Merge main into litellm_openai_ws_frame_model_gate

2026-11-01 07:03:02 +00:00 · 2026-10-29 23:42:40 -07:00 · 2026-10-29 23:42:40 -07:00 · af0ad899de
commit af0ad899de
parent 791bc4aad6 23595f7fe5
303 changed files with 14754 additions and 4945 deletions
--- a/.github/workflows/cost-map-guard.yml
+++ b/.github/workflows/cost-map-guard.yml
@ -8,6 +8,7 @@ on:

 permissions:
  contents: read
+  pull-requests: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
@ -21,16 +22,19 @@ jobs:
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          persist-credentials: false
-      - name: Fetch the pull request head, its merge base, and the base branch tip
+      - name: Check out the base branch tip and fetch the pull request head and its merge base
        id: revisions
        env:
          GH_TOKEN: ${{ github.token }}
-          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
-          target="$(gh api "repos/${GITHUB_REPOSITORY}/branches/${BASE_REF}" --jq '.commit.sha')"
+          base_ref="$(gh api "repos/${GITHUB_REPOSITORY}/branches/${EVENT_BASE_REF}" --jq .name)" || base_ref="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .base.ref)"
+          target="$(gh api "repos/${GITHUB_REPOSITORY}/branches/${base_ref}" --jq '.commit.sha')"
          merge_base="$(gh api "repos/${GITHUB_REPOSITORY}/compare/${target}...${HEAD_SHA}" --jq '.merge_base_commit.sha')"
          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA" "$target"
+          git checkout -q --detach "$target"
          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
          echo "target=$target" >> "$GITHUB_OUTPUT"
      - name: Set up uv
--- a/.github/workflows/lens-install-smoke.yml
+++ b/.github/workflows/lens-install-smoke.yml
@ -1,152 +0,0 @@
-name: Lens installation smoke
-
-on:
-  workflow_dispatch:
-    inputs:
-      lens_image:
-        description: Verified baseline Lens image at ghcr.io/berriai/lens@sha256
-        required: true
-        type: string
-      lens_upgrade_image:
-        description: Compatible Lens upgrade image at ghcr.io/berriai/lens@sha256
-        required: true
-        type: string
-      gateway_baseline_ref:
-        description: Previously qualified gateway source commit, full SHA
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: lens-install-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build-images:
-    runs-on: ubuntu-latest-16-cores
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - component: gateway
-            dockerfile: gateway/Dockerfile
-          - component: backend
-            dockerfile: backend/Dockerfile
-          - component: ui
-            dockerfile: ui/Dockerfile
-          - component: migrations
-            dockerfile: migrations/Dockerfile
-          - component: monolith
-            dockerfile: Dockerfile
-          - component: gateway
-            dockerfile: gateway/Dockerfile
-            baseline: true
-          - component: backend
-            dockerfile: backend/Dockerfile
-            baseline: true
-          - component: monolith
-            dockerfile: Dockerfile
-            baseline: true
-    env:
-      COMPONENT: ${{ matrix.component }}
-      DOCKERFILE: ${{ matrix.dockerfile }}
-      SOURCE_REF: ${{ matrix.baseline && inputs.gateway_baseline_ref || github.sha }}
-      IMAGE_TAG: ${{ matrix.baseline && 'v0.0.0-lens-ci-baseline' || 'v0.0.0-lens-ci' }}
-      CURRENT_REF: ${{ github.sha }}
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-          ref: ${{ env.SOURCE_REF }}
-      - name: Verify the selected source
-        shell: bash -euo pipefail {0}
-        run: |
-          [[ "$SOURCE_REF" =~ ^[0-9a-f]{40}$ ]]
-          test "$(git rev-parse HEAD)" = "$SOURCE_REF"
-          if [[ "$IMAGE_TAG" == v0.0.0-lens-ci-baseline ]]; then
-            test "$SOURCE_REF" != "$CURRENT_REF"
-          fi
-      - name: Build the matching release image
-        run: |
-          docker build --build-arg "LITELLM_RELEASE_TAG=$IMAGE_TAG" \
-            -f "$DOCKERFILE" -t "lens-ci-$COMPONENT:$IMAGE_TAG" .
-      - name: Save the matching release image
-        run: |
-          docker save "lens-ci-$COMPONENT:$IMAGE_TAG" \
-            | gzip -1 > "$RUNNER_TEMP/lens-install-$COMPONENT-$IMAGE_TAG.tar.gz"
-      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: lens-install-${{ matrix.component }}-${{ env.IMAGE_TAG }}-${{ github.sha }}
-          path: ${{ runner.temp }}/lens-install-${{ matrix.component }}-${{ env.IMAGE_TAG }}.tar.gz
-          compression-level: 0
-          retention-days: 3
-          if-no-files-found: error
-          overwrite: true
-
-  helm-install:
-    needs: build-images
-    runs-on: ubuntu-latest-16-cores
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-      - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
-        with:
-          pattern: lens-install-*-${{ github.sha }}
-          merge-multiple: true
-          path: ${{ runner.temp }}/lens-install-images
-      - name: Load the matching release images
-        run: |
-          for archive in "$RUNNER_TEMP"/lens-install-images/lens-install-*.tar.gz; do
-            gzip -dc "$archive" | docker load
-            rm "$archive"
-          done
-      - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
-        with:
-          cosign-release: v2.4.3
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ vars.LENS_READ_USER || github.actor }}
-          password: ${{ secrets.LENS_READ_TOKEN }}
-      - name: Verify independent Lens images before loading them
-        env:
-          LENS_IMAGE: ${{ inputs.lens_image }}
-          LENS_UPGRADE_IMAGE: ${{ inputs.lens_upgrade_image }}
-          LENS_PUBLIC_KEY: ${{ vars.LENS_COSIGN_PUBLIC_KEY }}
-          LENS_PUBLIC_KEY_SHA256: ${{ vars.LENS_COSIGN_PUBLIC_KEY_SHA256 }}
-        shell: bash -euo pipefail {0}
-        run: |
-          [[ "$LENS_PUBLIC_KEY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          printf '%s' "$LENS_PUBLIC_KEY" > "$RUNNER_TEMP/lens.pub"
-          echo "$LENS_PUBLIC_KEY_SHA256  $RUNNER_TEMP/lens.pub" | sha256sum --check
-          for image in "$LENS_IMAGE" "$LENS_UPGRADE_IMAGE"; do
-            [[ "$image" =~ ^ghcr.io/berriai/lens@sha256:[0-9a-f]{64}$ ]]
-            cosign verify --key "$RUNNER_TEMP/lens.pub" "$image" > /dev/null
-            cosign verify-attestation --key "$RUNNER_TEMP/lens.pub" --type spdxjson "$image" > /dev/null
-            docker pull "$image"
-          done
-          docker tag "$LENS_IMAGE" lens-ci-worker:baseline
-          docker tag "$LENS_UPGRADE_IMAGE" lens-ci-worker:upgrade
-      - name: Install pinned Kubernetes test tools
-        run: |
-          curl --fail --location --output "$RUNNER_TEMP/kind" \
-            https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
-          echo "a6875aaea358acf0ac07786b1a6755d08fd640f4c79b7a2e46681cc13f49a04b  $RUNNER_TEMP/kind" | sha256sum --check
-          chmod +x "$RUNNER_TEMP/kind"
-          curl --fail --location --output "$RUNNER_TEMP/kubectl" \
-            https://dl.k8s.io/release/v1.32.2/bin/linux/amd64/kubectl
-          echo "4f6a959dcc5b702135f8354cc7109b542a2933c46b808b248a214c1f69f817ea  $RUNNER_TEMP/kubectl" | sha256sum --check
-          chmod +x "$RUNNER_TEMP/kubectl"
-          curl --fail --location --output "$RUNNER_TEMP/helm.tar.gz" \
-            https://get.helm.sh/helm-v3.19.0-linux-amd64.tar.gz
-          echo "a7f81ce08007091b86d8bd696eb4d86b8d0f2e1b9f6c714be62f82f96a594496  $RUNNER_TEMP/helm.tar.gz" | sha256sum --check
-          tar -xzf "$RUNNER_TEMP/helm.tar.gz" -C "$RUNNER_TEMP"
-          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
-          echo "$RUNNER_TEMP/linux-amd64" >> "$GITHUB_PATH"
-      - name: Install, ingest, upgrade, and restart both charts
-        run: bash tests/e2e/migrations/lens_helm_smoke.sh
--- a/.github/workflows/spend-logs-guard.yml
+++ b/.github/workflows/spend-logs-guard.yml
@ -19,17 +19,17 @@ jobs:
    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
-          ref: ${{ github.event.pull_request.base.sha }}
+          ref: ${{ github.event.pull_request.base.ref }}
          persist-credentials: false
      - name: Fetch the pull request head, its merge base and its reviews
        id: revisions
        env:
          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
        run: |
-          merge_base="$(gh api "repos/${GITHUB_REPOSITORY}/compare/${BASE_SHA}...${HEAD_SHA}" --jq '.merge_base_commit.sha')"
+          merge_base="$(gh api "repos/${GITHUB_REPOSITORY}/compare/${BASE_REF}...${HEAD_SHA}" --jq '.merge_base_commit.sha')"
          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
          gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/reviews" --paginate --slurp | jq 'add // []' > "$RUNNER_TEMP/reviews.json"
          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
--- a/.github/workflows/test-linting.yml
+++ b/.github/workflows/test-linting.yml
@ -48,11 +48,13 @@ jobs:
        if: steps.changes.outputs.decision != 'skip'
        env:
          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
-          MERGE_BASE=$(retry gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
+          BASE_REF=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${EVENT_BASE_REF}" --jq .name) || BASE_REF=$(retry gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .base.ref)
+          MERGE_BASE=$(retry gh api "repos/${GITHUB_REPOSITORY}/compare/${BASE_REF}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
          test -n "$MERGE_BASE"
          retry git fetch --no-tags --depth=1 origin "$MERGE_BASE"
          echo "GATE_BASE_SHA=$MERGE_BASE" >> "$GITHUB_ENV"
@ -264,6 +266,7 @@ jobs:
    name: ui
    permissions:
      contents: read
+      pull-requests: read
    runs-on: ubuntu-latest
    timeout-minutes: 8
    defaults:
@ -281,16 +284,12 @@ jobs:
        id: changed
        env:
          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
-          # base.sha is the base branch tip from when the PR was opened, while
-          # actions/checkout leaves HEAD on a merge of the PR into the *current*
-          # base tip. "$BASE_SHA"...HEAD therefore spans every base-branch commit
-          # landed since, so a PR that touches no UI file still gets linted
-          # against hundreds of other people's files. Diff the PR head against its
-          # own merge base instead, which is exactly what this PR changed.
-          merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
+          base_ref=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${EVENT_BASE_REF}" --jq .name) || base_ref=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .base.ref)
+          merge_base=$(gh api "repos/${GITHUB_REPOSITORY}/compare/${base_ref}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
          test -n "$merge_base"
          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
          : > "$RUNNER_TEMP/prettier_files.txt"
@ -630,6 +629,12 @@ jobs:
      - name: check_migrations_lock_timeout
        run: uv run --no-sync python ./tests/code_coverage_tests/check_migrations_lock_timeout.py

+      - name: check_no_none_string_error_fields
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_no_none_string_error_fields.py
+
+      - name: test_check_no_none_string_error_fields
+        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_check_no_none_string_error_fields.py
+
      - name: check_no_publicly_known_master_key
        run: uv run --no-sync python ./tests/code_coverage_tests/check_no_publicly_known_master_key.py

--- a/.github/workflows/test-unit.yml
+++ b/.github/workflows/test-unit.yml
@ -245,6 +245,7 @@ jobs:
              tests/unit/llms/chatgpt
              tests/unit/llms/clarifai
              tests/unit/llms/claude_code
+              tests/unit/llms/clf_ai_gateway
              tests/unit/llms/cloudflare
              tests/unit/llms/codestral
              tests/unit/llms/codex
@ -1003,9 +1004,9 @@ jobs:
        run: |
          diff -u model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
          if [ -z "$RUST_BRIDGE_ARTIFACT" ]; then
-            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra caching --extra extra_proxy --extra proxy-runtime --extra utils
+            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra extra_proxy --extra proxy-runtime --extra utils
          else
-            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra caching --extra extra_proxy --extra proxy-runtime --extra utils --no-install-project
+            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra extra_proxy --extra proxy-runtime --extra utils --no-install-project
            uv pip install --no-deps --python .venv/bin/python rust-bridge-dist/*.whl
            cp rust-bridge-dist/litellm/rust_bridge/_native.abi3.so litellm/rust_bridge/_native.abi3.so
            uv run --no-sync python -c "import importlib.metadata; import litellm.rust_bridge._native; print(importlib.metadata.version('litellm'))"
@ -1150,18 +1151,20 @@ jobs:
        env:
          CI: "true"
          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          full_suite() { npm run test -- --run --pool forks --maxWorkers=14; }

-          if [ -z "$BASE_SHA" ]; then
+          if [ -z "$PR_NUMBER" ]; then
            echo "Push to $GITHUB_REF_NAME: running the full suite"
            full_suite
            exit 0
          fi

-          merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
+          base_ref=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${EVENT_BASE_REF}" --jq .name) || base_ref=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .base.ref)
+          merge_base=$(gh api "repos/${GITHUB_REPOSITORY}/compare/${base_ref}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
          test -n "$merge_base"
          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
          changed_files=()
@ -1451,9 +1454,9 @@ jobs:
          RUST_BRIDGE_ARTIFACT: ${{ needs.rust-bridge.outputs.artifact }}
        run: |
          if [ -z "$RUST_BRIDGE_ARTIFACT" ]; then
-            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra caching --extra extra_proxy --extra proxy-runtime --extra utils
+            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra extra_proxy --extra proxy-runtime --extra utils
          else
-            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra caching --extra extra_proxy --extra proxy-runtime --extra utils --no-install-project
+            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra extra_proxy --extra proxy-runtime --extra utils --no-install-project
            uv pip install --no-deps --python .venv/bin/python rust-bridge-dist/*.whl
            cp rust-bridge-dist/litellm/rust_bridge/_native.abi3.so litellm/rust_bridge/_native.abi3.so
          fi
--- a/2
+++ b/2
@ -153,7 +153,7 @@ lint-install:
 # the same set CI's ':(glob)litellm/**/*.py' selects.
 lint-format-check-changed: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
 	@base_ref=$$($(RESOLVE_BASE)) && \
-	changed=$$(git diff --name-only --diff-filter=ACMR "$$base_ref...HEAD" -- 'litellm/*.py') && \
+	changed=$$(git diff --name-only --diff-filter=ACMR --merge-base "$$base_ref" -- 'litellm/*.py') && \
 	files=$$(printf '%s\n' "$$changed" | grep -v '^litellm/enterprise/' || true) || exit $$?; \
 	if [ -z "$$files" ]; then \
 		echo "No changed litellm Python files to format-check."; \
--- a/README.md
+++ b/README.md
@ -379,6 +379,7 @@ Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call th
 | [Bytez (`bytez`)](https://docs.litellm.ai/docs/providers/bytez) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Cerebras (`cerebras`)](https://docs.litellm.ai/docs/providers/cerebras) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Clarifai (`clarifai`)](https://docs.litellm.ai/docs/providers/clarifai) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
+| [CLF AI Gateway (`clf_ai_gateway`)](https://docs.litellm.ai/docs/providers/clf_ai_gateway) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Cloudflare AI Workers (`cloudflare`)](https://docs.litellm.ai/docs/providers/cloudflare_workers) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Codestral (`codestral`)](https://docs.litellm.ai/docs/providers/codestral) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Cognition (`cognition`)](https://docs.litellm.ai/docs/providers/cognition) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
@ -398,6 +399,7 @@ Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call th
 | [Eden AI (`edenai`)](https://docs.litellm.ai/docs/providers/edenai) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |  |  |  |
 | [ElevenLabs (`elevenlabs`)](https://docs.litellm.ai/docs/providers/elevenlabs) | ✅ | ✅ | ✅ |  |  | ✅ | ✅ |  |  |  |
 | [Empower (`empower`)](https://docs.litellm.ai/docs/providers/empower) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
+| [eu/jev Decisions API (`eu_jev`)](https://docs.litellm.ai/docs/pass_through/eu_jev) |  |  |  |  |  |  |  |  |  |  |
 | [Fal AI (`fal_ai`)](https://docs.litellm.ai/docs/providers/fal_ai) | ✅ | ✅ | ✅ |  | ✅ |  |  |  |  |  |
 | [Featherless AI (`featherless_ai`)](https://docs.litellm.ai/docs/providers/featherless_ai) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Fireworks AI (`fireworks_ai`)](https://docs.litellm.ai/docs/providers/fireworks_ai) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
--- a/enterprise/pyproject.toml
+++ b/enterprise/pyproject.toml
@ -1,6 +1,6 @@
 [project]
 name = "litellm-enterprise"
-version = "0.1.80"
+version = "0.1.81"
 description = "Package for LiteLLM Enterprise features"
 readme = "README.md"
 requires-python = ">=3.9"
@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""

 [tool.commitizen]
-version = "0.1.80"
+version = "0.1.81"
 version_files = [
    "pyproject.toml:^version",
    "../pyproject.toml:litellm-enterprise==",
--- a/gateway/routes/allowlist.py
+++ b/gateway/routes/allowlist.py
@ -142,6 +142,7 @@ GATEWAY_EXACT_PATHS: frozenset[str] = frozenset(
        "/test",
        "/debug/memory/summary",
        "/api/event_logging/batch",
+        "/eu_jev/v1/systemone",
    }
 )

--- a/helm/litellm-helm/Chart.lock
+++ b/helm/litellm-helm/Chart.lock
@ -5,8 +5,5 @@ dependencies:
 - name: redis
  repository: oci://registry-1.docker.io/bitnamicharts
  version: 18.19.1
- name: lens
-  repository: oci://ghcr.io/berriai/charts
-  version: 0.1.0-dev.0
-digest: sha256:16b92c3d7fc74632e8aa11e602c136d273c774ed39b2fe970b80273e0570898b
-generated: '2026-10-09T04:18:10.643228000Z'
+digest: sha256:38962e231f6596b93f82a8412bbe4cf5de696caecf5775dfbbd163383eb1c009
+generated: '2026-10-30T02:13:11.505726000Z'
--- a/helm/litellm-helm/Chart.yaml
+++ b/helm/litellm-helm/Chart.yaml
@ -39,6 +39,3 @@ dependencies:
    version: "18.19.1"
    repository: oci://registry-1.docker.io/bitnamicharts
    condition: redis.enabled
-  - name: lens
-    version: 0.1.0-dev.0
-    repository: oci://ghcr.io/berriai/charts
--- a/helm/litellm-helm/README.md
+++ b/helm/litellm-helm/README.md
@ -256,9 +256,7 @@ itself.

 ## Connect Lens

-`lensWorker.mode` selects `disabled`, `bundled` or `external`. Bundled mode generates separate service and identity-signing credentials. External mode requires `lensWorker.gateway.secretName` and `lensWorker.serviceTokenSecret.name`; their keys default to `gateway-secret` and `service-token`. Provision distinct values matching the external Lens deployment
-
-Follow the [Lens Helm connection guide](https://github.com/BerriAI/lens/blob/main/helm/lens/README.md#connect-a-gateway) for complete values, verification, GitOps credential requirements and existing-data migration. Source-chart installation requires a built Lens image until the first signed Lens release is published
+This chart does not deploy Lens. Deploy Lens from [its own chart](https://github.com/BerriAI/lens/tree/main/helm/lens), then set `lens.enabled: true`, `lens.url`, `lens.publicUrl`, `lens.gatewaySecret.name` and `lens.serviceTokenSecret.name`. The secret keys default to `gateway-secret` and `service-token`. Set `lens.service.name` when that Lens runs in this release's namespace and the chart ingress should route `/lens-ingest` to it. The old `lensWorker` values are no longer read, and enabling them fails the render

 ## Shutdown accounting

--- a/helm/litellm-helm/charts/lens-0.1.0-dev.0.tgz
+++ b/helm/litellm-helm/charts/lens-0.1.0-dev.0.tgz
--- a/helm/litellm-helm/templates/_helpers.tpl
+++ b/helm/litellm-helm/templates/_helpers.tpl
@ -372,10 +372,6 @@ through an emptyDir. Empty when the sidecar is off or uses 127.0.0.1 TCP.
  value: {{ .Values.collector.drainTimeoutSeconds | quote }}
 {{- end -}}

-{{- define "litellm.lensWorker.image" -}}
-{{- include "lens.image" (dict "Values" .Values.lensWorker "Chart" .Subcharts.lens.Chart) -}}
-{{- end -}}
-
 {{- define "litellm.gateway.collectorSocketDir" -}}
 {{- if and .Values.gateway.collector.enabled (hasPrefix "unix://" .Values.gateway.collector.address) -}}
 {{- dir (trimPrefix "unix://" .Values.gateway.collector.address) -}}
@ -402,95 +398,28 @@ shutdown drain window.
 {{- end }}
 {{- end -}}

