diff --git a/.circleci/config.yml b/.circleci/config.yml index 0966da461ec..cf69ff68da6 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -158,6 +158,8 @@ jobs: CHOCOLATEY_CONFIRM_ALL: "true" - run: name: Install Dependencies + environment: + UV_HTTP_TIMEOUT: "300" command: | $installer = Join-Path $env:TEMP "uv-install.ps1" Invoke-WebRequest -Uri https://astral.sh/uv/0.10.9/install.ps1 -OutFile $installer @@ -228,7 +230,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv \ - --cov=litellm \ + --cov=./litellm \ --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=20 \ @@ -293,7 +295,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv \ - --cov=litellm \ + --cov=./litellm \ --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=20 \ @@ -409,14 +411,25 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -v -x \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5 \ -n 2" no_output_timeout: 15m + - run: + name: Rename the coverage files + command: | + mv coverage.xml auth_ui_unit_tests_coverage.xml + mv .coverage auth_ui_unit_tests_coverage # Store test results - store_test_results: path: test-results + - persist_to_workspace: + root: . + paths: + - auth_ui_unit_tests_coverage.xml + - auth_ui_unit_tests_coverage litellm_router_testing: # Runs all tests with the "router" keyword docker: @@ -493,13 +506,24 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -v -x \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5 \ -n 4" no_output_timeout: 15m + - run: + name: Rename the coverage files + command: | + mv coverage.xml router_unit_tests_coverage.xml + mv .coverage router_unit_tests_coverage # Store test results - store_test_results: path: test-results + - persist_to_workspace: + root: . + paths: + - router_unit_tests_coverage.xml + - router_unit_tests_coverage litellm_assistants_api_testing: # Runs all tests with the "assistants" keyword docker: - *python312_image @@ -603,7 +627,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=20 \ -n 4 \ @@ -646,7 +670,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv -x -s \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5" no_output_timeout: 15m @@ -688,7 +712,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5 \ -n 2 \ @@ -732,7 +756,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv -x -s \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5 \ --retries 3 --retry-delay 5" @@ -814,7 +838,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv -x \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5 \ -n 4" @@ -856,7 +880,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv -x \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5 \ -n 4" @@ -930,7 +954,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv -x -s \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5 \ -n 2" @@ -972,7 +996,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv -x -s \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5 \ -n 2" @@ -1015,7 +1039,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv -x \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5 \ -n 4" @@ -1090,7 +1114,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ -n 4 \ --junitxml=test-results/junit.xml \ --durations=5 \ @@ -1133,7 +1157,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv -x -s \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5" no_output_timeout: 15m @@ -1184,7 +1208,7 @@ jobs: --verbose \ --command="awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \ -vv -x -s \ - --cov=litellm --cov-report=xml \ + --cov=./litellm --cov-report=xml \ --junitxml=test-results/junit.xml \ --durations=5 -n 2 \ --reruns 2 --reruns-delay 1" @@ -2280,10 +2304,11 @@ jobs: - run: name: Combine Coverage command: | - uv tool run --from 'coverage[toml]==7.10.6' coverage combine realtime_translation_coverage ocr_coverage search_coverage logging_coverage audio_coverage local_testing_part1_coverage local_testing_part2_coverage pass_through_unit_tests_coverage batches_coverage guardrails_coverage redis_caching_coverage + uv tool run --from 'coverage[toml]==7.10.6' coverage combine realtime_translation_coverage ocr_coverage search_coverage logging_coverage audio_coverage local_testing_part1_coverage local_testing_part2_coverage pass_through_unit_tests_coverage batches_coverage guardrails_coverage redis_caching_coverage agent_coverage google_generate_content_endpoint_coverage litellm_utils_coverage router_unit_tests_coverage auth_ui_unit_tests_coverage uv tool run --from 'coverage[toml]==7.10.6' coverage xml - codecov/upload: file: ./coverage.xml + flags: circleci ui_build: docker: @@ -2452,10 +2477,15 @@ jobs: DISABLE_SCHEMA_UPDATE: "true" SERVER_ROOT_PATH: "" PROXY_LOGOUT_URL: "" + # LITELLM_LICENSE is forwarded from the project env so premium-gated + # UI flows can be exercised. license.spec.ts asserts the resulting + # JWT carries premium_user=true; if it ever stops being passed, that + # test fails loudly rather than silently regressing premium coverage. command: | - uv run --no-sync python -m litellm.proxy.proxy_cli \ - --config ui/litellm-dashboard/e2e_tests/fixtures/config.yml \ - --port 4000 + LITELLM_LICENSE="$LITELLM_LICENSE" \ + uv run --no-sync python -m litellm.proxy.proxy_cli \ + --config ui/litellm-dashboard/e2e_tests/fixtures/config.yml \ + --port 4000 background: true - run: name: Wait for proxy to be ready @@ -2472,9 +2502,12 @@ jobs: exit 1 - run: name: Run Playwright E2E tests + # Forward LITELLM_LICENSE so license.spec.ts can detect that the + # proxy was launched with a license and assert premium_user=true. command: | cd ui/litellm-dashboard - npx playwright test --config e2e_tests/playwright.config.ts + LITELLM_LICENSE="$LITELLM_LICENSE" \ + npx playwright test --config e2e_tests/playwright.config.ts no_output_timeout: 10m - store_artifacts: path: ui/litellm-dashboard/test-results @@ -2508,7 +2541,6 @@ jobs: paths: - litellm-docker-database.tar.zst - test_bad_database_url: machine: image: ubuntu-2204:2024.04.1 @@ -2669,6 +2701,8 @@ workflows: - local_testing_part1 - local_testing_part2 - litellm_assistants_api_testing + - litellm_router_unit_testing + - auth_ui_unit_tests - db_migration_disable_update_check: requires: - build_docker_database_image diff --git a/.github/actions/helm-oci-chart-releaser/action.yml b/.github/actions/helm-oci-chart-releaser/action.yml deleted file mode 100644 index 454c591d436..00000000000 --- a/.github/actions/helm-oci-chart-releaser/action.yml +++ /dev/null @@ -1,94 +0,0 @@ -name: Helm OCI Chart Releaser -description: Push Helm charts to OCI-based (Docker) registries -author: sergeyshaykhullin -branding: - color: yellow - icon: upload-cloud -inputs: - name: - required: true - description: Chart name - repository: - required: true - description: Chart repository name - tag: - required: true - description: Chart version - app_version: - required: true - description: App version - path: - required: false - description: Chart path (Default 'charts/{name}') - registry: - required: true - description: OCI registry - registry_username: - required: true - description: OCI registry username - registry_password: - required: true - description: OCI registry password - update_dependencies: - required: false - default: 'false' - description: Update chart dependencies before packaging (Default 'false') -outputs: - image: - value: ${{ steps.output.outputs.image }} - description: Chart image (Default '{registry}/{repository}/{image}:{tag}') -runs: - using: composite - steps: - - name: Helm | Setup - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1 - with: - version: v3.20.0 - - - name: Helm | Login - shell: bash - env: - REGISTRY_PASSWORD: ${{ inputs.registry_password }} - REGISTRY_USERNAME: ${{ inputs.registry_username }} - REGISTRY: ${{ inputs.registry }} - run: echo "$REGISTRY_PASSWORD" | helm registry login -u "$REGISTRY_USERNAME" --password-stdin "$REGISTRY" - - - name: Helm | Dependency - if: inputs.update_dependencies == 'true' - shell: bash - env: - CHART_PATH: ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }} - run: helm dependency update "$CHART_PATH" - - - name: Helm | Package - shell: bash - env: - CHART_PATH: ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }} - TAG: ${{ inputs.tag }} - APP_VERSION: ${{ inputs.app_version }} - run: helm package "$CHART_PATH" --version "$TAG" --app-version "$APP_VERSION" - - - name: Helm | Push - shell: bash - env: - NAME: ${{ inputs.name }} - TAG: ${{ inputs.tag }} - REGISTRY: ${{ inputs.registry }} - REPOSITORY: ${{ inputs.repository }} - run: helm push "${NAME}-${TAG}.tgz" "oci://${REGISTRY}/${REPOSITORY}" - - - name: Helm | Logout - shell: bash - env: - REGISTRY: ${{ inputs.registry }} - run: helm registry logout "$REGISTRY" - - - name: Helm | Output - id: output - shell: bash - env: - REGISTRY: ${{ inputs.registry }} - REPOSITORY: ${{ inputs.repository }} - NAME: ${{ inputs.name }} - TAG: ${{ inputs.tag }} - run: echo "image=${REGISTRY}/${REPOSITORY}/${NAME}:${TAG}" >> $GITHUB_OUTPUT diff --git a/.github/workflows/README.md b/.github/workflows/README.md deleted file mode 100644 index b4e777969d9..00000000000 --- a/.github/workflows/README.md +++ /dev/null @@ -1,35 +0,0 @@ -# Simple PyPI Publishing - -A GitHub workflow to manually publish LiteLLM packages to PyPI with a specified version. - -## How to Use - -1. Go to the **Actions** tab in the GitHub repository -2. Select **Simple PyPI Publish** from the workflow list -3. Click **Run workflow** -4. Enter the version to publish (e.g., `1.74.10`) - -## What the Workflow Does - -1. **Updates** the version in `pyproject.toml` -2. **Copies** the model prices backup file -3. **Builds** the Python package -4. **Publishes** to PyPI - -## Prerequisites - -Make sure the following secret is configured in the repository: -- `PYPI_PUBLISH_PASSWORD`: PyPI API token for authentication - -## Example Usage - -- Version: `1.74.11` → Publishes as v1.74.11 -- Version: `1.74.10-hotfix1` → Publishes as v1.74.10-hotfix1 - -## Features - -- ✅ Manual trigger with version input -- ✅ Automatic version updates in `pyproject.toml` -- ✅ Repository safety check (only runs on official repo) -- ✅ Clean package building and publishing -- ✅ Success confirmation with PyPI package link \ No newline at end of file diff --git a/.github/workflows/_test-unit-base.yml b/.github/workflows/_test-unit-base.yml index 9377cbeb0ca..7e91341ac77 100644 --- a/.github/workflows/_test-unit-base.yml +++ b/.github/workflows/_test-unit-base.yml @@ -91,7 +91,7 @@ jobs: --reruns-delay 1 \ --dist=loadscope \ --durations=20 \ - --cov=litellm \ + --cov=./litellm \ --cov-report=xml:coverage.xml \ --cov-config=pyproject.toml @@ -132,4 +132,5 @@ jobs: use_oidc: true directory: coverage-reports root_dir: ${{ github.workspace }} + flags: ${{ inputs.artifact-name }} fail_ci_if_error: false diff --git a/.github/workflows/_test-unit-services-base.yml b/.github/workflows/_test-unit-services-base.yml index 8c47b6d7666..7f973d8cafa 100644 --- a/.github/workflows/_test-unit-services-base.yml +++ b/.github/workflows/_test-unit-services-base.yml @@ -132,7 +132,7 @@ jobs: --reruns "${RERUNS}" \ --reruns-delay 1 \ --durations=20 \ - --cov=litellm \ + --cov=./litellm \ --cov-report=xml:coverage.xml \ --cov-config=pyproject.toml else @@ -144,7 +144,7 @@ jobs: --reruns-delay 1 \ --dist="${DIST}" \ --durations=20 \ - --cov=litellm \ + --cov=./litellm \ --cov-report=xml:coverage.xml \ --cov-config=pyproject.toml fi @@ -186,4 +186,5 @@ jobs: use_oidc: true directory: coverage-reports root_dir: ${{ github.workspace }} + flags: ${{ inputs.artifact-name }} fail_ci_if_error: false diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e86fca17c7a..babe3b62933 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -53,3 +53,31 @@ jobs: uses: github/codeql-action/analyze@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3 with: category: "/language:${{ matrix.language }}" + output: sarif-results + upload: failure-only + + # py/weak-sensitive-data-hashing (CWE-328) fires on the OCI signing call at + # litellm/llms/oci/common_utils.py, which hashes the HTTP request body to + # produce the x-content-sha256 header required by the OCI HTTP signing spec — + # a content-integrity hash, not a password or secret hash. SHA-256 is mandated + # by Oracle for this header; see + # https://docs.oracle.com/en-us/iaas/Content/API/Concepts/signingrequests.htm + # The `usedforsecurity=False` flag on the hashlib.sha256 call already declares + # non-security intent, but CodeQL's taint flow still re-fires when callers + # further up the stack are modified. The suppression is scoped to this one + # file/rule pair via SARIF post-filtering so every other callsite of + # py/weak-sensitive-data-hashing in the repository continues to be analyzed. + - name: Filter SARIF (OCI sha256) + if: matrix.language == 'python' + uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1 + with: + patterns: | + -litellm/llms/oci/common_utils.py:py/weak-sensitive-data-hashing + input: sarif-results/python.sarif + output: sarif-results/python.sarif + + - name: Upload SARIF + uses: github/codeql-action/upload-sarif@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3 + with: + sarif_file: sarif-results + category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/llm-translation-testing.yml b/.github/workflows/llm-translation-testing.yml deleted file mode 100644 index 8d9d52f4e58..00000000000 --- a/.github/workflows/llm-translation-testing.yml +++ /dev/null @@ -1,92 +0,0 @@ -name: LLM Translation Tests - -on: - workflow_dispatch: - inputs: - release_candidate_tag: - description: "Release candidate tag/version" - required: true - type: string - push: - tags: - - "v*-rc*" # Triggers on release candidate tags like v1.0.0-rc1 - -permissions: - contents: read - -jobs: - run-llm-translation-tests: - runs-on: ubuntu-latest - timeout-minutes: 90 - - steps: - - name: Checkout code - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - with: - persist-credentials: false - ref: ${{ github.event.inputs.release_candidate_tag || github.ref }} - - - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 - with: - python-version: "3.12" - - - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 - with: - version: "0.10.9" - enable-cache: false - - - name: Restore uv dependencies cache - uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 - with: - path: | - ~/.cache/uv - .venv - key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }} - restore-keys: | - ${{ runner.os }}-uv- - - - name: Install dependencies - run: | - uv sync --frozen - - - name: Create test results directory - run: mkdir -p test-results - - - name: Run LLM Translation Tests - env: - OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} - ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} - COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }} - GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} - AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }} - AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }} - AZURE_API_VERSION: ${{ secrets.AZURE_API_VERSION }} - RC_TAG: ${{ github.event.inputs.release_candidate_tag || github.ref_name }} - COMMIT_SHA: ${{ github.sha }} - run: | - python .github/workflows/run_llm_translation_tests.py \ - --tag "$RC_TAG" \ - --commit "$COMMIT_SHA" \ - || true # Continue even if tests fail - - - name: Display test summary - if: always() - run: | - if [ -f "test-results/llm_translation_report.md" ]; then - echo "Test report generated successfully!" - echo "Artifact will contain:" - echo "- test-results/junit.xml (JUnit XML results)" - echo "- test-results/llm_translation_report.md (Beautiful markdown report)" - else - echo "Warning: Test report was not generated" - fi - - - name: Upload test artifacts - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - if: always() - with: - name: LLM-Translation-Artifact-${{ github.event.inputs.release_candidate_tag || github.ref_name }} - path: test-results/ - retention-days: 30 diff --git a/.github/workflows/mutation-test.yml b/.github/workflows/mutation-test.yml new file mode 100644 index 00000000000..8094ca57467 --- /dev/null +++ b/.github/workflows/mutation-test.yml @@ -0,0 +1,131 @@ +name: "Mutation Test (manual)" + +# Manually-triggered mutation testing. Runs mutmut against the scope +# configured in [tool.mutmut] in pyproject.toml (currently the +# litellm/proxy/management_endpoints/ folder). Intended cadence is roughly +# weekly — clicked from the Actions tab when someone wants a fresh report. +# +# Uploads a structured `mutation-report.md` (Meta ACH-style: original + +# mutated function with `# MUTANT START`/`# MUTANT END` delimiters + the +# existing tests + a task instruction) as a workflow artifact. Failures +# do not block anything because nothing depends on this workflow. + +on: + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: mutation-test-${{ github.ref }} + cancel-in-progress: true + +jobs: + mutation: + name: Run mutmut + runs-on: ubuntu-latest + # Whole-folder mutation against ~15 files / ~7.5k LOC can take hours. + # 350 minutes is just under the GitHub-hosted job cap of 360 minutes. + timeout-minutes: 350 + + steps: + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + with: + persist-credentials: false + + - name: Set up Python + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + with: + python-version: "3.12" + + - name: Set up uv + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + with: + version: "0.10.9" + + - name: Cache uv dependencies + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + with: + path: | + ~/.cache/uv + .venv + key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }} + restore-keys: | + ${{ runner.os }}-uv- + + - name: Install dependencies + run: | + uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router + + - name: Generate Prisma client + env: + PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache + run: | + uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma + + # mutmut 3.x runs tests inside a `mutants/` sandbox where it injects + # mutation trampolines. uv installs the project as editable by default, + # which puts the original source dir on sys.path via a .pth file and + # shadows the sandbox copy — so tests would never exercise the mutated + # code. Reinstalling non-editable removes the .pth shadow. + - name: Reinstall litellm non-editable (so mutants/ is not shadowed) + run: | + uv pip uninstall litellm + uv pip install . --no-deps + + # pytest-retry's pytest_configure hook crashes with + # `INTERNALERROR: no option named 'filtered_exceptions'` when invoked + # via mutmut's in-process pytest.main() call. The entry-point name + # doesn't normalize cleanly with `-p no:`, so just remove the + # package outright. Reruns are wrong for mutation testing anyway — + # rerunning a "failed" mutant test would mask which mutants are killed. + - name: Remove pytest plugins that conflict with mutmut + run: | + uv pip uninstall pytest-retry || true + + - name: Run mutmut + env: + # Make the mutants/ sandbox win over site-packages on sys.path so the + # trampolined files are imported instead of the installed copy. + PYTHONPATH: ${{ github.workspace }}/mutants + run: | + set -o pipefail + mkdir -p mutants + uv run --no-sync --with mutmut==3.5.0 mutmut run 2>&1 | tee mutmut-run.log + + # Generate the structured report. The script embeds the enclosing + # function source for each survivor (via Python AST) and includes the + # existing test files, so an LLM agent has enough context to write + # killing tests without further file lookups. Modeled on Meta's ACH + # prompt template (arXiv 2501.12862). + - name: Generate detailed mutation report + if: always() + run: | + set +e + uv run --no-sync --with mutmut==3.5.0 mutmut export-cicd-stats > /dev/null 2>&1 + uv run --no-sync --with mutmut==3.5.0 mutmut results > mutmut-results.txt 2>&1 + uv run --no-sync python scripts/mutation_report.py + # The full report can be very long for big test files; the run-page + # summary cuts off at 1 MB. Append the head of the report (summary + # + survivor list) and link out to the artifact for the full body. + { + head -c 900000 mutation-report.md + echo "" + echo "" + echo "_Full report (with embedded function bodies and test files) is in the workflow artifact._" + } >> "$GITHUB_STEP_SUMMARY" + + - name: Upload mutmut artifacts + if: always() + uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 + with: + name: mutmut-${{ github.run_id }}-${{ github.run_attempt }} + path: | + mutation-report.md + mutmut-results.txt + mutmut-run.log + mutants/mutmut-stats.json + mutants/mutmut-cicd-stats.json + mutants/litellm/proxy/management_endpoints/**/*.py + if-no-files-found: warn + retention-days: 14 diff --git a/.github/workflows/publish_to_pypi.yml b/.github/workflows/publish_to_pypi.yml deleted file mode 100644 index d60254a0ac5..00000000000 --- a/.github/workflows/publish_to_pypi.yml +++ /dev/null @@ -1,153 +0,0 @@ -name: Publish to PyPI - -on: - workflow_dispatch: - -jobs: - preflight-checks: - name: Preflight Checks - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: read - # No environment — read-only checks, no approval needed - outputs: - needs_publish: ${{ steps.check-litellm.outputs.needs_publish }} - version: ${{ steps.check-litellm.outputs.version }} - - steps: - - name: Checkout repo - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - - - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 - with: - python-version: "3.12" - - - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 - with: - version: "0.10.9" - enable-cache: false - - - name: Check litellm version on PyPI - id: check-litellm - run: | - VERSION=$(python - <<'PY' - import tomllib - - with open("pyproject.toml", "rb") as f: - print(tomllib.load(f)["project"]["version"]) - PY - ) - echo "version=$VERSION" >> "$GITHUB_OUTPUT" - echo "Checking if litellm $VERSION exists on PyPI..." - - HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm/$VERSION/json") - if [ "$HTTP_STATUS" = "200" ]; then - echo "litellm $VERSION already exists on PyPI. Skipping publish." - echo "needs_publish=false" >> "$GITHUB_OUTPUT" - else - echo "litellm $VERSION not found on PyPI. Publish needed." - echo "needs_publish=true" >> "$GITHUB_OUTPUT" - fi - - - name: Sanity check proxy-extras version - run: | - # Read pinned version from project optional dependencies - PYPROJECT_VERSION=$(python3 - <<'PY' - import sys - import tomllib - - with open("pyproject.toml", "rb") as f: - proxy_requirements = tomllib.load(f)["project"]["optional-dependencies"]["proxy"] - - version = None - for requirement in proxy_requirements: - normalized = requirement.split(";", 1)[0].strip() - if not normalized.startswith("litellm-proxy-extras"): - continue - parts = normalized.split("==", 1) - if len(parts) == 2 and parts[0].strip() == "litellm-proxy-extras": - candidate = parts[1].strip() - if candidate: - version = candidate - break - - if version is None: - print( - "::error::Could not find an exact litellm-proxy-extras pin in project.optional-dependencies.proxy", - file=sys.stderr, - ) - sys.exit(1) - - print(version) - PY - ) - echo "pyproject.toml pins litellm-proxy-extras version: $PYPROJECT_VERSION" - - # Check that the pinned version exists on PyPI - echo "Checking if litellm-proxy-extras $PYPROJECT_VERSION exists on PyPI..." - HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm-proxy-extras/$PYPROJECT_VERSION/json") - if [ "$HTTP_STATUS" != "200" ]; then - echo "::error::litellm-proxy-extras $PYPROJECT_VERSION is not published on PyPI yet. Publish it before releasing litellm." - exit 1 - fi - echo "litellm-proxy-extras $PYPROJECT_VERSION exists on PyPI. Sanity check passed." - - publish-litellm: - name: Publish litellm to PyPI - needs: preflight-checks - if: needs.preflight-checks.outputs.needs_publish == 'true' - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - id-token: write - contents: read - environment: pypi-publish - - steps: - - name: Checkout repo - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - - - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 - with: - python-version: "3.12" - - - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 - with: - version: "0.10.9" - enable-cache: false - - - name: Copy model prices backup - run: cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json - - - name: Build package - run: | - rm -rf build dist - uv build - - - name: Verify build artifacts - env: - EXPECTED_VERSION: ${{ needs.preflight-checks.outputs.version }} - run: | - echo "Contents of dist/:" - ls -la dist/ - # Ensure we have both sdist and wheel - ls dist/*.tar.gz - ls dist/*.whl - # Verify built version matches expected - ls dist/ | grep -q "litellm-${EXPECTED_VERSION}" || { - echo "::error::Built artifacts do not match expected version $EXPECTED_VERSION" - ls dist/ - exit 1 - } - - - name: Validate package metadata - run: | - uv tool run --from 'twine==6.2.0' twine check dist/* - - - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 diff --git a/.github/workflows/read_pyproject_version.yml b/.github/workflows/read_pyproject_version.yml deleted file mode 100644 index 04b4a38ce19..00000000000 --- a/.github/workflows/read_pyproject_version.yml +++ /dev/null @@ -1,28 +0,0 @@ -name: Read Version from pyproject.toml - -on: - push: - branches: - - main # Change this to the default branch of your repository - -permissions: - contents: read - -jobs: - read-version: - runs-on: ubuntu-latest - - steps: - - name: Checkout code - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - with: - persist-credentials: false - - - name: Read version from pyproject.toml - id: read-version - run: | - version=$(grep -m1 '^version' pyproject.toml | sed 's/version = "\(.*\)"/\1/') - printf "LITELLM_VERSION=%s" "$version" >> $GITHUB_ENV - - - name: Display version - run: echo "Current version is $LITELLM_VERSION" diff --git a/.github/workflows/results_stats.csv b/.github/workflows/results_stats.csv deleted file mode 100644 index bcef047b0fb..00000000000 --- a/.github/workflows/results_stats.csv +++ /dev/null @@ -1,27 +0,0 @@ -Date,"Ben -Ashley",Tom Brooks,Jimmy Cooney,"Sue -Daniels",Berlinda Fong,Terry Jones,Angelina Little,Linda Smith -10/1,FALSE,TRUE,TRUE,TRUE,TRUE,TRUE,FALSE,TRUE -10/2,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/3,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/4,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/5,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/6,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/7,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/8,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/9,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/10,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/11,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/12,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/13,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/14,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/15,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/16,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/17,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/18,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/19,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/20,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/21,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/22,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -10/23,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE -Total,0,1,1,1,1,1,0,1 \ No newline at end of file diff --git a/.github/workflows/run_observatory_tests.yml b/.github/workflows/run_observatory_tests.yml deleted file mode 100644 index a25b96766d7..00000000000 --- a/.github/workflows/run_observatory_tests.yml +++ /dev/null @@ -1,229 +0,0 @@ -name: Run Observatory Tests -on: - workflow_dispatch: - inputs: - tag: - description: "Docker image tag to test (e.g. v1.61.0.rc1)" - required: true - type: string - commit_hash: - description: "Commit hash (defaults to HEAD of current branch)" - required: false - type: string - workflow_call: - inputs: - tag: - description: "Docker image tag to test" - required: true - type: string - commit_hash: - description: "Commit hash of the release" - required: true - type: string - -permissions: - contents: read - -env: - LITELLM_MASTER_KEY: ${{ secrets.LITELLM_MASTER_KEY_STAGING }} - -jobs: - observatory-tests: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout repository - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - with: - persist-credentials: false - - - name: Validate tag input - env: - TAG: ${{ inputs.tag }} - run: | - if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+ ]]; then - echo "Invalid tag format: $TAG (expected vX.Y.Z...)" - exit 1 - fi - - - name: Start LiteLLM container - env: - TAG: ${{ inputs.tag }} - AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }} - AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }} - WORKSPACE: ${{ github.workspace }} - run: | - docker run -d \ - --name litellm-rc \ - -p 4000:4000 \ - -v "${WORKSPACE}/.github/observatory/litellm_config.yaml:/app/config.yaml" \ - -e LITELLM_MASTER_KEY="${LITELLM_MASTER_KEY}" \ - -e AZURE_API_KEY="${AZURE_API_KEY}" \ - -e AZURE_API_BASE="${AZURE_API_BASE}" \ - "litellm/litellm:${TAG}" \ - --config /app/config.yaml --port 4000 - - - name: Wait for LiteLLM health check - run: | - echo "Waiting for LiteLLM to be ready..." - for i in $(seq 1 30); do - if curl -s -f http://localhost:4000/health/liveliness > /dev/null 2>&1; then - echo "LiteLLM is healthy" - exit 0 - fi - echo "Attempt $i/30 - not ready yet, waiting 10s..." - sleep 10 - done - echo "LiteLLM failed to start within 5 minutes" - docker logs litellm-rc - exit 1 - - - name: Start cloudflared tunnel - run: | - # Install cloudflared (pinned version + checksum) - curl -sL https://github.com/cloudflare/cloudflared/releases/download/2025.2.1/cloudflared-linux-amd64 -o /usr/local/bin/cloudflared - echo "afdfadd1ef552e66bffc35246fe30a9bd578356d2d386de95585ccfc432472b8 /usr/local/bin/cloudflared" | sha256sum -c - - chmod +x /usr/local/bin/cloudflared - - # Start a quick tunnel (no account needed) and capture the URL - cloudflared tunnel --url http://localhost:4000 --no-autoupdate > /tmp/cloudflared.log 2>&1 & - CLOUDFLARED_PID=$! - echo "CLOUDFLARED_PID=$CLOUDFLARED_PID" >> $GITHUB_ENV - - # Wait for tunnel URL to appear in logs - echo "Waiting for tunnel URL..." - for i in $(seq 1 30); do - TUNNEL_URL=$(grep -oP 'https://[a-z0-9-]+\.trycloudflare\.com' /tmp/cloudflared.log | head -1 || true) - if [ -n "$TUNNEL_URL" ]; then - echo "Tunnel URL: $TUNNEL_URL" - echo "TUNNEL_URL=$TUNNEL_URL" >> $GITHUB_ENV - exit 0 - fi - sleep 2 - done - echo "Failed to get tunnel URL" - cat /tmp/cloudflared.log - exit 1 - - - name: Verify tunnel connectivity - run: | - echo "Testing tunnel at ${TUNNEL_URL}..." - # Quick tunnels need time for DNS propagation; retry to avoid - # transient NXDOMAIN (curl exit code 6) on first attempt. - for i in $(seq 1 10); do - if curl -sf "${TUNNEL_URL}/health/liveliness" > /dev/null 2>&1; then - echo "Tunnel is working (attempt $i)" - exit 0 - fi - echo "Attempt $i/10 - tunnel not routable yet, waiting 5s..." - sleep 5 - done - echo "Tunnel failed to become reachable after 50s" - cat /tmp/cloudflared.log - exit 1 - - - name: Trigger observatory test run - id: trigger - env: - OBSERVATORY_URL: ${{ secrets.OBSERVATORY_URL }} - OBSERVATORY_API_KEY: ${{ secrets.OBSERVATORY_API_KEY }} - run: | - PAYLOAD=$(jq -n \ - --arg url "${TUNNEL_URL}" \ - --arg key "${LITELLM_MASTER_KEY}" \ - '{ - deployment_url: $url, - api_key: $key, - test_suite: "TestOAIAzureRelease", - models: ["gpt-4o-mini", "gpt-4o"] - }') - RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${OBSERVATORY_URL}/run-test" \ - -H "Content-Type: application/json" \ - -H "X-LiteLLM-Observatory-API-Key: ${OBSERVATORY_API_KEY}" \ - -d "$PAYLOAD") - HTTP_CODE=$(echo "$RESPONSE" | tail -1) - BODY=$(echo "$RESPONSE" | head -n -1) - echo "Response ($HTTP_CODE): $BODY" - if [ "$HTTP_CODE" -ge 400 ]; then - echo "Failed to trigger test run" - exit 1 - fi - - # Extract request_id for polling this specific run - REQUEST_ID=$(echo "$BODY" | jq -r '.results.request_id') - if [ -z "$REQUEST_ID" ] || [ "$REQUEST_ID" = "null" ]; then - echo "Failed to extract request_id from response" - exit 1 - fi - echo "Request ID: $REQUEST_ID" - echo "request_id=$REQUEST_ID" >> $GITHUB_OUTPUT - - - name: Poll for test completion - id: poll - env: - OBSERVATORY_URL: ${{ secrets.OBSERVATORY_URL }} - OBSERVATORY_API_KEY: ${{ secrets.OBSERVATORY_API_KEY }} - REQUEST_ID: ${{ steps.trigger.outputs.request_id }} - run: | - TIMEOUT=900 # 15 minutes - INTERVAL=30 - ELAPSED=0 - while [ $ELAPSED -lt $TIMEOUT ]; do - STATUS=$(curl -s "${OBSERVATORY_URL}/run-status/${REQUEST_ID}" \ - -H "X-LiteLLM-Observatory-API-Key: ${OBSERVATORY_API_KEY}") - RUN_STATUS=$(echo "$STATUS" | jq -r '.status') - echo "Run status (${ELAPSED}s elapsed): $RUN_STATUS" - - if [ "$RUN_STATUS" = "completed" ] || [ "$RUN_STATUS" = "failed" ]; then - echo "Test finished with status: $RUN_STATUS" - echo "$STATUS" > /tmp/observatory_result.json - exit 0 - fi - - sleep $INTERVAL - ELAPSED=$((ELAPSED + INTERVAL)) - done - echo "Timed out waiting for test to complete after ${TIMEOUT}s" - exit 1 - - - name: Verify test results - run: | - RESULT=$(cat /tmp/observatory_result.json) - echo "Full result: $RESULT" - - STATUS=$(echo "$RESULT" | jq -r '.status') - TEST_PASSED=$(echo "$RESULT" | jq -r '.result.test_passed // false') - FAILURE_RATE=$(echo "$RESULT" | jq -r '.result.failure_rate // "N/A"') - ERROR=$(echo "$RESULT" | jq -r '.error // empty') - - echo "Status: $STATUS" - echo "Test passed: $TEST_PASSED" - echo "Failure rate: $FAILURE_RATE" - - if [ -n "$ERROR" ]; then - echo "Error: $ERROR" - fi - - if [ "$STATUS" = "failed" ]; then - echo "Test run failed" - exit 1 - fi - - if [ "$TEST_PASSED" != "true" ]; then - echo "Tests did not pass (failure rate: $FAILURE_RATE)" - exit 1 - fi - - echo "All tests passed!" - - - name: Print LiteLLM logs on failure - if: failure() - run: | - docker logs litellm-rc 2>/dev/null || true - cat /tmp/cloudflared.log 2>/dev/null || true - - - name: Cleanup - if: always() - run: | - kill "$CLOUDFLARED_PID" 2>/dev/null || true - docker rm -f litellm-rc 2>/dev/null || true diff --git a/.github/workflows/scan_duplicate_issues.yml b/.github/workflows/scan_duplicate_issues.yml deleted file mode 100644 index ab0ac2aa3ac..00000000000 --- a/.github/workflows/scan_duplicate_issues.yml +++ /dev/null @@ -1,48 +0,0 @@ -name: Scan Duplicate Issues (One-Time) - -on: - workflow_dispatch: - inputs: - threshold: - description: "Similarity threshold (0-1)" - required: false - default: "0.85" - close: - description: "Actually close duplicates (false = dry run)" - required: false - type: boolean - default: false - -jobs: - scan: - runs-on: ubuntu-latest - permissions: - issues: write - contents: read - steps: - - name: Checkout scripts - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - with: - sparse-checkout: .github/scripts - persist-credentials: false - - - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 - with: - python-version: "3.12" - - - name: Scan for duplicate issues - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - INPUT_THRESHOLD: ${{ inputs.threshold }} - INPUT_CLOSE: ${{ inputs.close }} - run: | - CLOSE_FLAG="" - if [ "$INPUT_CLOSE" = "true" ]; then - CLOSE_FLAG="--close" - fi - python3 .github/scripts/close_duplicate_issues.py \ - --scan \ - --repo ${{ github.repository }} \ - --threshold "$INPUT_THRESHOLD" \ - $CLOSE_FLAG diff --git a/.github/workflows/test-litellm.yml b/.github/workflows/test-litellm.yml deleted file mode 100644 index 938647f5d0c..00000000000 --- a/.github/workflows/test-litellm.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: LiteLLM Mock Tests (folder - tests/test_litellm) - -# DEPRECATED: This workflow is replaced by test-litellm-matrix.yml which runs -# the same tests in parallel across 10 jobs for faster CI times. -# Kept for manual debugging only. -on: - workflow_dispatch: # Manual trigger only - # pull_request: - # branches: [ main ] - -permissions: - contents: read - -jobs: - test: - runs-on: ubuntu-latest - timeout-minutes: 25 - - steps: - - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - with: - persist-credentials: false - - - name: Thank You Message - run: | - echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY - echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY - - - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 - with: - python-version: "3.12" - - - name: Set up uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 - with: - version: "0.10.9" - - - name: Install dependencies - run: | - uv lock --check - uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router - - name: Run tests - run: | - uv run --no-sync pytest tests/test_litellm --tb=short -vv --maxfail=10 -n 4 --durations=50 diff --git a/.github/workflows/test-mcp.yml b/.github/workflows/test-mcp.yml index 313043e12fe..2ae60951afc 100644 --- a/.github/workflows/test-mcp.yml +++ b/.github/workflows/test-mcp.yml @@ -43,4 +43,4 @@ jobs: - name: Run MCP tests run: | - uv run --no-sync pytest tests/mcp_tests -x -vv -n 4 --cov=litellm --cov-report=xml --durations=5 + uv run --no-sync pytest tests/mcp_tests -x -vv -n 4 --cov=./litellm --cov-report=xml --durations=5 diff --git a/.github/workflows/test-unit-caching-redis.yml b/.github/workflows/test-unit-caching-redis.yml deleted file mode 100644 index ca274324f2f..00000000000 --- a/.github/workflows/test-unit-caching-redis.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: "Unit Tests: Caching (Redis)" - -# Uses cloud Redis credentials — only runs on trusted branches, not PRs. -# This prevents external PRs from accessing Redis credentials. -on: - push: - branches: [main, "litellm_*"] - -permissions: - contents: read - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - caching-redis: - uses: ./.github/workflows/_test-unit-services-base.yml - with: - # Redis-only tests that do NOT require provider API keys. - # Tests needing API keys (test_caching.py, test_caching_ssl.py, test_prometheus_service.py, - # test_router_caching.py) are in Phase 3 integration workflows. - test-path: >- - tests/local_testing/test_dual_cache.py - tests/local_testing/test_redis_batch_optimizations.py - tests/local_testing/test_router_utils.py - workers: 2 - reruns: 2 - timeout-minutes: 20 - enable-redis: true - enable-postgres: false - secrets: - REDIS_HOST: ${{ secrets.REDIS_HOST }} - REDIS_PORT: ${{ secrets.REDIS_PORT }} - REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }} - DATABASE_URL: ${{ secrets.DATABASE_URL }} - POSTGRES_USER: ${{ secrets.POSTGRES_USER }} - POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }} diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows/test-unit-proxy-db.yml index 5a9688db9c4..2d4e85630dc 100644 --- a/.github/workflows/test-unit-proxy-db.yml +++ b/.github/workflows/test-unit-proxy-db.yml @@ -100,6 +100,7 @@ jobs: test-path: >- tests/proxy_unit_tests/test_auth_checks.py tests/proxy_unit_tests/test_user_api_key_auth.py + tests/proxy_unit_tests/test_deprecated_key_grace_period.py workers: 4 dist: loadscope timeout: 15 @@ -142,6 +143,7 @@ jobs: tests/proxy_unit_tests/test_proxy_pass_user_config.py tests/proxy_unit_tests/test_proxy_token_counter.py tests/proxy_unit_tests/test_request_size_limit_middleware.py + tests/proxy_unit_tests/test_multipart_bypass_repro.py workers: 4 dist: loadscope timeout: 15 @@ -213,8 +215,10 @@ jobs: tests/proxy_unit_tests/test_models_fallback_endpoint.py tests/proxy_unit_tests/test_google_endpoint_routing.py tests/proxy_unit_tests/test_google_gemini_proxy_request.py + tests/proxy_unit_tests/test_gemini_agents_endpoints.py tests/proxy_unit_tests/test_get_favicon.py tests/proxy_unit_tests/test_get_image.py + tests/proxy_unit_tests/test_reducto_ocr_route.py tests/proxy_unit_tests/test_ui_path_detection.py tests/proxy_unit_tests/test_prompt_test_endpoint.py tests/proxy_unit_tests/test_check_batch_cost.py diff --git a/.github/workflows/test-unit-proxy-mgmt-behavior.yml b/.github/workflows/test-unit-proxy-mgmt-behavior.yml new file mode 100644 index 00000000000..e73997323a4 --- /dev/null +++ b/.github/workflows/test-unit-proxy-mgmt-behavior.yml @@ -0,0 +1,34 @@ +name: "Unit Tests: Proxy Management-Endpoint Behavior Pinning" + +on: + pull_request: + branches: + - main + - litellm_internal_staging + - litellm_oss_branch + - "litellm_**" + +permissions: + contents: read + id-token: write + pull-requests: write + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + proxy-mgmt-behavior: + uses: ./.github/workflows/_test-unit-services-base.yml + with: + test-path: tests/proxy_behavior + # workers=0 (no xdist): the world seed is a single shared Postgres + # state — two xdist workers both call seed_world() and race on the + # ``behavior-pin-budget`` row, producing UniqueViolation + cascading + # missing-membership FK failures. The whole suite is ~7s sequentially, + # so the cost of disabling parallelism here is negligible. + workers: 0 + reruns: 0 + enable-postgres: true + artifact-name: proxy-mgmt-behavior + timeout-minutes: 15 diff --git a/.github/workflows/update_release.py b/.github/workflows/update_release.py deleted file mode 100644 index f70509e8e75..00000000000 --- a/.github/workflows/update_release.py +++ /dev/null @@ -1,54 +0,0 @@ -import os -import requests -from datetime import datetime - -# GitHub API endpoints -GITHUB_API_URL = "https://api.github.com" -REPO_OWNER = "BerriAI" -REPO_NAME = "litellm" - -# GitHub personal access token (required for uploading release assets) -GITHUB_ACCESS_TOKEN = os.environ.get("GITHUB_ACCESS_TOKEN") - -# Headers for GitHub API requests -headers = { - "Accept": "application/vnd.github+json", - "Authorization": f"Bearer {GITHUB_ACCESS_TOKEN}", - "X-GitHub-Api-Version": "2022-11-28", -} - -# Get the latest release -releases_url = f"{GITHUB_API_URL}/repos/{REPO_OWNER}/{REPO_NAME}/releases/latest" -response = requests.get(releases_url, headers=headers) -latest_release = response.json() -print("Latest release:", latest_release) - -# Upload an asset to the latest release -upload_url = latest_release["upload_url"].split("{?")[0] -asset_name = "results_stats.csv" -asset_path = os.path.join(os.getcwd(), asset_name) -print("upload_url:", upload_url) - -with open(asset_path, "rb") as asset_file: - asset_data = asset_file.read() - -upload_payload = { - "name": asset_name, - "label": "Load test results", - "created_at": datetime.utcnow().isoformat() + "Z", -} - -upload_headers = headers.copy() -upload_headers["Content-Type"] = "application/octet-stream" - -upload_response = requests.post( - upload_url, - headers=upload_headers, - data=asset_data, - params=upload_payload, -) - -if upload_response.status_code == 201: - print(f"Asset '{asset_name}' uploaded successfully to the latest release.") -else: - print(f"Failed to upload asset. Response: {upload_response.text}") diff --git a/.gitignore b/.gitignore index 20355a8e4ef..dff64e3c9e9 100644 --- a/.gitignore +++ b/.gitignore @@ -101,4 +101,23 @@ STABILIZATION_TODO.md **/*.storageState.json **/coverage test-config + +# ---------- Terraform ---------- +# Provider binaries + module cache — regenerated by `terraform init`. +**/.terraform/ +# State files often contain secrets (DB passwords, API keys snapshotted from +# data sources). Keep state in a remote backend, never in git. +*.tfstate +*.tfstate.* +*.tfstate.backup +# Plan files can also contain sensitive values (variables in plaintext). +*.tfplan +# User-specific variable inputs — example files (terraform.tfvars.example) are +# tracked because they end in .example, which doesn't match the glob below. +*.tfvars +*.auto.tfvars +crash.log +crash.*.log +# .terraform.lock.hcl is intentionally NOT ignored — it pins provider versions +# and should be committed. .vscode \ No newline at end of file diff --git a/AGENTS.md b/AGENTS.md index 4bdbf26ae9d..e99bf79d783 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -241,10 +241,27 @@ When opening issues or pull requests, follow these templates: ### Running the proxy server -Start the proxy with a config file: +Create a minimal config file and start the proxy: + +```yaml +# config.yaml +model_list: + - model_name: fake-openai-endpoint + litellm_params: + model: openai/fake-model + api_key: fake-key + api_base: https://fake-api.example.com + +general_settings: + master_key: sk-1234 + +litellm_settings: + drop_params: True + telemetry: False +``` ```bash -uv run litellm --config dev_config.yaml --port 4000 +uv run litellm --config config.yaml --port 4000 ``` The proxy takes ~15-20 seconds to fully start (it runs Prisma migrations on boot). Wait for `/health` to return before sending requests. Without a PostgreSQL `DATABASE_URL`, the proxy connects to a default Neon dev database embedded in the `litellm-proxy-extras` package. diff --git a/CLAUDE.md b/CLAUDE.md index 71e5af28ee7..baf23c90148 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -117,6 +117,7 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components: - **Always use `antd` for new UI components** — we are migrating off of `@tremor/react`. Do not introduce new `Badge`, `Text`, `Card`, `Grid`, `Title`, or other imports from `@tremor/react` in any new or modified file. Use `antd` equivalents: `Tag` for labels, `Typography.Text` / `Typography.Title` / `Typography.Paragraph` for textual content (avoid plain text-only ``, `

