feat(terraform): sync provider 0.3.0 from mirror and cut 0.4.0

The provider's release gate in project-releaser publishes only when the
topmost released heading in terraform/provider/CHANGELOG.md moves past the
tag the mirror already carries. That heading has been 0.2.2 since
2026-05-13, so every stable release since has correctly decided there was
nothing to publish and the registry has gone stale.

Two things were blocking a release:

1. The mirror shipped 0.3.0 out-of-band on 2026-07-13 (pricing_base_model,
   BerriAI/terraform-provider-litellm#47) after the source move, so that
   code exists only in the mirror. The publish rsyncs monorepo -> mirror
   with --delete, so publishing without this port would have deleted a
   released feature from the registry.
2. Nothing here declared a new version.

Port #47 verbatim (resource_model.go and resource_model_crud.go are now
byte-identical to the mirror's released files), backfill the 0.3.0
changelog entry it shipped under, and cut 0.4.0 covering the changes made
here since the source move. 0.3.0 is not reusable as the next version --
the mirror holds that tag and the publish workflow's tag guard rejects it.

terraform/provider/CHANGELOG.md

@@ -7,13 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-08-06
+
 ### Fixed
 
 - **organization**: Send `PATCH` instead of `POST` to `/organization/update` and `/organization/member_update`, matching the methods the LiteLLM proxy serves; organization and organization member updates previously failed with a 405
+- **team_member**: Include `role` in the update payload so a role change on an existing `litellm_team_member` is applied instead of being silently dropped
 
 ### Changed
 
 - The provider source of truth moved to `terraform/provider/` in [BerriAI/litellm](https://github.com/BerriAI/litellm); this repository is now a release mirror. CI in the monorepo statically audits every endpoint the provider calls against the proxy's OpenAPI schema on every change
+- **mcp_server**, **vector_store**: `env` and `litellm_params` are now marked sensitive, so they are redacted from plan/apply output, and they are no longer read back from the API into state — the configured value is authoritative. If the proxy returns values that differ from the configuration, that drift is no longer surfaced on refresh
+- Dependency updates: `grpc` and `golang.org/x` modules
+
+## [0.3.0] - 2026-07-13
+
+Released from the mirror repository before the source move was complete; this entry backfills it in the monorepo changelog.
+
+### Added
+
+- **model**: Add optional `pricing_base_model` attribute that sets `model_info.base_model` (the cost-map lookup key) independently of routing. Deployments whose routing name differs from the pricing key (for example Azure Data Zone, routed as `azure/gpt-4.1` but priced via `us/gpt-4.1-2025-04-14`) can now be billed correctly without breaking routing. When unset, behavior is unchanged and `base_model` continues to drive both routing and pricing (#47)
 
 ## [0.2.2] - 2026-05-13
 

terraform/provider/docs/resources/model.md

@@ -118,6 +118,8 @@ The following arguments are supported:
 
 * `base_model` - (Required) string. The actual model identifier from the provider (e.g., "gpt-4", "claude-2").
 
+* `pricing_base_model` - (Optional) string. A pricing key fed to `model_info.base_model` **independently of routing**. When set, `litellm_params.model` still routes via `base_model`, but LiteLLM looks up cost against this key. Useful when the routing/deployment name differs from the cost-map key — e.g. an Azure deployment routed as `azure/gpt-4.1` whose real tier is Data Zone: set `pricing_base_model = "us/gpt-4.1-2025-04-14"` so it is billed at the Data Zone rate. When unset, `base_model` drives pricing as before.
+
 * `litellm_credential_name` - (Optional) string. Name of a LiteLLM credential to use for this model.
 
 * `tier` - (Optional) string. The usage tier for this model. Valid values are `"free"` or `"paid"`. Default: `"free"`.

terraform/provider/litellm/resource_model.go

@@ -73,6 +73,14 @@ func resourceLiteLLMModel() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 			},
+			"pricing_base_model": {
+				// Optional pricing key fed to model_info.base_model, DECOUPLED
+				// from routing. When set, litellm_params.model still routes via
+				// base_model, but cost is looked up against this key (e.g.
+				// "us/gpt-4.1-2025-04-14" for Azure Data Zone pricing).
+				Type:     schema.TypeString,
+				Optional: true,
+			},
 			"tier": {
 				Type:     schema.TypeString,
 				Optional: true,

terraform/provider/litellm/resource_model_crud.go

@@ -68,6 +68,14 @@ func createOrUpdateModel(d *schema.ResourceData, m interface{}, isUpdate bool) e
 	baseModel := d.Get("base_model").(string)
 	modelName := fmt.Sprintf("%s/%s", customLLMProvider, baseModel)
 
+	// Pricing base_model, decoupled from routing. When pricing_base_model is
+	// set it feeds model_info.base_model (the cost-lookup key) WITHOUT changing
+	// the routing string above; otherwise base_model drives pricing as before.
+	pricingBaseModel := baseModel
+	if v, ok := d.GetOk("pricing_base_model"); ok && v.(string) != "" {
+		pricingBaseModel = v.(string)
+	}
+
 	// Generate a UUID for new models
 	modelID := d.Id()
 	if !isUpdate {
@@ -240,7 +248,7 @@ func createOrUpdateModel(d *schema.ResourceData, m interface{}, isUpdate bool) e
 		ModelInfo: ModelInfo{
 			ID:        modelID,
 			DBModel:   true,
-			BaseModel: baseModel,
+			BaseModel: pricingBaseModel,
 			Tier:      d.Get("tier").(string),
 			Mode:      d.Get("mode").(string),
 			TeamID:    d.Get("team_id").(string),
@@ -306,7 +314,16 @@ func resourceLiteLLMModelRead(d *schema.ResourceData, m interface{}) error {
 	d.Set("rpm", GetIntValue(modelResp.LiteLLMParams.RPM, d.Get("rpm").(int)))
 	d.Set("model_api_base", GetStringValue(modelResp.LiteLLMParams.APIBase, d.Get("model_api_base").(string)))
 	d.Set("api_version", GetStringValue(modelResp.LiteLLMParams.APIVersion, d.Get("api_version").(string)))
-	d.Set("base_model", GetStringValue(modelResp.ModelInfo.BaseModel, d.Get("base_model").(string)))
+	// base_model / pricing_base_model read-back. When pricing_base_model is
+	// configured, model_info.base_model holds the PRICING key, so recover the
+	// routing base_model from state (not returned by the API) and read
+	// pricing_base_model from model_info.
+	if pbm, ok := d.GetOk("pricing_base_model"); ok && pbm.(string) != "" {
+		d.Set("base_model", d.Get("base_model").(string))
+		d.Set("pricing_base_model", GetStringValue(modelResp.ModelInfo.BaseModel, pbm.(string)))
+	} else {
+		d.Set("base_model", GetStringValue(modelResp.ModelInfo.BaseModel, d.Get("base_model").(string)))
+	}
 	d.Set("tier", GetStringValue(modelResp.ModelInfo.Tier, d.Get("tier").(string)))
 	d.Set("mode", GetStringValue(modelResp.ModelInfo.Mode, d.Get("mode").(string)))
 	d.Set("team_id", GetStringValue(modelResp.ModelInfo.TeamID, d.Get("team_id").(string)))