-{{- define "litellm.lensWorker.labels" -}}
-{{- $labels := include "litellm.labels" . | fromYaml -}}
-{{- $_ := set $labels "app.kubernetes.io/name" (printf "%s-lens-worker" (include "litellm.name" . | trunc 51 | trimSuffix "-")) -}}
-{{- toYaml $labels -}}
-{{- end -}}
-
-{{- define "litellm.lensWorker.serviceTokenSecretName" -}}
-{{- .Values.lensWorker.serviceTokenSecret.name | default (printf "%s-lens-service" (include "litellm.fullname" .)) -}}
-{{- end -}}
-
-{{- define "litellm.lensWorker.gatewaySecretName" -}}
-{{- .Values.lensWorker.gateway.secretName | default (printf "%s-lens-gateway" (include "litellm.fullname" . | trunc 50 | trimSuffix "-")) -}}
-{{- end -}}
-
-{{- define "litellm.lensWorker.bundledClickhouse" -}}
-{{- if and (eq (include "litellm.lens.mode" .) "bundled") .Values.lensWorker.clickhouse.enabled (not .Values.lensWorker.clickhouseSecret.name) -}}true{{- end -}}
-{{- end -}}
-
-{{- define "litellm.lensWorker.publicUrl" -}}
-{{- if .Values.lensWorker.publicUrl -}}
-{{- .Values.lensWorker.publicUrl -}}
-{{- else if eq (include "litellm.lens.mode" .) "external" -}}
-{{- fail "lensWorker.publicUrl is required for external Lens" -}}
-{{- else if .Values.lensWorker.ingress.enabled -}}
-{{- $tls := or (not (empty .Values.lensWorker.ingress.tls)) (hasKey .Values.lensWorker.ingress.annotations "alb.ingress.kubernetes.io/certificate-arn") -}}
-{{- printf "%s://%s" (ternary "https" "http" $tls) (required "lensWorker.ingress.host is required" .Values.lensWorker.ingress.host) -}}
-{{- else if and .Values.ingress.enabled (eq (len .Values.ingress.hosts) 1) -}}
-{{- $host := required "ingress.hosts[0].host is required" (first .Values.ingress.hosts).host -}}
-{{- $tls := or (not (empty .Values.ingress.tls)) (hasKey .Values.ingress.annotations "alb.ingress.kubernetes.io/certificate-arn") -}}
-{{- printf "%s://%s/lens-ingest" (ternary "https" "http" $tls) $host -}}
-{{- else -}}
-{{- fail "lensWorker.publicUrl is required when there is no single ingress hostname" -}}
-{{- end -}}
-{{- end -}}
-
-{{- define "litellm.lensWorker.clickhouseName" -}}
-{{- printf "%s-lens-clickhouse" (include "litellm.fullname" . | trunc 47 | trimSuffix "-") -}}
-{{- end -}}
-
 {{- define "litellm.lensConnectionEnv" -}}
-{{- $mode := include "litellm.lens.mode" . -}}
-{{- if ne $mode "disabled" }}
-{{- if and (eq $mode "external") (not .Values.lensWorker.serviceTokenSecret.name) -}}
-{{- fail "lensWorker.serviceTokenSecret.name is required for external Lens" -}}
+{{- with .Values.lensWorker }}
+{{- if or .enabled (and .mode (ne .mode "disabled")) }}
+{{- fail "lensWorker was removed; deploy Lens from its own chart and set lens.* instead, see the chart README" }}
 {{- end }}
-{{- if and (eq $mode "external") (not .Values.lensWorker.gateway.secretName) -}}
-{{- fail "lensWorker.gateway.secretName is required for external Lens" -}}
-{{- end -}}
+{{- end }}
+{{- with .Values.lens }}
+{{- if .enabled }}
 - name: LITELLM_LENS_URL
-  value: {{ if eq $mode "external" }}{{ required "lensWorker.externalUrl is required for external Lens" .Values.lensWorker.externalUrl | quote }}{{ else }}{{ printf "http://%s-lens-worker:%v" (include "litellm.fullname" .) .Values.lensWorker.service.port | quote }}{{ end }}
+  value: {{ required "lens.url is required when lens.enabled is true" .url | quote }}
 - name: LITELLM_LENS_PUBLIC_URL
-  value: {{ include "litellm.lensWorker.publicUrl" . | quote }}
+  value: {{ required "lens.publicUrl is required when lens.enabled is true" .publicUrl | quote }}
 - name: LENS_GATEWAY_SECRET
  valueFrom:
    secretKeyRef:
-      name: {{ include "litellm.lensWorker.gatewaySecretName" . | quote }}
-      key: {{ .Values.lensWorker.gateway.secretKey | quote }}
+      name: {{ required "lens.gatewaySecret.name is required when lens.enabled is true" .gatewaySecret.name | quote }}
+      key: {{ .gatewaySecret.key | quote }}
 - name: LITELLM_LENS_SERVICE_TOKEN
  valueFrom:
    secretKeyRef:
-      name: {{ include "litellm.lensWorker.serviceTokenSecretName" . | quote }}
-      key: {{ .Values.lensWorker.serviceTokenSecret.key | quote }}
+      name: {{ required "lens.serviceTokenSecret.name is required when lens.enabled is true" .serviceTokenSecret.name | quote }}
+      key: {{ .serviceTokenSecret.key | quote }}
+{{- end }}
 {{- end }}
 {{- end -}}
-
-{{- define "litellm.lens.mode" -}}
-{{- $mode := .Values.lensWorker.mode | default (ternary "bundled" "disabled" .Values.lensWorker.enabled) -}}
-{{- if not (has $mode (list "bundled" "external" "disabled")) -}}
-{{- fail "lensWorker.mode must be bundled, external or disabled" -}}
-{{- end -}}
-{{- $mode -}}
-{{- end -}}
-
-{{- define "litellm.lens.render" -}}
-{{- $root := .root -}}
-{{- $values := mergeOverwrite (deepCopy $root.Subcharts.lens.Values) (deepCopy $root.Values.lensWorker) -}}
-{{- $_ := set $values "fullnameOverride" (printf "%s-lens-worker" (include "litellm.fullname" $root)) -}}
-{{- $_ := set $values "component" "lens-worker" -}}
-{{- $_ := set $values "nameOverride" (printf "%s-lens-worker" (include "litellm.name" $root | trunc 51 | trimSuffix "-")) -}}
-{{- $_ := set $values "imagePullSecrets" $root.Values.imagePullSecrets -}}
-{{- $_ := set $values.gateway "enabled" true -}}
-{{- $_ := set $values.gateway "generatedName" (include "litellm.lensWorker.gatewaySecretName" $root) -}}
-{{- $_ := set $values.clickhouse "nameOverride" (include "litellm.lensWorker.clickhouseName" $root) -}}
-{{- $_ := set $values.serviceTokenSecret "generatedName" (include "litellm.lensWorker.serviceTokenSecretName" $root) -}}
-{{- $_ := set $values "publicUrl" ($root.Values.lensWorker.standaloneUrl | default $root.Subcharts.lens.Values.publicUrl) -}}
-{{- if and (eq .resource "deployment") (or $root.Values.lensWorker.publicUrl $root.Values.lensWorker.ingress.enabled $root.Values.ingress.enabled) -}}
-{{- $ingestion := include "litellm.lensWorker.publicUrl" $root -}}
-{{- $_ := set $values "ingestionUrl" $ingestion -}}
-{{- $_ := set $values "publicUrl" ($root.Values.lensWorker.standaloneUrl | default (trimSuffix "/lens-ingest" $ingestion)) -}}
-{{- end -}}
-{{- include (printf "lens.%s" .resource) (dict "Values" $values "Release" $root.Release "Chart" $root.Subcharts.lens.Chart "Capabilities" $root.Capabilities) -}}
-{{- end -}}
--- a/helm/litellm-helm/templates/ingress.yaml
+++ b/helm/litellm-helm/templates/ingress.yaml
@ -1,8 +1,6 @@
 {{- if .Values.ingress.enabled -}}
 {{- $fullName := include "litellm.fullname" . -}}
 {{- $svcPort := .Values.service.port -}}
-{{- $lensMode := include "litellm.lens.mode" . -}}
-{{- $lensService := .Values.lensWorker.externalServiceName | default (printf "%s-lens-worker" $fullName) -}}
 {{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
@ -46,18 +44,18 @@ spec:
    - host: {{ .host | quote }}
      http:
        paths:
-          {{- if or (eq $lensMode "bundled") (and (eq $lensMode "external") $.Values.lensWorker.externalServiceName) }}
+          {{- if and $.Values.lens.enabled $.Values.lens.service.name }}
          - path: /lens-ingest
            pathType: Prefix
            backend:
              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
              service:
-                name: {{ if eq $lensMode "external" }}{{ $lensService }}{{ else }}{{ $fullName }}-lens-worker{{ end }}
+                name: {{ $.Values.lens.service.name }}
                port:
-                  number: {{ $.Values.lensWorker.service.port }}
+                  number: {{ $.Values.lens.service.port }}
              {{- else }}
-              serviceName: {{ if eq $lensMode "external" }}{{ $lensService }}{{ else }}{{ $fullName }}-lens-worker{{ end }}
-              servicePort: {{ $.Values.lensWorker.service.port }}
+              serviceName: {{ $.Values.lens.service.name }}
+              servicePort: {{ $.Values.lens.service.port }}
              {{- end }}
          {{- end }}
          {{- range .paths }}
--- a/helm/litellm-helm/templates/lens/clickhouse.yaml
+++ b/helm/litellm-helm/templates/lens/clickhouse.yaml
@ -1,3 +0,0 @@
-{{- if eq (include "litellm.lens.mode" .) "bundled" }}
-{{ include "litellm.lens.render" (dict "root" . "resource" "clickhouse") }}
-{{- end }}
--- a/helm/litellm-helm/templates/lens/deployment.yaml
+++ b/helm/litellm-helm/templates/lens/deployment.yaml
@ -1,3 +0,0 @@
-{{- if eq (include "litellm.lens.mode" .) "bundled" }}
-{{ include "litellm.lens.render" (dict "root" . "resource" "deployment") }}
-{{- end }}
--- a/helm/litellm-helm/templates/lens/ingress.yaml
+++ b/helm/litellm-helm/templates/lens/ingress.yaml
@ -1,3 +0,0 @@
-{{- if eq (include "litellm.lens.mode" .) "bundled" }}
-{{ include "litellm.lens.render" (dict "root" . "resource" "ingress") }}
-{{- end }}
--- a/helm/litellm-helm/templates/lens/secrets.yaml
+++ b/helm/litellm-helm/templates/lens/secrets.yaml
@ -1,3 +0,0 @@
-{{- if eq (include "litellm.lens.mode" .) "bundled" }}
-{{ include "litellm.lens.render" (dict "root" . "resource" "secrets") }}
-{{- end }}
--- a/helm/litellm-helm/templates/lens/service.yaml
+++ b/helm/litellm-helm/templates/lens/service.yaml
@ -1,3 +0,0 @@
-{{- if eq (include "litellm.lens.mode" .) "bundled" }}
-{{ include "litellm.lens.render" (dict "root" . "resource" "service") }}
-{{- end }}
--- a/helm/litellm-helm/tests/lens_connection_tests.yaml
+++ b/helm/litellm-helm/tests/lens_connection_tests.yaml
@ -0,0 +1,128 @@
+suite: lens connection
+templates:
+  - deployment.yaml
+  - configmap-litellm.yaml
+  - ingress.yaml
+tests:
+  - it: connects the proxy to an external Lens
+    template: deployment.yaml
+    set:
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_LENS_URL
+            value: http://lens.lens.svc:4318
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_LENS_PUBLIC_URL
+            value: https://lens.example.com/lens-ingest
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LENS_GATEWAY_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: lens-gateway
+                key: gateway-secret
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_LENS_SERVICE_TOKEN
+            valueFrom:
+              secretKeyRef:
+                name: lens-service
+                key: service-token
+
+  - it: requires lens.url when Lens is enabled
+    template: deployment.yaml
+    set:
+      lens.enabled: true
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - failedTemplate:
+          errorMessage: lens.url is required when lens.enabled is true
+
+  - it: requires lens.publicUrl when Lens is enabled
+    template: deployment.yaml
+    set:
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - failedTemplate:
+          errorMessage: lens.publicUrl is required when lens.enabled is true
+
+  - it: requires lens.gatewaySecret.name when Lens is enabled
+    template: deployment.yaml
+    set:
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - failedTemplate:
+          errorMessage: lens.gatewaySecret.name is required when lens.enabled is true
+
+  - it: requires lens.serviceTokenSecret.name when Lens is enabled
+    template: deployment.yaml
+    set:
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+    asserts:
+      - failedTemplate:
+          errorMessage: lens.serviceTokenSecret.name is required when lens.enabled is true
+
+  - it: routes /lens-ingest to the named Lens service ahead of the host paths
+    template: ingress.yaml
+    set:
+      ingress.enabled: true
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+      lens.service.name: existing-lens
+    asserts:
+      - equal:
+          path: spec.rules[0].http.paths[0].path
+          value: /lens-ingest
+      - contains:
+          path: spec.rules[0].http.paths
+          content:
+            path: /lens-ingest
+            pathType: Prefix
+            backend:
+              service:
+                name: existing-lens
+                port:
+                  number: 4318
+
+  - it: leaves /lens-ingest off the ingress without a Lens service name
+    template: ingress.yaml
+    set:
+      ingress.enabled: true
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - exists:
+          path: spec.rules[0].http.paths
+      - notContains:
+          path: spec.rules[0].http.paths
+          content:
+            path: /lens-ingest
+          any: true
--- a/helm/litellm-helm/tests/lens_endpoint_defaults_tests.yaml
+++ b/helm/litellm-helm/tests/lens_endpoint_defaults_tests.yaml
@ -1,84 +0,0 @@
-suite: Lens endpoint defaults
-templates:
-  - deployment.yaml
-  - configmap-litellm.yaml
-set:
-  lensWorker.enabled: true
-  ingress.enabled: true
-  ingress.hosts: [{host: gateway.example, paths: [{path: /, pathType: Prefix}]}]
-  ingress.tls:
-    - hosts: [gateway.example]
-      secretName: tls
-tests:
-  - it: derives the trace endpoint from the deployment hostname and TLS
-    template: deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: https://gateway.example/lens-ingest
-  - it: preserves an explicitly configured public address
-    set:
-      lensWorker.publicUrl: https://custom.example/prefix
-    template: deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: https://custom.example/prefix
-  - it: uses the dedicated Lens ingress when configured
-    set:
-      lensWorker.ingress.enabled: true
-      lensWorker.ingress.host: traces.example
-      lensWorker.ingress.tls:
-        - hosts: [traces.example]
-          secretName: traces-tls
-    template: deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: https://traces.example
-  - it: uses HTTPS for a dedicated ALB ingress with certificate annotations
-    set:
-      lensWorker.ingress.enabled: true
-      lensWorker.ingress.host: traces.example
-      lensWorker.ingress.className: alb
-      lensWorker.ingress.tls: []
-      lensWorker.ingress.annotations:
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:123456789012:certificate/test
-        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
-        alb.ingress.kubernetes.io/ssl-redirect: "443"
-    template: deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: https://traces.example
-  - it: uses HTTP for a dedicated ingress without its own TLS
-    set:
-      lensWorker.ingress.enabled: true
-      lensWorker.ingress.host: traces.example
-      lensWorker.ingress.tls: []
-      lensWorker.ingress.annotations: {}
-    template: deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: http://traces.example
-  - it: uses HTTP when ingress has no TLS
-    set:
-      ingress.tls: []
-    template: deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: http://gateway.example/lens-ingest
--- a/helm/litellm-helm/tests/lens_modes_tests.yaml
+++ b/helm/litellm-helm/tests/lens_modes_tests.yaml
@ -1,187 +0,0 @@
---
-suite: Lens deployment modes
-templates:
- ingress.yaml
- configmap-litellm.yaml
- deployment.yaml
- lens/deployment.yaml
- lens/service.yaml
- lens/clickhouse.yaml
- lens/secrets.yaml
-set:
-  lensWorker.publicUrl: https://traces.example
-tests:
- it: retains the existing deployment before transferring its release ownership
-  template: lens/deployment.yaml
-  set:
-    lensWorker.mode: bundled
-    lensWorker.retainResources: true
-  asserts:
-  - equal:
-      path: metadata.annotations["helm.sh/resource-policy"]
-      value: keep
- it: connects an external deployment without installing Lens resources
-  templates:
-  - lens/deployment.yaml
-  - lens/service.yaml
-  - lens/clickhouse.yaml
-  - lens/secrets.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://lens.other-namespace:4318
-    lensWorker.serviceTokenSecret.name: external-lens-signing
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - hasDocuments:
-      count: 0
- it: sends delegated requests to the explicitly selected external Lens
-  template: deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://lens.other-namespace:4318
-    lensWorker.serviceTokenSecret.name: external-lens-signing
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_URL
-        value: http://lens.other-namespace:4318
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_GATEWAY_SECRET
-        valueFrom:
-          secretKeyRef:
-            name: external-lens-signing
-            key: gateway-secret
- it: disables Lens explicitly even with a retained legacy enable flag
-  template: lens/deployment.yaml
-  set:
-    lensWorker.mode: disabled
-    lensWorker.enabled: true
-  asserts:
-  - hasDocuments:
-      count: 0
- it: bundles Lens through explicit mode selection
-  template: lens/deployment.yaml
-  set:
-    lensWorker.mode: bundled
-  asserts:
-  - hasDocuments:
-      count: 1
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_MODE
-        value: standalone
- it: uses separate credentials for external identity and service access
-  template: deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.serviceTokenSecret: {name: worker-service, key: token}
-    lensWorker.gateway: {secretName: delegated-identity, secretKey: signature}
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_GATEWAY_SECRET
-        valueFrom:
-          secretKeyRef: {name: delegated-identity, key: signature}
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_SERVICE_TOKEN
-        valueFrom:
-          secretKeyRef: {name: worker-service, key: token}
- it: supplies the same separate signing secret to the bundled service
-  template: lens/deployment.yaml
-  set:
-    lensWorker.mode: bundled
-    lensWorker.gateway: {secretName: delegated-identity, secretKey: signature}
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_GATEWAY_SECRET
-        valueFrom:
-          secretKeyRef: {name: delegated-identity, key: signature}
- it: routes explicit bundled mode with the enable flag off
-  template: ingress.yaml
-  set:
-    fullnameOverride: gateway
-    ingress.enabled: true
-    ingress.hosts: [{host: gateway.example, paths: [{path: /, pathType: Prefix}]}]
-    lensWorker.mode: bundled
-    lensWorker.enabled: false
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.externalServiceName: ""
-    lensWorker.serviceTokenSecret.name: worker-service
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - contains:
-      path: spec.rules[0].http.paths
-      content:
-        path: /lens-ingest
-        pathType: Prefix
-        backend:
-          service:
-            name: gateway-lens-worker
-            port: {number: 4318}
- it: routes external mode to its selected service
-  template: ingress.yaml
-  set:
-    fullnameOverride: gateway
-    ingress.enabled: true
-    ingress.hosts: [{host: gateway.example, paths: [{path: /, pathType: Prefix}]}]
-    lensWorker.mode: external
-    lensWorker.enabled: true
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.externalServiceName: "existing-lens"
-    lensWorker.serviceTokenSecret.name: worker-service
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - contains:
-      path: spec.rules[0].http.paths
-      content:
-        path: /lens-ingest
-        pathType: Prefix
-        backend:
-          service:
-            name: existing-lens
-            port: {number: 4318}
- it: omits ingestion when an external service has no ingress backend
-  template: ingress.yaml
-  set:
-    fullnameOverride: gateway
-    ingress.enabled: true
-    ingress.hosts: [{host: gateway.example, paths: [{path: /, pathType: Prefix}]}]
-    lensWorker.mode: external
-    lensWorker.enabled: true
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.externalServiceName: ""
-    lensWorker.serviceTokenSecret.name: worker-service
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - notContains:
-      path: spec.rules[0].http.paths
-      content: {path: /lens-ingest}
-      any: true
- it: omits ingestion for disabled mode with the enable flag on
-  template: ingress.yaml
-  set:
-    fullnameOverride: gateway
-    ingress.enabled: true
-    ingress.hosts: [{host: gateway.example, paths: [{path: /, pathType: Prefix}]}]
-    lensWorker.mode: disabled
-    lensWorker.enabled: true
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.externalServiceName: ""
-    lensWorker.serviceTokenSecret.name: worker-service
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - notContains:
-      path: spec.rules[0].http.paths
-      content: {path: /lens-ingest}
-      any: true
--- a/helm/litellm-helm/tests/lens_modes_validation_tests.yaml
+++ b/helm/litellm-helm/tests/lens_modes_validation_tests.yaml
@ -1,52 +0,0 @@
---
-suite: Lens deployment mode validation
-templates:
- configmap-litellm.yaml
- deployment.yaml
-set:
-  lensWorker.publicUrl: https://traces.example
-tests:
- it: requires a separate identity signing reference for external Lens
-  template: deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://lens.other-namespace:4318
-    lensWorker.serviceTokenSecret.name: worker-service
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.gateway.secretName is required for external Lens
- it: requires an external service address
-  template: deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.serviceTokenSecret.name: external-lens-signing
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.externalUrl is required for external Lens
- it: requires the shared server credential for an external service
-  template: deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://lens.other-namespace:4318
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.serviceTokenSecret.name is required for external Lens
- it: requires an agent reachable URL for external ingestion
-  template: deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://lens.other-namespace:4318
-    lensWorker.serviceTokenSecret.name: external-lens-signing
-    lensWorker.gateway.secretName: external-lens-signing
-    lensWorker.publicUrl: ''
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.publicUrl is required for external Lens
- it: rejects unsupported deployment modes
-  template: deployment.yaml
-  set:
-    lensWorker.mode: typo
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.mode must be bundled, external or disabled
--- a/helm/litellm-helm/tests/lens_saved_secrets_tests.yaml
+++ b/helm/litellm-helm/tests/lens_saved_secrets_tests.yaml
@ -1,59 +0,0 @@
-suite: Lens preserves credentials across Helm upgrades
-templates:
-  - lens/secrets.yaml
-set:
-  fullnameOverride: lens-test
-  lensWorker.enabled: true
-release:
-  namespace: lens
-  name: lens-test
-  upgrade: true
-kubernetesProvider:
-  scheme:
-    v1/Secret:
-      gvr:
-        version: v1
-        resource: secrets
-      namespaced: true
-  objects:
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: lens-test-lens-gateway
-        namespace: lens
-      data:
-        gateway-secret: c2F2ZWQtc2lnbmluZy1rZXk=
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: lens-test-lens-service
-        namespace: lens
-      data:
-        service-token: c2F2ZWQtc2VydmljZS10b2tlbg==
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: lens-test-lens-clickhouse
-        namespace: lens
-      data:
-        password: c2F2ZWQtZGF0YWJhc2UtcGFzc3dvcmQ=
-tests:
-  - it: preserves the separate signing credential across upgrades
-    documentSelector: {path: metadata.name, value: lens-test-lens-gateway}
-    asserts:
-      - equal:
-          path: data.gateway-secret
-          value: c2F2ZWQtc2lnbmluZy1rZXk=
-      - notExists: {path: data.service-token}
-  - it: reuses the service credential instead of breaking running services
-    documentIndex: 0
-    asserts:
-      - equal:
-          path: data.service-token
-          value: c2F2ZWQtc2VydmljZS10b2tlbg==
-  - it: reuses the database password instead of locking out stored traces
-    documentIndex: 1
-    asserts:
-      - equal:
-          path: data.password
-          value: c2F2ZWQtZGF0YWJhc2UtcGFzc3dvcmQ=
--- a/helm/litellm-helm/tests/lens_service_tests.yaml
+++ b/helm/litellm-helm/tests/lens_service_tests.yaml
@ -1,167 +0,0 @@
-suite: Lens service isolation and ingestion routing
-templates:
- configmap-litellm.yaml
- deployment.yaml
- ingress.yaml
- lens/ingress.yaml
- lens/service.yaml
- lens/deployment.yaml
-tests:
- it: connects deployment.yaml to the shared Lens service
-  template: deployment.yaml
-  set: &id001
-    fullnameOverride: lens-test
-    lensWorker.enabled: true
-    lensWorker.publicUrl: https://gateway.example/lens-ingest
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_URL
-        value: http://lens-test-lens-worker:4318
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_PUBLIC_URL
-        value: https://gateway.example/lens-ingest
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_GATEWAY_SECRET
-        valueFrom:
-          secretKeyRef:
-            name: lens-test-lens-gateway
-            key: gateway-secret
- it: routes uploads directly to Lens instead of the gateway
-  template: ingress.yaml
-  set:
-    fullnameOverride: lens-test
-    lensWorker.enabled: true
-    lensWorker.publicUrl: https://gateway.example/lens-ingest
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-    ingress.enabled: true
-    ingress.hosts:
-    - host: gateway.example
-      paths:
-      - path: /
-        pathType: Prefix
-  asserts:
-  - contains:
-      path: spec.rules[0].http.paths
-      content:
-        path: /lens-ingest
-        pathType: Prefix
-        backend:
-          service:
-            name: lens-test-lens-worker
-            port:
-              number: 4318
- it: keeps internal routes out of a dedicated ingestion hostname
-  template: lens/ingress.yaml
-  set:
-    fullnameOverride: lens-test
-    lensWorker.enabled: true
-    lensWorker.publicUrl: https://gateway.example/lens-ingest
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-    lensWorker.ingress.enabled: true
-    lensWorker.ingress.host: traces.example
-  asserts:
-  - equal:
-      path: spec.rules[0].http.paths
-      value:
-      - path: /v1/
-        pathType: Prefix
-        backend:
-          service:
-            name: lens-test-lens-worker
-            port:
-              name: otlp
- it: maps the Lens service to the ingestion listener
-  template: lens/service.yaml
-  set: *id001
-  asserts:
-  - equal:
-      path: spec.selector
-      value:
-        app.kubernetes.io/instance: RELEASE-NAME
-        app.kubernetes.io/component: lens-worker
-  - equal:
-      path: spec.ports
-      value:
-      - name: otlp
-        port: 4318
-        targetPort: otlp
- it: gives only Lens the ClickHouse secret
-  template: lens/deployment.yaml
-  set: *id001
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: CLICKHOUSE_URL
-        valueFrom:
-          secretKeyRef:
-            name: lens-storage
-            key: url
- it: requires an agent reachable ingestion URL
-  template: deployment.yaml
-  set:
-    fullnameOverride: lens-test
-    lensWorker.enabled: true
-    lensWorker.publicUrl: ''
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.publicUrl is required when there is no single ingress hostname
- it: omits Lens connection settings when disabled in deployment.yaml
-  template: deployment.yaml
-  asserts:
-  - notContains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_URL
-      any: true
- it: preserves an existing ClickHouse database and retention
-  template: lens/deployment.yaml
-  set:
-    lensWorker.enabled: true
-    lensWorker.publicUrl: https://traces.example
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-    lensWorker.clickhouseDatabase: existing_traces
-    lensWorker.retentionDays: 45
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: CLICKHOUSE_DATABASE
-        value: existing_traces
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: AGENT_TRACING_RETENTION_DAYS
-        value: '45'
- it: keeps Lens pods outside the gateway autoscaling selector
-  template: lens/deployment.yaml
-  set: &id002
-    nameOverride: inference
-    lensWorker.enabled: true
-    lensWorker.publicUrl: https://traces.example
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-  asserts:
-  - equal:
-      path: spec.template.metadata.labels["app.kubernetes.io/name"]
-      value: inference-lens-worker
- it: preserves the existing gateway deployment selector
-  template: deployment.yaml
-  set: *id002
-  asserts:
-  - equal:
-      path: spec.selector.matchLabels["app.kubernetes.io/name"]
-      value: inference
--- a/helm/litellm-helm/tests/lens_setup_tests.yaml
+++ b/helm/litellm-helm/tests/lens_setup_tests.yaml
@ -1,162 +0,0 @@
-suite: Lens managed setup
-set:
-  fullnameOverride: lens-test
-  lensWorker.enabled: true
-  lensWorker.publicUrl: https://traces.example
-release:
-  namespace: lens
-  name: lens-test
-templates:
-  - lens/deployment.yaml
-  - lens/clickhouse.yaml
-  - lens/secrets.yaml
-tests:
-  - it: generates private login, gateway and storage credentials
-    template: lens/secrets.yaml
-    asserts:
-      - hasDocuments:
-          count: 4
-      - matchRegex:
-          path: data.service-token
-          pattern: '^[A-Za-z0-9+/]{86}==$'
-        documentIndex: 0
-      - matchRegex:
-          path: data.password
-          pattern: '^[A-Za-z0-9+/]{86}==$'
-        documentIndex: 1
-      - equal:
-          path: metadata.annotations["helm.sh/resource-policy"]
-          value: keep
-  - it: connects Lens to its private bundled storage
-    template: lens/deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: CLICKHOUSE_HOST
-            value: lens-test-lens-clickhouse
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: CLICKHOUSE_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: lens-test-lens-clickhouse
-                key: password
-  - it: stores traces on a persistent volume with the chosen storage class
-    template: lens/clickhouse.yaml
-    documentIndex: 1
-    set:
-      lensWorker.clickhouse.storage: 40Gi
-      lensWorker.clickhouse.storageClassName: fast
-    asserts:
-      - equal:
-          path: spec.volumeClaimTemplates[0].spec
-          value:
-            accessModes: [ReadWriteOnce]
-            storageClassName: fast
-            resources:
-              requests:
-                storage: 40Gi
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: CLICKHOUSE_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: lens-test-lens-clickhouse
-                key: password
-  - it: keeps an existing external database instead of creating a new one
-    template: lens/clickhouse.yaml
-    set:
-      lensWorker.clickhouseSecret.name: external-clickhouse
-    asserts:
-      - hasDocuments:
-          count: 0
-  - it: leaves supplied secrets under their existing manager
-    template: lens/secrets.yaml
-    set:
-      lensWorker.clickhouseSecret.name: external-clickhouse
-      lensWorker.serviceTokenSecret.name: external-service
-      lensWorker.adminTokenSecret.name: external-admin
-      lensWorker.gateway.secretName: external-signing
-    asserts:
-      - hasDocuments:
-          count: 0
-  - it: creates no credentials or database when Lens is disabled
-    templates:
-      - lens/secrets.yaml
-      - lens/clickhouse.yaml
-    set:
-      lensWorker.enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-  - it: requires an external database when bundled storage is explicitly disabled
-    template: lens/deployment.yaml
-    set:
-      lensWorker.clickhouse.enabled: false
-    asserts:
-      - failedTemplate:
-          errorMessage: Lens clickhouseSecret.name is required when bundled storage is disabled
-  - it: keeps storage names valid and uses the same name for the connection
-    set:
-      fullnameOverride: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-    asserts:
-      - matchRegex:
-          path: metadata.name
-          pattern: '^[a-z]([-a-z0-9]{0,61}[a-z0-9])?$'
-        template: lens/clickhouse.yaml
-        documentIndex: 0
-      - matchRegex:
-          path: metadata.name
-          pattern: '^[a-z]([-a-z0-9]{0,61}[a-z0-9])?$'
-        template: lens/clickhouse.yaml
-        documentIndex: 1
-      - equal:
-          path: metadata.name
-          value: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lens-clickhouse
-        template: lens/clickhouse.yaml
-        documentIndex: 0
-      - equal:
-          path: spec.serviceName
-          value: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lens-clickhouse
-        template: lens/clickhouse.yaml
-        documentIndex: 1
-      - equal:
-          path: metadata.name
-          value: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lens-clickhouse
-        template: lens/secrets.yaml
-        documentIndex: 1
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: CLICKHOUSE_HOST
-            value: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lens-clickhouse
-        template: lens/deployment.yaml
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: CLICKHOUSE_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lens-clickhouse
-                key: password
-        template: lens/deployment.yaml
-
-  - it: allows cold storage startup and inherits registry credentials
-    template: lens/clickhouse.yaml
-    documentIndex: 1
-    set:
-      imagePullSecrets: [{name: registry-auth}]
-    asserts:
-      - equal:
-          path: spec.template.spec.imagePullSecrets
-          value: [{name: registry-auth}]
-      - equal:
-          path: spec.template.spec.containers[0].startupProbe
-          value:
-            httpGet: {path: /ping, port: http}
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 60
--- a/helm/litellm-helm/values.yaml
+++ b/helm/litellm-helm/values.yaml
@ -668,70 +668,15 @@ serviceMonitor:
    # - test-namespace

 lens:
-  library: true
-
-lensWorker:
-  retainResources: false
-  mode: ""
-  externalUrl: ""
-  externalServiceName: ""
-  gateway:
-    secretName: ""
-    secretKey: gateway-secret
-  standaloneUrl: ""
-  adminTokenSecret:
-    name: ""
-    key: admin-token
-  extraEnv: []
-  extraEnvFrom: []
  enabled: false
-  replicaCount: 1
-  image:
-    repository: ghcr.io/berriai/lens
-    tag: "0.1.0-dev.0"
-    digest: ""
-    pullPolicy: IfNotPresent
-  tokenSecret:
+  url: ""
+  publicUrl: ""
+  service:
    name: ""
-    key: token
+    port: 4318
+  gatewaySecret:
+    name: ""
+    key: gateway-secret
  serviceTokenSecret:
    name: ""
    key: service-token
-  clickhouse:
-    enabled: true
-    image: clickhouse/clickhouse-server:26.9.6.6@sha256:eb4870e7ca7ed70c259eebfcfbee6cf797017f6b5436c2926bbbfe3d4d28486e
-    storage: 20Gi
-    storageClassName: null
-    resources:
-      requests:
-        cpu: 100m
-        memory: 512Mi
-      limits:
-        memory: 2Gi
-  clickhouseDatabase: litellm
-  retentionDays: 14
-  clickhouseSecret:
-    name: ""
-    key: url
-  publicUrl: ""
-  service:
-    port: 4318
-    annotations: {}
-  ingress:
-    enabled: false
-    path: /v1/
-    className: ""
-    host: ""
-    annotations: {}
-    tls: []
-  url: ""
-  tmpSizeLimit: 1Gi
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 2Gi
-  nodeSelector: {}
-  tolerations: []
-  affinity: {}
--- a/helm/litellm/Chart.lock
+++ b/helm/litellm/Chart.lock
@ -1,6 +0,0 @@
-dependencies:
- name: lens
-  repository: oci://ghcr.io/berriai/charts
-  version: 0.1.0-dev.0
-digest: sha256:6b244c878890f10a093a297d70c9e68b2c3bda00fbbb56ab287e7ecee1d7bbcf
-generated: '2026-10-09T04:18:10.642706000Z'
--- a/helm/litellm/Chart.yaml
+++ b/helm/litellm/Chart.yaml
@ -6,8 +6,3 @@ version: 0.1.0
 appVersion: "0.1.0"
 annotations:
  org.opencontainers.image.source: "https://github.com/BerriAI/litellm"
-
-dependencies:
-  - name: lens
-    version: 0.1.0-dev.0
-    repository: oci://ghcr.io/berriai/charts
--- a/helm/litellm/README.md
+++ b/helm/litellm/README.md
@ -1,10 +1,8 @@
 # LiteLLM componentized chart

-This chart deploys separate gateway, backend and UI services. Configure Lens through `lensWorker.mode`: `disabled` keeps it off, `bundled` installs the Lens dependency, and `external` connects an existing Lens service
+This chart deploys separate gateway, backend and UI services

-Bundled mode generates separate service and identity-signing credentials. External mode requires `lensWorker.gateway.secretName` and `lensWorker.serviceTokenSecret.name`; their keys default to `gateway-secret` and `service-token`. Provision distinct values matching the external Lens deployment
-
-Follow the [Lens Helm connection guide](https://github.com/BerriAI/lens/blob/main/helm/lens/README.md#connect-a-gateway) for the complete values and verification flow. It also links the GitOps credential requirements and existing-data migration. Source-chart installation requires a built Lens image until the first signed Lens release is published
+This chart does not deploy Lens. Deploy Lens from [its own chart](https://github.com/BerriAI/lens/tree/main/helm/lens), then set `lens.enabled: true`, `lens.url`, `lens.publicUrl`, `lens.gatewaySecret.name` and `lens.serviceTokenSecret.name`. The secret keys default to `gateway-secret` and `service-token`. Set `lens.service.name` when that Lens runs in this release's namespace and the chart ingress should route `/lens-ingest` to it. The old `lensWorker` values are no longer read, and enabling them fails the render

 For an ingress with separate component hostnames, set all three `ingress.componentHosts` values, leave `ingress.host` and `ingress.extraPaths` empty, configure `ui.backendUrl` as the backend's public origin and `backend.gatewayUrl` as the gateway's public origin, and set `ui.publicUrl` to the browser-facing UI origin. The UI Deployment receives `LITELLM_BACKEND_URL` from `ui.backendUrl` only when `ingress.componentHosts` is configured.

--- a/helm/litellm/charts/lens-0.1.0-dev.0.tgz
+++ b/helm/litellm/charts/lens-0.1.0-dev.0.tgz
--- a/helm/litellm/templates/_helpers.tpl
+++ b/helm/litellm/templates/_helpers.tpl
@ -604,10 +604,6 @@ Directory of the collector's unix socket, shared by the gateway and
 collector containers through an emptyDir. Empty when the sidecar is off
 or gateway.collector.address is a tcp://127.0.0.1:<port> address.
 */}}
-{{- define "litellm.lensWorker.image" -}}
-{{- include "lens.image" (dict "Values" .Values.lensWorker "Chart" .Subcharts.lens.Chart) -}}
-{{- end -}}
-
 {{- define "litellm.gateway.collectorSocketDir" -}}
 {{- if and .Values.gateway.collector.enabled (hasPrefix "unix://" .Values.gateway.collector.address) -}}
 {{- dir (trimPrefix "unix://" .Values.gateway.collector.address) -}}
@ -635,93 +631,27 @@ shutdown drain window.
 {{- end -}}