`, `` when Typography fits), and `Card` from `antd`. Note that `antd` has no `"yellow"` Tag color — use `"gold"` for amber/yellow. ### MCP OAuth / OpenAPI Transport Mapping +- **`available_on_public_internet: false` with `delegate_auth_to_upstream: true` (oauth2, interactive — not `client_credentials`)** — LiteLLM still allows the anonymous upstream PKCE path (no proxy API key for `/authorize` and matching MCP routes). The internal-only flag mainly affects other surfaces (e.g. IP-based discovery). Rely on the upstream IdP and network policy; the dashboard shows a warning when both are set, and the proxy logs a warning when the server is loaded from config or the database. - `TRANSPORT.OPENAPI` is a UI-only concept. The backend only accepts `"http"`, `"sse"`, or `"stdio"`. Always map it to `"http"` before any API call (including pre-OAuth temp-session calls). - FastAPI validation errors return `detail` as an array of `{loc, msg, type}` objects. Error extractors must handle: array (map `.msg`), string, nested `{error: string}`, and fallback. - When an MCP server already has `authorization_url` stored, skip OAuth discovery (`_discovery_metadata`) — the server URL for OpenAPI MCPs is the spec file, not the API base, and fetching it causes timeouts. @@ -146,7 +147,7 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components: - **Bound large result sets.** Prisma materializes full results in memory. For results over ~10 MB, paginate with `take`/`skip` or `cursor`/`take`, always with an explicit `order`. Prefer cursor-based pagination (`skip` is O(n)). Don't paginate naturally small result sets. - **Limit fetched columns on wide tables.** Use `select` to fetch only needed fields — returns a partial object, so downstream code must not access unselected fields. - **Check index coverage.** For new or modified queries, check `schema.prisma` for a supporting index. Prefer extending an existing index (e.g. `@@index([a])` → `@@index([a, b])`) over adding a new one, unless it's a `@@unique`. Only add indexes for large/frequent queries. -- **Keep schema files in sync.** Apply schema changes to all `schema.prisma` copies (`schema.prisma`, `litellm/proxy/`, `litellm-proxy-extras/`, `litellm-js/spend-logs/` for SpendLogs) with a migration under `litellm-proxy-extras/litellm_proxy_extras/migrations/`. +- **Keep schema files in sync.** Apply schema changes to all `schema.prisma` copies (`schema.prisma`, `litellm/proxy/`, `litellm-proxy-extras/`) with a migration under `litellm-proxy-extras/litellm_proxy_extras/migrations/`. ### Setup Wizard (`litellm/setup_wizard.py`) - The wizard is implemented as a single `SetupWizard` class with `@staticmethod` methods — keep it that way. No module-level functions except `run_setup_wizard()` (the public entrypoint) and pure helpers (color, ANSI). diff --git a/Dockerfile b/Dockerfile index 915daff999c..9ad9ab31b65 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,8 +1,8 @@ # Base image for building -ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:3258be472764337fd13095bcbb3182da170243b5819fd67ad4c0754590588b31 +ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:31da6565f35af6401031c1d7aa91dc84ac76c5c48edd17fb90f0ed9e3173c7a9 # Runtime image -ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:3258be472764337fd13095bcbb3182da170243b5819fd67ad4c0754590588b31 +ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:31da6565f35af6401031c1d7aa91dc84ac76c5c48edd17fb90f0ed9e3173c7a9 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a FROM $UV_IMAGE AS uvbin @@ -68,8 +68,8 @@ FROM $LITELLM_RUNTIME_IMAGE AS runtime USER root -RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervisor && \ - npm install -g npm@11.12.1 tar@7.5.11 glob@13.0.6 @isaacs/brace-expansion@5.0.1 brace-expansion@5.0.5 minimatch@10.2.4 diff@8.0.3 picomatch@4.0.4 && \ +RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile && \ + npm install -g npm@11.14.0 tar@7.5.11 glob@13.0.6 @isaacs/brace-expansion@5.0.1 brace-expansion@5.0.5 minimatch@10.2.4 diff@8.0.3 picomatch@4.0.4 && \ GLOBAL="$(npm root -g)" && \ for pkg in tar glob @isaacs/brace-expansion brace-expansion minimatch diff picomatch; do \ name="${pkg##*/}"; \ @@ -85,17 +85,17 @@ ENV PATH="/app/.venv/bin:${PATH}" COPY --from=builder /app /app # Prisma binaries live in $HOME/.cache (default prisma-python location), -# which is /root/.cache here. Copy them from the builder so they survive -# deployments that volume-mount /app/.cache (e.g. readOnlyRootFilesystem -# + emptyDir) — otherwise the mount would shadow the baked-in query engine. -COPY --from=builder /root/.cache /root/.cache +# which is /root/.cache here. Copy only the Prisma subdirs — copying the +# whole /root/.cache drags in the uv build cache (~660 MB, includes a +# setuptools wheel that surfaces as a CVE finding even though it's not +# on the runtime sys.path). +COPY --from=builder /root/.cache/prisma /root/.cache/prisma +COPY --from=builder /root/.cache/prisma-python /root/.cache/prisma-python RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \ find /app/.venv -type d -path "*/tornado/test" -delete EXPOSE 4000/tcp -COPY docker/supervisord.conf /etc/supervisord.conf - ENTRYPOINT ["docker/prod_entrypoint.sh"] CMD ["--port", "4000"] diff --git a/README.md b/README.md index 72fd43925c9..8df351e9303 100644 --- a/README.md +++ b/README.md @@ -292,7 +292,7 @@ curl -X POST 'http://0.0.0.0:4000/v1/chat/completions' \ | [CompactifAI (`compactifai`)](https://docs.litellm.ai/docs/providers/compactifai) | ✅ | ✅ | ✅ | | | | | | | | | [Custom (`custom`)](https://docs.litellm.ai/docs/providers/custom_llm_server) | ✅ | ✅ | ✅ | | | | | | | | | [Custom OpenAI (`custom_openai`)](https://docs.litellm.ai/docs/providers/openai_compatible) | ✅ | ✅ | ✅ | | | ✅ | ✅ | ✅ | ✅ | | -| [Dashscope (`dashscope`)](https://docs.litellm.ai/docs/providers/dashscope) | ✅ | ✅ | ✅ | | | | | | | | +| [Dashscope (`dashscope`)](https://docs.litellm.ai/docs/providers/dashscope) | ✅ | ✅ | ✅ | ✅ | | | | | | ✅ | | [Databricks (`databricks`)](https://docs.litellm.ai/docs/providers/databricks) | ✅ | ✅ | ✅ | | | | | | | | | [DataRobot (`datarobot`)](https://docs.litellm.ai/docs/providers/datarobot) | ✅ | ✅ | ✅ | | | | | | | | | [Deepgram (`deepgram`)](https://docs.litellm.ai/docs/providers/deepgram) | ✅ | ✅ | ✅ | | | ✅ | | | | | diff --git a/backend/Dockerfile b/backend/Dockerfile new file mode 100644 index 00000000000..c08014fc0ef --- /dev/null +++ b/backend/Dockerfile @@ -0,0 +1,83 @@ +ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:31da6565f35af6401031c1d7aa91dc84ac76c5c48edd17fb90f0ed9e3173c7a9 +ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:31da6565f35af6401031c1d7aa91dc84ac76c5c48edd17fb90f0ed9e3173c7a9 +ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a + +FROM $UV_IMAGE AS uvbin + +# ---------- Builder ---------- +FROM $LITELLM_BUILD_IMAGE AS builder + +WORKDIR /app +USER root + +COPY --from=uvbin /uv /uvx /usr/local/bin/ + +RUN apk add --no-cache bash gcc python3 python3-dev openssl openssl-dev libsndfile + +# UV_COMPILE_BYTECODE=1 precompiles .pyc at install time → faster cold start. +# UV_LINK_MODE=copy avoids hardlink warnings when uv installs from a +# BuildKit cache mount (different filesystem). +# UV_PYTHON_DOWNLOADS=0 force uv to use the apk-installed CPython instead of +# silently pulling a managed interpreter. +ENV UV_PROJECT_ENVIRONMENT=/app/.venv \ + UV_LINK_MODE=copy \ + UV_COMPILE_BYTECODE=1 \ + UV_PYTHON_DOWNLOADS=0 \ + PATH="/app/.venv/bin:${PATH}" + +# Stage 1 — install dependencies only. +RUN --mount=type=cache,target=/root/.cache/uv \ + --mount=type=bind,source=pyproject.toml,target=pyproject.toml \ + --mount=type=bind,source=uv.lock,target=uv.lock \ + --mount=type=bind,source=enterprise/pyproject.toml,target=enterprise/pyproject.toml \ + --mount=type=bind,source=litellm-proxy-extras/pyproject.toml,target=litellm-proxy-extras/pyproject.toml \ + uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \ + --extra proxy \ + --extra proxy-runtime \ + --extra extra_proxy \ + --extra semantic-router \ + --python python3 + +# Stage 2 — copy source and install the project + workspace members. +COPY . . + +RUN --mount=type=cache,target=/root/.cache/uv \ + uv sync --frozen --no-default-groups --no-editable \ + --extra proxy \ + --extra proxy-runtime \ + --extra extra_proxy \ + --extra semantic-router \ + --python python3 + +RUN mkdir -p /home/nonroot && \ + HOME=/home/nonroot prisma generate --schema=./schema.prisma && \ + chown -R nonroot:nonroot /home/nonroot/.cache + +# ---------- Runtime ---------- +FROM $LITELLM_RUNTIME_IMAGE AS runtime + +USER root + +RUN apk add --no-cache bash openssl tzdata python3 libsndfile libatomic + +# wolfi-base ships an unprivileged `nonroot` account (UID/GID 65532) with +# /home/nonroot. We run the backend as that user +WORKDIR /app +ENV HOME=/home/nonroot \ + PATH="/app/.venv/bin:${PATH}" \ + PYTHONPATH="/app" \ + PYTHONDONTWRITEBYTECODE=1 \ + PYTHONUNBUFFERED=1 + +COPY --from=builder --chown=nonroot:nonroot /app /app +COPY --from=builder --chown=nonroot:nonroot /home/nonroot/.cache /home/nonroot/.cache + +RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \ + find /app/.venv -type d -path "*/tornado/test" -delete + +USER nonroot + +EXPOSE 4001/tcp + +ENTRYPOINT ["uvicorn", "backend.main:app"] +CMD ["--host", "0.0.0.0", "--port", "4001"] diff --git a/backend/main.py b/backend/main.py new file mode 100644 index 00000000000..4092cd63f69 --- /dev/null +++ b/backend/main.py @@ -0,0 +1,51 @@ +"""UI backend entrypoint. + +Reuses the existing FastAPI app from `litellm.proxy.proxy_server` and trims its +route table to just the management/admin surface used by the dashboard. Purely +additive — no existing module is modified. + +Run with: + uvicorn backend.main:app --host 0.0.0.0 --port 4001 +""" + +from contextlib import asynccontextmanager + +from fastapi.routing import Mount + +# See gateway/main.py for why we assemble DATABASE_URL(s) here before +# importing proxy_server. +from litellm.proxy.db.db_url_settings import DatabaseURLSettings + +DatabaseURLSettings.from_env().apply_to_env() + +from litellm.proxy.proxy_server import app + +from backend.routes.allowlist import BACKEND_EXACT_PATHS, BACKEND_PATH_PREFIXES + + +def _is_backend_route(route) -> bool: + """Keep the route on the backend if its path is in the management surface.""" + path = getattr(route, "path", None) + if path is None: + return False + if isinstance(route, Mount): + # Static UI mounts are served by the dedicated UI container, not here. + return False + if path in BACKEND_EXACT_PATHS: + return True + return any(path.startswith(prefix) for prefix in BACKEND_PATH_PREFIXES) + + +# See gateway/main.py for why the trim runs inside the lifespan instead of at +# module scope. +_proxy_lifespan = app.router.lifespan_context + + +@asynccontextmanager +async def _backend_lifespan(app_): + async with _proxy_lifespan(app_): + app_.router.routes = [r for r in app_.router.routes if _is_backend_route(r)] + yield + + +app.router.lifespan_context = _backend_lifespan diff --git a/backend/routes/__init__.py b/backend/routes/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/backend/routes/allowlist.py b/backend/routes/allowlist.py new file mode 100644 index 00000000000..610ba3dbd69 --- /dev/null +++ b/backend/routes/allowlist.py @@ -0,0 +1,135 @@ +"""Path allowlist for the UI backend (control plane) component. + +The backend exposes management/admin endpoints consumed by the UI: keys, users, +teams, orgs, customers, budgets, tags, workflows, model management, spend & +analytics, settings (router/cache/cost-tracking/fallbacks), SSO/onboarding, +audit logs, debug, enterprise admin, and UI bootstrap helpers (logo, favicon, +.well-known config). + +Anything LLM data-plane is dropped — those run on the gateway component. +""" + +BACKEND_PATH_PREFIXES: tuple[str, ...] = ( + # Identity / access + "/key/", + "/v2/key/", + "/user/", + "/v2/user/", + "/team/", + "/v2/team/", + "/organization/", + "/customer/", + "/end_user/", + "/sso/", + "/login", + "/v2/login", + "/v3/login", + "/logout", + "/token", + "/onboarding/", + "/audit", + "/oauth/", + "/invitation/", + "/jwt/", + # Models & routing config + "/model/", + "/v1/model/info", + "/v2/model/", + "/model_group", + "/model_access_group/", + "/model_hub/", + "/v1/access_group", + "/access_group/", + "/router/", + "/router_settings", + "/adaptive_router/", + "/fallback", + "/fallbacks", + "/cache_settings", + "/cost_tracking", + "/cost/", + "/credentials", + "/credential", + "/provider/budgets", + # Tools / agents (registry & policy admin) + "/v1/tool/", + "/v1/agents", + # Guardrails admin + "/v2/guardrails/", + # MCP server admin + BYOK OAuth flow (UI-initiated) + dynamic per-server endpoints + "/v1/mcp/", + "/test/", + "/{mcp_server_name}/", + # Budgets / tags / workflows / memory mgmt + "/budget/", + "/tag/", + "/workflow/", + "/v1/workflows/", + "/project/", + "/memory/", + "/mcp/", + # Spend / analytics + "/spend/", + "/analytics/", + "/global/", + "/user_agent", + "/usage/", + "/daily/", + # CloudZero cost-export admin (init / settings / export / dry-run / delete) + "/cloudzero/", + # Caching admin + "/cache/", + "/caching/", + # Callbacks / hooks + "/active/callbacks", + "/callbacks", + "/team_callback", + # Alerting / email / IP allowlist + "/alerting/", + "/email/", + "/add/allowed_ip", + "/delete/allowed_ip", + "/get/", + # Enterprise admin + "/enterprise/", + # Debug / config / profiling + "/debug/", + "/config/", + "/memory-usage-in-mem-cache", + "/otel-spans", + "/lazy/", + "/in_product_nudges", + # Admin reload / schedule + "/reload/", + "/schedule/", + "/settings", + "/update/", + "/upload/", + # Dev / admin utilities + "/utils/", + # UI bootstrap helpers (assets the dashboard fetches) + "/get_logo_url", + "/get_image", + "/get_favicon", + "/.well-known/", + "/litellm/.well-known/", + "/ui_discovery/", + "/ui-config", + "/sso_settings", + "/public/", + "/robots.txt", + # Health (k8s probes) + "/health", +) + +BACKEND_EXACT_PATHS: frozenset[str] = frozenset( + { + "/", + "/routes", + "/openapi.json", + "/docs", + "/docs/oauth2-redirect", + "/redoc", + "/fallback/login", + } +) diff --git a/codecov.yaml b/codecov.yaml index 8609d3143d6..58681b884d0 100644 --- a/codecov.yaml +++ b/codecov.yaml @@ -3,6 +3,16 @@ codecov: notify: wait_for_ci: false # post as soon as expected uploads arrive, don't wait on CI +# Uploads are flagged per workflow/shard (GHA) or "circleci". carryforward makes +# a re-upload of a flag replace its prior session instead of accumulating a +# conflicting one, and lets a commit reuse a flag from its parent when that flag +# was not re-uploaded. Required because the same commit can receive the +# push-triggered workflows more than once (re-runs / branches cut at the same +# SHA); flagless overlapping sessions made Codecov drop the largest files. +flag_management: + default_rules: + carryforward: true + component_management: individual_components: - component_id: "Router" diff --git a/deploy/Dockerfile.ghcr_base b/deploy/Dockerfile.ghcr_base deleted file mode 100644 index 66e64e5b774..00000000000 --- a/deploy/Dockerfile.ghcr_base +++ /dev/null @@ -1,18 +0,0 @@ -# Use the provided base image -FROM ghcr.io/berriai/litellm:main-latest@sha256:7c311546c25e7bb6e8cafede9fcd3d0d622ac636b5c9418befaa32e85dfb0186 - -# Set the working directory to /app -WORKDIR /app - -# Copy the configuration file into the container at /app -COPY config.yaml . - -# Make sure your docker/entrypoint.sh is executable -# Convert Windows line endings to Unix -RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh - -# Expose the necessary port -EXPOSE 4000/tcp - -# Override the CMD instruction with your desired command and arguments -CMD ["--port", "4000", "--config", "config.yaml", "--detailed_debug", "--run_gunicorn"] diff --git a/deploy/charts/litellm-helm/Chart.yaml b/deploy/charts/litellm-helm/Chart.yaml index 0f6db331e50..0aef2442bfe 100644 --- a/deploy/charts/litellm-helm/Chart.yaml +++ b/deploy/charts/litellm-helm/Chart.yaml @@ -24,7 +24,7 @@ version: 1.1.0 # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: v1.80.12 +appVersion: v1.85.1 annotations: org.opencontainers.image.source: "https://github.com/BerriAI/litellm" diff --git a/deploy/charts/litellm-helm/templates/deployment.yaml b/deploy/charts/litellm-helm/templates/deployment.yaml index a9b41e0d8e0..aefe2a564bb 100644 --- a/deploy/charts/litellm-helm/templates/deployment.yaml +++ b/deploy/charts/litellm-helm/templates/deployment.yaml @@ -53,7 +53,7 @@ spec: - name: {{ include "litellm.name" . }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "main-%s" .Chart.AppVersion) }}" + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} env: - name: HOST @@ -100,6 +100,16 @@ spec: - name: DATABASE_URL value: {{ .Values.db.url | quote }} {{- end }} + {{- if and .Values.db.useExisting .Values.db.secret.readReplicaUrlKey }} + - name: DATABASE_URL_READ_REPLICA + valueFrom: + secretKeyRef: + name: {{ .Values.db.secret.name }} + key: {{ .Values.db.secret.readReplicaUrlKey }} + {{- else if .Values.db.readReplicaUrl }} + - name: DATABASE_URL_READ_REPLICA + value: {{ .Values.db.readReplicaUrl | quote }} + {{- end }} - name: PROXY_MASTER_KEY valueFrom: secretKeyRef: @@ -129,12 +139,6 @@ spec: value: {{ $val | quote }} {{- end }} {{- end }} - {{- if .Values.separateHealthApp }} - - name: SEPARATE_HEALTH_APP - value: "1" - - name: SEPARATE_HEALTH_PORT - value: {{ .Values.separateHealthPort | default "8081" | quote }} - {{- end }} {{- with .Values.extraEnvVars }} {{- toYaml . | nindent 12 }} {{- end }} @@ -175,15 +179,10 @@ spec: - name: http containerPort: {{ .Values.service.port }} protocol: TCP - {{- if .Values.separateHealthApp }} - - name: health - containerPort: {{ .Values.separateHealthPort | default 8081 }} - protocol: TCP - {{- end }} livenessProbe: httpGet: path: {{ .Values.livenessProbe.path | quote }} - port: {{ if .Values.separateHealthApp }}"health"{{ else }}"http"{{ end }} + port: "http" initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.livenessProbe.periodSeconds }} timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} @@ -192,7 +191,7 @@ spec: readinessProbe: httpGet: path: {{ .Values.readinessProbe.path | quote }} - port: {{ if .Values.separateHealthApp }}"health"{{ else }}"http"{{ end }} + port: "http" initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.readinessProbe.periodSeconds }} timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} @@ -201,7 +200,7 @@ spec: startupProbe: httpGet: path: {{ .Values.startupProbe.path | quote }} - port: {{ if .Values.separateHealthApp }}"health"{{ else }}"http"{{ end }} + port: "http" initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }} periodSeconds: {{ .Values.startupProbe.periodSeconds }} timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }} diff --git a/deploy/charts/litellm-helm/templates/hpa.yaml b/deploy/charts/litellm-helm/templates/hpa.yaml index 71e199c5aeb..fec4d1f5c5e 100644 --- a/deploy/charts/litellm-helm/templates/hpa.yaml +++ b/deploy/charts/litellm-helm/templates/hpa.yaml @@ -12,6 +12,10 @@ spec: name: {{ include "litellm.fullname" . }} minReplicas: {{ .Values.autoscaling.minReplicas }} maxReplicas: {{ .Values.autoscaling.maxReplicas }} + {{- if .Values.autoscaling.behavior }} + behavior: + {{- toYaml .Values.autoscaling.behavior | nindent 4 }} + {{- end }} metrics: {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} - type: Resource diff --git a/deploy/charts/litellm-helm/templates/migrations-job.yaml b/deploy/charts/litellm-helm/templates/migrations-job.yaml index c3f32fe32f3..5ec7f5b7f3e 100644 --- a/deploy/charts/litellm-helm/templates/migrations-job.yaml +++ b/deploy/charts/litellm-helm/templates/migrations-job.yaml @@ -41,7 +41,7 @@ spec: {{- end }} containers: - name: prisma-migrations - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "main-%s" .Chart.AppVersion) }}" + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} diff --git a/deploy/charts/litellm-helm/tests/hpa_tests.yaml b/deploy/charts/litellm-helm/tests/hpa_tests.yaml new file mode 100644 index 00000000000..ec18c3591d3 --- /dev/null +++ b/deploy/charts/litellm-helm/tests/hpa_tests.yaml @@ -0,0 +1,36 @@ +suite: "hpa with behavior" +templates: + - hpa.yaml +tests: + - it: "renders behavior when set" + set: + autoscaling.enabled: true + autoscaling.behavior: + scaleUp: + stabilizationWindowSeconds: 60 + policies: + - type: Pods + value: 2 + periodSeconds: 60 + scaleDown: + stabilizationWindowSeconds: 90 + policies: + - type: Pods + value: 1 + periodSeconds: 60 + asserts: + - isKind: { of: HorizontalPodAutoscaler } + - equal: { path: spec.behavior.scaleUp.stabilizationWindowSeconds, value: 60 } + - equal: { path: spec.behavior.scaleDown.stabilizationWindowSeconds, value: 90 } + +--- +suite: "hpa without behavior" +templates: + - hpa.yaml +tests: + - it: "does not render behavior when not set" + set: + autoscaling.enabled: true + asserts: + - isKind: { of: HorizontalPodAutoscaler } + - isNull: { path: spec.behavior } diff --git a/deploy/charts/litellm-helm/values.yaml b/deploy/charts/litellm-helm/values.yaml index 3dd1112bea7..a9cdf28f0e7 100644 --- a/deploy/charts/litellm-helm/values.yaml +++ b/deploy/charts/litellm-helm/values.yaml @@ -10,7 +10,7 @@ image: repository: ghcr.io/berriai/litellm-database pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - # tag: "main-latest" + # tag: "latest" tag: "" imagePullSecrets: [] @@ -88,12 +88,6 @@ service: # optionally specify loadBalancerClass # loadBalancerClass: tailscale -# Separate health app configuration -# When enabled, health checks will use a separate port and the application -# will receive SEPARATE_HEALTH_APP=1 and SEPARATE_HEALTH_PORT from environment variables -separateHealthApp: false -separateHealthPort: 8081 - # Probes for LiteLLM gateway container livenessProbe: path: /health/liveliness @@ -190,6 +184,7 @@ autoscaling: maxReplicas: 100 targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 + # behavior: {} # Autoscaling with keda is mutually exclusive with hpa keda: @@ -258,6 +253,26 @@ db: passwordKey: password # Optional: when set, DATABASE_HOST will be sourced from this secret key instead of db.endpoint endpointKey: "" + # Optional: when set, DATABASE_URL_READ_REPLICA will be sourced from this + # secret key instead of db.readReplicaUrl. Prefer this over the plain + # value: read-replica URLs typically embed credentials, and a value + # written to db.readReplicaUrl ends up visible in the rendered pod spec + # and the Helm release secret. + readReplicaUrlKey: "" + + # Optional read-replica routing. When set, the proxy sends read-only + # queries (find_*, count, group_by, query_raw/_first) to this URL while + # writes continue to go to db.url. Useful for Aurora-style clusters with + # separate reader/writer endpoints. Leave empty to keep single-DB behavior. + # When IAM_TOKEN_DB_AUTH is enabled, the reader URL is auto-refreshed + # alongside the writer (host/port/user/db are parsed from this URL once + # at startup; only the IAM token rotates). + # + # If the URL embeds credentials, prefer db.secret.readReplicaUrlKey over + # this field — the plain value is rendered into the pod spec and the + # Helm release secret. This field is intended for credential-less URLs + # only (e.g. when IAM_TOKEN_DB_AUTH supplies the token at runtime). + readReplicaUrl: "" # Use the Stackgres Helm chart to deploy an instance of a Stackgres cluster. # The Stackgres Operator must already be installed within the target diff --git a/deploy/kubernetes/kub.yaml b/deploy/kubernetes/kub.yaml deleted file mode 100644 index d5ba500d8f0..00000000000 --- a/deploy/kubernetes/kub.yaml +++ /dev/null @@ -1,56 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: litellm-deployment -spec: - replicas: 3 - selector: - matchLabels: - app: litellm - template: - metadata: - labels: - app: litellm - spec: - containers: - - name: litellm-container - image: ghcr.io/berriai/litellm:main-latest - imagePullPolicy: Always - env: - - name: AZURE_API_KEY - value: "d6f****" - - name: AZURE_API_BASE - value: "https://openai" - - name: LITELLM_MASTER_KEY - value: "sk-1234" - - name: DATABASE_URL - value: "postgresql://ishaan*********" - args: - - "--config" - - "/app/proxy_config.yaml" # Update the path to mount the config file - volumeMounts: # Define volume mount for proxy_config.yaml - - name: config-volume - mountPath: /app - readOnly: true - livenessProbe: - httpGet: - path: /health/liveliness - port: 4000 - initialDelaySeconds: 120 - periodSeconds: 15 - successThreshold: 1 - failureThreshold: 3 - timeoutSeconds: 10 - readinessProbe: - httpGet: - path: /health/readiness - port: 4000 - initialDelaySeconds: 120 - periodSeconds: 15 - successThreshold: 1 - failureThreshold: 3 - timeoutSeconds: 10 - volumes: # Define volume to mount proxy_config.yaml - - name: config-volume - configMap: - name: litellm-config diff --git a/deploy/kubernetes/service.yaml b/deploy/kubernetes/service.yaml deleted file mode 100644 index 4751c837254..00000000000 --- a/deploy/kubernetes/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: litellm-service -spec: - selector: - app: litellm - ports: - - protocol: TCP - port: 4000 - targetPort: 4000 - type: LoadBalancer \ No newline at end of file diff --git a/dev_config.yaml b/dev_config.yaml deleted file mode 100644 index 64e3c14703e..00000000000 --- a/dev_config.yaml +++ /dev/null @@ -1,13 +0,0 @@ -model_list: - - model_name: fake-openai-endpoint - litellm_params: - model: openai/fake-model - api_key: fake-key - api_base: https://exampleopenaiendpoint-production.up.railway.app/ - -general_settings: - master_key: sk-1234 - -litellm_settings: - drop_params: True - telemetry: False diff --git a/docker-compose.yml b/docker-compose.yml index 988860a7877..80e1f289aad 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -16,6 +16,11 @@ services: - "4000:4000" # Map the container port to the host, change the host port if necessary environment: DATABASE_URL: "postgresql://llmproxy:dbpassword9090@db:5432/litellm" + # Optional: route read-only queries (find_*, count, group_by, query_raw/_first) + # to a separate reader endpoint, e.g. an Aurora reader. Leave unset for + # single-DB deployments. With IAM_TOKEN_DB_AUTH enabled, the reader URL + # is auto-refreshed alongside the writer. + # DATABASE_URL_READ_REPLICA: "postgresql://llmproxy:dbpassword9090@db-reader:5432/litellm" STORE_MODEL_IN_DB: "True" # allows adding models to proxy via UI env_file: - .env # Load local .env file diff --git a/docker/Dockerfile.alpine b/docker/Dockerfile.alpine deleted file mode 100644 index 5de588cf4e4..00000000000 --- a/docker/Dockerfile.alpine +++ /dev/null @@ -1,68 +0,0 @@ -# Base image for building -ARG LITELLM_BUILD_IMAGE=python:3.11-alpine@sha256:f07e2ace46f560f09a6eeec7b4913b80ee99546e749ef82342a419a326620856 - -# Runtime image -ARG LITELLM_RUNTIME_IMAGE=python:3.11-alpine@sha256:f07e2ace46f560f09a6eeec7b4913b80ee99546e749ef82342a419a326620856 -ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a - -FROM $UV_IMAGE AS uvbin - -FROM $LITELLM_BUILD_IMAGE AS builder - -WORKDIR /app - -COPY --from=uvbin /uv /usr/local/bin/uv -COPY --from=uvbin /uvx /usr/local/bin/uvx - -RUN apk add --no-cache gcc python3-dev musl-dev nodejs npm libsndfile - -ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ - UV_PROJECT_ENVIRONMENT=/app/.venv \ - UV_LINK_MODE=copy \ - XDG_CACHE_HOME=/app/.cache \ - PATH="/app/.venv/bin:${PATH}" - -# Copy dependency metadata first for layer caching -COPY pyproject.toml uv.lock ./ -COPY enterprise/pyproject.toml enterprise/ -COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/ - -# Install third-party dependencies (cached unless pyproject.toml/uv.lock change) -RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \ - --extra proxy \ - --extra proxy-runtime \ - --extra extra_proxy \ - --extra semantic-router \ - --python python3 - -# Copy full source tree -COPY . . - -# Install project and workspace packages (fast - deps already cached) -RUN uv sync --frozen --no-default-groups --no-editable \ - --extra proxy \ - --extra proxy-runtime \ - --extra extra_proxy \ - --extra semantic-router \ - --python python3 - -RUN prisma generate --schema=./schema.prisma - -RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \ - sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh - -FROM $LITELLM_RUNTIME_IMAGE AS runtime - -RUN apk upgrade --no-cache && apk add --no-cache libsndfile nodejs npm - -WORKDIR /app -ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ - XDG_CACHE_HOME=/app/.cache \ - PATH="/app/.venv/bin:${PATH}" - -COPY --from=builder /app /app - -EXPOSE 4000/tcp - -ENTRYPOINT ["docker/prod_entrypoint.sh"] -CMD ["--port", "4000"] diff --git a/docker/Dockerfile.custom_ui b/docker/Dockerfile.custom_ui deleted file mode 100644 index cc44893bf92..00000000000 --- a/docker/Dockerfile.custom_ui +++ /dev/null @@ -1,86 +0,0 @@ -# Use the provided base image -# NOTE: This is a dev/branch-specific tag. Update digest when the base image is rebuilt. -FROM ghcr.io/berriai/litellm:litellm_fwd_server_root_path-dev - -# Set the working directory to /app -WORKDIR /app - -# Install Node.js and npm (adjust version as needed) -RUN apt-get update && apt-get upgrade -y \ - libxml2 \ - libexpat1 \ - openssl \ - libssl3 \ - git \ - libkrb5-3 \ - libglib2.0-0 \ - wget \ - libaom3 \ - libxslt1.1 \ - libgnutls30 \ - libc6 && \ - apt-get install -y --no-install-recommends nodejs npm && \ - npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \ - GLOBAL="$(npm root -g)" && \ - find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \ - rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \ - done && \ - find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \ - rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \ - done && \ - find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \ - rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \ - done && \ - find "$GLOBAL/npm" -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \ - rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \ - done && \ - find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \ - rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \ - done && \ - find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \ - sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \ - npm cache clean --force && \ - apt-get purge -y npm - -# Copy the UI source into the container -COPY ./ui/litellm-dashboard /app/ui/litellm-dashboard - -# Set an environment variable for UI_BASE_PATH -# This can be overridden at build time -# set UI_BASE_PATH to "/ui" -ENV UI_BASE_PATH="/prod/ui" - -# Build the UI with the specified UI_BASE_PATH -WORKDIR /app/ui/litellm-dashboard -RUN npm ci -RUN UI_BASE_PATH=$UI_BASE_PATH npm run build - -# Create the destination directory -RUN mkdir -p /app/litellm/proxy/_experimental/out - -# Move the built files to the appropriate location -# Assuming the build output is in ./out directory -RUN rm -rf /app/litellm/proxy/_experimental/out/* && \ - mv ./out/* /app/litellm/proxy/_experimental/out/ - -# Switch back to the main app directory -WORKDIR /app - -# Make sure your docker/entrypoint.sh is executable -# Convert Windows line endings to Unix for entrypoint scripts -RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh -RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh - -# Run as non-root user -RUN groupadd --gid 1000 appuser && useradd --uid 1000 --gid 1000 --no-create-home appuser \ - && chown -R appuser:appuser /app -USER appuser - -# Expose the necessary port -EXPOSE 4000/tcp - -HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ - CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4000/health')"] - -# Override the CMD instruction with your desired command and arguments -CMD ["--port", "4000", "--config", "config.yaml", "--detailed_debug"] \ No newline at end of file diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database index 671f374ca27..c84003a065f 100644 --- a/docker/Dockerfile.database +++ b/docker/Dockerfile.database @@ -66,7 +66,7 @@ FROM $LITELLM_RUNTIME_IMAGE AS runtime USER root -RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervisor && \ +RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile && \ npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \ GLOBAL="$(npm root -g)" && \ find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \ @@ -102,7 +102,5 @@ RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \ EXPOSE 4000/tcp -COPY docker/supervisord.conf /etc/supervisord.conf - ENTRYPOINT ["docker/prod_entrypoint.sh"] CMD ["--port", "4000"] diff --git a/docker/Dockerfile.dev b/docker/Dockerfile.dev deleted file mode 100644 index ebc92a22d50..00000000000 --- a/docker/Dockerfile.dev +++ /dev/null @@ -1,121 +0,0 @@ -# Base image for building -ARG LITELLM_BUILD_IMAGE=python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d - -# Runtime image -ARG LITELLM_RUNTIME_IMAGE=python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d -ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a - -FROM $UV_IMAGE AS uvbin - -FROM $LITELLM_BUILD_IMAGE AS builder - -WORKDIR /app -USER root - -COPY --from=uvbin /uv /usr/local/bin/uv -COPY --from=uvbin /uvx /usr/local/bin/uvx - -RUN apt-get update && apt-get install -y --no-install-recommends \ - gcc \ - g++ \ - python3-dev \ - libssl-dev \ - pkg-config \ - nodejs \ - npm \ - && rm -rf /var/lib/apt/lists/* - -ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ - UV_PROJECT_ENVIRONMENT=/app/.venv \ - UV_LINK_MODE=copy \ - XDG_CACHE_HOME=/app/.cache \ - PATH="/app/.venv/bin:${PATH}" - -# Copy dependency metadata first for layer caching -COPY pyproject.toml uv.lock ./ -COPY enterprise/pyproject.toml enterprise/ -COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/ - -# Install third-party dependencies (cached unless pyproject.toml/uv.lock change) -RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \ - --extra proxy \ - --extra proxy-runtime \ - --extra extra_proxy \ - --extra semantic-router \ - --python python - -# Copy full source tree -COPY . . - -# Build Admin UI before final sync -RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh - -# Install project and workspace packages (fast - deps already cached) -RUN uv sync --frozen --no-default-groups --no-editable \ - --extra proxy \ - --extra proxy-runtime \ - --extra extra_proxy \ - --extra semantic-router \ - --python python - -RUN prisma generate --schema=./schema.prisma - -RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \ - sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh - -FROM $LITELLM_RUNTIME_IMAGE AS runtime - -USER root - -RUN apt-get update && apt-get upgrade -y \ - libxml2 \ - libexpat1 \ - openssl \ - libssl3 \ - git \ - libkrb5-3 \ - libglib2.0-0 \ - wget \ - libaom3 \ - libxslt1.1 \ - libgnutls30 \ - libc6 \ - && apt-get install -y --no-install-recommends \ - libssl3 \ - libatomic1 \ - nodejs \ - npm \ - && rm -rf /var/lib/apt/lists/* \ - && npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \ - && GLOBAL="$(npm root -g)" \ - && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \ - rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \ - done \ - && find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \ - rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \ - done \ - && find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \ - rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \ - done \ - && find "$GLOBAL/npm" -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \ - rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \ - done \ - && find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \ - rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \ - done \ - && find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \ - sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null \ - && npm cache clean --force \ - && apt-get purge -y npm - -WORKDIR /app -ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ - XDG_CACHE_HOME=/app/.cache \ - PATH="/app/.venv/bin:${PATH}" - -COPY --from=builder /app /app - -EXPOSE 4000/tcp - -ENTRYPOINT ["docker/prod_entrypoint.sh"] -CMD ["--port", "4000"] diff --git a/docker/Dockerfile.health_check b/docker/Dockerfile.health_check deleted file mode 100644 index a2e5cb9f71f..00000000000 --- a/docker/Dockerfile.health_check +++ /dev/null @@ -1,30 +0,0 @@ -ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a -FROM $UV_IMAGE AS uvbin - -FROM python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d - -WORKDIR /app - -# Copy the uv binary and the health check script. -COPY --from=uvbin /uv /usr/local/bin/uv -COPY pyproject.toml uv.lock /app/ -COPY scripts/health_check/health_check_client.py /app/health_check_client.py - -# Resolve and install the health-check dependencies from the project lockfile -# so the runtime image stays self-contained and reproducible. -RUN uv export --frozen --no-default-groups --only-group healthcheck --no-emit-project --no-hashes --output-file /tmp/health-check-requirements.txt \ - && uv pip install --system -r /tmp/health-check-requirements.txt \ - && rm /tmp/health-check-requirements.txt \ - && rm /app/pyproject.toml /app/uv.lock \ - && chmod +x /app/health_check_client.py - -# Run as non-root user -RUN groupadd --gid 1000 appuser && useradd --uid 1000 --gid 1000 --no-create-home appuser -USER appuser - -# Health check -HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \ - CMD ["python", "/app/health_check_client.py", "--help"] - -# Set entrypoint -ENTRYPOINT ["python", "/app/health_check_client.py"] diff --git a/docker/Dockerfile.non_root b/docker/Dockerfile.non_root index 3fa73f42437..2729babb6d6 100644 --- a/docker/Dockerfile.non_root +++ b/docker/Dockerfile.non_root @@ -24,7 +24,8 @@ RUN for i in 1 2 3; do \ curl \ openssl \ libsndfile \ - nodejs && break || sleep 5; \ + nodejs \ + npm && break || sleep 5; \ done ENV UV_PROJECT_ENVIRONMENT=/app/.venv \ @@ -103,13 +104,12 @@ RUN for i in 1 2 3; do \ apk upgrade --no-cache && break || sleep 5; \ done && \ for i in 1 2 3; do \ - apk add --no-cache python3 bash openssl tzdata supervisor libsndfile nodejs && break || sleep 5; \ + apk add --no-cache python3 bash openssl tzdata libsndfile nodejs && break || sleep 5; \ done COPY --from=builder /app /app COPY --from=builder /var/lib/litellm/ui /var/lib/litellm/ui COPY --from=builder /var/lib/litellm/assets /var/lib/litellm/assets -COPY --from=builder /app/docker/supervisord.conf /etc/supervisord.conf ENV PATH="/app/.venv/bin:${PATH}" \ PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ diff --git a/docker/prod_entrypoint.sh b/docker/prod_entrypoint.sh index 28d1bdcc294..bd78bf6687b 100644 --- a/docker/prod_entrypoint.sh +++ b/docker/prod_entrypoint.sh @@ -1,14 +1,8 @@ #!/bin/sh -if [ "$SEPARATE_HEALTH_APP" = "1" ]; then - export LITELLM_ARGS="$@" - export SUPERVISORD_STOPWAITSECS="${SUPERVISORD_STOPWAITSECS:-3600}" - exec supervisord -c /etc/supervisord.conf -fi - if [ "$USE_DDTRACE" = "true" ]; then export DD_TRACE_OPENAI_ENABLED="False" exec ddtrace-run litellm "$@" else exec litellm "$@" -fi \ No newline at end of file +fi diff --git a/docker/supervisord.conf b/docker/supervisord.conf deleted file mode 100644 index ba9d99d18a5..00000000000 --- a/docker/supervisord.conf +++ /dev/null @@ -1,46 +0,0 @@ -[supervisord] -nodaemon=true -loglevel=info -logfile=/tmp/supervisord.log -pidfile=/tmp/supervisord.pid - -[group:litellm] -programs=main,health - -[program:main] -command=sh -c 'if [ "$USE_DDTRACE" = "true" ]; then export DD_TRACE_OPENAI_ENABLED="False"; exec ddtrace-run python -m litellm.proxy.proxy_cli --host 0.0.0.0 --port=4000 $LITELLM_ARGS; else exec python -m litellm.proxy.proxy_cli --host 0.0.0.0 --port=4000 $LITELLM_ARGS; fi' -autostart=true -autorestart=true -startretries=3 -priority=1 -exitcodes=0 -stopasgroup=true -killasgroup=true -stopwaitsecs=%(ENV_SUPERVISORD_STOPWAITSECS)s -stdout_logfile=/dev/stdout -stderr_logfile=/dev/stderr -stdout_logfile_maxbytes = 0 -stderr_logfile_maxbytes = 0 -environment=PYTHONUNBUFFERED=true - -[program:health] -command=sh -c '[ "$SEPARATE_HEALTH_APP" = "1" ] && exec uvicorn litellm.proxy.health_endpoints.health_app_factory:build_health_app --factory --host 0.0.0.0 --port=${SEPARATE_HEALTH_PORT:-4001} || exit 0' -autostart=true -autorestart=true -startretries=3 -priority=2 -exitcodes=0 -stopasgroup=true -killasgroup=true -stopwaitsecs=%(ENV_SUPERVISORD_STOPWAITSECS)s -stdout_logfile=/dev/stdout -stderr_logfile=/dev/stderr -stdout_logfile_maxbytes = 0 -stderr_logfile_maxbytes = 0 -environment=PYTHONUNBUFFERED=true - -[eventlistener:process_monitor] -command=python -c "from supervisor import childutils; import os, signal; [os.kill(os.getppid(), signal.SIGTERM) for h,p in iter(lambda: childutils.listener.wait(), None) if h['eventname'] in ['PROCESS_STATE_FATAL', 'PROCESS_STATE_EXITED'] and dict([x.split(':') for x in p.split(' ')])['processname'] in ['main', 'health'] or childutils.listener.ok()]" -events=PROCESS_STATE_EXITED,PROCESS_STATE_FATAL -autostart=true -autorestart=true \ No newline at end of file diff --git a/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py b/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py index 356f6ecd4b5..ee7745d0add 100644 --- a/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py +++ b/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py @@ -300,6 +300,42 @@ class CheckBatchCost: custom_llm_provider=custom_llm_provider, ) + # CheckBatchCost bypasses async_post_call_success_hook, so convert raw + # output/error file IDs to managed base64 IDs before the DB write here. + managed_files_hook = self.proxy_logging_obj.get_proxy_hook("managed_files") + if managed_files_hook is not None: + from litellm.proxy._types import UserAPIKeyAuth + _minimal_auth = UserAPIKeyAuth( + user_id=job.created_by or "default-user-id", + team_id=getattr(job, "team_id", None), + ) + for _file_attr in ["output_file_id", "error_file_id"]: + _raw_file_id = getattr(response, _file_attr, None) + if _raw_file_id and not _is_base64_encoded_unified_file_id(_raw_file_id): + try: + _unified_file_id = managed_files_hook.get_unified_output_file_id( + output_file_id=_raw_file_id, + model_id=model_id, + model_name=str(model_name) if model_name else deployment_info.model_name or None, + ) + await managed_files_hook.store_unified_file_id( + file_id=_unified_file_id, + file_object=None, + litellm_parent_otel_span=None, + model_mappings={model_id: _raw_file_id}, + user_api_key_dict=_minimal_auth, + ) + setattr(response, _file_attr, _unified_file_id) + verbose_proxy_logger.info( + f"CheckBatchCost: converted {_file_attr} " + f"{_raw_file_id!r} -> managed ID for batch {batch_id}" + ) + except Exception as _e: + verbose_proxy_logger.warning( + f"CheckBatchCost: failed to create managed file ID for " + f"{_file_attr}={_raw_file_id!r}: {_e}" + ) + # Pass deployment model_info so custom batch pricing # (input_cost_per_token_batches etc.) is used for cost calc deployment_model_info = deployment_info.model_info.model_dump() if deployment_info.model_info else {} diff --git a/enterprise/pyproject.toml b/enterprise/pyproject.toml index 9698e7912d4..9f37b52d94c 100644 --- a/enterprise/pyproject.toml +++ b/enterprise/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "litellm-enterprise" -version = "0.1.40" +version = "0.1.41" description = "Package for LiteLLM Enterprise features" readme = "README.md" requires-python = ">=3.9" @@ -26,7 +26,7 @@ required-version = ">=0.10.9" module-root = "" [tool.commitizen] -version = "0.1.40" +version = "0.1.41" version_files = [ "pyproject.toml:^version", "../pyproject.toml:litellm-enterprise==", diff --git a/gateway/Dockerfile b/gateway/Dockerfile new file mode 100644 index 00000000000..a2ca3d3f83f --- /dev/null +++ b/gateway/Dockerfile @@ -0,0 +1,83 @@ +ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:31da6565f35af6401031c1d7aa91dc84ac76c5c48edd17fb90f0ed9e3173c7a9 +ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:31da6565f35af6401031c1d7aa91dc84ac76c5c48edd17fb90f0ed9e3173c7a9 +ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a + +FROM $UV_IMAGE AS uvbin + +# ---------- Builder ---------- +FROM $LITELLM_BUILD_IMAGE AS builder + +WORKDIR /app +USER root + +COPY --from=uvbin /uv /uvx /usr/local/bin/ + +RUN apk add --no-cache bash gcc python3 python3-dev openssl openssl-dev libsndfile + +# UV_COMPILE_BYTECODE=1 precompiles .pyc at install time → faster cold start. +# UV_LINK_MODE=copy avoids hardlink warnings when uv installs from a +# BuildKit cache mount (different filesystem). +# UV_PYTHON_DOWNLOADS=0 force uv to use the apk-installed CPython instead of +# silently pulling a managed interpreter. +ENV UV_PROJECT_ENVIRONMENT=/app/.venv \ + UV_LINK_MODE=copy \ + UV_COMPILE_BYTECODE=1 \ + UV_PYTHON_DOWNLOADS=0 \ + PATH="/app/.venv/bin:${PATH}" + +# Stage 1 — install dependencies only. +RUN --mount=type=cache,target=/root/.cache/uv \ + --mount=type=bind,source=pyproject.toml,target=pyproject.toml \ + --mount=type=bind,source=uv.lock,target=uv.lock \ + --mount=type=bind,source=enterprise/pyproject.toml,target=enterprise/pyproject.toml \ + --mount=type=bind,source=litellm-proxy-extras/pyproject.toml,target=litellm-proxy-extras/pyproject.toml \ + uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \ + --extra proxy \ + --extra proxy-runtime \ + --extra extra_proxy \ + --extra semantic-router \ + --python python3 + +# Stage 2 — copy source and install the project + workspace members. +COPY . . + +RUN --mount=type=cache,target=/root/.cache/uv \ + uv sync --frozen --no-default-groups --no-editable \ + --extra proxy \ + --extra proxy-runtime \ + --extra extra_proxy \ + --extra semantic-router \ + --python python3 + +RUN mkdir -p /home/nonroot && \ + HOME=/home/nonroot prisma generate --schema=./schema.prisma && \ + chown -R nonroot:nonroot /home/nonroot/.cache + +# ---------- Runtime ---------- +FROM $LITELLM_RUNTIME_IMAGE AS runtime + +USER root + +RUN apk add --no-cache bash openssl tzdata python3 libsndfile libatomic + +# wolfi-base ships an unprivileged `nonroot` account (UID/GID 65532) with +# /home/nonroot. We run the proxy as that user. +WORKDIR /app +ENV HOME=/home/nonroot \ + PATH="/app/.venv/bin:${PATH}" \ + PYTHONPATH="/app" \ + PYTHONDONTWRITEBYTECODE=1 \ + PYTHONUNBUFFERED=1 + +COPY --from=builder --chown=nonroot:nonroot /app /app +COPY --from=builder --chown=nonroot:nonroot /home/nonroot/.cache /home/nonroot/.cache + +RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \ + find /app/.venv -type d -path "*/tornado/test" -delete + +USER nonroot + +EXPOSE 4000/tcp + +ENTRYPOINT ["sh", "-c", "exec uvicorn gateway.main:app --workers \"${NUM_WORKERS:-1}\" \"$@\"", "--"] +CMD ["--host", "0.0.0.0", "--port", "4000"] diff --git a/gateway/main.py b/gateway/main.py new file mode 100644 index 00000000000..09d30f5da3f --- /dev/null +++ b/gateway/main.py @@ -0,0 +1,59 @@ +"""Gateway entrypoint. + +Reuses the existing FastAPI app from `litellm.proxy.proxy_server` and trims its +route table to just the LLM data-plane surface. The trim is purely additive — +no existing module is modified, the full app continues to work via the legacy +entrypoint (`litellm.proxy.proxy_server:app`). + +Run with: + uvicorn gateway.main:app --host 0.0.0.0 --port 4000 +""" + +from contextlib import asynccontextmanager + +from fastapi.routing import Mount + +# Assemble DATABASE_URL (+ DATABASE_URL_READ_REPLICA) from the discrete +# DATABASE_* env vars before proxy_server imports spin up Prisma. Handles +# both IAM (mint a token) and password auth, writer and reader. The standard +# CLI flow does this in proxy_cli.py; we bypass proxy_cli by uvicorn'ing the +# app directly, so without this Prisma initializes with the placeholder URL +# and every DB-needing endpoint returns "Database not connected". +from litellm.proxy.db.db_url_settings import DatabaseURLSettings + +DatabaseURLSettings.from_env().apply_to_env() + +from litellm.proxy.proxy_server import app + +from gateway.routes.allowlist import GATEWAY_EXACT_PATHS, GATEWAY_PATH_PREFIXES + + +def _is_gateway_route(route) -> bool: + """Keep the route on the gateway if its path is in the LLM data-plane surface.""" + path = getattr(route, "path", None) + if path is None: + return False + if isinstance(route, Mount): + # Gateway never serves the static UI or its asset bundles. + return False + if path in GATEWAY_EXACT_PATHS: + return True + return any(path.startswith(prefix) for prefix in GATEWAY_PATH_PREFIXES) + + +# Wrap proxy_server's existing lifespan so the route trim runs *after* its +# startup hooks (and any plugin code those hooks load) have had a chance to +# register routes. A module-load filter would miss routes added during +# startup; running inside the lifespan, after the inner __aenter__, catches +# them while still completing before uvicorn opens the listener. +_proxy_lifespan = app.router.lifespan_context + + +@asynccontextmanager +async def _gateway_lifespan(app_): + async with _proxy_lifespan(app_): + app_.router.routes = [r for r in app_.router.routes if _is_gateway_route(r)] + yield + + +app.router.lifespan_context = _gateway_lifespan diff --git a/gateway/routes/__init__.py b/gateway/routes/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/gateway/routes/allowlist.py b/gateway/routes/allowlist.py new file mode 100644 index 00000000000..cbbf55c9873 --- /dev/null +++ b/gateway/routes/allowlist.py @@ -0,0 +1,121 @@ +"""Path allowlist for the gateway component. + +The gateway exposes the LLM data-plane surface: chat/completions, embeddings, +audio, batches, files, fine-tuning, rerank, ocr, rag, video, search, image, +responses, vector stores, passthrough providers, realtime websockets, MCP +tool-call endpoints, and operational endpoints (/health, /metrics). + +Any path not listed here is dropped from the gateway process so management/UI +endpoints don't ride on the same pods. + +Versioned data-plane paths are enumerated explicitly rather than allowing a +blanket `/v1/` or `/v2/` prefix — those broad prefixes would otherwise also +match management routes like `/v1/access_group`, `/v1/tool/{tool_name}/logs`, +`/v2/key/info`, etc. +""" + +GATEWAY_PATH_PREFIXES: tuple[str, ...] = ( + # OpenAI-compatible data-plane surface (versioned + unversioned) + "/v1/chat/", + "/chat/", + "/v1/completions", + "/completions", + "/v1/embeddings", + "/embeddings", + "/v1/moderations", + "/moderations", + "/v1/audio/", + "/audio/", + "/v1/images/", + "/images/", + "/v1/files", + "/files", + "/v1/batches", + "/batches", + "/v1/fine_tuning/", + "/fine_tuning/", + "/v1/fine-tuning/", + "/fine-tuning/", + "/v1/responses", + "/responses", + "/v1/threads", + "/threads", + "/v1/assistants", + "/assistants", + "/v1/vector_stores", + "/vector_stores", + "/v1/indexes", + "/v1/models", + "/models", + "/openai/", + "/engines/", + # Anthropic / agentic data-plane surface + "/v1/messages", + "/messages", + "/v1/skills", + "/v1/a2a/", + # LiteLLM-native LLM surface + "/v1/rerank", + "/v2/rerank", + "/rerank", + "/v1/ocr", + "/ocr", + "/v1/rag/", + "/rag/", + "/v1/video", + "/v1/videos", + "/video/", + "/videos", + "/v1/search", + "/search", + "/v1/containers", + "/containers", + "/v1/evals", + "/v1/memory", + "/queue/chat/", + # Google data plane (v1beta is the Google AI Studio version) + "/v1beta/", + "/interactions", + # Provider passthrough + "/anthropic/", + "/azure/", + "/azure_ai/", + "/aws/", + "/bedrock/", + "/cohere/", + "/gemini/", + "/google/", + "/vertex_ai/", + "/vertex-ai/", + "/assemblyai/", + "/eu.assemblyai/", + "/langfuse/", + "/vllm/", + "/mistral/", + "/groq/", + "/voyage/", + "/cursor/", + "/milvus/", + "/openai_passthrough/", + # Dynamic provider / toolset passthrough (path templates) + "/{provider}/", + "/toolset/", + # Realtime / streaming + "/v1/realtime", + "/realtime", + # Health & ops + "/health", + "/metrics", +) + +GATEWAY_EXACT_PATHS: frozenset[str] = frozenset( + { + "/", + "/routes", + "/openapi.json", + "/docs", + "/docs/oauth2-redirect", + "/redoc", + "/test", + } +) diff --git a/helm/litellm/Chart.yaml b/helm/litellm/Chart.yaml new file mode 100644 index 00000000000..e67f5790c7e --- /dev/null +++ b/helm/litellm/Chart.yaml @@ -0,0 +1,8 @@ +apiVersion: v2 +name: litellm +description: LiteLLM componentized — gateway, UI backend, and UI as separate services +type: application +version: 0.1.0 +appVersion: "0.1.0" +annotations: + org.opencontainers.image.source: "https://github.com/BerriAI/litellm" diff --git a/helm/litellm/templates/NOTES.txt b/helm/litellm/templates/NOTES.txt new file mode 100644 index 00000000000..5b939fe480a --- /dev/null +++ b/helm/litellm/templates/NOTES.txt @@ -0,0 +1,49 @@ +LiteLLM componentized — release {{ .Release.Name }} in namespace {{ .Release.Namespace }}. + +Components: +{{- if .Values.gateway.enabled }} + - gateway : Service {{ include "litellm.gateway.fullname" . }} on port {{ .Values.gateway.service.port }} +{{- end }} +{{- if .Values.backend.enabled }} + - backend : Service {{ include "litellm.backend.fullname" . }} on port {{ .Values.backend.service.port }} +{{- end }} +{{- if .Values.ui.enabled }} + - ui : Service {{ include "litellm.ui.fullname" . }} on port {{ .Values.ui.service.port }} +{{- end }} + +Port-forward examples: + kubectl -n {{ .Release.Namespace }} port-forward svc/{{ include "litellm.gateway.fullname" . }} {{ .Values.gateway.service.port }} + kubectl -n {{ .Release.Namespace }} port-forward svc/{{ include "litellm.backend.fullname" . }} {{ .Values.backend.service.port }} + kubectl -n {{ .Release.Namespace }} port-forward svc/{{ include "litellm.ui.fullname" . }} {{ .Values.ui.service.port }} + +Reminders: + - Sensitive values come from Secret references only. Before installing, set: + - masterKey.secretName (Secret with the proxy master key) + - database.writer.{host,port,dbname} (writer connection pieces) + - database.writer.passwordSecret.{name,usernameKey,passwordKey} + (Secret holding the writer DB username + password) + - database.writer.useIAMAuth: true (optional — chart sets IAM_TOKEN_DB_AUTH=true and + omits DATABASE_PASSWORD / DATABASE_URL so the proxy + mints the URL from an IAM token at startup) + - database.reader.host (optional — enables read-replica routing; reader + .passwordSecret.name is required when set, unless + .useIAMAuth is true) + - database.reader.useIAMAuth: true (optional, requires database.writer.useIAMAuth: true — + chart emits DATABASE_*_READ_REPLICA env vars and + omits DATABASE_PASSWORD_READ_REPLICA / + DATABASE_URL_READ_REPLICA so the proxy mints the + reader URL from an IAM token at startup) + - redis.passwordSecret.name (optional — set when redis.host is provided and the + cache requires auth) + - redis.cluster: true (optional — chart sets REDIS_CLUSTER_NODES from + redis.host / redis.port so the proxy's Cache() + constructs a RedisClusterCache; the cluster client + discovers remaining nodes from CLUSTER SLOTS) + - Per-component extras (gateway / backend / ui): + - {component}.extraEnv / envConfigMaps / envSecrets (the latter two are lists of resource names → + envFrom configMapRef / secretRef) + - {component}.logLevel (renders as LITELLM_LOG) + - gateway.config.proxy_config (rendered into a ConfigMap and mounted at + /app/config/config.yaml; gateway reads it via + CONFIG_FILE_PATH) + - Enable ingress.enabled=true to dispatch / → ui, gateway data-plane prefixes → gateway, and the catch-all → backend. diff --git a/helm/litellm/templates/_helpers.tpl b/helm/litellm/templates/_helpers.tpl new file mode 100644 index 00000000000..e2faf42b766 --- /dev/null +++ b/helm/litellm/templates/_helpers.tpl @@ -0,0 +1,245 @@ +{{/* +Common naming + label helpers shared by gateway, backend, and ui templates. +*/}} + +{{- define "litellm.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "litellm.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} + +{{- define "litellm.gateway.fullname" -}} +{{- printf "%s-gateway" (include "litellm.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "litellm.backend.fullname" -}} +{{- printf "%s-backend" (include "litellm.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "litellm.ui.fullname" -}} +{{- printf "%s-ui" (include "litellm.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "litellm.commonLabels" -}} +app.kubernetes.io/name: {{ include "litellm.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }} +{{- end -}} + +{{/* +Per-component selector labels — used in both Service selectors and Deployment matchLabels. +*/}} +{{- define "litellm.gateway.selectorLabels" -}} +app.kubernetes.io/name: {{ include "litellm.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/component: gateway +{{- end -}} + +{{- define "litellm.backend.selectorLabels" -}} +app.kubernetes.io/name: {{ include "litellm.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/component: backend +{{- end -}} + +{{- define "litellm.ui.selectorLabels" -}} +app.kubernetes.io/name: {{ include "litellm.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/component: ui +{{- end -}} + +{{/* +Shared ServiceAccount name used by all three component Deployments. When +`serviceAccount.create` is true and `serviceAccount.name` is empty, default +to the chart fullname. When `create` is false, fall back to the provided +name or the namespace's `default` SA. +*/}} +{{- define "litellm.