!y)return;let t=e.target;y.contains(t)?R.current=t:v(R.current,{select:!0})},t=function(e){if(S.paused||!y)return;let t=e.relatedTarget;null!==t&&(y.contains(t)||v(R.current,{select:!0}))};document.addEventListener("focusin",e),document.addEventListener("focusout",t);let n=new MutationObserver(function(e){if(document.activeElement===document.body)for(let t of e)t.removedNodes.length>0&&v(y)});return y&&n.observe(y,{childList:!0,subtree:!0}),()=>{document.removeEventListener("focusin",e),document.removeEventListener("focusout",t),n.disconnect()}}},[m,y,S.paused]),n.useEffect(()=>{if(y){p.add(S);let e=document.activeElement;if(!y.contains(e)){let t=new CustomEvent(s,c);y.addEventListener(s,w),y.dispatchEvent(t),t.defaultPrevented||(function(e,{select:t=!1}={}){let n=document.activeElement;for(let r of e)if(v(r,{select:t}),document.activeElement!==n)return}(d(y).filter(e=>"A"!==e.tagName),{select:!0}),document.activeElement===e&&v(y))}return()=>{y.removeEventListener(s,w),setTimeout(()=>{let t=new CustomEvent(u,c);y.addEventListener(u,C),y.dispatchEvent(t),t.defaultPrevented||v(e??document.body,{select:!0}),y.removeEventListener(u,C),p.remove(S)},0)}}},[y,w,C,S]);let P=n.useCallback(e=>{if(!l&&!m||S.paused)return;let t="Tab"===e.key&&!e.altKey&&!e.ctrlKey&&!e.metaKey,n=document.activeElement;if(t&&n){var r;let t,o=e.currentTarget,[a,i]=[f(t=d(r=o),r),f(t.reverse(),r)];a&&i?e.shiftKey||n!==i?e.shiftKey&&n===a&&(e.preventDefault(),l&&v(i,{select:!0})):(e.preventDefault(),l&&v(a,{select:!0})):n===o&&e.preventDefault()}},[l,m,S.paused]);return(0,i.jsx)(o.Primitive.div,{tabIndex:-1,...E,ref:D,onKeyDown:P})});function d(e){let t=[],n=document.createTreeWalker(e,NodeFilter.SHOW_ELEMENT,{acceptNode:e=>{let t="INPUT"===e.tagName&&"hidden"===e.type;return e.disabled||e.hidden||t?NodeFilter.FILTER_SKIP:e.tabIndex>=0?NodeFilter.FILTER_ACCEPT:NodeFilter.FILTER_SKIP}});for(;n.nextNode();)t.push(n.currentNode);return t}function f(e,t){for(let n of e)if(!function(e,{upTo:t}){if("hidden"===getComputedStyle(e).visibility)return!0;for(;e&&(void 0===t||e!==t);){if("none"===getComputedStyle(e).display)return!0;e=e.parentElement}return!1}(n,{upTo:t}))return n}function v(e,{select:t=!1}={}){if(e&&e.focus){var n;let r=document.activeElement;e.focus({preventScroll:!0}),e!==r&&(n=e)instanceof HTMLInputElement&&"select"in n&&t&&e.select()}}l.displayName="FocusScope";var p=(t=[],{add(e){let n=t[0];e!==n&&n?.pause(),(t=m(t,e)).unshift(e)},remove(e){t=m(t,e),t[0]?.resume()}});function m(e,t){let n=[...e],r=n.indexOf(t);return -1!==r&&n.splice(r,1),n}e.s(["FocusScope",0,l],765491);var h=e.i(174080),g=e.i(934620),E=n.forwardRef((e,t)=>{let{container:r,...a}=e,[s,u]=n.useState(!1);(0,g.useLayoutEffect)(()=>u(!0),[]);let c=r||s&&globalThis?.document?.body;return c?h.createPortal((0,i.jsx)(o.Primitive.div,{...a,ref:t}),c):null});E.displayName="Portal",e.s(["Portal",0,E],774606)},303536,e=>{"use strict";var t=e.i(271645),n=0,r=null;function o(){let e=document.createElement("span");return e.setAttribute("data-radix-focus-guard",""),e.tabIndex=0,e.style.outline="none",e.style.opacity="0",e.style.position="fixed",e.style.pointerEvents="none",e}e.s(["useFocusGuards",0,function(){t.useEffect(()=>{r||(r={start:o(),end:o()});let{start:e,end:t}=r;return document.body.firstElementChild!==e&&document.body.insertAdjacentElement("afterbegin",e),document.body.lastElementChild!