 {{- define "litellm.lensConnectionEnv" -}}
-{{- $mode := include "litellm.lens.mode" . -}}
-{{- if ne $mode "disabled" }}
-{{- if and (eq $mode "external") (not .Values.lensWorker.serviceTokenSecret.name) -}}
-{{- fail "lensWorker.serviceTokenSecret.name is required for external Lens" -}}
+{{- with .Values.lensWorker }}
+{{- if or .enabled (and .mode (ne .mode "disabled")) }}
+{{- fail "lensWorker was removed; deploy Lens from its own chart and set lens.* instead, see the chart README" }}
 {{- end }}
-{{- if and (eq $mode "external") (not .Values.lensWorker.gateway.secretName) -}}
-{{- fail "lensWorker.gateway.secretName is required for external Lens" -}}
-{{- end -}}
+{{- end }}
+{{- with .Values.lens }}
+{{- if .enabled }}
 - name: LITELLM_LENS_URL
-  value: {{ if eq $mode "external" }}{{ required "lensWorker.externalUrl is required for external Lens" .Values.lensWorker.externalUrl | quote }}{{ else }}{{ printf "http://%s-lens-worker:%v" (include "litellm.fullname" .) .Values.lensWorker.service.port | quote }}{{ end }}
+  value: {{ required "lens.url is required when lens.enabled is true" .url | quote }}
 - name: LITELLM_LENS_PUBLIC_URL
-  value: {{ include "litellm.lensWorker.publicUrl" . | quote }}
+  value: {{ required "lens.publicUrl is required when lens.enabled is true" .publicUrl | quote }}
 - name: LENS_GATEWAY_SECRET
  valueFrom:
    secretKeyRef:
-      name: {{ include "litellm.lensWorker.gatewaySecretName" . | quote }}
-      key: {{ .Values.lensWorker.gateway.secretKey | quote }}
+      name: {{ required "lens.gatewaySecret.name is required when lens.enabled is true" .gatewaySecret.name | quote }}
+      key: {{ .gatewaySecret.key | quote }}
 - name: LITELLM_LENS_SERVICE_TOKEN
  valueFrom:
    secretKeyRef:
-      name: {{ include "litellm.lensWorker.serviceTokenSecretName" . | quote }}
-      key: {{ .Values.lensWorker.serviceTokenSecret.key | quote }}
+      name: {{ required "lens.serviceTokenSecret.name is required when lens.enabled is true" .serviceTokenSecret.name | quote }}
+      key: {{ .serviceTokenSecret.key | quote }}
+{{- end }}
 {{- end }}
 {{- end -}}
-
-{{- define "litellm.lensWorker.labels" -}}
-{{- $labels := include "litellm.commonLabels" . | fromYaml -}}
-{{- $_ := set $labels "app.kubernetes.io/name" (printf "%s-lens-worker" (include "litellm.name" . | trunc 51 | trimSuffix "-")) -}}
-{{- toYaml $labels -}}
-{{- end -}}
-
-{{- define "litellm.lensWorker.serviceTokenSecretName" -}}
-{{- .Values.lensWorker.serviceTokenSecret.name | default (printf "%s-lens-service" (include "litellm.fullname" .)) -}}
-{{- end -}}
-
-{{- define "litellm.lensWorker.gatewaySecretName" -}}
-{{- .Values.lensWorker.gateway.secretName | default (printf "%s-lens-gateway" (include "litellm.fullname" . | trunc 50 | trimSuffix "-")) -}}
-{{- end -}}
-
-{{- define "litellm.lensWorker.bundledClickhouse" -}}
-{{- if and (eq (include "litellm.lens.mode" .) "bundled") .Values.lensWorker.clickhouse.enabled (not .Values.lensWorker.clickhouseSecret.name) -}}true{{- end -}}
-{{- end -}}
-
-{{- define "litellm.lensWorker.publicUrl" -}}
-{{- if .Values.lensWorker.publicUrl -}}
-{{- .Values.lensWorker.publicUrl -}}
-{{- else if eq (include "litellm.lens.mode" .) "external" -}}
-{{- fail "lensWorker.publicUrl is required for external Lens" -}}
-{{- else if .Values.lensWorker.ingress.enabled -}}
-{{- $tls := or (not (empty .Values.lensWorker.ingress.tls)) (hasKey .Values.lensWorker.ingress.annotations "alb.ingress.kubernetes.io/certificate-arn") -}}
-{{- printf "%s://%s" (ternary "https" "http" $tls) (required "lensWorker.ingress.host is required" .Values.lensWorker.ingress.host) -}}
-{{- else if and .Values.ingress.enabled .Values.ingress.host -}}
-{{- $tls := or (not (empty .Values.ingress.tls)) (hasKey .Values.ingress.annotations "alb.ingress.kubernetes.io/certificate-arn") -}}
-{{- printf "%s://%s/lens-ingest" (ternary "https" "http" $tls) .Values.ingress.host -}}
-{{- else -}}
-{{- fail "lensWorker.publicUrl is required when there is no single ingress hostname" -}}
-{{- end -}}
-{{- end -}}
-
-{{- define "litellm.lensWorker.clickhouseName" -}}
-{{- printf "%s-lens-clickhouse" (include "litellm.fullname" . | trunc 47 | trimSuffix "-") -}}
-{{- end -}}
-
-{{- define "litellm.lens.mode" -}}
-{{- $mode := .Values.lensWorker.mode | default (ternary "bundled" "disabled" .Values.lensWorker.enabled) -}}
-{{- if not (has $mode (list "bundled" "external" "disabled")) -}}
-{{- fail "lensWorker.mode must be bundled, external or disabled" -}}
-{{- end -}}
-{{- $mode -}}
-{{- end -}}
-
-{{- define "litellm.lens.render" -}}
-{{- $root := .root -}}
-{{- $values := mergeOverwrite (deepCopy $root.Subcharts.lens.Values) (deepCopy $root.Values.lensWorker) -}}
-{{- $_ := set $values "fullnameOverride" (printf "%s-lens-worker" (include "litellm.fullname" $root)) -}}
-{{- $_ := set $values "component" "lens-worker" -}}
-{{- $_ := set $values "nameOverride" (printf "%s-lens-worker" (include "litellm.name" $root | trunc 51 | trimSuffix "-")) -}}
-{{- $_ := set $values "imagePullSecrets" $root.Values.imagePullSecrets -}}
-{{- $_ := set $values.gateway "enabled" true -}}
-{{- $_ := set $values.gateway "generatedName" (include "litellm.lensWorker.gatewaySecretName" $root) -}}
-{{- $_ := set $values.clickhouse "nameOverride" (include "litellm.lensWorker.clickhouseName" $root) -}}
-{{- $_ := set $values.serviceTokenSecret "generatedName" (include "litellm.lensWorker.serviceTokenSecretName" $root) -}}
-{{- $_ := set $values "publicUrl" ($root.Values.lensWorker.standaloneUrl | default $root.Subcharts.lens.Values.publicUrl) -}}
-{{- if and (eq .resource "deployment") (or $root.Values.lensWorker.publicUrl $root.Values.lensWorker.ingress.enabled $root.Values.ingress.enabled) -}}
-{{- $ingestion := include "litellm.lensWorker.publicUrl" $root -}}
-{{- $_ := set $values "ingestionUrl" $ingestion -}}
-{{- $_ := set $values "publicUrl" ($root.Values.lensWorker.standaloneUrl | default (trimSuffix "/lens-ingest" $ingestion)) -}}
-{{- end -}}
-{{- include (printf "lens.%s" .resource) (dict "Values" $values "Release" $root.Release "Chart" $root.Subcharts.lens.Chart "Capabilities" $root.Capabilities) -}}
-{{- end -}}
--- a/helm/litellm/templates/ingress.yaml
+++ b/helm/litellm/templates/ingress.yaml
@ -166,14 +166,14 @@ spec:
    - host: {{ $componentHosts.gateway | quote }}
      http:
        paths:
-          {{- if or (eq (include "litellm.lens.mode" .) "bundled") (and (eq (include "litellm.lens.mode" .) "external") .Values.lensWorker.externalServiceName) }}
+          {{- if and .Values.lens.enabled .Values.lens.service.name }}
          - path: /lens-ingest
            pathType: Prefix
            backend:
              service:
-                name: {{ .Values.lensWorker.externalServiceName | default (printf "%s-lens-worker" (include "litellm.fullname" .)) }}
+                name: {{ .Values.lens.service.name }}
                port:
-                  number: {{ .Values.lensWorker.service.port }}
+                  number: {{ .Values.lens.service.port }}
          {{- end }}
          - path: /
            pathType: Prefix
@ -249,15 +249,15 @@ spec:
                port:
                  number: {{ $gatewayPort }}
          {{- end }}
-          {{- if or (eq (include "litellm.lens.mode" .) "bundled") (and (eq (include "litellm.lens.mode" .) "external") .Values.lensWorker.externalServiceName) }}
+          {{- if and .Values.lens.enabled .Values.lens.service.name }}
          {{- $builtinPathKeys = append $builtinPathKeys "/lens-ingest|Prefix" }}
          - path: /lens-ingest
            pathType: Prefix
            backend:
              service:
-                name: {{ .Values.lensWorker.externalServiceName | default (printf "%s-lens-worker" (include "litellm.fullname" .)) }}
+                name: {{ .Values.lens.service.name }}
                port:
-                  number: {{ .Values.lensWorker.service.port }}
+                  number: {{ .Values.lens.service.port }}
          {{- end }}
          {{- /*
            --- Operator-supplied extra paths (ingress.extraPaths) ---
--- a/helm/litellm/templates/lens/clickhouse.yaml
+++ b/helm/litellm/templates/lens/clickhouse.yaml
@ -1,3 +0,0 @@
-{{- if eq (include "litellm.lens.mode" .) "bundled" }}
-{{ include "litellm.lens.render" (dict "root" . "resource" "clickhouse") }}
-{{- end }}
--- a/helm/litellm/templates/lens/deployment.yaml
+++ b/helm/litellm/templates/lens/deployment.yaml
@ -1,3 +0,0 @@
-{{- if eq (include "litellm.lens.mode" .) "bundled" }}
-{{ include "litellm.lens.render" (dict "root" . "resource" "deployment") }}
-{{- end }}
--- a/helm/litellm/templates/lens/ingress.yaml
+++ b/helm/litellm/templates/lens/ingress.yaml
@ -1,3 +0,0 @@
-{{- if eq (include "litellm.lens.mode" .) "bundled" }}
-{{ include "litellm.lens.render" (dict "root" . "resource" "ingress") }}
-{{- end }}
--- a/helm/litellm/templates/lens/secrets.yaml
+++ b/helm/litellm/templates/lens/secrets.yaml
@ -1,3 +0,0 @@
-{{- if eq (include "litellm.lens.mode" .) "bundled" }}
-{{ include "litellm.lens.render" (dict "root" . "resource" "secrets") }}
-{{- end }}
--- a/helm/litellm/templates/lens/service.yaml
+++ b/helm/litellm/templates/lens/service.yaml
@ -1,3 +0,0 @@
-{{- if eq (include "litellm.lens.mode" .) "bundled" }}
-{{ include "litellm.lens.render" (dict "root" . "resource" "service") }}
-{{- end }}
--- a/helm/litellm/tests/component_hosts_tests.yaml
+++ b/helm/litellm/tests/component_hosts_tests.yaml
@ -15,7 +15,6 @@ tests:
      ingress.componentHosts.ui: ui.example.com
      ingress.componentHosts.backend: backend.example.com
      ingress.componentHosts.gateway: gateway.example.com
-      lensWorker.mode: disabled
      ingress.tls:
        - hosts:
            - ui.example.com
@ -83,12 +82,12 @@ tests:
      ui.backendUrl: https://backend.example.com
      ui.publicUrl: https://ui.example.com
      backend.gatewayUrl: https://gateway.example.com
-      lensWorker.mode: external
-      lensWorker.externalServiceName: existing-lens
-      lensWorker.externalUrl: https://lens.example.com
-      lensWorker.publicUrl: https://lens.example.com
-      lensWorker.serviceTokenSecret.name: existing-lens-signing
-      lensWorker.gateway.secretName: existing-lens-signing
+      lens.enabled: true
+      lens.service.name: existing-lens
+      lens.url: http://existing-lens:4318
+      lens.publicUrl: https://gateway.example.com/lens-ingest
+      lens.serviceTokenSecret.name: existing-lens-signing
+      lens.gatewaySecret.name: existing-lens-signing
    asserts:
      - equal:
          path: spec.rules[2].http.paths[0].path
--- a/helm/litellm/tests/lens_connection_tests.yaml
+++ b/helm/litellm/tests/lens_connection_tests.yaml
@ -0,0 +1,166 @@
+suite: lens connection
+templates:
+  - gateway/deployment.yaml
+  - backend/deployment.yaml
+  - gateway/configmap.yaml
+  - ingress.yaml
+values:
+  - ./values/required.yaml
+tests:
+  - it: connects the gateway to an external Lens
+    template: gateway/deployment.yaml
+    set:
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_LENS_URL
+            value: http://lens.lens.svc:4318
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_LENS_PUBLIC_URL
+            value: https://lens.example.com/lens-ingest
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LENS_GATEWAY_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: lens-gateway
+                key: gateway-secret
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_LENS_SERVICE_TOKEN
+            valueFrom:
+              secretKeyRef:
+                name: lens-service
+                key: service-token
+
+  - it: connects the backend to an external Lens
+    template: backend/deployment.yaml
+    set:
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_LENS_URL
+            value: http://lens.lens.svc:4318
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_LENS_PUBLIC_URL
+            value: https://lens.example.com/lens-ingest
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LENS_GATEWAY_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: lens-gateway
+                key: gateway-secret
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_LENS_SERVICE_TOKEN
+            valueFrom:
+              secretKeyRef:
+                name: lens-service
+                key: service-token
+
+  - it: requires lens.url when Lens is enabled
+    template: gateway/deployment.yaml
+    set:
+      lens.enabled: true
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - failedTemplate:
+          errorMessage: lens.url is required when lens.enabled is true
+
+  - it: requires lens.publicUrl when Lens is enabled
+    template: gateway/deployment.yaml
+    set:
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - failedTemplate:
+          errorMessage: lens.publicUrl is required when lens.enabled is true
+
+  - it: requires lens.gatewaySecret.name when Lens is enabled
+    template: gateway/deployment.yaml
+    set:
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - failedTemplate:
+          errorMessage: lens.gatewaySecret.name is required when lens.enabled is true
+
+  - it: requires lens.serviceTokenSecret.name when Lens is enabled
+    template: gateway/deployment.yaml
+    set:
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+    asserts:
+      - failedTemplate:
+          errorMessage: lens.serviceTokenSecret.name is required when lens.enabled is true
+
+  - it: routes /lens-ingest to the named Lens service on the single ingress host
+    template: ingress.yaml
+    set:
+      ingress.enabled: true
+      ingress.host: litellm.example.com
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+      lens.service.name: existing-lens
+    asserts:
+      - contains:
+          path: spec.rules[0].http.paths
+          content:
+            path: /lens-ingest
+            pathType: Prefix
+            backend:
+              service:
+                name: existing-lens
+                port:
+                  number: 4318
+
+  - it: leaves /lens-ingest off the ingress without a Lens service name
+    template: ingress.yaml
+    set:
+      ingress.enabled: true
+      ingress.host: litellm.example.com
+      lens.enabled: true
+      lens.url: http://lens.lens.svc:4318
+      lens.publicUrl: https://lens.example.com/lens-ingest
+      lens.gatewaySecret.name: lens-gateway
+      lens.serviceTokenSecret.name: lens-service
+    asserts:
+      - exists:
+          path: spec.rules[0].http.paths
+      - notContains:
+          path: spec.rules[0].http.paths
+          content:
+            path: /lens-ingest
+          any: true
--- a/helm/litellm/tests/lens_endpoint_defaults_tests.yaml
+++ b/helm/litellm/tests/lens_endpoint_defaults_tests.yaml
@ -1,86 +0,0 @@
-suite: Lens endpoint defaults
-templates:
-  - gateway/deployment.yaml
-  - gateway/configmap.yaml
-set:
-  lensWorker.enabled: true
-  ingress.enabled: true
-  ingress.host: gateway.example
-  ingress.tls:
-    - hosts: [gateway.example]
-      secretName: tls
-tests:
-  - it: derives the trace endpoint from the deployment hostname and TLS
-    template: gateway/deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: https://gateway.example/lens-ingest
-  - it: preserves an explicitly configured public address
-    set:
-      lensWorker.publicUrl: https://custom.example/prefix
-    template: gateway/deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: https://custom.example/prefix
-  - it: uses the dedicated Lens ingress when configured
-    set:
-      lensWorker.ingress.enabled: true
-      lensWorker.ingress.host: traces.example
-      lensWorker.ingress.tls:
-        - hosts: [traces.example]
-          secretName: traces-tls
-    template: gateway/deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: https://traces.example
-  - it: uses HTTPS for a dedicated ALB ingress with certificate annotations
-    set:
-      lensWorker.ingress.enabled: true
-      lensWorker.ingress.host: traces.example
-      lensWorker.ingress.className: alb
-      lensWorker.ingress.tls: []
-      lensWorker.ingress.annotations:
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:123456789012:certificate/test
-        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
-        alb.ingress.kubernetes.io/ssl-redirect: "443"
-    template: gateway/deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: https://traces.example
-  - it: uses HTTP for a dedicated ingress without its own TLS
-    set:
-      lensWorker.ingress.enabled: true
-      lensWorker.ingress.host: traces.example
-      lensWorker.ingress.tls: []
-      lensWorker.ingress.annotations: {}
-    template: gateway/deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: http://traces.example
-  - it: uses HTTP when ingress has no TLS
-    set:
-      ingress.tls: []
-    template: gateway/deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LITELLM_LENS_PUBLIC_URL
-            value: http://gateway.example/lens-ingest
-values:
-  - ./values/required.yaml
--- a/helm/litellm/tests/lens_modes_tests.yaml
+++ b/helm/litellm/tests/lens_modes_tests.yaml
@ -1,208 +0,0 @@
---
-suite: Lens deployment modes
-templates:
- gateway/configmap.yaml
- backend/deployment.yaml
- lens/deployment.yaml
- lens/service.yaml
- lens/clickhouse.yaml
- lens/secrets.yaml
- ingress.yaml
-values:
- "./values/required.yaml"
-set:
-  lensWorker.publicUrl: https://traces.example
-tests:
- it: retains the existing deployment before transferring its release ownership
-  template: lens/deployment.yaml
-  set:
-    lensWorker.mode: bundled
-    lensWorker.retainResources: true
-  asserts:
-  - equal:
-      path: metadata.annotations["helm.sh/resource-policy"]
-      value: keep
- it: keeps the ingestion endpoint on an independently deployed Lens service
-  template: ingress.yaml
-  set:
-    ingress.enabled: true
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.externalServiceName: existing-lens
-    lensWorker.serviceTokenSecret.name: external-lens-signing
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - contains:
-      path: spec.rules[0].http.paths
-      content:
-        path: /lens-ingest
-        pathType: Prefix
-        backend:
-          service:
-            name: existing-lens
-            port: {number: 4318}
- it: connects an external deployment without installing Lens resources
-  templates:
-  - lens/deployment.yaml
-  - lens/service.yaml
-  - lens/clickhouse.yaml
-  - lens/secrets.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://lens.other-namespace:4318
-    lensWorker.serviceTokenSecret.name: external-lens-signing
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - hasDocuments:
-      count: 0
- it: sends delegated requests to the explicitly selected external Lens
-  template: backend/deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://lens.other-namespace:4318
-    lensWorker.serviceTokenSecret.name: external-lens-signing
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_URL
-        value: http://lens.other-namespace:4318
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_GATEWAY_SECRET
-        valueFrom:
-          secretKeyRef:
-            name: external-lens-signing
-            key: gateway-secret
- it: disables Lens explicitly even with a retained legacy enable flag
-  template: lens/deployment.yaml
-  set:
-    lensWorker.mode: disabled
-    lensWorker.enabled: true
-  asserts:
-  - hasDocuments:
-      count: 0
- it: bundles Lens through explicit mode selection
-  template: lens/deployment.yaml
-  set:
-    lensWorker.mode: bundled
-  asserts:
-  - hasDocuments:
-      count: 1
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_MODE
-        value: standalone
- it: uses separate credentials for external identity and service access
-  template: backend/deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.serviceTokenSecret: {name: worker-service, key: token}
-    lensWorker.gateway: {secretName: delegated-identity, secretKey: signature}
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_GATEWAY_SECRET
-        valueFrom:
-          secretKeyRef: {name: delegated-identity, key: signature}
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_SERVICE_TOKEN
-        valueFrom:
-          secretKeyRef: {name: worker-service, key: token}
- it: supplies the same separate signing secret to the bundled service
-  template: lens/deployment.yaml
-  set:
-    lensWorker.mode: bundled
-    lensWorker.gateway: {secretName: delegated-identity, secretKey: signature}
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_GATEWAY_SECRET
-        valueFrom:
-          secretKeyRef: {name: delegated-identity, key: signature}
- it: routes explicit bundled mode with the enable flag off
-  template: ingress.yaml
-  set:
-    fullnameOverride: gateway
-    ingress.enabled: true
-    ingress.host: gateway.example
-    lensWorker.mode: bundled
-    lensWorker.enabled: false
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.externalServiceName: ""
-    lensWorker.serviceTokenSecret.name: worker-service
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - contains:
-      path: spec.rules[0].http.paths
-      content:
-        path: /lens-ingest
-        pathType: Prefix
-        backend:
-          service:
-            name: gateway-lens-worker
-            port: {number: 4318}
- it: routes external mode to its selected service
-  template: ingress.yaml
-  set:
-    fullnameOverride: gateway
-    ingress.enabled: true
-    ingress.host: gateway.example
-    lensWorker.mode: external
-    lensWorker.enabled: true
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.externalServiceName: "existing-lens"
-    lensWorker.serviceTokenSecret.name: worker-service
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - contains:
-      path: spec.rules[0].http.paths
-      content:
-        path: /lens-ingest
-        pathType: Prefix
-        backend:
-          service:
-            name: existing-lens
-            port: {number: 4318}
- it: omits ingestion when an external service has no ingress backend
-  template: ingress.yaml
-  set:
-    fullnameOverride: gateway
-    ingress.enabled: true
-    ingress.host: gateway.example
-    lensWorker.mode: external
-    lensWorker.enabled: true
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.externalServiceName: ""
-    lensWorker.serviceTokenSecret.name: worker-service
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - notContains:
-      path: spec.rules[0].http.paths
-      content: {path: /lens-ingest}
-      any: true
- it: omits ingestion for disabled mode with the enable flag on
-  template: ingress.yaml
-  set:
-    fullnameOverride: gateway
-    ingress.enabled: true
-    ingress.host: gateway.example
-    lensWorker.mode: disabled
-    lensWorker.enabled: true
-    lensWorker.externalUrl: http://existing-lens:4318
-    lensWorker.externalServiceName: ""
-    lensWorker.serviceTokenSecret.name: worker-service
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - notContains:
-      path: spec.rules[0].http.paths
-      content: {path: /lens-ingest}
-      any: true
--- a/helm/litellm/tests/lens_modes_validation_tests.yaml
+++ b/helm/litellm/tests/lens_modes_validation_tests.yaml
@ -1,54 +0,0 @@
---
-suite: Lens deployment mode validation
-templates:
- gateway/configmap.yaml
- backend/deployment.yaml
-values:
- "./values/required.yaml"
-set:
-  lensWorker.publicUrl: https://traces.example
-tests:
- it: requires a separate identity signing reference for external Lens
-  template: backend/deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://lens.other-namespace:4318
-    lensWorker.serviceTokenSecret.name: worker-service
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.gateway.secretName is required for external Lens
- it: requires an external service address
-  template: backend/deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.serviceTokenSecret.name: external-lens-signing
-    lensWorker.gateway.secretName: external-lens-signing
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.externalUrl is required for external Lens
- it: requires the shared server credential for an external service
-  template: backend/deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://lens.other-namespace:4318
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.serviceTokenSecret.name is required for external Lens
- it: requires an agent reachable URL for external ingestion
-  template: backend/deployment.yaml
-  set:
-    lensWorker.mode: external
-    lensWorker.externalUrl: http://lens.other-namespace:4318
-    lensWorker.serviceTokenSecret.name: external-lens-signing
-    lensWorker.gateway.secretName: external-lens-signing
-    lensWorker.publicUrl: ''
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.publicUrl is required for external Lens
- it: rejects unsupported deployment modes
-  template: backend/deployment.yaml
-  set:
-    lensWorker.mode: typo
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.mode must be bundled, external or disabled
--- a/helm/litellm/tests/lens_saved_secrets_tests.yaml
+++ b/helm/litellm/tests/lens_saved_secrets_tests.yaml
@ -1,61 +0,0 @@
-suite: Lens preserves credentials across Helm upgrades
-templates:
-  - lens/secrets.yaml
-set:
-  fullnameOverride: lens-test
-  lensWorker.enabled: true
-release:
-  namespace: lens
-  name: lens-test
-  upgrade: true
-kubernetesProvider:
-  scheme:
-    v1/Secret:
-      gvr:
-        version: v1
-        resource: secrets
-      namespaced: true
-  objects:
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: lens-test-lens-gateway
-        namespace: lens
-      data:
-        gateway-secret: c2F2ZWQtc2lnbmluZy1rZXk=
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: lens-test-lens-service
-        namespace: lens
-      data:
-        service-token: c2F2ZWQtc2VydmljZS10b2tlbg==
-    - apiVersion: v1
-      kind: Secret
-      metadata:
-        name: lens-test-lens-clickhouse
-        namespace: lens
-      data:
-        password: c2F2ZWQtZGF0YWJhc2UtcGFzc3dvcmQ=
-tests:
-  - it: preserves the separate signing credential across upgrades
-    documentSelector: {path: metadata.name, value: lens-test-lens-gateway}
-    asserts:
-      - equal:
-          path: data.gateway-secret
-          value: c2F2ZWQtc2lnbmluZy1rZXk=
-      - notExists: {path: data.service-token}
-  - it: reuses the service credential instead of breaking running services
-    documentIndex: 0
-    asserts:
-      - equal:
-          path: data.service-token
-          value: c2F2ZWQtc2VydmljZS10b2tlbg==
-  - it: reuses the database password instead of locking out stored traces
-    documentIndex: 1
-    asserts:
-      - equal:
-          path: data.password
-          value: c2F2ZWQtZGF0YWJhc2UtcGFzc3dvcmQ=
-values:
-  - ./values/required.yaml
--- a/helm/litellm/tests/lens_service_tests.yaml
+++ b/helm/litellm/tests/lens_service_tests.yaml
@ -1,196 +0,0 @@
-suite: Lens service isolation and ingestion routing
-templates:
- gateway/configmap.yaml
- gateway/deployment.yaml
- backend/deployment.yaml
- ingress.yaml
- lens/ingress.yaml
- lens/service.yaml
- lens/deployment.yaml
-tests:
- it: connects gateway/deployment.yaml to the shared Lens service
-  template: gateway/deployment.yaml
-  set: &id001
-    fullnameOverride: lens-test
-    lensWorker.enabled: true
-    lensWorker.publicUrl: https://gateway.example/lens-ingest
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_URL
-        value: http://lens-test-lens-worker:4318
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_PUBLIC_URL
-        value: https://gateway.example/lens-ingest
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_GATEWAY_SECRET
-        valueFrom:
-          secretKeyRef:
-            name: lens-test-lens-gateway
-            key: gateway-secret
- it: connects backend/deployment.yaml to the shared Lens service
-  template: backend/deployment.yaml
-  set: *id001
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_URL
-        value: http://lens-test-lens-worker:4318
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_PUBLIC_URL
-        value: https://gateway.example/lens-ingest
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LENS_GATEWAY_SECRET
-        valueFrom:
-          secretKeyRef:
-            name: lens-test-lens-gateway
-            key: gateway-secret
- it: routes uploads directly to Lens instead of the gateway
-  template: ingress.yaml
-  set:
-    fullnameOverride: lens-test
-    lensWorker.enabled: true
-    lensWorker.publicUrl: https://gateway.example/lens-ingest
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-    ingress.enabled: true
-    ingress.host: gateway.example
-  asserts:
-  - contains:
-      path: spec.rules[0].http.paths
-      content:
-        path: /lens-ingest
-        pathType: Prefix
-        backend:
-          service:
-            name: lens-test-lens-worker
-            port:
-              number: 4318
- it: keeps internal routes out of a dedicated ingestion hostname
-  template: lens/ingress.yaml
-  set:
-    fullnameOverride: lens-test
-    lensWorker.enabled: true
-    lensWorker.publicUrl: https://gateway.example/lens-ingest
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-    lensWorker.ingress.enabled: true
-    lensWorker.ingress.host: traces.example
-  asserts:
-  - equal:
-      path: spec.rules[0].http.paths
-      value:
-      - path: /v1/
-        pathType: Prefix
-        backend:
-          service:
-            name: lens-test-lens-worker
-            port:
-              name: otlp
- it: maps the Lens service to the ingestion listener
-  template: lens/service.yaml
-  set: *id001
-  asserts:
-  - equal:
-      path: spec.selector
-      value:
-        app.kubernetes.io/instance: RELEASE-NAME
-        app.kubernetes.io/component: lens-worker
-  - equal:
-      path: spec.ports
-      value:
-      - name: otlp
-        port: 4318
-        targetPort: otlp
- it: gives only Lens the ClickHouse secret
-  template: lens/deployment.yaml
-  set: *id001
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: CLICKHOUSE_URL
-        valueFrom:
-          secretKeyRef:
-            name: lens-storage
-            key: url
- it: requires an agent reachable ingestion URL
-  template: gateway/deployment.yaml
-  set:
-    fullnameOverride: lens-test
-    lensWorker.enabled: true
-    lensWorker.publicUrl: ''
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-  asserts:
-  - failedTemplate:
-      errorMessage: lensWorker.publicUrl is required when there is no single ingress hostname
- it: omits Lens connection settings when disabled in gateway/deployment.yaml
-  template: gateway/deployment.yaml
-  asserts:
-  - notContains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_URL
-      any: true
- it: omits Lens connection settings when disabled in backend/deployment.yaml
-  template: backend/deployment.yaml
-  asserts:
-  - notContains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: LITELLM_LENS_URL
-      any: true
- it: preserves an existing ClickHouse database and retention
-  template: lens/deployment.yaml
-  set:
-    lensWorker.enabled: true
-    lensWorker.publicUrl: https://traces.example
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-    lensWorker.clickhouseDatabase: existing_traces
-    lensWorker.retentionDays: 45
-  asserts:
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: CLICKHOUSE_DATABASE
-        value: existing_traces
-  - contains:
-      path: spec.template.spec.containers[0].env
-      content:
-        name: AGENT_TRACING_RETENTION_DAYS
-        value: '45'
- it: keeps Lens pods outside the gateway autoscaling selector
-  template: lens/deployment.yaml
-  set: &id002
-    nameOverride: inference
-    lensWorker.enabled: true
-    lensWorker.publicUrl: https://traces.example
-    lensWorker.serviceTokenSecret.name: lens-service
-    lensWorker.clickhouseSecret.name: lens-storage
-  asserts:
-  - equal:
-      path: spec.template.metadata.labels["app.kubernetes.io/name"]
-      value: inference-lens-worker
- it: preserves the existing gateway deployment selector
-  template: gateway/deployment.yaml
-  set: *id002
-  asserts:
-  - equal:
-      path: spec.selector.matchLabels["app.kubernetes.io/name"]
-      value: inference
-values:
- ./values/required.yaml
--- a/helm/litellm/tests/lens_setup_tests.yaml
+++ b/helm/litellm/tests/lens_setup_tests.yaml
@ -1,164 +0,0 @@
-suite: Lens managed setup
-set:
-  fullnameOverride: lens-test
-  lensWorker.enabled: true
-  lensWorker.publicUrl: https://traces.example
-release:
-  namespace: lens
-  name: lens-test
-templates:
-  - lens/deployment.yaml
-  - lens/clickhouse.yaml
-  - lens/secrets.yaml
-tests:
-  - it: generates private login, gateway and storage credentials
-    template: lens/secrets.yaml
-    asserts:
-      - hasDocuments:
-          count: 4
-      - matchRegex:
-          path: data.service-token
-          pattern: '^[A-Za-z0-9+/]{86}==$'
-        documentIndex: 0
-      - matchRegex:
-          path: data.password
-          pattern: '^[A-Za-z0-9+/]{86}==$'
-        documentIndex: 1
-      - equal:
-          path: metadata.annotations["helm.sh/resource-policy"]
-          value: keep
-  - it: connects Lens to its private bundled storage
-    template: lens/deployment.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: CLICKHOUSE_HOST
-            value: lens-test-lens-clickhouse
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: CLICKHOUSE_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: lens-test-lens-clickhouse
-                key: password
-  - it: stores traces on a persistent volume with the chosen storage class
-    template: lens/clickhouse.yaml
-    documentIndex: 1
-    set:
-      lensWorker.clickhouse.storage: 40Gi
-      lensWorker.clickhouse.storageClassName: fast
-    asserts:
-      - equal:
-          path: spec.volumeClaimTemplates[0].spec
-          value:
-            accessModes: [ReadWriteOnce]
-            storageClassName: fast
-            resources:
-              requests:
-                storage: 40Gi
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: CLICKHOUSE_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: lens-test-lens-clickhouse
-                key: password
-  - it: keeps an existing external database instead of creating a new one
-    template: lens/clickhouse.yaml
-    set:
-      lensWorker.clickhouseSecret.name: external-clickhouse
-    asserts:
-      - hasDocuments:
-          count: 0
-  - it: leaves supplied secrets under their existing manager
-    template: lens/secrets.yaml
-    set:
-      lensWorker.clickhouseSecret.name: external-clickhouse
-      lensWorker.serviceTokenSecret.name: external-service
-      lensWorker.adminTokenSecret.name: external-admin
-      lensWorker.gateway.secretName: external-signing
-    asserts:
-      - hasDocuments:
-          count: 0
-  - it: creates no credentials or database when Lens is disabled
-    templates:
-      - lens/secrets.yaml
-      - lens/clickhouse.yaml
-    set:
-      lensWorker.enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-  - it: requires an external database when bundled storage is explicitly disabled
-    template: lens/deployment.yaml
-    set:
-      lensWorker.clickhouse.enabled: false
-    asserts:
-      - failedTemplate:
-          errorMessage: Lens clickhouseSecret.name is required when bundled storage is disabled
-  - it: keeps storage names valid and uses the same name for the connection
-    set:
-      fullnameOverride: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-    asserts:
-      - matchRegex:
-          path: metadata.name
-          pattern: '^[a-z]([-a-z0-9]{0,61}[a-z0-9])?$'
-        template: lens/clickhouse.yaml
-        documentIndex: 0
-      - matchRegex:
-          path: metadata.name
-          pattern: '^[a-z]([-a-z0-9]{0,61}[a-z0-9])?$'
-        template: lens/clickhouse.yaml
-        documentIndex: 1
-      - equal:
-          path: metadata.name
-          value: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lens-clickhouse
-        template: lens/clickhouse.yaml
-        documentIndex: 0
-      - equal:
-          path: spec.serviceName
-          value: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lens-clickhouse
-        template: lens/clickhouse.yaml
-        documentIndex: 1
-      - equal:
-          path: metadata.name
-          value: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lens-clickhouse
-        template: lens/secrets.yaml
-        documentIndex: 1
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: CLICKHOUSE_HOST
-            value: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lens-clickhouse
-        template: lens/deployment.yaml
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: CLICKHOUSE_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lens-clickhouse
-                key: password
-        template: lens/deployment.yaml
-  - it: allows cold storage startup and inherits registry credentials
-    template: lens/clickhouse.yaml
-    documentIndex: 1
-    set:
-      imagePullSecrets: [{name: registry-auth}]
-    asserts:
-      - equal:
-          path: spec.template.spec.imagePullSecrets
-          value: [{name: registry-auth}]
-      - equal:
-          path: spec.template.spec.containers[0].startupProbe
-          value:
-            httpGet: {path: /ping, port: http}
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 60
-
-values:
-  - ./values/required.yaml
--- a/helm/litellm/tests/lens_worker_tests.yaml
+++ b/helm/litellm/tests/lens_worker_tests.yaml
@ -1,79 +0,0 @@
-suite: Independent Lens release and credentials
-templates:
-  - lens/deployment.yaml
-values:
-  - ./values/required.yaml
-set:
-  fullnameOverride: lens-test
-  lensWorker.enabled: true
-  lensWorker.publicUrl: https://traces.example
-  lensWorker.serviceTokenSecret.name: lens-service
-  lensWorker.clickhouseSecret.name: lens-storage
-tests:
-  - it: selects a Lens release independently of the gateway
-    chart:
-      appVersion: 9.8.7
-    set:
-      backend.image.tag: gateway-9.8.7
-      lensWorker.image.tag: 2.3.4
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].image
-          value: ghcr.io/berriai/lens:2.3.4
-  - it: retains the pinned Lens chart default when only the gateway changes
-    chart:
-      appVersion: 9.8.7
-    set:
-      backend.image.tag: gateway-9.8.7
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].image
-          value: ghcr.io/berriai/lens:0.1.0-dev.0
-  - it: selects development publications explicitly
-    set:
-      lensWorker.image.repository: ghcr.io/berriai/lens-dev
-      lensWorker.image.tag: sha-0123456789abcdef
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].image
-          value: ghcr.io/berriai/lens-dev:sha-0123456789abcdef
-  - it: preserves a verified registry mirror and digest
-    set:
-      lensWorker.image.repository: registry.example/lens
-      lensWorker.image.tag: replaced-label
-      lensWorker.image.digest: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].image
-          value: registry.example/lens@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-  - it: rejects a malformed digest
-    set:
-      lensWorker.image.digest: sha256:invalid
-    asserts:
-      - failedTemplate:
-          errorMessage: Lens image.digest must be sha256 followed by 64 lowercase hex characters
-  - it: keeps the legacy enablement switch working
-    set:
-      lensWorker.enabled: false
-    asserts:
-      - hasDocuments: {count: 0}
-  - it: keeps isolated local analysis with delegated gateway access
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content: {name: LENS_MODE, value: standalone}
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: LENS_GATEWAY_SECRET
-            valueFrom:
-              secretKeyRef: {name: lens-test-lens-gateway, key: gateway-secret}
-      - equal:
-          path: spec.template.spec.automountServiceAccountToken
-          value: false
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
-          value: true
-      - equal:
-          path: spec.template.spec.volumes[0].emptyDir
-          value: {medium: Memory, sizeLimit: 1Gi}
--- a/helm/litellm/values.yaml
+++ b/helm/litellm/values.yaml
@ -654,70 +654,15 @@ ui:
  topologySpreadConstraints: []

 lens:
-  library: true
-
-lensWorker:
-  retainResources: false
-  mode: ""
-  externalUrl: ""
-  externalServiceName: ""
-  gateway:
-    secretName: ""
-    secretKey: gateway-secret
-  standaloneUrl: ""
-  adminTokenSecret:
-    name: ""
-    key: admin-token
-  extraEnv: []
-  extraEnvFrom: []
  enabled: false
-  replicaCount: 1
-  image:
-    repository: ghcr.io/berriai/lens
-    tag: "0.1.0-dev.0"
-    digest: ""
-    pullPolicy: IfNotPresent
-  tokenSecret:
+  url: ""
+  publicUrl: ""
+  service:
    name: ""
-    key: token
+    port: 4318
+  gatewaySecret:
+    name: ""
+    key: gateway-secret
  serviceTokenSecret:
    name: ""
    key: service-token
-  clickhouse:
-    enabled: true
-    image: clickhouse/clickhouse-server:26.9.6.6@sha256:eb4870e7ca7ed70c259eebfcfbee6cf797017f6b5436c2926bbbfe3d4d28486e
-    storage: 20Gi
-    storageClassName: null
-    resources:
-      requests:
-        cpu: 100m
-        memory: 512Mi
-      limits:
-        memory: 2Gi
-  clickhouseDatabase: litellm
-  retentionDays: 14
-  clickhouseSecret:
-    name: ""
-    key: url
-  publicUrl: ""
-  service:
-    port: 4318
-    annotations: {}
-  ingress:
-    enabled: false
-    path: /v1/
-    className: ""
-    host: ""
-    annotations: {}
-    tls: []
-  url: ""
-  tmpSizeLimit: 1Gi
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 2Gi
-  nodeSelector: {}
-  tolerations: []
-  affinity: {}
--- a/license_cache.json
+++ b/license_cache.json
--- a/litellm-proxy-extras/pyproject.toml
+++ b/litellm-proxy-extras/pyproject.toml
@ -1,6 +1,6 @@
 [project]
 name = "litellm-proxy-extras"
-version = "0.4.111"
+version = "0.4.112"
 description = "Additional files for the LiteLLM Proxy. Reduces the size of the main litellm package."
 readme = "README.md"
 requires-python = ">=3.9"
@ -30,7 +30,7 @@ required-version = ">=0.10.9"
 module-root = ""