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} +{{ default (include "litellm.fullname" .) .Values.serviceAccount.name }} +{{- else -}} +{{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Master-key + database + redis env block — shared by gateway, backend, and the +migrations Job. + +Invoke with a dict: `(dict "root" $ "component" .Values.gateway)`. `root` is +the chart context (needed for .Values), `component` selects which component's +`extraEnv` / `logLevel` to render. + +Sensitive values (master key, DB username + password, Redis password) come +only from referenced Secrets; the chart never accepts inline values for them. + +The chart never assembles DATABASE_URL itself. It emits only the discrete +DATABASE_HOST/PORT/USER/NAME/SCHEMA (+ DATABASE_PASSWORD for password auth) +vars; the proxy's entrypoint (DatabaseURLSettings in +litellm/proxy/db/db_url_settings.py) builds the URL from them and +percent-encodes the credentials. Assembling the URL here via Kubernetes +`$(VAR)` substitution would embed the raw secret value, corrupting the URL +whenever the password contains a URL-reserved character (@, /, ?, %, +, +...) — as AWS RDS auto-generated passwords routinely do. + +When `database.writer.useIAMAuth: true`, the chart injects +IAM_TOKEN_DB_AUTH=true and omits DATABASE_PASSWORD — the entrypoint mints +the URL from DATABASE_HOST/PORT/USER/NAME plus a short-lived IAM token +instead of a static password. + +The read replica is opt-in via `database.reader.host`. The chart emits +DATABASE_HOST_READ_REPLICA / DATABASE_PORT_READ_REPLICA / +DATABASE_NAME_READ_REPLICA (+ DATABASE_SCHEMA_READ_REPLICA) for both auth +modes, plus DATABASE_USER_READ_REPLICA / DATABASE_PASSWORD_READ_REPLICA for +password auth. When `database.reader.useIAMAuth: true` it omits +DATABASE_PASSWORD_READ_REPLICA and the entrypoint mints the reader URL the +same way. Reader IAM only takes effect when the writer also uses IAM auth +(the proxy gates URL minting on IAM_TOKEN_DB_AUTH, which only the writer +sets). +*/}} +{{- define "litellm.serverEnv" -}} +{{- $root := .root -}} +{{- $component := .component -}} +- name: LITELLM_MASTER_KEY + valueFrom: + secretKeyRef: + name: {{ required "masterKey.secretName is required (the chart no longer accepts an inline master key)" $root.Values.masterKey.secretName }} + key: {{ $root.Values.masterKey.secretKey | default "master-key" }} +{{- if $component.logLevel }} +- name: LITELLM_LOG + value: {{ $component.logLevel | quote }} +{{- end }} +{{- with $root.Values.database.writer }} +- name: DATABASE_HOST + value: {{ required "database.writer.host is required" .host | quote }} +- name: DATABASE_PORT + value: {{ .port | default 5432 | quote }} +- name: DATABASE_USER + valueFrom: + secretKeyRef: + name: {{ required "database.writer.passwordSecret.name is required" .passwordSecret.name }} + key: {{ .passwordSecret.usernameKey | default "username" }} +- name: DATABASE_NAME + value: {{ required "database.writer.dbname is required" .dbname | quote }} +{{- if .schema }} +- name: DATABASE_SCHEMA + value: {{ .schema | quote }} +{{- end }} +{{- if .useIAMAuth }} +- name: IAM_TOKEN_DB_AUTH + value: "true" +{{- else }} +- name: DATABASE_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .passwordSecret.name }} + key: {{ .passwordSecret.passwordKey | default "password" }} +{{- end }} +{{- end }} +{{- with $root.Values.database.reader }} +{{- if .host }} +{{- if and .useIAMAuth (not $root.Values.database.writer.useIAMAuth) }} +{{- fail "database.reader.useIAMAuth requires database.writer.useIAMAuth: true (the proxy gates IAM URL minting on IAM_TOKEN_DB_AUTH, which is only set by the writer)" }} +{{- end }} +- name: DATABASE_HOST_READ_REPLICA + value: {{ .host | quote }} +- name: DATABASE_PORT_READ_REPLICA + value: {{ .port | default 5432 | quote }} +- name: DATABASE_NAME_READ_REPLICA + value: {{ required "database.reader.dbname is required when database.reader.host is set" .dbname | quote }} +{{- if .schema }} +- name: DATABASE_SCHEMA_READ_REPLICA + value: {{ .schema | quote }} +{{- end }} +{{- if .useIAMAuth }} +{{- if .passwordSecret.name }} +- name: DATABASE_USER_READ_REPLICA + valueFrom: + secretKeyRef: + name: {{ .passwordSecret.name }} + key: {{ .passwordSecret.usernameKey | default "username" }} +{{- end }} +{{- else }} +{{- if not .passwordSecret.name }} +{{- fail "database.reader.passwordSecret.name is required when database.reader.host is set" }} +{{- end }} +- name: DATABASE_USER_READ_REPLICA + valueFrom: + secretKeyRef: + name: {{ .passwordSecret.name }} + key: {{ .passwordSecret.usernameKey | default "username" }} +- name: DATABASE_PASSWORD_READ_REPLICA + valueFrom: + secretKeyRef: + name: {{ .passwordSecret.name }} + key: {{ .passwordSecret.passwordKey | default "password" }} +{{- end }} +{{- end }} +{{- end }} +{{/* +The migrations Job (helm.sh/hook: pre-upgrade) is the single owner of +`prisma migrate deploy`. Without this, every gateway/backend pod also runs +Prisma schema-update on startup and contends with the Job — and with each +other — for Prisma's Postgres advisory lock on the writer, which makes the +Job's `migrate deploy` intermittently block until its per-attempt timeout +and retry-exhaust. The Job's entrypoint (migrations/run.py) does not import +proxy_server and never reads DISABLE_SCHEMA_UPDATE, so emitting it here is a +harmless no-op for the Job and authoritative for the app pods. +*/}} +- name: DISABLE_SCHEMA_UPDATE + value: "true" +{{- if $root.Values.redis.host }} +- name: REDIS_HOST + value: {{ $root.Values.redis.host | quote }} +- name: REDIS_PORT + value: {{ $root.Values.redis.port | quote }} +{{- if $root.Values.redis.passwordSecret.name }} +- name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $root.Values.redis.passwordSecret.name }} + key: {{ $root.Values.redis.passwordSecret.passwordKey | default "password" }} +{{- end }} +{{- if $root.Values.redis.cluster }} +{{/* The proxy's Cache() reads REDIS_CLUSTER_NODES as JSON and constructs a + RedisClusterCache when it's set (litellm/caching/caching.py:169-192). + We seed with the single configured endpoint — the cluster client + discovers the remaining nodes from CLUSTER SLOTS at startup. */}} +- name: REDIS_CLUSTER_NODES + value: {{ printf "[{\"host\":%q,\"port\":%v}]" $root.Values.redis.host (int $root.Values.redis.port) | quote }} +{{- end }} +{{- end }} +{{- with $component.extraEnv }} +{{ toYaml . }} +{{- end }} +{{- end -}} + +{{/* +Renders `envFrom:` block for a component's `envConfigMaps` / `envSecrets` +lists. Each entry is a resource name; the chart wires the whole ConfigMap / +Secret into the container's env via configMapRef / secretRef. + +Invoke with just the component dict, e.g. `.Values.gateway`. Emits nothing +when both lists are empty so the container spec stays clean. +*/}} +{{- define "litellm.envFrom" -}} +{{- $component := . -}} +{{- if or $component.envConfigMaps $component.envSecrets }} +envFrom: +{{- range $component.envConfigMaps }} + - configMapRef: + name: {{ . }} +{{- end }} +{{- range $component.envSecrets }} + - secretRef: + name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} diff --git a/helm/litellm/templates/backend/deployment.yaml b/helm/litellm/templates/backend/deployment.yaml new file mode 100644 index 00000000000..e761409f8c4 --- /dev/null +++ b/helm/litellm/templates/backend/deployment.yaml @@ -0,0 +1,60 @@ +{{- if .Values.backend.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "litellm.backend.fullname" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + app.kubernetes.io/component: backend +spec: + selector: + matchLabels: + {{- include "litellm.backend.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.backend.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "litellm.backend.selectorLabels" . | nindent 8 }} + spec: + serviceAccountName: {{ include "litellm.serviceAccountName" . }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: backend + image: "{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.backend.image.pullPolicy }} + ports: + - name: http + containerPort: 4001 + protocol: TCP + env: + {{- include "litellm.serverEnv" (dict "root" $ "component" .Values.backend) | nindent 12 }} + {{- include "litellm.envFrom" .Values.backend | nindent 10 }} + {{- with .Values.backend.livenessProbe }} + livenessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.backend.readinessProbe }} + readinessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + resources: + {{- toYaml .Values.backend.resources | nindent 12 }} + {{- with .Values.backend.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.backend.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.backend.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/helm/litellm/templates/backend/hpa.yaml b/helm/litellm/templates/backend/hpa.yaml new file mode 100644 index 00000000000..d02f011d0bb --- /dev/null +++ b/helm/litellm/templates/backend/hpa.yaml @@ -0,0 +1,33 @@ +{{- if and .Values.backend.enabled .Values.backend.hpa.enabled }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "litellm.backend.fullname" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + app.kubernetes.io/component: backend +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "litellm.backend.fullname" . }} + minReplicas: {{ .Values.backend.hpa.minReplicas }} + maxReplicas: {{ .Values.backend.hpa.maxReplicas }} + metrics: + {{- if .Values.backend.hpa.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.backend.hpa.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.backend.hpa.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ .Values.backend.hpa.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/helm/litellm/templates/backend/service.yaml b/helm/litellm/templates/backend/service.yaml new file mode 100644 index 00000000000..d480c654784 --- /dev/null +++ b/helm/litellm/templates/backend/service.yaml @@ -0,0 +1,18 @@ +{{- if .Values.backend.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "litellm.backend.fullname" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + app.kubernetes.io/component: backend +spec: + type: {{ .Values.backend.service.type }} + ports: + - port: {{ .Values.backend.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "litellm.backend.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/helm/litellm/templates/gateway/configmap.yaml b/helm/litellm/templates/gateway/configmap.yaml new file mode 100644 index 00000000000..d262bf25b87 --- /dev/null +++ b/helm/litellm/templates/gateway/configmap.yaml @@ -0,0 +1,9 @@ +{{- if .Values.gateway.config.create }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "litellm.gateway.fullname" . }}-config +data: + config.yaml: | +{{ .Values.gateway.config.proxy_config | toYaml | indent 6 }} +{{- end }} diff --git a/helm/litellm/templates/gateway/deployment.yaml b/helm/litellm/templates/gateway/deployment.yaml new file mode 100644 index 00000000000..935d432342e --- /dev/null +++ b/helm/litellm/templates/gateway/deployment.yaml @@ -0,0 +1,83 @@ +{{- if .Values.gateway.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "litellm.gateway.fullname" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + app.kubernetes.io/component: gateway +spec: + selector: + matchLabels: + {{- include "litellm.gateway.selectorLabels" . | nindent 6 }} + template: + metadata: + annotations: + {{- if .Values.gateway.config.create }} + checksum/config: {{ include (print $.Template.BasePath "/gateway/configmap.yaml") . | sha256sum }} + {{- end }} + {{- with .Values.gateway.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "litellm.gateway.selectorLabels" . | nindent 8 }} + spec: + serviceAccountName: {{ include "litellm.serviceAccountName" . }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: gateway + image: "{{ .Values.gateway.image.repository }}:{{ .Values.gateway.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.gateway.image.pullPolicy }} + ports: + - name: http + containerPort: 4000 + protocol: TCP + env: + {{- include "litellm.serverEnv" (dict "root" $ "component" .Values.gateway) | nindent 12 }} + {{- if .Values.gateway.config.create }} + - name: CONFIG_FILE_PATH + value: /app/config/config.yaml + {{- end }} + {{- if .Values.gateway.numWorkers }} + - name: NUM_WORKERS + value: {{ .Values.gateway.numWorkers | quote }} + {{- end }} + {{- include "litellm.envFrom" .Values.gateway | nindent 10 }} + {{- if .Values.gateway.config.create }} + volumeMounts: + - name: gateway-config + mountPath: /app/config/config.yaml + subPath: config.yaml + {{- end }} + {{- with .Values.gateway.livenessProbe }} + livenessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.gateway.readinessProbe }} + readinessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + resources: + {{- toYaml .Values.gateway.resources | nindent 12 }} + {{- if .Values.gateway.config.create }} + volumes: + - name: gateway-config + configMap: + name: {{ include "litellm.gateway.fullname" . }}-config + {{- end }} + {{- with .Values.gateway.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.gateway.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.gateway.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/helm/litellm/templates/gateway/hpa.yaml b/helm/litellm/templates/gateway/hpa.yaml new file mode 100644 index 00000000000..27c4f05ba59 --- /dev/null +++ b/helm/litellm/templates/gateway/hpa.yaml @@ -0,0 +1,33 @@ +{{- if and .Values.gateway.enabled .Values.gateway.hpa.enabled }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "litellm.gateway.fullname" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + app.kubernetes.io/component: gateway +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "litellm.gateway.fullname" . }} + minReplicas: {{ .Values.gateway.hpa.minReplicas }} + maxReplicas: {{ .Values.gateway.hpa.maxReplicas }} + metrics: + {{- if .Values.gateway.hpa.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.gateway.hpa.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.gateway.hpa.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ .Values.gateway.hpa.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/helm/litellm/templates/gateway/service.yaml b/helm/litellm/templates/gateway/service.yaml new file mode 100644 index 00000000000..03a4167a0ab --- /dev/null +++ b/helm/litellm/templates/gateway/service.yaml @@ -0,0 +1,18 @@ +{{- if .Values.gateway.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "litellm.gateway.fullname" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + app.kubernetes.io/component: gateway +spec: + type: {{ .Values.gateway.service.type }} + ports: + - port: {{ .Values.gateway.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "litellm.gateway.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/helm/litellm/templates/ingress.yaml b/helm/litellm/templates/ingress.yaml new file mode 100644 index 00000000000..30a8e7c974b --- /dev/null +++ b/helm/litellm/templates/ingress.yaml @@ -0,0 +1,153 @@ +{{- if .Values.ingress.enabled -}} +{{- $gatewayName := include "litellm.gateway.fullname" . -}} +{{- $backendName := include "litellm.backend.fullname" . -}} +{{- $uiName := include "litellm.ui.fullname" . -}} +{{- $gatewayPort := .Values.gateway.service.port -}} +{{- $backendPort := .Values.backend.service.port -}} +{{- $uiPort := .Values.ui.service.port -}} +{{/* + Gateway data-plane prefixes — must mirror gateway/routes/allowlist.py. + Versioned paths are listed explicitly to avoid routing management routes + (e.g. /v1/access_group, /v2/key/info, /v1/tool/*, /v1/agents, /v1/workflows, + /v2/user/info, /v2/team/list, /v2/model/info, /v2/login, /v2/guardrails/*, + /v1/mcp/*) onto the gateway via a broad /v1 or /v2 prefix. +*/}} +{{- $gatewayPrefixes := list + "/v1/chat" "/chat" "/v1/completions" "/completions" "/v1/embeddings" "/embeddings" + "/v1/moderations" "/moderations" "/v1/audio" "/audio" "/v1/images" "/images" + "/v1/files" "/files" "/v1/batches" "/batches" "/v1/fine_tuning" "/fine_tuning" + "/v1/fine-tuning" "/fine-tuning" "/v1/responses" "/responses" "/v1/threads" "/threads" + "/v1/assistants" "/assistants" "/v1/vector_stores" "/vector_stores" "/v1/indexes" + "/v1/models" "/models" "/openai" "/engines" + "/v1/messages" "/messages" "/v1/skills" "/v1/a2a" + "/v1/rerank" "/v2/rerank" "/rerank" "/v1/ocr" "/ocr" "/v1/rag" "/rag" + "/v1/video" "/v1/videos" "/video" "/videos" "/v1/search" "/search" + "/v1/containers" "/containers" "/v1/evals" "/v1/memory" "/queue/chat" + "/v1beta" "/interactions" + "/anthropic" "/azure" "/azure_ai" "/aws" "/bedrock" "/cohere" "/gemini" "/google" + "/vertex_ai" "/vertex-ai" "/assemblyai" "/eu.assemblyai" "/langfuse" "/vllm" + "/mistral" "/groq" "/voyage" "/cursor" "/milvus" "/openai_passthrough" + "/toolset" + "/v1/realtime" "/realtime" + "/health" "/metrics" +-}} +{{/* + /test is gateway-only as an EXACT path (GATEWAY_EXACT_PATHS), but its + children /test/connection and /test/tools/list are MCP-server management + endpoints kept only on the backend ("/test/" in BACKEND_PATH_PREFIXES). + A Prefix match here would route /test/* to the gateway, which trims those + routes at startup -> 404. So /test is rendered as a standalone Exact path + and /test/* falls through to the backend catch-all. +*/}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "litellm.fullname" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.ingress.className }} + ingressClassName: {{ . | quote }} + {{- end }} + {{- with .Values.ingress.tls }} + tls: + {{- toYaml . | nindent 4 }} + {{- end }} + rules: + - {{- with .Values.ingress.host }} + host: {{ . | quote }} + {{- end }} + http: + paths: + # --- UI (Next.js static export) --- + - path: / + pathType: Exact + backend: + service: + name: {{ $uiName }} + port: + number: {{ $uiPort }} + - path: /favicon.ico + pathType: Exact + backend: + service: + name: {{ $uiName }} + port: + number: {{ $uiPort }} + - path: /litellm-asset-prefix + pathType: Prefix + backend: + service: + name: {{ $uiName }} + port: + number: {{ $uiPort }} + - path: /_next + pathType: Prefix + backend: + service: + name: {{ $uiName }} + port: + number: {{ $uiPort }} + # /ui/* is where the Next.js SPA serves its login + dashboard + # routes (e.g. /ui/login). Without this, /ui/* falls into the + # catch-all → backend → 404. + - path: /ui + pathType: Prefix + backend: + service: + name: {{ $uiName }} + port: + number: {{ $uiPort }} + # Next.js App Router (output: "export", basePath: "") emits the + # RSC/flight payload for every route as a ROOT-level .txt + # (/index.txt, /teams.txt, /__next._tree.txt, ...). The client + # router fetches these on every soft navigation / prefetch as + # .txt?_rsc= (the query string is irrelevant to path + # matching). They are not under /ui, /_next, or + # /litellm-asset-prefix, so without this rule they fall to the + # backend catch-all → 404 → client-side navigation never settles + # and the login flow spins in an infinite redirect loop + # (/ ⇄ /ui/login). ui/nginx.conf already serves *.txt from the + # export; this rule only routes the request to it. Needs an + # ingress controller whose ImplementationSpecific path is a + # wildcard pattern (AWS ALB: `*` = 0+ chars); this chart targets + # the AWS Load Balancer Controller. + - path: /*.txt + pathType: ImplementationSpecific + backend: + service: + name: {{ $uiName }} + port: + number: {{ $uiPort }} + # --- Gateway data plane --- + # Exact /test only (see the $gatewayPrefixes comment above); + # /test/* MCP management endpoints fall to the backend catch-all. + - path: /test + pathType: Exact + backend: + service: + name: {{ $gatewayName }} + port: + number: {{ $gatewayPort }} + {{- range $gatewayPrefixes }} + - path: {{ . }} + pathType: Prefix + backend: + service: + name: {{ $gatewayName }} + port: + number: {{ $gatewayPort }} + {{- end }} + # --- Catch-all → backend (management API: /key/*, /user/*, /team/*, ...) --- + - path: / + pathType: Prefix + backend: + service: + name: {{ $backendName }} + port: + number: {{ $backendPort }} +{{- end }} diff --git a/helm/litellm/templates/migrations-job.yaml b/helm/litellm/templates/migrations-job.yaml new file mode 100644 index 00000000000..f3dc2ae0236 --- /dev/null +++ b/helm/litellm/templates/migrations-job.yaml @@ -0,0 +1,46 @@ +{{- if .Values.migrationJob.enabled -}} +# Pre-install / pre-upgrade hook that runs `prisma migrate deploy` against +# the writer database before the gateway and backend Deployments are rolled +# out. Required because the gateway and backend both spin up Prisma at +# startup and assume the LiteLLM schema (LiteLLM_Config, +# LiteLLM_VerificationToken, LiteLLM_SpendLogs, ...) already exists. +# +# Running this pre-upgrade closes the window where new application pods would +# otherwise serve traffic against the previous release's unmigrated schema. +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "litellm.fullname" . }}-migrations + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + app.kubernetes.io/component: migrations + annotations: + helm.sh/hook: pre-install,pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "0" +spec: + backoffLimit: {{ .Values.migrationJob.backoffLimit }} + ttlSecondsAfterFinished: {{ .Values.migrationJob.ttlSecondsAfterFinished }} + template: + metadata: + labels: + {{- include "litellm.commonLabels" . | nindent 8 }} + app.kubernetes.io/component: migrations + spec: + restartPolicy: Never + serviceAccountName: {{ include "litellm.serviceAccountName" . }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: prisma-migrations + image: "{{ .Values.migrationJob.image.repository }}:{{ .Values.migrationJob.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.migrationJob.image.pullPolicy }} + env: + {{- include "litellm.serverEnv" (dict "root" $ "component" .Values.migrationJob) | nindent 12 }} + {{- with .Values.migrationJob.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} +{{- end }} diff --git a/helm/litellm/templates/serviceaccount.yaml b/helm/litellm/templates/serviceaccount.yaml new file mode 100644 index 00000000000..3c998448ae5 --- /dev/null +++ b/helm/litellm/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "litellm.serviceAccountName" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} +{{- end }} diff --git a/helm/litellm/templates/ui/deployment.yaml b/helm/litellm/templates/ui/deployment.yaml new file mode 100644 index 00000000000..549bf61a0dd --- /dev/null +++ b/helm/litellm/templates/ui/deployment.yaml @@ -0,0 +1,70 @@ +{{- if .Values.ui.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "litellm.ui.fullname" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + app.kubernetes.io/component: ui +spec: + selector: + matchLabels: + {{- include "litellm.ui.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.ui.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "litellm.ui.selectorLabels" . | nindent 8 }} + spec: + serviceAccountName: {{ include "litellm.serviceAccountName" . }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: ui + image: "{{ .Values.ui.image.repository }}:{{ .Values.ui.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.ui.image.pullPolicy }} + ports: + - name: http + containerPort: 3000 + protocol: TCP + env: + {{- if .Values.ui.logLevel }} + - name: LITELLM_LOG + value: {{ .Values.ui.logLevel | quote }} + {{- end }} + {{- if .Values.ui.backendUrl }} + - name: LITELLM_BACKEND_URL + value: {{ .Values.ui.backendUrl | quote }} + {{- end }} + {{- with .Values.ui.extraEnv }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- include "litellm.envFrom" .Values.ui | nindent 10 }} + {{- with .Values.ui.livenessProbe }} + livenessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.ui.readinessProbe }} + readinessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + resources: + {{- toYaml .Values.ui.resources | nindent 12 }} + {{- with .Values.ui.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.ui.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.ui.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/helm/litellm/templates/ui/hpa.yaml b/helm/litellm/templates/ui/hpa.yaml new file mode 100644 index 00000000000..b43eda5ac4a --- /dev/null +++ b/helm/litellm/templates/ui/hpa.yaml @@ -0,0 +1,33 @@ +{{- if and .Values.ui.enabled .Values.ui.hpa.enabled }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "litellm.ui.fullname" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + app.kubernetes.io/component: ui +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "litellm.ui.fullname" . }} + minReplicas: {{ .Values.ui.hpa.minReplicas }} + maxReplicas: {{ .Values.ui.hpa.maxReplicas }} + metrics: + {{- if .Values.ui.hpa.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.ui.hpa.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.ui.hpa.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ .Values.ui.hpa.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/helm/litellm/templates/ui/service.yaml b/helm/litellm/templates/ui/service.yaml new file mode 100644 index 00000000000..52b539fa00c --- /dev/null +++ b/helm/litellm/templates/ui/service.yaml @@ -0,0 +1,18 @@ +{{- if .Values.ui.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "litellm.ui.fullname" . }} + labels: + {{- include "litellm.commonLabels" . | nindent 4 }} + app.kubernetes.io/component: ui +spec: + type: {{ .Values.ui.service.type }} + ports: + - port: {{ .Values.ui.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "litellm.ui.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/helm/litellm/values.yaml b/helm/litellm/values.yaml new file mode 100644 index 00000000000..92477616a9a --- /dev/null +++ b/helm/litellm/values.yaml @@ -0,0 +1,225 @@ +# LiteLLM helm chart values + +nameOverride: "" +fullnameOverride: "" + +imagePullSecrets: [] + +# Optional Ingress wiring the three component Services behind a single L7 +# entrypoint. Required when serving the static UI bundle over the network. +ingress: + enabled: false + className: "" + annotations: {} + host: "" # optional; if set, becomes the rule's host + tls: [] + +# Shared ServiceAccount used by all three component Deployments. Set +# `create: true` to have the chart provision it (e.g. when wiring an EKS +# Pod Identity association by SA name). Set `name` to use an existing SA +# (chart-created or out-of-band). When both are empty / false, pods run +# with the namespace's `default` SA. +serviceAccount: + create: false + automount: true + annotations: {} + name: "" + +# Pre-install / pre-upgrade Helm hook that runs `prisma migrate deploy` +# against the writer database, creating the LiteLLM schema (tables that +# gateway + backend assume exist at startup: LiteLLM_Config, +# LiteLLM_VerificationToken, LiteLLM_SpendLogs, ...). Disable if your +# pipeline runs migrations out-of-band. +# +# Uses a dedicated `litellm-migrations` image (prisma CLI + the migration +# files from `litellm-proxy-extras`) instead of the backend image, so the +# Job doesn't drag in the rest of the proxy and doesn't run `prisma +# generate` — the migration engine doesn't need the generated client. +migrationJob: + enabled: true + backoffLimit: 4 + ttlSecondsAfterFinished: 120 + resources: {} + image: + repository: ghcr.io/berriai/litellm-migrations + tag: "" # defaults to .Chart.AppVersion + pullPolicy: IfNotPresent + # Extra env appended to the migration container. The migration entrypoint + # uses the v2 resolver by default (no diff-and-force recovery — avoids the + # schema thrashing seen during rolling deploys). To opt back into the v1 + # resolver, append `- name: USE_V2_MIGRATION_RESOLVER` / `value: "false"`. + extraEnv: [] + +# Required: a master key used by gateway + backend to mint/verify proxy tokens. +# Must reference an existing Secret. +masterKey: + secretName: litellm-master-key-secret # name of a Secret containing the master key + secretKey: master-key + +# External Postgres connection. +database: + writer: + host: "" + port: 5432 + dbname: "" + schema: "" + useIAMAuth: false + passwordSecret: + name: litellm-writer-secret + usernameKey: username + passwordKey: password + + # Optional read-replica routing. When `reader.host` is set, the proxy routes + # reads (find_*, count, group_by, query_raw/_first) to this endpoint while + # writes stay on the writer. Leave `reader.host` empty to disable. + reader: + host: "" + port: 5432 + dbname: "" + schema: "" + useIAMAuth: false + passwordSecret: + name: litellm-reader-secret + usernameKey: username + passwordKey: password + +# Optional Redis (caching, rate limiting). Leave host empty to disable. +# +# Set `cluster: true` for Redis Cluster mode (e.g. AWS ElastiCache Cluster, +# self-hosted Redis Cluster). The chart emits REDIS_CLUSTER_NODES from +# `host` / `port` as the single seed; the cluster client discovers the +# remaining nodes from CLUSTER SLOTS at startup. +redis: + cluster: false + host: "" + port: 6379 + passwordSecret: + name: "" # Leave empty for auth-less Redis + passwordKey: password + +# ---------- gateway (LLM data plane) ---------- +gateway: + enabled: true + logLevel: INFO + # Number of uvicorn worker processes per gateway pod. Sets NUM_WORKERS, + # consumed by the gateway image entrypoint. Default is 1. + numWorkers: 1 + extraEnv: [] # Add extra environment variables to the gateway + envConfigMaps: [] # Add extra environment variables to the gateway from config maps + envSecrets: [] # Add extra environment variables to the gateway from secrets + config: + create: true + proxy_config: {} + image: + repository: ghcr.io/berriai/litellm-gateway + tag: "" # defaults to .Chart.AppVersion + pullPolicy: IfNotPresent + service: + type: ClusterIP + port: 4000 + resources: + requests: + cpu: "1" + memory: 4Gi + limits: + cpu: "2" + memory: 4Gi + livenessProbe: + httpGet: { path: /health/liveliness, port: http } + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: { path: /health/readiness, port: http } + initialDelaySeconds: 5 + periodSeconds: 10 + hpa: + enabled: true + minReplicas: 1 + maxReplicas: 10 + targetCPUUtilizationPercentage: 70 + targetMemoryUtilizationPercentage: 80 + podAnnotations: {} + nodeSelector: {} + tolerations: [] + affinity: {} + +# ---------- backend (UI / management API) ---------- +backend: + enabled: true + logLevel: INFO + extraEnv: [] + envConfigMaps: [] + envSecrets: [] + image: + repository: ghcr.io/berriai/litellm-backend + tag: "" + pullPolicy: IfNotPresent + service: + type: ClusterIP + port: 4001 + resources: + requests: + cpu: "1" + memory: 4Gi + limits: + cpu: "2" + memory: 4Gi + livenessProbe: + httpGet: { path: /health/liveliness, port: http } + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: { path: /health/readiness, port: http } + initialDelaySeconds: 5 + periodSeconds: 10 + hpa: + enabled: true + minReplicas: 1 + maxReplicas: 4 + targetCPUUtilizationPercentage: 70 + podAnnotations: {} + nodeSelector: {} + tolerations: [] + affinity: {} + +# ---------- ui (Next.js static dashboard) ---------- +ui: + enabled: true + logLevel: INFO + extraEnv: [] + envConfigMaps: [] + envSecrets: [] + image: + repository: ghcr.io/berriai/litellm-ui + tag: "" + pullPolicy: IfNotPresent + service: + type: ClusterIP + port: 3000 + # The dashboard expects to know where to reach the backend API. Set this to + # the externally-routable URL (typically the ingress host + /api or similar). + backendUrl: "" + resources: + requests: + cpu: 500m + memory: 500Mi + limits: + cpu: "1" + memory: 1Gi + livenessProbe: + httpGet: { path: /, port: http } + initialDelaySeconds: 5 + periodSeconds: 20 + readinessProbe: + httpGet: { path: /, port: http } + initialDelaySeconds: 2 + periodSeconds: 10 + hpa: + enabled: false + minReplicas: 1 + maxReplicas: 3 + targetCPUUtilizationPercentage: 80 + podAnnotations: {} + nodeSelector: {} + tolerations: [] + affinity: {} diff --git a/index.yaml b/index.yaml deleted file mode 100644 index 9b2461c36b5..00000000000 --- a/index.yaml +++ /dev/null @@ -1,108 +0,0 @@ -apiVersion: v1 -entries: - litellm-helm: - - apiVersion: v2 - appVersion: v1.43.18 - created: "2024-08-19T23:58:25.331689+08:00" - dependencies: - - condition: db.deployStandalone - name: postgresql - repository: oci://registry-1.docker.io/bitnamicharts - version: '>=13.3.0' - - condition: redis.enabled - name: redis - repository: oci://registry-1.docker.io/bitnamicharts - version: '>=18.0.0' - description: Call all LLM APIs using the OpenAI format - digest: 0411df3dc42868be8af3ad3e00cb252790e6bd7ad15f5b77f1ca5214573a8531 - name: litellm-helm - type: application - urls: - - https://berriai.github.io/litellm/litellm-helm-0.2.3.tgz - version: 0.2.3 - postgresql: - - annotations: - category: Database - images: | - - name: os-shell - image: docker.io/bitnami/os-shell:12-debian-12-r16 - - name: postgres-exporter - image: docker.io/bitnami/postgres-exporter:0.15.0-debian-12-r14 - - name: postgresql - image: docker.io/bitnami/postgresql:16.2.0-debian-12-r6 - licenses: Apache-2.0 - apiVersion: v2 - appVersion: 16.2.0 - created: "2024-08-19T23:58:25.335716+08:00" - dependencies: - - name: common - repository: oci://registry-1.docker.io/bitnamicharts - tags: - - bitnami-common - version: 2.x.x - description: PostgreSQL (Postgres) is an open source object-relational database - known for reliability and data integrity. ACID-compliant, it supports foreign - keys, joins, views, triggers and stored procedures. - digest: 3c8125526b06833df32e2f626db34aeaedb29d38f03d15349db6604027d4a167 - home: https://bitnami.com - icon: https://bitnami.com/assets/stacks/postgresql/img/postgresql-stack-220x234.png - keywords: - - postgresql - - postgres - - database - - sql - - replication - - cluster - maintainers: - - name: VMware, Inc. - url: https://github.com/bitnami/charts - name: postgresql - sources: - - https://github.com/bitnami/charts/tree/main/bitnami/postgresql - urls: - - https://berriai.github.io/litellm/charts/postgresql-14.3.1.tgz - version: 14.3.1 - redis: - - annotations: - category: Database - images: | - - name: kubectl - image: docker.io/bitnami/kubectl:1.29.2-debian-12-r3 - - name: os-shell - image: docker.io/bitnami/os-shell:12-debian-12-r16 - - name: redis - image: docker.io/bitnami/redis:7.2.4-debian-12-r9 - - name: redis-exporter - image: docker.io/bitnami/redis-exporter:1.58.0-debian-12-r4 - - name: redis-sentinel - image: docker.io/bitnami/redis-sentinel:7.2.4-debian-12-r7 - licenses: Apache-2.0 - apiVersion: v2 - appVersion: 7.2.4 - created: "2024-08-19T23:58:25.339392+08:00" - dependencies: - - name: common - repository: oci://registry-1.docker.io/bitnamicharts - tags: - - bitnami-common - version: 2.x.x - description: Redis(R) is an open source, advanced key-value store. It is often - referred to as a data structure server since keys can contain strings, hashes, - lists, sets and sorted sets. - digest: b2fa1835f673a18002ca864c54fadac3c33789b26f6c5e58e2851b0b14a8f984 - home: https://bitnami.com - icon: https://bitnami.com/assets/stacks/redis/img/redis-stack-220x234.png - keywords: - - redis - - keyvalue - - database - maintainers: - - name: VMware, Inc. - url: https://github.com/bitnami/charts - name: redis - sources: - - https://github.com/bitnami/charts/tree/main/bitnami/redis - urls: - - https://berriai.github.io/litellm/charts/redis-18.19.1.tgz - version: 18.19.1 -generated: "2024-08-19T23:58:25.322532+08:00" diff --git a/license_cache.json b/license_cache.json index 4b09afacaa3..dc061b48f4f 100644 --- a/license_cache.json +++ b/license_cache.json @@ -49,5 +49,13 @@ "grpc-google-iam-v1:0.14.3": "Apache 2.0", "h11:0.16.0": "MIT", "requests-toolbelt:1.0.0": "Apache 2.0", - "tornado:6.5.4": "Apache-2.0" + "tornado:6.5.4": "Apache-2.0", + "granian:2.5.7": "BSD-3-Clause", + "mlflow:3.11.1": "Copyright 2018 Databricks, Inc. All rights reserved.\n \n \t\t\t\tApache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n \n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n \n 1. Definitions.\n \n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n \n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n \n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n \n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n \n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n \n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n \n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n \n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n \n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n \n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n \n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n \n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n \n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n \n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n \n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n \n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n \n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n \n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n \n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n \n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n \n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n \n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n \n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n \n END OF TERMS AND CONDITIONS\n APPENDIX: How to apply the Apache License to your work.\n \n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n \n Copyright [yyyy] [name of copyright owner]\n \n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n \n http://www.apache.org/licenses/LICENSE-2.0\n \n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n ", + "nvidia-riva-client:2.15.0": "MIT", + "numpy:1.26.0": "Copyright (c) 2005-2023, NumPy Developers. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of the NumPy Developers nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ---- This binary distribution of NumPy also bundles the following software: Name: GCC runtime library Files: .dylibs/* Description: dynamically linked to files compiled with gcc Availability: https://gcc.gnu.org/viewcvs/gcc/ License: GPLv3 + runtime exception Copyright (C) 2002-2017 Free Software Foundation, Inc. Libgfortran is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. Libgfortran is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. Under Section 7 of GPL version 3, you are granted additional permissions described in the GCC Runtime Library Exception, version 3.1, as published by the Free Software Foundation. You should have received a copy of the GNU General Public License and a copy of the GCC Runtime Library Exception along with this program; see the files COPYING3 and COPYING.RUNTIME respectively. If not, see . ---- Full text of license texts referred to above follows (that they are listed below does not necessarily imply the conditions apply to the present binary release): ---- GCC RUNTIME LIBRARY EXCEPTION Version 3.1, 31 March 2009 Copyright (C) 2009 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. This GCC Runtime Library Exception (\"Exception\") is an additional permission under section 7 of the GNU General Public License, version 3 (\"GPLv3\"). It applies to a given file (the \"Runtime Library\") that bears a notice placed by the copyright holder of the file stating that the file is governed by GPLv3 along with this Exception. When you use GCC to compile a program, GCC may combine portions of certain GCC header files and runtime libraries with the compiled program. The purpose of this Exception is to allow compilation of non-GPL (including proprietary) programs to use, in this way, the header files and runtime libraries covered by this Exception. 0. Definitions. A file is an \"Independent Module\" if it either requires the Runtime Library for execution after a Compilation Process, or makes use of an interface provided by the Runtime Library, but is not otherwise based on the Runtime Library. \"GCC\" means a version of the GNU Compiler Collection, with or without modifications, governed by version 3 (or a specified later version) of the GNU General Public License (GPL) with the option of using any subsequent versions published by the FSF. \"GPL-compatible Software\" is software whose conditions of propagation, modification and use would permit combination with GCC in accord with the license of GCC. \"Target Code\" refers to output from any compiler for a real or virtual target processor architecture, in executable form or suitable for input to an assembler, loader, linker and/or execution phase. Notwithstanding that, Target Code does not include data in any format that is used as a compiler intermediate representation, or used for producing a compiler intermediate representation. The \"Compilation Process\" transforms code entirely represented in non-intermediate languages designed for human-written code, and/or in Java Virtual Machine byte code, into Target Code. Thus, for example, use of source code generators and preprocessors need not be considered part of the Compilation Process, since the Compilation Process can be understood as starting with the output of the generators or preprocessors. A Compilation Process is \"Eligible\" if it is done using GCC, alone or with other GPL-compatible software, or if it is done without using any work based on GCC. For example, using non-GPL-compatible Software to optimize any GCC intermediate representations would not qualify as an Eligible Compilation Process. 1. Grant of Additional Permission. You have permission to propagate a work of Target Code formed by combining the Runtime Library with Independent Modules, even if such propagation would otherwise violate the terms of GPLv3, provided that all Target Code was generated by Eligible Compilation Processes. You may then convey such a combination under terms of your choice, consistent with the licensing of the Independent Modules. 2. No Weakening of GCC Copyleft. The availability of this Exception does not imply any general presumption that third-party software is unaffected by the copyleft requirements of the license of GCC. ---- GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. \"This License\" refers to version 3 of the GNU General Public License. \"Copyright\" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. \"The Program\" refers to any copyrightable work licensed under this License. Each licensee is addressed as \"you\". \"Licensees\" and \"recipients\" may be individuals or organizations. To \"modify\" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a \"modified version\" of the earlier work or a work \"based on\" the earlier work. A \"covered work\" means either the unmodified Program or a work based on the Program. To \"propagate\" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To \"convey\" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays \"Appropriate Legal Notices\" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The \"source code\" for a work means the preferred form of the work for making modifications to it. \"Object code\" means any non-source form of a work. A \"Standard Interface\" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The \"System Libraries\" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A \"Major Component\", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The \"Corresponding Source\" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to \"keep intact all notices\". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an \"aggregate\" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A \"User Product\" is either (1) a \"consumer product\", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, \"normally used\" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. \"Installation Information\" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. \"Additional permissions\" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered \"further restrictions\" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An \"entity transaction\" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A \"contributor\" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's \"contributor version\". A contributor's \"essential patent claims\" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, \"control\" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a \"patent license\" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To \"grant\" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. \"Knowingly relying\" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is \"discriminatory\" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License \"or any later version\" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM \"AS IS\" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the \"copyright\" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: Copyright (C) This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an \"about box\". You should also get your employer (if you work as a programmer) or school, if any, to sign a \"copyright disclaimer\" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read .", + "vcrpy:8.1.1": "MIT", + "langchain-openai:1.1.14": "MIT", + "grpc-google-iam-v1:0.14.4": "Apache 2.0", + "tornado:6.5.5": "Apache-2.0" } \ No newline at end of file diff --git a/litellm-js/proxy/.npmrc b/litellm-js/proxy/.npmrc deleted file mode 100644 index 7999681cc35..00000000000 --- a/litellm-js/proxy/.npmrc +++ /dev/null @@ -1,5 +0,0 @@ -# Supply-chain hardening -# Packages needing lifecycle scripts: npm rebuild -ignore-scripts=true -# Protects local npm install only — npm ci (used in CI) ignores this -min-release-age=3 diff --git a/litellm-js/proxy/README.md b/litellm-js/proxy/README.md deleted file mode 100644 index cc58e962d8f..00000000000 --- a/litellm-js/proxy/README.md +++ /dev/null @@ -1,8 +0,0 @@ -``` -npm install -npm run dev -``` - -``` -npm run deploy -``` diff --git a/litellm-js/proxy/package-lock.json b/litellm-js/proxy/package-lock.json deleted file mode 100644 index 0d09fa1a6c4..00000000000 --- a/litellm-js/proxy/package-lock.json +++ /dev/null @@ -1,2054 +0,0 @@ -{ - "name": "proxy", - "lockfileVersion": 3, - "requires": true, - "packages": { - "": { - "dependencies": { - "hono": "4.12.16", - "openai": "4.29.2" - }, - "devDependencies": { - "@cloudflare/workers-types": "4.20260501.1", - "wrangler": "4.87.0" - } - }, - "node_modules/@cloudflare/kv-asset-handler": { - "version": "0.5.0", - "resolved": "https://registry.npmjs.org/@cloudflare/kv-asset-handler/-/kv-asset-handler-0.5.0.tgz", - "integrity": "sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg==", - "dev": true, - "license": "MIT OR Apache-2.0", - "engines": { - "node": ">=22.0.0" - } - }, - "node_modules/@cloudflare/unenv-preset": { - "version": "2.16.1", - "resolved": "https://registry.npmjs.org/@cloudflare/unenv-preset/-/unenv-preset-2.16.1.tgz", - "integrity": "sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw==", - "dev": true, - "license": "MIT OR Apache-2.0", - "peerDependencies": { - "unenv": "2.0.0-rc.24", - "workerd": ">1.20260305.0 <2.0.0-0" - }, - "peerDependenciesMeta": { - "workerd": { - "optional": true - } - } - }, - "node_modules/@cloudflare/workerd-darwin-64": { - "version": "1.20260430.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260430.1.tgz", - "integrity": "sha512-ADohZUHf7NBvPp2PdZig2Opxx+hDkk3ve7jrTne3JRx9kDSB73zc4LzcEeEN8LKkbAcqZmvfRJfpChSlusu0lA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=16" - } - }, - "node_modules/@cloudflare/workerd-darwin-arm64": { - "version": "1.20260430.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20260430.1.tgz", - "integrity": "sha512-/DoYC/1wHs+YRZzzqSQg1/EHB4hiv1yV5U8FnmapRRIzVaPtnt+ApeOXeMrIdKidgKOI8TqQzgBU8xbIM7Cl4Q==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=16" - } - }, - "node_modules/@cloudflare/workerd-linux-64": { - "version": "1.20260430.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20260430.1.tgz", - "integrity": "sha512-koJhBWvEVZPKCVFtMLp2iMHlYr+lFCF47wGbnlKdHVlemV0zTxJEyHI8aLlrhPLhBmOmYLp46rXw09/qJkRIhQ==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=16" - } - }, - "node_modules/@cloudflare/workerd-linux-arm64": { - "version": "1.20260430.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20260430.1.tgz", - "integrity": "sha512-hMdapNAzNQZDXGGkg4Slydc3fRJP5FUZLJVVcZCW/+imhhJro9Z1rv5n/wfR+txKoSWhTYR8eOp8Pyi2bzLzlw==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=16" - } - }, - "node_modules/@cloudflare/workerd-windows-64": { - "version": "1.20260430.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20260430.1.tgz", - "integrity": "sha512-jS3ffixjb5USOwz4frw4WzCz0HrjVxkgyU3WiYb06N7hBAfN6eOrveAJ4QRef0+suK4V1vQFoB1oKdRBsXe9Dw==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=16" - } - }, - "node_modules/@cloudflare/workers-types": { - "version": "4.20260501.