==t&&document.body.insertAdjacentElement("beforeend",t),n++,()=>{1===n&&(r?.start.remove(),r?.end.remove(),r=null),n=Math.max(0,n-1)}},[])}])},326999,985369,e=>{"use strict";var t,n,r,o,a,i,s,u=e.i(271645),c=e.i(981140),l=e.i(820783),d=e.i(30030),f=e.i(610772),v=e.i(369340),p=e.i(726330),m=e.i(765491),h=e.i(774606),g=e.i(296626),E=e.i(248425),y=e.i(303536),b=e.i(290571),w="right-scroll-bar-position",C="width-before-scroll-bar";function R(e,t){return"function"==typeof e?e(t):e&&(e.current=t),e}var D="u">typeof window?u.useLayoutEffect:u.useEffect,S=new WeakMap,P=(void 0===t&&(t={}),(void 0===n&&(n=function(e){return e}),r=[],o=!1,a={read:function(){if(o)throw Error("Sidecar: could not `read` from an `assigned` medium. `read` could be used only with `useMedium`.");return r.length?r[r.length-1]:null},useMedium:function(e){var t=n(e,o);return r.push(t),function(){r=r.filter(function(e){return e!==t})}},assignSyncMedium:function(e){for(o=!0;r.length;){var t=r;r=[],t.forEach(e)}r={push:function(t){return e(t)},filter:function(){return r}}},assignMedium:function(e){o=!0;var t=[];if(r.length){var n=r;r=[],n.forEach(e),t=r}var a=function(){var n=t;t=[],n.forEach(e)},i=function(){return Promise.resolve().then(a)};i(),r={push:function(e){t.push(e),i()},filter:function(e){return t=t.filter(e),r}}}}).options=(0,b.__assign)({async:!0,ssr:!1},t),a),L=function(){},x=u.forwardRef(function(e,t){var n,r,o,a,i=u.useRef(null),s=u.useState({onScrollCapture:L,onWheelCapture:L,onTouchMoveCapture:L}),c=s[0],l=s[1],d=e.forwardProps,f=e.children,v=e.className,p=e.removeScrollBar,m=e.enabled,h=e.shards,g=e.sideCar,E=e.noRelative,y=e.noIsolation,w=e.inert,C=e.allowPinchZoom,x=e.as,T=e.gapMode,_=(0,b.__rest)(e,["forwardProps","children","className","removeScrollBar","enabled","shards","sideCar","noRelative","noIsolation","inert","allowPinchZoom","as","gapMode"]),k=(n=[i,t],r=function(e){return n.forEach(function(t){return R(t,e)})},(o=(0,u.useState)(function(){return{value:null,callback:r,facade:{get current(){return o.value},set current(value){var e=o.value;e!==value&&(o.value=value,o.callback(value,e))}}}})[0]).callback=r,a=o.facade,D(function(){var e=S.get(a);if(e){var t=new Set(e),r=new Set(n),o=a.current;t.forEach(function(e){r.has(e)||R(e,null)}),r.forEach(function(e){t.has(e)||R(e,o)})}S.set(a,n)},[n]),a),N=(0,b.__assign)((0,b.__assign)({},_),c);return u.createElement(u.Fragment,null,m&&u.createElement(g,{sideCar:P,removeScrollBar:p,shards:h,noRelative:E,noIsolation:y,inert:w,setCallbacks:l,allowPinchZoom:!!C,lockRef:i,gapMode:T}),d?u.cloneElement(u.Children.only(f),(0,b.__assign)((0,b.__assign)({},N),{ref:k})):u.createElement(void 0===x?"div":x,(0,b.__assign)({},N,{className:v,ref:k}),f))});x.defaultProps={enabled:!0,removeScrollBar:!0,inert:!1},x.classNames={fullWidth:C,zeroRight:w};var T=function(e){var t=e.sideCar,n=(0,b.__rest)(e,["sideCar"]);if(!t)throw Error("Sidecar: please provide `sideCar` property to import the right car");var r=t.read();if(!r)throw Error("Sidecar medium not found");return u.createElement(r,(0,b.__assign)({},n))};T.isSideCarExport=!0;var _=function(){var e=0,t=null;return{add:function(n){if(0==e&&(t=function(){if(!document)return null;var e=document.createElement("style");e.type="text/css";var t=s||("u">typeof __webpack_nonce__?__webpack_nonce__:void 0);return t&&e.setAttribute("nonce",t),e}())){var r,o;(r=t).styleSheet?r.styleSheet.cssText=n:r.appendChild(document.createTextNode(n)),o=t,(document.head||document.getElementsByTagName("head")[0]).appendChild(o)}e++},remove:function(){--e||!t||(t.parentNode&&t.parentNode.removeChild(t),t=null)}}},k=function(){var e=_();return function(t,n){u.useEffect(function(){return e.add(t),function(){e.remove()}},[t&&n])}},N=function(){var e=k();return function(t){return e(t.styles,t.dynamic),null}},O={left:0,top:0,right:0,gap:0},F=function(e){return parseInt(e||"",10)||0},M=function(e){var t=window.getComputedStyle(document.body),n=t["padding"===e?"paddingLeft":"marginLeft"],r=t["padding"===e?"paddingTop":"marginTop"],o=t["padding"===e?"paddingRight":"marginRight"];return[F(n),F(r),F(o)]},I=function(e){if(void 0===e&&(e="margin"),"u"