 [tool.commitizen]
-version = "0.4.111"
+version = "0.4.112"
 version_files = [
    "pyproject.toml:^version",
    "../pyproject.toml:litellm-proxy-extras==",
--- a/litellm-rust/crates/llms-types/src/providers/anthropic/beta.rs
+++ b/litellm-rust/crates/llms-types/src/providers/anthropic/beta.rs
@ -238,7 +238,8 @@ impl AnthropicBeta {
            Self::ComputerUse20250124
            | Self::ComputerUse20251124
            | Self::Context1m20250807
-            | Self::ThinkingBindingControls20260801 => &[],
+            | Self::ThinkingBindingControls20260801
+            | Self::ThinkingDisplayUpdates20260818 => &[],
            Self::DangerousToolUse20260903 => &[BetaProvider::BedrockConverse],
            Self::Effort20251124 => &[BetaProvider::VertexAi],
            Self::FastMode20260201 | Self::Oauth20250420 => &[
@ -275,7 +276,6 @@ impl AnthropicBeta {
                BetaProvider::Databricks,
            ],
            Self::StructuredOutputs20251113 => &[BetaProvider::Bedrock, BetaProvider::VertexAi],
-            Self::ThinkingDisplayUpdates20260818 => &[BetaProvider::Databricks],
            Self::ToolSearchTool20251019 => &[
                BetaProvider::Anthropic,
                BetaProvider::AzureAi,
--- a/litellm/init.py
+++ b/litellm/init.py
@ -633,6 +633,7 @@ fireworks_ai_models: Set = set()
 baseten_models: Set[str] = set()
 fireworks_ai_embedding_models: Set = set()
 deepinfra_models: Set = set()
+clf_ai_gateway_models: set[str] = set()  # mutable-ok: filled at import like sibling sets
 perplexity_models: Set = set()
 watsonx_models: Set = set()
 gemini_models: Set = set()
@ -859,6 +860,8 @@ def _populate_provider_model_sets(model_cost_map: Mapping[str, Mapping[str, obje
            bedrock_converse_models.add(key)
        elif value.get("litellm_provider") == "deepinfra":
            deepinfra_models.add(key)
+        elif value.get("litellm_provider") == "clf_ai_gateway":  # pyright: ignore[reportUnknownMemberType]  # raw cost map
+            clf_ai_gateway_models.add(key)  # pyright: ignore[reportUnknownArgumentType]  # raw cost map key
        elif value.get("litellm_provider") == "perplexity":
            perplexity_models.add(key)
        elif value.get("litellm_provider") == "watsonx":
@ -1110,6 +1113,7 @@ model_list = list(
    | set(ollama_models)
    | bedrock_models
    | deepinfra_models
+    | clf_ai_gateway_models
    | perplexity_models
    | set(maritalk_models)
    | runwayml_models
@ -1235,6 +1239,7 @@ def _build_models_by_provider() -> dict:
        "ollama": ollama_models,
        "ollama_chat": ollama_models,
        "deepinfra": deepinfra_models,
+        "clf_ai_gateway": clf_ai_gateway_models,
        "perplexity": perplexity_models,
        "maritalk": maritalk_models,
        "watsonx": watsonx_models,
@ -1783,6 +1788,9 @@ if TYPE_CHECKING:
    from .llms.bespoke.decisions.transformation import (
        BespokeDecisionsConfig as BespokeDecisionsConfig,
    )
+    from .llms.eu_jev.decisions.transformation import (
+        EuJevDecisionsConfig as EuJevDecisionsConfig,
+    )
    from .llms.openai.decisions.transformation import (
        OpenAIDecisionsConfig as OpenAIDecisionsConfig,
    )
@ -2108,6 +2116,9 @@ if TYPE_CHECKING:
        LiteLLMProxyChatConfig as _LiteLLMProxyChatConfig,
    )
    from .llms.deepinfra.chat.transformation import DeepInfraConfig as _DeepInfraConfig
+    from .llms.clf_ai_gateway.chat.transformation import (
+        ClfAiGatewayConfig as _ClfAiGatewayConfig,
+    )
    from .llms.llamafile.chat.transformation import (
        LlamafileChatConfig as _LlamafileChatConfig,
    )
@ -2137,6 +2148,7 @@ if TYPE_CHECKING:
    IBMWatsonXAIConfig: Type[_IBMWatsonXAIConfig]
    LiteLLMProxyChatConfig: Type[_LiteLLMProxyChatConfig]
    DeepInfraConfig: Type[_DeepInfraConfig]
+    ClfAiGatewayConfig: type[_ClfAiGatewayConfig]
    LlamafileChatConfig: Type[_LlamafileChatConfig]
    LMStudioChatConfig: Type[_LMStudioChatConfig]
    LmStudioEmbeddingConfig: Type[_LmStudioEmbeddingConfig]
--- a/litellm/_lazy_imports_registry.py
+++ b/litellm/_lazy_imports_registry.py
@ -174,6 +174,7 @@ LLM_CONFIG_NAMES: Final = (
    "OllamaDecisionsConfig",
    "LayaDecisionsConfig",
    "BespokeDecisionsConfig",
+    "EuJevDecisionsConfig",
    "OpenAIDecisionsConfig",
    "AzureDecisionsConfig",
    "AzureAIDecisionsConfig",
@ -244,6 +245,7 @@ LLM_CONFIG_NAMES: Final = (
    "MistralEmbeddingConfig",
    "OpenAIImageVariationConfig",
    "DeepInfraConfig",
+    "ClfAiGatewayConfig",
    "DeepgramAudioTranscriptionConfig",
    "TopazImageVariationConfig",
    "OpenAITextCompletionConfig",
@ -753,6 +755,7 @@ _LLM_CONFIGS_IMPORT_MAP: Final = {
    "OllamaDecisionsConfig": (".llms.ollama.decisions.transformation", "OllamaDecisionsConfig"),
    "LayaDecisionsConfig": (".llms.laya.decisions.transformation", "LayaDecisionsConfig"),
    "BespokeDecisionsConfig": (".llms.bespoke.decisions.transformation", "BespokeDecisionsConfig"),
+    "EuJevDecisionsConfig": (".llms.eu_jev.decisions.transformation", "EuJevDecisionsConfig"),
    "OpenAIDecisionsConfig": (".llms.openai.decisions.transformation", "OpenAIDecisionsConfig"),
    "AzureDecisionsConfig": (".llms.azure.decisions.transformation", "AzureDecisionsConfig"),
    "AzureAIDecisionsConfig": (".llms.azure_ai.decisions.transformation", "AzureAIDecisionsConfig"),
@ -973,6 +976,10 @@ _LLM_CONFIGS_IMPORT_MAP: Final = {
        "OpenAIImageVariationConfig",
    ),
    "DeepInfraConfig": (".llms.deepinfra.chat.transformation", "DeepInfraConfig"),
+    "ClfAiGatewayConfig": (
+        ".llms.clf_ai_gateway.chat.transformation",
+        "ClfAiGatewayConfig",
+    ),
    "DeepgramAudioTranscriptionConfig": (
        ".llms.deepgram.audio_transcription.transformation",
        "DeepgramAudioTranscriptionConfig",
--- a/litellm/_logging.py
+++ b/litellm/_logging.py
@ -28,9 +28,11 @@ from litellm.litellm_core_utils.env_utils import get_env_int
 from litellm.litellm_core_utils.safe_json_dumps import UNSERIALIZABLE_OBJECT, safe_dumps, safe_json_structure
 from litellm.litellm_core_utils.safe_json_loads import safe_json_loads
 from litellm.litellm_core_utils.secret_redaction import (
+    REDACTED,
    python_redact_string,
    python_redact_structured_value,
    redact_internal_details,
+    redact_structured_value,
 )
 from litellm.litellm_core_utils.secret_redaction import (
    redact_string as redact_secret_string,
@ -140,6 +142,32 @@ def redact_internal_details_from_client_message(value: str) -> str:
    return redact_internal_details(value)


+_CLIENT_FIELDS: Final = TypeAdapter(dict[str, object])
+_CLIENT_ITEMS: Final = TypeAdapter(list[object])
+
+
+def _redacted_client_field(key: str | None, value: object) -> object:
+    if isinstance(value, str):
+        return redact_internal_details(redact_structured_value(key, value))
+    if isinstance(value, dict):
+        return {
+            child_key: _redacted_client_field(child_key, child)
+            for child_key, child in _CLIENT_FIELDS.validate_python(value).items()
+        }
+    if isinstance(value, (list, tuple)):
+        return [_redacted_client_field(key, child) for child in _CLIENT_ITEMS.validate_python(value)]
+    if not isinstance(value, (int, float)):
+        return value
+    text: Final = str(value)
+    return value if redact_structured_value(key, text) == text else REDACTED
+
+
+def redact_internal_details_from_client_fields(fields: Mapping[str, object]) -> object:
+    if not _ENABLE_SECRET_REDACTION:
+        return fields
+    return _redacted_client_field(None, dict(fields))
+
+
 def _substituted_color_message(record: logging.LogRecord) -> str | None:
    """Render a record's ``color_message`` against its args, or None if absent.

--- a/litellm/caching/Readme.md
+++ b/litellm/caching/Readme.md
@ -8,10 +8,9 @@ The following caching mechanisms are supported:
 2. **RedisSemanticCache**
 3. **QdrantSemanticCache**
 4. **InMemoryCache**
-5. **DiskCache**
-6. **S3Cache**
-7. **AzureBlobCache**
-8. **DualCache** (updates both Redis and an in-memory cache simultaneously)
+5. **S3Cache**
+6. **AzureBlobCache**
+7. **DualCache** (updates both Redis and an in-memory cache simultaneously)

 ## Folder Structure

@ -20,7 +19,6 @@ litellm/caching/
 ├── base_cache.py
 ├── caching.py
 ├── caching_handler.py
-├── disk_cache.py
 ├── dual_cache.py
 ├── in_memory_cache.py
 ├── qdrant_semantic_cache.py
--- a/litellm/caching/init.py
+++ b/litellm/caching/init.py
@ -1,6 +1,5 @@
 from .azure_blob_cache import AzureBlobCache
 from .caching import Cache, LiteLLMCacheType
-from .disk_cache import DiskCache
 from .dual_cache import DualCache
 from .gcs_cache import GCSCache
 from .in_memory_cache import InMemoryCache
--- a/litellm/caching/caching.py
+++ b/litellm/caching/caching.py
@ -18,7 +18,7 @@ from contextlib import contextmanager
 from enum import Enum
 from typing import Any, Final, Literal, cast

-from pydantic import BaseModel, TypeAdapter
+from pydantic import BaseModel, ConfigDict, TypeAdapter

 import litellm
 from litellm._internal_context import current_service_target, service_target
@ -31,7 +31,6 @@ from litellm.types.utils import EmbeddingResponse, is_litellm_owned_kwarg

 from .azure_blob_cache import AzureBlobCache
 from .base_cache import BaseCache
-from .disk_cache import DiskCache
 from .dual_cache import DualCache  # noqa: F401  # re-exported, callers import DualCache from litellm.caching.caching
 from .gcs_cache import GCSCache
 from .in_memory_cache import InMemoryCache
@ -44,6 +43,9 @@ from .s3_cache import S3Cache
 RESPONSE_CACHE_TARGET: Final = "llm_response"
 _ALWAYS_KEYED_PROVIDER_PARAMS: Final = frozenset({"continuation_token"})
 _DECODED_LITERAL: Final = TypeAdapter(object)
+_REDIS_STARTUP_NODES_ADAPTER: Final = TypeAdapter(
+    list[dict[str, object]], config=ConfigDict(strict=True, hide_input_in_errors=True)
+)


@contextmanager
@ -153,7 +155,7 @@ class Cache:
        Initializes the cache based on the given type.

        Args:
-            type (str, optional): The type of cache to initialize. Can be "local", "redis", "redis-semantic", "qdrant-semantic", "s3" or "disk". Defaults to "local".
+            type (str, optional): The type of cache to initialize. Can be "local", "redis", "redis-semantic", "qdrant-semantic" or "s3". Defaults to "local".

            # Redis Cache Args
            host (str, optional): The host address for the Redis cache. Required if type is "redis".
@ -174,9 +176,6 @@ class Cache:
            semantic_cache_scope (str, optional): "key" isolates semantic-cache buckets per key/team/org. "end_user" additionally isolates per end user (falls back to the key scope when the request carries no end-user id). Defaults to "key".
            max_messages (int, optional): Requests with more `messages` (or Responses API `input` items) than this are neither looked up nor stored, so long agent conversations never serve or create a cache entry. None disables the limit. Defaults to 4.

-            # Disk Cache Args
-            disk_cache_dir (str, optional): The directory for the disk cache. Defaults to None.
-
            # S3 Cache Args
            s3_bucket_name (str, optional): The bucket name for the s3 cache. Defaults to None.
            s3_region_name (str, optional): The region name for the s3 cache. Defaults to None.
@ -211,7 +210,7 @@ class Cache:
            if not redis_startup_nodes:
                _env_cluster_nodes: Final = litellm.get_secret("REDIS_CLUSTER_NODES")
                if _env_cluster_nodes is not None and isinstance(_env_cluster_nodes, str):
-                    redis_startup_nodes = json.loads(_env_cluster_nodes)
+                    redis_startup_nodes = _REDIS_STARTUP_NODES_ADAPTER.validate_python(json.loads(_env_cluster_nodes))

            if redis_startup_nodes:
                # Only pass GCP parameters if they are provided
@ -306,8 +305,11 @@ class Cache:
                account_url=azure_account_url,
                container=azure_blob_container,
            )
-        elif type == LiteLLMCacheType.DISK:
-            self.cache = DiskCache(disk_cache_dir=disk_cache_dir)
+        else:
+            supported_types: Final = ", ".join(member.value for member in LiteLLMCacheType)
+            raise ValueError(f"Unsupported cache type {type!r}. Supported types: {supported_types}")
+        if disk_cache_dir is not None:
+            verbose_logger.warning("Ignoring disk_cache_dir, the disk cache backend was removed")
        if "cache" not in litellm.input_callback:
            litellm.input_callback.append("cache")
        if "cache" not in litellm.success_callback:
@ -1044,7 +1046,7 @@ def enable_cache(
    Enable cache with the specified configuration.

    Args:
-        type (Optional[Literal["local", "redis", "s3", "disk"]]): The type of cache to enable. Defaults to "local".
+        type (Optional[Literal["local", "redis", "s3"]]): The type of cache to enable. Defaults to "local".
        host (Optional[str]): The host address of the cache server. Defaults to None.
        port (Optional[str]): The port number of the cache server. Defaults to None.
        password (Optional[str]): The password for the cache server. Defaults to None.
@ -1056,7 +1058,7 @@ def enable_cache(
        None

    Raises:
-        None
+        ValueError: If no cache is set yet and the cache type is unsupported.
    """
    print_verbose("LiteLLM: Enabling Cache")
    if "cache" not in litellm.input_callback:
@ -1091,7 +1093,7 @@ def update_cache(
    Update the cache for LiteLLM.

    Args:
-        type (Optional[Literal["local", "redis", "s3", "disk"]]): The type of cache. Defaults to "local".
+        type (Optional[Literal["local", "redis", "s3"]]): The type of cache. Defaults to "local".
        host (Optional[str]): The host of the cache. Defaults to None.
        port (Optional[str]): The port of the cache. Defaults to None.
        password (Optional[str]): The password for the cache. Defaults to None.
--- a/litellm/caching/caching_handler.py
+++ b/litellm/caching/caching_handler.py
@ -9,7 +9,7 @@ This file is a wrapper around caching.py

 This class is used to handle caching logic specific for LLM API requests (completion / embedding / text_completion / transcription etc)

-It utilizes the (RedisCache, s3Cache, RedisSemanticCache, QdrantSemanticCache, InMemoryCache, DiskCache) based on what the user has setup
+It utilizes the (RedisCache, s3Cache, RedisSemanticCache, QdrantSemanticCache, InMemoryCache) based on what the user has setup

 In each method it will call the appropriate method from caching.py
 """
--- a/litellm/caching/disk_cache.py
+++ b/litellm/caching/disk_cache.py
@ -1,92 +0,0 @@
-import json
-from typing import TYPE_CHECKING, Any, Final
-
-from pydantic import TypeAdapter
-
-from .base_cache import BaseCache
-
-if TYPE_CHECKING:
-    from opentelemetry.trace import Span as _Span
-
-    Span = _Span
-else:
-    Span = Any
-
-_DECODED_DISK_VALUE: Final = TypeAdapter(object)
-
-
-class DiskCache(BaseCache):
-    def __init__(self, disk_cache_dir: str | None = None):
-        try:
-            import diskcache as dc
-        except ModuleNotFoundError as e:
-            raise ModuleNotFoundError("Please install litellm with `litellm[caching]` to use disk caching.") from e
-
-        # if users don't provider one, use the default litellm cache
-        if disk_cache_dir is None:
-            self.disk_cache = dc.Cache(".litellm_cache")
-        else:
-            self.disk_cache = dc.Cache(disk_cache_dir)
-
-    def set_cache(self, key, value, **kwargs):
-        if "ttl" in kwargs:
-            self.disk_cache.set(key, value, expire=kwargs["ttl"])
-        else:
-            self.disk_cache.set(key, value)
-
-    async def async_set_cache(self, key, value, **kwargs):
-        self.set_cache(key=key, value=value, **kwargs)
-
-    async def async_set_cache_pipeline(self, cache_list, **kwargs):
-        for cache_key, cache_value in cache_list:
-            if "ttl" in kwargs:
-                self.set_cache(key=cache_key, value=cache_value, ttl=kwargs["ttl"])
-            else:
-                self.set_cache(key=cache_key, value=cache_value)
-
-    def get_cache(self, key, **kwargs):
-        original_cached_response: Final = self.disk_cache.get(key)
-        if original_cached_response:
-            try:
-                cached_response = _DECODED_DISK_VALUE.validate_python(json.loads(original_cached_response))
-            except Exception:
-                cached_response = original_cached_response
-            return cached_response
-        return None
-
-    def batch_get_cache(self, keys: list, **kwargs):
-        return_val: Final = []
-        for k in keys:
-            val = self.get_cache(key=k, **kwargs)
-            return_val.append(val)
-        return return_val
-
-    def increment_cache(self, key, value: int, **kwargs) -> int:
-        with self.disk_cache.transact():
-            cached_value: Final = self.get_cache(key=key)
-            init_value: Final = cached_value if isinstance(cached_value, int) else 0
-            new_value: Final = init_value + value
-            self.set_cache(key, new_value, **kwargs)
-            return new_value
-
-    async def async_get_cache(self, key, **kwargs):
-        return self.get_cache(key=key, **kwargs)
-
-    async def async_batch_get_cache(self, keys: list, **kwargs):
-        return_val: Final = []
-        for k in keys:
-            val = self.get_cache(key=k, **kwargs)
-            return_val.append(val)
-        return return_val
-
-    async def async_increment(self, key, value: int, **kwargs) -> int:
-        return self.increment_cache(key=key, value=value, **kwargs)
-
-    def flush_cache(self):
-        self.disk_cache.clear()
-
-    async def disconnect(self):
-        pass
-
-    def delete_cache(self, key):
-        self.disk_cache.pop(key)
--- a/litellm/completion_extras/litellm_responses_transformation/transformation.py
+++ b/litellm/completion_extras/litellm_responses_transformation/transformation.py
@ -1979,6 +1979,7 @@ class OpenAiResponsesToChatCompletionStreamIterator(BaseModelResponseIterator):
        self._tool_call_index_map: dict[int, int] = {}  # mutable-ok: per-stream accumulator state
        self._structured_output: Final = structured_output
        self._first_message_item_done: bool = False
+        self._reasoning_summary_streamed: bool = False

    def _handle_string_chunk(
        self, str_line: Union[str, "BaseModel"]
@ -2021,6 +2022,7 @@ class OpenAiResponsesToChatCompletionStreamIterator(BaseModelResponseIterator):
        tool_call_index_map: dict[int, int] | None = None,  # mutable-ok: per-stream state, remapped in place
        replays_openai_history: bool = False,
        structured_output: bool = False,
+        reasoning_summary_streamed: bool = False,
    ) -> "ModelResponseStream":
        """
        Translate a Responses API streaming chunk to OpenAI chat completion streaming format.
@ -2030,6 +2032,7 @@ class OpenAiResponsesToChatCompletionStreamIterator(BaseModelResponseIterator):
            tool_call_index_map: Per-stream output_index -> sequential tool_call index map
            replays_openai_history: Record the completed output's item sequence for the next turn
            structured_output: Only the first message item became content
+            reasoning_summary_streamed: Whether earlier chunks already streamed reasoning summary text

        Returns:
            ModelResponseStream: OpenAI-formatted streaming chunk
@ -2210,13 +2213,15 @@ class OpenAiResponsesToChatCompletionStreamIterator(BaseModelResponseIterator):
                )
            else:
                raise ValueError(f"Chat provider: Invalid text delta {parsed_chunk}")
+        elif event_type == "response.reasoning_summary_part.added" and reasoning_summary_streamed:
+            return ModelResponseStream(choices=[StreamingChoices(index=0, delta=Delta(reasoning_content=" "))])
        elif event_type == "response.reasoning_summary_text.delta":
            content_part = parsed_chunk.get("delta", None)
            if content_part:
                return ModelResponseStream(
                    choices=[
                        StreamingChoices(
-                            index=cast(int, parsed_chunk.get("summary_index")),
+                            index=0,
                            delta=Delta(reasoning_content=content_part),
                        )
                    ]
@ -2317,10 +2322,13 @@ class OpenAiResponsesToChatCompletionStreamIterator(BaseModelResponseIterator):
                tool_call_index_map=self._tool_call_index_map,
                replays_openai_history=self._replays_openai_history,
                structured_output=self._structured_output,
+                reasoning_summary_streamed=self._reasoning_summary_streamed,
            )
        )
        if self._structured_output and _is_message_item_done(chunk):
            self._first_message_item_done = True
+        if _responses_event_type(chunk) == "response.reasoning_summary_text.delta" and chunk.get("delta"):
+            self._reasoning_summary_streamed = True
        return self._with_served_service_tier(self._with_stream_scoped_id(translated))

    def _is_text_delta_after_structured_answer(self, chunk: Mapping[str, object]) -> bool:
--- a/litellm/constants.py
+++ b/litellm/constants.py
@ -753,7 +753,13 @@ ANTHROPIC_BATCHES_ROUTE: Final = "/v1/messages/batches"
 ANTHROPIC_IMAGE_MAX_LONG_EDGE_PX: Final = 1568
 ANTHROPIC_IMAGE_MAX_PIXELS: Final = 1_150_000
 ANTHROPIC_IMAGE_PIXELS_PER_TOKEN: Final = 750
+OPENAI_PDF_TEXT_PAGE_FRAMING_TOKENS: Final = 13
+OPENAI_CHAT_PDF_FILE_TOKENS: Final = 192
 PDF_DATA_URL_PREFIX: Final = "data:application/pdf;base64,"
+PDF_MAX_FORM_XOBJECT_DEPTH: Final = 32
+PDF_MAX_XOBJECT_DRAWS_PER_PAGE: Final = 10_000
+OPENAI_MODEL_NAME_MAX_DASHES: Final = 16
+OPENAI_CHAT_MODES: Final = frozenset({"chat", "responses"})
 VERTEX_BATCH_PREDICTION_JOBS_ROUTE: Final = "batchPredictionJobs"
 ANTHROPIC_WEB_SEARCH_TOOL_MAX_USES: Final = {
    "low": 1,
@ -813,6 +819,7 @@ LITELLM_CHAT_PROVIDERS: Final = [
    "ollama",
    "ollama_chat",
    "deepinfra",
+    "clf_ai_gateway",
    "perplexity",
    "mistral",
    "groq",
@ -1012,6 +1019,7 @@ openai_compatible_endpoints: Final[list[str]] = [
    "api.perplexity.ai",
    "api.endpoints.anyscale.com/v1",
    "api.deepinfra.com/v1/openai",
+    "api.clfaigateway.dev/v1",
    "api.mistral.ai/v1",
    "codestral.mistral.ai/v1/chat/completions",
    "codestral.mistral.ai/v1/fim/completions",
@ -1083,6 +1091,7 @@ openai_compatible_providers: Final[list[str]] = [
    "deepseek",
    "tencent",
    "deepinfra",
+    "clf_ai_gateway",
    "perplexity",
    "xinference",
    "xai",
--- a/litellm/cost_calculator.py
+++ b/litellm/cost_calculator.py
@ -153,7 +153,9 @@ from litellm.utils import (
    ProviderConfigManager,
    TextCompletionResponse,
    TranscriptionResponse,
+    cached_cost_map_key,
    cached_get_model_info_helper,
+    mapped_model_fill_missing,
    model_info_with_pricing_overrides,
    runtime_model_cost_registrations,
    token_counter,
@ -962,21 +964,17 @@ def select_model_name_for_cost_calc(
    """
    1. If custom pricing is true, return received model name
    2. If base_model is set (e.g. for azure models), return that
-    3. If completion response has model set return that
+    3. If completion response has model set return that, unless only the requested model's cost-map row has rates
    4. Check if model is passed in return that
    """

    return_model: str | None = None
    custom_llm_provider = _get_provider_for_cost_calc(model=model, custom_llm_provider=custom_llm_provider)

-    completion_response_model: str | None = None
-    if completion_response is not None:
-        if isinstance(completion_response, BaseModel):
-            completion_response_model = getattr(completion_response, "model", None)
-        elif isinstance(completion_response, dict):
-            completion_response_model = completion_response.get("model", None)
+    completion_response_model: Final = _get_response_model(completion_response)
    hidden_params: Final[dict | None] = getattr(completion_response, "_hidden_params", None)
    provider_response_model: Final = _get_hidden_str_for_cost_calc(hidden_params, "provider_response_model")
+    requested_model: Final = model or _get_hidden_str_for_cost_calc(hidden_params, "litellm_model_name")
    explicit_pricing: Final = custom_pricing is True or base_model is not None
    configured_model: Final = model or (
        completion_response_model if isinstance(completion_response_model, str) else None
@ -1002,35 +1000,72 @@ def select_model_name_for_cost_calc(
        else:
            return_model = model

-    elif base_model is not None or bedrock_pricing_model is not None or provider_response_model is not None:
-        return_model = base_model if base_model is not None else bedrock_pricing_model or provider_response_model
+    elif base_model is not None or bedrock_pricing_model is not None:
+        return_model = base_model if base_model is not None else bedrock_pricing_model
+
+    elif provider_response_model is not None:
+        return _served_or_priced_requested_model(
+            provider_response_model, requested_model, custom_llm_provider, priced_region
+        )

    elif completion_response_model is None and hidden_params is not None:
        if hidden_params.get("model", None) is not None and len(hidden_params["model"]) > 0:
            return_model = hidden_params.get("model", model)

    if return_model is None and completion_response_model is not None:
-        return_model = completion_response_model
+        return _served_or_priced_requested_model(
+            completion_response_model, requested_model, custom_llm_provider, priced_region
+        )

    if return_model is None and model is not None:
        return_model = model

-    if (
-        return_model is not None
-        and custom_llm_provider is not None
-        and not _model_contains_known_llm_provider(return_model)
-    ):  # add provider prefix if not already present, to match model_cost
-        provider_prefix: Final = (
-            custom_llm_provider if priced_region is None else f"{custom_llm_provider}/{priced_region}"
-        )
-        return_model = _strip_unregistered_leading_segments(f"{provider_prefix}/{return_model}", priced_region)
-
-    return return_model
+    if return_model is None:
+        return None
+    return _cost_map_model_name(return_model, custom_llm_provider, priced_region)


 _select_model_name_for_cost_calc = select_model_name_for_cost_calc


+def _cost_map_model_name(model: str, custom_llm_provider: str | None, region_name: str | None) -> str:
+    if custom_llm_provider is None or _model_contains_known_llm_provider(model):
+        return model
+    provider_prefix: Final = custom_llm_provider if region_name is None else f"{custom_llm_provider}/{region_name}"
+    return _strip_unregistered_leading_segments(f"{provider_prefix}/{model}", region_name)
+
+
+def _rule_declares_rates(model: str, custom_llm_provider: str | None) -> bool:
+    rule_info: Final = unmapped_model_generalization(model, custom_llm_provider)
+    return rule_info is not None and _cost_map_entry_prices_anything(rule_info)
+
+
+def _resolves_to_rates(model: str, custom_llm_provider: str | None) -> bool:
+    key: Final = cached_cost_map_key(model, custom_llm_provider)
+    if key is None:
+        return False
+    entry: Final = _raw_cost_map_entry(key)
+    if entry is None:
+        return _rule_declares_rates(model, custom_llm_provider)
+    fill_missing: Final = mapped_model_fill_missing(key, entry)
+    return _cost_map_entry_prices_anything(entry if fill_missing is None else {**fill_missing, **entry})
+
+
+def _served_or_priced_requested_model(
+    served_model: str, requested_model: str | None, custom_llm_provider: str | None, priced_region: str | None
+) -> str:
+    served: Final = _cost_map_model_name(served_model, custom_llm_provider, priced_region)
+    if requested_model is None:
+        return served
+    requested: Final = _cost_map_model_name(requested_model, custom_llm_provider, None)
+    if served in (requested, requested.partition("/")[2]):
+        return served
+    pricing_provider: Final = _get_provider_for_cost_calc(requested, custom_llm_provider)
+    if _resolves_to_rates(served, pricing_provider):
+        return served
+    return requested if _resolves_to_rates(requested, pricing_provider) else served
+
+
 def _strip_unregistered_leading_segments(model: str, region_name: str | None) -> str:
    """Resolve a provider-prefixed slash alias like "vertex_ai/vertex/claude-opus-5" to the
    registered cost key ("vertex_ai/claude-opus-5"), keeping the model unchanged when it already
@ -1887,7 +1922,10 @@ def completion_cost(
                        video_resolution=video_resolution,
                    )
                elif call_type in _SPEECH_CALL_TYPES:
-                    prompt_characters = litellm.utils.count_characters(text=prompt)
+                    prompt_characters = _speech_billed_characters(
+                        completion_response if isinstance(completion_response, HttpxBinaryResponseContent) else None,
+                        prompt,
+                    )
                elif call_type in _TRANSCRIPTION_CALL_TYPES:
                    # Check _hidden_params first (duration stored there to
                    # avoid polluting the response body), then fall back to
@ -2366,6 +2404,11 @@ def response_cost_calculator(
        raise e


+def _speech_billed_characters(speech_response: HttpxBinaryResponseContent | None, prompt: str) -> int:
+    reported: Final = speech_response.hidden_params.get("billed_characters") if speech_response is not None else None
+    return reported if isinstance(reported, int) else litellm.utils.count_characters(text=prompt)
+
+
 def _video_input_image_cost(
    model: str,
    custom_llm_provider: str | None,
@ -3508,7 +3551,7 @@ def _cost_map_entry_declares_pricing(model_name: str, custom_llm_provider: str)
    lookups cannot strip that prefix, so a zero-rated override read as declaring nothing, and a
    session that should bill nothing fell through to the public rates instead.
    """
-    resolved: Final = _get_model_info_or_none(model_name, custom_llm_provider)
+    resolved: Final = _cost_map_model_info(model_name, custom_llm_provider)
    entries: Final = (
        litellm.model_cost.get(resolved.get("key")) if resolved is not None else None,
        litellm.model_cost.get(model_name),
@ -3704,9 +3747,9 @@ def handle_realtime_transcription_cost_calculation(
        return 0.0

    model_name: Final = _get_transcription_model_name_from_results(results) or litellm_model_name
-    model_info: Final = _get_model_info_or_none(model_name, custom_llm_provider)
+    model_info: Final = _cost_map_model_info(model_name, custom_llm_provider)
    override_info: Final = (
-        _get_model_info_or_none(custom_pricing_model, custom_llm_provider) if custom_pricing_model is not None else None
+        _cost_map_model_info(custom_pricing_model, custom_llm_provider) if custom_pricing_model is not None else None
    )

    total_cost = 0.0
@ -3737,13 +3780,6 @@ def _get_transcription_model_name_from_results(
    return None


-def _get_model_info_or_none(model: str, custom_llm_provider: str) -> ModelInfo | None:
-    try:
-        return litellm.get_model_info(model=model, custom_llm_provider=custom_llm_provider)
-    except Exception:
-        return None
-
-
 _TranscriptionRateKey: TypeAlias = Literal[
    "input_cost_per_second", "input_cost_per_audio_token", "input_cost_per_token", "output_cost_per_token"
 ]
--- a/litellm/images/main.py
+++ b/litellm/images/main.py
@ -53,7 +53,7 @@ from litellm.main import (
 from litellm.secret_managers.main import get_secret_str
 from litellm.types.images.main import ImageEditOptionalRequestParams
 from litellm.types.llms.openai import ImageGenerationRequestQuality
-from litellm.types.router import GenericLiteLLMParams
+from litellm.types.router import CustomPricingLiteLLMParams, GenericLiteLLMParams
 from litellm.types.utils import (
    LITELLM_IMAGE_VARIATION_PROVIDERS,
    LlmProviders,
@ -1010,6 +1010,7 @@ def image_edit(
            optional_params=dict(image_edit_request_params),
            litellm_params={
                **image_edit_request_params,
+                **litellm_params.model_dump(include=set(CustomPricingLiteLLMParams.model_fields), exclude_none=True),
                "litellm_call_id": litellm_call_id,
                "model_info": model_info,
                "vertex_location": litellm_params.vertex_location,
--- a/litellm/images/utils.py
+++ b/litellm/images/utils.py
@ -20,7 +20,7 @@ class ImageEditRequestUtils:
        image_edit_optional_params: ImageEditOptionalRequestParams,
        drop_params: bool | None = None,
        additional_drop_params: Collection[str] | None = None,
-    ) -> dict:
+    ) -> dict[str, object]:
        """
        Get optional parameters for the image edit API.