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workers-types/-/workers-types-4.20260501.1.tgz", - "integrity": "sha512-B/VX2w3my/sCqxKyWOX7SxUpFC1uD8Gh7I2zbI1d3zA8p7Tx03AFsnuEx8lYLmcd8yONAA93YsAZb1wAaLK83w==", - "dev": true, - "license": "MIT OR Apache-2.0" - }, - "node_modules/@cspotcode/source-map-support": { - "version": "0.8.1", - "resolved": "https://registry.npmjs.org/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz", - "integrity": "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==", - "dev": true, - "license": "MIT", - "dependencies": { - "@jridgewell/trace-mapping": "0.3.9" - }, - "engines": { - "node": ">=12" - } - }, - "node_modules/@emnapi/runtime": { - "version": "1.10.0", - "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz", - "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==", - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "tslib": "^2.4.0" - } - }, - "node_modules/@esbuild/aix-ppc64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz", - "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==", - "cpu": [ - "ppc64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "aix" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/android-arm": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz", - "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==", - "cpu": [ - "arm" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/android-arm64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz", - "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/android-x64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz", - "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/darwin-arm64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz", - "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/darwin-x64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz", - "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/freebsd-arm64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz", - "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/freebsd-x64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz", - "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-arm": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz", - "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==", - "cpu": [ - "arm" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-arm64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz", - "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-ia32": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz", - "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==", - "cpu": [ - "ia32" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-loong64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz", - "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==", - "cpu": [ - "loong64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-mips64el": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz", - "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==", - "cpu": [ - "mips64el" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-ppc64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz", - "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==", - "cpu": [ - "ppc64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-riscv64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz", - "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==", - "cpu": [ - "riscv64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-s390x": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz", - "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==", - "cpu": [ - "s390x" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-x64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz", - "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/netbsd-arm64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz", - "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "netbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/netbsd-x64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz", - "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "netbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/openbsd-arm64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz", - "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "openbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/openbsd-x64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz", - "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "openbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/openharmony-arm64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz", - "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "openharmony" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/sunos-x64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz", - "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "sunos" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/win32-arm64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz", - "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/win32-ia32": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz", - "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==", - "cpu": [ - "ia32" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/win32-x64": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz", - "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@img/colour": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz", - "integrity": "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=18" - } - }, - "node_modules/@img/sharp-darwin-arm64": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.5.tgz", - "integrity": "sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-libvips-darwin-arm64": "1.2.4" - } - }, - "node_modules/@img/sharp-darwin-x64": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.5.tgz", - "integrity": "sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-libvips-darwin-x64": "1.2.4" - } - }, - "node_modules/@img/sharp-libvips-darwin-arm64": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.4.tgz", - "integrity": "sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "LGPL-3.0-or-later", - "optional": true, - "os": [ - "darwin" - ], - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-libvips-darwin-x64": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.4.tgz", - "integrity": "sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "LGPL-3.0-or-later", - "optional": true, - "os": [ - "darwin" - ], - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-libvips-linux-arm": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.4.tgz", - "integrity": "sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==", - "cpu": [ - "arm" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "LGPL-3.0-or-later", - "optional": true, - "os": [ - "linux" - ], - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-libvips-linux-arm64": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.4.tgz", - "integrity": "sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==", - "cpu": [ - "arm64" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "LGPL-3.0-or-later", - "optional": true, - "os": [ - "linux" - ], - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-libvips-linux-ppc64": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.2.4.tgz", - "integrity": "sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==", - "cpu": [ - "ppc64" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "LGPL-3.0-or-later", - "optional": true, - "os": [ - "linux" - ], - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-libvips-linux-riscv64": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.2.4.tgz", - "integrity": "sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==", - "cpu": [ - "riscv64" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "LGPL-3.0-or-later", - "optional": true, - "os": [ - "linux" - ], - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-libvips-linux-s390x": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.2.4.tgz", - "integrity": "sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==", - "cpu": [ - "s390x" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "LGPL-3.0-or-later", - "optional": true, - "os": [ - "linux" - ], - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-libvips-linux-x64": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.2.4.tgz", - "integrity": "sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==", - "cpu": [ - "x64" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "LGPL-3.0-or-later", - "optional": true, - "os": [ - "linux" - ], - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-libvips-linuxmusl-arm64": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.2.4.tgz", - "integrity": "sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==", - "cpu": [ - "arm64" - ], - "dev": true, - "libc": [ - "musl" - ], - "license": "LGPL-3.0-or-later", - "optional": true, - "os": [ - "linux" - ], - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-libvips-linuxmusl-x64": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.4.tgz", - "integrity": "sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==", - "cpu": [ - "x64" - ], - "dev": true, - "libc": [ - "musl" - ], - "license": "LGPL-3.0-or-later", - "optional": true, - "os": [ - "linux" - ], - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-linux-arm": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.5.tgz", - "integrity": "sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==", - "cpu": [ - "arm" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-libvips-linux-arm": "1.2.4" - } - }, - "node_modules/@img/sharp-linux-arm64": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.5.tgz", - "integrity": "sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==", - "cpu": [ - "arm64" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-libvips-linux-arm64": "1.2.4" - } - }, - "node_modules/@img/sharp-linux-ppc64": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.34.5.tgz", - "integrity": "sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==", - "cpu": [ - "ppc64" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-libvips-linux-ppc64": "1.2.4" - } - }, - "node_modules/@img/sharp-linux-riscv64": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.34.5.tgz", - "integrity": "sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==", - "cpu": [ - "riscv64" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-libvips-linux-riscv64": "1.2.4" - } - }, - "node_modules/@img/sharp-linux-s390x": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.5.tgz", - "integrity": "sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==", - "cpu": [ - "s390x" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-libvips-linux-s390x": "1.2.4" - } - }, - "node_modules/@img/sharp-linux-x64": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.5.tgz", - "integrity": "sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==", - "cpu": [ - "x64" - ], - "dev": true, - "libc": [ - "glibc" - ], - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-libvips-linux-x64": "1.2.4" - } - }, - "node_modules/@img/sharp-linuxmusl-arm64": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.5.tgz", - "integrity": "sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==", - "cpu": [ - "arm64" - ], - "dev": true, - "libc": [ - "musl" - ], - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-libvips-linuxmusl-arm64": "1.2.4" - } - }, - "node_modules/@img/sharp-linuxmusl-x64": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.5.tgz", - "integrity": "sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==", - "cpu": [ - "x64" - ], - "dev": true, - "libc": [ - "musl" - ], - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-libvips-linuxmusl-x64": "1.2.4" - } - }, - "node_modules/@img/sharp-wasm32": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.34.5.tgz", - "integrity": "sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==", - "cpu": [ - "wasm32" - ], - "dev": true, - "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT", - "optional": true, - "dependencies": { - "@emnapi/runtime": "^1.7.0" - }, - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-win32-arm64": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.5.tgz", - "integrity": "sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "Apache-2.0 AND LGPL-3.0-or-later", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-win32-ia32": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.5.tgz", - "integrity": "sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==", - "cpu": [ - "ia32" - ], - "dev": true, - "license": "Apache-2.0 AND LGPL-3.0-or-later", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@img/sharp-win32-x64": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.5.tgz", - "integrity": "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0 AND LGPL-3.0-or-later", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - } - }, - "node_modules/@jridgewell/resolve-uri": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz", - "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6.0.0" - } - }, - "node_modules/@jridgewell/sourcemap-codec": { - "version": "1.5.5", - "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz", - "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==", - "dev": true, - "license": "MIT" - }, - "node_modules/@jridgewell/trace-mapping": { - "version": "0.3.9", - "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.9.tgz", - "integrity": "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "@jridgewell/resolve-uri": "^3.0.3", - "@jridgewell/sourcemap-codec": "^1.4.10" - } - }, - "node_modules/@poppinss/colors": { - "version": "4.1.6", - "resolved": "https://registry.npmjs.org/@poppinss/colors/-/colors-4.1.6.tgz", - "integrity": "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg==", - "dev": true, - "license": "MIT", - "dependencies": { - "kleur": "^4.1.5" - } - }, - "node_modules/@poppinss/dumper": { - "version": "0.6.5", - "resolved": "https://registry.npmjs.org/@poppinss/dumper/-/dumper-0.6.5.tgz", - "integrity": "sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw==", - "dev": true, - "license": "MIT", - "dependencies": { - "@poppinss/colors": "^4.1.5", - "@sindresorhus/is": "^7.0.2", - "supports-color": "^10.0.0" - } - }, - "node_modules/@poppinss/exception": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/@poppinss/exception/-/exception-1.2.3.tgz", - "integrity": "sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==", - "dev": true, - "license": "MIT" - }, - "node_modules/@sindresorhus/is": { - "version": "7.2.0", - "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-7.2.0.tgz", - "integrity": "sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sindresorhus/is?sponsor=1" - } - }, - "node_modules/@speed-highlight/core": { - "version": "1.2.15", - "resolved": "https://registry.npmjs.org/@speed-highlight/core/-/core-1.2.15.tgz", - "integrity": "sha512-BMq1K3DsElxDWawkX6eLg9+CKJrTVGCBAWVuHXVUV2u0s2711qiChLSId6ikYPfxhdYocLNt3wWwSvDiTvFabw==", - "dev": true, - "license": "CC0-1.0" - }, - "node_modules/@types/node": { - "version": "18.19.130", - "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.130.tgz", - "integrity": "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==", - "license": "MIT", - "dependencies": { - "undici-types": "~5.26.4" - } - }, - "node_modules/@types/node-fetch": { - "version": "2.6.13", - "resolved": "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.6.13.tgz", - "integrity": "sha512-QGpRVpzSaUs30JBSGPjOg4Uveu384erbHBoT1zeONvyCfwQxIkUshLAOqN/k9EjGviPRmWTTe6aH2qySWKTVSw==", - "license": "MIT", - "dependencies": { - "@types/node": "*", - "form-data": "^4.0.4" - } - }, - "node_modules/abort-controller": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz", - "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==", - "license": "MIT", - "dependencies": { - "event-target-shim": "^5.0.0" - }, - "engines": { - "node": ">=6.5" - } - }, - "node_modules/agentkeepalive": { - "version": "4.6.0", - "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.6.0.tgz", - "integrity": "sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ==", - "license": "MIT", - "dependencies": { - "humanize-ms": "^1.2.1" - }, - "engines": { - "node": ">= 8.0.0" - } - }, - "node_modules/asynckit": { - "version": "0.4.0", - "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz", - "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==", - "license": "MIT" - }, - "node_modules/base-64": { - "version": "0.1.0", - "resolved": "https://registry.npmjs.org/base-64/-/base-64-0.1.0.tgz", - "integrity": "sha512-Y5gU45svrR5tI2Vt/X9GPd3L0HNIKzGu202EjxrXMpuc2V2CiKgemAbUUsqYmZJvPtCXoUKjNZwBJzsNScUbXA==" - }, - "node_modules/blake3-wasm": { - "version": "2.1.5", - "resolved": "https://registry.npmjs.org/blake3-wasm/-/blake3-wasm-2.1.5.tgz", - "integrity": "sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==", - "dev": true, - "license": "MIT" - }, - "node_modules/call-bind-apply-helpers": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz", - "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==", - "license": "MIT", - "dependencies": { - "es-errors": "^1.3.0", - "function-bind": "^1.1.2" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/charenc": { - "version": "0.0.2", - "resolved": "https://registry.npmjs.org/charenc/-/charenc-0.0.2.tgz", - "integrity": "sha512-yrLQ/yVUFXkzg7EDQsPieE/53+0RlaWTs+wBrvW36cyilJ2SaDWfl4Yj7MtLTXleV9uEKefbAGUPv2/iWSooRA==", - "license": "BSD-3-Clause", - "engines": { - "node": "*" - } - }, - "node_modules/combined-stream": { - "version": "1.0.8", - "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz", - "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==", - "license": "MIT", - "dependencies": { - "delayed-stream": "~1.0.0" - }, - "engines": { - "node": ">= 0.8" - } - }, - "node_modules/cookie": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz", - "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=18" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/express" - } - }, - "node_modules/crypt": { - "version": "0.0.2", - "resolved": "https://registry.npmjs.org/crypt/-/crypt-0.0.2.tgz", - "integrity": "sha512-mCxBlsHFYh9C+HVpiEacem8FEBnMXgU9gy4zmNC+SXAZNB/1idgp/aulFJ4FgCi7GPEVbfyng092GqL2k2rmow==", - "license": "BSD-3-Clause", - "engines": { - "node": "*" - } - }, - "node_modules/delayed-stream": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz", - "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==", - "license": "MIT", - "engines": { - "node": ">=0.4.0" - } - }, - "node_modules/detect-libc": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz", - "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==", - "dev": true, - "license": "Apache-2.0", - "engines": { - "node": ">=8" - } - }, - "node_modules/digest-fetch": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/digest-fetch/-/digest-fetch-1.3.0.tgz", - "integrity": "sha512-CGJuv6iKNM7QyZlM2T3sPAdZWd/p9zQiRNS9G+9COUCwzWFTs0Xp8NF5iePx7wtvhDykReiRRrSeNb4oMmB8lA==", - "license": "ISC", - "dependencies": { - "base-64": "^0.1.0", - "md5": "^2.3.0" - } - }, - "node_modules/dunder-proto": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", - "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==", - "license": "MIT", - "dependencies": { - "call-bind-apply-helpers": "^1.0.1", - "es-errors": "^1.3.0", - "gopd": "^1.2.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/error-stack-parser-es": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/error-stack-parser-es/-/error-stack-parser-es-1.0.5.tgz", - "integrity": "sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA==", - "dev": true, - "license": "MIT", - "funding": { - "url": "https://github.com/sponsors/antfu" - } - }, - "node_modules/es-define-property": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz", - "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==", - "license": "MIT", - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/es-errors": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", - "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", - "license": "MIT", - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/es-object-atoms": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz", - "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==", - "license": "MIT", - "dependencies": { - "es-errors": "^1.3.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/es-set-tostringtag": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz", - "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==", - "license": "MIT", - "dependencies": { - "es-errors": "^1.3.0", - "get-intrinsic": "^1.2.6", - "has-tostringtag": "^1.0.2", - "hasown": "^2.0.2" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/esbuild": { - "version": "0.27.3", - "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz", - "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==", - "dev": true, - "hasInstallScript": true, - "license": "MIT", - "bin": { - "esbuild": "bin/esbuild" - }, - "engines": { - "node": ">=18" - }, - "optionalDependencies": { - "@esbuild/aix-ppc64": "0.27.3", - "@esbuild/android-arm": "0.27.3", - "@esbuild/android-arm64": "0.27.3", - "@esbuild/android-x64": "0.27.3", - "@esbuild/darwin-arm64": "0.27.3", - "@esbuild/darwin-x64": "0.27.3", - "@esbuild/freebsd-arm64": "0.27.3", - "@esbuild/freebsd-x64": "0.27.3", - "@esbuild/linux-arm": "0.27.3", - "@esbuild/linux-arm64": "0.27.3", - "@esbuild/linux-ia32": "0.27.3", - "@esbuild/linux-loong64": "0.27.3", - "@esbuild/linux-mips64el": "0.27.3", - "@esbuild/linux-ppc64": "0.27.3", - "@esbuild/linux-riscv64": "0.27.3", - "@esbuild/linux-s390x": "0.27.3", - "@esbuild/linux-x64": "0.27.3", - "@esbuild/netbsd-arm64": "0.27.3", - "@esbuild/netbsd-x64": "0.27.3", - "@esbuild/openbsd-arm64": "0.27.3", - "@esbuild/openbsd-x64": "0.27.3", - "@esbuild/openharmony-arm64": "0.27.3", - "@esbuild/sunos-x64": "0.27.3", - "@esbuild/win32-arm64": "0.27.3", - "@esbuild/win32-ia32": "0.27.3", - "@esbuild/win32-x64": "0.27.3" - } - }, - "node_modules/event-target-shim": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz", - "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==", - "license": "MIT", - "engines": { - "node": ">=6" - } - }, - "node_modules/form-data": { - "version": "4.0.5", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz", - "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==", - "license": "MIT", - "dependencies": { - "asynckit": "^0.4.0", - "combined-stream": "^1.0.8", - "es-set-tostringtag": "^2.1.0", - "hasown": "^2.0.2", - "mime-types": "^2.1.12" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/form-data-encoder": { - "version": "1.7.2", - "resolved": "https://registry.npmjs.org/form-data-encoder/-/form-data-encoder-1.7.2.tgz", - "integrity": "sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==", - "license": "MIT" - }, - "node_modules/formdata-node": { - "version": "4.4.1", - "resolved": "https://registry.npmjs.org/formdata-node/-/formdata-node-4.4.1.tgz", - "integrity": "sha512-0iirZp3uVDjVGt9p49aTaqjk84TrglENEDuqfdlZQ1roC9CWlPk6Avf8EEnZNcAqPonwkG35x4n3ww/1THYAeQ==", - "license": "MIT", - "dependencies": { - "node-domexception": "1.0.0", - "web-streams-polyfill": "4.0.0-beta.3" - }, - "engines": { - "node": ">= 12.20" - } - }, - "node_modules/formdata-node/node_modules/web-streams-polyfill": { - "version": "4.0.0-beta.3", - "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-4.0.0-beta.3.tgz", - "integrity": "sha512-QW95TCTaHmsYfHDybGMwO5IJIM93I/6vTRk+daHTWFPhwh+C8Cg7j7XyKrwrj8Ib6vYXe0ocYNrmzY4xAAN6ug==", - "license": "MIT", - "engines": { - "node": ">= 14" - } - }, - "node_modules/fsevents": { - "version": "2.3.3", - "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz", - "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==", - "dev": true, - "hasInstallScript": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": "^8.16.0 || ^10.6.0 || >=11.0.0" - } - }, - "node_modules/function-bind": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", - "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", - "license": "MIT", - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/get-intrinsic": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz", - "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==", - "license": "MIT", - "dependencies": { - "call-bind-apply-helpers": "^1.0.2", - "es-define-property": "^1.0.1", - "es-errors": "^1.3.0", - "es-object-atoms": "^1.1.1", - "function-bind": "^1.1.2", - "get-proto": "^1.0.1", - "gopd": "^1.2.0", - "has-symbols": "^1.1.0", - "hasown": "^2.0.2", - "math-intrinsics": "^1.1.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/get-proto": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz", - "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==", - "license": "MIT", - "dependencies": { - "dunder-proto": "^1.0.1", - "es-object-atoms": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/gopd": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz", - "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==", - "license": "MIT", - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/has-symbols": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz", - "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==", - "license": "MIT", - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/has-tostringtag": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz", - "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==", - "license": "MIT", - "dependencies": { - "has-symbols": "^1.0.3" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/hasown": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz", - "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==", - "license": "MIT", - "dependencies": { - "function-bind": "^1.1.2" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/hono": { - "version": "4.12.16", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.16.tgz", - "integrity": "sha512-jN0ZewiNAWSe5khM3EyCmBb250+b40wWbwNILNfEvq84VREWwOIkuUsFONk/3i3nqkz7Oe1PcpM2mwQEK2L9Kg==", - "license": "MIT", - "engines": { - "node": ">=16.9.0" - } - }, - "node_modules/humanize-ms": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz", - "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==", - "license": "MIT", - "dependencies": { - "ms": "^2.0.0" - } - }, - "node_modules/is-buffer": { - "version": "1.1.6", - "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz", - "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==", - "license": "MIT" - }, - "node_modules/kleur": { - "version": "4.1.5", - "resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz", - "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6" - } - }, - "node_modules/math-intrinsics": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz", - "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==", - "license": "MIT", - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/md5": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/md5/-/md5-2.3.0.tgz", - "integrity": "sha512-T1GITYmFaKuO91vxyoQMFETst+O71VUPEU3ze5GNzDm0OWdP8v1ziTaAEPUr/3kLsY3Sftgz242A1SetQiDL7g==", - "license": "BSD-3-Clause", - "dependencies": { - "charenc": "0.0.2", - "crypt": "0.0.2", - "is-buffer": "~1.1.6" - } - }, - "node_modules/mime-db": { - "version": "1.52.0", - "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz", - "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==", - "license": "MIT", - "engines": { - "node": ">= 0.6" - } - }, - "node_modules/mime-types": { - "version": "2.1.35", - "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz", - "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==", - "license": "MIT", - "dependencies": { - "mime-db": "1.52.0" - }, - "engines": { - "node": ">= 0.6" - } - }, - "node_modules/miniflare": { - "version": "4.20260430.0", - "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-4.20260430.0.tgz", - "integrity": "sha512-MWvMm3Siho9Yj7lbJZidLs8hbrRvIcOrif2mnsHQZdvoKfedpea+GaN8XJxbpRcq0B2WzNI1BB1ihdnqes3/ZA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@cspotcode/source-map-support": "0.8.1", - "sharp": "^0.34.5", - "undici": "7.24.8", - "workerd": "1.20260430.1", - "ws": "8.18.0", - "youch": "4.1.0-beta.10" - }, - "bin": { - "miniflare": "bootstrap.js" - }, - "engines": { - "node": ">=22.0.0" - } - }, - "node_modules/ms": { - "version": "2.1.3", - "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", - "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", - "license": "MIT" - }, - "node_modules/node-domexception": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz", - "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==", - "deprecated": "Use your platform's native DOMException instead", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/jimmywarting" - }, - { - "type": "github", - "url": "https://paypal.me/jimmywarting" - } - ], - "license": "MIT", - "engines": { - "node": ">=10.5.0" - } - }, - "node_modules/node-fetch": { - "version": "2.7.0", - "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz", - "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==", - "license": "MIT", - "dependencies": { - "whatwg-url": "^5.0.0" - }, - "engines": { - "node": "4.x || >=6.0.0" - }, - "peerDependencies": { - "encoding": "^0.1.0" - }, - "peerDependenciesMeta": { - "encoding": { - "optional": true - } - } - }, - "node_modules/openai": { - "version": "4.29.2", - "resolved": "https://registry.npmjs.org/openai/-/openai-4.29.2.tgz", - "integrity": "sha512-cPkT6zjEcE4qU5OW/SoDDuXEsdOLrXlAORhzmaguj5xZSPlgKvLhi27sFWhLKj07Y6WKNWxcwIbzm512FzTBNQ==", - "license": "Apache-2.0", - "dependencies": { - "@types/node": "^18.11.18", - "@types/node-fetch": "^2.6.4", - "abort-controller": "^3.0.0", - "agentkeepalive": "^4.2.1", - "digest-fetch": "^1.3.0", - "form-data-encoder": "1.7.2", - "formdata-node": "^4.3.2", - "node-fetch": "^2.6.7", - "web-streams-polyfill": "^3.2.1" - }, - "bin": { - "openai": "bin/cli" - } - }, - "node_modules/path-to-regexp": { - "version": "6.3.0", - "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.3.0.tgz", - "integrity": "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==", - "dev": true, - "license": "MIT" - }, - "node_modules/pathe": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz", - "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==", - "dev": true, - "license": "MIT" - }, - "node_modules/semver": { - "version": "7.7.4", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz", - "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==", - "dev": true, - "license": "ISC", - "bin": { - "semver": "bin/semver.js" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/sharp": { - "version": "0.34.5", - "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz", - "integrity": "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==", - "dev": true, - "hasInstallScript": true, - "license": "Apache-2.0", - "dependencies": { - "@img/colour": "^1.0.0", - "detect-libc": "^2.1.2", - "semver": "^7.7.3" - }, - "engines": { - "node": "^18.17.0 || ^20.3.0 || >=21.0.0" - }, - "funding": { - "url": "https://opencollective.com/libvips" - }, - "optionalDependencies": { - "@img/sharp-darwin-arm64": "0.34.5", - "@img/sharp-darwin-x64": "0.34.5", - "@img/sharp-libvips-darwin-arm64": "1.2.4", - "@img/sharp-libvips-darwin-x64": "1.2.4", - "@img/sharp-libvips-linux-arm": "1.2.4", - "@img/sharp-libvips-linux-arm64": "1.2.4", - "@img/sharp-libvips-linux-ppc64": "1.2.4", - "@img/sharp-libvips-linux-riscv64": "1.2.4", - "@img/sharp-libvips-linux-s390x": "1.2.4", - "@img/sharp-libvips-linux-x64": "1.2.4", - "@img/sharp-libvips-linuxmusl-arm64": "1.2.4", - "@img/sharp-libvips-linuxmusl-x64": "1.2.4", - "@img/sharp-linux-arm": "0.34.5", - "@img/sharp-linux-arm64": "0.34.5", - "@img/sharp-linux-ppc64": "0.34.5", - "@img/sharp-linux-riscv64": "0.34.5", - "@img/sharp-linux-s390x": "0.34.5", - "@img/sharp-linux-x64": "0.34.5", - "@img/sharp-linuxmusl-arm64": "0.34.5", - "@img/sharp-linuxmusl-x64": "0.34.5", - "@img/sharp-wasm32": "0.34.5", - "@img/sharp-win32-arm64": "0.34.5", - "@img/sharp-win32-ia32": "0.34.5", - "@img/sharp-win32-x64": "0.34.5" - } - }, - "node_modules/supports-color": { - "version": "10.2.2", - "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-10.2.2.tgz", - "integrity": "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/chalk/supports-color?sponsor=1" - } - }, - "node_modules/tr46": { - "version": "0.0.3", - "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz", - "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==", - "license": "MIT" - }, - "node_modules/tslib": { - "version": "2.8.1", - "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz", - "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==", - "dev": true, - "license": "0BSD", - "optional": true - }, - "node_modules/undici": { - "version": "7.24.8", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.8.tgz", - "integrity": "sha512-6KQ/+QxK49Z/p3HO6E5ZCZWNnCasyZLa5ExaVYyvPxUwKtbCPMKELJOqh7EqOle0t9cH/7d2TaaTRRa6Nhs4YQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=20.18.1" - } - }, - "node_modules/undici-types": { - "version": "5.26.5", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz", - "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==", - "license": "MIT" - }, - "node_modules/unenv": { - "version": "2.0.0-rc.24", - "resolved": "https://registry.npmjs.org/unenv/-/unenv-2.0.0-rc.24.tgz", - "integrity": "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw==", - "dev": true, - "license": "MIT", - "dependencies": { - "pathe": "^2.0.3" - } - }, - "node_modules/web-streams-polyfill": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz", - "integrity": "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==", - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/webidl-conversions": { - "version": "3.0.1", - "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz", - "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==", - "license": "BSD-2-Clause" - }, - "node_modules/whatwg-url": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz", - "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==", - "license": "MIT", - "dependencies": { - "tr46": "~0.0.3", - "webidl-conversions": "^3.0.0" - } - }, - "node_modules/workerd": { - "version": "1.20260430.1", - "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20260430.1.tgz", - "integrity": "sha512-KEgIWyiw3Jmn+DCd/L3ePo5fmiiYb/UcwKvDWPf/nLLOiwShDFzDSsegU5NY/JcwgvO/QsLHVi2FYrbkcXNY5Q==", - "dev": true, - "hasInstallScript": true, - "license": "Apache-2.0", - "bin": { - "workerd": "bin/workerd" - }, - "engines": { - "node": ">=16" - }, - "optionalDependencies": { - "@cloudflare/workerd-darwin-64": "1.20260430.1", - "@cloudflare/workerd-darwin-arm64": "1.20260430.1", - "@cloudflare/workerd-linux-64": "1.20260430.1", - "@cloudflare/workerd-linux-arm64": "1.20260430.1", - "@cloudflare/workerd-windows-64": "1.20260430.1" - } - }, - "node_modules/wrangler": { - "version": "4.87.0", - "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.87.0.tgz", - "integrity": "sha512-lfhfKwLfQlowwgV0xhlYgE9fU3n0I30d4ccGY/rTCEm/n42Mjvlr0Ng3ZPNqlsrsKBcDR531V7dsPkgELvrk/Q==", - "dev": true, - "license": "MIT OR Apache-2.0", - "dependencies": { - "@cloudflare/kv-asset-handler": "0.5.0", - "@cloudflare/unenv-preset": "2.16.1", - "blake3-wasm": "2.1.5", - "esbuild": "0.27.3", - "miniflare": "4.20260430.0", - "path-to-regexp": "6.3.0", - "unenv": "2.0.0-rc.24", - "workerd": "1.20260430.1" - }, - "bin": { - "wrangler": "bin/wrangler.js", - "wrangler2": "bin/wrangler.js" - }, - "engines": { - "node": ">=22.0.0" - }, - "optionalDependencies": { - "fsevents": "~2.3.2" - }, - "peerDependencies": { - "@cloudflare/workers-types": "^4.20260430.1" - }, - "peerDependenciesMeta": { - "@cloudflare/workers-types": { - "optional": true - } - } - }, - "node_modules/ws": { - "version": "8.18.0", - "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.0.tgz", - "integrity": "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=10.0.0" - }, - "peerDependencies": { - "bufferutil": "^4.0.1", - "utf-8-validate": ">=5.0.2" - }, - "peerDependenciesMeta": { - "bufferutil": { - "optional": true - }, - "utf-8-validate": { - "optional": true - } - } - }, - "node_modules/youch": { - "version": "4.1.0-beta.10", - "resolved": "https://registry.npmjs.org/youch/-/youch-4.1.0-beta.10.tgz", - "integrity": "sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "@poppinss/colors": "^4.1.5", - "@poppinss/dumper": "^0.6.4", - "@speed-highlight/core": "^1.2.7", - "cookie": "^1.0.2", - "youch-core": "^0.3.3" - } - }, - "node_modules/youch-core": { - "version": "0.3.3", - "resolved": "https://registry.npmjs.org/youch-core/-/youch-core-0.3.3.tgz", - "integrity": "sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@poppinss/exception": "^1.2.2", - "error-stack-parser-es": "^1.0.5" - } - } - } -} diff --git a/litellm-js/proxy/package.json b/litellm-js/proxy/package.json deleted file mode 100644 index 9fd94cd882f..00000000000 --- a/litellm-js/proxy/package.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "scripts": { - "dev": "wrangler dev src/index.ts", - "deploy": "wrangler deploy --minify src/index.ts" - }, - "dependencies": { - "hono": "4.12.16", - "openai": "4.29.2" - }, - "devDependencies": { - "@cloudflare/workers-types": "4.20260501.1", - "wrangler": "4.87.0" - } -} diff --git a/litellm-js/proxy/src/index.ts b/litellm-js/proxy/src/index.ts deleted file mode 100644 index dc5dc9c689e..00000000000 --- a/litellm-js/proxy/src/index.ts +++ /dev/null @@ -1,59 +0,0 @@ -import { Hono } from 'hono' -import { Context } from 'hono'; -import { bearerAuth } from 'hono/bearer-auth' -import OpenAI from "openai"; - -const openai = new OpenAI({ - apiKey: "sk-1234", - baseURL: "https://openai-endpoint.ishaanjaffer0324.workers.dev" -}); - -async function call_proxy() { - const completion = await openai.chat.completions.create({ - messages: [{ role: "system", content: "You are a helpful assistant." }], - model: "gpt-3.5-turbo", - }); - - return completion -} - -const app = new Hono() - -// Middleware for API Key Authentication -const apiKeyAuth = async (c: Context, next: Function) => { - const apiKey = c.req.header('Authorization'); - if (!apiKey || apiKey !== 'Bearer sk-1234') { - return c.text('Unauthorized', 401); - } - await next(); -}; - - -app.use('/*', apiKeyAuth) - - -app.get('/', (c) => { - return c.text('Hello Hono!') -}) - - - - -// Handler for chat completions -const chatCompletionHandler = async (c: Context) => { - // Assuming your logic for handling chat completion goes here - // For demonstration, just returning a simple JSON response - const response = await call_proxy() - return c.json(response); -}; - -// Register the above handler for different POST routes with the apiKeyAuth middleware -app.post('/v1/chat/completions', chatCompletionHandler); -app.post('/chat/completions', chatCompletionHandler); - -// Example showing how you might handle dynamic segments within the URL -// Here, using ':model*' to capture the rest of the path as a parameter 'model' -app.post('/openai/deployments/:model*/chat/completions', chatCompletionHandler); - - -export default app diff --git a/litellm-js/proxy/tsconfig.json b/litellm-js/proxy/tsconfig.json deleted file mode 100644 index 28fcfb58246..00000000000 --- a/litellm-js/proxy/tsconfig.json +++ /dev/null @@ -1,17 +0,0 @@ -{ - "compilerOptions": { - "target": "ESNext", - "module": "ESNext", - "moduleResolution": "Bundler", - "strict": true, - "lib": [ - "ESNext" - ], - "types": [ - "@cloudflare/workers-types" - ], - "jsx": "react-jsx", - "jsxImportSource": "hono/jsx", - "skipLibCheck": true - }, -} \ No newline at end of file diff --git a/litellm-js/proxy/wrangler.toml b/litellm-js/proxy/wrangler.toml deleted file mode 100644 index e7c323dff97..00000000000 --- a/litellm-js/proxy/wrangler.toml +++ /dev/null @@ -1,18 +0,0 @@ -name = "my-app" -compatibility_date = "2023-12-01" - -# [vars] -# MY_VAR = "my-variable" - -# [[kv_namespaces]] -# binding = "MY_KV_NAMESPACE" -# id = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" - -# [[r2_buckets]] -# binding = "MY_BUCKET" -# bucket_name = "my-bucket" - -# [[d1_databases]] -# binding = "DB" -# database_name = "my-database" -# database_id = "" diff --git a/litellm-js/spend-logs/.npmrc b/litellm-js/spend-logs/.npmrc deleted file mode 100644 index 7999681cc35..00000000000 --- a/litellm-js/spend-logs/.npmrc +++ /dev/null @@ -1,5 +0,0 @@ -# Supply-chain hardening -# Packages needing lifecycle scripts: npm rebuild -ignore-scripts=true -# Protects local npm install only — npm ci (used in CI) ignores this -min-release-age=3 diff --git a/litellm-js/spend-logs/Dockerfile b/litellm-js/spend-logs/Dockerfile deleted file mode 100644 index 5040dc74bf6..00000000000 --- a/litellm-js/spend-logs/Dockerfile +++ /dev/null @@ -1,26 +0,0 @@ -# Use the specific Node.js v20.11.0 image -FROM node:20.18.1-alpine3.20 - -# Set the working directory inside the container -WORKDIR /app - -# Copy package.json and package-lock.json to the working directory -COPY ./litellm-js/spend-logs/package*.json ./ - -# Install dependencies -RUN npm ci - -# Install Prisma globally -RUN npm install -g prisma - -# Copy the rest of the application code -COPY ./litellm-js/spend-logs . - -# Generate Prisma client -RUN npx prisma generate - -# Expose the port that the Node.js server will run on -EXPOSE 3000 - -# Command to run the Node.js app with npm run dev -CMD ["npm", "run", "dev"] diff --git a/litellm-js/spend-logs/README.md b/litellm-js/spend-logs/README.md deleted file mode 100644 index e12b31db70a..00000000000 --- a/litellm-js/spend-logs/README.md +++ /dev/null @@ -1,8 +0,0 @@ -``` -npm install -npm run dev -``` - -``` -open http://localhost:3000 -``` diff --git a/litellm-js/spend-logs/package-lock.json b/litellm-js/spend-logs/package-lock.json deleted file mode 100644 index e9fc4b00f6a..00000000000 --- a/litellm-js/spend-logs/package-lock.json +++ /dev/null @@ -1,597 +0,0 @@ -{ - "name": "spend-logs", - "lockfileVersion": 3, - "requires": true, - "packages": { - "": { - "dependencies": { - "@hono/node-server": "1.19.13", - "hono": "4.12.16" - }, - "devDependencies": { - "@types/node": "20.19.25", - "tsx": "4.20.6" - } - }, - "node_modules/@esbuild/aix-ppc64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz", - "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==", - "cpu": [ - "ppc64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "aix" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/android-arm": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz", - "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==", - "cpu": [ - "arm" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/android-arm64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz", - "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/android-x64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz", - "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/darwin-arm64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz", - "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/darwin-x64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz", - "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/freebsd-arm64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz", - "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/freebsd-x64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz", - "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-arm": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz", - "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==", - "cpu": [ - "arm" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-arm64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz", - "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-ia32": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz", - "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==", - "cpu": [ - "ia32" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-loong64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz", - "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==", - "cpu": [ - "loong64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-mips64el": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz", - "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==", - "cpu": [ - "mips64el" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-ppc64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz", - "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==", - "cpu": [ - "ppc64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-riscv64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz", - "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==", - "cpu": [ - "riscv64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-s390x": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz", - "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==", - "cpu": [ - "s390x" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-x64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz", - "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/netbsd-arm64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz", - "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "netbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/netbsd-x64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz", - "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "netbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/openbsd-arm64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz", - "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "openbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/openbsd-x64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz", - "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "openbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/openharmony-arm64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz", - "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "openharmony" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/sunos-x64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz", - "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "sunos" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/win32-arm64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz", - "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/win32-ia32": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz", - "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==", - "cpu": [ - "ia32" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/win32-x64": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz", - "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@hono/node-server": { - "version": "1.19.13", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.13.tgz", - "integrity": "sha512-TsQLe4i2gvoTtrHje625ngThGBySOgSK3Xo2XRYOdqGN1teR8+I7vchQC46uLJi8OF62YTYA3AhSpumtkhsaKQ==", - "license": "MIT", - "engines": { - "node": ">=18.14.1" - }, - "peerDependencies": { - "hono": "^4" - } - }, - "node_modules/@types/node": { - "version": "20.19.25", - "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.25.tgz", - "integrity": "sha512-ZsJzA5thDQMSQO788d7IocwwQbI8B5OPzmqNvpf3NY/+MHDAS759Wo0gd2WQeXYt5AAAQjzcrTVC6SKCuYgoCQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "undici-types": "~6.21.0" - } - }, - "node_modules/esbuild": { - "version": "0.25.12", - "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz", - "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==", - "dev": true, - "hasInstallScript": true, - "license": "MIT", - "bin": { - "esbuild": "bin/esbuild" - }, - "engines": { - "node": ">=18" - }, - "optionalDependencies": { - "@esbuild/aix-ppc64": "0.25.12", - "@esbuild/android-arm": "0.25.12", - "@esbuild/android-arm64": "0.25.12", - "@esbuild/android-x64": "0.25.12", - "@esbuild/darwin-arm64": "0.25.12", - "@esbuild/darwin-x64": "0.25.12", - "@esbuild/freebsd-arm64": "0.25.12", - "@esbuild/freebsd-x64": "0.25.12", - "@esbuild/linux-arm": "0.25.12", - "@esbuild/linux-arm64": "0.25.12", - "@esbuild/linux-ia32": "0.25.12", - "@esbuild/linux-loong64": "0.25.12", - "@esbuild/linux-mips64el": "0.25.12", - "@esbuild/linux-ppc64": "0.25.12", - "@esbuild/linux-riscv64": "0.25.12", - "@esbuild/linux-s390x": "0.25.12", - "@esbuild/linux-x64": "0.25.12", - "@esbuild/netbsd-arm64": "0.25.12", - "@esbuild/netbsd-x64": "0.25.12", - "@esbuild/openbsd-arm64": "0.25.12", - "@esbuild/openbsd-x64": "0.25.12", - "@esbuild/openharmony-arm64": "0.25.12", - "@esbuild/sunos-x64": "0.25.12", - "@esbuild/win32-arm64": "0.25.12", - "@esbuild/win32-ia32": "0.25.12", - "@esbuild/win32-x64": "0.25.12" - } - }, - "node_modules/fsevents": { - "version": "2.3.3", - "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz", - "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==", - "dev": true, - "hasInstallScript": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": "^8.16.0 || ^10.6.0 || >=11.0.0" - } - }, - "node_modules/get-tsconfig": { - "version": "4.13.0", - "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.13.0.tgz", - "integrity": "sha512-1VKTZJCwBrvbd+Wn3AOgQP/2Av+TfTCOlE4AcRJE72W1ksZXbAx8PPBR9RzgTeSPzlPMHrbANMH3LbltH73wxQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "resolve-pkg-maps": "^1.0.0" - }, - "funding": { - "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1" - } - }, - "node_modules/hono": { - "version": "4.12.16", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.16.tgz", - "integrity": "sha512-jN0ZewiNAWSe5khM3EyCmBb250+b40wWbwNILNfEvq84VREWwOIkuUsFONk/3i3nqkz7Oe1PcpM2mwQEK2L9Kg==", - "license": "MIT", - "engines": { - "node": ">=16.9.0" - } - }, - "node_modules/resolve-pkg-maps": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz", - "integrity": "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==", - "dev": true, - "license": "MIT", - "funding": { - "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1" - } - }, - "node_modules/tsx": { - "version": "4.20.6", - "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.20.6.tgz", - "integrity": "sha512-ytQKuwgmrrkDTFP4LjR0ToE2nqgy886GpvRSpU0JAnrdBYppuY5rLkRUYPU1yCryb24SsKBTL/hlDQAEFVwtZg==", - "dev": true, - "license": "MIT", - "dependencies": { - "esbuild": "~0.25.0", - "get-tsconfig": "^4.7.5" - }, - "bin": { - "tsx": "dist/cli.mjs" - }, - "engines": { - "node": ">=18.0.0" - }, - "optionalDependencies": { - "fsevents": "~2.3.3" - } - }, - "node_modules/undici-types": { - "version": "6.21.0", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz", - "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==", - "dev": true, - "license": "MIT" - } - } -} diff --git a/litellm-js/spend-logs/package.json b/litellm-js/spend-logs/package.json deleted file mode 100644 index 5a7a95c5de1..00000000000 --- a/litellm-js/spend-logs/package.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "scripts": { - "dev": "tsx watch src/index.ts" - }, - "dependencies": { - "@hono/node-server": "1.19.13", - "hono": "4.12.16" - }, - "devDependencies": { - "@types/node": "20.19.25", - "tsx": "4.20.6" - } -} diff --git a/litellm-js/spend-logs/schema.prisma b/litellm-js/spend-logs/schema.prisma deleted file mode 100644 index b0403f277aa..00000000000 --- a/litellm-js/spend-logs/schema.prisma +++ /dev/null @@ -1,29 +0,0 @@ -generator client { - provider = "prisma-client-js" -} - -datasource client { - provider = "postgresql" - url = env("DATABASE_URL") -} - -model LiteLLM_SpendLogs { - request_id String @id - call_type String - api_key String @default("") - spend Float @default(0.0) - total_tokens Int @default(0) - prompt_tokens Int @default(0) - completion_tokens Int @default(0) - startTime DateTime - endTime DateTime - model String @default("") - api_base String @default("") - user String @default("") - metadata Json @default("{}") - cache_hit String @default("") - cache_key String @default("") - request_tags Json @default("[]") - team_id String? - end_user String? -} \ No newline at end of file diff --git a/litellm-js/spend-logs/src/_types.ts b/litellm-js/spend-logs/src/_types.ts deleted file mode 100644 index 6a9b499171e..00000000000 --- a/litellm-js/spend-logs/src/_types.ts +++ /dev/null @@ -1,32 +0,0 @@ -export type LiteLLM_IncrementSpend = { - key_transactions: Array, // [{"key": spend},..] - user_transactions: Array, - team_transactions: Array, - spend_logs_transactions: Array -} - -export type LiteLLM_IncrementObject = { - key: string, - spend: number -} - -export type LiteLLM_SpendLogs = { - request_id: string; // @id means it's a unique identifier - call_type: string; - api_key: string; // @default("") means it defaults to an empty string if not provided - spend: number; // Float in Prisma corresponds to number in TypeScript - total_tokens: number; // Int in Prisma corresponds to number in TypeScript - prompt_tokens: number; - completion_tokens: number; - startTime: Date; // DateTime in Prisma corresponds to Date in TypeScript - endTime: Date; - model: string; // @default("") means it defaults to an empty string if not provided - api_base: string; - user: string; - metadata: any; // Json type in Prisma is represented by any in TypeScript; could also use a more specific type if the structure of JSON is known - cache_hit: string; - cache_key: string; - request_tags: any; // Similarly, this could be an array or a more specific type depending on the expected structure - team_id?: string | null; // ? indicates it's optional and can be undefined, but could also be null if not provided - end_user?: string | null; -}; \ No newline at end of file diff --git a/litellm-js/spend-logs/src/index.ts b/litellm-js/spend-logs/src/index.ts deleted file mode 100644 index 3581d95c830..00000000000 --- a/litellm-js/spend-logs/src/index.ts +++ /dev/null @@ -1,84 +0,0 @@ -import { serve } from '@hono/node-server' -import { Hono } from 'hono' -import { PrismaClient } from '@prisma/client' -import {LiteLLM_SpendLogs, LiteLLM_IncrementSpend, LiteLLM_IncrementObject} from './_types' - -const app = new Hono() -const prisma = new PrismaClient() -// In-memory storage for logs -let spend_logs: LiteLLM_SpendLogs[] = []; -const key_logs: LiteLLM_IncrementObject[] = []; -const user_logs: LiteLLM_IncrementObject[] = []; -const transaction_logs: LiteLLM_IncrementObject[] = []; - - -app.get('/', (c) => { - return c.text('Hello Hono!') -}) - -const MIN_LOGS = 1; // Minimum number of logs needed to initiate a flush -const FLUSH_INTERVAL = 5000; // Time in ms to wait before trying to flush again -const BATCH_SIZE = 100; // Preferred size of each batch to write to the database -const MAX_LOGS_PER_INTERVAL = 1000; // Maximum number of logs to flush in a single interval - -const flushLogsToDb = async () => { - if (spend_logs.length >= MIN_LOGS) { - // Limit the logs to process in this interval to MAX_LOGS_PER_INTERVAL or less - const logsToProcess = spend_logs.slice(0, MAX_LOGS_PER_INTERVAL); - - for (let i = 0; i < logsToProcess.length; i += BATCH_SIZE) { - // Create subarray for current batch, ensuring it doesn't exceed the BATCH_SIZE - const batch = logsToProcess.slice(i, i + BATCH_SIZE); - - // Convert datetime strings to Date objects - const batchWithDates = batch.map(entry => ({ - ...entry, - startTime: new Date(entry.startTime), - endTime: new Date(entry.endTime), - // Repeat for any other DateTime fields you may have - })); - - await prisma.liteLLM_SpendLogs.createMany({ - data: batchWithDates, - }); - - console.log(`Flushed ${batch.length} logs to the DB.