--- a/litellm/integrations/arize/arize_phoenix_client.py
+++ b/litellm/integrations/arize/arize_phoenix_client.py
@ -5,9 +5,17 @@ Arize Phoenix API client for fetching prompt versions from Arize Phoenix.
 import urllib.parse
 from typing import Final

+from pydantic import BaseModel, ConfigDict
+
 from litellm.llms.custom_httpx.http_handler import HTTPHandler


+class _PromptVersionResponse(BaseModel):
+    model_config = ConfigDict(extra="ignore", strict=True, frozen=True, hide_input_in_errors=True)
+
+    data: dict[str, object] | None = None
+
+
 def _sanitize_id(identifier: str) -> str:
    """Reject path traversal characters and URL-encode the identifier."""
    if any(c in identifier for c in ("/", "\\", "#", "?")):
@ -71,8 +79,7 @@ class ArizePhoenixClient:
            response: Final = self.http_handler.get(url, headers=self.headers)
            response.raise_for_status()

-            data: Final = response.json()
-            return data.get("data")
+            return _PromptVersionResponse.model_validate(response.json()).data

        except Exception as e:
            # Check if it's an HTTP error
--- a/litellm/integrations/opentelemetry.py
+++ b/litellm/integrations/opentelemetry.py
@ -72,7 +72,7 @@ if TYPE_CHECKING:
    )
    from litellm.proxy.proxy_server import UserAPIKeyAuth as _UserAPIKeyAuth

-    Span = _Span | Any
+    Span = _Span
    Tracer = _Tracer
    Context = _Context
    SpanExporter = _SpanExporter
@ -1440,7 +1440,7 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
            span = None
            # Only set attributes if the span is still recording (not closed)
            # Note: parent_span is guaranteed to be not None here
-            if hasattr(parent_span, "set_status"):
+            if parent_span is not None and hasattr(parent_span, "set_status"):
                parent_span.set_status(Status(StatusCode.OK))
                self.set_attributes(parent_span, kwargs, response_obj)
            # Raw-request as direct child of parent_span
@ -2233,7 +2233,7 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
            # record error on parent span (keeps hierarchy shallow)
            # Only set attributes if the span is still recording (not closed)
            # Note: parent_otel_span is guaranteed to be not None here
-            if parent_otel_span.is_recording():
+            if parent_otel_span is not None and parent_otel_span.is_recording():
                self.set_attributes(parent_otel_span, kwargs, response_obj)
                parent_error_message: Final = self._record_exception_on_span(span=parent_otel_span, kwargs=kwargs)
                parent_otel_span.set_status(Status(StatusCode.ERROR, parent_error_message))
--- a/litellm/litellm_core_utils/get_llm_provider_logic.py
+++ b/litellm/litellm_core_utils/get_llm_provider_logic.py
@ -292,6 +292,10 @@ def get_llm_provider(
                    elif endpoint == "api.deepinfra.com/v1/openai":
                        custom_llm_provider = "deepinfra"
                        dynamic_api_key = get_secret_str("DEEPINFRA_API_KEY")
+                    elif endpoint == "api.clfaigateway.dev/v1":
+                        custom_llm_provider = "clf_ai_gateway"  # rebind-ok: endpoint inference, like every branch
+                        clf_env_key = get_secret_str("CLF_AI_GATEWAY_API_KEY")
+                        dynamic_api_key = api_key or clf_env_key
                    elif endpoint == "api.mistral.ai/v1":
                        custom_llm_provider = "mistral"
                        dynamic_api_key = get_secret_str("MISTRAL_API_KEY")
@ -644,6 +648,11 @@ def _get_openai_compatible_provider_info(
            api_base,
            dynamic_api_key,
        ) = litellm.DeepInfraConfig().get_openai_compatible_provider_info(api_base, api_key)
+    elif custom_llm_provider == "clf_ai_gateway":
+        (
+            api_base,  # rebind-ok: resolved base/key are what this function returns, like every branch
+            dynamic_api_key,  # rebind-ok: see above
+        ) = litellm.ClfAiGatewayConfig().get_openai_compatible_provider_info(api_base, api_key)
    elif custom_llm_provider == "empower":
        api_base = api_base or get_secret("EMPOWER_API_BASE") or "https://app.empower.dev/api/v1"
        dynamic_api_key = api_key or get_secret_str("EMPOWER_API_KEY")
--- a/litellm/litellm_core_utils/litellm_logging.py
+++ b/litellm/litellm_core_utils/litellm_logging.py
@ -202,6 +202,7 @@ from litellm.types.utils import (
    TextCompletionResponse,
    TranscriptionResponse,
    Usage,
+    batch_chat_usage,
 )
 from litellm.types.videos.main import VideoObject
 from litellm.utils import get_base_model_from_metadata, print_verbose
@ -2091,6 +2092,11 @@ class Logging(LiteLLMLoggingBaseClass):
            elif router_model_id is None and "model_id" in hidden_params:  # use model_id if not already set
                router_model_id = hidden_params["model_id"]

+        if isinstance(priced_result, LiteLLMBatch) and (
+            not batch_cost_is_final(priced_result) or self._is_batch_poll_without_logging(priced_result)
+        ):
+            return 0.0
+
        # Fallback: extract router_model_id from litellm_params when not available
        # from the result object. ResponsesAPIResponse objects (used by /v1/responses
        # streaming) don't carry _hidden_params["model_id"] like ModelResponse does.
@ -3346,6 +3352,10 @@ class Logging(LiteLLMLoggingBaseClass):
        finally:
            self._restore_correlation_context()

+    def _is_batch_poll_without_logging(self, result: object) -> bool:
+        litellm_metadata: Final = (self.litellm_params or {}).get("litellm_metadata") or {}
+        return isinstance(result, LiteLLMBatch) and litellm_metadata.get("batch_ignore_default_logging", False) is True
+
    def _success_handler_body(
        self,
        result: object = None,
@ -3860,11 +3870,7 @@ class Logging(LiteLLMLoggingBaseClass):

        ## CALCULATE COST FOR BATCH JOBS
        if self.call_type == CallTypes.aretrieve_batch.value and isinstance(result, LiteLLMBatch):
-            litellm_params = self.litellm_params or {}
-            litellm_metadata: Final = litellm_params.get("litellm_metadata") or {}
-            if (
-                litellm_metadata.get("batch_ignore_default_logging", False) is True
-            ):  # polling job will query these frequently, don't spam db logs
+            if self._is_batch_poll_without_logging(result):
                return

            batch_cost: Final = kwargs.get("batch_cost", None)
@ -7481,7 +7487,8 @@ def get_standard_logging_object_payload(
        # Extract usage as a plain dict, avoiding Pydantic round-trip
        raw_usage_dict: Final = StandardLoggingPayloadSetup.get_usage_as_dict(
            response_obj=None if is_unbilled_non_inference_call(call_type, metadata, response_obj) else response_obj,
-            combined_usage_object=cast(Usage | None, kwargs.get("combined_usage_object")),
+            combined_usage_object=cast(Usage | None, kwargs.get("combined_usage_object"))
+            or (batch_chat_usage(init_response_obj) if isinstance(init_response_obj, LiteLLMBatch) else None),
        )
        usage_dict: Final = (
            {**raw_usage_dict, "output_image_count": len(init_response_obj.data)}
--- a/litellm/litellm_core_utils/llm_cost_calc/utils.py
+++ b/litellm/litellm_core_utils/llm_cost_calc/utils.py
@ -75,6 +75,14 @@ _IMAGE_TOKEN_RATE_KEYS: Final[tuple[str, ...]] = (
    "output_cost_per_image_token",
 )

+
+def _deployment_prices_images_without_an_output_price(pricing: ModelInfo | None) -> bool:
+    return pricing is not None and (
+        "input_cost_per_pixel" in pricing
+        or ("input_cost_per_image" in pricing and "output_cost_per_image" not in pricing)
+    )
+
+
 # Pre-resolved service-tier cost-key suffixes (e.g. "_priority"). Used per
 # request in the cost-calc path, so the f-strings are built once here instead
 # of being rebuilt for every model_info key on every call. Longest-first so a
@ -127,7 +135,7 @@ def _get_token_detail_value(details: object, key: str) -> int | None:
    return value if isinstance(value, int) else None


-_IMAGE_SIZE_PATTERN: Final = re.compile(r"\d+(?:x|-x-)\d+")
+_IMAGE_SIZE_PATTERN: Final = re.compile(r"\d+(?:x|-x-|\*)\d+")


 def _requested_image_param(optional_params: Mapping[str, object] | None, key: str) -> str | None:
@ -137,7 +145,7 @@ def _requested_image_param(optional_params: Mapping[str, object] | None, key: st

 def _requested_image_size(optional_params: Mapping[str, object] | None) -> str | None:
    value: Final = _requested_image_param(optional_params, "size")
-    return value if value is not None and _IMAGE_SIZE_PATTERN.fullmatch(value) else None
+    return value.replace("*", "x") if value is not None and _IMAGE_SIZE_PATTERN.fullmatch(value) else None


 def get_web_search_requests(server_tool_use: object) -> int | None:
@ -2090,7 +2098,7 @@ class _ModelPricedImageCostCalculator(Protocol):


 def _model_priced_image_cost_calculator(
-    custom_llm_provider: str | None, model: str
+    custom_llm_provider: str | None, model: str, pricing: ModelInfo | None
 ) -> _ModelPricedImageCostCalculator | None:
    match custom_llm_provider:
        case litellm.LlmProviders.RECRAFT.value:
@ -2116,6 +2124,14 @@ def _model_priced_image_cost_calculator(
            from litellm.llms.tencent.image_generation.transformation import is_tokenhub_image_model

            return tencent_image_cost_calculator if is_tokenhub_image_model(model) else None
+        case litellm.LlmProviders.DASHSCOPE.value:
+            if _deployment_prices_images_without_an_output_price(pricing):
+                return None
+            from litellm.llms.dashscope.image_generation.cost_calculator import (
+                cost_calculator as dashscope_image_cost_calculator,
+            )
+
+            return dashscope_image_cost_calculator
        case _:
            return None

@ -2178,7 +2194,7 @@ class CostCalculatorUtils:
        )
        resolved_n: Final = n if n is not None else (len(completion_response.data) if completion_response.data else 0)
        pricing: Final = deployment_pricing(model_info)
-        model_priced_calculator: Final = _model_priced_image_cost_calculator(custom_llm_provider, model)
+        model_priced_calculator: Final = _model_priced_image_cost_calculator(custom_llm_provider, model, pricing)

        if model_priced_calculator is not None:
            return model_priced_calculator(model=model, image_response=completion_response, model_info=pricing)
--- a/litellm/litellm_core_utils/reasoning_effort_strength.py
+++ b/litellm/litellm_core_utils/reasoning_effort_strength.py
@ -0,0 +1,45 @@
+"""How strong each reasoning_effort level is, and rounding a requested level onto a declared set.
+
+Imports nothing from the SDK, so the `lite` CLI, which loads without initializing litellm, can use it.
+"""
+
+from collections.abc import Sequence
+from types import MappingProxyType
+from typing import Final, Literal, TypeAlias
+
+from typing_extensions import assert_never
+
+ReasoningEffortRounding: TypeAlias = Literal["up", "down"]
+
+REASONING_EFFORT_STRENGTH_ORDER: Final = ("minimal", "low", "medium", "high", "xhigh", "max")
+REASONING_EFFORT_STRENGTH_RANK: Final = MappingProxyType(
+    {effort: rank for rank, effort in enumerate(REASONING_EFFORT_STRENGTH_ORDER)}
+)
+
+
+def nearest_declared_reasoning_effort(
+    requested: str, declared: Sequence[str], rounding: ReasoningEffortRounding = "up"
+) -> str:
+    """Rounding up takes the weakest declared level at least as strong as the request, else the
+    strongest declared, so the caller gets no less reasoning than it asked for instead of a rejected
+    call. Rounding down mirrors it: the strongest declared level at most as strong, else the
+    weakest. none is the off switch rather than a strength, so it is never rounded onto the ladder
+    and no level is rounded to it: a caller who turned reasoning off must not be billed for it, and
+    a model that cannot turn it off says so itself. A level outside the strength order is likewise
+    returned as is for upstream to judge."""
+    ranked: Final = sorted(
+        (effort for effort in declared if effort in REASONING_EFFORT_STRENGTH_RANK),
+        key=lambda effort: REASONING_EFFORT_STRENGTH_RANK[effort],
+    )
+    if requested in ranked or requested not in REASONING_EFFORT_STRENGTH_RANK or not ranked:
+        return requested
+    strength: Final = REASONING_EFFORT_STRENGTH_RANK[requested]
+    match rounding:
+        case "up":
+            return next((effort for effort in ranked if REASONING_EFFORT_STRENGTH_RANK[effort] >= strength), ranked[-1])
+        case "down":
+            return next(
+                (effort for effort in reversed(ranked) if REASONING_EFFORT_STRENGTH_RANK[effort] <= strength), ranked[0]
+            )
+        case _:
+            assert_never(rounding)
--- a/litellm/litellm_core_utils/streaming_chunk_builder_utils.py
+++ b/litellm/litellm_core_utils/streaming_chunk_builder_utils.py
@ -3,7 +3,7 @@ import builtins
 import time
 from collections.abc import Callable, Iterable, Iterator, Mapping, Sequence
 from dataclasses import dataclass, replace
-from itertools import chain, groupby
+from itertools import chain, groupby, takewhile
 from types import MappingProxyType
 from typing import TYPE_CHECKING, Final, Optional, Protocol, TypeAlias, TypedDict, TypeVar, Union, cast

@ -257,7 +257,7 @@ def apply_grounding_request_counts(


 class ChunkProcessor:
-    def __init__(self, chunks: list, messages: Sequence | None = None):
+    def __init__(self, chunks: list, messages: Sequence[object] | None = None):
        self.chunks = self._sort_chunks(chunks)
        self.messages = messages
        self.first_chunk = chunks[0]
@ -390,6 +390,30 @@ class ChunkProcessor:
            case _:
                return "assistant"

+    @staticmethod
+    def _finish_reason_of_chunks(chunks: Sequence["_BaseChunk"], unreported: str = "stop") -> object:
+        finish_reason = unreported
+        for chunk in chunks:
+            if "choices" in chunk and len(chunk["choices"]) > 0:
+                chunk_finish_reason = None
+                if hasattr(chunk["choices"][0], "finish_reason"):
+                    chunk_finish_reason = chunk["choices"][0].finish_reason
+                elif "finish_reason" in chunk["choices"][0]:
+                    chunk_finish_reason = _CHOICE_FIELD_VALUE.validate_python(chunk["choices"][0]["finish_reason"])
+                if chunk_finish_reason is not None:
+                    finish_reason = chunk_finish_reason
+        return finish_reason
+
+    @staticmethod
+    def build_base_choice(index: int, chunks: Sequence["_BaseChunk"]) -> Choices:
+        return Choices(
+            index=index,
+            finish_reason=ChunkProcessor._finish_reason_of_chunks(
+                chunks, unreported="tool_calls" if _carries_tool_calls(chunks) else "stop"
+            ),
+            message={"role": ChunkProcessor._get_role_from_chunks(chunks), "content": ""},
+        )
+
    @staticmethod
    def _get_model_from_chunks(chunks: Sequence["_BaseChunk"], first_chunk_model: str) -> str:
        """
@ -414,7 +438,11 @@ class ChunkProcessor:
            None,
        )

-    def build_base_response(self, chunks: Sequence["_BaseChunk"]) -> ModelResponse:
+    def build_base_response(
+        self,
+        chunks: Sequence["_BaseChunk"],
+        choice_streams: Sequence[tuple[int, Sequence["_BaseChunk"]]],
+    ) -> ModelResponse:
        chunk = self.first_chunk
        id: Final = ChunkProcessor._get_chunk_id(chunks)
        object: Final = chunk["object"]
@ -426,16 +454,7 @@ class ChunkProcessor:
        service_tier: Final = ChunkProcessor._get_service_tier_from_chunks(chunks)

        role: Final = ChunkProcessor._get_role_from_chunks(chunks)
-        finish_reason = "stop"
-        for chunk in chunks:
-            if "choices" in chunk and len(chunk["choices"]) > 0:
-                chunk_finish_reason = None
-                if hasattr(chunk["choices"][0], "finish_reason"):
-                    chunk_finish_reason = chunk["choices"][0].finish_reason
-                elif "finish_reason" in chunk["choices"][0]:
-                    chunk_finish_reason = _CHOICE_FIELD_VALUE.validate_python(chunk["choices"][0]["finish_reason"])
-                if chunk_finish_reason is not None:
-                    finish_reason = chunk_finish_reason
+        finish_reason: Final = ChunkProcessor._finish_reason_of_chunks(chunks)

        # Initialize the response dictionary
        response = ModelResponse(
@ -455,13 +474,17 @@ class ChunkProcessor:
                    if service_tier is not None
                    else MappingProxyType({})
                ),
-                "choices": [
-                    {
-                        "index": 0,
-                        "message": {"role": role, "content": ""},
-                        "finish_reason": finish_reason,
-                    }
-                ],
+                "choices": (
+                    [ChunkProcessor.build_base_choice(index, choice_chunks) for index, choice_chunks in choice_streams]
+                    if len(choice_streams) > 1
+                    else [
+                        {
+                            "index": 0,
+                            "message": {"role": role, "content": ""},
+                            "finish_reason": finish_reason,
+                        }
+                    ]
+                ),
                "usage": {
                    "prompt_tokens": 0,  # Modify as needed
                    "completion_tokens": 0,  # Modify as needed
@ -1520,11 +1543,188 @@ def _bedrock_trace_fields(chunk: object) -> Mapping[str, object]:
    return {field: fields[field] for field in BEDROCK_TRACE_FIELDS if field in fields}


+def _stream_choice_index(choice: object) -> int:
+    index: Final = _field_of(choice, "index")
+    return index if isinstance(index, int) else 0
+
+
+def _carries_tool_calls(chunks: Sequence[_BaseChunk]) -> bool:
+    return any(
+        "tool_calls" in choice["delta"] and choice["delta"]["tool_calls"]
+        for choice in chain.from_iterable(chunk.get("choices") or () for chunk in chunks)
+    )
+
+
+def _choice_streams(chunks: Sequence[_BaseChunk]) -> tuple[tuple[int, Sequence[_BaseChunk]], ...]:
+    indices: Final = sorted(
+        frozenset(map(_stream_choice_index, chain.from_iterable(chunk.get("choices") or () for chunk in chunks)))
+    )
+    if len(indices) <= 1:
+        return ((0, chunks),)
+    return tuple((index, _narrowed_to_choice(chunks, index)) for index in indices)
+
+
+def _narrowed_to_choice(chunks: Sequence[_BaseChunk], index: int) -> tuple[_BaseChunk, ...]:
+    return tuple(
+        _BaseChunk(choices=[choice for choice in chunk.get("choices") or () if _stream_choice_index(choice) == index])
+        for chunk in chunks
+    )
+
+
+def _simple_text(chunks: Sequence[_BaseChunk]) -> str | None:
+    choices_per_chunk: Final = tuple(chunk["choices"] for chunk in chunks if chunk.get("choices"))
+    parts: Final = tuple(takewhile(lambda part: part is not None, map(_simple_text_part, choices_per_chunk)))
+    return "".join(filter(None, parts)) if len(parts) == len(choices_per_chunk) else None
+
+
+def _assembled_message_fields(processor: ChunkProcessor, chunks: Sequence) -> Iterator[tuple[str, object]]:
+    tool_call_chunks: Final = [
+        chunk
+        for chunk in chunks
+        if any(
+            "tool_calls" in choice["delta"] and choice["delta"]["tool_calls"] is not None
+            for choice in chunk.get("choices") or ()
+        )
+    ]
+
+    if tool_call_chunks:
+        tool_calls_list: Final = processor.get_combined_tool_content(tool_call_chunks)
+        yield "content", None
+        yield "tool_calls", tool_calls_list
+
+    function_call_chunks: Final = [
+        chunk
+        for chunk in chunks
+        if chunk.get("choices")
+        and "function_call" in chunk["choices"][0]["delta"]
+        and chunk["choices"][0]["delta"]["function_call"] is not None
+    ]
+
+    if function_call_chunks:
+        yield "content", None
+        yield "function_call", processor.get_combined_function_call_content(function_call_chunks)
+
+    content_chunks: Final = [
+        chunk
+        for chunk in chunks
+        if chunk.get("choices")
+        and "content" in chunk["choices"][0]["delta"]
+        and chunk["choices"][0]["delta"]["content"] is not None
+    ]
+
+    if content_chunks:
+        yield "content", processor.get_combined_content(content_chunks)
+
+    thinking_blocks: Final = [
+        chunk
+        for chunk in chunks
+        if chunk.get("choices")
+        and "thinking_blocks" in chunk["choices"][0]["delta"]
+        and chunk["choices"][0]["delta"]["thinking_blocks"] is not None
+    ]
+
+    if thinking_blocks:
+        yield "thinking_blocks", processor.get_combined_thinking_content(thinking_blocks)
+
+    reasoning_chunks: Final = [
+        chunk
+        for chunk in chunks
+        if chunk.get("choices")
+        and "reasoning_content" in chunk["choices"][0]["delta"]
+        and chunk["choices"][0]["delta"]["reasoning_content"] is not None
+    ]
+
+    if reasoning_chunks:
+        yield "reasoning_content", processor.get_combined_reasoning_content(reasoning_chunks)
+
+    typed_chunks: Final = cast(Sequence[object], chunks)  # cast-ok: chunks are untyped upstream
+    reasoning_items: Final = tuple(chain.from_iterable(_chunk_reasoning_items(chunk) for chunk in typed_chunks))
+    if reasoning_items:
+        yield "reasoning_items", list(reasoning_items)
+
+    annotation_chunks: Final = [
+        chunk
+        for chunk in chunks
+        if chunk.get("choices")
+        and "annotations" in chunk["choices"][0]["delta"]
+        and chunk["choices"][0]["delta"]["annotations"] is not None
+    ]
+
+    message_annotations, provider_annotations = (
+        partition_annotations(
+            list(chain.from_iterable(chunk["choices"][0]["delta"]["annotations"] for chunk in annotation_chunks))
+        )
+        if annotation_chunks
+        else (None, ())
+    )
+    if message_annotations is not None:
+        yield "annotations", message_annotations
+
+    audio_chunks: Final = [
+        chunk
+        for chunk in chunks
+        if chunk.get("choices")
+        and "audio" in chunk["choices"][0]["delta"]
+        and chunk["choices"][0]["delta"]["audio"] is not None
+    ]
+
+    if audio_chunks:
+        yield "audio", processor.get_combined_audio_content(audio_chunks)
+
+    # Handle image chunks from models like gemini-2.5-flash-image
+    # See: https://github.com/BerriAI/litellm/issues/19478
+    image_chunks: Final = [
+        chunk
+        for chunk in chunks
+        if chunk.get("choices")
+        and "images" in chunk["choices"][0]["delta"]
+        and chunk["choices"][0]["delta"]["images"] is not None
+    ]
+
+    if image_chunks:
+        # Images come complete in a single chunk, collect all images from all chunks
+        all_images: Final = []
+        for chunk in image_chunks:
+            all_images.extend(chunk["choices"][0]["delta"]["images"])
+        yield "images", all_images
+
+    # Combine provider_specific_fields from streaming chunks (e.g., web_search_results, citations)
+    # See: https://github.com/BerriAI/litellm/issues/17737
+    provider_specific_chunks: Final = [
+        chunk
+        for chunk in chunks
+        if chunk.get("choices")
+        and "provider_specific_fields" in chunk["choices"][0]["delta"]
+        and chunk["choices"][0]["delta"]["provider_specific_fields"] is not None
+    ]
+
+    provider_field_dicts: Final = tuple(
+        fields
+        for chunk in provider_specific_chunks
+        for fields in (chunk["choices"][0]["delta"]["provider_specific_fields"],)
+        if isinstance(fields, dict)
+    )
+    streamed_citations: Final = tuple(
+        fields["citation"] for fields in provider_field_dicts if fields.get("citation") is not None
+    )
+    citation_fields: Final = {"citations": _joined_streamed_citations(streamed_citations)} if streamed_citations else {}
+    provider_annotation_fields: Final = {"annotations": list(provider_annotations)} if provider_annotations else {}
+    combined_provider_fields: Final = {
+        key: value
+        for fields in (provider_annotation_fields, citation_fields, *provider_field_dicts)
+        for key, value in fields.items()
+        if key != "citation"
+    }
+
+    if combined_provider_fields:
+        yield "provider_specific_fields", combined_provider_fields
+
+
 def stream_chunk_builder(
    chunks: list,
    messages: Sequence | None = None,
-    start_time=None,
-    end_time=None,
+    start_time: object = None,
+    end_time: object = None,
    logging_obj: Optional["Logging"] = None,
    count_prompt_tokens: Callable[[], int] | None = None,
 ) -> ModelResponse | TextCompletionResponse | None:
@ -1561,26 +1761,15 @@ def stream_chunk_builder(
        usage_model: Final = usage_tokenizer_model(
            model, get_base_model_from_metadata(logging_obj.model_call_details) if logging_obj is not None else None
        )
-        # Initialize the response dictionary
-        response: Final = processor.build_base_response(chunks)
+        choice_streams: Final = _choice_streams(chunks)
+        response: Final = processor.build_base_response(chunks, choice_streams)
+        rebuilt_choices: Final = tuple(zip(response.choices, (choice_chunks for _, choice_chunks in choice_streams)))

-        # Fast path for the common text-only streaming case:
-        # avoid repeated multi-pass list scans over chunks.
-        simple_content_parts: Final[list[str]] = []
-        is_simple_text_stream = True
-        for chunk in chunks:
-            if not chunk.get("choices"):
-                continue
-
-            if (part := _simple_text_part(chunk["choices"])) is None:
-                is_simple_text_stream = False
-                break
-            if part:
-                simple_content_parts.append(part)
-
-        if is_simple_text_stream:
-            if simple_content_parts:
-                response["choices"][0]["message"]["content"] = "".join(simple_content_parts)
+        simple_texts: Final = tuple(_simple_text(choice_chunks) for _, choice_chunks in choice_streams)
+        if None not in simple_texts:
+            for (choice, _), simple_text in zip(rebuilt_choices, simple_texts):
+                if simple_text:
+                    choice.message.content = simple_text
            completion_output = get_content_from_model_response(response)
            usage = processor.calculate_usage(
                chunks=chunks,
@ -1619,165 +1808,9 @@ def stream_chunk_builder(
            processor.apply_provider_assembled_streaming_metadata(response, chunks, logging_obj)
            return response

-        tool_call_chunks: Final = [
-            chunk
-            for chunk in chunks
-            if any(
-                "tool_calls" in choice["delta"] and choice["delta"]["tool_calls"] is not None
-                for choice in chunk.get("choices") or ()
-            )
-        ]
-
-        if len(tool_call_chunks) > 0:
-            tool_calls_list: Final = processor.get_combined_tool_content(tool_call_chunks)
-            _choice = response.choices[0]
-            _choice.message.content = None
-            _choice.message.tool_calls = tool_calls_list
-
-        function_call_chunks: Final = [
-            chunk
-            for chunk in chunks
-            if chunk.get("choices")
-            and "function_call" in chunk["choices"][0]["delta"]
-            and chunk["choices"][0]["delta"]["function_call"] is not None
-        ]
-
-        if len(function_call_chunks) > 0:
-            _choice = response.choices[0]
-            _choice.message.content = None
-            _choice.message.function_call = processor.get_combined_function_call_content(function_call_chunks)
-
-        content_chunks: Final = [
-            chunk
-            for chunk in chunks
-            if chunk.get("choices")
-            and "content" in chunk["choices"][0]["delta"]
-            and chunk["choices"][0]["delta"]["content"] is not None
-        ]
-
-        if len(content_chunks) > 0:
-            response["choices"][0]["message"]["content"] = processor.get_combined_content(content_chunks)
-
-        thinking_blocks: Final = [
-            chunk
-            for chunk in chunks
-            if chunk.get("choices")
-            and "thinking_blocks" in chunk["choices"][0]["delta"]
-            and chunk["choices"][0]["delta"]["thinking_blocks"] is not None
-        ]
-
-        if len(thinking_blocks) > 0:
-            response["choices"][0]["message"]["thinking_blocks"] = processor.get_combined_thinking_content(
-                thinking_blocks
-            )
-
-        reasoning_chunks: Final = [
-            chunk
-            for chunk in chunks
-            if chunk.get("choices")
-            and "reasoning_content" in chunk["choices"][0]["delta"]
-            and chunk["choices"][0]["delta"]["reasoning_content"] is not None
-        ]
-
-        if len(reasoning_chunks) > 0:
-            response["choices"][0]["message"]["reasoning_content"] = processor.get_combined_reasoning_content(
-                reasoning_chunks
-            )
-
-        typed_chunks: Final = cast(Sequence[object], chunks)  # cast-ok: chunks are untyped upstream
-        reasoning_items: Final = tuple(chain.from_iterable(_chunk_reasoning_items(chunk) for chunk in typed_chunks))
-        if reasoning_items:
-            response["choices"][0]["message"]["reasoning_items"] = list(reasoning_items)
-
-        annotation_chunks: Final = [
-            chunk
-            for chunk in chunks
-            if chunk.get("choices")
-            and "annotations" in chunk["choices"][0]["delta"]
-            and chunk["choices"][0]["delta"]["annotations"] is not None
-        ]
-
-        if len(annotation_chunks) > 0:
-            # Merge annotations from ALL chunks — providers may spread
-            # them across multiple streaming chunks or send them only in
-            # the final chunk.
-            all_annotations: Final[list[object]] = []
-            for ac in annotation_chunks:
-                all_annotations.extend(ac["choices"][0]["delta"]["annotations"])
-            message_annotations, provider_annotations = partition_annotations(all_annotations)
-            if message_annotations is not None:
-                response["choices"][0]["message"]["annotations"] = message_annotations
-            if provider_annotations:
-                response.choices[0].message.provider_specific_fields = {
-                    **(response.choices[0].message.provider_specific_fields or {}),
-                    "annotations": list(provider_annotations),
-                }
-
-        audio_chunks: Final = [
-            chunk
-            for chunk in chunks
-            if chunk.get("choices")
-            and "audio" in chunk["choices"][0]["delta"]
-            and chunk["choices"][0]["delta"]["audio"] is not None
-        ]
-
-        if len(audio_chunks) > 0:
-            _choice = response.choices[0]
-            _choice.message.audio = processor.get_combined_audio_content(audio_chunks)
-
-        # Handle image chunks from models like gemini-2.5-flash-image
-        # See: https://github.com/BerriAI/litellm/issues/19478
-        image_chunks: Final = [
-            chunk
-            for chunk in chunks
-            if chunk.get("choices")
-            and "images" in chunk["choices"][0]["delta"]
-            and chunk["choices"][0]["delta"]["images"] is not None
-        ]
-
-        if len(image_chunks) > 0:
-            # Images come complete in a single chunk, collect all images from all chunks
-            all_images: Final = []
-            for chunk in image_chunks:
-                all_images.extend(chunk["choices"][0]["delta"]["images"])
-            response["choices"][0]["message"]["images"] = all_images
-
-        # Combine provider_specific_fields from streaming chunks (e.g., web_search_results, citations)
-        # See: https://github.com/BerriAI/litellm/issues/17737
-        provider_specific_chunks: Final = [
-            chunk
-            for chunk in chunks
-            if chunk.get("choices")
-            and "provider_specific_fields" in chunk["choices"][0]["delta"]
-            and chunk["choices"][0]["delta"]["provider_specific_fields"] is not None
-        ]
-
-        if len(provider_specific_chunks) > 0:
-            provider_field_dicts: Final = tuple(
-                fields
-                for chunk in provider_specific_chunks
-                for fields in (chunk["choices"][0]["delta"]["provider_specific_fields"],)
-                if isinstance(fields, dict)
-            )
-            streamed_citations: Final = tuple(
-                fields["citation"] for fields in provider_field_dicts if fields.get("citation") is not None
-            )
-            citation_fields: Final = (
-                {"citations": _joined_streamed_citations(streamed_citations)} if streamed_citations else {}
-            )
-            combined_provider_fields: Final = {
-                key: value
-                for fields in (citation_fields, *provider_field_dicts)
-                for key, value in fields.items()
-                if key != "citation"
-            }
-
-            if combined_provider_fields:
-                _choice = response.choices[0]
-                _choice.message.provider_specific_fields = {
-                    **(_choice.message.provider_specific_fields or {}),
-                    **combined_provider_fields,
-                }
+        for choice, choice_chunks in rebuilt_choices:
+            for field, value in _assembled_message_fields(processor, choice_chunks):
+                choice.message[field] = value

        completion_output = get_content_from_model_response(response)

--- a/litellm/litellm_core_utils/token_counter.py
+++ b/litellm/litellm_core_utils/token_counter.py
@ -7,9 +7,11 @@ import re
 import struct
 from bisect import bisect_right
 from collections.abc import Awaitable, Callable, Iterable, Mapping, Sequence
-from itertools import accumulate
+from dataclasses import dataclass
+from functools import cached_property
+from itertools import accumulate, chain, islice
 from types import MappingProxyType
-from typing import TYPE_CHECKING, Final, Literal, cast
+from typing import TYPE_CHECKING, Final, Literal, Protocol, TypeAlias, cast

 import anyio
 import anyio.lowlevel
@ -33,7 +35,12 @@ from litellm.constants import (
    MAX_SHORT_SIDE_FOR_IMAGE_HIGH_RES,
    MAX_TILE_HEIGHT,
    MAX_TILE_WIDTH,
+    OPENAI_CHAT_MODES,
+    OPENAI_MODEL_NAME_MAX_DASHES,
+    OPENAI_PDF_TEXT_PAGE_FRAMING_TOKENS,
    PDF_DATA_URL_PREFIX,
+    PDF_MAX_FORM_XOBJECT_DEPTH,
+    PDF_MAX_XOBJECT_DRAWS_PER_PAGE,
    TIKTOKEN_ENCODE_CHUNK_SIZE_CHARS,
    TOKEN_COUNTER_MAX_CONCURRENT_COUNTS,
    TOKEN_COUNTER_MAX_EXACT_CHARS,
@ -606,6 +613,35 @@ TokenCounterFunction = Callable[[str], int]
 Type for a function that counts tokens in a string.
 """

+PdfPagePricing: TypeAlias = Literal["openai", "claude"]
+
+
+class _PdfBox(Protocol):
+    @property
+    def width(self) -> float: ...
+
+    @property
+    def height(self) -> float: ...
+
+
+class _PdfContent(Protocol):
+    def get_data(self) -> bytes: ...
+
+
+class _PdfPage(Protocol):
+    @property
+    def mediabox(self) -> _PdfBox: ...
+
+    def extract_text(self) -> str: ...
+
+    def get_contents(self) -> _PdfContent | None: ...
+
+
+class _PdfReader(Protocol):
+    @property
+    def pages(self) -> Sequence[_PdfPage]: ...
+
+
 EXTRAPOLATION_SAMPLES: Final = 16
 T_ParamSpec: Final = ParamSpec("T_ParamSpec")
 T_Retval = TypeVar("T_Retval")
@ -662,7 +698,7 @@ class _MessageCountParams:
        if uses_legacy_message_accounting(model):
            self.tokens_per_message = 4  # every message follows <|start|>{role/name}\n{content}<|end|>\n
            self.tokens_per_name = -1  # if there's a name, the role is omitted
-        elif actual_model in litellm.open_ai_chat_completion_models or actual_model in litellm.azure_llms:
+        elif _is_openai_chat_model(actual_model):
            self.tokens_per_message = 3
            self.tokens_per_name = 1
        else:
@ -671,6 +707,63 @@ class _MessageCountParams:
            self.tokens_per_name = 1
        self.count_function = _get_count_function(model, custom_tokenizer)
        self.tool_section = chat_template_tool_section(model)
+        self._model = model
+
+    @cached_property
+    def pdf_pricing(self) -> PdfPagePricing:
+        return pdf_page_pricing(self._model)
+
+
+def _is_openai_chat_model(model: str) -> bool:
+    return model in litellm.open_ai_chat_completion_models or model in litellm.azure_llms
+
+
+def _openai_deployment_name(model: str) -> str:
+    name: Final = model.rpartition("/")[2]
+    return name.split(":")[1] if name.startswith("ft:") else name
+
+
+def _openai_model_family(model: str) -> str | None:
+    words: Final = _openai_deployment_name(model).split("-", OPENAI_MODEL_NAME_MAX_DASHES)
+    prefixes: Final = ("-".join(words[:end]) for end in range(len(words), 0, -1))
+    listed: Final = next((prefix for prefix in prefixes if _is_openai_chat_model(prefix)), None)
+    return None if listed is None or _is_listed_non_chat_model(listed) else listed
+
+
+def _untyped_cost_map() -> object:
+    return litellm.model_cost  # pyright: ignore[reportUnknownMemberType, reportUnknownVariableType]  # loaded untyped
+
+
+def _cost_map_entry(model: str) -> Mapping[str, object]:
+    cost_map: Final = _pdf_dictionary(_untyped_cost_map()) or {}
+    return _pdf_dictionary(cost_map.get(model)) or {}
+
+
+def _is_azure_openai_chat_model(model: str) -> bool:
+    name: Final = _openai_deployment_name(model)
+    entry: Final = _cost_map_entry(f"azure/{name}")
+    return (
+        entry.get("litellm_provider") == "azure"
+        and entry.get("mode") in OPENAI_CHAT_MODES
+        and (entry.get("supports_pdf_input") is True or name.startswith("gpt-"))
+    )
+
+
+def _is_openai_or_azure_model(model: str) -> bool:
+    if _is_listed_non_chat_model(_openai_deployment_name(model)):
+        return False
+    return _is_openai_chat_model(model) or _openai_model_family(model) is not None or _is_azure_openai_chat_model(model)
+
+
+def pdf_page_pricing(model: str | None) -> PdfPagePricing:
+    return "openai" if _is_openai_or_azure_model(model or "") else "claude"
+
+
+def reads_pdf_pages(model: str) -> bool:
+    segments: Final = model.split("/")
+    names: Final = ("/".join(segments[start:]) for start in range(len(segments)))
+    stated: Final = (_cost_map_entry(name).get("supports_pdf_input") for name in names)
+    return next((support for support in stated if support is not None), False) is True


 def token_counter(
@ -842,6 +935,7 @@ def _count_messages(
                    value,
                    use_default_image_token_count,
                    default_token_count,
+                    params.pdf_pricing,
                )
            elif key == "search_results" and isinstance(value, list):
                from litellm.litellm_core_utils.prompt_templates.common_utils import (
@ -986,7 +1080,7 @@ def _get_exact_count_function(

        return count_tokens
    if tokenizer_json["type"] == "openai_tokenizer":
-        encoding: Final = openai_tokenizer_encoding(model)
+        encoding: Final = openai_tokenizer_encoding(model or "")

        def encode_length(text: str) -> int:
            return _encoding_count(encoding, text)
@ -1006,6 +1100,11 @@ def openai_tokenizer_encoding(model: str) -> "Encoding":
    return get_encoding(openai_tokenizer_encoding_name(model))


+def _is_listed_non_chat_model(model: str) -> bool:
+    modes: Final = (_cost_map_entry(name).get("mode") for name in (model, f"azure/{model}"))
+    return any(mode is not None and mode not in OPENAI_CHAT_MODES for mode in modes)
+
+
 def openai_tokenizer_encoding_name(model: str) -> str:
    """The tiktoken encoding name for `model`, without loading the encoding.