`); - } - - // Remove the processed logs from spend_logs - spend_logs = spend_logs.slice(logsToProcess.length); - - console.log(`${logsToProcess.length} logs processed. Remaining in queue: ${spend_logs.length}`); - } else { - // This will ensure it doesn't falsely claim "No logs to flush." when it's merely below the MIN_LOGS threshold. - if(spend_logs.length > 0) { - console.log(`Accumulating logs. Currently at ${spend_logs.length}, waiting for at least ${MIN_LOGS}.`); - } else { - console.log("No logs to flush."); - } - } -}; - -// Setup interval for attempting to flush the logs -setInterval(flushLogsToDb, FLUSH_INTERVAL); - -// Route to receive log messages -app.post('/spend/update', async (c) => { - const incomingLogs = await c.req.json(); - - spend_logs.push(...incomingLogs); - - console.log(`Received and stored ${incomingLogs.length} logs. Total logs in memory: ${spend_logs.length}`); - - return c.json({ message: `Successfully stored ${incomingLogs.length} logs` }); -}); - - - -const port = 3000 -console.log(`Server is running on port ${port}`) - -serve({ - fetch: app.fetch, - port -}) diff --git a/litellm-js/spend-logs/tsconfig.json b/litellm-js/spend-logs/tsconfig.json deleted file mode 100644 index 028c03b6a81..00000000000 --- a/litellm-js/spend-logs/tsconfig.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "compilerOptions": { - "target": "ESNext", - "module": "ESNext", - "moduleResolution": "Bundler", - "strict": true, - "types": [ - "node" - ], - "jsx": "react-jsx", - "jsxImportSource": "hono/jsx", - } -} \ No newline at end of file diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260421135425_add_team_membership_total_spend/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260421135425_add_team_membership_total_spend/migration.sql index 049bd513cd8..7d7c359bf2d 100644 --- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260421135425_add_team_membership_total_spend/migration.sql +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260421135425_add_team_membership_total_spend/migration.sql @@ -1,3 +1,3 @@ -- AlterTable -ALTER TABLE "LiteLLM_TeamMembership" ADD COLUMN "total_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; +ALTER TABLE "LiteLLM_TeamMembership" ADD COLUMN IF NOT EXISTS "total_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0; diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260513120000_add_delegate_auth_to_upstream_to_mcp_servers/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260513120000_add_delegate_auth_to_upstream_to_mcp_servers/migration.sql new file mode 100644 index 00000000000..50a48743901 --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260513120000_add_delegate_auth_to_upstream_to_mcp_servers/migration.sql @@ -0,0 +1,2 @@ +-- AlterTable +ALTER TABLE "LiteLLM_MCPServerTable" ADD COLUMN IF NOT EXISTS "delegate_auth_to_upstream" BOOLEAN NOT NULL DEFAULT false; diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260514120000_add_blocked_to_proxy_model_table/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260514120000_add_blocked_to_proxy_model_table/migration.sql new file mode 100644 index 00000000000..3253b63a884 --- /dev/null +++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260514120000_add_blocked_to_proxy_model_table/migration.sql @@ -0,0 +1,4 @@ +-- AlterTable +-- Adds the admin-toggleable pause flag used by the router's blocked filter and the +-- credential lookup helpers; defaults to false so existing rows behave unchanged. +ALTER TABLE "LiteLLM_ProxyModelTable" ADD COLUMN IF NOT EXISTS "blocked" BOOLEAN NOT NULL DEFAULT false; diff --git a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma index 84ce99557e3..78143fe0411 100644 --- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma +++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma @@ -48,9 +48,10 @@ model LiteLLM_CredentialsTable { // Models on proxy model LiteLLM_ProxyModelTable { model_id String @id @default(uuid()) - model_name String + model_name String litellm_params Json - model_info Json? + model_info Json? + blocked Boolean @default(false) created_at DateTime @default(now()) @map("created_at") created_by String updated_at DateTime @default(now()) @updatedAt @map("updated_at") @@ -323,6 +324,7 @@ model LiteLLM_MCPServerTable { registration_url String? allow_all_keys Boolean @default(false) available_on_public_internet Boolean @default(true) + delegate_auth_to_upstream Boolean @default(false) is_byok Boolean @default(false) byok_description String[] @default([]) byok_api_key_help_url String? diff --git a/litellm-proxy-extras/pyproject.toml b/litellm-proxy-extras/pyproject.toml index cd569ca08ec..0654f17ec68 100644 --- a/litellm-proxy-extras/pyproject.toml +++ b/litellm-proxy-extras/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "litellm-proxy-extras" -version = "0.4.71" +version = "0.4.73" description = "Additional files for the LiteLLM Proxy. Reduces the size of the main litellm package." readme = "README.md" requires-python = ">=3.9" @@ -26,7 +26,7 @@ required-version = ">=0.10.9" module-root = "" [tool.commitizen] -version = "0.4.71" +version = "0.4.73" version_files = [ "pyproject.toml:^version", "../pyproject.toml:litellm-proxy-extras==", diff --git a/litellm/__init__.py b/litellm/__init__.py index 617c102fb85..7c92623358d 100644 --- a/litellm/__init__.py +++ b/litellm/__init__.py @@ -206,6 +206,7 @@ add_user_information_to_llm_headers: Optional[bool] = ( ) store_audit_logs = False # Enterprise feature, allow users to see audit logs skip_system_message_in_guardrail: bool = False +skip_tool_message_in_guardrail: bool = False ### end of callbacks ############# email: Optional[str] = ( @@ -224,6 +225,10 @@ use_chat_completions_url_for_anthropic_messages: bool = bool( route_all_chat_openai_to_responses: bool = ( os.getenv("LITELLM_ROUTE_ALL_CHAT_OPENAI_TO_RESPONSES", "false").lower() == "true" ) # When True, routes all OpenAI /chat/completions requests through the Responses API bridge +use_legacy_interactions_schema: bool = ( + os.getenv("LITELLM_USE_LEGACY_INTERACTIONS_SCHEMA", "false").lower() == "true" +) # When True, sends Api-Revision: 2026-05-07 to Google so responses use the legacy `outputs` +# schema instead of the new `steps` schema. Remove this flag after June 8, 2026. retry = True ### AUTH ### api_key: Optional[str] = None @@ -388,6 +393,7 @@ anthropic_beta_headers_url: str = os.getenv( suppress_debug_info = False dynamodb_table_name: Optional[str] = None s3_callback_params: Optional[Dict] = None +s3_audit_callback_params: Optional[Dict] = None datadog_llm_observability_params: Optional[Union[DatadogLLMObsInitParams, Dict]] = None datadog_params: Optional[Union[DatadogInitParams, Dict]] = None aws_sqs_callback_params: Optional[Dict] = None @@ -407,6 +413,12 @@ internal_user_budget_duration: Optional[str] = None tag_budget_config: Optional[Dict[str, "BudgetConfig"]] = None max_end_user_budget: Optional[float] = None max_end_user_budget_id: Optional[str] = None +# When True, end-user IDs extracted from requests are validated against +# LiteLLM_EndUserTable / LiteLLM_UserTable. Values that do not resolve to a +# known row are dropped before reaching spend logs. Defaults to False for +# backwards compatibility — arbitrary client-supplied identifiers still +# pass through unchanged. +validate_end_user_id_in_db: bool = False disable_end_user_cost_tracking: Optional[bool] = None disable_end_user_cost_tracking_prometheus_only: Optional[bool] = None enable_end_user_cost_tracking_prometheus_only: Optional[bool] = None @@ -414,6 +426,7 @@ custom_prometheus_metadata_labels: List[str] = [] custom_prometheus_tags: List[str] = [] prometheus_metrics_config: Optional[List] = None prometheus_emit_stream_label: bool = False +prometheus_user_budget_label_include_email_alias: bool = False prometheus_end_user_metrics_max_series_per_metric: Optional[int] = 10000 prometheus_end_user_metrics_ttl_seconds: Optional[float] = 3600.0 prometheus_end_user_metrics_cleanup_interval_seconds: Optional[float] = 60.0 @@ -629,6 +642,7 @@ minimax_models: Set = set() aws_polly_models: Set = set() gigachat_models: Set = set() llamagate_models: Set = set() +reducto_models: Set = set() bedrock_mantle_models: Set = set() @@ -896,6 +910,8 @@ def add_known_models(model_cost_map: Optional[Dict] = None): gigachat_models.add(key) elif value.get("litellm_provider") == "llamagate": llamagate_models.add(key) + elif value.get("litellm_provider") == "reducto": + reducto_models.add(key) elif value.get("litellm_provider") == "bedrock_mantle": bedrock_mantle_models.add(key) @@ -1007,6 +1023,7 @@ model_list = list( | ovhcloud_models | lemonade_models | docker_model_runner_models + | reducto_models | bedrock_mantle_models | set(clarifai_models) ) @@ -1113,6 +1130,7 @@ models_by_provider: dict = { "aws_polly": aws_polly_models, "gigachat": gigachat_models, "llamagate": llamagate_models, + "reducto": reducto_models, "bedrock_mantle": bedrock_mantle_models, } @@ -1285,6 +1303,18 @@ from .responses.main import * # Interactions API is available as litellm.interactions module # Usage: litellm.interactions.create(), litellm.interactions.get(), etc. from . import interactions +from .interactions.agents.main import ( + acreate as acreate_agent, + create as create_agent, + alist as alist_agents, + list as list_agents, + aget as aget_agent, + get as get_agent, + adelete as adelete_agent, + delete as delete_agent, + alist_versions as alist_agent_versions, + list_versions as list_agent_versions, +) from .skills.main import ( create_skill, acreate_skill, @@ -1424,6 +1454,12 @@ if TYPE_CHECKING: ) from .llms.datarobot.chat.transformation import DataRobotConfig as DataRobotConfig from .llms.anthropic.chat.transformation import AnthropicConfig as AnthropicConfig + from .llms.bedrock.claude_platform.transformation import ( + BedrockClaudePlatformConfig as BedrockClaudePlatformConfig, + ) + from .llms.bedrock.claude_platform.messages_transformation import ( + BedrockClaudePlatformMessagesConfig as BedrockClaudePlatformMessagesConfig, + ) from .llms.anthropic.completion.transformation import ( AnthropicTextConfig as AnthropicTextConfig, ) @@ -1841,6 +1877,9 @@ if TYPE_CHECKING: from .llms.azure.completion.transformation import ( AzureOpenAITextConfig as AzureOpenAITextConfig, ) + from .llms.azure.audio_transcription.transformation import ( + AzureSpeechAudioTranscriptionConfig as AzureSpeechAudioTranscriptionConfig, + ) from .llms.hosted_vllm.chat.transformation import ( HostedVLLMChatConfig as HostedVLLMChatConfig, ) @@ -1872,6 +1911,12 @@ if TYPE_CHECKING: from .llms.dashscope.chat.transformation import ( DashScopeChatConfig as DashScopeChatConfig, ) + from .llms.dashscope.embed.transformation import ( + DashScopeEmbeddingConfig as DashScopeEmbeddingConfig, + ) + from .llms.dashscope.rerank.transformation import ( + DashScopeRerankConfig as DashScopeRerankConfig, + ) from .llms.moonshot.chat.transformation import ( MoonshotChatConfig as MoonshotChatConfig, ) diff --git a/litellm/_lazy_imports_registry.py b/litellm/_lazy_imports_registry.py index 119e62a5b38..17eb6609292 100644 --- a/litellm/_lazy_imports_registry.py +++ b/litellm/_lazy_imports_registry.py @@ -131,6 +131,7 @@ LLM_CONFIG_NAMES = ( "OpenrouterConfig", "DataRobotConfig", "AnthropicConfig", + "BedrockClaudePlatformConfig", "AnthropicTextConfig", "GroqSTTConfig", "TritonConfig", @@ -170,6 +171,7 @@ LLM_CONFIG_NAMES = ( "SagemakerNovaConfig", "CohereChatConfig", "AnthropicMessagesConfig", + "BedrockClaudePlatformMessagesConfig", "AmazonAnthropicClaudeMessagesConfig", "AmazonMantleMessagesConfig", "TogetherAIConfig", @@ -271,6 +273,7 @@ LLM_CONFIG_NAMES = ( "AzureOpenAIConfig", "AzureOpenAIGPT5Config", "AzureOpenAITextConfig", + "AzureSpeechAudioTranscriptionConfig", "HostedVLLMChatConfig", "HostedVLLMEmbeddingConfig", # Alias for backwards compatibility @@ -374,7 +377,6 @@ UTILS_MODULE_NAMES = ( "HTTPHandler", "get_num_retries_from_retry_policy", "reset_retry_policy", - "get_secret", "get_coroutine_checker", "get_litellm_logging_class", "get_set_callbacks", @@ -610,6 +612,10 @@ _LLM_CONFIGS_IMPORT_MAP = { "OpenrouterConfig": (".llms.openrouter.chat.transformation", "OpenrouterConfig"), "DataRobotConfig": (".llms.datarobot.chat.transformation", "DataRobotConfig"), "AnthropicConfig": (".llms.anthropic.chat.transformation", "AnthropicConfig"), + "BedrockClaudePlatformConfig": ( + ".llms.bedrock.claude_platform.transformation", + "BedrockClaudePlatformConfig", + ), "AnthropicTextConfig": ( ".llms.anthropic.completion.transformation", "AnthropicTextConfig", @@ -712,6 +718,10 @@ _LLM_CONFIGS_IMPORT_MAP = { ".llms.anthropic.experimental_pass_through.messages.transformation", "AnthropicMessagesConfig", ), + "BedrockClaudePlatformMessagesConfig": ( + ".llms.bedrock.claude_platform.messages_transformation", + "BedrockClaudePlatformMessagesConfig", + ), "AmazonAnthropicClaudeMessagesConfig": ( ".llms.bedrock.messages.invoke_transformations.anthropic_claude3_transformation", "AmazonAnthropicClaudeMessagesConfig", @@ -1045,6 +1055,10 @@ _LLM_CONFIGS_IMPORT_MAP = { ".llms.azure.completion.transformation", "AzureOpenAITextConfig", ), + "AzureSpeechAudioTranscriptionConfig": ( + ".llms.azure.audio_transcription.transformation", + "AzureSpeechAudioTranscriptionConfig", + ), "HostedVLLMChatConfig": ( ".llms.hosted_vllm.chat.transformation", "HostedVLLMChatConfig", @@ -1274,7 +1288,6 @@ _UTILS_MODULE_IMPORT_MAP = { "litellm.router_utils.get_retry_from_policy", "reset_retry_policy", ), - "get_secret": ("litellm.secret_managers.main", "get_secret"), "get_coroutine_checker": ( "litellm.litellm_core_utils.cached_imports", "get_coroutine_checker", diff --git a/litellm/_logging.py b/litellm/_logging.py index 5ddafd6c6af..6b99f50e014 100644 --- a/litellm/_logging.py +++ b/litellm/_logging.py @@ -404,6 +404,7 @@ def _turn_on_debug(): def _disable_debugging(): + """Disable the package, router, and proxy verbose loggers.""" verbose_logger.disabled = True verbose_router_logger.disabled = True verbose_proxy_logger.disabled = True diff --git a/litellm/_redis.py b/litellm/_redis.py index f12afbac297..5ab551453bb 100644 --- a/litellm/_redis.py +++ b/litellm/_redis.py @@ -19,6 +19,7 @@ import redis.asyncio as async_redis # type: ignore from litellm import get_secret, get_secret_str from litellm._redis_credential_provider import ( + AzureADCredentialProvider, GCPIAMCredentialProvider, _generate_gcp_iam_access_token, ) @@ -27,6 +28,8 @@ from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker from ._logging import verbose_logger +AZURE_REDIS_SCOPE = "https://redis.azure.com/.default" + def _get_redis_kwargs(): arg_spec = inspect.getfullargspec(redis.Redis) @@ -38,14 +41,18 @@ def _get_redis_kwargs(): "retry", } - include_args = [ + include_args = { "url", "redis_connect_func", "gcp_service_account", "gcp_ssl_ca_certs", - ] + "azure_redis_ad_token", + "azure_client_id", + "azure_tenant_id", + "azure_client_secret", + } - available_args = [x for x in arg_spec.args if x not in exclude_args] + include_args + available_args = {x for x in arg_spec.args if x not in exclude_args} | include_args return available_args @@ -77,19 +84,25 @@ def _get_redis_cluster_kwargs(client=None): # Only allow primitive arguments exclude_args = {"self", "connection_pool", "retry", "host", "port", "startup_nodes"} - available_args = [x for x in arg_spec.args if x not in exclude_args] - available_args.append("password") - available_args.append("username") - available_args.append("ssl") - available_args.append("ssl_cert_reqs") - available_args.append("ssl_check_hostname") - available_args.append("ssl_ca_certs") - available_args.append( - "redis_connect_func" - ) # Needed for sync clusters and IAM detection - available_args.append("gcp_service_account") - available_args.append("gcp_ssl_ca_certs") - available_args.append("max_connections") + available_args = {x for x in arg_spec.args if x not in exclude_args} + available_args |= { + "password", + "username", + "ssl", + "ssl_cert_reqs", + "ssl_check_hostname", + "ssl_ca_certs", + "redis_connect_func", # Needed for sync clusters and IAM detection + "gcp_service_account", + "gcp_ssl_ca_certs", + "azure_redis_ad_token", + "azure_client_id", + "azure_tenant_id", + "azure_client_secret", + "max_connections", + "socket_timeout", + "socket_connect_timeout", + } return available_args @@ -155,6 +168,125 @@ def create_gcp_iam_redis_connect_func( return iam_connect +def _build_azure_credential( + azure_client_id: Optional[str] = None, + azure_tenant_id: Optional[str] = None, + azure_client_secret: Optional[str] = None, +): + """ + Build a long-lived Azure credential object. + + Azure SDK credentials cache tokens internally and handle expiry/refresh + transparently, so this should be called once and the result reused. + """ + try: + from azure.identity import ( + ClientSecretCredential, + DefaultAzureCredential, + ManagedIdentityCredential, + ) + except ImportError: + raise ImportError( + "azure-identity is required for Azure AD Redis authentication. " + "Install it with: pip install azure-identity" + ) + + _client_id = azure_client_id or os.environ.get("AZURE_CLIENT_ID") + _tenant_id = azure_tenant_id or os.environ.get("AZURE_TENANT_ID") + _client_secret = azure_client_secret or os.environ.get("AZURE_CLIENT_SECRET") + + if _client_id and _tenant_id and _client_secret: + return ClientSecretCredential( + client_id=_client_id, + tenant_id=_tenant_id, + client_secret=_client_secret, + ) + elif _client_id: + return ManagedIdentityCredential(client_id=_client_id) + else: + return DefaultAzureCredential() + + +def _generate_azure_ad_redis_token( + azure_client_id: Optional[str] = None, + azure_tenant_id: Optional[str] = None, + azure_client_secret: Optional[str] = None, +) -> str: + """ + One-shot helper that builds a credential and fetches a single Azure AD + access token for Redis. Each call rebuilds the credential and performs a + network round-trip, so it should not be used in steady-state Redis flows + — the sync (``create_azure_ad_redis_connect_func``) and async paths + (``AzureADCredentialProvider``) keep the credential alive across + connections so the Azure SDK's internal cache + silent refresh apply. + """ + credential = _build_azure_credential( + azure_client_id=azure_client_id, + azure_tenant_id=azure_tenant_id, + azure_client_secret=azure_client_secret, + ) + token = credential.get_token(AZURE_REDIS_SCOPE) + return token.token + + +def create_azure_ad_redis_connect_func( + azure_client_id: Optional[str] = None, + azure_tenant_id: Optional[str] = None, + azure_client_secret: Optional[str] = None, +) -> Callable: + """ + Creates a custom Redis connection function for Azure AD authentication. + + Used for sync Redis clients. The credential is created once (captured by the + closure) and reused across connections — the Azure SDK handles token caching + and silent renewal internally. Only ``get_token`` is called per connection. + """ + credential = _build_azure_credential( + azure_client_id=azure_client_id, + azure_tenant_id=azure_tenant_id, + azure_client_secret=azure_client_secret, + ) + + def ad_connect(self): + """Initialize the connection and authenticate using Azure AD""" + from redis.exceptions import ( + AuthenticationError, + AuthenticationWrongNumberOfArgsError, + ) + from redis.utils import str_if_bytes + + self._parser.on_connect(self) + + access_token = credential.get_token(AZURE_REDIS_SCOPE).token + + # Only include username when explicitly set — sending AUTH "" + # is invalid for most ACL-configured Azure Redis instances. + username = os.environ.get("REDIS_USERNAME", "") + if username: + auth_args = (username, access_token) + else: + auth_args = (access_token,) + + self.send_command("AUTH", *auth_args, check_health=False) + + try: + auth_response = self.read_response() + except AuthenticationWrongNumberOfArgsError: + # Fallback: try with just the token (Redis < 6 / no ACL) + self.send_command("AUTH", access_token, check_health=False) + auth_response = self.read_response() + + if str_if_bytes(auth_response) != "OK": + raise AuthenticationError("Azure AD authentication failed for Redis") + + # Attach the live credential object so async paths can wrap it in + # AzureADCredentialProvider for refresh-aware token retrieval. The raw + # client_id/tenant_id/secret are intentionally NOT exposed here — the + # credential closure already holds them. + ad_connect._azure_credential = credential # type: ignore[attr-defined] + return ad_connect + + def get_redis_url_from_environment(): if "REDIS_URL" in os.environ: return os.environ["REDIS_URL"] @@ -179,7 +311,7 @@ def get_redis_url_from_environment(): return f"{redis_protocol}://{auth_part}{os.environ['REDIS_HOST']}:{os.environ['REDIS_PORT']}" -def _get_redis_client_logic(**env_overrides): +def _get_redis_client_logic(**env_overrides): # noqa: PLR0915 """ Common functionality across sync + async redis client implementations """ @@ -253,6 +385,52 @@ def _get_redis_client_logic(**env_overrides): if _gcp_ssl_ca_certs and redis_kwargs.get("ssl", False): redis_kwargs["ssl_ca_certs"] = _gcp_ssl_ca_certs + # Handle Azure AD authentication (after GCP IAM block) + _azure_redis_ad_token = redis_kwargs.get("azure_redis_ad_token") or get_secret( + "REDIS_AZURE_AD_TOKEN" + ) + + _azure_ad_enabled = ( + _azure_redis_ad_token is not None + and str(_azure_redis_ad_token).lower() == "true" + ) + + if _azure_ad_enabled and _gcp_service_account is not None: + verbose_logger.warning( + "Both GCP IAM (gcp_service_account) and Azure AD (azure_redis_ad_token) are configured for Redis. " + "Using GCP IAM. Remove one to avoid misconfiguration." + ) + + if _azure_ad_enabled and _gcp_service_account is None: + _azure_client_id = redis_kwargs.get("azure_client_id") or get_secret_str( + "AZURE_CLIENT_ID" + ) + _azure_tenant_id = redis_kwargs.get("azure_tenant_id") or get_secret_str( + "AZURE_TENANT_ID" + ) + _azure_client_secret = redis_kwargs.get( + "azure_client_secret" + ) or get_secret_str("AZURE_CLIENT_SECRET") + + verbose_logger.debug("Setting up Azure AD authentication for Redis.") + redis_kwargs["redis_connect_func"] = create_azure_ad_redis_connect_func( + azure_client_id=_azure_client_id, + azure_tenant_id=_azure_tenant_id, + azure_client_secret=_azure_client_secret, + ) + # Marker for async paths to detect Azure AD auth. The live credential + # object is attached separately as `_azure_credential` by + # `create_azure_ad_redis_connect_func`; the raw client_id/tenant_id/secret + # are intentionally NOT exposed on the function to avoid leaking + # credentials via inspection or logging. + redis_kwargs["redis_connect_func"]._azure_redis_ad_token = True # type: ignore[attr-defined] + + # Always remove Azure-specific kwargs that shouldn't be passed to Redis client + redis_kwargs.pop("azure_redis_ad_token", None) + redis_kwargs.pop("azure_client_id", None) + redis_kwargs.pop("azure_tenant_id", None) + redis_kwargs.pop("azure_client_secret", None) + if "url" in redis_kwargs and redis_kwargs["url"] is not None: # Only strip host/port/db/password when not routing to a cluster. # When startup_nodes is also present the cluster path takes priority and @@ -303,10 +481,24 @@ def init_redis_cluster(redis_kwargs) -> redis.RedisCluster: return redis.RedisCluster(startup_nodes=new_startup_nodes, **cluster_kwargs) # type: ignore +def _get_redis_sentinel_connection_kwargs(redis_kwargs: dict) -> dict: + connection_kwargs = {} + args = _get_redis_kwargs() + for arg in redis_kwargs: + if arg in args: + connection_kwargs[arg] = redis_kwargs[arg] + + return connection_kwargs + + def _init_redis_sentinel(redis_kwargs) -> redis.Redis: sentinel_nodes = redis_kwargs.get("sentinel_nodes") sentinel_password = redis_kwargs.get("sentinel_password") service_name = redis_kwargs.get("service_name") + connection_kwargs = _get_redis_sentinel_connection_kwargs(redis_kwargs) + connection_kwargs.setdefault("socket_timeout", REDIS_SOCKET_TIMEOUT) + sentinel_kwargs = dict(connection_kwargs) + sentinel_kwargs["password"] = sentinel_password if not sentinel_nodes or not service_name: raise ValueError( @@ -318,19 +510,22 @@ def _init_redis_sentinel(redis_kwargs) -> redis.Redis: # Set up the Sentinel client sentinel = redis.Sentinel( sentinel_nodes, - socket_timeout=REDIS_SOCKET_TIMEOUT, - password=sentinel_password, + sentinel_kwargs=sentinel_kwargs, ) # Return the master instance for the given service - return sentinel.master_for(service_name) + return sentinel.master_for(service_name, **connection_kwargs) def _init_async_redis_sentinel(redis_kwargs) -> async_redis.Redis: sentinel_nodes = redis_kwargs.get("sentinel_nodes") sentinel_password = redis_kwargs.get("sentinel_password") service_name = redis_kwargs.get("service_name") + connection_kwargs = _get_redis_sentinel_connection_kwargs(redis_kwargs) + connection_kwargs.setdefault("socket_timeout", REDIS_SOCKET_TIMEOUT) + sentinel_kwargs = dict(connection_kwargs) + sentinel_kwargs["password"] = sentinel_password if not sentinel_nodes or not service_name: raise ValueError( @@ -342,13 +537,12 @@ def _init_async_redis_sentinel(redis_kwargs) -> async_redis.Redis: # Set up the Sentinel client sentinel = async_redis.Sentinel( sentinel_nodes, - socket_timeout=REDIS_SOCKET_TIMEOUT, - password=sentinel_password, + sentinel_kwargs=sentinel_kwargs, ) # Return the master instance for the given service - return sentinel.master_for(service_name) + return sentinel.master_for(service_name, **connection_kwargs) def get_redis_client(**env_overrides): @@ -373,7 +567,7 @@ def get_redis_client(**env_overrides): return redis.Redis(**redis_kwargs) -def get_redis_async_client( +def get_redis_async_client( # noqa: PLR0915 connection_pool: Optional[async_redis.BlockingConnectionPool] = None, **env_overrides, ) -> Union[async_redis.Redis, async_redis.RedisCluster]: @@ -398,6 +592,14 @@ def get_redis_async_client( cluster_kwargs["credential_provider"] = GCPIAMCredentialProvider( redis_connect_func._gcp_service_account ) + # Handle Azure AD authentication for async clusters via CredentialProvider + # so the credential's internal cache + silent refresh runs per connection + # (mirrors GCP IAM above; avoids static-token-baked-in-pool expiry). + elif redis_connect_func and hasattr(redis_connect_func, "_azure_credential"): + cluster_kwargs["credential_provider"] = AzureADCredentialProvider( + redis_connect_func._azure_credential, + username=os.environ.get("REDIS_USERNAME") or None, + ) new_startup_nodes: List[ClusterNode] = [] @@ -431,6 +633,22 @@ def get_redis_async_client( # Check for Redis Sentinel if "sentinel_nodes" in redis_kwargs and "service_name" in redis_kwargs: return _init_async_redis_sentinel(redis_kwargs) + + # Wrap GCP / Azure AD auth in a CredentialProvider for the standard async + # Redis client. The async client doesn't support redis_connect_func, but it + # does honour credential_provider — which is called per connection, so the + # underlying SDK can refresh tokens silently before they expire. + redis_connect_func = redis_kwargs.pop("redis_connect_func", None) + if redis_connect_func and hasattr(redis_connect_func, "_azure_credential"): + redis_kwargs["credential_provider"] = AzureADCredentialProvider( + redis_connect_func._azure_credential, + username=os.environ.get("REDIS_USERNAME") or None, + ) + elif redis_connect_func and hasattr(redis_connect_func, "_gcp_service_account"): + redis_kwargs["credential_provider"] = GCPIAMCredentialProvider( + redis_connect_func._gcp_service_account + ) + _pretty_print_redis_config(redis_kwargs=redis_kwargs) if connection_pool is not None: @@ -464,6 +682,21 @@ def get_redis_connection_pool( redis_kwargs["max_connections"], ) return async_redis.BlockingConnectionPool.from_url(**pool_kwargs) + + # Wrap GCP / Azure AD auth in a CredentialProvider so pool-managed + # connections re-fetch tokens via the SDK's internal cache + silent refresh + # rather than reusing a single token captured at pool creation. + redis_connect_func = redis_kwargs.pop("redis_connect_func", None) + if redis_connect_func and hasattr(redis_connect_func, "_azure_credential"): + redis_kwargs["credential_provider"] = AzureADCredentialProvider( + redis_connect_func._azure_credential, + username=os.environ.get("REDIS_USERNAME") or None, + ) + elif redis_connect_func and hasattr(redis_connect_func, "_gcp_service_account"): + redis_kwargs["credential_provider"] = GCPIAMCredentialProvider( + redis_connect_func._gcp_service_account + ) + connection_class = async_redis.Connection if "ssl" in redis_kwargs: connection_class = async_redis.SSLConnection diff --git a/litellm/_redis_credential_provider.py b/litellm/_redis_credential_provider.py index 70725fe12c4..586b1c7716c 100644 --- a/litellm/_redis_credential_provider.py +++ b/litellm/_redis_credential_provider.py @@ -1,10 +1,13 @@ import asyncio import threading import time -from typing import Dict, Tuple +from typing import Any, Dict, Optional, Tuple, Union from redis.credentials import CredentialProvider # type: ignore[attr-defined] +# Azure AD scope for Redis Cache for Azure. +AZURE_REDIS_SCOPE = "https://redis.azure.com/.default" + # GCP IAM tokens are valid for 1 hour. Cache for 55 minutes to refresh before expiry. _GCP_IAM_TOKEN_TTL_SECONDS = 3300 @@ -101,3 +104,33 @@ class GCPIAMCredentialProvider(CredentialProvider): _get_cached_gcp_iam_token, self._gcp_service_account ) return (token,) + + +class AzureADCredentialProvider(CredentialProvider): + """ + redis.credentials.CredentialProvider implementation that supplies Azure AD + tokens for Redis authentication. + + Wraps an azure-identity credential object so the Azure SDK's internal token + cache and silent refresh are honoured on every Redis connection. This avoids + the static-token-baked-in-pool issue where pool-managed connections would + fail authentication after the initial token expired (~1 hour TTL). + """ + + def __init__(self, credential: Any, username: Optional[str] = None) -> None: + self._credential = credential + self._username = username + + def get_credentials(self) -> Union[Tuple[str], Tuple[str, str]]: + token = self._credential.get_token(AZURE_REDIS_SCOPE).token + if self._username: + return (self._username, token) + return (token,) + + async def get_credentials_async(self) -> Union[Tuple[str], Tuple[str, str]]: + token_obj = await asyncio.to_thread( + self._credential.get_token, AZURE_REDIS_SCOPE + ) + if self._username: + return (self._username, token_obj.token) + return (token_obj.token,) diff --git a/litellm/_uuid.py b/litellm/_uuid.py index 52acf647dd8..2b7c3b82d35 100644 --- a/litellm/_uuid.py +++ b/litellm/_uuid.py @@ -6,7 +6,6 @@ Always uses fastuuid for performance. import fastuuid as _uuid # type: ignore - # Expose a module-like alias so callers can use: uuid.uuid4() uuid = _uuid diff --git a/litellm/anthropic_interface/exceptions/exception_mapping_utils.py b/litellm/anthropic_interface/exceptions/exception_mapping_utils.py index 28020e763f4..4548185bbdc 100644 --- a/litellm/anthropic_interface/exceptions/exception_mapping_utils.py +++ b/litellm/anthropic_interface/exceptions/exception_mapping_utils.py @@ -9,7 +9,6 @@ from typing import Dict, Optional from .exceptions import AnthropicErrorResponse, AnthropicErrorType - # HTTP status code -> Anthropic error type # Source: https://docs.anthropic.com/en/api/errors ANTHROPIC_ERROR_TYPE_MAP: Dict[int, AnthropicErrorType] = { diff --git a/litellm/anthropic_interface/exceptions/exceptions.py b/litellm/anthropic_interface/exceptions/exceptions.py index 984390fa702..b289e493e6b 100644 --- a/litellm/anthropic_interface/exceptions/exceptions.py +++ b/litellm/anthropic_interface/exceptions/exceptions.py @@ -2,7 +2,6 @@ from typing_extensions import Literal, Required, TypedDict - # Known Anthropic error types # Source: https://docs.anthropic.com/en/api/errors AnthropicErrorType = Literal[ diff --git a/litellm/batches/batch_utils.py b/litellm/batches/batch_utils.py index aaf083e75d6..74e753b09ea 100644 --- a/litellm/batches/batch_utils.py +++ b/litellm/batches/batch_utils.py @@ -113,8 +113,11 @@ def _batch_cost_calculator( """ Calculate the cost of a batch based on the output file id """ - # Handle Vertex AI with specialized method - if custom_llm_provider == "vertex_ai" and model_name: + if ( + custom_llm_provider == "vertex_ai" + and model_name + and getattr(litellm, "disable_vertex_batch_output_transformation", False) + ): batch_cost, _ = calculate_vertex_ai_batch_cost_and_usage( file_content_dictionary, model_name ) @@ -136,10 +139,13 @@ def calculate_vertex_ai_batch_cost_and_usage( model_name: Optional[str] = None, ) -> Tuple[float, Usage]: """ - Calculate both cost and usage from Vertex AI batch responses. + Calculate both cost and usage from raw Vertex AI batch responses. - Vertex AI batch output lines have format: - {"request": ..., "status": "", "response": {"candidates": [...], "usageMetadata": {...}}} + Used only when ``litellm.disable_vertex_batch_output_transformation = True``. + In that case the GCS predictions.jsonl is returned as-is, with each line in + the native Vertex format: + + {"request": ..., "response": {"candidates": [...], "usageMetadata": {...}}} usageMetadata contains promptTokenCount, candidatesTokenCount, totalTokenCount. """ @@ -362,8 +368,11 @@ def _get_batch_job_total_usage_from_file_content( """ Get the tokens of a batch job from the file content """ - # Handle Vertex AI with specialized method - if custom_llm_provider == "vertex_ai" and model_name: + if ( + custom_llm_provider == "vertex_ai" + and model_name + and getattr(litellm, "disable_vertex_batch_output_transformation", False) + ): _, batch_usage = calculate_vertex_ai_batch_cost_and_usage( file_content_dictionary, model_name ) diff --git a/litellm/batches/main.py b/litellm/batches/main.py index 259439d4d09..15ee9303969 100644 --- a/litellm/batches/main.py +++ b/litellm/batches/main.py @@ -617,24 +617,35 @@ def retrieve_batch( _is_async = kwargs.pop("aretrieve_batch", False) is True client = kwargs.get("client", None) - # Check if this is an async invoke ARN (different from regular batch ARN) - # Async invoke ARNs have format: arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:async-invoke/[a-z0-9]{12} - if ( - batch_id.startswith("arn:aws") - and ":bedrock:" in batch_id - and ":async-invoke/" in batch_id - ): - # Handle async invoke status check - # Remove aws_region_name from kwargs to avoid duplicate parameter - async_kwargs = kwargs.copy() - async_kwargs.pop("aws_region_name", None) + # Bedrock has two distinct ARN families that need different APIs: + # * async-invoke ARNs (Twelve Labs Marengo embeddings) -> bedrock-runtime data plane + # * model-invocation-job ARNs (CreateModelInvocationJob batch) -> bedrock control plane + # They live on different AWS service endpoints and can't share a handler. + # ARN shapes: + # arn:aws(-[^:]+)?:bedrock:::async-invoke/ + # arn:aws(-[^:]+)?:bedrock:::model-invocation-job/ + if batch_id.startswith("arn:aws") and ":bedrock:" in batch_id: + if ":async-invoke/" in batch_id: + # Remove aws_region_name from kwargs to avoid duplicate parameter + async_kwargs = kwargs.copy() + async_kwargs.pop("aws_region_name", None) - return BedrockBatchesHandler._handle_async_invoke_status( - batch_id=batch_id, - aws_region_name=kwargs.get("aws_region_name", "us-east-1"), - logging_obj=litellm_logging_obj, - **async_kwargs, - ) + return BedrockBatchesHandler._handle_async_invoke_status( + batch_id=batch_id, + aws_region_name=kwargs.get("aws_region_name", "us-east-1"), + logging_obj=litellm_logging_obj, + **async_kwargs, + ) + if ":model-invocation-job/" in batch_id: + mij_kwargs = kwargs.copy() + mij_kwargs.pop("aws_region_name", None) + + return BedrockBatchesHandler._handle_model_invocation_job_status( + batch_id=batch_id, + aws_region_name=kwargs.get("aws_region_name"), + logging_obj=litellm_logging_obj, + **mij_kwargs, + ) # Try to use provider config first (for providers like bedrock) model: Optional[str] = kwargs.get("model", None) diff --git a/litellm/budget_manager.py b/litellm/budget_manager.py index b25967579e0..bbebb6042cb 100644 --- a/litellm/budget_manager.py +++ b/litellm/budget_manager.py @@ -178,6 +178,18 @@ class BudgetManager: return list(self.user_dict.keys()) def reset_cost(self, user): + """ + Reset the tracked spend for a user back to zero. + + Clears both the aggregate ``current_cost`` and the per-model + ``model_cost`` breakdown stored for the given user. + + Args: + user: The user identifier whose cost should be reset. + + Returns: + dict: ``{"user": }`` reflecting the reset state. + """ self.user_dict[user]["current_cost"] = 0 self.user_dict[user]["model_cost"] = {} return {"user": self.user_dict[user]} diff --git a/litellm/caching/caching_handler.py b/litellm/caching/caching_handler.py index 3cf1d911d7f..3f4e54382c9 100644 --- a/litellm/caching/caching_handler.py +++ b/litellm/caching/caching_handler.py @@ -87,6 +87,16 @@ class CachingHandlerResponse(BaseModel): in_memory_cache_obj = InMemoryCache() +def _is_chat_completion_cached_dict(cached_result: dict) -> bool: + cached_id = cached_result.get("id") + if isinstance(cached_id, str) and cached_id.startswith("chatcmpl"): + return True + obj = cached_result.get("object") + if isinstance(obj, str): + return obj.startswith("chat.completion") + return "choices" in cached_result + + def _should_defer_streaming_cache_hit_callbacks(*, kwargs: Dict[str, Any]) -> bool: """ When stream=True, do not run success callbacks at cache-hit time. @@ -861,27 +871,47 @@ class LLMCachingHandler: elif (call_type == "aresponses" or call_type == "responses") and isinstance( cached_result, dict ): - from litellm.responses.streaming_iterator import ( - CachedResponsesAPIStreamingIterator, - ) - - response_obj = ResponsesAPIResponse(**cached_result) - if ( - hasattr(response_obj, "_hidden_params") - and response_obj._hidden_params is not None - and isinstance(response_obj._hidden_params, dict) - ): - response_obj._hidden_params["cache_hit"] = True - - if kwargs.get("stream", False) is True: - cached_result = CachedResponsesAPIStreamingIterator( - response=response_obj, - logging_obj=logging_obj, - request_data=kwargs, - call_type=call_type, - ) + use_chat_completion_cache = _is_chat_completion_cached_dict(cached_result) + if use_chat_completion_cache: + if kwargs.get("stream", False) is True: + bridge_call_type = ( + CallTypes.acompletion.value + if call_type == "aresponses" + else CallTypes.completion.value + ) + cached_result = self._convert_cached_stream_response( + cached_result=cached_result, + call_type=bridge_call_type, + logging_obj=logging_obj, + model=model, + ) + else: + cached_result = convert_to_model_response_object( + response_object=cached_result, + model_response_object=ModelResponse(), + ) else: - cached_result = response_obj + from litellm.responses.streaming_iterator import ( + CachedResponsesAPIStreamingIterator, + ) + + response_obj = ResponsesAPIResponse(**cached_result) + if ( + hasattr(response_obj, "_hidden_params") + and response_obj._hidden_params is not None + and isinstance(response_obj._hidden_params, dict) + ): + response_obj._hidden_params["cache_hit"] = True + + if kwargs.get("stream", False) is True: + cached_result = CachedResponsesAPIStreamingIterator( + response=response_obj, + logging_obj=logging_obj, + request_data=kwargs, + call_type=call_type, + ) + else: + cached_result = response_obj if ( hasattr(cached_result, "_hidden_params") diff --git a/litellm/completion_extras/litellm_responses_transformation/handler.py b/litellm/completion_extras/litellm_responses_transformation/handler.py index ce398ee8288..2de7bda6467 100644 --- a/litellm/completion_extras/litellm_responses_transformation/handler.py +++ b/litellm/completion_extras/litellm_responses_transformation/handler.py @@ -37,6 +37,15 @@ class ResponsesToCompletionBridgeHandler: stream = litellm_params.get("stream", False) return bool(stream) + @staticmethod + def _is_preformatted_cached_chat_stream(result: Any) -> bool: + from litellm.litellm_core_utils.streaming_handler import CustomStreamWrapper + + return ( + isinstance(result, CustomStreamWrapper) + and result.custom_llm_provider == "cached_response" + ) + @staticmethod def _coerce_response_object( response_obj: Any, @@ -177,6 +186,8 @@ class ResponsesToCompletionBridgeHandler: **request_data, ) + from litellm.types.utils import ModelResponse + stream = self._resolve_stream_flag(optional_params, litellm_params) if isinstance(result, ResponsesAPIResponse): return self.transformation_handler.transform_response( @@ -192,6 +203,8 @@ class ResponsesToCompletionBridgeHandler: api_key=kwargs.get("api_key"), json_mode=kwargs.get("json_mode"), ) + elif isinstance(result, ModelResponse): + return result elif not stream: responses_api_response = self._collect_response_from_stream(result) return self.transformation_handler.transform_response( @@ -208,6 +221,10 @@ class ResponsesToCompletionBridgeHandler: json_mode=kwargs.get("json_mode"), ) else: + if self._is_preformatted_cached_chat_stream(result): + return self._apply_post_stream_processing( + result, model, custom_llm_provider + ) completion_stream = self.transformation_handler.get_model_response_iterator( streaming_response=result, # type: ignore sync_stream=True, @@ -256,6 +273,8 @@ class ResponsesToCompletionBridgeHandler: aresponses=True, ) + from litellm.types.utils import ModelResponse + stream = self._resolve_stream_flag(optional_params, litellm_params) if isinstance(result, ResponsesAPIResponse): return self.transformation_handler.transform_response( @@ -271,6 +290,8 @@ class ResponsesToCompletionBridgeHandler: api_key=kwargs.get("api_key"), json_mode=kwargs.get("json_mode"), ) + elif isinstance(result, ModelResponse): + return result elif not stream: responses_api_response = await self._collect_response_from_stream_async( result @@ -289,6 +310,10 @@ class ResponsesToCompletionBridgeHandler: json_mode=kwargs.get("json_mode"), ) else: + if self._is_preformatted_cached_chat_stream(result): + return self._apply_post_stream_processing( + result, model, custom_llm_provider + ) completion_stream = self.transformation_handler.get_model_response_iterator( streaming_response=result, # type: ignore sync_stream=False, diff --git a/litellm/completion_extras/litellm_responses_transformation/transformation.py b/litellm/completion_extras/litellm_responses_transformation/transformation.py index da3b9184edb..51abbbf729b 100644 --- a/litellm/completion_extras/litellm_responses_transformation/transformation.py +++ b/litellm/completion_extras/litellm_responses_transformation/transformation.py @@ -30,6 +30,11 @@ from litellm.llms.base_llm.base_model_iterator import BaseModelResponseIterator from litellm.llms.base_llm.bridges.completion_transformation import ( CompletionTransformationBridge, ) +from litellm.responses.sse_output_recovery import ( + parse_sse_json_chunk, + record_output_item_chunk, + record_output_text_chunk, +) from litellm.types.llms.openai import ( ChatCompletionAnnotation, ChatCompletionReasoningItem, @@ -97,7 +102,7 @@ def _build_reasoning_item( def _reasoning_item_to_response_input( - r_item: Union[ChatCompletionReasoningItem, Dict[str, Any]] + r_item: Union[ChatCompletionReasoningItem, Dict[str, Any]], ) -> Dict[str, Any]: """Convert a stored ChatCompletionReasoningItem back to a Responses API input item.""" r_input: Dict[str, Any] = { @@ -119,6 +124,20 @@ class LiteLLMResponsesTransformationHandler(CompletionTransformationBridge): def __init__(self): pass + def _normalize_tool_choice_for_responses_api(self, tool_choice: Any) -> Any: + """Chat tool_choice uses function.name; Responses API expects top-level name.""" + if not isinstance(tool_choice, dict) or tool_choice.get("type") != "function": + return tool_choice + if isinstance(tool_choice.get("name"), str) and tool_choice.get("name"): + # Return only Responses shape so stray chat ``function`` key is not sent upstream. + return {"type": "function", "name": tool_choice["name"]} + fn = tool_choice.get("function") + if isinstance(fn, dict): + fn_name = fn.get("name") + if isinstance(fn_name, str) and fn_name: + return {"type": "function", "name": fn_name} + return tool_choice + def _handle_raw_dict_response_item( self, item: Dict[str, Any], index: int ) -> Tuple[Optional[Any], int]: @@ -309,6 +328,10 @@ class LiteLLMResponsesTransformationHandler(CompletionTransformationBridge): text_format = self._transform_response_format_to_text_format(value) if text_format: responses_api_request["text"] = text_format # type: ignore + elif key == "tool_choice": + responses_api_request["tool_choice"] = ( # type: ignore[assignment] + self._normalize_tool_choice_for_responses_api(value) + ) elif key in ResponsesAPIOptionalRequestParams.__annotations__.keys(): responses_api_request[key] = value # type: ignore elif key == "previous_response_id": @@ -583,6 +606,79 @@ class LiteLLMResponsesTransformationHandler(CompletionTransformationBridge): return choices + @classmethod + def _extract_output_from_completed_event( + cls, parsed_chunk: Dict[str, Any] + ) -> Optional[List[Dict[str, Any]]]: + response_payload = parsed_chunk.get("response") + if not isinstance(response_payload, dict): + return None + response_output = response_payload.get("output") + if not isinstance(response_output, list) or len(response_output) == 0: + return None + return cast(List[Dict[str, Any]], response_output) + + @classmethod + def _recover_output_items_from_raw_sse( + cls, raw_sse: Optional[str] + ) -> List[Dict[str, Any]]: + if not raw_sse or not isinstance(raw_sse, str): + return [] + + recovered_output_items: Dict[int, Dict[str, Any]] = {} + recovered_text_only_items: Dict[int, Dict[str, Any]] = {} + + for chunk in raw_sse.splitlines(): + parsed_chunk = parse_sse_json_chunk(chunk) + if parsed_chunk is None: + continue + + event_type = parsed_chunk.get("type") + + if event_type == ResponsesAPIStreamEvents.RESPONSE_COMPLETED: + recovered_output = cls._extract_output_from_completed_event( + parsed_chunk + ) + if recovered_output is not None: + return recovered_output + continue + + if event_type == ResponsesAPIStreamEvents.OUTPUT_ITEM_DONE: + record_output_item_chunk( + parsed_chunk=parsed_chunk, + output_items=recovered_output_items, + ) + continue + + if event_type == ResponsesAPIStreamEvents.OUTPUT_TEXT_DONE: + record_output_text_chunk( + parsed_chunk=parsed_chunk, + output_items=recovered_output_items, + text_only_items=recovered_text_only_items, + ) + continue + + # Merge text-only items into the recovered output items. Real + # OUTPUT_ITEM_DONE events take precedence at any given output_index, + # but text-only items at indices without a matching OUTPUT_ITEM_DONE + # must still be preserved (e.g. multi-output responses where some + # indices only emitted OUTPUT_TEXT_DONE). + merged_items: Dict[int, Dict[str, Any]] = {**recovered_text_only_items} + merged_items.update(recovered_output_items) + + if merged_items: + return [item for _, item in sorted(merged_items.items())] + + return [] + + @classmethod + def _recover_output_items_from_logging( + cls, logging_obj: "LiteLLMLoggingObj" + ) -> List[Dict[str, Any]]: + model_call_details = getattr(logging_obj, "model_call_details", {}) or {} + original_response = model_call_details.get("original_response") + return cls._recover_output_items_from_raw_sse(original_response) + def transform_response( # noqa: PLR0915 self, model: str, @@ -607,9 +703,22 @@ class LiteLLMResponsesTransformationHandler(CompletionTransformationBridge): if raw_response.error is not None: raise ValueError(f"Error in response: {raw_response.error}") + output_items = raw_response.output + if len(output_items) == 0: + recovered_output_items = self._recover_output_items_from_logging( + logging_obj + ) + if recovered_output_items: + output_items = cast(Any, recovered_output_items) + raw_response.output = cast(Any, recovered_output_items) + verbose_logger.warning( + "Recovered empty Responses API output from raw SSE for model=%s", + model, + ) + # Convert response output to choices using the static helper choices = self._convert_response_output_to_choices( - output_items=raw_response.output, + output_items=output_items, handle_raw_dict_callback=self._handle_raw_dict_response_item, ) @@ -623,7 +732,7 @@ class LiteLLMResponsesTransformationHandler(CompletionTransformationBridge): ) else: raise ValueError( - f"Unknown items in responses API response: {raw_response.output}" + f"Unknown items in responses API response: {output_items}" ) setattr(model_response, "choices", choices) @@ -1123,6 +1232,14 @@ class OpenAiResponsesToChatCompletionStreamIterator(BaseModelResponseIterator): event_type = parsed_chunk.get("type") if isinstance(event_type, ResponsesAPIStreamEvents): event_type = event_type.value + + if parsed_chunk.get("object") == "chat.completion.chunk" or ( + event_type is None + and isinstance(parsed_chunk.get("choices"), list) + and parsed_chunk.get("choices") + ): + return ModelResponseStream(**parsed_chunk) + verbose_logger.debug(f"Chat provider: Processing event type: {event_type}") if event_type == "response.created": @@ -1211,7 +1328,7 @@ class OpenAiResponsesToChatCompletionStreamIterator(BaseModelResponseIterator): raise ValueError( f"Chat provider: Invalid function argument delta {parsed_chunk}" ) - elif event_type == "response.output_item.done": + elif event_type == ResponsesAPIStreamEvents.OUTPUT_ITEM_DONE: # New output item added output_item = parsed_chunk.get("item", {}) if output_item.get("type") == "function_call": diff --git a/litellm/compression/content_detection.py b/litellm/compression/content_detection.py index 0655a42daf5..975117eb608 100644 --- a/litellm/compression/content_detection.py +++ b/litellm/compression/content_detection.py @@ -5,7 +5,6 @@ Auto-detect content type per message: code, JSON, or text. import json import re - _CODE_KEYWORDS = re.compile( r"\b(?:def |function |class |import |from |require\(|#include|fn |func |const |let |var |public |private |static )\b" ) diff --git a/litellm/constants.py b/litellm/constants.py index 1e96f8eac9a..fb765c0226c 100644 --- a/litellm/constants.py +++ b/litellm/constants.py @@ -161,6 +161,11 @@ MCP_STDIO_ALLOWED_COMMANDS: frozenset = frozenset( | (set(_MCP_STDIO_EXTRA_COMMANDS.split(",")) - {""}) ) +# MCP OAuth2 Token Exchange (OBO) Defaults +MCP_TOKEN_EXCHANGE_CACHE_MAX_SIZE = int( + os.getenv("MCP_TOKEN_EXCHANGE_CACHE_MAX_SIZE", "500") +) + LITELLM_UI_ALLOW_HEADERS = [ "x-litellm-semantic-filter", "x-litellm-semantic-filter-tools", @@ -1438,6 +1443,12 @@ CLI_JWT_EXPIRATION_HOURS = int( or os.getenv("LITELLM_CLI_JWT_EXPIRATION_HOURS") or 24 ) +# Comma-separated allowlisted OIDC claim map for CLI SSO polling, e.g. +# "employment_type->acme_employment_type,org_info.department->department" +CLI_SSO_CLAIM_MAP = ( + os.getenv("CLI_SSO_CLAIM_MAP") or os.getenv("LITELLM_CLI_SSO_CLAIM_MAP") or "" +) +CLI_SSO_CLAIM_MAX_SCALAR_LENGTH = 1024 ########################### UI SESSION DURATION ########################### # Duration for UI login session (username/password, SSO, invitation links). Format: "30s", "30m", "24h", "7d" @@ -1564,6 +1575,15 @@ DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL = int( os.getenv("DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL", 60) ) DEFAULT_ACCESS_GROUP_CACHE_TTL = int(os.getenv("DEFAULT_ACCESS_GROUP_CACHE_TTL", 600)) +# Short TTL for negative MCP access-group existence lookups. Keeps unauthenticated +# callers from forcing a DB query per request for unknown names, while bounding +# staleness so a transient DB error (which surfaces as an empty list) cannot +# hide a real group for long. +DEFAULT_MCP_ACCESS_GROUP_NEGATIVE_CACHE_TTL = 10 +# Maximum number of comma-separated MCP server / access-group tokens accepted +# in a single ``/{name1,name2,...