@ -1021,7 +1120,9 @@ def openai_tokenizer_encoding_name(model: str) -> str:
    try:
        return tiktoken.encoding_name_for_model(model_to_use)
    except KeyError:
-        return _suffixed_variant_encoding_name(model_to_use) or "o200k_base"
+        return _suffixed_variant_encoding_name(model_to_use) or (
+            "cl100k_base" if _is_listed_non_chat_model(model_to_use) else "o200k_base"
+        )


 def unresolved_tokenizer_model(model: str) -> str:
@ -1079,7 +1180,16 @@ def single_encoding_openai_model(served: Sequence[str | None]) -> str | None:


 def _openai_model_name(model: str) -> str | None:
-    return _listed_openai_model_name(model) or _tiktoken_o200k_model_name(model) or _versioned_openai_model_name(model)
+    return (
+        _listed_openai_model_name(model)
+        or _tiktoken_o200k_model_name(model)
+        or _versioned_openai_model_name(model)
+        or _azure_openai_chat_model_name(model)
+    )
+
+
+def _azure_openai_chat_model_name(model: str) -> str | None:
+    return _openai_deployment_name(model) if _is_azure_openai_chat_model(model) else None


 _VERSIONED_OPENAI_MODEL: Final = re.compile(r"(?:gpt-(?:[5-9]|[1-9]\d+)|o[1-9]\d*)(?:[.-]|$)")
@ -1224,10 +1334,6 @@ def _validate_anthropic_content(content: Mapping[str, object]) -> type:
    if expected_cls is None:
        raise ValueError(f"Unknown Anthropic content type: '{content_type}'")

-    missing: Final = [k for k in getattr(expected_cls, "__required_keys__", set()) if k not in content]
-    if missing:
-        raise ValueError(f"Missing required fields in {content_type} block: {', '.join(missing)}")
-
    return expected_cls


@ -1253,7 +1359,165 @@ def _anthropic_rendered_page_image_tokens(width: float, height: float) -> int:
    return math.ceil(min(float(ANTHROPIC_IMAGE_MAX_PIXELS), area_at_max_edge) / ANTHROPIC_IMAGE_PIXELS_PER_TOKEN)


-def _count_inline_pdf_tokens(data_url: str, count_function: TokenCounterFunction) -> int | None:
+def _pdf_dictionary(node: object) -> Mapping[str, object] | None:
+    return node if isinstance(node, Mapping) else None  # pyright: ignore[reportUnknownVariableType]  # read per key
+
+
+def _pdf_value(container: Mapping[str, object], key: str) -> object:
+    return container[key] if key in container else None  # noqa: SIM401  # pypdf resolves references only in []
+
+
+_PdfXObjects: TypeAlias = Mapping[str, object] | None
+_PdfXObjectUse: TypeAlias = tuple[Mapping[str, object], _PdfXObjects]
+
+
+@dataclass(frozen=True, slots=True)
+class _PdfContentSummary:
+    drawn_names: tuple[str, ...]
+    draws_inline_image: bool
+
+
+_PdfDrawing: TypeAlias = tuple[_PdfContentSummary, _PdfXObjects]
+
+
+@dataclass(frozen=True, slots=True)
+class _PdfWalk:
+    frontier: tuple[_PdfDrawing, ...]
+    seen: frozenset[tuple[int, int]]
+    summaries: Mapping[int, _PdfContentSummary | None]
+    draws: int
+
+
+def _pdf_xobjects(container: Mapping[str, object], inherited: _PdfXObjects) -> _PdfXObjects:
+    resources: Final = _pdf_dictionary(_pdf_value(container, "/Resources"))
+    if resources is None:
+        return inherited
+    return _pdf_dictionary(_pdf_value(resources, "/XObject"))
+
+
+_PDF_WHITESPACE: Final = rb"\x00\t\n\x0c\r "
+_PDF_TOKEN_END: Final = _PDF_WHITESPACE + rb"()<>\[\]{}/%"
+_PDF_XOBJECT_DRAW: Final = re.compile(
+    rb"/([^" + _PDF_TOKEN_END + rb"]*)(?:[" + _PDF_WHITESPACE + rb"]|%[^\r\n]*[\r\n])+Do(?![^" + _PDF_TOKEN_END + rb"])"
+)
+_PDF_INLINE_IMAGE: Final = re.compile(rb"(?<![^" + _PDF_WHITESPACE + rb"])BI(?![^" + _PDF_WHITESPACE + rb"/])")
+_PDF_NAME_ESCAPE: Final = re.compile(rb"#([0-9A-Fa-f]{2})")
+_PDF_NAME_CHARSETS: Final = ("utf-8", "gbk")
+
+
+def _decoded(raw: bytes, charset: str) -> str | None:
+    try:
+        return raw.decode(charset)
+    except UnicodeDecodeError:
+        return None
+
+
+def _pdf_name(escaped: bytes) -> str:
+    raw: Final = _PDF_NAME_ESCAPE.sub(lambda escape: bytes.fromhex(escape[1].decode("ascii")), escaped)
+    decoded: Final = (_decoded(raw, charset) for charset in _PDF_NAME_CHARSETS)
+    return "/" + next((name for name in decoded if name is not None), raw.decode("latin-1"))
+
+
+def _pdf_content_summary(content: _PdfContent) -> _PdfContentSummary:
+    data: Final = content.get_data()
+    draws: Final = islice(_PDF_XOBJECT_DRAW.finditer(data), PDF_MAX_XOBJECT_DRAWS_PER_PAGE + 1)
+    return _PdfContentSummary(
+        drawn_names=tuple(_pdf_name(draw[1]) for draw in draws),
+        draws_inline_image=_PDF_INLINE_IMAGE.search(data) is not None,
+    )
+
+
+def _pdf_form_summary(form: Mapping[str, object]) -> _PdfContentSummary | None:
+    from pypdf.generic import StreamObject
+
+    if not isinstance(form, StreamObject):
+        return None
+    return _pdf_content_summary(cast(_PdfContent, form))  # cast-ok: pypdf is untyped
+
+
+def _pdf_drawn_xobjects(drawing: _PdfDrawing) -> tuple[_PdfXObjectUse, ...]:
+    summary, xobjects = drawing
+    if xobjects is None:
+        return ()
+    resolved: Final = (_pdf_dictionary(_pdf_value(xobjects, name)) for name in summary.drawn_names)
+    return tuple((xobject, xobjects) for xobject in resolved if xobject is not None)
+
+
+def _pdf_drawing_key(use: _PdfXObjectUse) -> tuple[int, int]:
+    xobject, inherited = use
+    return id(xobject), id(_pdf_xobjects(xobject, inherited))
+
+
+def _pdf_next_walk(walk: _PdfWalk) -> _PdfWalk | None:
+    draws: Final = walk.draws + sum(len(summary.drawn_names) for summary, _ in walk.frontier)
+    if draws > PDF_MAX_XOBJECT_DRAWS_PER_PAGE:
+        return None
+    drawn: Final = tuple(chain.from_iterable(map(_pdf_drawn_xobjects, walk.frontier)))
+    if any(_pdf_value(xobject, "/Subtype") == "/Image" for xobject, _ in drawn):
+        return None
+    forms: Final = {_pdf_drawing_key(use): use for use in drawn if _pdf_value(use[0], "/Subtype") == "/Form"}
+    unseen: Final = tuple(forms[key] for key in forms.keys() - walk.seen)
+    unparsed: Final = {id(form): form for form, _ in unseen if id(form) not in walk.summaries}
+    summaries: Final = MappingProxyType(
+        {**walk.summaries, **{key: _pdf_form_summary(form) for key, form in unparsed.items()}}
+    )
+    drawings: Final = ((summaries[id(form)], _pdf_xobjects(form, inherited)) for form, inherited in unseen)
+    return _PdfWalk(
+        frontier=tuple((summary, xobjects) for summary, xobjects in drawings if summary is not None),
+        seen=walk.seen | frozenset(forms),
+        summaries=summaries,
+        draws=draws,
+    )
+
+
+def _pdf_page_draws_raster_image(page: _PdfPage) -> bool:
+    contents: Final = page.get_contents()
+    page_dictionary: Final = _pdf_dictionary(page)
+    if contents is None or page_dictionary is None:
+        return False
+    walk: _PdfWalk = _PdfWalk(  # rebind-ok: breadth-first walk, recursion is banned
+        frontier=((_pdf_content_summary(contents), _pdf_xobjects(page_dictionary, None)),),
+        seen=frozenset(),
+        summaries=MappingProxyType({}),
+        draws=0,
+    )
+    for _ in range(PDF_MAX_FORM_XOBJECT_DEPTH):
+        if not walk.frontier:
+            return False
+        if any(summary.draws_inline_image for summary, _ in walk.frontier):
+            return True
+        if (next_walk := _pdf_next_walk(walk)) is None:
+            return True
+        walk = next_walk
+    return bool(walk.frontier)
+
+
+def _openai_pdf_page_tokens(page: _PdfPage, count_function: TokenCounterFunction) -> int:
+    if _pdf_page_draws_raster_image(page):
+        return _claude_pdf_page_tokens(page, count_function)
+    text: Final = page.extract_text() or ""
+    return count_function(text) + OPENAI_PDF_TEXT_PAGE_FRAMING_TOKENS if text.strip() else 0
+
+
+def _claude_pdf_page_tokens(page: _PdfPage, count_function: TokenCounterFunction) -> int:
+    return count_function(page.extract_text() or "") + _anthropic_rendered_page_image_tokens(
+        float(page.mediabox.width), float(page.mediabox.height)
+    )
+
+
+def _pdf_page_tokens(page: _PdfPage, count_function: TokenCounterFunction, pdf_pricing: PdfPagePricing) -> int:
+    match pdf_pricing:
+        case "openai":
+            return _openai_pdf_page_tokens(page, count_function)
+        case "claude":
+            return _claude_pdf_page_tokens(page, count_function)
+
+
+def _count_inline_pdf_tokens(
+    data_url: str,
+    count_function: TokenCounterFunction,
+    pdf_pricing: PdfPagePricing = "claude",
+) -> int | None:
    if not data_url.startswith(PDF_DATA_URL_PREFIX):
        return None
    try:
@ -1262,12 +1526,10 @@ def _count_inline_pdf_tokens(data_url: str, count_function: TokenCounterFunction
        verbose_logger.debug("pypdf is not installed, so the PDF document is priced like one image")
        return None
    try:
-        reader: Final = PdfReader(io.BytesIO(base64.b64decode(data_url[len(PDF_DATA_URL_PREFIX) :])))
-        return sum(
-            count_function(page.extract_text() or "")
-            + _anthropic_rendered_page_image_tokens(float(page.mediabox.width), float(page.mediabox.height))
-            for page in reader.pages
+        reader: Final = cast(  # cast-ok: pypdf's PdfReader satisfies _PdfReader, typed only where pypdf is installed
+            _PdfReader, PdfReader(io.BytesIO(base64.b64decode(data_url[len(PDF_DATA_URL_PREFIX) :])))
        )
+        return sum(_pdf_page_tokens(page, count_function, pdf_pricing) for page in reader.pages)
    except Exception as e:
        verbose_logger.debug("Could not read the PDF document's pages (%s), so it is priced like one image", e)
        return None
@ -1277,8 +1539,9 @@ def _count_opaque_document_tokens(
    data_url: str,
    count_function: TokenCounterFunction,
    use_default_image_token_count: bool,
+    pdf_pricing: PdfPagePricing = "claude",
 ) -> int:
-    pdf_tokens: Final = _count_inline_pdf_tokens(data_url, count_function)
+    pdf_tokens: Final = _count_inline_pdf_tokens(data_url, count_function, pdf_pricing)
    if pdf_tokens is not None:
        return pdf_tokens
    return calculate_img_tokens(
@ -1293,6 +1556,7 @@ def _count_document_tokens(
    count_function: TokenCounterFunction,
    use_default_image_token_count: bool,
    default_token_count: int | None,
+    pdf_pricing: PdfPagePricing = "claude",
 ) -> int:
    source: Final = document["source"]
    metadata_tokens: Final = sum(
@ -1305,10 +1569,10 @@ def _count_document_tokens(
        if isinstance(content, str):
            return metadata_tokens + count_function(content)
        return metadata_tokens + _count_content_list(
-            count_function, content, use_default_image_token_count, default_token_count
+            count_function, content, use_default_image_token_count, default_token_count, pdf_pricing
        )
    return metadata_tokens + _count_opaque_document_tokens(
-        _anthropic_image_source_data(source), count_function, use_default_image_token_count
+        _anthropic_image_source_data(source), count_function, use_default_image_token_count, pdf_pricing
    )


@ -1316,6 +1580,7 @@ def _count_file_tokens(
    file_value: object,
    count_function: TokenCounterFunction,
    use_default_image_token_count: bool,
+    pdf_pricing: PdfPagePricing = "claude",
 ) -> int:
    """An OpenAI `file` block is the chat-completions spelling of a document, so it prices like one."""
    if not isinstance(file_value, Mapping):
@ -1325,7 +1590,9 @@ def _count_file_tokens(
    name_tokens: Final = count_function(filename) if isinstance(filename, str) and filename else 0
    if not isinstance(file_data, str) or not file_data:
        return name_tokens
-    return name_tokens + _count_opaque_document_tokens(file_data, count_function, use_default_image_token_count)
+    return name_tokens + _count_opaque_document_tokens(
+        file_data, count_function, use_default_image_token_count, pdf_pricing
+    )


 def _count_anthropic_content(
@ -1333,6 +1600,7 @@ def _count_anthropic_content(
    count_function: TokenCounterFunction,
    use_default_image_token_count: bool,
    default_token_count: int | None,
+    pdf_pricing: PdfPagePricing = "claude",
 ) -> int:
    """
    Count tokens in Anthropic-specific content blocks (tool_use, tool_result, etc.).
@ -1367,6 +1635,7 @@ def _count_anthropic_content(
                    field_value,
                    use_default_image_token_count,
                    default_token_count,
+                    pdf_pricing,
                )
            elif isinstance(field_value, dict):
                tokens += count_function(str(field_value))
@ -1393,6 +1662,7 @@ def _count_content_list(
    ],
    use_default_image_token_count: bool,
    default_token_count: int | None,
+    pdf_pricing: PdfPagePricing = "claude",
 ) -> int:
    """Recursively count tokens from a list of content blocks."""
    try:
@ -1417,12 +1687,14 @@ def _count_content_list(
                    count_function,
                    use_default_image_token_count,
                    default_token_count,
+                    pdf_pricing,
                )
            elif c["type"] == "file":
                num_tokens += _count_file_tokens(
                    c.get("file"),
                    count_function,
                    use_default_image_token_count,
+                    pdf_pricing,
                )
            elif c["type"] in ("tool_use", "tool_result", "search_result"):
                num_tokens += _count_anthropic_content(
@ -1430,6 +1702,7 @@ def _count_content_list(
                    count_function,
                    use_default_image_token_count,
                    default_token_count,
+                    pdf_pricing,
                )
            elif c["type"] in ("thinking", "redacted_thinking"):
                # Claude extended thinking content block
@ -1552,12 +1825,13 @@ def _format_single_function_definition(function: Mapping[str, object]) -> tuple[

 def _format_object_parameters(parameters, indent):
    properties: Final = parameters.get("properties")
-    if not properties:
+    if not isinstance(properties, Mapping) or not properties:
        return ""
-    required_params: Final = parameters.get("required", [])
+    required: Final = parameters.get("required")
+    required_params: Final = tuple(required) if isinstance(required, list) else ()
    lines: Final = []
    for key, props in properties.items():
-        description = props.get("description")
+        description = props.get("description") if isinstance(props, Mapping) else None
        if description:
            lines.append(f"// {description}")
        question = "?"
@ -1568,19 +1842,21 @@ def _format_object_parameters(parameters, indent):


 def _format_type(props, indent):
+    if not isinstance(props, Mapping):
+        return "any"
    type: Final = props.get("type")
+    enum: Final = props.get("enum")
    if type == "string":
-        if "enum" in props:
-            return " | ".join([f'"{item}"' for item in props["enum"]])
+        if isinstance(enum, list):
+            return " | ".join([f'"{item}"' for item in enum])
        return "string"
    elif type == "array":
-        # items is required, OpenAI throws an error if it's missing
-        return f"{_format_type(props['items'], indent)}[]"
+        return f"{_format_type(props.get('items'), indent)}[]"
    elif type == "object":
        return f"{{\n{_format_object_parameters(props, indent + 2)}\n}}"
    elif type in ["integer", "number"]:
-        if "enum" in props:
-            return " | ".join([f'"{item}"' for item in props["enum"]])
+        if isinstance(enum, list):
+            return " | ".join([f'"{item}"' for item in enum])
        return "number"
    elif type == "boolean":
        return "boolean"
--- a/litellm/llms/a2a/chat/guardrail_translation/handler.py
+++ b/litellm/llms/a2a/chat/guardrail_translation/handler.py
@ -14,6 +14,7 @@ import json
 from collections.abc import Sequence
 from typing import TYPE_CHECKING, Any, Final, Optional

+from pydantic import ConfigDict, TypeAdapter, ValidationError
 from typing_extensions import ReadOnly, TypedDict

 from litellm._logging import verbose_proxy_logger
@ -28,6 +29,8 @@ if TYPE_CHECKING:
    from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
    from litellm.types.proxy.auth.user_api_key_auth import UserAPIKeyAuth

+_JSON_OBJECT: Final = TypeAdapter(dict[str, object], config=ConfigDict(strict=True, hide_input_in_errors=True))
+

 class _A2ATextPart(TypedDict, total=False):
    """The subset of an A2A message part this handler reads text from."""
@ -333,8 +336,8 @@ class A2AGuardrailHandler(BaseTranslation):
                obj = item
            elif isinstance(item, str):
                try:
-                    obj = json.loads(item.strip())
-                except (json.JSONDecodeError, TypeError):
+                    obj = _JSON_OBJECT.validate_python(json.loads(item.strip()))
+                except (json.JSONDecodeError, TypeError, ValidationError):
                    continue
            else:
                continue
--- a/litellm/llms/anthropic/chat/guardrail_translation/handler.py
+++ b/litellm/llms/anthropic/chat/guardrail_translation/handler.py
@ -18,9 +18,9 @@ from copy import deepcopy
 from dataclasses import dataclass
 from itertools import chain, repeat
 from types import MappingProxyType
-from typing import TYPE_CHECKING, Any, Final, Protocol, cast, overload, runtime_checkable
+from typing import TYPE_CHECKING, Any, Final, Protocol, TypeVar, cast, overload, runtime_checkable

-from pydantic import TypeAdapter, ValidationError
+from pydantic import ConfigDict, TypeAdapter, ValidationError, with_config
 from typing_extensions import ReadOnly, TypedDict, assert_never

 from litellm._logging import verbose_proxy_logger
@ -349,14 +349,40 @@ def _tool_call_shapes(tool_calls: Sequence[object]) -> tuple[_ToolCallShape, ...
    )


-class _AnthropicSSEDelta(TypedDict, total=False):
-    type: ReadOnly[str]
+@with_config(ConfigDict(extra="ignore", strict=True))
+class _SSETextDelta(TypedDict, total=False):
+    type: ReadOnly[object]
    text: ReadOnly[str]
-    stop_reason: ReadOnly[str | None]


-class _AnthropicSSEEvent(TypedDict, total=False):
-    delta: ReadOnly[_AnthropicSSEDelta]
+@with_config(ConfigDict(extra="ignore", strict=True))
+class _SSETextDeltaEvent(TypedDict, total=False):
+    delta: ReadOnly[_SSETextDelta]
+
+
+@with_config(ConfigDict(extra="ignore", strict=True))
+class _SSEStopDelta(TypedDict, total=False):
+    stop_reason: ReadOnly[object]
+
+
+@with_config(ConfigDict(extra="ignore", strict=True))
+class _SSEStopDeltaEvent(TypedDict, total=False):
+    delta: ReadOnly[_SSEStopDelta]
+
+
+_SSE_TEXT_DELTA_EVENT: Final = TypeAdapter(_SSETextDeltaEvent)
+_SSE_STOP_DELTA_EVENT: Final = TypeAdapter(_SSEStopDeltaEvent)
+_SSEEventT = TypeVar("_SSEEventT")
+
+
+def _parse_sse_event(adapter: TypeAdapter[_SSEEventT], event_type: str, data_line: str) -> _SSEEventT | None:
+    try:
+        return adapter.validate_python(json.loads(data_line))
+    except json.JSONDecodeError:
+        verbose_proxy_logger.warning("Skipping a %s SSE event that is not valid JSON", event_type)
+    except ValidationError:
+        verbose_proxy_logger.warning("Skipping a %s SSE event with an unexpected shape", event_type)
+    return None


 class AnthropicMessagesHandler(BaseTranslation):
@ -1806,13 +1832,10 @@ class AnthropicMessagesHandler(BaseTranslation):

                # Only process content_block_delta events
                if event_type == "content_block_delta" and data_line:
-                    try:
-                        data: _AnthropicSSEEvent = json.loads(data_line)
-                        delta: _AnthropicSSEDelta = data.get("delta", {})
-                        if delta.get("type") == "text_delta":
-                            text += delta.get("text", "")
-                    except json.JSONDecodeError:
-                        verbose_proxy_logger.warning("Failed to parse JSON from SSE data: %s", data_line)
+                    data = _parse_sse_event(_SSE_TEXT_DELTA_EVENT, event_type, data_line)
+                    delta: _SSETextDelta = {} if data is None else data.get("delta", {})
+                    if delta.get("type") == "text_delta":
+                        text += delta.get("text", "")

        except Exception as e:
            verbose_proxy_logger.error("Error extracting text from SSE: %s", e)
@ -1869,14 +1892,11 @@ class AnthropicMessagesHandler(BaseTranslation):

                        # Check for message_delta event with stop_reason
                        if event_type == "message_delta" and data_line:
-                            try:
-                                data: _AnthropicSSEEvent = json.loads(data_line)
-                                delta: _AnthropicSSEDelta = data.get("delta", {})
-                                stop_reason: str | None = delta.get("stop_reason")
-                                if stop_reason is not None:
-                                    return True
-                            except json.JSONDecodeError:
-                                verbose_proxy_logger.warning("Failed to parse JSON from SSE data: %s", data_line)
+                            data = _parse_sse_event(_SSE_STOP_DELTA_EVENT, event_type, data_line)
+                            delta: _SSEStopDelta = {} if data is None else data.get("delta", {})
+                            stop_reason: object = delta.get("stop_reason")
+                            if stop_reason is not None:
+                                return True

                except Exception as e:
                    verbose_proxy_logger.error("Error checking streaming end in SSE: %s", e)
--- a/litellm/llms/anthropic/messages/adapters/handler.py
+++ b/litellm/llms/anthropic/messages/adapters/handler.py
@ -160,6 +160,7 @@ async def prepare_context_managed_request(
    """Apply client compaction history, then optional context_management polyfill."""
    from litellm.llms.anthropic.messages.context_management.editors.compact import (
        apply_client_compaction_block_history,
+        slice_around_compaction_block,
    )

    # Skip the client-history pre-processing when a ``compact_20260112``
@ -175,7 +176,7 @@ async def prepare_context_managed_request(

    if polyfill_will_run:
        history_result: PolyfillResult | None = None
-        working_messages: _AnthropicMessages = messages
+        working_messages: _AnthropicMessages = list(slice_around_compaction_block(messages)[0])
        working_system: _AnthropicSystem = system
    else:
        history_result = apply_client_compaction_block_history(
--- a/litellm/llms/anthropic/messages/context_management/dispatcher.py
+++ b/litellm/llms/anthropic/messages/context_management/dispatcher.py
@ -8,6 +8,7 @@ from litellm._logging import verbose_logger
 from litellm.litellm_core_utils.asyncify import asyncify
 from litellm.types.llms.anthropic import AppliedEdit

+from ..convertible_blocks import drop_non_string_tool_result_texts
 from .constants import CLEAR_TOOL_USES_EDIT_TYPE, COMPACT_EDIT_TYPE
 from .editors import (
    CheckedEdit,
@ -103,7 +104,7 @@ async def apply_context_management(

    Every ``clear_tool_uses_20250919`` edit is validated before any editor runs, so a malformed one raises its 400
    before a ``compact_20260112`` summary call is paid for, or runs without its malformed fields under
-    ``drop_invalid_edits``.
+    ``drop_invalid_edits``, which also drops non-string ``tool_result`` text first, as the provider never receives it.

    The dispatcher is async so async editors (``compact_20260112``) can
    ``await`` the configured summarization model. Sync editors run in a
@ -119,7 +120,7 @@ async def apply_context_management(
        raise first_error
    well_formed_edits: Final = tuple(check.edit for check in checked)

-    current_messages = messages
+    current_messages = list(drop_non_string_tool_result_texts(messages, drop_invalid_edits))
    current_system = system
    aggregated_applied: Final[list[AppliedEdit]] = []
    aggregated_compaction_block = None
--- a/litellm/llms/anthropic/messages/context_management/editors/clear_tool_uses.py
+++ b/litellm/llms/anthropic/messages/context_management/editors/clear_tool_uses.py
@ -39,6 +39,21 @@ if TYPE_CHECKING:
 T = TypeVar("T")
 # api.anthropic.com, measured 2026-10-19: text results of 1 to 46 bytes are never cleared or counted toward keep
 _TINY_RESULT_BYTES: Final = 46
+_TOKEN_COUNTER_BLOCK_TYPES: Final = frozenset(
+    {
+        "text",
+        "image_url",
+        "image",
+        "document",
+        "file",
+        "tool_use",
+        "tool_result",
+        "thinking",
+        "redacted_thinking",
+        "tool_reference",
+        "search_result",
+    }
+)
 ToolNames = Literal["all"] | frozenset[str]


@ -52,16 +67,19 @@ class _ClearAtLeast(BaseModel):
 class _ClearToolUsesFields(BaseModel):
    model_config = ConfigDict(frozen=True)

+    trigger: Mapping[str, object] | None = None
+    keep: Mapping[str, object] | None = None
    clear_at_least: _ClearAtLeast | None = None
    exclude_tools: tuple[str, ...] | None = None
    clear_tool_inputs: bool | tuple[str, ...] | None = None


 _BLOCKS: Final = TypeAdapter(tuple[Mapping[str, object], ...])
-# api.anthropic.com, measured 2026-10-19: its wording for the two shapes pydantic words differently
+# api.anthropic.com, measured 2026-10-19 and 2026-10-28: its wording for the shapes pydantic words differently
 _API_MESSAGES: Final = MappingProxyType(
    {
        "tuple_type": "Input should be a valid array",
+        "dict_type": "Input should be an object",
        "model_type": "Input does not match the expected shape.",
    }
 )
@ -178,10 +196,12 @@ def _cleared_result(block: Mapping[str, object]) -> dict[str, object]:

 def _freed_tokens(model: str, result: Mapping[str, object], use: Mapping[str, object], clears_input: bool) -> int:
    """Tokens that clearing this use frees: its result, and its input when ``clear_tool_inputs`` covers it."""
-    before: Final = [result, use] if clears_input else [result]
-    after: Final = [_cleared_result(result), {**use, "input": {}}] if clears_input else [_cleared_result(result)]
+    before: Final[Sequence[Mapping[str, object]]] = (result, use) if clears_input else (result,)
+    after: Final[Sequence[Mapping[str, object]]] = (
+        (_cleared_result(result), {**use, "input": {}}) if clears_input else (_cleared_result(result),)
+    )
    counts: Final = tuple(
-        litellm.token_counter(model=model, messages=[{"role": "user", "content": blocks}]) for blocks in (before, after)
+        _count_tokens(model, [{"role": "user", "content": blocks}], None) for blocks in (before, after)
    )
    return max(counts[0] - counts[1], 0)

@ -199,6 +219,35 @@ def _select_in_batches(candidates: Sequence[str], tokens: Mapping[str, int], cle
    return tuple(candidates[:batch_end])


+def _without_uncountable_blocks(block: Mapping[str, object]) -> Mapping[str, object]:
+    nested: Final = _parse(_BLOCKS, block.get("content"))
+    if nested is None:
+        return block
+    return {**block, "content": [inner for inner in nested if inner.get("type") in _TOKEN_COUNTER_BLOCK_TYPES]}
+
+
+def _countable_message(message: Mapping[str, object]) -> Mapping[str, object]:
+    blocks: Final = _parse(_BLOCKS, message.get("content"))
+    if blocks is None:
+        return message
+    return {
+        **message,
+        "content": [
+            _without_uncountable_blocks(block) for block in blocks if block.get("type") in _TOKEN_COUNTER_BLOCK_TYPES
+        ],
+    }
+
+
+def _count_tokens(
+    model: str, messages: Sequence[Mapping[str, object]], tools: Sequence[Mapping[str, object]] | None
+) -> int:
+    return litellm.token_counter(
+        model=model,
+        messages=[_countable_message(message) for message in messages],
+        tools=cast("list[ChatCompletionToolParam] | None", tools),
+    )
+
+
 def _trigger_met(
    trigger: dict[str, object],
    model: str,
@ -218,11 +267,7 @@ def _trigger_met(

    if not isinstance(threshold, int):
        threshold = DEFAULT_INPUT_TOKENS_TRIGGER
-    message_tokens: Final = litellm.token_counter(
-        model=model,
-        messages=messages,
-        tools=cast("list[ChatCompletionToolParam] | None", tools),
-    )
+    message_tokens: Final = _count_tokens(model, messages, tools)
    if message_tokens > threshold:
        return True, message_tokens
    current_tokens: Final = message_tokens + count_system_tokens(model, system)
@ -375,17 +420,9 @@ def apply_clear_tool_uses_20250919(
        [_message_without_inputs(message, ids_to_clear, input_tools) for message in edited] if input_tools else edited
    )