}/mcp`` URL. Bounds the per-request DB / cache +# fan-out an authenticated caller can trigger by stuffing the path with tokens. +DEFAULT_MCP_NAMESPACE_CSV_MAX_TOKENS = 16 # Sentry Scrubbing Configuration SENTRY_DENYLIST = [ diff --git a/litellm/cost_calculator.py b/litellm/cost_calculator.py index 9b4dd80265c..98e00cf5788 100644 --- a/litellm/cost_calculator.py +++ b/litellm/cost_calculator.py @@ -173,17 +173,45 @@ def _cost_per_token_custom_pricing_helper( prompt_tokens: float = 0, completion_tokens: float = 0, response_time_ms: Optional[float] = 0.0, + cached_tokens: float = 0, + cache_creation_tokens: float = 0, ### CUSTOM PRICING ### custom_cost_per_token: Optional[CostPerToken] = None, custom_cost_per_second: Optional[float] = None, ) -> Optional[Tuple[float, float]]: - """Internal helper function for calculating cost, if custom pricing given""" + """Internal helper function for calculating cost, if custom pricing given. + + prompt_tokens is assumed to include both cached_tokens and cache_creation_tokens + (OpenAI-compatible convention). Anthropic-style usage where prompt_tokens excludes + cache tokens is handled at the caller (cost_per_token) before invoking this helper. + """ if custom_cost_per_token is None and custom_cost_per_second is None: return None if custom_cost_per_token is not None: - input_cost = custom_cost_per_token["input_cost_per_token"] * prompt_tokens - output_cost = custom_cost_per_token["output_cost_per_token"] * completion_tokens + input_cost_per_token = custom_cost_per_token["input_cost_per_token"] + output_cost_per_token = custom_cost_per_token["output_cost_per_token"] + + cache_read_input_token_cost = custom_cost_per_token.get( + "cache_read_input_token_cost", + input_cost_per_token, + ) + cache_creation_input_token_cost = custom_cost_per_token.get( + "cache_creation_input_token_cost", + input_cost_per_token, + ) + + regular_prompt_tokens = max( + prompt_tokens - cached_tokens - cache_creation_tokens, + 0, + ) + + input_cost = ( + regular_prompt_tokens * input_cost_per_token + + cached_tokens * cache_read_input_token_cost + + cache_creation_tokens * cache_creation_input_token_cost + ) + output_cost = completion_tokens * output_cost_per_token return input_cost, output_cost elif custom_cost_per_second is not None: output_cost = custom_cost_per_second * response_time_ms / 1000 # type: ignore @@ -323,10 +351,56 @@ def cost_per_token( # noqa: PLR0915 ) ## CUSTOM PRICING ## + # Normalize cache token counts across providers: + # - OpenAI-compatible: usage.prompt_tokens_details.cached_tokens + # (prompt_tokens already INCLUDES cached_tokens) + # - Anthropic: usage.cache_read_input_tokens / cache_creation_input_tokens + # (prompt_tokens does NOT include these — adjust before calling helper) + _cache_read_tokens: float = 0 + _cache_creation_tokens: float = 0 + _is_anthropic_style = False + + if usage_object is not None: + _pt_details = getattr(usage_object, "prompt_tokens_details", None) + if _pt_details is not None: + _cache_read_tokens = float(getattr(_pt_details, "cached_tokens", 0) or 0) + # OpenAI-compatible providers report cache-write tokens under + # either `cache_write_tokens` (kimi-k2) or `cache_creation_tokens`. + # Mirror db_spend_update_writer to stay symmetric. + _cache_creation_tokens = float( + getattr(_pt_details, "cache_write_tokens", 0) + or getattr(_pt_details, "cache_creation_tokens", 0) + or 0 + ) + + _anthropic_read = getattr(usage_object, "cache_read_input_tokens", None) + _anthropic_create = getattr(usage_object, "cache_creation_input_tokens", None) + if _anthropic_read is not None or _anthropic_create is not None: + _is_anthropic_style = True + if _anthropic_read is not None: + _cache_read_tokens = float(_anthropic_read) + if _anthropic_create is not None: + _cache_creation_tokens = float(_anthropic_create) + + if not _cache_read_tokens and cache_read_input_tokens: + _cache_read_tokens = float(cache_read_input_tokens) + _is_anthropic_style = True + if not _cache_creation_tokens and cache_creation_input_tokens: + _cache_creation_tokens = float(cache_creation_input_tokens) + _is_anthropic_style = True + + # Anthropic reports prompt_tokens as input_tokens (excluding cache tokens). + # Adjust so the helper's "prompt_tokens includes cache tokens" invariant holds. + _normalized_prompt_tokens = float(prompt_tokens) + if _is_anthropic_style: + _normalized_prompt_tokens += _cache_read_tokens + _cache_creation_tokens + response_cost = _cost_per_token_custom_pricing_helper( - prompt_tokens=prompt_tokens, + prompt_tokens=_normalized_prompt_tokens, completion_tokens=completion_tokens, response_time_ms=response_time_ms, + cached_tokens=_cache_read_tokens, + cache_creation_tokens=_cache_creation_tokens, custom_cost_per_second=custom_cost_per_second, custom_cost_per_token=custom_cost_per_token, ) @@ -1805,10 +1879,6 @@ def ocr_cost( if response.usage_info is None: raise ValueError("OCR response usage_info is None") - pages_processed = response.usage_info.pages_processed - if pages_processed is None: - raise ValueError("OCR response pages_processed is None") - try: model_info: Optional[ModelInfo] = litellm.get_model_info( model=model, custom_llm_provider=custom_llm_provider @@ -1816,9 +1886,49 @@ def ocr_cost( except Exception: model_info = None - ocr_cost_per_page: float = 0.0 + credits = getattr(response.usage_info, "credits", None) + cost_per_credit = None if model_info is not None: - ocr_cost_per_page = model_info.get("ocr_cost_per_page") or 0.0 + cost_per_credit = model_info.get("ocr_cost_per_credit") + if credits is not None and cost_per_credit is not None: + return cost_per_credit * credits, 0.0 + + ocr_cost_per_page: Optional[float] = None + if model_info is not None: + ocr_cost_per_page = model_info.get("ocr_cost_per_page") + + pages_processed = response.usage_info.pages_processed + if pages_processed is None: + if cost_per_credit is not None or ocr_cost_per_page is None: + # Surface missing usage data instead of silently under-reporting + # cost. The previous behavior raised ValueError; we now return 0.0 + # for credit-priced or unpriced models, so log a warning to keep + # the regression visible to operators. + verbose_logger.warning( + "OCR cost: model=%s custom_llm_provider=%s response.usage_info." + "pages_processed is None and credits=%s; returning 0.0 cost.", + model, + custom_llm_provider, + credits, + ) + return 0.0, 0.0 + raise ValueError("OCR response pages_processed is None") + + if ocr_cost_per_page is None: + # No per-page pricing configured. Either the model is on credit-based + # pricing (and credits weren't returned, so the credit branch above did + # not match) or the model has no OCR pricing entry at all. Surface a + # warning so that missing pricing entries are visible rather than + # silently producing zero cost for billable usage. + verbose_logger.warning( + "OCR cost: model=%s custom_llm_provider=%s reported " + "pages_processed=%s but no ocr_cost_per_page is configured; " + "returning 0.0 cost.", + model, + custom_llm_provider, + pages_processed, + ) + return 0.0, 0.0 total_ocr_processing_cost: float = ocr_cost_per_page * pages_processed return total_ocr_processing_cost, 0.0 @@ -2120,6 +2230,26 @@ def batch_cost_calculator( ) except Exception: model_info = None + elif not any( + model_info.get(k) is not None + for k in ( + "input_cost_per_token_batches", + "input_cost_per_token", + "output_cost_per_token_batches", + "output_cost_per_token", + ) + ): + # model_info was provided (e.g. deployment metadata with only id/db_model) + # but carries no pricing fields. Fall back to the global pricing table so + # that standard model pricing is used instead of silently returning $0. + try: + global_info = litellm.get_model_info( + model=model, custom_llm_provider=custom_llm_provider + ) + if global_info: + model_info = global_info + except Exception: + pass if not model_info: return 0.0, 0.0 diff --git a/litellm/exceptions.py b/litellm/exceptions.py index 8b005291556..17f5b43c273 100644 --- a/litellm/exceptions.py +++ b/litellm/exceptions.py @@ -918,9 +918,11 @@ class GuardrailRaisedException(Exception): guardrail_name: Optional[str] = None, message: str = "", should_wrap_with_default_message: bool = True, + status_code: int = 400, ): default_message = f"Guardrail raised an exception, Guardrail: {guardrail_name}, Message: {message}" self.guardrail_name = guardrail_name + self.status_code = status_code self.message = default_message if should_wrap_with_default_message else message super().__init__(self.message) @@ -930,12 +932,14 @@ class BlockedPiiEntityError(Exception): self, entity_type: str, guardrail_name: Optional[str] = None, + status_code: int = 400, ): """ Raised when a blocked entity is detected by a guardrail. """ self.entity_type = entity_type self.guardrail_name = guardrail_name + self.status_code = status_code self.message = f"Blocked entity detected: {entity_type} by Guardrail: {guardrail_name}. This entity is not allowed to be used in this request." super().__init__(self.message) diff --git a/litellm/experimental_mcp_client/client.py b/litellm/experimental_mcp_client/client.py index e703a3956b9..0dc56b6a3bc 100644 --- a/litellm/experimental_mcp_client/client.py +++ b/litellm/experimental_mcp_client/client.py @@ -366,6 +366,8 @@ class MCPClient: headers["Authorization"] = f"Bearer {self._mcp_auth_value}" elif self.auth_type == MCPAuth.token: headers["Authorization"] = f"token {self._mcp_auth_value}" + elif self.auth_type == MCPAuth.oauth2_token_exchange: + headers["Authorization"] = f"Bearer {self._mcp_auth_value}" elif isinstance(self._mcp_auth_value, dict): headers.update(self._mcp_auth_value) # Note: aws_sigv4 auth is not handled here — SigV4 requires per-request diff --git a/litellm/files/types.py b/litellm/files/types.py index 688bc86f0cf..ba42a39f666 100644 --- a/litellm/files/types.py +++ b/litellm/files/types.py @@ -1,6 +1,5 @@ from typing import AsyncIterator, Dict, Iterator, Literal, NamedTuple, Union - FileContentProvider = Literal[ "openai", "azure", "vertex_ai", "bedrock", "hosted_vllm", "anthropic", "manus" ] diff --git a/litellm/google_genai/adapters/__init__.py b/litellm/google_genai/adapters/__init__.py index bfa9e712678..6fbe7d95a55 100644 --- a/litellm/google_genai/adapters/__init__.py +++ b/litellm/google_genai/adapters/__init__.py @@ -1,10 +1,10 @@ """ Google GenAI Adapters for LiteLLM -This module provides adapters for transforming Google GenAI generate_content requests +This module provides adapters for transforming Google GenAI generate_content requests to/from LiteLLM completion format with full support for: - Text content transformation -- Tool calling (function declarations, function calls, function responses) +- Tool calling (function declarations, function calls, function responses) - Streaming (both regular and tool calling) - Mixed content (text + tool calls) """ diff --git a/litellm/integrations/SlackAlerting/batching_handler.py b/litellm/integrations/SlackAlerting/batching_handler.py index fdce2e04793..828f3eb4175 100644 --- a/litellm/integrations/SlackAlerting/batching_handler.py +++ b/litellm/integrations/SlackAlerting/batching_handler.py @@ -1,9 +1,9 @@ """ -Handles Batching + sending Httpx Post requests to slack +Handles Batching + sending Httpx Post requests to slack -Slack alerts are sent every 10s or when events are greater than X events +Slack alerts are sent every 10s or when events are greater than X events -see custom_batch_logger.py for more details / defaults +see custom_batch_logger.py for more details / defaults """ from typing import TYPE_CHECKING, Any diff --git a/litellm/integrations/SlackAlerting/utils.py b/litellm/integrations/SlackAlerting/utils.py index e695266c88b..e2580768178 100644 --- a/litellm/integrations/SlackAlerting/utils.py +++ b/litellm/integrations/SlackAlerting/utils.py @@ -18,7 +18,7 @@ else: def process_slack_alerting_variables( - alert_to_webhook_url: Optional[Dict[AlertType, Union[List[str], str]]] + alert_to_webhook_url: Optional[Dict[AlertType, Union[List[str], str]]], ) -> Optional[Dict[AlertType, Union[List[str], str]]]: """ process alert_to_webhook_url diff --git a/litellm/integrations/additional_logging_utils.py b/litellm/integrations/additional_logging_utils.py index 795afd81d41..59319140a18 100644 --- a/litellm/integrations/additional_logging_utils.py +++ b/litellm/integrations/additional_logging_utils.py @@ -1,5 +1,5 @@ """ -Base class for Additional Logging Utils for CustomLoggers +Base class for Additional Logging Utils for CustomLoggers - Health Check for the logging util - Get Request / Response Payload for the logging util diff --git a/litellm/integrations/custom_batch_logger.py b/litellm/integrations/custom_batch_logger.py index f9d4496c21f..8f4844501c3 100644 --- a/litellm/integrations/custom_batch_logger.py +++ b/litellm/integrations/custom_batch_logger.py @@ -1,5 +1,5 @@ """ -Custom Logger that handles batching logic +Custom Logger that handles batching logic Use this if you want your logs to be stored in memory and flushed periodically. """ @@ -14,22 +14,38 @@ from litellm.integrations.custom_logger import CustomLogger class CustomBatchLogger(CustomLogger): + preserve_events_added_during_flush = False + + # Default cap on the in-memory log queue. Prevents unbounded memory growth + # if ``async_send_batch`` consistently fails (e.g. the destination is + # unreachable) and events are preserved across flush attempts. Subclasses + # may override by passing ``max_queue_size`` or by setting the attribute + # directly (see ``RubrikLogger`` for an example). + DEFAULT_MAX_QUEUE_SIZE = 50_000 + def __init__( self, flush_lock: Optional[asyncio.Lock] = None, batch_size: Optional[int] = None, flush_interval: Optional[int] = None, + max_queue_size: Optional[int] = None, **kwargs, ) -> None: """ Args: flush_lock (Optional[asyncio.Lock], optional): Lock to use when flushing the queue. Defaults to None. Only used for custom loggers that do batching + max_queue_size (Optional[int], optional): Maximum number of events to retain in ``log_queue``. When the limit is exceeded (e.g. because the send destination is unreachable and events are preserved for retry), the oldest events are dropped. Defaults to ``DEFAULT_MAX_QUEUE_SIZE``. """ self.log_queue: List = [] self.flush_interval = flush_interval or litellm.DEFAULT_FLUSH_INTERVAL_SECONDS self.batch_size: int = batch_size or litellm.DEFAULT_BATCH_SIZE self.last_flush_time = time.time() self.flush_lock = flush_lock + self.max_queue_size: int = ( + max_queue_size + if max_queue_size is not None + else self.DEFAULT_MAX_QUEUE_SIZE + ) super().__init__(**kwargs) @@ -47,11 +63,40 @@ class CustomBatchLogger(CustomLogger): async with self.flush_lock: if self.log_queue: + log_queue_length = len(self.log_queue) verbose_logger.debug( "CustomLogger: Flushing batch of %s events", len(self.log_queue) ) - await self.async_send_batch() - self.log_queue.clear() + try: + await self.async_send_batch() + except Exception: + # If the underlying batch send raised, do NOT drop the + # in-flight events. They will be retried on the next flush. + # Most existing async_send_batch implementations swallow + # their own errors, so this only affects loggers that opt + # in to surfacing failures (e.g. Rubrik). + verbose_logger.exception( + "CustomLogger: async_send_batch raised; preserving " + "%s events in queue for retry", + log_queue_length, + ) + # Guard against unbounded queue growth if the destination + # is persistently unreachable. Drop the oldest events + # beyond ``max_queue_size``. + overflow = len(self.log_queue) - self.max_queue_size + if overflow > 0: + del self.log_queue[:overflow] + verbose_logger.warning( + "CustomLogger: log queue exceeded max_queue_size=%s; " + "dropped %s oldest events.", + self.max_queue_size, + overflow, + ) + return + if self.preserve_events_added_during_flush: + del self.log_queue[:log_queue_length] + else: + self.log_queue.clear() self.last_flush_time = time.time() async def async_send_batch(self, *args, **kwargs): diff --git a/litellm/integrations/custom_guardrail.py b/litellm/integrations/custom_guardrail.py index a03aef481e7..82a35f2eedd 100644 --- a/litellm/integrations/custom_guardrail.py +++ b/litellm/integrations/custom_guardrail.py @@ -43,7 +43,11 @@ if TYPE_CHECKING: dc = DualCache() -from litellm.exceptions import ModifyResponseException as ModifyResponseException +from litellm.exceptions import ( + BlockedPiiEntityError, + GuardrailRaisedException, + ModifyResponseException, +) class CustomGuardrail(CustomLogger): @@ -737,12 +741,15 @@ class CustomGuardrail(CustomLogger): (this was logged previously as an API failure - guardrail_failed_to_respond). Guardrails signal intentional blocks by raising: + - GuardrailRaisedException (generic guardrail API, tool permission) + - BlockedPiiEntityError (Presidio PII detection) - HTTPException with status 400 (content policy violation) - ModifyResponseException (passthrough mode violation) """ - if isinstance(e, ModifyResponseException): return True + if isinstance(e, (GuardrailRaisedException, BlockedPiiEntityError)): + return True if ( HTTPException is not None and isinstance(e, HTTPException) @@ -888,6 +895,15 @@ def log_guardrail_information(func): - pre_call - during_call - post_call + + Some guardrails (e.g. ``block_code_execution``) call + ``add_standard_logging_guardrail_information_to_request_data`` directly + from inside the wrapped function so they can record a richer payload + (structured detections, tracing detail) than this decorator's + "allow"/"mask"/raw-response default. To avoid double-recording in that + case (which would emit two spans, two Datadog records, two spend-log + entries, etc.), snapshot the entry count before invocation: if the + wrapped function already appended its own entry, skip the auto-record. """ import functools import inspect @@ -907,6 +923,16 @@ def log_guardrail_information(func): return GuardrailEventHooks.post_call return None + def _count_recorded_guardrail_entries(request_data: dict) -> int: + total = 0 + for container_key in ("metadata", "litellm_metadata"): + container = request_data.get(container_key) + if isinstance(container, dict): + entries = container.get("standard_logging_guardrail_information") + if isinstance(entries, list): + total += len(entries) + return total + @functools.wraps(func) async def async_wrapper(*args, **kwargs): start_time = datetime.now() # Move start_time inside the wrapper @@ -919,8 +945,11 @@ def log_guardrail_information(func): if func.__name__ == "apply_guardrail" and "inputs" in kwargs: original_inputs = kwargs.get("inputs") + entries_before = _count_recorded_guardrail_entries(request_data) try: response = await func(*args, **kwargs) + if _count_recorded_guardrail_entries(request_data) > entries_before: + return response return self._process_response( response=response, request_data=request_data, @@ -931,6 +960,8 @@ def log_guardrail_information(func): original_inputs=original_inputs, ) except Exception as e: + if _count_recorded_guardrail_entries(request_data) > entries_before: + raise return self._process_error( e=e, request_data=request_data, @@ -952,8 +983,11 @@ def log_guardrail_information(func): if func.__name__ == "apply_guardrail" and "inputs" in kwargs: original_inputs = kwargs.get("inputs") + entries_before = _count_recorded_guardrail_entries(request_data) try: response = func(*args, **kwargs) + if _count_recorded_guardrail_entries(request_data) > entries_before: + return response return self._process_response( response=response, request_data=request_data, @@ -962,6 +996,8 @@ def log_guardrail_information(func): original_inputs=original_inputs, ) except Exception as e: + if _count_recorded_guardrail_entries(request_data) > entries_before: + raise return self._process_error( e=e, request_data=request_data, diff --git a/litellm/integrations/custom_logger.py b/litellm/integrations/custom_logger.py index 300c311f36d..481cf7fce8e 100644 --- a/litellm/integrations/custom_logger.py +++ b/litellm/integrations/custom_logger.py @@ -697,6 +697,27 @@ class CustomLogger: # https://docs.litellm.ai/docs/observability/custom_callbac """ return AgenticLoopPlan(run_agentic_loop=False) + async def async_post_agentic_loop_response_hook( + self, + response: Any, + plan: AgenticLoopPlan, + kwargs: Dict, + ) -> Any: + """ + Post-process the response returned by the agentic-loop follow-up call. + + Called after BaseLLMHTTPHandler executes ``AgenticLoopPlan.request_patch`` + and receives the final response from the provider. Lets callbacks shape + what the client sees without bypassing the loop's safety / observability + machinery (depth tracking, fingerprinting, etc.). + + Use ``plan.metadata`` to carry whatever the build step decided to expose + for post-processing (e.g. native tool_result blocks to inject). + + Default returns ``response`` unchanged. + """ + return response + async def async_should_run_chat_completion_agentic_loop( self, response: Any, diff --git a/litellm/integrations/focus/transformer.py b/litellm/integrations/focus/transformer.py index b7d28e3dbb9..6f4433b4a05 100644 --- a/litellm/integrations/focus/transformer.py +++ b/litellm/integrations/focus/transformer.py @@ -9,7 +9,6 @@ import polars as pl from .schema import FOCUS_NORMALIZED_SCHEMA - _TAG_KEYS = ( "team_id", "team_alias", diff --git a/litellm/integrations/opentelemetry.py b/litellm/integrations/opentelemetry.py index 77833e5de0f..81fdc5a1e21 100644 --- a/litellm/integrations/opentelemetry.py +++ b/litellm/integrations/opentelemetry.py @@ -1,7 +1,7 @@ import os -from dataclasses import dataclass +from dataclasses import dataclass, field from datetime import datetime -from typing import TYPE_CHECKING, Any, Dict, List, Optional, Union, cast +from typing import TYPE_CHECKING, Any, Dict, List, Optional, Set, Union, cast import litellm from litellm._logging import verbose_logger @@ -10,6 +10,12 @@ from litellm.integrations._types.open_inference import ( SpanAttributes, ) from litellm.integrations.custom_logger import CustomLogger +from litellm.integrations.opentelemetry_utils.gen_ai_semconv import ( + OTEL_SEMCONV_STABILITY_OPT_IN_ENV, + OTELGenAISemconvMixin, + OTELSemconvCategory, + parse_semconv_opt_in, +) from litellm.litellm_core_utils.safe_json_dumps import safe_dumps from litellm.secret_managers.main import get_secret_bool, str_to_bool from litellm.types.services import ServiceLoggerPayload @@ -53,10 +59,26 @@ LITELLM_TRACER_NAME = os.getenv("OTEL_TRACER_NAME", "litellm") LITELLM_METER_NAME = os.getenv("LITELLM_METER_NAME", "litellm") LITELLM_LOGGER_NAME = os.getenv("LITELLM_LOGGER_NAME", "litellm") LITELLM_PROXY_REQUEST_SPAN_NAME = "Received Proxy Server Request" +# OTel-standard names. status is also kept under error.code for back compat. +HTTP_RESPONSE_STATUS_CODE_ATTRIBUTE = "http.response.status_code" +HTTP_ROUTE_ATTRIBUTE = "http.route" +URL_PATH_ATTRIBUTE = "url.path" +PREPROCESSING_DURATION_MS_ATTRIBUTE = "litellm.preprocessing.duration_ms" # Remove the hardcoded LITELLM_RESOURCE dictionary - we'll create it properly later RAW_REQUEST_SPAN_NAME = "raw_gen_ai_request" LITELLM_REQUEST_SPAN_NAME = "litellm_request" +CAPTURE_MODE_NO_CONTENT = "NO_CONTENT" +CAPTURE_MODE_SPAN_ONLY = "SPAN_ONLY" +CAPTURE_MODE_EVENT_ONLY = "EVENT_ONLY" +CAPTURE_MODE_SPAN_AND_EVENT = "SPAN_AND_EVENT" +_VALID_CAPTURE_MODES = { + CAPTURE_MODE_NO_CONTENT, + CAPTURE_MODE_SPAN_ONLY, + CAPTURE_MODE_EVENT_ONLY, + CAPTURE_MODE_SPAN_AND_EVENT, +} + @dataclass class OpenTelemetryConfig: @@ -71,6 +93,10 @@ class OpenTelemetryConfig: ignore_context_propagation: Optional[bool] = None # When True, create a private TracerProvider instead of reusing or setting the global one. skip_set_global: bool = False + # Programmatic override for OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT. + # One of NO_CONTENT, SPAN_ONLY, EVENT_ONLY, SPAN_AND_EVENT (or "true" as legacy alias). + capture_message_content: Optional[str] = None + semconv_stability_opt_in: Set[OTELSemconvCategory] = field(default_factory=set) def __post_init__(self) -> None: # If endpoint is specified but exporter is still the default "console", @@ -96,6 +122,11 @@ class OpenTelemetryConfig: self.ignore_context_propagation = str_to_bool( os.getenv("OTEL_IGNORE_CONTEXT_PROPAGATION") ) + # Resolve the env opt-in once here so self.semconv_stability_opt_in is the + # single source of truth: the union of programmatic and env categories. + self.semconv_stability_opt_in |= parse_semconv_opt_in( + os.getenv(OTEL_SEMCONV_STABILITY_OPT_IN_ENV) + ) @classmethod def from_env(cls): @@ -143,7 +174,7 @@ class OpenTelemetryConfig: ) -class OpenTelemetry(CustomLogger): +class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger): def __init__( self, config: Optional[OpenTelemetryConfig] = None, @@ -182,6 +213,9 @@ class OpenTelemetry(CustomLogger): super().__init__(**kwargs) self._init_metrics(meter_provider) self._init_logs(logger_provider) + # Sample env-var / config / message_logging at init so subsequent + # _capture_in_span / _capture_in_event calls are deterministic. + self._capture_mode_cached = self._compute_capture_mode_from_init_state() self._init_otel_logger_on_litellm_proxy() @staticmethod @@ -220,7 +254,14 @@ class OpenTelemetry(CustomLogger): not isinstance(cb, OpenTelemetry) for cb in litellm.service_callback ): litellm.service_callback.append(self) - setattr(proxy_server, "open_telemetry_logger", self) + # avoid proxy logger ownership being overwritten by later + # handlers. Multiple integrations (default OTEL, Langfuse OTEL, + # Arize OTEL, etc.) may initialize in sequence; without this guard, + # the last one silently replaces the first and breaks expected + # routing for proxy_server.open_telemetry_logger consumers. + # Behavior: first-registered wins. + if getattr(proxy_server, "open_telemetry_logger", None) is None: + setattr(proxy_server, "open_telemetry_logger", self) def _get_or_create_provider( self, @@ -306,6 +347,62 @@ class OpenTelemetry(CustomLogger): hasattr(self, "callback_name") and self.callback_name == "langfuse_otel" ) + def _compute_capture_mode_from_init_state(self) -> Optional[str]: + """Sample explicit settings at init. Returns the resolved mode or + None if nothing explicit is set (in which case the legacy + ``self.message_logging`` flag is consulted dynamically per request). + + ``"true"``/``"1"`` map to ``EVENT_ONLY`` per the contrib convention. + ``"false"``/``"0"`` map to ``NO_CONTENT``. + Unknown values are ignored. + """ + explicit = self.config.capture_message_content or os.getenv( + "OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT" + ) + if not explicit: + return None + normalized = explicit.upper() + if normalized in ("TRUE", "1"): + return CAPTURE_MODE_EVENT_ONLY + if normalized in ("FALSE", "0"): + return CAPTURE_MODE_NO_CONTENT + if normalized in _VALID_CAPTURE_MODES: + return normalized + return None + + def _resolve_capture_mode(self) -> str: + """Return the active capture mode for this request. + + Precedence: + 1. ``litellm.turn_off_message_logging=True`` forces ``NO_CONTENT`` + (kill-switch checked dynamically). + 2. Explicit setting sampled at init from + ``OpenTelemetryConfig.capture_message_content`` or + ``OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT``. + 3. Legacy ``self.message_logging`` (checked dynamically). + """ + if litellm.turn_off_message_logging: + return CAPTURE_MODE_NO_CONTENT + if self._capture_mode_cached is not None: + return self._capture_mode_cached + return ( + CAPTURE_MODE_SPAN_AND_EVENT + if self.message_logging + else CAPTURE_MODE_NO_CONTENT + ) + + def _capture_in_span(self) -> bool: + return self._resolve_capture_mode() in ( + CAPTURE_MODE_SPAN_ONLY, + CAPTURE_MODE_SPAN_AND_EVENT, + ) + + def _capture_in_event(self) -> bool: + return self._resolve_capture_mode() in ( + CAPTURE_MODE_EVENT_ONLY, + CAPTURE_MODE_SPAN_AND_EVENT, + ) + def _init_tracing(self, tracer_provider): from opentelemetry import trace from opentelemetry.sdk.trace import TracerProvider @@ -575,6 +672,48 @@ class OpenTelemetry(CustomLogger): parent_otel_span = user_api_key_dict.parent_otel_span if parent_otel_span is not None: parent_otel_span.set_status(Status(StatusCode.ERROR)) + + # Stamp team attributes onto the SERVER (root) span too, so the + # trace root is team-filterable on the failure path like the + # child exception span below. + self._set_team_attributes_on_span( + span=parent_otel_span, + team_id=user_api_key_dict.team_id, + team_alias=user_api_key_dict.team_alias, + ) + + # Stamp structured error attrs on the SERVER span itself; the + # failure path otherwise only sets its status (_handle_failure + # records on the litellm_request child span). Inline import: + # litellm_logging <-> integrations is circular. + from litellm.litellm_core_utils.litellm_logging import ( + StandardLoggingPayloadSetup, + ) + + error_information = StandardLoggingPayloadSetup.get_error_information( + original_exception=original_exception, + traceback_str=traceback_str, + ) + self._record_exception_on_span( + span=parent_otel_span, + kwargs={ + "exception": original_exception, + "standard_logging_object": {"error_information": error_information}, + }, + ) + + # _record_exception_on_span only stamps when error_code is set; + # bare TypeError etc. has none, and the span is about to be ended. + error_code = ( + error_information.get("error_code") if error_information else None + ) + if not error_code: + self.set_response_status_code_attribute(parent_otel_span, 500) + + # Pre-request latency (request_data carries the propagated + # metadata on the failure path; omitted if it failed before handoff). + self.set_preprocessing_duration_attribute(parent_otel_span, request_data) + _span_name = "Failed Proxy Server Request" # Exception Logging Child Span @@ -587,12 +726,65 @@ class OpenTelemetry(CustomLogger): key="exception", value=str(original_exception), ) + self._set_team_attributes_on_span( + span=exception_logging_span, + team_id=user_api_key_dict.team_id, + team_alias=user_api_key_dict.team_alias, + ) exception_logging_span.set_status(Status(StatusCode.ERROR)) exception_logging_span.end(end_time=self._to_ns(datetime.now())) + # Emit guardrail spans for any guardrail invocations that + # ran during this request. _handle_failure typically does this, + # but for pre-call guardrail blocks the standard_logging_object + # may not carry guardrail_information by the time _handle_failure + # fires (the data lives only in request_data["metadata"]). Pull + # directly from request_data so the span is recorded either way; + # _emit_once dedupes if _handle_failure already emitted it. + self._emit_guardrail_spans_from_request_data( + request_data=request_data, + parent_span=parent_otel_span, + ) + # End Parent OTEL Sspan parent_otel_span.end(end_time=self._to_ns(datetime.now())) + def _emit_guardrail_spans_from_request_data( + self, + request_data: dict, + parent_span: Optional[Any], + ) -> None: + """Emit ``guardrail`` spans from ``request_data["metadata"] + ["standard_logging_guardrail_information"]``. + + Routed through ``_create_guardrail_span`` so the dedupe state in + ``_otel_internal`` is honoured — if ``_handle_failure`` already + emitted these spans for the same kwargs, this is a no-op. + """ + from opentelemetry import trace as _trace + + metadata = (request_data or {}).get("metadata") or {} + guardrail_information = metadata.get("standard_logging_guardrail_information") + if not guardrail_information: + return + + # _create_guardrail_span reads guardrail_information from + # kwargs["standard_logging_object"] and shares its dedupe state via + # kwargs["litellm_params"]["metadata"]["_otel_internal"]. Pass the + # SAME metadata dict the proxy populated so _handle_failure and + # this hook see the same dedupe markers. + kwargs: Dict[str, Any] = { + "litellm_params": {"metadata": metadata}, + "standard_logging_object": { + "guardrail_information": guardrail_information, + "metadata": metadata, + }, + } + context = ( + _trace.set_span_in_context(parent_span) if parent_span is not None else None + ) + self._create_guardrail_span(kwargs=kwargs, context=context) + async def async_post_call_success_hook( self, data: dict, @@ -611,6 +803,9 @@ class OpenTelemetry(CustomLogger): ctx, _ = self._get_span_context(kwargs, default_span=parent_span) + # Pre-request latency on the SERVER span (success path). + self.set_preprocessing_duration_attribute(parent_span, kwargs) + # 3. Guardrail span self._create_guardrail_span(kwargs=kwargs, context=ctx) @@ -721,12 +916,108 @@ class OpenTelemetry(CustomLogger): # End of Team/Key Based Logging Control Flow ######################################################### + def _emit_once(self, kwargs: dict, *scope: object) -> bool: + """Return True the first time this handler is asked to emit a span + for the given (handler, scope) on this kwargs; False on repeats. + + Used to suppress duplicate span emission for two distinct patterns: + + 1. **Handler-level dual-fire**: streaming code paths trigger both + the sync and async callback for one request, so ``_handle_success`` + / ``_handle_failure`` would otherwise produce two + ``litellm_request`` spans. Scope: ``("success",)`` / ``("failure",)``. + 2. **Payload-driven multi-entrypoint emission**: a span loop that + reads entries from ``standard_logging_payload`` (currently only + guardrails) is invoked from multiple lifecycle points + (post-call hooks, success callback, failure callback). The list + can be re-read with mutated entries between calls, so dedupe + must be at entry granularity. Scope: the entry's stable identity. + + ``scope`` parts can be any hashable identity. The marker is stored + in ``kwargs["litellm_params"]["metadata"]["_otel_internal"]`` so it + is request-local (kwargs is shared across the sync/async callbacks + and lifecycle hooks for one request). + """ + litellm_params = kwargs.get("litellm_params") + if not isinstance(litellm_params, dict): + litellm_params = {} + kwargs["litellm_params"] = litellm_params + + _metadata = litellm_params.get("metadata") + if not isinstance(_metadata, dict): + _metadata = {} + litellm_params["metadata"] = _metadata + + _otel_internal = _metadata.get("_otel_internal") + if not isinstance(_otel_internal, dict): + _otel_internal = {} + _metadata["_otel_internal"] = _otel_internal + + spans_logged = _otel_internal.get("spans_logged") + if not isinstance(spans_logged, dict): + spans_logged = {} + _otel_internal["spans_logged"] = spans_logged + + dedupe_key = (self.__class__.__name__, id(self), *scope) + if spans_logged.get(dedupe_key) is True: + return False + + spans_logged[dedupe_key] = True + return True + + def _end_proxy_span_from_kwargs(self, kwargs: dict, end_time) -> None: + """Close the proxy-level parent span if it is still recording. + + This helper retrieves the proxy span directly from kwargs metadata + and closes it after all child spans have been recorded. + + Only called from the success path. The failure path deliberately + leaves the proxy span open so ``async_post_call_failure_hook`` can + append the ``"Failed Proxy Server Request"`` child span before + closing it. + + Only spans named ``LITELLM_PROXY_REQUEST_SPAN_NAME`` are closed — + externally provided spans must not be closed by LiteLLM. + """ + litellm_params = kwargs.get("litellm_params", {}) or {} + _metadata = litellm_params.get("metadata", {}) or {} + proxy_span = _metadata.get("litellm_parent_otel_span", None) + if ( + proxy_span is not None + and getattr(proxy_span, "name", None) == LITELLM_PROXY_REQUEST_SPAN_NAME + and hasattr(proxy_span, "is_recording") + and proxy_span.is_recording() + ): + self._close_proxy_span_ok(proxy_span, end_time) + + def _close_proxy_span_ok(self, span: Span, end_time) -> None: + """Stamp http.response.status_code=200 + status=OK, then end the span.""" + from opentelemetry.trace import Status, StatusCode + + self.set_response_status_code_attribute(span, 200) + span.set_status(Status(StatusCode.OK)) + span.end(end_time=self._to_ns(end_time)) + def _handle_success(self, kwargs, response_obj, start_time, end_time): + """Create the litellm_request span then close the proxy span.""" verbose_logger.debug( "OpenTelemetry Logger: Logging kwargs: %s, OTEL config settings=%s", kwargs, self.config, ) + + # sync + async success handlers can both fire for one + # request (notably in streaming code paths). Guard against duplicate + # span writes — but still close the proxy span on the skip path so + # the trace doesn't leak an open root span. + if not self._emit_once(kwargs, "success"): + verbose_logger.debug( + "OpenTelemetry: skipping duplicate success span for handler=%s", + self.__class__.__name__, + ) + self._end_proxy_span_from_kwargs(kwargs, end_time) + return + ctx, parent_span = self._get_span_context(kwargs) if self.config.ignore_context_propagation: @@ -786,13 +1077,24 @@ class OpenTelemetry(CustomLogger): # 6. Do NOT end parent span - it should be managed by its creator # External spans (from Langfuse, user code, HTTP headers, global context) must not be closed by LiteLLM - # However, proxy-created spans should be closed here + # However, proxy-created spans should be closed here. if ( parent_span is not None and hasattr(parent_span, "name") and parent_span.name == LITELLM_PROXY_REQUEST_SPAN_NAME + and hasattr(parent_span, "is_recording") + and parent_span.is_recording() ): - parent_span.end(end_time=self._to_ns(end_time)) + self._close_proxy_span_ok(parent_span, end_time) + + # Stamp team attributes onto the SERVER (root) span before it is + # closed, so the trace root carries them like every child span. + self._set_team_attributes_on_proxy_span_from_kwargs(kwargs) + + # close the proxy span explicitly from kwargs metadata + # after all child spans (litellm_request, guardrail, raw_request) + # have been fully recorded and exported. + self._end_proxy_span_from_kwargs(kwargs, end_time) def _start_primary_span( self, @@ -806,13 +1108,14 @@ class OpenTelemetry(CustomLogger): otel_tracer: Tracer = self.get_tracer_to_use_for_request(kwargs) - # Always create a new span - # The parent relationship is preserved through the context parameter - span = otel_tracer.start_span( - name=self._get_span_name(kwargs), - start_time=self._to_ns(start_time), - context=context, - ) + span_kwargs: Dict[str, Any] = { + "name": self._get_span_name(kwargs), + "start_time": self._to_ns(start_time), + "context": context, + } + if self._gen_ai_semconv_latest_experimental: + span_kwargs["kind"] = self.span_kind.CLIENT + span = otel_tracer.start_span(**span_kwargs) span.set_status(Status(StatusCode.OK)) self.set_attributes(span, kwargs, response_obj) @@ -825,8 +1128,11 @@ class OpenTelemetry(CustomLogger): from opentelemetry import trace from opentelemetry.trace import Status, StatusCode - # only log raw LLM request/response if message_logging is on and not globally turned off - if litellm.turn_off_message_logging or not self.message_logging: + # raw_gen_ai_request is non-standard in semconv mode. + if self._gen_ai_semconv_latest_experimental: + return + + if not self._capture_in_span(): return litellm_params = kwargs.get("litellm_params", {}) @@ -843,15 +1149,81 @@ class OpenTelemetry(CustomLogger): ) raw_span.set_status(Status(StatusCode.OK)) self.set_raw_request_attributes(raw_span, kwargs, response_obj) + self._set_team_attributes_from_kwargs(raw_span, kwargs) raw_span.end(end_time=self._to_ns(end_time)) + def _set_team_attributes_on_span( + self, + span: Span, + team_id: Optional[str], + team_alias: Optional[str], + ) -> None: + """Stamp team_id / team_alias onto a span so every child span of a + litellm_request trace carries them, not just the root span. + + Empty strings are treated as absent: a request made with the master + key or a team-less virtual key carries ``user_api_key_team_id=""`` + in ``standard_logging_object.metadata``; propagating that to every + span only adds noise that makes traces look mis-instrumented. + """ + if team_id: + self.safe_set_attribute( + span=span, + key="metadata.user_api_key_team_id", + value=team_id, + ) + if team_alias: + self.safe_set_attribute( + span=span, + key="metadata.user_api_key_team_alias", + value=team_alias, + ) + + def _set_team_attributes_from_kwargs(self, span: Span, kwargs: dict) -> None: + """Pull team_id / team_alias from the standard logging metadata in kwargs and stamp them onto span.""" + std_log = kwargs.get("standard_logging_object") + md: dict = {} + if isinstance(std_log, dict): + md = std_log.get("metadata") or {} + elif std_log is not None: + md = getattr(std_log, "metadata", None) or {} + self._set_team_attributes_on_span( + span=span, + team_id=md.get("user_api_key_team_id"), + team_alias=md.get("user_api_key_team_alias"), + ) + + def _set_team_attributes_on_proxy_span_from_kwargs(self, kwargs: dict) -> None: + """Stamp team attributes onto the proxy SERVER (root) span so the + trace root is filterable by team, not just its children. The root + span is created in auth before the team is resolved and is + otherwise only closed (never re-attributed) on the success path. + + Guarded to the LiteLLM-created proxy span (by name + recording) so + externally provided parent spans are never mutated. + """ + litellm_params = kwargs.get("litellm_params") or {} + metadata = litellm_params.get("metadata") or {} + proxy_span = metadata.get("litellm_parent_otel_span") + if ( + proxy_span is not None + and getattr(proxy_span, "name", None) == LITELLM_PROXY_REQUEST_SPAN_NAME + and hasattr(proxy_span, "is_recording") + and proxy_span.is_recording() + ): + self._set_team_attributes_from_kwargs(proxy_span, kwargs) + def _record_metrics(self, kwargs, response_obj, start_time, end_time): duration_s = (end_time - start_time).total_seconds() params = kwargs.get("litellm_params") or {} provider = params.get("custom_llm_provider", "Unknown") common_attrs = { - "gen_ai.operation.name": "chat", + "gen_ai.operation.name": ( + self._gen_ai_operation_name(kwargs) + if self._gen_ai_semconv_latest_experimental + else "chat" + ), "gen_ai.system": provider, "gen_ai.request.model": kwargs.get("model"), "gen_ai.framework": "litellm", @@ -876,8 +1248,13 @@ class OpenTelemetry(CustomLogger): "mcp_tool_call_metadata", "vector_store_request_metadata", ]: - if md.get(key) is not None: - common_attrs[f"metadata.{key}"] = str(md[key]) + value = md.get(key) + if value is None: + continue + if isinstance(value, (dict, list)): + common_attrs[f"metadata.{key}"] = safe_dumps(value) + else: + common_attrs[f"metadata.{key}"] = str(value) # get hidden params hidden_params = getattr(std_log, "hidden_params", None) or (std_log or {}).get( @@ -1074,6 +1451,24 @@ class OpenTelemetry(CustomLogger): response_duration_seconds, attributes=common_attrs ) + @staticmethod + def _otel_log_types(): + """Resolve ``(LogRecord, SeverityNumber)`` across OTEL SDK versions. + + ``LogRecord`` moved out of ``opentelemetry.sdk._logs`` in OTEL >= 1.39.0 + (open-telemetry/opentelemetry-python#4676). Imports stay function-local + because the SDK is an optional dependency. + """ + from opentelemetry._logs import SeverityNumber + + try: + from opentelemetry.sdk._logs import LogRecord # OTEL < 1.39.0 + except ImportError: + from opentelemetry.sdk._logs._internal import ( # OTEL >= 1.39.0 + LogRecord, + ) + return LogRecord, SeverityNumber + def _emit_semantic_logs(self, kwargs, response_obj, span: Span): if not self.config.enable_events: return @@ -1087,16 +1482,7 @@ class OpenTelemetry(CustomLogger): # See: https://github.com/open-telemetry/opentelemetry-python/pull/4676 # TODO: Refactor to use the proper OTEL Logs API instead of directly creating SDK LogRecords - from opentelemetry._logs import SeverityNumber - - try: - from opentelemetry.sdk._logs import ( # type: ignore[attr-defined] # OTEL < 1.39.0 - LogRecord as SdkLogRecord, - ) - except ImportError: - from opentelemetry.sdk._logs._internal import ( - LogRecord as SdkLogRecord, # type: ignore[attr-defined] # OTEL >= 1.39.0 - ) + SdkLogRecord, SeverityNumber = self._otel_log_types() # Resolve through the handler's own LoggerProvider (which may be a # private one when skip_set_global=True) rather than the module-level @@ -1108,6 +1494,16 @@ class OpenTelemetry(CustomLogger): "custom_llm_provider", "Unknown" ) + if self._gen_ai_semconv_latest_experimental: + self._emit_inference_details_event( + kwargs=kwargs, + response_obj=response_obj, + provider=provider, + otel_logger=otel_logger, + parent_ctx=parent_ctx, + ) + return + # per-message events for msg in kwargs.get("messages", []): role = msg.get("role", "user") @@ -1117,9 +1513,14 @@ class OpenTelemetry(CustomLogger): } if role == "tool" and msg.get("id"): attrs["id"] = msg["id"] - if self.message_logging and msg.get("content"): + capture_event_content = self._capture_in_event() + if capture_event_content and msg.get("content"): attrs["gen_ai.prompt"] = msg["content"] + body = msg.copy() + if not capture_event_content: + body.pop("content", None) + log_record = SdkLogRecord( timestamp=self._to_ns(datetime.now()), trace_id=parent_ctx.trace_id, @@ -1127,7 +1528,7 @@ class OpenTelemetry(CustomLogger): trace_flags=parent_ctx.trace_flags, severity_number=SeverityNumber.INFO, severity_text="INFO", - body=msg.copy(), + body=body, attributes=attrs, ) otel_logger.emit(log_record) @@ -1141,14 +1542,15 @@ class OpenTelemetry(CustomLogger): "finish_reason": choice.get("finish_reason"), } body_msg = choice.get("message", {}) - if self.message_logging and body_msg.get("content"): + capture_event_content = self._capture_in_event() + if capture_event_content and body_msg.get("content"): attrs["message.content"] = body_msg["content"] body = { "index": idx, "finish_reason": choice.get("finish_reason"), "message": {"role": body_msg.get("role", "assistant")}, } - if self.message_logging and body_msg.get("content"): + if capture_event_content and body_msg.get("content"): body["message"]["content"] = body_msg["content"] log_record = SdkLogRecord( @@ -1218,6 +1620,21 @@ class OpenTelemetry(CustomLogger): for guardrail_information in guardrail_information_list: start_time_float = guardrail_information.get("start_time") end_time_float = guardrail_information.get("end_time") + + # ``_create_guardrail_span`` is called from three lifecycle + # points (``async_post_call_success_hook``, ``_handle_success``, + # ``_handle_failure``) and re-reads the (mutating) entry list + # each time. Dedupe at entry granularity so a single real + # guardrail invocation produces exactly one span per handler. + if not self._emit_once( + kwargs, + "guardrail", + guardrail_information.get("guardrail_name"), + start_time_float, + guardrail_information.get("guardrail_mode"), + ): + continue + start_time_datetime = datetime.now() if start_time_float is not None: start_time_datetime = datetime.fromtimestamp(start_time_float) @@ -1255,12 +1672,45 @@ class OpenTelemetry(CustomLogger): "masked_entity_count", safe_dumps(masked_entity_count) ) + guardrail_response = guardrail_information.get("guardrail_response") + if guardrail_response is not None: + guardrail_span.set_attribute( + "guardrail_response", safe_dumps(guardrail_response) + ) + + # Surface guardrail_status (success / guardrail_intervened / + # guardrail_failed_to_respond / not_run) as a top-level span + # attribute so trace backends can filter on it without parsing + # guardrail_response. self.safe_set_attribute( span=guardrail_span, - key="guardrail_response", - value=guardrail_information.get("guardrail_response"), + key="guardrail_status", + value=guardrail_information.get("guardrail_status"), ) + # Provider's raw top-level action (e.g. Bedrock's + # ``GUARDRAIL_INTERVENED`` / ``NONE``). Populated by the provider + # hook onto StandardLoggingGuardrailInformation so this integration + # stays provider-agnostic — we only read a normalised string. + guardrail_action = guardrail_information.get("guardrail_action") + if guardrail_action: + guardrail_span.set_attribute("guardrail_action", guardrail_action) + + # The provider hook (e.g. Bedrock) extracts violation_categories + # from the raw response BEFORE redaction and stamps them onto + # StandardLoggingGuardrailInformation. Surfacing them here as a + # queryable attribute lets dashboards group by violation category + # without parsing the redacted guardrail_response blob. + violation_categories = guardrail_information.get("violation_categories") + if violation_categories: + # OTel sequence attributes must be homogeneous primitives; + # serialise to JSON once so set_attribute never coerces. + guardrail_span.set_attribute( + "guardrail_violation_categories", safe_dumps(violation_categories) + ) + + self._set_team_attributes_from_kwargs(guardrail_span, kwargs) + guardrail_span.end(end_time=self._to_ns(end_time_datetime)) def _handle_failure(self, kwargs, response_obj, start_time, end_time): @@ -1271,6 +1721,21 @@ class OpenTelemetry(CustomLogger): kwargs, self.config, ) + + # sync + async failure handlers can both fire for one + # request (notably in streaming code paths), producing two + # semantically identical ERROR spans. Unlike the success path, the + # proxy span is intentionally left open here so that + # ``async_post_call_failure_hook`` can append the + # "Failed Proxy Server Request" child span before closing it — + # there is no proxy-span side-effect to preserve on the skip path. + if not self._emit_once(kwargs, "failure"): + verbose_logger.debug( + "OpenTelemetry: skipping duplicate failure span for handler=%s", + self.__class__.__name__, + ) + return + _parent_context, parent_otel_span = self._get_span_context(kwargs) if self.config.ignore_context_propagation: @@ -1288,11 +1753,14 @@ class OpenTelemetry(CustomLogger): if should_create_primary_span: # Span 1: Request sent to litellm SDK otel_tracer: Tracer = self.get_tracer_to_use_for_request(kwargs) - span = otel_tracer.start_span( - name=self._get_span_name(kwargs), - start_time=self._to_ns(start_time), - context=_parent_context, - ) + span_kwargs: Dict[str, Any] = { + "name": self._get_span_name(kwargs), + "start_time": self._to_ns(start_time), + "context": _parent_context, + } + if self._gen_ai_semconv_latest_experimental: + span_kwargs["kind"] = self.span_kind.CLIENT + span = otel_tracer.start_span(**span_kwargs) span.set_status(Status(StatusCode.ERROR)) self.set_attributes(span, kwargs, response_obj) @@ -1376,6 +1844,19 @@ class OpenTelemetry(CustomLogger): value=error_information["error_code"], ) + # Also expose under the OTel-standard name as an int + # (error_code is a str, may be non-numeric). + _error_code_val = error_information["error_code"] + if _error_code_val is not None: + try: + self.safe_set_attribute( + span=span, + key=HTTP_RESPONSE_STATUS_CODE_ATTRIBUTE, + value=int(_error_code_val), + ) + except (ValueError, TypeError): + pass + if error_information.get("error_class"): self.safe_set_attribute( span=span, @@ -1574,11 +2055,21 @@ class OpenTelemetry(CustomLogger): ) # The Generative AI Provider: Azure, OpenAI, etc. - self.safe_set_attribute( - span=span, - key=SpanAttributes.LLM_SYSTEM.value, - value=litellm_params.get("custom_llm_provider", "Unknown"), - ) + provider_name = litellm_params.get("custom_llm_provider", "Unknown") + # Latest-experimental semconv replaced gen_ai.system with + # gen_ai.provider.name; emit only the conformant key in that mode. + if self._gen_ai_semconv_latest_experimental: + self.safe_set_attribute( + span=span, + key="gen_ai.provider.name", + value=provider_name, + ) + else: + self.safe_set_attribute( + span=span, + key=SpanAttributes.LLM_SYSTEM.value, + value=provider_name, + ) # The maximum number of tokens the LLM generates for a request. if optional_params.get("max_tokens"): @@ -1604,11 +2095,17 @@ class OpenTelemetry(CustomLogger): value=optional_params.get("top_p"), ) - self.safe_set_attribute( - span=span, - key=SpanAttributes.LLM_IS_STREAMING.value, - value=str(optional_params.get("stream", False)), - ) + if self._gen_ai_semconv_latest_experimental: + # Semconv emits gen_ai.request.stream (only when streaming) via + # _set_semconv_request_attributes; skip the legacy llm.is_streaming. + self._set_semconv_request_attributes(span, optional_params) + self._set_semconv_cache_token_attributes(span, standard_logging_payload) + else: + self.safe_set_attribute( + span=span, + key=SpanAttributes.LLM_IS_STREAMING.value, + value=str(optional_params.get("stream", False)), + ) if optional_params.get("user"): self.safe_set_attribute( @@ -1674,9 +2171,7 @@ class OpenTelemetry(CustomLogger): ########## LLM Request Medssages / tools / content Attributes ########### ######################################################################### - if litellm.turn_off_message_logging is True: - return - if self.message_logging is not True: + if not self._capture_in_span(): return if optional_params.get("tools"): @@ -1695,26 +2190,54 @@ class OpenTelemetry(CustomLogger): value=safe_dumps(transformed_messages), ) - if kwargs.get("system_instructions"): - transformed_system_instructions = ( - self._transform_messages_to_otel_semantic_conventions( - kwargs.get("system_instructions") + # Coalesce the different kwarg names that carry the system + # prompt depending on the call path: + # - "system_instructions" — Vertex AI Gemini chat-completion + # - "instructions" — OpenAI Responses API + # - "system" — Anthropic Messages API + # Use `is not None` rather than truthiness to avoid falsy + # values (e.g. []) falling through to the wrong kwarg. + system_instructions = ( + kwargs.get("system_instructions") + if kwargs.get("system_instructions") is not None + else ( + kwargs.get("instructions") + if kwargs.get("instructions") is not None + else kwargs.get("system") + ) + ) + if system_instructions: + if isinstance(system_instructions, str): + # Plain text system prompt — no transformation needed + self.safe_set_attribute( + span=span, + key=SpanAttributes.GEN_AI_SYSTEM_INSTRUCTIONS.value, + value=system_instructions, + ) + else: + transformed_system_instructions = ( + self._transform_messages_to_otel_semantic_conventions( + system_instructions + ) + ) + self.safe_set_attribute( + span=span, + key=SpanAttributes.GEN_AI_SYSTEM_INSTRUCTIONS.value, + value=safe_dumps(transformed_system_instructions), ) - ) - self.safe_set_attribute( - span=span, - key=SpanAttributes.GEN_AI_SYSTEM_INSTRUCTIONS.value, - value=safe_dumps(transformed_system_instructions), - ) - self.safe_set_attribute( - span=span, - key=SpanAttributes.GEN_AI_OPERATION_NAME.value, - value=( + if self._gen_ai_semconv_latest_experimental: + operation_name = self._gen_ai_operation_name(kwargs) + else: + operation_name = ( "chat" if standard_logging_payload.get("call_type") == "completion" else standard_logging_payload.get("call_type") or "chat" - ), + ) + self.safe_set_attribute( + span=span, + key=SpanAttributes.GEN_AI_OPERATION_NAME.value, + value=operation_name, ) if standard_logging_payload.get("request_id"): @@ -1764,6 +2287,57 @@ class OpenTelemetry(CustomLogger): value=value, ) + elif response_obj.get("output"): + # Responses API: ResponsesAPIResponse has an "output" + # list instead of "choices". Each item with + # type="message" contains a "content" list of + # OutputText objects (type="output_text"). + output_items = response_obj.get("output") + output_messages = self._transform_responses_api_output_to_otel( + output_items + ) + if output_messages: + self.safe_set_attribute( + span=span, + key=SpanAttributes.GEN_AI_OUTPUT_MESSAGES.value, + value=safe_dumps(output_messages), + ) + + # Emit per-tool-call span attributes (parity with + # the choices branch that calls _tool_calls_kv_pair). + # Convert Responses API function_call items to the + # ChatCompletionMessageToolCall format expected by + # _tool_calls_kv_pair. + tool_calls = [] + for out_item in output_items: + item_d = self._to_dict(out_item) + if item_d and item_d.get("type") == "function_call": + tool_calls.append( + { + "function": { + "name": item_d.get("name", ""), + "arguments": item_d.get("arguments", ""), + } + } + ) + if tool_calls: + kv_pairs = OpenTelemetry._tool_calls_kv_pair(tool_calls) # type: ignore + for key, value in kv_pairs.items(): + self.safe_set_attribute( + span=span, + key=key, + value=value, + ) + + # Extract finish reason from ResponsesAPIResponse.status + status = response_obj.get("status") + if status: + self.safe_set_attribute( + span=span, + key=SpanAttributes.GEN_AI_RESPONSE_FINISH_REASONS.value, + value=safe_dumps([status]), + ) + except Exception as e: self.handle_callback_failure( callback_name=self.callback_name or "opentelemetry" @@ -1859,6 +2433,78 @@ class OpenTelemetry(CustomLogger): transformed.append(transformed_msg) return transformed + @staticmethod + def _to_dict(obj) -> Optional[dict]: + """Normalize an object to a plain dict. + + Handles three forms that appear in practice: + + 1. Plain ``dict`` — returned as-is. + 2. LiteLLM's ``BaseLiteLLMOpenAIResponseObject`` — exposes a + ``.get()`` method that delegates to ``__dict__``. + 3. Raw Pydantic v2 models from the ``openai`` SDK (e.g. + ``ResponseOutputMessage``, ``ResponseOutputText``) — these do + **not** have ``.get()`` but do have ``.model_dump()``. + + Returns ``None`` for anything else so callers can skip it. + """ + if isinstance(obj, dict): + return obj + if hasattr(obj, "get"): + # BaseLiteLLMOpenAIResponseObject duck-type + return obj # type: ignore[return-value] + if hasattr(obj, "model_dump"): + # Raw Pydantic v2 model (e.g. openai SDK types) + return obj.model_dump() # type: ignore[union-attr] + return None + + def _transform_responses_api_output_to_otel(self, output: List) -> List[dict]: + """ + Transform Responses API output items into OTEL GenAI 1.38 format. + + The Responses API returns output as a list of items, each with a + ``type`` field. Message items (``type="message"``) contain a + ``content`` list of ``OutputText`` objects with ``type="output_text"`` + and ``text`` fields. + + Items may be plain dicts, LiteLLM wrapper objects (with ``.get()``), + or raw Pydantic v2 models from the ``openai`` SDK (with + ``.model_dump()``). We normalize each item to a dict via + ``_to_dict`` before processing. + + This method converts them to the same ``{"role": ..., "parts": [...]}`` + format used by ``_transform_choices_to_otel_semantic_conventions``. + """ + transformed = [] + for raw_item in output: + item = self._to_dict(raw_item) + if item is None: + continue + if item.get("type") == "message": + role = item.get("role", "assistant") + parts = [] + for raw_content in item.get("content", []): + content = self._to_dict(raw_content) + if content is None: + continue + if content.get("type") == "output_text": + text = content.get("text", "") + if text: + parts.append({"type": "text", "content": text}) + if parts: + transformed.append({"role": role, "parts": parts}) + elif item.get("type") == "function_call": + # Surface tool calls from Responses API output + part: dict = { + "type": "tool_call", + "name": item.get("name", ""), + "arguments": item.get("arguments", ""), + } + if item.get("call_id"): + part["id"] = item["call_id"] + transformed.append({"role": "assistant", "parts": [part]}) + return transformed + def set_raw_request_attributes(self, span: Span, kwargs, response_obj): try: # Only set provider-specific raw payload attributes on this span. @@ -1928,6 +2574,10 @@ class OpenTelemetry(CustomLogger): if generation_name: return generation_name + if self._gen_ai_semconv_latest_experimental: + model = kwargs.get("model") or "unknown" + return f"{self._gen_ai_operation_name(kwargs)} {model}" + return LITELLM_REQUEST_SPAN_NAME def get_traceparent_from_header(self, headers): @@ -1965,7 +2615,7 @@ class OpenTelemetry(CustomLogger): verbose_logger.debug( "OpenTelemetry: Using explicit parent span from metadata" ) - return trace.set_span_in_context(parent_otel_span), parent_otel_span + return trace.set_span_in_context(parent_otel_span), None # Priority 2: HTTP traceparent header if traceparent is not None: @@ -2404,6 +3054,11 @@ class OpenTelemetry(CustomLogger): management_endpoint_span.set_status(Status(StatusCode.OK)) management_endpoint_span.end(end_time=_end_time_ns) + # The management wrapper has no other hook that closes the SERVER span. + self.set_response_status_code_attribute(parent_otel_span, 200) + parent_otel_span.set_status(Status(StatusCode.OK)) + parent_otel_span.end(end_time=_end_time_ns) + async def async_management_endpoint_failure_hook( self, logging_payload: ManagementEndpointLoggingPayload, @@ -2454,6 +3109,24 @@ class OpenTelemetry(CustomLogger): management_endpoint_span.set_status(Status(StatusCode.ERROR)) management_endpoint_span.end(end_time=_end_time_ns) + # The management wrapper has no other hook that closes the SERVER span. + from litellm.litellm_core_utils.litellm_logging import ( + StandardLoggingPayloadSetup, + ) + + error_information = StandardLoggingPayloadSetup.get_error_information( + original_exception=_exception, + ) + parent_otel_span.set_status(Status(StatusCode.ERROR)) + self._record_exception_on_span( + span=parent_otel_span, + kwargs={ + "exception": _exception, + "standard_logging_object": {"error_information": error_information}, + }, + ) + parent_otel_span.end(end_time=_end_time_ns) + def create_litellm_proxy_request_started_span( self, start_time: datetime, @@ -2469,3 +3142,86 @@ class OpenTelemetry(CustomLogger): context=self.get_traceparent_from_header(headers=headers), kind=self.span_kind.SERVER, ) + + def set_proxy_request_route_attributes( + self, + span: Optional[Span], + *, + url_path: Optional[str] = None, + http_route: Optional[str] = None, + ) -> None: + """ + Set OTel-standard ``http.route`` / ``url.path`` on the proxy SERVER + span. Called from the auth path, the only point where both the + SERVER span and the request are in hand. No-op if span/value missing. + """ + if span is None: + return + if url_path: + self.safe_set_attribute(span=span, key=URL_PATH_ATTRIBUTE, value=url_path) + if http_route: + self.safe_set_attribute( + span=span, key=HTTP_ROUTE_ATTRIBUTE, value=http_route + ) + + def set_response_status_code_attribute( + self, span: Optional[Span], status_code: Optional[int] + ) -> None: + """ + Set OTel-standard ``http.response.status_code`` (int) on the proxy + SERVER span. The failure path sets this from the error code in + ``_record_exception_on_span``; this is the success-path counterpart + so the attribute is present on every SERVER span regardless of + outcome (required by the HTTP semconv, and needed for error-ratio / + status-breakdown dashboards). No-op if span/value missing. + """ + if span is None or status_code is None: + return + self.safe_set_attribute( + span=span, + key=HTTP_RESPONSE_STATUS_CODE_ATTRIBUTE, + value=int(status_code), + ) + + def set_preprocessing_duration_attribute( + self, span: Optional[Span], container: Any + ) -> None: + """ + Set ``litellm.preprocessing.duration_ms`` (proxy-receive -> first + provider handoff) on the proxy SERVER span. ``litellm_received_at`` + rides request metadata; ``first_api_call_start_time`` is the + set-once first-handoff instant (retries/backoff excluded). Works + uniformly for the success (model_call_details) and failure + (request_data) containers. No-op if span/either anchor is missing. + """ + if span is None or not isinstance(container, dict): + return + received_at = None + # first_api_call_start_time is top-level (never in user metadata). + first_handoff = container.get("first_api_call_start_time") + _lp = container.get("litellm_params") + for _md in ( + (_lp or {}).get("metadata") if isinstance(_lp, dict) else None, + container.get("metadata"), + container.get("litellm_metadata"), + ): + if isinstance(_md, dict): + received_at = received_at or _md.get("litellm_received_at") + if received_at is None or first_handoff is None: + return + try: + start_ts = self._to_timestamp(received_at) + end_ts = self._to_timestamp(first_handoff) + except Exception: + return + if start_ts is None or end_ts is None: + return + duration_ms = (end_ts - start_ts) * 1000.0 + # Clock skew → omit rather than emit a negative latency. + if duration_ms < 0: + return + self.safe_set_attribute( + span=span, + key=PREPROCESSING_DURATION_MS_ATTRIBUTE, + value=duration_ms, + ) diff --git a/litellm/integrations/opentelemetry_utils/gen_ai_semconv.py b/litellm/integrations/opentelemetry_utils/gen_ai_semconv.py new file mode 100644 index 00000000000..e45fe149e13 --- /dev/null +++ b/litellm/integrations/opentelemetry_utils/gen_ai_semconv.py @@ -0,0 +1,271 @@ +"""OTEL GenAI ``gen_ai_latest_experimental`` semantic conventions. + +Setting ``OTEL_SEMCONV_STABILITY_OPT_IN=gen_ai_latest_experimental`` switches the +emitted traces to the experimental OTEL GenAI conventions +(https://opentelemetry.io/docs/specs/semconv/gen-ai/). Concretely, versus the +default LiteLLM output: + +Request span: + +- name is ``{operation} {model}`` (e.g. ``chat gpt-4``) instead of + ``litellm_request``; span kind is ``CLIENT``. +- ``gen_ai.operation.name`` is the actual operation (``chat`` / + ``text_completion`` / ``embeddings``) instead of always ``chat``. +- the provider is reported as ``gen_ai.provider.name``; the superseded + ``gen_ai.system`` and the legacy ``llm.is_streaming`` are dropped. +- adds ``gen_ai.request.{frequency_penalty,presence_penalty,top_k,seed}``, + ``gen_ai.request.stop_sequences`` (a string array), + ``gen_ai.request.stream`` (only when streaming), + ``gen_ai.request.choice.count`` (only when n > 1), and + ``gen_ai.usage.cache_{creation,read}.input_tokens``. +- the non-standard ``raw_gen_ai_request`` child span is no longer created. + +Events: + +- the per-message ``gen_ai.content.prompt`` / per-choice + ``gen_ai.content.completion`` log events are replaced by a single + ``gen_ai.client.inference.operation.details`` log event carrying + ``gen_ai.input.messages`` / ``gen_ai.output.messages`` (message content + included only when content capture is enabled). +""" + +from datetime import datetime +from enum import Enum +from typing import TYPE_CHECKING, Any, Dict, List, Optional, Set, Tuple, Union + +from litellm.litellm_core_utils.safe_json_dumps import safe_dumps + +if TYPE_CHECKING: + from opentelemetry.trace import Span as _Span + + from litellm.integrations.opentelemetry import OpenTelemetryConfig + + Span = Union[_Span, Any] +else: + Span = Any + + +# OTEL_SEMCONV_STABILITY_OPT_IN is a comma-separated list of category-specific +# opt-in values. See https://opentelemetry.io/docs/specs/semconv/gen-ai/ +OTEL_SEMCONV_STABILITY_OPT_IN_ENV = "OTEL_SEMCONV_STABILITY_OPT_IN" + + +class OTELSemconvCategory(Enum): + GEN_AI_LATEST_EXPERIMENTAL = "gen_ai_latest_experimental" + + +# Reverse lookup: opt-in token string -> OTELSemconvCategory. +_SEMCONV_CATEGORY_BY_VALUE = { + category.value: category for category in OTELSemconvCategory +} + + +# LiteLLM optional_params key -> OTEL gen_ai semconv span attribute. +_SEMCONV_REQUEST_ATTRIBUTES = { + "frequency_penalty": "gen_ai.request.frequency_penalty", + "presence_penalty": "gen_ai.request.presence_penalty", + "top_k": "gen_ai.request.top_k", + "seed": "gen_ai.request.seed", +} + +# usage_object key -> OTEL gen_ai semconv cache-token span attribute. +_SEMCONV_CACHE_TOKEN_ATTRIBUTES = { + "cache_creation_input_tokens": "gen_ai.usage.cache_creation.input_tokens", + "cache_read_input_tokens": "gen_ai.usage.cache_read.input_tokens", +} + +# Name of the consolidated GenAI inference event (replaces the legacy +# per-message gen_ai.content.prompt / per-choice gen_ai.content.completion). +_INFERENCE_DETAILS_EVENT_NAME = "gen_ai.client.inference.operation.details" + + +def parse_semconv_opt_in(raw: Optional[str]) -> Set[OTELSemconvCategory]: + """Parse the comma-separated OTEL_SEMCONV_STABILITY_OPT_IN value into the + set of recognized categories. Unknown tokens are ignored per the spec.""" + if not raw: + return set() + return { + _SEMCONV_CATEGORY_BY_VALUE[token] + for token in (part.strip() for part in raw.split(",")) + if token in _SEMCONV_CATEGORY_BY_VALUE + } + + +class OTELGenAISemconvMixin: + """OTEL GenAI ``gen_ai_latest_experimental`` semantic-convention behavior. + + Mixed into ``OpenTelemetry`` (its only host). Every member is internal to + the OTEL integration; the leading underscore marks "subsystem-internal", + not "class-private" (the host lives in a sibling module). + + Members the host calls (the mixin -> host contract): + + - ``_gen_ai_semconv_latest_experimental`` -- opt-in gate; guards every + semconv code path in ``opentelemetry.py``. + - ``_gen_ai_operation_name`` -- LiteLLM ``call_type`` -> spec + ``gen_ai.operation.name``. + - ``_set_semconv_request_attributes`` / + ``_set_semconv_cache_token_attributes`` -- add the ``gen_ai.request.*`` + / ``gen_ai.usage.cache_*`` span attributes. + - ``_emit_inference_details_event`` -- emit the consolidated event. + + Helpers the host must provide (declared under ``TYPE_CHECKING`` below): + ``config``, ``safe_set_attribute``, ``_capture_in_event``, + ``_transform_messages_to_otel_semantic_conventions``, + ``_transform_choices_to_otel_semantic_conventions``, ``_to_ns``, + ``_otel_log_types``. + """ + + if TYPE_CHECKING: + config: "OpenTelemetryConfig" + + def safe_set_attribute(self, span: Span, key: str, value: Any) -> None: ... + + def _capture_in_event(self) -> bool: ... + + def _transform_messages_to_otel_semantic_conventions( + self, messages: Union[List[dict], str] + ) -> List[dict]: ... + + def _transform_choices_to_otel_semantic_conventions( + self, choices: List[dict] + ) -> List[dict]: ... + + def _to_ns(self, dt: datetime) -> int: ... + + def _otel_log_types(self) -> Tuple[Any, Any]: ... + + @property + def _gen_ai_semconv_latest_experimental(self) -> bool: + """Whether the ``gen_ai_latest_experimental`` opt-in is active. + + Every semconv behavior is gated on this; ``False`` => legacy output. + """ + return ( + OTELSemconvCategory.GEN_AI_LATEST_EXPERIMENTAL + in self.config.semconv_stability_opt_in + ) + + @staticmethod + def _gen_ai_operation_name(kwargs: dict) -> str: + """Map a LiteLLM ``call_type`` to spec ``gen_ai.operation.name``. + + Substring match (e.g. ``aembedding`` -> ``embeddings``); defaults to + ``chat``. + """ + call_type = kwargs.get("call_type", "") or "" + match call_type: + case s if "embedding" in s: + return "embeddings" + case s if "text_completion" in s: + return "text_completion" + case _: + return "chat" + + def _set_semconv_request_attributes( + self, span: Span, optional_params: dict + ) -> None: + """Add ``gen_ai.request.*`` span attributes from ``optional_params``. + + Covers the sampling params plus the conditionally-required + ``stop_sequences`` / ``stream`` / ``choice.count`` per the spec. + """ + for source_key, semconv_key in _SEMCONV_REQUEST_ATTRIBUTES.items(): + value = optional_params.get(source_key) + if value is not None: + self.safe_set_attribute(span=span, key=semconv_key, value=value) + + stop = optional_params.get("stop") + if stop is not None: + # Spec types this as string[]. safe_set_attribute coerces to a + # primitive, so set the array directly via the span API. + stop_list = stop if isinstance(stop, list) else [stop] + span.set_attribute( + "gen_ai.request.stop_sequences", [str(s) for s in stop_list] + ) + + # Conditionally required: set only when the request is streaming. + if optional_params.get("stream"): + self.safe_set_attribute(span=span, key="gen_ai.request.stream", value=True) + + # Conditionally required per spec ("if available and != 1"). Valid n is + # an int >= 1, so n > 1 is equivalent for conformant input while + # suppressing nonsensical values (0, negative, non-int). + n = optional_params.get("n") + if isinstance(n, int) and n > 1: + self.safe_set_attribute( + span=span, key="gen_ai.request.choice.count", value=n + ) + + def _set_semconv_cache_token_attributes( + self, span: Span, standard_logging_payload + ) -> None: + """Add ``gen_ai.usage.cache_*.input_tokens`` from the usage object. + + No-op when the payload or the usage values are missing/zero. + """ + if not standard_logging_payload: + return + usage = (standard_logging_payload.get("metadata") or {}).get( + "usage_object" + ) or {} + for source_key, semconv_key in _SEMCONV_CACHE_TOKEN_ATTRIBUTES.items(): + value = usage.get(source_key) + if value: + self.safe_set_attribute(span=span, key=semconv_key, value=value) + + def _build_inference_details_attrs( + self, kwargs: dict, response_obj: dict, provider: str + ) -> Dict[str, Any]: + """Build the attribute payload for the inference-details event. + + Always includes provider/operation; input/output messages are added + only when content capture is enabled and non-empty. Mixin-internal. + """ + attrs: Dict[str, Any] = { + "event_name": _INFERENCE_DETAILS_EVENT_NAME, + "gen_ai.provider.name": provider, + "gen_ai.operation.name": self._gen_ai_operation_name(kwargs), + } + if not self._capture_in_event(): + return attrs + + input_messages = self._transform_messages_to_otel_semantic_conventions( + kwargs.get("messages") or [] + ) + output_messages = self._transform_choices_to_otel_semantic_conventions( + response_obj.get("choices", []) + ) + if input_messages: + attrs["gen_ai.input.messages"] = safe_dumps(input_messages) + if output_messages: + attrs["gen_ai.output.messages"] = safe_dumps(output_messages) + return attrs + + def _emit_inference_details_event( + self, + kwargs: dict, + response_obj: dict, + provider: str, + otel_logger, + parent_ctx, + ) -> None: + """Emit the consolidated ``gen_ai.client.inference.operation.details`` + log event, correlated to the request span via ``parent_ctx``. + + Replaces the legacy per-message / per-choice content events. + """ + LogRecord, SeverityNumber = self._otel_log_types() + log_record = LogRecord( + timestamp=self._to_ns(datetime.now()), + trace_id=parent_ctx.trace_id, + span_id=parent_ctx.span_id, + trace_flags=parent_ctx.trace_flags, + severity_number=SeverityNumber.INFO, + severity_text="INFO", + body=None, + attributes=self._build_inference_details_attrs( + kwargs, response_obj, provider + ), + ) + otel_logger.emit(log_record) diff --git a/litellm/integrations/opik/utils.py b/litellm/integrations/opik/utils.py index b0ab5991c91..43577505c11 100644 --- a/litellm/integrations/opik/utils.py +++ b/litellm/integrations/opik/utils.py @@ -105,7 +105,7 @@ def _remove_nulls(x: Dict[str, Any]) -> Dict[str, Any]: def get_traces_and_spans_from_payload( - payload: List[Dict[str, Any]] + payload: List[Dict[str, Any]], ) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]]]: """ Separate traces and spans from payload. diff --git a/litellm/integrations/prometheus.py b/litellm/integrations/prometheus.py index f9b1c666439..5f052842122 100644 --- a/litellm/integrations/prometheus.py +++ b/litellm/integrations/prometheus.py @@ -166,6 +166,53 @@ class PrometheusLogger(CustomLogger): labelnames=self.get_labels_for_metric("litellm_output_tokens_metric"), ) + # Token-type detail metrics. These break out cached, cache-creation, + # audio and reasoning tokens that providers report inside + # prompt_tokens_details / completion_tokens_details on the usage + # object. They are sparse (only incremented when the provider + # reports a non-zero value) and are additive to the existing + # input/output token totals — no breaking change for existing + # dashboards built on the totals. + self.litellm_input_cached_tokens_metric = self._counter_factory( + "litellm_input_cached_tokens_metric", + "Provider-side cached input tokens (e.g. OpenAI prompt_tokens_details.cached_tokens, Anthropic cache_read_input_tokens)", + labelnames=self.get_labels_for_metric( + "litellm_input_cached_tokens_metric" + ), + ) + + self.litellm_input_cache_creation_tokens_metric = self._counter_factory( + "litellm_input_cache_creation_tokens_metric", + "Provider-side input tokens written to prompt cache (e.g. Anthropic cache_creation_input_tokens)", + labelnames=self.get_labels_for_metric( + "litellm_input_cache_creation_tokens_metric" + ), + ) + + self.litellm_input_audio_tokens_metric = self._counter_factory( + "litellm_input_audio_tokens_metric", + "Audio input tokens reported in prompt_tokens_details.audio_tokens", + labelnames=self.get_labels_for_metric( + "litellm_input_audio_tokens_metric" + ), + ) + + self.litellm_output_reasoning_tokens_metric = self._counter_factory( + "litellm_output_reasoning_tokens_metric", + "Reasoning tokens reported in completion_tokens_details.reasoning_tokens", + labelnames=self.get_labels_for_metric( + "litellm_output_reasoning_tokens_metric" + ), + ) + + self.litellm_output_audio_tokens_metric = self._counter_factory( + "litellm_output_audio_tokens_metric", + "Audio output tokens reported in completion_tokens_details.audio_tokens", + labelnames=self.get_labels_for_metric( + "litellm_output_audio_tokens_metric" + ), + ) + # Remaining Budget for Team self.litellm_remaining_team_budget_metric = self._gauge_factory( "litellm_remaining_team_budget_metric", @@ -1226,6 +1273,17 @@ class PrometheusLogger(CustomLogger): label_context=label_context, ) + # Provider-agnostic fallback: providers like Bedrock and Vertex don't return + # x-ratelimit-remaining-* headers, so the gauges above only fire for OpenAI / + # Anthropic / Azure. When the proxy router has tpm/rpm configured for the + # model_group, derive remaining from configured-limit minus current usage so + # the same metric is populated for any provider. + await self._async_set_router_remaining_metrics( + standard_logging_payload=standard_logging_payload, # type: ignore + enum_values=enum_values, + label_context=label_context, + ) + # cache metrics self._increment_cache_metrics( standard_logging_payload=standard_logging_payload, # type: ignore @@ -1290,6 +1348,101 @@ class PrometheusLogger(CustomLogger): amount=float(standard_logging_payload["completion_tokens"]), ) + # Token-type detail metrics — sparse, only emitted when the provider + # reports a non-zero value in usage.prompt_tokens_details / + # usage.completion_tokens_details. + self._increment_token_detail_metrics( + standard_logging_payload=standard_logging_payload, + enum_values=enum_values, + label_context=label_context, + ) + + def _increment_token_detail_metrics( + self, + standard_logging_payload: StandardLoggingPayload, + enum_values: UserAPIKeyLabelValues, + label_context: Optional[PrometheusLabelFactoryContext] = None, + ) -> None: + """ + Increment per-token-type counters from the Usage object that providers + attach to the request. The Usage dict is plumbed onto + ``standard_logging_payload["metadata"]["usage_object"]`` by + ``get_standard_logging_object_payload``. + + Each counter is only incremented when the underlying value is > 0, so + scrape output stays sparse for providers that don't report these + details (most non-OpenAI/Anthropic models). + """ + metadata = standard_logging_payload.get("metadata") or {} + usage_object = ( + metadata.get("usage_object") if isinstance(metadata, dict) else None + ) + if not isinstance(usage_object, dict): + return + + prompt_details = usage_object.get("prompt_tokens_details") or {} + completion_details = usage_object.get("completion_tokens_details") or {} + + detail_metrics: List[Tuple[Any, DEFINED_PROMETHEUS_METRICS, Any]] = [ + ( + self.litellm_input_cached_tokens_metric, + "litellm_input_cached_tokens_metric", + ( + prompt_details.get("cached_tokens") + if isinstance(prompt_details, dict) + else None + ), + ), + ( + self.litellm_input_cache_creation_tokens_metric, + "litellm_input_cache_creation_tokens_metric", + ( + prompt_details.get("cache_creation_tokens") + if isinstance(prompt_details, dict) + else None + ), + ), + ( + self.litellm_input_audio_tokens_metric, + "litellm_input_audio_tokens_metric", + ( + prompt_details.get("audio_tokens") + if isinstance(prompt_details, dict) + else None + ), + ), + ( + self.litellm_output_reasoning_tokens_metric, + "litellm_output_reasoning_tokens_metric", + ( + completion_details.get("reasoning_tokens") + if isinstance(completion_details, dict) + else None + ), + ), + ( + self.litellm_output_audio_tokens_metric, + "litellm_output_audio_tokens_metric", + ( + completion_details.get("audio_tokens") + if isinstance(completion_details, dict) + else None + ), + ), + ] + + for counter, metric_name, value in detail_metrics: + if not isinstance(value, (int, float)) or value <= 0: + continue + PrometheusLogger._inc_labeled_counter( + self, + counter, + metric_name, + enum_values, + label_context=label_context, + amount=float(value), + ) + def _increment_cache_metrics( self, standard_logging_payload: StandardLoggingPayload, @@ -2199,6 +2352,99 @@ class PrometheusLogger(CustomLogger): ) self.litellm_deployment_rpm_limit.labels(**_labels).set(rpm) + async def _async_set_router_remaining_metrics( + self, + standard_logging_payload: StandardLoggingPayload, + enum_values: UserAPIKeyLabelValues, + label_context: Optional[PrometheusLabelFactoryContext] = None, + ) -> None: + """ + Populate ``litellm_remaining_tokens_metric`` / + ``litellm_remaining_requests_metric`` from the router's internal usage + counters when the upstream provider did not return + ``x-ratelimit-remaining-*`` response headers. + + OpenAI / Anthropic / Azure return remaining tokens/requests in response + headers, but Bedrock and Vertex AI do not. This fallback computes + ``configured_limit - current_usage`` via + ``Router.get_remaining_model_group_usage`` so the same gauges are + emitted for every provider when tpm/rpm is configured on the + deployment. + """ + try: + additional_headers = ( + standard_logging_payload.get("hidden_params", {}) or {} + ).get("additional_headers") or {} + + already_have_tokens = ( + additional_headers.get("x_ratelimit_remaining_tokens") is not None + ) + already_have_requests = ( + additional_headers.get("x_ratelimit_remaining_requests") is not None + ) + if already_have_tokens and already_have_requests: + return + + model_group = standard_logging_payload.get("model_group") + if not model_group: + return + + try: + from litellm.proxy.proxy_server import llm_router + except ImportError: + llm_router = None + + if llm_router is None: + return + + try: + remaining_usage = await llm_router.get_remaining_model_group_usage( + model_group + ) + except Exception as e: + verbose_logger.exception( + "Prometheus: get_remaining_model_group_usage failed for " + "model_group=%s: %s", + model_group, + e, + ) + return + + if not remaining_usage: + return + + remaining_tokens = remaining_usage.get("x-ratelimit-remaining-tokens") + remaining_requests = remaining_usage.get("x-ratelimit-remaining-requests") + + if not already_have_tokens and remaining_tokens is not None: + _labels = prometheus_label_factory( + supported_enum_labels=self.get_labels_for_metric( + metric_name="litellm_remaining_tokens_metric" + ), + enum_values=enum_values, + label_context=label_context, + ) + self.litellm_remaining_tokens_metric.labels(**_labels).set( + remaining_tokens + ) + + if not already_have_requests and remaining_requests is not None: + _labels = prometheus_label_factory( + supported_enum_labels=self.get_labels_for_metric( + metric_name="litellm_remaining_requests_metric" + ), + enum_values=enum_values, + label_context=label_context, + ) + self.litellm_remaining_requests_metric.labels(**_labels).set( + remaining_requests + ) + except Exception as e: + verbose_logger.exception( + "Prometheus Error: _async_set_router_remaining_metrics. " + "Exception occured - {}".format(str(e)) + ) + def set_llm_deployment_success_metrics( self, request_kwargs: dict, @@ -3436,6 +3682,10 @@ class PrometheusLogger(CustomLogger): user_object.budget_reset_at = user_info.budget_reset_at if user_object.max_budget is None and user_info.max_budget is not None: user_object.max_budget = user_info.max_budget + if user_info.user_email is not None: + user_object.user_email = user_info.user_email + if user_info.user_alias is not None: + user_object.user_alias = user_info.user_alias return user_object @@ -3452,6 +3702,8 @@ class PrometheusLogger(CustomLogger): """ enum_values = UserAPIKeyLabelValues( user=user.user_id, + user_email=user.user_email or "", + user_alias=user.user_alias or "", ) _labels = prometheus_label_factory( diff --git a/litellm/integrations/rubrik.py b/litellm/integrations/rubrik.py new file mode 100644 index 00000000000..af396ecdc73 --- /dev/null +++ b/litellm/integrations/rubrik.py @@ -0,0 +1,605 @@ +"""Rubrik LiteLLM Plugin for tool blocking and batch logging.""" + +import asyncio +import os +import random +import time +import urllib.parse +import uuid +from collections import Counter +from typing import TYPE_CHECKING, Any, Literal, Optional + +import httpx +from litellm._logging import verbose_logger +from litellm.integrations.custom_batch_logger import CustomBatchLogger +from litellm.integrations.custom_guardrail import ( + CustomGuardrail, + ModifyResponseException, +) +from litellm.litellm_core_utils.core_helpers import safe_deep_copy +from litellm.llms.custom_httpx.http_handler import ( + get_async_httpx_client, + httpxSpecialProvider, +) +from litellm.types.guardrails import GuardrailEventHooks +from litellm.types.utils import ( + ChatCompletionMessageToolCall, + Function, + GenericGuardrailAPIInputs, + StandardLoggingPayload, +) + +if TYPE_CHECKING: + from litellm.litellm_core_utils.litellm_logging import ( + Logging as LiteLLMLoggingObj, + ) + +_ENDPOINT_ANTHROPIC_MESSAGES = "/v1/messages" +_WEBHOOK_PATH_TOOL_BLOCKING = "/v1/after_completion/openai/v1" +_WEBHOOK_PATH_LOGGING_BATCH = "/v1/litellm/batch" +_MAX_QUEUE_SIZE = 10_000 +_DROP_WARNING_INTERVAL_SECONDS = 60.0 + + +class _MalformedToolBlockingResponseError(Exception): + """Raised when the tool blocking service returns a structurally invalid + response (e.g. empty ``choices``). + + Distinct from transient network/HTTP errors so callers can surface a + louder, misconfiguration-style log instead of treating it as a routine + fail-open. + """ + + +class RubrikLogger(CustomGuardrail, CustomBatchLogger): + def __init__( + self, + api_key: str | None = None, + api_base: str | None = None, + **kwargs, + ): + self.flush_lock = asyncio.Lock() + kwargs.setdefault("guardrail_name", "rubrik") + # `initialize_guardrail` always passes these kwargs explicitly, with + # value `None` when the user omits `mode` / `default_on` from the + # guardrail config. Coerce None (omitted) to the desired default + # while preserving any explicit value the caller did set -- + # in particular `default_on=False` if the user wants the guardrail + # off by default. + kwargs["event_hook"] = kwargs.get("event_hook") or GuardrailEventHooks.post_call + if kwargs.get("default_on") is None: + kwargs["default_on"] = True + super().__init__( + flush_lock=self.flush_lock, + **kwargs, + ) + + verbose_logger.debug("initializing rubrik logger") + + self.sampling_rate = 1.0 + rbrk_sampling_rate = os.getenv("RUBRIK_SAMPLING_RATE") + if rbrk_sampling_rate is not None: + try: + parsed_rate = float(rbrk_sampling_rate.strip()) + self.sampling_rate = max(0.0, min(1.0, parsed_rate)) + if parsed_rate != self.sampling_rate: + verbose_logger.warning( + f"RUBRIK_SAMPLING_RATE={parsed_rate} clamped to " + f"{self.sampling_rate}" + ) + except ValueError: + verbose_logger.warning( + f"Invalid RUBRIK_SAMPLING_RATE: {rbrk_sampling_rate!r}, using 1.0" + ) + + self.key = api_key or os.getenv("RUBRIK_API_KEY") + if not self.key: + verbose_logger.warning( + "Rubrik: No API key configured. Requests will be unauthenticated." + ) + _batch_size = os.getenv("RUBRIK_BATCH_SIZE") + + if _batch_size: + try: + self.batch_size = int(_batch_size) + except ValueError: + verbose_logger.warning( + f"Invalid RUBRIK_BATCH_SIZE: {_batch_size!r}, using default" + ) + + # Cap the in-memory retry queue so a Rubrik webhook outage cannot let + # authenticated traffic accumulate prompt/response payloads until the + # proxy runs out of memory. Once the cap is reached, oldest events are + # dropped to make room for fresh ones (drop-oldest backpressure). + self.max_queue_size = _MAX_QUEUE_SIZE + self._dropped_since_warning = 0 + self._last_drop_warning_time = 0.0 + + _webhook_url = api_base or os.getenv("RUBRIK_WEBHOOK_URL") + + if _webhook_url is None: + raise ValueError( + "Rubrik webhook URL not configured. " + "Set RUBRIK_WEBHOOK_URL or pass api_base." + ) + + _webhook_url = _webhook_url.rstrip("/").removesuffix("/v1") + self.tool_blocking_endpoint = f"{_webhook_url}{_WEBHOOK_PATH_TOOL_BLOCKING}" + self.logging_endpoint = f"{_webhook_url}{_WEBHOOK_PATH_LOGGING_BATCH}" + + self.async_httpx_client = get_async_httpx_client( + llm_provider=httpxSpecialProvider.LoggingCallback + ) + + self.tool_blocking_client = get_async_httpx_client( + llm_provider=httpxSpecialProvider.LoggingCallback, + params={"timeout": httpx.Timeout(5.0, connect=2.0)}, + ) + + self._headers: dict[str, str] = {"Content-Type": "application/json"} + if self.key: + self._headers["Authorization"] = f"Bearer {self.key}" + + # Periodic flush is started lazily on the first log event so that + # low-traffic deployments still get their batches drained even when the + # logger is instantiated outside a running event loop (sync init). + self._flush_task: Optional[asyncio.Task[Any]] = ( + self._start_periodic_flush_task() + ) + + def _start_periodic_flush_task(self) -> Optional[asyncio.Task[Any]]: + """Start the periodic flush task only when an event loop is already running.""" + try: + loop = asyncio.get_running_loop() + except RuntimeError: + verbose_logger.debug( + "Rubrik logger init: no running event loop, " + "periodic flush will start on first log event." + ) + return None + return loop.create_task(self.periodic_flush()) + + def _ensure_periodic_flush_task(self) -> None: + # Synchronous helper: in asyncio's cooperative model there is no await + # between the check and assignment, so two callers cannot race here. + if self._flush_task is None or self._flush_task.done(): + self._flush_task = self._start_periodic_flush_task() + + async def aclose(self): + """Close the dedicated HTTP clients used by this logger.""" + # Cancel the periodic flush task before closing the HTTP clients so + # the loop doesn't wake up and try to POST via a closed client. + if self._flush_task is not None and not self._flush_task.done(): + self._flush_task.cancel() + try: + await self._flush_task + except (asyncio.CancelledError, Exception): + pass + self._flush_task = None + await self.tool_blocking_client.close() + await self.async_httpx_client.close() + + # -- Guardrail hook -------------------------------------------------------- + + async def apply_guardrail( + self, + inputs: GenericGuardrailAPIInputs, + request_data: dict, + input_type: Literal["request", "response"], + logging_obj: Optional["LiteLLMLoggingObj"] = None, + ) -> GenericGuardrailAPIInputs: + """Validate tool calls against the blocking service (fail-open).""" + if input_type != "response": + return inputs + + tool_calls = inputs.get("tool_calls") + if not tool_calls: + return inputs + + try: + return await self._check_tool_calls( + inputs, tool_calls, request_data, logging_obj + ) + except ModifyResponseException: + raise + except _MalformedToolBlockingResponseError as e: + # Distinct from transient errors: the service responded but the + # payload was structurally invalid, which usually indicates a + # misconfigured webhook or a breaking change in its response + # format. Log loudly so operators notice their tool-blocking + # policy is not actually being enforced. + verbose_logger.critical( + "Tool blocking service returned a malformed response: %s. " + "Tool calls are NOT being checked -- verify the webhook " + "configuration. Returning original response unchanged.", + e, + exc_info=True, + ) + return inputs + except Exception as e: + verbose_logger.error( + f"Tool blocking hook failed: {e}. " + "Returning original response unchanged.", + exc_info=True, + ) + return inputs + + async def _check_tool_calls( + self, + inputs: GenericGuardrailAPIInputs, + tool_calls: Any, + request_data: dict, + logging_obj: Optional["LiteLLMLoggingObj"], + ) -> GenericGuardrailAPIInputs: + """Send tool calls to blocking service, raise if any are blocked.""" + message_tool_calls = self._normalize_tool_calls(tool_calls) + + call_details = ( + getattr(logging_obj, "model_call_details", {}) if logging_obj else {} + ) + response = request_data.get("response") + request_id = getattr(response, "id", None) if response else None + if logging_obj and not call_details: + verbose_logger.warning( + "Rubrik: logging_obj present but model_call_details is empty " + "-- request context will be missing" + ) + + response_data = self._build_tool_call_payload(message_tool_calls, request_id) + req_data = self._extract_request_data(call_details) + + service_response = await self._post_to_tool_blocking_service( + response_data, req_data + ) + blocked_explanation = self._extract_blocked_tools( + service_response, message_tool_calls + ) + + if blocked_explanation is not None: + model = self._resolve_model(request_data, call_details) + raise ModifyResponseException( + message=blocked_explanation, + model=model, + request_data=request_data, + guardrail_name=self.guardrail_name, + ) + + return inputs + + @staticmethod + def _normalize_tool_calls(tool_calls: Any) -> list[ChatCompletionMessageToolCall]: + """Convert tool_calls from inputs to ChatCompletionMessageToolCall objects.""" + result = [] + for tc in tool_calls: + if isinstance(tc, ChatCompletionMessageToolCall): + result.append(tc) + elif isinstance(tc, dict): + func = tc.get("function", {}) + result.append( + ChatCompletionMessageToolCall( + id=tc.get("id", ""), + type=tc.get("type", "function"), + function=Function( + name=func.get("name", ""), + arguments=func.get("arguments", ""), + ), + ) + ) + elif hasattr(tc, "id") and hasattr(tc, "function"): + result.append( + ChatCompletionMessageToolCall( + id=tc.id or "", + type=getattr(tc, "type", None) or "function", + function=tc.function, + ) + ) + else: + raise TypeError( + f"Cannot normalize tool_call of type {type(tc).__name__}" + ) + return result + + @staticmethod + def _build_tool_call_payload( + tool_calls: list[ChatCompletionMessageToolCall], + request_id: str | None, + ) -> dict[str, Any]: + """Build a full OpenAI ChatCompletion-format dict for the blocking service.""" + return { + "id": request_id or f"chatcmpl-{uuid.uuid4()}", + "object": "chat.completion", + "created": int(time.time()), + "model": "", + "choices": [ + { + "index": 0, + "message": { + "role": "assistant", + "content": None, + "tool_calls": [ + tc.model_dump(exclude_none=True) for tc in tool_calls + ], + }, + "finish_reason": "tool_calls", + } + ], + } + + @staticmethod + def _extract_request_data(call_details: dict[str, Any]) -> dict[str, Any]: + """Extract original request data from model_call_details.""" + if not call_details: + return {} + litellm_params = call_details.get("litellm_params", {}) or {} + return { + "messages": call_details.get("messages"), + "model": call_details.get("model"), + "proxy_server_request": RubrikLogger._sanitize_proxy_server_request( + litellm_params.get("proxy_server_request") + ), + } + + @staticmethod + def _sanitize_proxy_server_request(proxy_server_request: Any) -> Any: + """Allowlist only routing fields (``url``, ``method``) when forwarding + ``proxy_server_request`` to the external Rubrik webhook, dropping + inbound ``headers`` (Authorization, Cookie, x-api-key, ...) and the raw + request ``body`` so proxy credentials are not exfiltrated.""" + if not isinstance(proxy_server_request, dict): + return proxy_server_request + return { + key: proxy_server_request[key] + for key in ("url", "method") + if key in proxy_server_request + } + + @staticmethod + def _resolve_model( + request_data: dict[str, Any], call_details: dict[str, Any] + ) -> str: + """Get the model name for the ModifyResponseException.""" + response = request_data.get("response") + if response and hasattr(response, "model"): + return response.model or "unknown" + return call_details.get("model", "unknown") + + # -- Logging hooks --------------------------------------------------------- + + async def _prepare_log_payload( + self, kwargs: dict, event_type: str + ) -> StandardLoggingPayload | None: + """Shared logic for success and failure logging.""" + if random.random() > self.sampling_rate: + verbose_logger.debug( + f"Skipping Rubrik {event_type} logging " + f"(sampling_rate={self.sampling_rate})" + ) + return None + + # Deep-copy so mutations don't affect other callbacks sharing this object + standard_logging_payload: StandardLoggingPayload = safe_deep_copy( + kwargs["standard_logging_object"] + ) + + # For Anthropic /v1/messages requests, LiteLLM creates a separate + # ModelResponse (with a generated chatcmpl-* id) for logging, which + # differs from the original Anthropic msg-* id on the response dict. + # Normalize to litellm_call_id so that the logging and tool-blocking + # endpoints see the same request identifier. + litellm_params = kwargs.get("litellm_params", {}) or {} + proxy_request = litellm_params.get("proxy_server_request", {}) or {} + url_path = urllib.parse.urlparse(proxy_request.get("url", "")).path + if url_path.endswith(_ENDPOINT_ANTHROPIC_MESSAGES): + _litellm_call_id = kwargs.get("litellm_call_id") + if _litellm_call_id: + standard_logging_payload["id"] = _litellm_call_id # type: ignore[literal-required] + + if "system" in kwargs: + system_prompt_msg_list = kwargs["system"] + try: + if system_prompt_msg_list: + system_scaffold = { + "role": "system", + "content": system_prompt_msg_list, + } + if isinstance(standard_logging_payload["messages"], list): + standard_logging_payload["messages"].insert(0, system_scaffold) + elif isinstance(standard_logging_payload["messages"], (dict, str)): + standard_logging_payload["messages"] = [ + system_scaffold, + standard_logging_payload["messages"], + ] + except Exception as e: + verbose_logger.warning( + f"Rubrik: failed to prepend system prompt: {e}", + exc_info=True, + ) + + return standard_logging_payload + + async def _enqueue_log_event(self, kwargs: dict, event_type: str): + try: + self._ensure_periodic_flush_task() + payload = await self._prepare_log_payload(kwargs, event_type) + if payload is None: + return + + self.log_queue.append(payload) + self._enforce_max_queue_size() + + if len(self.log_queue) >= self.batch_size: + await self.flush_queue() + except Exception as e: + verbose_logger.error( + f"Rubrik {event_type} logging hook failed: {e}. " + "Skipping logging for this event.", + exc_info=True, + ) + + def _enforce_max_queue_size(self) -> None: + overflow = len(self.log_queue) - self.max_queue_size + if overflow <= 0: + return + del self.log_queue[:overflow] + self._dropped_since_warning += overflow + now = time.time() + if now - self._last_drop_warning_time >= _DROP_WARNING_INTERVAL_SECONDS: + verbose_logger.warning( + "Rubrik: log queue exceeded max_queue_size=%s; dropped %s " + "oldest events since the last warning. The Rubrik webhook may " + "be unhealthy or undersized for current traffic.", + self.max_queue_size, + self._dropped_since_warning, + ) + self._dropped_since_warning = 0 + self._last_drop_warning_time = now + + async def async_log_success_event(self, kwargs, response_obj, start_time, end_time): + await self._enqueue_log_event(kwargs, "success") + + async def async_log_failure_event(self, kwargs, response_obj, start_time, end_time): + await self._enqueue_log_event(kwargs, "failure") + + # -- Batch logging --------------------------------------------------------- + + async def _log_batch_to_rubrik(self, data): + # NOTE: this method intentionally re-raises on failure so the parent + # CustomBatchLogger.flush_queue keeps the unsent events in the queue + # for the next flush attempt instead of silently dropping them. + try: + response = await self.async_httpx_client.post( + url=self.logging_endpoint, + json=data, + headers=self._headers, + ) + response.raise_for_status() + except httpx.HTTPStatusError as e: + verbose_logger.exception( + f"Rubrik HTTP Error: {e.response.status_code} - {e.response.text}" + ) + raise + except Exception: + verbose_logger.exception("Rubrik Layer Error") + raise + + async def async_send_batch(self): + """Handles sending batches of responses to Rubrik. + + Note: the canonical flush path is :meth:`flush_queue`, which takes a + single snapshot used for both sending and queue draining. This method + is kept for direct callers / tests; it intentionally does NOT remove + events from the queue. + """ + if not self.log_queue: + return + + log_queue_snapshot = list(self.log_queue) + verbose_logger.debug( + "Rubrik: Flushing batch of %s events", len(log_queue_snapshot) + ) + await self._log_batch_to_rubrik( + data=log_queue_snapshot, + ) + + async def flush_queue(self): + """Snapshot, send, and drain in one consistent step. + + Overrides the base implementation so the same snapshot drives both + the HTTP send and the queue truncation. This avoids the subtle + coupling where the base class captures `len(self.log_queue)` + separately from the snapshot taken inside `async_send_batch`, + which could otherwise drift in a future refactor and cause + duplicate deliveries to Rubrik. + """ + if self.flush_lock is None: + return + + async with self.flush_lock: + if not self.log_queue: + return + snapshot = list(self.log_queue) + verbose_logger.debug("Rubrik: Flushing batch of %s events", len(snapshot)) + try: + await self._log_batch_to_rubrik(data=snapshot) + except Exception: + # Already logged with traceback inside _log_batch_to_rubrik. + # Preserve the in-flight events for retry on the next flush. + return + del self.log_queue[: len(snapshot)] + self.last_flush_time = time.time() + + # -- Tool blocking service ------------------------------------------------- + + async def _post_to_tool_blocking_service( + self, + response_data: dict[str, Any], + request_data: dict[str, Any], + ) -> dict[str, Any]: + """Post a payload to the tool blocking service and return the response. + + Args: + response_data: The OpenAI-formatted response payload to send. + request_data: Original LLM request data to include alongside + the response for additional context. Empty dict if unavailable. + + Raises: + Exception: If the service is unavailable or returns an error. + """ + envelope = { + "request": request_data, + "response": response_data, + } + verbose_logger.debug( + f"Sending request to tool blocking service: " + f"{self.tool_blocking_endpoint}" + ) + http_response = await self.tool_blocking_client.post( + self.tool_blocking_endpoint, + json=envelope, + headers=self._headers, + ) + http_response.raise_for_status() + result: dict[str, Any] = http_response.json() + return result + + @staticmethod + def _extract_blocked_tools( + service_response: dict[str, Any], + all_tool_calls: list[ChatCompletionMessageToolCall], + ) -> Optional[str]: + """Return the blocking explanation if any tool calls were blocked. + + Compares the service response (which contains only allowed tools) against + the full set of tool calls. Returns ``None`` if all tools are allowed, or + the explanation string (prefixed with newlines) otherwise. + + Expects service_response in OpenAI chat completion format: + {"choices": [{"message": {"tool_calls": [...], "content": "..."