-    tokens_before: Final = (
-        counted_tokens
-        if counted_tokens is not None
-        else litellm.token_counter(
-            model=model, messages=kept, tools=cast("list[ChatCompletionToolParam] | None", tools)
-        )
-    )
+    tokens_before: Final = counted_tokens if counted_tokens is not None else _count_tokens(model, kept, tools)
    kept_after, _ = history_after_client_compaction(final_messages, system)
-    tokens_after: Final = litellm.token_counter(
-        model=model, messages=kept_after, tools=cast("list[ChatCompletionToolParam] | None", tools)
-    )
+    tokens_after: Final = _count_tokens(model, kept_after, tools)
    cleared_input_tokens: Final = max(tokens_before - tokens_after, 0)

    return final_messages, {
--- a/litellm/llms/anthropic/messages/context_management/editors/compact.py
+++ b/litellm/llms/anthropic/messages/context_management/editors/compact.py
@ -137,7 +137,7 @@ def _find_latest_compaction_index(
    return None, None


-def _slice_around_compaction_block(
+def slice_around_compaction_block(
    messages: Sequence[_MsgT],
 ) -> tuple[Sequence[_MsgT | dict[str, object]], dict[str, object] | None]:
    """Apply Anthropic's "drop everything before the compaction block" rule.
@ -194,7 +194,7 @@ def history_after_client_compaction(
    system: str | Sequence[Mapping[str, object]] | None,
 ) -> tuple[list[dict[str, object]], str | Sequence[Mapping[str, object]] | None]:
    """Return the history the API keeps after the latest compaction block, without it, and the system with its summary."""
-    sliced, block = _slice_around_compaction_block(messages)
+    sliced, block = slice_around_compaction_block(messages)
    if block is None:
        return list(messages), system
    tail: Final = _strip_compaction_blocks(sliced)
@ -615,7 +615,7 @@ def apply_client_compaction_block_history(
    tail is forwarded unchanged (with compaction blocks stripped) so recent
    turns the summary does not cover are preserved.
    """
-    effective_messages, prior_compaction_block = _slice_around_compaction_block(messages)
+    effective_messages, prior_compaction_block = slice_around_compaction_block(messages)
    if prior_compaction_block is None:
        return None

@ -686,7 +686,7 @@ async def apply_compact_20260112(
    # opt-in gate below so that even when summarization is disabled we still
    # strip Anthropic-only ``compaction`` blocks from messages going to
    # non-Anthropic backends (which would reject them).
-    effective_messages, prior_compaction_block = _slice_around_compaction_block(messages)
+    effective_messages, prior_compaction_block = slice_around_compaction_block(messages)
    prior_summary_text: Final = prior_compaction_block.get("content") if prior_compaction_block else None
    augmented_system: str | list[dict[str, object]] | None = system
    if isinstance(prior_summary_text, str) and prior_summary_text:
--- a/litellm/llms/anthropic/messages/responses_adapters/handler.py
+++ b/litellm/llms/anthropic/messages/responses_adapters/handler.py
@ -10,11 +10,15 @@ from typing import Final, TypeAlias
 from pydantic import TypeAdapter, ValidationError

 import litellm
+from litellm._logging import verbose_logger
 from litellm.integrations.anthropic_cache_control_hook import (
    AnthropicCacheControlHook,
    supports_openai_prompt_cache_breakpoint,
 )
-from litellm.litellm_core_utils.core_helpers import drops_unsupported_params
+from litellm.litellm_core_utils.asyncify import (
+    run_async_function,  # pyright: ignore[reportUnknownVariableType]  # untyped helper
+)
+from litellm.litellm_core_utils.core_helpers import as_str_mapping, drops_unsupported_params
 from litellm.litellm_core_utils.prompt_templates.common_utils import (
    cache_control_as_prompt_cache_breakpoint,
    prompt_cache_breakpoint_for_wire,
@ -28,14 +32,19 @@ from litellm.types.llms.anthropic import (
    AnthropicMessagesRequest,
    AnthropicOutputConfig,
    AnthropicOutputSchema,
+    ContextManagementResponse,
 )
 from litellm.types.llms.anthropic_messages.anthropic_response import (
    AnthropicMessagesResponse,
 )
 from litellm.types.llms.openai import ResponsesAPIResponse
+from litellm.types.utils import CountContextManagement
 from litellm.utils import ProviderConfigManager

-from ..adapters.handler import request_safeguards_evaluator
+from ..adapters.handler import context_management_explicitly_dropped, request_safeguards_evaluator
+from ..context_management import AnthropicContextManagementError, PolyfillResult, apply_context_management
+from ..context_management.constants import COMPACT_EDIT_TYPE
+from ..context_management.dispatcher import normalize_spec
 from ..convertible_blocks import reject_malformed_tool_result_text
 from ..safeguards import with_safeguard_results
 from ..utils import litellm_logging_obj_from_kwargs, local_model_name
@ -45,10 +54,111 @@ from .transformation import LiteLLMAnthropicToResponsesAPIAdapter
 AnthropicRequestMessages: TypeAlias = list[AllAnthropicMessageValues] | list[dict[str, object]]
 BlockRewrite: TypeAlias = Callable[[Mapping[str, object]], Mapping[str, object]]
 _BLOCK_LIST: Final = TypeAdapter(list[dict[str, object]])
+_SYSTEM_ITEMS: Final = TypeAdapter(list[object])
+_SPEC: Final = TypeAdapter(dict[str, object])
+_SplitEdits: TypeAlias = tuple[dict[str, object] | None, Sequence[Mapping[str, object]]]
+AnthropicContextManagementSpec: TypeAlias = dict[str, object] | list[dict[str, object]] | None

 _ADAPTER: Final = LiteLLMAnthropicToResponsesAPIAdapter()


+def _split_context_management(
+    spec: AnthropicContextManagementSpec,
+    kwargs: Mapping[str, object],
+) -> _SplitEdits:
+    """Return (the edits the Responses API runs natively, the edits the gateway polyfill runs).
+
+    The Responses API compacts natively (``compact_20260112`` becomes its ``compaction``); any other
+    edit, such as ``clear_tool_uses_20250919``, has no Responses API form and runs in the polyfill, as
+    it does on the chat completions path. An OpenAI-style list spec is not Anthropic's shape and stays
+    unsent, as it was before the polyfill ran here.
+    """
+    if not isinstance(spec, dict):
+        return None, ()
+    if not spec or context_management_explicitly_dropped(kwargs.get("additional_drop_params")):
+        return spec, ()
+    edits: Final = normalize_spec(spec) or []
+    native: Final = [edit for edit in edits if edit.get("type") == COMPACT_EDIT_TYPE]
+    return ({"edits": native} if native else None), tuple(
+        edit for edit in edits if edit.get("type") != COMPACT_EDIT_TYPE
+    )
+
+
+def _system_blocks(system: object) -> str | Sequence[Mapping[str, object]] | None:
+    if system is None or isinstance(system, str):
+        return system
+    try:
+        items: Final = _SYSTEM_ITEMS.validate_python(system)
+    except ValidationError:
+        return None
+    return tuple(block for block in map(as_str_mapping, items) if block is not None)
+
+
+async def _polyfilled(
+    *,
+    model: str,
+    messages: AnthropicRequestMessages,
+    tools: Sequence[AllAnthropicToolsValues | Mapping[str, object]] | None,
+    system: object,
+    edits: Sequence[Mapping[str, object]],
+    kwargs: Mapping[str, object],
+) -> PolyfillResult | None:
+    """Run the edits the Responses API can't run natively; raise like the chat completions path does."""
+    if not edits:
+        return None
+    reject_malformed_tool_result_text(messages, model, kwargs)
+    drop_invalid_edits: Final = drops_unsupported_params(kwargs.get("drop_params"))
+    blocks: Final = _system_blocks(system)
+    try:
+        return await apply_context_management(
+            model=model,
+            messages=_BLOCK_LIST.validate_python(messages),
+            tools=_BLOCK_LIST.validate_python(tools) if tools else None,
+            system=blocks if blocks is None or isinstance(blocks, str) else _BLOCK_LIST.validate_python(blocks),
+            context_management_spec={"edits": [dict(edit) for edit in edits]},
+            drop_invalid_edits=drop_invalid_edits,
+        )
+    except AnthropicContextManagementError:
+        raise
+    except Exception as e:
+        verbose_logger.exception("context_management polyfill failed on the Responses API path: %s", e)
+        raise AnthropicContextManagementError(
+            status_code=500, message=f"context_management polyfill failed: {e}"
+        ) from e
+
+
+async def count_view_messages(
+    *,
+    model: str,
+    messages: Sequence[Mapping[str, object]],
+    tools: Sequence[Mapping[str, object]] | None,
+    system: object,
+    context_management: CountContextManagement | None,
+) -> Sequence[Mapping[str, object]]:
+    """The messages /v1/messages sends the Responses API once the polyfill has run the edits it can't run natively."""
+    if context_management is None or not isinstance(context_management.spec, dict):
+        return messages
+    _, edits = _split_context_management(_SPEC.validate_python(context_management.spec), {})
+    result: Final = await _polyfilled(
+        model=model,
+        messages=_BLOCK_LIST.validate_python(messages),
+        tools=tools,
+        system=system,
+        edits=edits,
+        kwargs={"drop_params": context_management.drop_invalid_edits},
+    )
+    return messages if result is None else result.messages
+
+
+def _with_applied_edits(
+    response: AnthropicMessagesResponse, polyfill_result: PolyfillResult | None
+) -> AnthropicMessagesResponse:
+    applied_edits: Final = polyfill_result.applied_edits_for_response() if polyfill_result else None
+    if not applied_edits:
+        return response
+    return {**response, "context_management": ContextManagementResponse(applied_edits=list(applied_edits))}
+
+
 def _record_bridged_response(responses_kwargs: Mapping[str, object], result: ResponsesAPIResponse) -> None:
    logging_obj: Final = litellm_logging_obj_from_kwargs(responses_kwargs)
    if logging_obj is not None:
@ -281,7 +391,7 @@ class LiteLLMMessagesToResponsesAPIHandler:
        max_tokens: int,
        messages: AnthropicRequestMessages,
        model: str,
-        context_management: dict[str, object] | None = None,
+        context_management: AnthropicContextManagementSpec = None,
        metadata: dict[str, object] | None = None,
        output_config: AnthropicOutputConfig | None = None,
        stop_sequences: list[str] | None = None,
@ -296,11 +406,15 @@ class LiteLLMMessagesToResponsesAPIHandler:
        output_format: AnthropicOutputSchema | None = None,
        **kwargs: object,
    ) -> AnthropicMessagesResponse | AsyncIterator[bytes]:
+        native_context_management, polyfilled_edits = _split_context_management(context_management, kwargs)
+        polyfill_result: Final = await _polyfilled(
+            model=model, messages=messages, tools=tools, system=system, edits=polyfilled_edits, kwargs=kwargs
+        )
        responses_kwargs: Final = _build_responses_kwargs(
            max_tokens=max_tokens,
-            messages=messages,
+            messages=polyfill_result.messages if polyfill_result is not None else messages,
            model=model,
-            context_management=context_management,
+            context_management=native_context_management,
            metadata=metadata,
            output_config=output_config,
            stop_sequences=stop_sequences,
@ -325,13 +439,16 @@ class LiteLLMMessagesToResponsesAPIHandler:
                model=local_model_name(model, kwargs.get("custom_llm_provider")),
                litellm_logging_obj=litellm_logging_obj_from_kwargs(responses_kwargs),
                safeguards_evaluator=safeguards_evaluator,
+                applied_edits=polyfill_result.applied_edits_for_response() if polyfill_result else None,
            )
            return wrapper.async_anthropic_sse_wrapper()

        if not isinstance(result, ResponsesAPIResponse):
            raise ValueError(f"Expected ResponsesAPIResponse, got {type(result)}")

-        served: Final = await with_safeguard_results(_ADAPTER.translate_response(result), safeguards_evaluator)
+        served: Final = await with_safeguard_results(
+            _with_applied_edits(_ADAPTER.translate_response(result), polyfill_result), safeguards_evaluator
+        )
        _record_bridged_response(responses_kwargs, result)
        return served

@ -340,7 +457,7 @@ class LiteLLMMessagesToResponsesAPIHandler:
        max_tokens: int,
        messages: AnthropicRequestMessages,
        model: str,
-        context_management: dict[str, object] | None = None,
+        context_management: AnthropicContextManagementSpec = None,
        metadata: dict[str, object] | None = None,
        output_config: AnthropicOutputConfig | None = None,
        stop_sequences: list[str] | None = None,
@ -382,11 +499,26 @@ class LiteLLMMessagesToResponsesAPIHandler:
            )

        # Sync path
+        native_context_management, polyfilled_edits = _split_context_management(context_management, kwargs)
+        ran: Final[object] = (  # pyright: ignore[reportUnknownVariableType]  # run_async_function is untyped
+            run_async_function(
+                _polyfilled,
+                model=model,
+                messages=messages,
+                tools=tools,
+                system=system,
+                edits=polyfilled_edits,
+                kwargs=kwargs,
+            )
+            if polyfilled_edits
+            else None
+        )
+        polyfill_result: Final = ran if isinstance(ran, PolyfillResult) else None
        responses_kwargs: Final = _build_responses_kwargs(
            max_tokens=max_tokens,
-            messages=messages,
+            messages=polyfill_result.messages if polyfill_result is not None else messages,
            model=model,
-            context_management=context_management,
+            context_management=native_context_management,
            metadata=metadata,
            output_config=output_config,
            stop_sequences=stop_sequences,
@ -409,10 +541,11 @@ class LiteLLMMessagesToResponsesAPIHandler:
                responses_stream=result,
                model=local_model_name(model, kwargs.get("custom_llm_provider")),
                litellm_logging_obj=litellm_logging_obj_from_kwargs(responses_kwargs),
+                applied_edits=polyfill_result.applied_edits_for_response() if polyfill_result else None,
            )
            return wrapper.async_anthropic_sse_wrapper()

        if not isinstance(result, ResponsesAPIResponse):
            raise ValueError(f"Expected ResponsesAPIResponse, got {type(result)}")

-        return _ADAPTER.translate_response(result)
+        return _with_applied_edits(_ADAPTER.translate_response(result), polyfill_result)
--- a/litellm/llms/anthropic/messages/responses_adapters/streaming_iterator.py
+++ b/litellm/llms/anthropic/messages/responses_adapters/streaming_iterator.py
@ -2,7 +2,7 @@
 ## Translates OpenAI call to Anthropic `/v1/messages` format
 import asyncio
 from collections import deque
-from collections.abc import AsyncGenerator, Awaitable, Callable, Iterator, Mapping
+from collections.abc import AsyncGenerator, Awaitable, Callable, Iterator, Mapping, Sequence
 from typing import TYPE_CHECKING, Any, Final

 import anyio
@ -27,6 +27,7 @@ from litellm.responses.streaming_iterator import (
    partial_responses_incomplete_event_on_disconnect,
    stream_error_status_and_message,
 )
+from litellm.types.llms.anthropic import AppliedEdit, ContextManagementResponse
 from litellm.types.llms.anthropic_messages.anthropic_response import AnthropicUsage
 from litellm.types.llms.base import LiteLLMBaseModel

@ -129,8 +130,10 @@ class AnthropicResponsesStreamWrapper:
        model: str,
        litellm_logging_obj: "LiteLLMLoggingObject | None" = None,
        safeguards_evaluator: "SafeguardsEvaluator | None" = None,
+        applied_edits: Sequence[AppliedEdit] | None = None,
    ) -> None:
        self.responses_stream = responses_stream
+        self._applied_edits: Final = tuple(applied_edits or ())
        self.model = model
        self.litellm_logging_obj = litellm_logging_obj
        self.safeguards_evaluator: Final = safeguards_evaluator
@ -445,6 +448,11 @@ class AnthropicResponsesStreamWrapper:
                    "type": "message_delta",
                    "delta": message_delta_payload,
                    "usage": dict(anthropic_usage),
+                    **(
+                        {"context_management": ContextManagementResponse(applied_edits=list(self._applied_edits))}
+                        if self._applied_edits
+                        else {}
+                    ),
                }
            )
            self._chunk_queue.append({"type": "message_stop"})
--- a/litellm/llms/azure_ai/image_generation/mai_transformation.py
+++ b/litellm/llms/azure_ai/image_generation/mai_transformation.py
@ -1,7 +1,12 @@
-from typing import TYPE_CHECKING, Any, Final
+import math
+from collections.abc import Mapping
+from typing import TYPE_CHECKING, Annotated, Final, TypeAlias

 import httpx
+from pydantic import BeforeValidator, ConfigDict, TypeAdapter, ValidationError, with_config
+from typing_extensions import NotRequired, ReadOnly, TypedDict

+from litellm._logging import verbose_logger
 from litellm.exceptions import UnsupportedParamsError
 from litellm.litellm_core_utils.url_utils import join_api_base
 from litellm.llms.base_llm.image_generation.transformation import (
@ -18,6 +23,67 @@ if TYPE_CHECKING:
    from litellm.litellm_core_utils.tokenizer import Encoding as Tokenizer


+_TOKEN_COUNT_ADAPTER: Final[TypeAdapter[int | float]] = TypeAdapter(int | float)
+
+
+def _token_count_or_none(value: object) -> int | float | None:
+    if value is None:
+        return None
+    try:
+        count: Final = _TOKEN_COUNT_ADAPTER.validate_python(value)
+    except ValidationError:
+        verbose_logger.warning("MAI image usage has a token count that is not a number, counting it as absent")
+        return None
+    if not math.isfinite(count):
+        verbose_logger.warning("MAI image usage has a token count that is not finite, counting it as absent")
+        return None
+    return count
+
+
+_TokenCount: TypeAlias = Annotated[int | float | None, BeforeValidator(_token_count_or_none)]
+
+
+@with_config(ConfigDict(extra="allow"))
+class _MAIImageUsageDetails(TypedDict, total=False):
+    text_tokens: ReadOnly[NotRequired[_TokenCount]]
+    image_tokens: ReadOnly[NotRequired[_TokenCount]]
+
+
+@with_config(ConfigDict(extra="allow"))
+class _MAIImageUsage(TypedDict, total=False):
+    input_tokens_details: ReadOnly[NotRequired[object]]
+    num_input_text_tokens: ReadOnly[NotRequired[_TokenCount]]
+    num_input_image_tokens: ReadOnly[NotRequired[_TokenCount]]
+    input_tokens: ReadOnly[NotRequired[_TokenCount]]
+    output_tokens: ReadOnly[NotRequired[_TokenCount]]
+    num_output_tokens: ReadOnly[NotRequired[_TokenCount]]
+    output_image_tokens: ReadOnly[NotRequired[_TokenCount]]
+    total_tokens: ReadOnly[NotRequired[_TokenCount]]
+
+
+@with_config(ConfigDict(extra="allow"))
+class _MAIImageResponse(TypedDict, total=False):
+    usage: ReadOnly[NotRequired[object]]
+
+
+_MAI_IMAGE_USAGE_DETAILS_ADAPTER: Final[TypeAdapter[_MAIImageUsageDetails]] = TypeAdapter(_MAIImageUsageDetails)
+_MAI_IMAGE_USAGE_ADAPTER: Final[TypeAdapter[_MAIImageUsage]] = TypeAdapter(_MAIImageUsage)
+_MAI_RAW_USAGE_ADAPTER: Final[TypeAdapter[Mapping[str, object]]] = TypeAdapter(Mapping[str, object])
+
+
+def _raw_usage_or_none(usage: object) -> Mapping[str, object] | None:
+    if usage is None:
+        return None
+    try:
+        return _MAI_RAW_USAGE_ADAPTER.validate_python(usage)
+    except ValidationError:
+        verbose_logger.warning("MAI image usage is not an object, counting it as absent")
+        return None
+
+
+_MAI_IMAGE_RESPONSE_ADAPTER: Final[TypeAdapter[_MAIImageResponse]] = TypeAdapter(_MAIImageResponse)
+
+
 class AzureFoundryMAIImageGenerationConfig(BaseImageGenerationConfig):
    """Azure AI Foundry MAI image generation (e.g. MAI-Image-2.5)."""

@ -78,9 +144,10 @@ class AzureFoundryMAIImageGenerationConfig(BaseImageGenerationConfig):
        return "maiimage" in model_normalized

    @staticmethod
-    def normalize_mai_image_usage(usage: dict[str, Any] | None) -> dict[str, Any]:
+    def normalize_mai_image_usage(usage: object) -> Mapping[str, object]:
        """Map Azure MAI usage fields to OpenAI ImageUsage schema."""
-        if usage is None:
+        raw_usage: Final = _raw_usage_or_none(usage)
+        if raw_usage is None:
            return {
                "input_tokens": 0,
                "input_tokens_details": {"image_tokens": 0, "text_tokens": 0},
@ -88,10 +155,13 @@ class AzureFoundryMAIImageGenerationConfig(BaseImageGenerationConfig):
                "total_tokens": 0,
            }

-        normalized_usage: Final = dict(usage)
-        input_tokens_details = normalized_usage.get("input_tokens_details")
-        if not isinstance(input_tokens_details, dict):
-            input_tokens_details = {}
+        normalized_usage: Final[_MAIImageUsage] = _MAI_IMAGE_USAGE_ADAPTER.validate_python(raw_usage)
+        input_tokens_details_value: Final = normalized_usage.get("input_tokens_details")
+        input_tokens_details: Final[_MAIImageUsageDetails] = (
+            _MAI_IMAGE_USAGE_DETAILS_ADAPTER.validate_python(input_tokens_details_value)
+            if isinstance(input_tokens_details_value, dict)
+            else {}
+        )

        text_tokens = normalized_usage.get("num_input_text_tokens")
        if text_tokens is None:
@ -121,18 +191,16 @@ class AzureFoundryMAIImageGenerationConfig(BaseImageGenerationConfig):
        if total_tokens is None:
            total_tokens = input_tokens + output_tokens

-        normalized_usage.update(
-            {
-                "input_tokens": input_tokens,
-                "input_tokens_details": {
-                    "image_tokens": image_tokens,
-                    "text_tokens": text_tokens,
-                },
-                "output_tokens": output_tokens,
-                "total_tokens": total_tokens,
-            }
-        )
-        return normalized_usage
+        return {
+            **raw_usage,
+            "input_tokens": input_tokens,
+            "input_tokens_details": {
+                "image_tokens": image_tokens,
+                "text_tokens": text_tokens,
+            },
+            "output_tokens": output_tokens,
+            "total_tokens": total_tokens,
+        }

    def get_supported_openai_params(self, model: str) -> list[OpenAIImageGenerationOptionalParams]:
        return ["n", "size"]
@ -252,12 +320,18 @@ class AzureFoundryMAIImageGenerationConfig(BaseImageGenerationConfig):
        json_mode: bool | None = None,
    ) -> ImageResponse:
        try:
-            response: Final = raw_response.json()
+            response_json: Final = _MAI_IMAGE_RESPONSE_ADAPTER.validate_python(raw_response.json())
        except Exception:
            raise OpenAIError(message=raw_response.text, status_code=raw_response.status_code)

-        if "usage" in response:
-            response["usage"] = self.normalize_mai_image_usage(response.get("usage"))
+        response: Final = (
+            {
+                **response_json,
+                "usage": self.normalize_mai_image_usage(response_json["usage"]),
+            }
+            if "usage" in response_json
+            else dict(response_json)
+        )

        logging_obj.post_call(
            input=request_data.get("prompt", ""),
--- a/litellm/llms/base_llm/text_to_speech/transformation.py
+++ b/litellm/llms/base_llm/text_to_speech/transformation.py
@ -135,6 +135,18 @@ class BaseTextToSpeechConfig(ABC):
        Transform provider response to standard format
        """

+    async def async_transform_text_to_speech_response(
+        self,
+        model: str,
+        raw_response: httpx.Response,
+        logging_obj: LiteLLMLoggingObj,
+    ) -> "HttpxBinaryResponseContent":
+        return self.transform_text_to_speech_response(
+            model=model,
+            raw_response=raw_response,
+            logging_obj=logging_obj,
+        )
+
    def get_error_class(self, error_message: str, status_code: int, headers: dict) -> BaseLLMException:
        from ..chat.transformation import BaseLLMException

--- a/litellm/llms/bedrock/embed/embedding.py
+++ b/litellm/llms/bedrock/embed/embedding.py
@ -9,7 +9,7 @@ from collections.abc import Callable, Mapping
 from typing import TYPE_CHECKING, Final, get_args, overload

 import httpx
-from pydantic import TypeAdapter
+from pydantic import ConfigDict, TypeAdapter

 import litellm
 from litellm.constants import BEDROCK_EMBEDDING_PROVIDERS_LITERAL
@ -48,6 +48,8 @@ from .amazon_titan_v2_transformation import AmazonTitanV2Config
 from .cohere_transformation import BedrockCohereEmbeddingConfig
 from .twelvelabs_marengo_transformation import TwelveLabsMarengoEmbeddingConfig, drop_params_enabled

+_JSON_OBJECT: Final = TypeAdapter(dict[str, object], config=ConfigDict(strict=True, hide_input_in_errors=True))
+
 if TYPE_CHECKING:
    from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj

@ -155,7 +157,7 @@ class BedrockEmbedding(BaseAWSLLM):
        except httpx.TimeoutException:
            raise BedrockError(status_code=408, message="Timeout error occurred.")

-        return response.json()
+        return _JSON_OBJECT.validate_python(response.json())

    async def _make_async_call(
        self,
@ -189,7 +191,7 @@ class BedrockEmbedding(BaseAWSLLM):
        except httpx.TimeoutException:
            raise BedrockError(status_code=408, message="Timeout error occurred.")

-        return response.json()
+        return _JSON_OBJECT.validate_python(response.json())

    def _transform_response(
        self,
@ -689,7 +691,7 @@ class BedrockEmbedding(BaseAWSLLM):

        # Parse response
        if response.status_code == 200:
-            return response.json()
+            return _JSON_OBJECT.validate_python(response.json())
        else:
            raise Exception(f"Failed to get async invoke status: {response.status_code} - {response.text}")

--- a/litellm/llms/clf_ai_gateway/chat/transformation.py
+++ b/litellm/llms/clf_ai_gateway/chat/transformation.py
@ -0,0 +1,95 @@
+from typing import Final
+
+import litellm
+from litellm._logging import verbose_logger
+from litellm.exceptions import UnsupportedParamsError
+from litellm.litellm_core_utils.core_helpers import as_str_mapping
+from litellm.llms.openai.chat.gpt_transformation import OpenAIGPTConfig
+from litellm.router_utils.reasoning_effort_capability import declared_reasoning_efforts_for_model
+from litellm.secret_managers.main import get_secret_str
+
+SUPPORTED_OPENAI_PARAMS: Final = (
+    "stream",
+    "stream_options",
+    "frequency_penalty",
+    "presence_penalty",
+    "logit_bias",
+    "logprobs",
+    "top_logprobs",
+    "max_tokens",
+    "max_completion_tokens",
+    "n",
+    "stop",
+    "temperature",
+    "top_p",
+    "seed",
+    "response_format",
+    "tools",
+    "tool_choice",
+    "parallel_tool_calls",
+    "user",
+    "store",
+    "service_tier",
+)
+
+
+class ClfAiGatewayConfig(OpenAIGPTConfig):
+    @property
+    def custom_llm_provider(self) -> str | None:
+        return "clf_ai_gateway"
+
+    def get_supported_openai_params(self, model: str) -> list[str]:  # mutable-ok: matches OpenAIGPTConfig's list return
+        supports_reasoning: Final = litellm.supports_reasoning(
+            model=model,
+            custom_llm_provider=self.custom_llm_provider,
+        )
+        extra: Final = ("reasoning_effort",) if supports_reasoning else ()
+        return [*SUPPORTED_OPENAI_PARAMS, *extra]
+
+    def map_openai_params(
+        self,
+        non_default_params: dict[str, object],  # mutable-ok: OpenAIConfig.map_openai_params signature
+        optional_params: dict[str, object],  # mutable-ok: OpenAIConfig.map_openai_params signature
+        model: str,
+        drop_params: bool,
+    ) -> dict[str, object]:  # mutable-ok: OpenAIConfig.map_openai_params signature
+        requested: Final = non_default_params.get("reasoning_effort")
+        requested_mapping: Final = as_str_mapping(requested)
+        effort: Final = requested_mapping.get("effort") if requested_mapping is not None else requested
+        declared: Final = declared_reasoning_efforts_for_model(model, "clf_ai_gateway")
+        drop_enabled: Final = drop_params or litellm.drop_params is True
+        if requested_mapping is not None and effort is None and not drop_enabled:
+            raise UnsupportedParamsError(
+                message=f"clf_ai_gateway needs an effort level in reasoning_effort, got {requested!r}. To drop "
+                "unsupported openai params from the call, set `litellm.drop_params = True`",
+                llm_provider="clf_ai_gateway",
+                model=model,
+                status_code=400,
+            )
+        drops_effort: Final = drop_enabled and effort is not None and declared is not None and effort not in declared
+        if drops_effort:
+            verbose_logger.warning(
+                "Dropping reasoning_effort=%r for model=%r (drop_params=True) because clf_ai_gateway takes only %s for it.",
+                effort,
+                model,
+                declared,
+            )
+        others: Final = {param: value for param, value in non_default_params.items() if param != "reasoning_effort"}
+        normalized: Final = {**others, "reasoning_effort": effort} if effort is not None else others
+        forwarded: Final = others if drops_effort else normalized
+        mapped: Final[dict[str, object]] = super().map_openai_params(  # pyright: ignore[reportUnknownMemberType, reportUnknownVariableType]  # OpenAIGPTConfig types its params and result as bare dicts  # mutable-ok: parent returns a dict
+            non_default_params=forwarded,
+            optional_params=optional_params,
+            model=model,
+            drop_params=drop_params,
+        )
+        return mapped
+
+    def get_openai_compatible_provider_info(
+        self, api_base: str | None, api_key: str | None
+    ) -> tuple[str | None, str | None]:
+        resolved_api_base: Final = (
+            api_base or get_secret_str("CLF_AI_GATEWAY_API_BASE") or "https://api.clfaigateway.dev/v1"
+        )
+        dynamic_api_key: Final = api_key or get_secret_str("CLF_AI_GATEWAY_API_KEY")
+        return resolved_api_base, dynamic_api_key
--- a/litellm/llms/custom_httpx/llm_http_handler.py
+++ b/litellm/llms/custom_httpx/llm_http_handler.py
@ -12849,7 +12849,7 @@ class BaseLLMHTTPHandler:
                provider_config=text_to_speech_provider_config,
            )

-        speech_response: Final = text_to_speech_provider_config.transform_text_to_speech_response(
+        speech_response: Final = await text_to_speech_provider_config.async_transform_text_to_speech_response(
            model=model,
            raw_response=response,
            logging_obj=logging_obj,
--- a/litellm/llms/dashscope/common_utils.py
+++ b/litellm/llms/dashscope/common_utils.py
@ -24,7 +24,8 @@ DASHSCOPE_ANTHROPIC_PATH: Final = "/apps/anthropic"
 DASHSCOPE_NATIVE_V1_PATH: Final = "/api/v1"
 DASHSCOPE_COMPATIBLE_API_PATH: Final = "/compatible-api/v1"
 DASHSCOPE_RERANK_PATH: Final = f"{DASHSCOPE_COMPATIBLE_API_PATH}/reranks"
-DASHSCOPE_IMAGE_PATH: Final = "/api/v1/services/aigc/multimodal-generation/generation"
+DASHSCOPE_MULTIMODAL_GENERATION_PATH: Final = "/api/v1/services/aigc/multimodal-generation/generation"
+DASHSCOPE_IMAGE_PATH: Final = DASHSCOPE_MULTIMODAL_GENERATION_PATH
 DASHSCOPE_DEFAULT_ORIGIN: Final = "https://dashscope.aliyuncs.com"

 _STANDARD_DASHSCOPE_HOSTS: Final = frozenset(
@ -100,6 +101,21 @@ def is_dashscope_native_endpoint_url(api_base: str) -> bool:
    return urlparse(api_base).path.rstrip("/").startswith(f"{DASHSCOPE_NATIVE_V1_PATH}/")


+def dashscope_api_root(api_base: str) -> str:
+    endpoints: Final = resolve_dashscope_endpoints(api_base)
+    if endpoints is not None:
+        return endpoints.origin
+    trimmed: Final = api_base.rstrip("/")
+    if trimmed.endswith(DASHSCOPE_CHAT_COMPATIBLE_PATH):
+        return trimmed.removesuffix(DASHSCOPE_CHAT_COMPATIBLE_PATH)
+    root, separator, _ = trimmed.partition(DASHSCOPE_NATIVE_V1_PATH)
+    return root if separator else trimmed
+
+
+def is_aliyun_host(host: str | None) -> bool:
+    return host is not None and (host == "aliyuncs.com" or host.endswith(".aliyuncs.com"))
+
+
 def resolve_dashscope_openai_api_base(
    api_base: str | None,
    env_var: str = "DASHSCOPE_API_BASE",
@ -140,9 +156,7 @@ def _chat_shaped_aliyun_origin(api_base: str | None) -> str | None:
    if api_base is None:
        return None
    parsed: Final = urlparse(api_base)
-    host: Final = parsed.hostname or ""
-    on_aliyun_host: Final = host == "aliyuncs.com" or host.endswith(".aliyuncs.com")
-    if not on_aliyun_host or parsed.path.rstrip("/") != DASHSCOPE_CHAT_COMPATIBLE_PATH:
+    if not is_aliyun_host(parsed.hostname) or parsed.path.rstrip("/") != DASHSCOPE_CHAT_COMPATIBLE_PATH:
        return None
    return f"{parsed.scheme}://{parsed.netloc}"

--- a/litellm/llms/dashscope/image_edit/init.py
+++ b/litellm/llms/dashscope/image_edit/init.py
--- a/litellm/llms/dashscope/image_edit/transformation.py
+++ b/litellm/llms/dashscope/image_edit/transformation.py
@ -0,0 +1,160 @@
+from collections.abc import Mapping
+from typing import TYPE_CHECKING, Final
+
+import httpx
+from httpx._types import RequestFiles
+from pydantic import TypeAdapter
+from typing_extensions import override
+
+import litellm
+from litellm.images.utils import image_to_data_url
+from litellm.llms.base_llm.image_edit.transformation import BaseImageEditConfig
+from litellm.llms.dashscope.common_utils import (
+    DASHSCOPE_CHAT_COMPATIBLE_PATH,
+    DASHSCOPE_MULTIMODAL_GENERATION_PATH,
+    dashscope_api_root,
+    is_dashscope_native_endpoint_url,
+    resolve_dashscope_endpoints,
+)
+from litellm.llms.dashscope.image_generation.transformation import (
+    DEFAULT_API_BASE,
+    OPENAI_TO_DASHSCOPE_SIZE,
+    DashScopeImageGenerationConfig,
+)
+from litellm.secret_managers.main import get_secret_str
+from litellm.types.images.main import ImageEditOptionalRequestParams
+from litellm.types.router import GenericLiteLLMParams
+from litellm.types.utils import ImageResponse
+
+if TYPE_CHECKING:
+    from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
+
+MAX_INPUT_IMAGES: Final = 3
+DASHSCOPE_IMAGE_EDIT_PARAMS: Final = ("n", "size", "negative_prompt", "prompt_extend", "watermark", "seed")
+
+_IMAGES: Final = TypeAdapter(tuple[object, ...])
+
+
+def _dashscope_size(size: object) -> object:
+    if not isinstance(size, str):
+        return size
+    return OPENAI_TO_DASHSCOPE_SIZE.get(size, size.replace("x", "*"))
+
+
+def _deployment_edit_url(api_base: str) -> str:
+    derives_from_root: Final = not is_dashscope_native_endpoint_url(api_base) and (
+        resolve_dashscope_endpoints(api_base) is not None
+        or api_base.rstrip("/").endswith(DASHSCOPE_CHAT_COMPATIBLE_PATH)
+    )
+    return f"{dashscope_api_root(api_base)}{DASHSCOPE_MULTIMODAL_GENERATION_PATH}" if derives_from_root else api_base
+
+
+class DashScopeImageEditConfig(BaseImageEditConfig):
+    def __init__(self, generation_config: DashScopeImageGenerationConfig | None = None) -> None:
+        super().__init__()
+        self._generation_config: Final = generation_config or DashScopeImageGenerationConfig()
+
+    @override
+    def get_supported_openai_params(self, model: str) -> list[str]:  # mutable-ok: mirrors override contract
+        return list(DASHSCOPE_IMAGE_EDIT_PARAMS)
+
+    @override
+    def map_openai_params(
+        self,
+        image_edit_optional_params: ImageEditOptionalRequestParams,
+        model: str,
+        drop_params: bool,
+    ) -> dict[str, object]:  # mutable-ok: mirrors override contract
+        return {
+            key: _dashscope_size(value) if key == "size" else value
+            for key, value in image_edit_optional_params.items()
+            if key in DASHSCOPE_IMAGE_EDIT_PARAMS
+        }
+
+    @override
+    def validate_environment(
+        self,
+        headers: dict[str, str],  # mutable-ok: mirrors override contract
+        model: str,
+        api_key: str | None = None,
+        litellm_params: dict[str, object] | None = None,  # mutable-ok: mirrors override contract
+        api_base: str | None = None,
+    ) -> dict[str, str]:  # mutable-ok: mirrors override contract
+        return self._generation_config.validate_environment(
+            headers=dict(headers),
+            model=model,
+            messages=[],
+            optional_params={},
+            litellm_params=dict(litellm_params or {}),
+            api_key=api_key,
+            api_base=api_base,
+        )
+
+    @override
+    def get_complete_url(
+        self,
+        model: str,
+        api_base: str | None,
+        litellm_params: dict[str, object],  # mutable-ok: mirrors override contract
+    ) -> str:
+        if api_base is not None:
+            return _deployment_edit_url(api_base)
+        env_api_base: Final = get_secret_str("DASHSCOPE_API_BASE")
+        derived: Final = (
+            f"{dashscope_api_root(env_api_base)}{DASHSCOPE_MULTIMODAL_GENERATION_PATH}" if env_api_base else None
+        )
+        return get_secret_str("DASHSCOPE_API_BASE_IMAGE") or derived or DEFAULT_API_BASE
+
+    @override
+    def use_multipart_form_data(self) -> bool:
+        return False
+
+    @override
+    def transform_image_edit_request(
+        self,
+        model: str,
+        prompt: str | None,
+        image: object,
+        image_edit_optional_request_params: Mapping[str, object],
+        litellm_params: GenericLiteLLMParams,
+        headers: Mapping[str, str],
+    ) -> tuple[dict[str, object], RequestFiles]:  # mutable-ok: mirrors override contract
+        candidates: Final = _IMAGES.validate_python(image) if isinstance(image, list) else (image,)
+        images: Final = tuple(candidate for candidate in candidates if candidate is not None)
+        if len(images) > MAX_INPUT_IMAGES:
+            raise litellm.BadRequestError(
+                message=f"DashScope image edit accepts at most {MAX_INPUT_IMAGES} input images, got {len(images)}",
+                model=model,
+                llm_provider="dashscope",
+            )
+        prompt_content: Final = ({"text": prompt},) if prompt is not None else ()
+        return {
+            "model": model,
+            "input": {
+                "messages": [
+                    {
+                        "role": "user",
+                        "content": [*({"image": image_to_data_url(item)} for item in images), *prompt_content],
+                    }
+                ]
+            },
+            "parameters": dict(image_edit_optional_request_params),
+        }, ()
+
+    @override
+    def transform_image_edit_response(
+        self,
+        model: str,
+        raw_response: httpx.Response,
+        logging_obj: "LiteLLMLoggingObj",
+    ) -> ImageResponse:
+        return self._generation_config.transform_image_generation_response(
+            model=model,
+            raw_response=raw_response,
+            model_response=ImageResponse(),
+            logging_obj=logging_obj,
+            request_data={},
+            optional_params={},
+            litellm_params={},
+            encoding=None,
+        )
--- a/litellm/llms/dashscope/image_generation/cost_calculator.py
+++ b/litellm/llms/dashscope/image_generation/cost_calculator.py
@ -0,0 +1,19 @@
+from typing import Final
+
+import litellm
+from litellm.litellm_core_utils.llm_cost_calc.utils import resolve_image_model_info
+from litellm.types.utils import ImageResponse, ModelInfo
+
+
+def cost_calculator(model: str, image_response: ImageResponse, model_info: ModelInfo | None = None) -> float:
+    prices: Final = resolve_image_model_info(
+        model=model, custom_llm_provider=litellm.LlmProviders.DASHSCOPE.value, model_info=model_info
+    )
+    output_cost_per_image: Final = prices.get("output_cost_per_image")
+    if output_cost_per_image is None:
+        raise ValueError(f"No output_cost_per_image found for dashscope/{model}")
+    input_images: Final = image_response.hidden_params.get("billable_input_image_count")
+    input_image_cost: Final = (prices.get("input_cost_per_image") or 0.0) * (
+        input_images if isinstance(input_images, int) else 0
+    )
+    return output_cost_per_image * len(image_response.data or ()) + input_image_cost
--- a/litellm/llms/dashscope/image_generation/transformation.py
+++ b/litellm/llms/dashscope/image_generation/transformation.py
@ -23,7 +23,7 @@ Response format:
 }
 """

-from collections.abc import Iterable, Mapping
+from collections.abc import Iterable, Iterator, Mapping
 from typing import TYPE_CHECKING, Any, Final

 import httpx
@ -61,7 +61,7 @@ _DECODED_JSON: Final = TypeAdapter(object)
 DEFAULT_API_BASE: Final = "https://dashscope-intl.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation"

 # Maps OpenAI size strings (WxH) to DashScope size strings (W*H)
-OPENAI_TO_DASHSCOPE_SIZE: Final[dict] = {
+OPENAI_TO_DASHSCOPE_SIZE: Final[Mapping[str, str]] = {
    "256x256": "256*256",
    "512x512": "512*512",
    "1024x1024": "1024*1024",
@ -71,6 +71,24 @@ OPENAI_TO_DASHSCOPE_SIZE: Final[dict] = {
 }


+def _message_image_urls(message: Mapping[str, object]) -> Iterator[str]:
+    contents: Final = _JSON_OBJECTS.validate_python(message.get("content", []))
+    return (url for url in (item.get("image") for item in contents) if isinstance(url, str) and url)
+
+
+def _image_urls(response_object: Mapping[str, object]) -> Iterator[str]:
+    output: Final = _JSON_OBJECT.validate_python(response_object.get("output", {}))
+    choices: Final = _JSON_OBJECTS.validate_python(output.get("choices", []))
+    for choice in choices:
+        yield from _message_image_urls(_JSON_OBJECT.validate_python(choice.get("message", {})))
+
+
+def _dashscope_size(size: object) -> object:
+    if not isinstance(size, str):
+        return size
+    return OPENAI_TO_DASHSCOPE_SIZE.get(size, size.replace("x", "*"))
+
+
 class DashScopeImageGenerationConfig(BaseImageGenerationConfig):
    """
    Configuration for DashScope image generation (qwen-image-2.0, qwen-image-2.0-pro,
@ -82,24 +100,16 @@ class DashScopeImageGenerationConfig(BaseImageGenerationConfig):

    def map_openai_params(
        self,
-        non_default_params: dict,
-        optional_params: dict,
+        non_default_params: dict[str, object],
+        optional_params: dict[str, object],
        model: str,
        drop_params: bool,
-    ) -> dict:
+    ) -> dict[str, object]:
        supported_params: Final = self.get_supported_openai_params(model)
-        mapped: Final[dict] = {}
-        for k, v in non_default_params.items():
-            if k in optional_params:
-                continue
-            if k not in supported_params:
-                continue
-            if k == "size":
-                # Convert "WxH" → "W*H"
-                mapped["size"] = OPENAI_TO_DASHSCOPE_SIZE.get(v, v.replace("x", "*"))
-            else:
-                mapped[k] = v
-        return mapped
+        requested: Final = {
+            k: v for k, v in non_default_params.items() if k in supported_params and k not in optional_params
+        }
+        return {k: _dashscope_size(v) if k == "size" else v for k, v in requested.items()}

    def _resolve_api_key(self, api_key: str | None) -> str:
        resolved_api_key: Final = api_key or get_secret_str("DASHSCOPE_API_KEY")
@ -121,8 +131,8 @@ class DashScopeImageGenerationConfig(BaseImageGenerationConfig):
        api_base: str | None,
        api_key: str | None,
        model: str,
-        optional_params: dict,
-        litellm_params: dict,
+        optional_params: dict[str, object],
+        litellm_params: dict[str, object],
        stream: bool | None = None,
    ) -> str:
        image_env_api_base: Final = self._image_api_base_env()
@ -140,14 +150,14 @@ class DashScopeImageGenerationConfig(BaseImageGenerationConfig):

    def validate_environment(
        self,
-        headers: dict,
+        headers: dict[str, str],
        model: str,
        messages: list[AllMessageValues],
-        optional_params: dict,
-        litellm_params: dict,
+        optional_params: dict[str, object],
+        litellm_params: dict[str, object],
        api_key: str | None = None,
        api_base: str | None = None,
-    ) -> dict:
+    ) -> dict[str, str]:
        headers["Authorization"] = f"Bearer {self._resolve_api_key(api_key)}"
        headers["Content-Type"] = "application/json"
        return headers
@ -186,9 +196,9 @@ class DashScopeImageGenerationConfig(BaseImageGenerationConfig):
        raw_response: httpx.Response,
        model_response: ImageResponse,
        logging_obj: LiteLLMLoggingObj,
-        request_data: dict,
-        optional_params: dict,
-        litellm_params: dict,
+        request_data: dict[str, object],
+        optional_params: dict[str, object],
+        litellm_params: dict[str, object],
        encoding: "Tokenizer | None",
        api_key: str | None = None,
        json_mode: bool | None = None,
@ -225,17 +235,21 @@ class DashScopeImageGenerationConfig(BaseImageGenerationConfig):
                headers=raw_response.headers,
            )

-        if not model_response.data:
-            model_response.data = []
-
-        output: Final = _JSON_OBJECT.validate_python(response_object.get("output", {}))
-        choices: Final = _JSON_OBJECTS.validate_python(output.get("choices", []))
-        for choice in choices:
-            message = _JSON_OBJECT.validate_python(choice.get("message", {}))
-            content_list = _JSON_OBJECTS.validate_python(message.get("content", []))
-            for content_item in content_list:
-                image_url = content_item.get("image")
-                if image_url:
-                    model_response.data.append(ImageObject(url=image_url))
-
-        return model_response
+        images: Final = [*(model_response.data or ()), *(ImageObject(url=url) for url in _image_urls(response_object))]
+        usage: Final = response_object.get("usage")
+        usage_fields: Final[Mapping[str, object]] = usage if isinstance(usage, Mapping) else {}
+        width: Final = usage_fields.get("output_width", usage_fields.get("width"))
+        height: Final = usage_fields.get("output_height", usage_fields.get("height"))
+        image_response: Final = model_response.model_copy(
+            update={
+                "data": images,
+                **({"size": f"{width}x{height}"} if isinstance(width, int) and isinstance(height, int) else {}),
+            }
+        )
+        input_image_count: Final = usage_fields.get("input_image_count")
+        if isinstance(input_image_count, int) and input_image_count > 0:
+            image_response.hidden_params = {
+                **model_response.hidden_params,
+                "billable_input_image_count": input_image_count,
+            }
+        return image_response
--- a/litellm/llms/dashscope/text_to_speech/init.py
+++ b/litellm/llms/dashscope/text_to_speech/init.py
--- a/litellm/llms/dashscope/text_to_speech/transformation.py
+++ b/litellm/llms/dashscope/text_to_speech/transformation.py
@ -0,0 +1,297 @@
+from collections.abc import Callable, Mapping
+from dataclasses import dataclass
+from itertools import chain
+from typing import TYPE_CHECKING, Final
+from urllib.parse import urlparse
+
+import httpx
+from pydantic import BaseModel, ConfigDict, TypeAdapter, ValidationError
+from typing_extensions import override
+
+import litellm
+from litellm.exceptions import UnsupportedParamsError
+from litellm.litellm_core_utils.core_helpers import drops_unsupported_params
+from litellm.litellm_core_utils.url_utils import SSRFError, async_safe_get, safe_get
+from litellm.llms.base_llm.chat.transformation import BaseLLMException
+from litellm.llms.base_llm.text_to_speech.transformation import (
+    BaseTextToSpeechConfig,
+    TextToSpeechRequestData,
+)
+from litellm.llms.custom_httpx.http_handler import (
+    AsyncHTTPHandler,
+    HTTPHandler,
+    get_async_httpx_client,  # pyright: ignore[reportUnknownVariableType]  # factory stub leaves params untyped
+    get_httpx_client,  # pyright: ignore[reportUnknownVariableType]  # factory stub leaves params untyped
+)
+from litellm.llms.dashscope.common_utils import (
+    DASHSCOPE_MULTIMODAL_GENERATION_PATH,
+    DashScopeError,
+    dashscope_api_root,
+    is_aliyun_host,
+    missing_dashscope_family_key_message,
+    resolve_dashscope_family_api_key,
+)
+from litellm.secret_managers.main import get_secret_str
+from litellm.types.llms.openai import HttpxBinaryResponseContent
+from litellm.types.utils import Usage
+
+if TYPE_CHECKING:
+    from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
+
+DASHSCOPE_TTS_DEFAULT_API_BASE: Final = "https://dashscope-intl.aliyuncs.com"
+_SPEECH_SYNTHESIZER_MODEL_PREFIX: Final = "qwen-audio-"
+_TIMEOUT_PHASES: Final = TypeAdapter(dict[str, float | None])
+
+
+@dataclass(frozen=True, slots=True)
+class _TextToSpeechFamily:
+    path: str
+    response_formats: frozenset[str]
+    sends_format: bool
+    takes_instructions: bool
+
+
+MULTIMODAL_GENERATION_FAMILY: Final = _TextToSpeechFamily(
+    path=DASHSCOPE_MULTIMODAL_GENERATION_PATH,
+    response_formats=frozenset({"wav"}),
+    sends_format=False,
+    takes_instructions=False,
+)
+SPEECH_SYNTHESIZER_FAMILY: Final = _TextToSpeechFamily(
+    path="/api/v1/services/audio/tts/SpeechSynthesizer",
+    response_formats=frozenset({"mp3", "wav", "opus", "pcm"}),
+    sends_format=True,
+    takes_instructions=True,
+)
+
+
+class _Audio(BaseModel):
+    model_config = ConfigDict(frozen=True)
+    url: str
+
+
+class _Output(BaseModel):
+    model_config = ConfigDict(frozen=True)
+    audio: _Audio
+
+
+class _Usage(BaseModel):
+    model_config = ConfigDict(frozen=True)
+    input_tokens: int | None = None
+    output_tokens: int | None = None
+    characters: int | None = None
+
+
+class _SpeechResponse(BaseModel):
+    model_config = ConfigDict(frozen=True)
+    output: _Output | None = None
+    usage: _Usage | None = None
+    code: str | None = None
+    message: str | None = None
+
+
+def text_to_speech_family(model: str) -> _TextToSpeechFamily:
+    if model.startswith(_SPEECH_SYNTHESIZER_MODEL_PREFIX):
+        return SPEECH_SYNTHESIZER_FAMILY
+    return MULTIMODAL_GENERATION_FAMILY
+
+
+def _mapped_field(family: _TextToSpeechFamily, key: str, value: object) -> Mapping[str, object] | None:
+    match key:
+        case "response_format" if value in family.response_formats:
+            return {"format": value} if family.sends_format else {}
+        case "instructions" if family.takes_instructions:
+            return {"instruction": value}
+        case _:
+            return None
+
+
+def _unsupported(model: str, unsupported: tuple[str, ...]) -> UnsupportedParamsError:
+    return UnsupportedParamsError(
+        message=f"DashScope {model} does not support {', '.join(unsupported)}, set drop_params=True to ignore it",
+        model=model,
+        llm_provider="dashscope",
+    )
+
+
+def _speech_response(raw_response: httpx.Response) -> _SpeechResponse:
+    try:
+        return _SpeechResponse.model_validate_json(raw_response.content)
+    except ValidationError as e:
+        raise DashScopeError(
+            status_code=502,
+            message=f"Unexpected DashScope text-to-speech response: {e}",
+            headers=raw_response.headers,
+        ) from e
+
+
+def _https_on_aliyun(url: str) -> str:
+    parsed: Final = urlparse(url)
+    return (
+        parsed._replace(scheme="https").geturl() if parsed.scheme == "http" and is_aliyun_host(parsed.hostname) else url
+    )
+
+
+def _audio_url(raw_response: httpx.Response) -> tuple[str, _Usage | None]:
+    parsed: Final = _speech_response(raw_response)
+    if parsed.output is None:
+        raise DashScopeError(
+            status_code=max(raw_response.status_code, 400),
+            message=parsed.message or parsed.code or raw_response.text,
+            headers=raw_response.headers,
+        )
+    return _https_on_aliyun(parsed.output.audio.url), parsed.usage
+
+
+def _request_timeout(raw_response: httpx.Response) -> httpx.Timeout | None:
+    extension: Final = raw_response.request.extensions.get("timeout")
+    if extension is None:
+        return None
+    phases: Final = _TIMEOUT_PHASES.validate_python(extension)
+    return httpx.Timeout(
+        connect=phases.get("connect"), read=phases.get("read"), write=phases.get("write"), pool=phases.get("pool")
+    )
+
+
+def _token_usage(usage: _Usage | None) -> Usage | None:
+    if usage is None or usage.input_tokens is None or usage.output_tokens is None:
+        return None
+    return Usage(
+        prompt_tokens=usage.input_tokens,
+        completion_tokens=usage.output_tokens,
+        total_tokens=usage.input_tokens + usage.output_tokens,
+    )
+
+
+def _refused_audio_url(error: SSRFError) -> DashScopeError:
+    return DashScopeError(status_code=502, message=f"DashScope returned an audio URL that was refused: {error}")
+
+
+def _binary_audio(audio_response: httpx.Response, usage: _Usage | None) -> HttpxBinaryResponseContent:
+    if audio_response.status_code != 200:
+        raise DashScopeError(
+            status_code=502,
+            message=f"DashScope audio download failed with HTTP {audio_response.status_code}",
+            headers=audio_response.headers,
+        )
+    binary: Final = HttpxBinaryResponseContent(audio_response)
+    binary.usage = _token_usage(usage)
+    if usage is not None and usage.characters is not None:
+        binary.hidden_params = {**binary.hidden_params, "billed_characters": usage.characters}
+    return binary
+
+
+def _shared_async_client() -> AsyncHTTPHandler:
+    return get_async_httpx_client(llm_provider=litellm.LlmProviders.DASHSCOPE)
+
+
+class DashScopeTextToSpeechConfig(BaseTextToSpeechConfig):
+    def __init__(
+        self,
+        sync_client: Callable[[], HTTPHandler] = get_httpx_client,
+        async_client: Callable[[], AsyncHTTPHandler] = _shared_async_client,
+    ) -> None:
+        super().__init__()
+        self._sync_client: Final = sync_client
+        self._async_client: Final = async_client
+
+    @override
+    def get_supported_openai_params(self, model: str) -> list[str]:  # mutable-ok: mirrors override contract
+        family: Final = text_to_speech_family(model)
+        return ["voice", "response_format", *(("instructions",) if family.takes_instructions else ())]
+
+    @override
+    def map_openai_params(
+        self,
+        model: str,
+        optional_params: dict[str, object],  # mutable-ok: mirrors override contract
+        voice: str | dict[str, object] | None = None,  # mutable-ok: mirrors override contract
+        drop_params: bool = False,
+        kwargs: Mapping[str, object] | None = None,
+    ) -> tuple[str | None, dict[str, object]]:  # mutable-ok: mirrors override contract
+        family: Final = text_to_speech_family(model)
+        fields: Final = tuple((key, value, _mapped_field(family, key, value)) for key, value in optional_params.items())
+        unsupported: Final = (
+            *(f"{key}={value!r}" for key, value, field in fields if field is None),
+            *(("voice as an object",) if isinstance(voice, dict) else ()),
+        )
+        if unsupported and not (drop_params or drops_unsupported_params((kwargs or {}).get("drop_params"))):
+            raise _unsupported(model, unsupported)
+        supported: Final = tuple(field for _, _, field in fields if field is not None)
+        return voice if isinstance(voice, str) else None, dict(chain.from_iterable(f.items() for f in supported))
+
+    @override
+    def validate_environment(
+        self,
+        headers: dict[str, str],  # mutable-ok: mirrors override contract
+        model: str,
+        api_key: str | None = None,
+        api_base: str | None = None,
+    ) -> dict[str, str]:  # mutable-ok: mirrors override contract
+        resolved_api_key: Final = resolve_dashscope_family_api_key("dashscope", api_key)
+        if resolved_api_key is None:
+            raise ValueError(missing_dashscope_family_key_message("dashscope"))
+        return {**headers, "Authorization": f"Bearer {resolved_api_key}", "Content-Type": "application/json"}
+
+    @override
+    def get_complete_url(
+        self,
+        model: str,
+        api_base: str | None,
+        litellm_params: dict[str, object],  # mutable-ok: mirrors override contract
+    ) -> str:
+        configured: Final = api_base or get_secret_str("DASHSCOPE_API_BASE")
+        root: Final = dashscope_api_root(configured) if configured else DASHSCOPE_TTS_DEFAULT_API_BASE
+        return f"{root}{text_to_speech_family(model).path}"
+
+    @override
+    def transform_text_to_speech_request(
+        self,
+        model: str,
+        input: str,
+        voice: str | None,
+        optional_params: dict[str, object],  # mutable-ok: mirrors override contract
+        litellm_params: dict[str, object],  # mutable-ok: mirrors override contract
+        headers: dict[str, str],  # mutable-ok: mirrors override contract
+    ) -> TextToSpeechRequestData:
+        voice_field: Final = {"voice": voice} if voice is not None else {}
+        return {"dict_body": {"model": model, "input": {"text": input, **voice_field, **optional_params}}}
+
+    @override
+    def transform_text_to_speech_response(
+        self,
+        model: str,
+        raw_response: httpx.Response,
+        logging_obj: "LiteLLMLoggingObj",
+    ) -> HttpxBinaryResponseContent:
+        audio_url, usage = _audio_url(raw_response)
+        try:
+            audio_response: Final = safe_get(self._sync_client(), audio_url, timeout=_request_timeout(raw_response))
+        except SSRFError as e:
+            raise _refused_audio_url(e) from e
+        return _binary_audio(audio_response, usage)
+
+    @override
+    async def async_transform_text_to_speech_response(
+        self,
+        model: str,
+        raw_response: httpx.Response,
+        logging_obj: "LiteLLMLoggingObj",
+    ) -> HttpxBinaryResponseContent:
+        audio_url, usage = _audio_url(raw_response)
+        try:
+            audio_response: Final = await async_safe_get(
+                self._async_client(), audio_url, timeout=_request_timeout(raw_response)
+            )
+        except SSRFError as e:
+            raise _refused_audio_url(e) from e
+        return _binary_audio(audio_response, usage)
+
+    @override
+    def get_error_class(
+        self,
+        error_message: str,
+        status_code: int,
+        headers: dict[str, str] | httpx.Headers,  # mutable-ok: mirrors override contract
+    ) -> BaseLLMException:
+        return DashScopeError(status_code=status_code, message=error_message, headers=httpx.Headers(headers))
--- a/litellm/llms/edenai/audio_transcription/transformation.py
+++ b/litellm/llms/edenai/audio_transcription/transformation.py
@ -9,6 +9,7 @@ from collections.abc import Mapping
 from typing import Final

 import httpx
+from pydantic import ConfigDict, TypeAdapter

 from litellm.litellm_core_utils.audio_utils.utils import process_audio_file
 from litellm.litellm_core_utils.core_helpers import set_response_cost_in_hidden_params
@ -21,6 +22,8 @@ from litellm.utils import convert_to_model_response_object

 from ..common_utils import EdenAIException, authorized_headers, endpoint_url, reported_cost

+_JSON_OBJECT: Final = TypeAdapter(dict[str, object], config=ConfigDict(strict=True, hide_input_in_errors=True))
+

 def _form_fields(model: str, optional_params: Mapping[str, object]) -> dict[str, object]:  # mutable-ok: httpx form data
    """LiteLLM parks non-OpenAI params, `model` included, under `extra_body` for the OpenAI SDK; a
@ -75,7 +78,7 @@ class EdenAIAudioTranscriptionConfig(OpenAIWhisperAudioTranscriptionConfig):
    def transform_audio_transcription_response(self, raw_response: httpx.Response) -> TranscriptionResponse:
        if "application/json" not in raw_response.headers.get("content-type", ""):
            return TranscriptionResponse(text=raw_response.text)
-        body: Final = raw_response.json()
+        body: Final = _JSON_OBJECT.validate_python(raw_response.json())
        response: Final[TranscriptionResponse] = convert_to_model_response_object(
            response_object=body, model_response_object=TranscriptionResponse(), response_type="audio_transcription"
        )
--- a/litellm/llms/eu_jev/init.py
+++ b/litellm/llms/eu_jev/init.py
--- a/litellm/llms/eu_jev/common_utils.py
+++ b/litellm/llms/eu_jev/common_utils.py
@ -0,0 +1,34 @@
+from collections.abc import Mapping
+from types import MappingProxyType
+from typing import Final
+
+EU_JEV_LATEST_MODEL: Final = "eu-jeff-latest"
+_EU_JEV_CURRENT_RELEASE_NAMES: Final = frozenset((EU_JEV_LATEST_MODEL, "jeff-latest", "jeff-1.0.0"))
+_EU_JEV_PREFIX: Final = "eu_jev/"
+
+
+def eu_jev_registry_model(requested_model: str | None) -> str:
+    release: Final = requested_model.removeprefix(_EU_JEV_PREFIX) if requested_model is not None else None
+    if release is None or release in _EU_JEV_CURRENT_RELEASE_NAMES:
+        return EU_JEV_LATEST_MODEL
+    return release
+
+
+def eu_jev_scoped_model(decision_body: Mapping[str, object]) -> str:
+    requested_model: Final = decision_body.get("model")
+    return f"{_EU_JEV_PREFIX}{eu_jev_registry_model(requested_model if isinstance(requested_model, str) else None)}"
+
+
+def eu_jev_upstream_body(hook_body: Mapping[str, object], client_body: Mapping[str, object]) -> Mapping[str, object]:
+    hook_model: Final = hook_body.get("model")
+    without_model: Final = {key: value for key, value in hook_body.items() if key != "model"}
+    if hook_model == eu_jev_scoped_model(client_body):
+        client_model: Final = client_body.get("model")
+        if client_model is None:
+            return MappingProxyType(without_model)
+        if isinstance(client_model, str):
+            return MappingProxyType({**without_model, "model": client_model.removeprefix(_EU_JEV_PREFIX)})
+        return MappingProxyType({**without_model, "model": client_model})
+    if isinstance(hook_model, str):
+        return MappingProxyType({**without_model, "model": hook_model.removeprefix(_EU_JEV_PREFIX)})
+    return hook_body
--- a/litellm/llms/eu_jev/decisions/transformation.py
+++ b/litellm/llms/eu_jev/decisions/transformation.py
@ -0,0 +1,9 @@
+from litellm.llms.base_llm.decisions.transformation import BaseDecisionsConfig
+
+
+class EuJevDecisionsConfig(BaseDecisionsConfig):
+    api_key_env = ("EU_JEV_API_KEY",)
+    api_base_env = ("EU_JEV_API_BASE",)
+
+    def get_default_api_base(self) -> str | None:
+        return "https://eu-jev.com"
--- a/litellm/llms/litellm_proxy/responses/transformation.py
+++ b/litellm/llms/litellm_proxy/responses/transformation.py
@ -5,11 +5,30 @@ LiteLLM Proxy supports the OpenAI Responses API natively when the underlying mod
 This config enables pass-through behavior to the proxy's /v1/responses endpoint.
 """

+from typing import Final
+
+import httpx
+from pydantic import TypeAdapter, ValidationError
+
 from litellm.litellm_core_utils.url_utils import join_api_base
+from litellm.llms.base_llm.chat.transformation import BaseLLMException
 from litellm.llms.openai.responses.transformation import OpenAIResponsesAPIConfig
 from litellm.secret_managers.main import get_secret_str
 from litellm.types.utils import LlmProviders

+_ERROR_BODY: Final = TypeAdapter(dict[str, object])
+
+
+def _openai_sdk_error_body(
+    error_message: str,
+) -> dict[str, object] | None:  # mutable-ok: BaseLLMException.body is a dict
+    try:
+        decoded: Final = _ERROR_BODY.validate_json(error_message)
+    except ValidationError:
+        return None
+    nested: Final = decoded.get("error")
+    return _ERROR_BODY.validate_python(nested) if isinstance(nested, dict) else decoded
+

 class LiteLLMProxyResponsesAPIConfig(OpenAIResponsesAPIConfig):
    """
@ -43,6 +62,19 @@ class LiteLLMProxyResponsesAPIConfig(OpenAIResponsesAPIConfig):

        return join_api_base(api_base, "responses")

+    def get_error_class(
+        self,
+        error_message: str,
+        status_code: int,
+        headers: dict[str, object] | httpx.Headers,  # mutable-ok: inherited contract
+    ) -> BaseLLMException:
+        return BaseLLMException(
+            status_code=status_code,
+            message=error_message,
+            headers=headers,
+            body=_openai_sdk_error_body(error_message),
+        )
+
    def supports_native_websocket(self) -> bool:
        """LiteLLM Proxy does not support native WebSocket for Responses API"""
        return False
--- a/litellm/llms/openai/chat/guardrail_translation/handler.py
+++ b/litellm/llms/openai/chat/guardrail_translation/handler.py
@ -687,11 +687,6 @@ class OpenAIChatCompletionsHandler(BaseTranslation):
        responses_so_far: Sequence["ModelResponseStream"],
        litellm_logging_obj: "LiteLLMLoggingObj | None",
    ) -> "ModelResponse":
-        """``stream_chunk_builder`` folds every choice of a stream into one index-0
-        choice, so the stream is rebuilt one choice index at a time (every chunk
-        kept, its choices narrowed to that index, so usage-only chunks still
-        count) and the rebuilt choices are stitched into one response, each
-        carrying the index the stream gave it."""
        choice_indices: Final = tuple(
            sorted(frozenset(choice.index for response in responses_so_far for choice in response.choices))
        )
--- a/litellm/llms/openai/image_generation/gpt_transformation.py
+++ b/litellm/llms/openai/image_generation/gpt_transformation.py
@ -1,6 +1,7 @@
 from typing import TYPE_CHECKING, Final

 import httpx
+from pydantic import ConfigDict, TypeAdapter

 from litellm.llms.base_llm.image_generation.transformation import (
    BaseImageGenerationConfig,
@ -9,6 +10,8 @@ from litellm.types.llms.openai import OpenAIImageGenerationOptionalParams
 from litellm.types.utils import ImageResponse
 from litellm.utils import convert_to_model_response_object

+_JSON_OBJECT: Final = TypeAdapter(dict[str, object], config=ConfigDict(strict=True, hide_input_in_errors=True))
+
 if TYPE_CHECKING:
    from litellm.litellm_core_utils.logging import Logging as LiteLLMLoggingObj

@ -66,7 +69,7 @@ class GPTImageGenerationConfig(BaseImageGenerationConfig):
        api_key: str | None = None,
        json_mode: bool | None = None,
    ) -> ImageResponse:
-        response: Final = raw_response.json()
+        response: Final = _JSON_OBJECT.validate_python(raw_response.json())

        stringified_response: Final = response
        ## LOGGING
--- a/Show more
+++ b/Show more