}}]} + """ + choices = service_response.get("choices", []) + if not choices: + raise _MalformedToolBlockingResponseError( + "Tool blocking service returned empty response" + ) + + message = choices[0].get("message", {}) + returned_tool_calls = message.get("tool_calls") or [] + blocking_explanation = message.get("content", "") + + allowed_id_counts: Counter = Counter( + tc["id"] + for tc in returned_tool_calls + if isinstance(tc, dict) and tc.get("id") + ) + required_id_counts: Counter = Counter(tc.id for tc in all_tool_calls if tc.id) + + all_allowed = len(returned_tool_calls) >= len(all_tool_calls) and all( + allowed_id_counts.get(tc_id, 0) >= count + for tc_id, count in required_id_counts.items() + ) + + if all_allowed: + return None + + explanation = blocking_explanation or "Tool call blocked by policy." + return f"\n\n{explanation}" diff --git a/litellm/integrations/s3_v2.py b/litellm/integrations/s3_v2.py index 08ce7ed8947..4ed8a809a13 100644 --- a/litellm/integrations/s3_v2.py +++ b/litellm/integrations/s3_v2.py @@ -1,8 +1,8 @@ """ s3 Bucket Logging Integration -async_log_success_event: Processes the event, stores it in memory for DEFAULT_S3_FLUSH_INTERVAL_SECONDS seconds or until DEFAULT_S3_BATCH_SIZE and then flushes to s3 -async_log_failure_event: Processes the event, stores it in memory for DEFAULT_S3_FLUSH_INTERVAL_SECONDS seconds or until DEFAULT_S3_BATCH_SIZE and then flushes to s3 +async_log_success_event: Processes the event, stores it in memory for DEFAULT_S3_FLUSH_INTERVAL_SECONDS seconds or until DEFAULT_S3_BATCH_SIZE and then flushes to s3 +async_log_failure_event: Processes the event, stores it in memory for DEFAULT_S3_FLUSH_INTERVAL_SECONDS seconds or until DEFAULT_S3_BATCH_SIZE and then flushes to s3 NOTE 1: S3 does not provide a BATCH PUT API endpoint, so we create tasks to upload each element individually """ @@ -16,6 +16,7 @@ from litellm._logging import print_verbose, verbose_logger from litellm.constants import DEFAULT_S3_BATCH_SIZE, DEFAULT_S3_FLUSH_INTERVAL_SECONDS from litellm.integrations.s3 import get_s3_object_key from litellm.litellm_core_utils.safe_json_dumps import safe_dumps +from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker from litellm.llms.bedrock.base_aws_llm import BaseAWSLLM from litellm.llms.custom_httpx.http_handler import ( _get_httpx_client, @@ -53,15 +54,25 @@ class S3Logger(CustomBatchLogger, BaseAWSLLM): s3_strip_base64_files: bool = False, s3_use_key_prefix: bool = False, s3_use_virtual_hosted_style: bool = False, + s3_callback_params_override: Optional[dict] = None, **kwargs, ): try: - verbose_logger.debug( - f"in init s3 logger - s3_callback_params {litellm.s3_callback_params}" - ) + _masker = SensitiveDataMasker() + if s3_callback_params_override is not None: + verbose_logger.debug( + f"in init s3 logger (audit override) - " + f"{_masker.mask_dict(dict(s3_callback_params_override))}" + ) + else: + verbose_logger.debug( + f"in init s3 logger - s3_callback_params " + f"{_masker.mask_dict(dict(litellm.s3_callback_params or {}))}" + ) # Initialize S3 params first to get the correct s3_verify value self._init_s3_params( + params_source=s3_callback_params_override, s3_bucket_name=s3_bucket_name, s3_region_name=s3_region_name, s3_api_version=s3_api_version, @@ -139,94 +150,85 @@ class S3Logger(CustomBatchLogger, BaseAWSLLM): s3_strip_base64_files: bool = False, s3_use_key_prefix: bool = False, s3_use_virtual_hosted_style: bool = False, + params_source: Optional[dict] = None, ): """ - Initialize the s3 params for this logging callback + Initialize the s3 params for this logging callback. Reads from + `params_source` if given (e.g. `s3_audit_callback_params` for the + audit-log instance), otherwise falls back to `litellm.s3_callback_params`. + Resolves `os.environ/X` markers into a local dict; never mutates the source. """ - litellm.s3_callback_params = litellm.s3_callback_params or {} - # read in .env variables - example os.environ/AWS_BUCKET_NAME - for key, value in litellm.s3_callback_params.items(): - if isinstance(value, str) and value.startswith("os.environ/"): - litellm.s3_callback_params[key] = litellm.get_secret(value) + if params_source is None: + params_source = litellm.s3_callback_params or {} + params: dict = { + key: ( + litellm.get_secret(value) + if isinstance(value, str) and value.startswith("os.environ/") + else value + ) + for key, value in params_source.items() + } - self.s3_bucket_name = ( - litellm.s3_callback_params.get("s3_bucket_name") or s3_bucket_name - ) - self.s3_region_name = ( - litellm.s3_callback_params.get("s3_region_name") or s3_region_name - ) - self.s3_api_version = ( - litellm.s3_callback_params.get("s3_api_version") or s3_api_version - ) + self.s3_bucket_name = params.get("s3_bucket_name") or s3_bucket_name + self.s3_region_name = params.get("s3_region_name") or s3_region_name + self.s3_api_version = params.get("s3_api_version") or s3_api_version self.s3_use_ssl = ( - litellm.s3_callback_params.get("s3_use_ssl", True) - if litellm.s3_callback_params.get("s3_use_ssl") is not None + params.get("s3_use_ssl", True) + if params.get("s3_use_ssl") is not None else s3_use_ssl ) self.s3_verify = ( - litellm.s3_callback_params.get("s3_verify") - if litellm.s3_callback_params.get("s3_verify") is not None + params.get("s3_verify") + if params.get("s3_verify") is not None else s3_verify ) - self.s3_endpoint_url = ( - litellm.s3_callback_params.get("s3_endpoint_url") or s3_endpoint_url - ) + self.s3_endpoint_url = params.get("s3_endpoint_url") or s3_endpoint_url self.s3_aws_access_key_id = ( - litellm.s3_callback_params.get("s3_aws_access_key_id") - or s3_aws_access_key_id + params.get("s3_aws_access_key_id") or s3_aws_access_key_id ) self.s3_aws_secret_access_key = ( - litellm.s3_callback_params.get("s3_aws_secret_access_key") - or s3_aws_secret_access_key + params.get("s3_aws_secret_access_key") or s3_aws_secret_access_key ) self.s3_aws_session_token = ( - litellm.s3_callback_params.get("s3_aws_session_token") - or s3_aws_session_token + params.get("s3_aws_session_token") or s3_aws_session_token ) self.s3_aws_session_name = ( - litellm.s3_callback_params.get("s3_aws_session_name") or s3_aws_session_name + params.get("s3_aws_session_name") or s3_aws_session_name ) self.s3_aws_profile_name = ( - litellm.s3_callback_params.get("s3_aws_profile_name") or s3_aws_profile_name + params.get("s3_aws_profile_name") or s3_aws_profile_name ) - self.s3_aws_role_name = ( - litellm.s3_callback_params.get("s3_aws_role_name") or s3_aws_role_name - ) + self.s3_aws_role_name = params.get("s3_aws_role_name") or s3_aws_role_name self.s3_aws_web_identity_token = ( - litellm.s3_callback_params.get("s3_aws_web_identity_token") - or s3_aws_web_identity_token + params.get("s3_aws_web_identity_token") or s3_aws_web_identity_token ) self.s3_aws_sts_endpoint = ( - litellm.s3_callback_params.get("s3_aws_sts_endpoint") or s3_aws_sts_endpoint + params.get("s3_aws_sts_endpoint") or s3_aws_sts_endpoint ) - self.s3_config = litellm.s3_callback_params.get("s3_config") or s3_config - self.s3_path = litellm.s3_callback_params.get("s3_path") or s3_path - # done reading litellm.s3_callback_params + self.s3_config = params.get("s3_config") or s3_config + self.s3_path = params.get("s3_path") or s3_path self.s3_use_team_prefix = ( - bool(litellm.s3_callback_params.get("s3_use_team_prefix", False)) - or s3_use_team_prefix + bool(params.get("s3_use_team_prefix", False)) or s3_use_team_prefix ) self.s3_use_key_prefix = ( - bool(litellm.s3_callback_params.get("s3_use_key_prefix", False)) - or s3_use_key_prefix + bool(params.get("s3_use_key_prefix", False)) or s3_use_key_prefix ) self.s3_strip_base64_files = ( - bool(litellm.s3_callback_params.get("s3_strip_base64_files", False)) - or s3_strip_base64_files + bool(params.get("s3_strip_base64_files", False)) or s3_strip_base64_files ) self.s3_use_virtual_hosted_style = ( - bool(litellm.s3_callback_params.get("s3_use_virtual_hosted_style", False)) + bool(params.get("s3_use_virtual_hosted_style", False)) or s3_use_virtual_hosted_style ) diff --git a/litellm/integrations/websearch_interception/handler.py b/litellm/integrations/websearch_interception/handler.py index 41618c72627..37528e7dcd5 100644 --- a/litellm/integrations/websearch_interception/handler.py +++ b/litellm/integrations/websearch_interception/handler.py @@ -19,12 +19,14 @@ from litellm.integrations.custom_logger import CustomLogger from litellm.integrations.websearch_interception.tools import ( get_litellm_web_search_tool, get_litellm_web_search_tool_openai, + is_anthropic_native_web_search_tool, is_web_search_tool, is_web_search_tool_chat_completion, ) from litellm.integrations.websearch_interception.transformation import ( WebSearchTransformation, ) +from litellm.llms.base_llm.search.transformation import SearchResponse from litellm.types.integrations.websearch_interception import ( WebSearchInterceptionConfig, ) @@ -36,6 +38,16 @@ from litellm.types.llms.openai import AllMessageValues from litellm.types.utils import LlmProviders from litellm.utils import ProviderConfigManager +# Key used to flag, on per-request kwargs, that the originating client sent +# an Anthropic-native ``web_search_*`` tool — meaning the final response +# should include ``web_search_tool_result`` content blocks so the client +# (e.g. Claude Desktop's citations panel) can render sources. +WEBSEARCH_EMIT_NATIVE_BLOCKS_KEY = "_websearch_interception_emit_native_blocks" + +# Key on ``AgenticLoopPlan.metadata`` carrying the list of pre-built +# ``web_search_tool_result`` blocks to inject into the final response. +WEBSEARCH_NATIVE_BLOCKS_METADATA_KEY = "websearch_native_blocks" + class WebSearchInterceptionLogger(CustomLogger): """ @@ -152,22 +164,55 @@ class WebSearchInterceptionLogger(CustomLogger): f"(provider={provider_str}, query='{query}')" ) - # Execute search + # Native clients (Claude Desktop / Cowork / Anthropic SDK) make a + # standalone /v1/messages sub-request just for the search, and they + # expect the response in native shape with server_tool_use + + # web_search_tool_result content blocks so the citations panel can + # render. The agentic-loop post-hook never fires on this path because + # there is no model call — emit the native blocks here instead. + native_tool = next( + (t for t in tools if is_anthropic_native_web_search_tool(t)), + None, + ) + + # Execute search — keep the structured SearchResponse so the native + # block can carry per-result url/title/page_age. try: - search_result_text = await self._execute_search(query) + search_result_text, structured = await self._execute_search(query) except Exception as e: verbose_logger.error( f"WebSearchInterception: Short-circuit search failed: {e}" ) - search_result_text = f"Search failed: {e}" + search_result_text, structured = f"Search failed: {e}", None + + content: List[Dict[str, Any]] = [] + if native_tool is not None: + tool_use_id = f"srvtoolu_{uuid.uuid4().hex}" + tool_name = native_tool.get("name") or "web_search" + content.append( + { + "type": "server_tool_use", + "id": tool_use_id, + "name": tool_name, + "input": {"query": query}, + } + ) + content.append( + WebSearchTransformation.build_web_search_tool_result_block( + tool_use_id=tool_use_id, + search_response=structured, + ) + ) + # Keep the text block so non-native short-circuit callers (Claude Code, + # github_copilot, etc.) see the same payload they always have. + content.append({"type": "text", "text": search_result_text}) - # Build synthetic Anthropic response response: Dict[str, Any] = { "id": f"msg_{str(uuid.uuid4())}", "type": "message", "role": "assistant", "model": model, - "content": [{"type": "text", "text": search_result_text}], + "content": content, "stop_reason": "end_turn", "stop_sequence": None, "usage": {"input_tokens": 0, "output_tokens": 0}, @@ -175,7 +220,8 @@ class WebSearchInterceptionLogger(CustomLogger): verbose_logger.debug( "WebSearchInterception: Short-circuit search completed, " - f"returning synthetic response ({len(search_result_text)} chars)" + f"returning synthetic response ({len(search_result_text)} chars, " + f"native_blocks={native_tool is not None})" ) return response @@ -219,6 +265,14 @@ class WebSearchInterceptionLogger(CustomLogger): "WebSearchInterception: Converting native web_search tools to LiteLLM standard" ) + # If the client sent an Anthropic-native web_search_* tool, mark the + # request so the agentic loop emits native web_search_tool_result + # blocks in the final response (matches async_pre_request_hook). This + # deployment hook fires before async_pre_request_hook on some paths, + # so flagging here ensures the signal isn't lost regardless of order. + if any(is_anthropic_native_web_search_tool(t) for t in tools): + kwargs[WEBSEARCH_EMIT_NATIVE_BLOCKS_KEY] = True + # Convert native/custom web_search tools to LiteLLM standard converted_tools = [] for tool in tools: @@ -342,6 +396,14 @@ class WebSearchInterceptionLogger(CustomLogger): f"WebSearchInterception: Pre-request hook triggered for provider={custom_llm_provider}" ) + # If the client sent an Anthropic-native web_search_* tool, mark the + # request so the agentic loop emits native web_search_tool_result + # blocks in the final response (for citations panels, etc.). The flag + # is read by async_build_agentic_loop_plan; the leading underscore + # prefix ensures it is stripped before the follow-up call kwargs. + if any(is_anthropic_native_web_search_tool(t) for t in tools): + kwargs[WEBSEARCH_EMIT_NATIVE_BLOCKS_KEY] = True + # Convert native web search tools to LiteLLM standard converted_tools = [] for tool in tools: @@ -591,7 +653,7 @@ class WebSearchInterceptionLogger(CustomLogger): ) -> AgenticLoopPlan: tool_calls = tools["tool_calls"] thinking_blocks = tools.get("thinking_blocks", []) - request_patch = await self._build_anthropic_request_patch( + request_patch, structured_results = await self._build_anthropic_request_patch( model=model, messages=messages, tool_calls=tool_calls, @@ -600,12 +662,92 @@ class WebSearchInterceptionLogger(CustomLogger): logging_obj=logging_obj, kwargs=kwargs, ) + + metadata: Dict[str, Any] = { + "tool_type": "websearch", + "response_format": "anthropic", + } + + # If the client request originally carried a native web_search_* tool, + # pre-build the Anthropic-native ``web_search_tool_result`` blocks now + # (while we still have the structured SearchResponse list) and stash + # them on plan metadata for the post-hook to inject. + if kwargs.get(WEBSEARCH_EMIT_NATIVE_BLOCKS_KEY): + metadata[WEBSEARCH_NATIVE_BLOCKS_METADATA_KEY] = ( + self._build_native_result_blocks( + tool_calls=tool_calls, + structured_results=structured_results, + ) + ) + return AgenticLoopPlan( run_agentic_loop=True, request_patch=request_patch, - metadata={"tool_type": "websearch", "response_format": "anthropic"}, + metadata=metadata, ) + async def async_post_agentic_loop_response_hook( + self, + response: Any, + plan: AgenticLoopPlan, + kwargs: Dict, + ) -> Any: + """ + Inject Anthropic-native ``web_search_tool_result`` blocks into the + final response when the originating client used a native + ``web_search_*`` tool. + + See ``WebSearchTransformation.build_web_search_tool_result_block`` for + the block shape. The blocks are prepended to ``response.content`` so + Anthropic-native clients (Claude Desktop, the Anthropic SDK) can + render citations / sources alongside the model's textual reply. + """ + native_blocks = plan.metadata.get(WEBSEARCH_NATIVE_BLOCKS_METADATA_KEY) + if not native_blocks: + return response + return self._inject_native_blocks(response, native_blocks) + + @staticmethod + def _build_native_result_blocks( + tool_calls: List[Dict], + structured_results: List[Optional[SearchResponse]], + ) -> List[Dict[str, Any]]: + """Build one ``web_search_tool_result`` block per tool_call.""" + blocks: List[Dict[str, Any]] = [] + for i, tool_call in enumerate(tool_calls): + tool_use_id = tool_call.get("id") or "" + structured = structured_results[i] if i < len(structured_results) else None + blocks.append( + WebSearchTransformation.build_web_search_tool_result_block( + tool_use_id=tool_use_id, + search_response=structured, + ) + ) + return blocks + + @staticmethod + def _inject_native_blocks( + response: Any, native_blocks: List[Dict[str, Any]] + ) -> Any: + """Prepend native blocks to response content, dict or object form.""" + if not native_blocks: + return response + if isinstance(response, dict): + existing = response.get("content") or [] + response["content"] = list(native_blocks) + list(existing) + return response + existing = getattr(response, "content", None) or [] + try: + response.content = list(native_blocks) + list(existing) + except (AttributeError, TypeError): + # Object refused write — fall through and leave the response + # untouched rather than crash the request. + verbose_logger.debug( + "WebSearchInterception: could not inject native blocks into " + f"response of type {type(response).__name__}" + ) + return response + async def async_run_chat_completion_agentic_loop( self, tools: Dict, @@ -733,7 +875,7 @@ class WebSearchInterceptionLogger(CustomLogger): kwargs: Dict, ) -> Any: """Legacy path: execute search + build patch + run follow-up call.""" - request_patch = await self._build_anthropic_request_patch( + request_patch, structured_results = await self._build_anthropic_request_patch( model=model, messages=messages, tool_calls=tool_calls, @@ -755,7 +897,7 @@ class WebSearchInterceptionLogger(CustomLogger): if max_tokens is None: max_tokens = cast(int, kwargs.get("max_tokens", 1024)) - return await anthropic_messages.acreate( + response = await anthropic_messages.acreate( max_tokens=max_tokens, messages=request_patch.messages, model=request_patch.model or model, @@ -763,6 +905,18 @@ class WebSearchInterceptionLogger(CustomLogger): **request_patch.kwargs, ) + # Legacy path: the new path goes through the typed plan + core + # dispatcher which runs the post-hook automatically. Mirror the + # native-block injection here so both paths behave identically. + if kwargs.get(WEBSEARCH_EMIT_NATIVE_BLOCKS_KEY): + native_blocks = self._build_native_result_blocks( + tool_calls=tool_calls, + structured_results=structured_results, + ) + response = self._inject_native_blocks(response, native_blocks) + + return response + async def _build_anthropic_request_patch( self, model: str, @@ -772,8 +926,16 @@ class WebSearchInterceptionLogger(CustomLogger): anthropic_messages_optional_request_params: Dict, logging_obj: Any, kwargs: Dict, - ) -> AgenticLoopRequestPatch: - """Execute litellm.search() and build follow-up request patch.""" + ) -> Tuple[AgenticLoopRequestPatch, List[Optional[SearchResponse]]]: + """ + Execute litellm.search() and build follow-up request patch. + + Returns the patch alongside the parallel list of structured + ``SearchResponse`` objects (one per tool_call, ``None`` when the + search failed or the tool_call had no query). The caller uses these + to optionally build Anthropic-native ``web_search_tool_result`` + content blocks for the final response. + """ # Extract search queries from tool_use blocks search_tasks = [] @@ -797,23 +959,38 @@ class WebSearchInterceptionLogger(CustomLogger): ) search_results = await asyncio.gather(*search_tasks, return_exceptions=True) - # Handle any exceptions in search results + # Split the gathered (text, structured) tuples into two parallel lists. + # The text list feeds the follow-up model call; the structured list + # is returned to the caller for native-block emission. final_search_results: List[str] = [] + structured_results: List[Optional[SearchResponse]] = [] for i, result in enumerate(search_results): if isinstance(result, Exception): verbose_logger.error( f"WebSearchInterception: Search {i} failed with error: {str(result)}" ) final_search_results.append(f"Search failed: {str(result)}") - elif isinstance(result, str): - # Explicitly cast to str for type checker - final_search_results.append(cast(str, result)) + structured_results.append(None) + elif isinstance(result, tuple) and len(result) == 2: + text_value, structured_value = result + final_search_results.append( + cast(str, text_value) + if isinstance(text_value, str) + else str(text_value) + ) + structured_results.append( + structured_value + if isinstance(structured_value, SearchResponse) + else None + ) else: - # Should never happen, but handle for type safety + # Defensive: legacy callers / unexpected shape — preserve text, + # drop structure. verbose_logger.debug( f"WebSearchInterception: Unexpected result type {type(result)} at index {i}" ) final_search_results.append(str(result)) + structured_results.append(None) # Build assistant and user messages using transformation assistant_message, user_message = WebSearchTransformation.transform_response( @@ -859,16 +1036,26 @@ class WebSearchInterceptionLogger(CustomLogger): len(follow_up_messages), len(final_search_results), ) - return AgenticLoopRequestPatch( + patch = AgenticLoopRequestPatch( model=full_model_name, messages=follow_up_messages, max_tokens=max_tokens, optional_params=optional_params_without_max_tokens, kwargs=kwargs_for_followup, ) + return patch, structured_results - async def _execute_search(self, query: str) -> str: - """Execute a single web search using router's search tools""" + async def _execute_search(self, query: str) -> Tuple[str, Optional[SearchResponse]]: + """ + Execute a single web search using router's search tools. + + Returns both the formatted text (fed back to the model in the follow-up + call) and the structured ``SearchResponse`` (preserved so callers can + build Anthropic-native ``web_search_tool_result`` blocks for clients + that requested a native ``web_search_*`` tool). The structured value + is None on the failure path so callers can still emit an empty result + block rather than dropping the search entirely. + """ try: # Import router from proxy_server try: @@ -934,7 +1121,7 @@ class WebSearchInterceptionLogger(CustomLogger): verbose_logger.debug( f"WebSearchInterception: Search completed for '{query}', got {len(search_result_text)} chars" ) - return search_result_text + return search_result_text, result except Exception as e: verbose_logger.error( f"WebSearchInterception: Search failed for '{query}': {str(e)}" @@ -1015,7 +1202,8 @@ class WebSearchInterceptionLogger(CustomLogger): ) search_results = await asyncio.gather(*search_tasks, return_exceptions=True) - # Handle any exceptions in search results + # Chat-completion path only needs text — OpenAI tool_result format + # has no equivalent of Anthropic's web_search_tool_result block. final_search_results: List[str] = [] for i, result in enumerate(search_results): if isinstance(result, Exception): @@ -1023,8 +1211,13 @@ class WebSearchInterceptionLogger(CustomLogger): f"WebSearchInterception: Search {i} failed with error: {str(result)}" ) final_search_results.append(f"Search failed: {str(result)}") - elif isinstance(result, str): - final_search_results.append(cast(str, result)) + elif isinstance(result, tuple) and len(result) == 2: + text_value, _ = result + final_search_results.append( + cast(str, text_value) + if isinstance(text_value, str) + else str(text_value) + ) else: verbose_logger.debug( f"WebSearchInterception: Unexpected result type {type(result)} at index {i}" @@ -1112,9 +1305,11 @@ class WebSearchInterceptionLogger(CustomLogger): kwargs=kwargs_for_followup, ) - async def _create_empty_search_result(self) -> str: + async def _create_empty_search_result( + self, + ) -> Tuple[str, Optional[SearchResponse]]: """Create an empty search result for tool calls without queries""" - return "No search query provided" + return "No search query provided", None @staticmethod def initialize_from_proxy_config( diff --git a/litellm/integrations/websearch_interception/tools.py b/litellm/integrations/websearch_interception/tools.py index e373b64cdda..b29372af9ed 100644 --- a/litellm/integrations/websearch_interception/tools.py +++ b/litellm/integrations/websearch_interception/tools.py @@ -126,6 +126,27 @@ def is_web_search_tool_chat_completion(tool: Dict[str, Any]) -> bool: return False +def is_anthropic_native_web_search_tool(tool: Dict[str, Any]) -> bool: + """ + Check if a tool is an Anthropic-native ``web_search_*`` tool. + + Native clients (Anthropic SDK, Claude Desktop, Anthropic Console) send + tools like ``{"type": "web_search_20250305", "name": "web_search"}`` and + expect the response to contain ``web_search_tool_result`` content blocks + so that citations can be rendered. This helper identifies that contract + so the agentic loop can emit native-format blocks for those clients + without affecting clients that send the LiteLLM standard tool. + + Returns False for the LiteLLM standard tool (``litellm_web_search``), + the OpenAI-shaped variant, the bare ``WebSearch`` legacy name, and the + bare ``web_search`` name (Claude Code style). + """ + tool_type = tool.get("type", "") + if not isinstance(tool_type, str): + return False + return tool_type.startswith("web_search_") and tool_type != "function" + + def is_web_search_tool(tool: Dict[str, Any]) -> bool: """ Check if a tool is a web search tool (native or LiteLLM standard). @@ -135,7 +156,22 @@ def is_web_search_tool(tool: Dict[str, Any]) -> bool: - OpenAI format: type == "function" with function.name == "litellm_web_search" - Anthropic native: type starts with "web_search_" (e.g., "web_search_20250305") - Claude Code: name == "web_search" with a type field - - Custom: name == "WebSearch" (legacy format) + - Custom: name == "WebSearch" (legacy interception marker — only matched + when input_schema is absent; see note below) + + Note on the legacy ``WebSearch`` name: + Clients like Claude Desktop / Cowork ship a *client-side* tool called + ``WebSearch`` (a fully-formed Anthropic client tool with its own + ``input_schema``) that they handle themselves. Treating that as our + interception marker hijacks it server-side and the client's own tool + handler never fires — which means Cowork's separate native + ``web_search_20250305`` sub-request (where citation data actually + flows) never gets made. + + Real Anthropic client tools always carry an ``input_schema`` (the API + rejects them otherwise), so a bare ``{name: "WebSearch"}`` with no + schema is the only thing that could be a legacy interception marker. + Gate the match on schema absence to keep both groups working. Args: tool: Tool dictionary to check @@ -152,6 +188,10 @@ def is_web_search_tool(tool: Dict[str, Any]) -> bool: True >>> is_web_search_tool({"name": "calculator"}) False + >>> is_web_search_tool({"name": "WebSearch"}) # legacy interception marker + True + >>> is_web_search_tool({"name": "WebSearch", "input_schema": {"type": "object"}}) # Cowork client tool + False """ tool_name = tool.get("name", "") tool_type = tool.get("type", "") @@ -175,8 +215,9 @@ def is_web_search_tool(tool: Dict[str, Any]) -> bool: if tool_name == "web_search" and tool_type: return True - # Check for legacy WebSearch format - if tool_name == "WebSearch": + # Legacy "WebSearch" interception marker — only when no schema is + # present, so real client-side WebSearch tools (Cowork) pass through. + if tool_name == "WebSearch" and "input_schema" not in tool: return True return False diff --git a/litellm/integrations/websearch_interception/transformation.py b/litellm/integrations/websearch_interception/transformation.py index 00d4829ad39..9c20a3f6c77 100644 --- a/litellm/integrations/websearch_interception/transformation.py +++ b/litellm/integrations/websearch_interception/transformation.py @@ -100,11 +100,14 @@ class WebSearchTransformation: block_id = getattr(block, "id", None) block_input = getattr(block, "input", {}) - # Check for LiteLLM standard or legacy web search tools - # Handles: litellm_web_search, WebSearch, web_search + # Detect tool_use blocks that came from interception. After + # pre-request conversion the model always sees + # ``litellm_web_search``; the bare ``web_search`` entry handles + # callers that bypass our pre-request hooks (e.g. direct + # litellm.acompletion). "WebSearch" is intentionally omitted — + # see is_web_search_tool for the Cowork rationale. if block_type == "tool_use" and block_name in ( LITELLM_WEB_SEARCH_TOOL_NAME, - "WebSearch", "web_search", ): # Convert to dict for easier handling @@ -190,10 +193,12 @@ class WebSearchTransformation: getattr(function, "arguments", None) if function else None ) - # Check for LiteLLM standard or legacy web search tools + # Detect function-style web search tool_calls. ``WebSearch`` is + # intentionally omitted — see is_web_search_tool for the Cowork + # rationale (clients ship their own client-side ``WebSearch`` and + # we must not hijack it). if tool_type == "function" and function_name in ( LITELLM_WEB_SEARCH_TOOL_NAME, - "WebSearch", "web_search", ): # Parse arguments (might be JSON string) @@ -350,6 +355,57 @@ class WebSearchTransformation: return assistant_message, tool_messages + @staticmethod + def build_web_search_tool_result_block( + tool_use_id: str, + search_response: Optional[SearchResponse], + ) -> Dict[str, Any]: + """ + Build an Anthropic-native ``web_search_tool_result`` content block. + + Native Anthropic clients (Claude Desktop, the Anthropic SDK, the + Anthropic Console) expect search-tool results to be returned as + structured ``web_search_tool_result`` blocks so that citations and + source links can be rendered. The agentic loop currently feeds the + model a flat text blob in the follow-up call (which is correct — the + model needs readable evidence). This helper produces the *additional* + block that should accompany the model's text reply when the original + request used a native ``web_search_*`` tool. + + Spec reference: + https://docs.anthropic.com/en/api/web-search-tool + + Args: + tool_use_id: The ``tool_use_id`` the model emitted on the first + turn. Must match exactly so the client can pair the result + with its tool_use block. + search_response: Structured ``SearchResponse`` from + ``litellm.asearch()``. If None or empty, the block is still + emitted with an empty result list (signals "search ran, no + results" rather than "search did not run"). + """ + items: List[Dict[str, Any]] = [] + if search_response is not None: + results = getattr(search_response, "results", None) or [] + for r in results: + url = getattr(r, "url", "") or "" + title = getattr(r, "title", "") or "" + page_age = getattr(r, "date", None) or getattr(r, "last_updated", None) + items.append( + { + "type": "web_search_result", + "url": url, + "title": title, + "page_age": page_age, + "encrypted_content": "", + } + ) + return { + "type": "web_search_tool_result", + "tool_use_id": tool_use_id, + "content": items, + } + @staticmethod def format_search_response(result: SearchResponse) -> str: """ diff --git a/litellm/interactions/__init__.py b/litellm/interactions/__init__.py index e1125b649a6..ed01462cba6 100644 --- a/litellm/interactions/__init__.py +++ b/litellm/interactions/__init__.py @@ -5,31 +5,40 @@ This module provides SDK methods for Google's Interactions API. Usage: import litellm - + # Create an interaction with a model response = litellm.interactions.create( model="gemini-2.5-flash", input="Hello, how are you?" ) - + # Create an interaction with an agent response = litellm.interactions.create( agent="deep-research-pro-preview-12-2025", input="Research the current state of cancer research" ) - + # Async version response = await litellm.interactions.acreate(...) - + # Get an interaction response = litellm.interactions.get(interaction_id="...") - + # Delete an interaction result = litellm.interactions.delete(interaction_id="...") - + # Cancel an interaction result = litellm.interactions.cancel(interaction_id="...") + # Create a managed agent on the provider side + result = litellm.interactions.agents.create( + name="waverunner", + custom_llm_provider="gemini", + api_key="...", + base_agent="gemini-2.5-flash", + instructions="You are a helpful assistant.", + ) + Methods: - create(): Sync create interaction - acreate(): Async create interaction @@ -39,8 +48,12 @@ Methods: - adelete(): Async delete interaction - cancel(): Sync cancel interaction - acancel(): Async cancel interaction + +Sub-modules: +- agents: Provider-side agent creation (litellm.interactions.agents.create) """ +from litellm.interactions import agents from litellm.interactions.main import ( acancel, acreate, @@ -65,4 +78,6 @@ __all__ = [ # Cancel "cancel", "acancel", + # Sub-modules + "agents", ] diff --git a/litellm/interactions/agents/__init__.py b/litellm/interactions/agents/__init__.py new file mode 100644 index 00000000000..711a54fdcbb --- /dev/null +++ b/litellm/interactions/agents/__init__.py @@ -0,0 +1,39 @@ +""" +litellm.interactions.agents + +Full CRUD SDK for provider-side managed agents (e.g. Gemini v1beta/agents). + + litellm.interactions.agents.create(name=..., ...) + litellm.interactions.agents.list(api_key=...) + litellm.interactions.agents.get(name=..., ...) + litellm.interactions.agents.delete(name=..., ...) + litellm.interactions.agents.list_versions(name=..., ...) + +Async counterparts: acreate, alist, aget, adelete, alist_versions +""" + +from litellm.interactions.agents.main import ( + acreate, + adelete, + aget, + alist, + alist_versions, + create, + delete, + get, + list, + list_versions, +) + +__all__ = [ + "create", + "acreate", + "list", + "alist", + "get", + "aget", + "delete", + "adelete", + "list_versions", + "alist_versions", +] diff --git a/litellm/interactions/agents/http_handler.py b/litellm/interactions/agents/http_handler.py new file mode 100644 index 00000000000..d45ca6f4346 --- /dev/null +++ b/litellm/interactions/agents/http_handler.py @@ -0,0 +1,478 @@ +""" +HTTP handler for the Agents API. + +Extends InteractionsHTTPHandler so that the shared HTTP infrastructure +(_handle_error, _sync_client, _async_client) is reused rather than +duplicated. BaseAgentsAPIConfig stays as pure transform code. +""" + +from typing import Any, Coroutine, Dict, Optional, Union + +import httpx + +from litellm.constants import request_timeout +from litellm.interactions.http_handler import InteractionsHTTPHandler +from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj +from litellm.llms.base_llm.agents.transformation import BaseAgentsAPIConfig +from litellm.llms.custom_httpx.http_handler import AsyncHTTPHandler, HTTPHandler +from litellm.types.agents import ( + AgentCreateResponse, + AgentDeleteResult, + AgentListResponse, + AgentVersionsResponse, +) +from litellm.types.router import GenericLiteLLMParams + + +class AgentsHTTPHandler(InteractionsHTTPHandler): + """HTTP handler for Agents API CRUD requests.""" + + # ------------------------------------------------------------------ # + # CREATE # + # ------------------------------------------------------------------ # + + def create_agent( + self, + agents_api_config: BaseAgentsAPIConfig, + name: str, + litellm_params: GenericLiteLLMParams, + logging_obj: LiteLLMLoggingObj, + extra_headers: Optional[Dict[str, Any]] = None, + extra_body: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + client: Optional[HTTPHandler] = None, + _is_async: bool = False, + ) -> Union[AgentCreateResponse, Coroutine[Any, Any, AgentCreateResponse]]: + if _is_async: + return self.async_create_agent( + agents_api_config=agents_api_config, + name=name, + litellm_params=litellm_params, + logging_obj=logging_obj, + extra_headers=extra_headers, + extra_body=extra_body, + timeout=timeout, + ) + + sync_httpx_client = self._sync_client(litellm_params, client) + headers = agents_api_config.validate_environment( + headers=extra_headers or {}, litellm_params=dict(litellm_params) + ) + url = agents_api_config.get_complete_url( + api_base=litellm_params.get("api_base"), + litellm_params=dict(litellm_params), + ) + data = agents_api_config.transform_create_request( + name=name, litellm_params=dict(litellm_params) + ) + if extra_body: + data.update(extra_body) + + logging_obj.pre_call( + input=name, + api_key="", + additional_args={ + "complete_input_dict": data, + "api_base": url, + "headers": headers, + }, + ) + try: + response = sync_httpx_client.post( + url=url, headers=headers, json=data, timeout=timeout or request_timeout + ) + except Exception as e: + raise self._handle_error(e=e, provider_config=agents_api_config) + + logging_obj.post_call( + original_response=response.text, + additional_args={"complete_input_dict": data}, + ) + return agents_api_config.transform_create_response( + raw_response=response, name=name + ) + + async def async_create_agent( + self, + agents_api_config: BaseAgentsAPIConfig, + name: str, + litellm_params: GenericLiteLLMParams, + logging_obj: LiteLLMLoggingObj, + extra_headers: Optional[Dict[str, Any]] = None, + extra_body: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + client: Optional[AsyncHTTPHandler] = None, + ) -> AgentCreateResponse: + async_httpx_client = self._async_client(litellm_params, client) + headers = agents_api_config.validate_environment( + headers=extra_headers or {}, litellm_params=dict(litellm_params) + ) + url = agents_api_config.get_complete_url( + api_base=litellm_params.get("api_base"), + litellm_params=dict(litellm_params), + ) + data = agents_api_config.transform_create_request( + name=name, litellm_params=dict(litellm_params) + ) + if extra_body: + data.update(extra_body) + + logging_obj.pre_call( + input=name, + api_key="", + additional_args={ + "complete_input_dict": data, + "api_base": url, + "headers": headers, + }, + ) + try: + response = await async_httpx_client.post( + url=url, headers=headers, json=data, timeout=timeout or request_timeout + ) + except Exception as e: + raise self._handle_error(e=e, provider_config=agents_api_config) + + logging_obj.post_call( + original_response=response.text, + additional_args={"complete_input_dict": data}, + ) + return agents_api_config.transform_create_response( + raw_response=response, name=name + ) + + # ------------------------------------------------------------------ # + # LIST # + # ------------------------------------------------------------------ # + + def list_agents( + self, + agents_api_config: BaseAgentsAPIConfig, + litellm_params: GenericLiteLLMParams, + logging_obj: LiteLLMLoggingObj, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + client: Optional[HTTPHandler] = None, + _is_async: bool = False, + ) -> Union[AgentListResponse, Coroutine[Any, Any, AgentListResponse]]: + if _is_async: + return self.async_list_agents( + agents_api_config=agents_api_config, + litellm_params=litellm_params, + logging_obj=logging_obj, + extra_headers=extra_headers, + timeout=timeout, + ) + + sync_httpx_client = self._sync_client(litellm_params, client) + headers = agents_api_config.validate_environment( + headers=extra_headers or {}, litellm_params=dict(litellm_params) + ) + url, params = agents_api_config.transform_list_request( + api_base=litellm_params.get("api_base"), + litellm_params=dict(litellm_params), + ) + logging_obj.pre_call( + input="list_agents", + api_key="", + additional_args={"api_base": url, "headers": headers}, + ) + try: + response = sync_httpx_client.get(url=url, headers=headers, params=params) + except Exception as e: + raise self._handle_error(e=e, provider_config=agents_api_config) + + logging_obj.post_call(original_response=response.text, additional_args={}) + return agents_api_config.transform_list_response(raw_response=response) + + async def async_list_agents( + self, + agents_api_config: BaseAgentsAPIConfig, + litellm_params: GenericLiteLLMParams, + logging_obj: LiteLLMLoggingObj, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + client: Optional[AsyncHTTPHandler] = None, + ) -> AgentListResponse: + async_httpx_client = self._async_client(litellm_params, client) + headers = agents_api_config.validate_environment( + headers=extra_headers or {}, litellm_params=dict(litellm_params) + ) + url, params = agents_api_config.transform_list_request( + api_base=litellm_params.get("api_base"), + litellm_params=dict(litellm_params), + ) + logging_obj.pre_call( + input="list_agents", + api_key="", + additional_args={"api_base": url, "headers": headers}, + ) + try: + response = await async_httpx_client.get( + url=url, headers=headers, params=params + ) + except Exception as e: + raise self._handle_error(e=e, provider_config=agents_api_config) + + logging_obj.post_call(original_response=response.text, additional_args={}) + return agents_api_config.transform_list_response(raw_response=response) + + # ------------------------------------------------------------------ # + # GET # + # ------------------------------------------------------------------ # + + def get_agent( + self, + agents_api_config: BaseAgentsAPIConfig, + name: str, + litellm_params: GenericLiteLLMParams, + logging_obj: LiteLLMLoggingObj, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + client: Optional[HTTPHandler] = None, + _is_async: bool = False, + ) -> Union[AgentCreateResponse, Coroutine[Any, Any, AgentCreateResponse]]: + if _is_async: + return self.async_get_agent( + agents_api_config=agents_api_config, + name=name, + litellm_params=litellm_params, + logging_obj=logging_obj, + extra_headers=extra_headers, + timeout=timeout, + ) + + sync_httpx_client = self._sync_client(litellm_params, client) + headers = agents_api_config.validate_environment( + headers=extra_headers or {}, litellm_params=dict(litellm_params) + ) + url, params = agents_api_config.transform_get_request( + name=name, + api_base=litellm_params.get("api_base"), + litellm_params=dict(litellm_params), + ) + logging_obj.pre_call( + input=name, + api_key="", + additional_args={"api_base": url, "headers": headers}, + ) + try: + response = sync_httpx_client.get(url=url, headers=headers, params=params) + except Exception as e: + raise self._handle_error(e=e, provider_config=agents_api_config) + + logging_obj.post_call(original_response=response.text, additional_args={}) + return agents_api_config.transform_get_response( + raw_response=response, name=name + ) + + async def async_get_agent( + self, + agents_api_config: BaseAgentsAPIConfig, + name: str, + litellm_params: GenericLiteLLMParams, + logging_obj: LiteLLMLoggingObj, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + client: Optional[AsyncHTTPHandler] = None, + ) -> AgentCreateResponse: + async_httpx_client = self._async_client(litellm_params, client) + headers = agents_api_config.validate_environment( + headers=extra_headers or {}, litellm_params=dict(litellm_params) + ) + url, params = agents_api_config.transform_get_request( + name=name, + api_base=litellm_params.get("api_base"), + litellm_params=dict(litellm_params), + ) + logging_obj.pre_call( + input=name, + api_key="", + additional_args={"api_base": url, "headers": headers}, + ) + try: + response = await async_httpx_client.get( + url=url, headers=headers, params=params + ) + except Exception as e: + raise self._handle_error(e=e, provider_config=agents_api_config) + + logging_obj.post_call(original_response=response.text, additional_args={}) + return agents_api_config.transform_get_response( + raw_response=response, name=name + ) + + # ------------------------------------------------------------------ # + # DELETE # + # ------------------------------------------------------------------ # + + def delete_agent( + self, + agents_api_config: BaseAgentsAPIConfig, + name: str, + litellm_params: GenericLiteLLMParams, + logging_obj: LiteLLMLoggingObj, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + client: Optional[HTTPHandler] = None, + _is_async: bool = False, + ) -> Union[AgentDeleteResult, Coroutine[Any, Any, AgentDeleteResult]]: + if _is_async: + return self.async_delete_agent( + agents_api_config=agents_api_config, + name=name, + litellm_params=litellm_params, + logging_obj=logging_obj, + extra_headers=extra_headers, + timeout=timeout, + ) + + sync_httpx_client = self._sync_client(litellm_params, client) + headers = agents_api_config.validate_environment( + headers=extra_headers or {}, litellm_params=dict(litellm_params) + ) + url = agents_api_config.transform_delete_request( + name=name, + api_base=litellm_params.get("api_base"), + litellm_params=dict(litellm_params), + ) + logging_obj.pre_call( + input=name, + api_key="", + additional_args={"api_base": url, "headers": headers}, + ) + try: + response = sync_httpx_client.delete( + url=url, headers=headers, timeout=timeout or request_timeout + ) + except Exception as e: + raise self._handle_error(e=e, provider_config=agents_api_config) + + logging_obj.post_call(original_response=response.text, additional_args={}) + return agents_api_config.transform_delete_response( + raw_response=response, name=name + ) + + async def async_delete_agent( + self, + agents_api_config: BaseAgentsAPIConfig, + name: str, + litellm_params: GenericLiteLLMParams, + logging_obj: LiteLLMLoggingObj, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + client: Optional[AsyncHTTPHandler] = None, + ) -> AgentDeleteResult: + async_httpx_client = self._async_client(litellm_params, client) + headers = agents_api_config.validate_environment( + headers=extra_headers or {}, litellm_params=dict(litellm_params) + ) + url = agents_api_config.transform_delete_request( + name=name, + api_base=litellm_params.get("api_base"), + litellm_params=dict(litellm_params), + ) + logging_obj.pre_call( + input=name, + api_key="", + additional_args={"api_base": url, "headers": headers}, + ) + try: + response = await async_httpx_client.delete( + url=url, headers=headers, timeout=timeout or request_timeout + ) + except Exception as e: + raise self._handle_error(e=e, provider_config=agents_api_config) + + logging_obj.post_call(original_response=response.text, additional_args={}) + return agents_api_config.transform_delete_response( + raw_response=response, name=name + ) + + # ------------------------------------------------------------------ # + # LIST VERSIONS # + # ------------------------------------------------------------------ # + + def list_agent_versions( + self, + agents_api_config: BaseAgentsAPIConfig, + name: str, + litellm_params: GenericLiteLLMParams, + logging_obj: LiteLLMLoggingObj, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + client: Optional[HTTPHandler] = None, + _is_async: bool = False, + ) -> Union[AgentVersionsResponse, Coroutine[Any, Any, AgentVersionsResponse]]: + if _is_async: + return self.async_list_agent_versions( + agents_api_config=agents_api_config, + name=name, + litellm_params=litellm_params, + logging_obj=logging_obj, + extra_headers=extra_headers, + timeout=timeout, + ) + + sync_httpx_client = self._sync_client(litellm_params, client) + headers = agents_api_config.validate_environment( + headers=extra_headers or {}, litellm_params=dict(litellm_params) + ) + url, params = agents_api_config.transform_list_versions_request( + name=name, + api_base=litellm_params.get("api_base"), + litellm_params=dict(litellm_params), + ) + logging_obj.pre_call( + input=name, + api_key="", + additional_args={"api_base": url, "headers": headers}, + ) + try: + response = sync_httpx_client.get(url=url, headers=headers, params=params) + except Exception as e: + raise self._handle_error(e=e, provider_config=agents_api_config) + + logging_obj.post_call(original_response=response.text, additional_args={}) + return agents_api_config.transform_list_versions_response( + raw_response=response, name=name + ) + + async def async_list_agent_versions( + self, + agents_api_config: BaseAgentsAPIConfig, + name: str, + litellm_params: GenericLiteLLMParams, + logging_obj: LiteLLMLoggingObj, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + client: Optional[AsyncHTTPHandler] = None, + ) -> AgentVersionsResponse: + async_httpx_client = self._async_client(litellm_params, client) + headers = agents_api_config.validate_environment( + headers=extra_headers or {}, litellm_params=dict(litellm_params) + ) + url, params = agents_api_config.transform_list_versions_request( + name=name, + api_base=litellm_params.get("api_base"), + litellm_params=dict(litellm_params), + ) + logging_obj.pre_call( + input=name, + api_key="", + additional_args={"api_base": url, "headers": headers}, + ) + try: + response = await async_httpx_client.get( + url=url, headers=headers, params=params + ) + except Exception as e: + raise self._handle_error(e=e, provider_config=agents_api_config) + + logging_obj.post_call(original_response=response.text, additional_args={}) + return agents_api_config.transform_list_versions_response( + raw_response=response, name=name + ) + + +agents_http_handler = AgentsHTTPHandler() diff --git a/litellm/interactions/agents/main.py b/litellm/interactions/agents/main.py new file mode 100644 index 00000000000..f56c6f3ed5e --- /dev/null +++ b/litellm/interactions/agents/main.py @@ -0,0 +1,522 @@ +""" +LiteLLM Agents API - Main Module + +Usage: + import litellm + + # Create + response = litellm.interactions.agents.create( + name="waverunner", + custom_llm_provider="gemini", + api_key="...", + base_agent="gemini-2.5-flash", + instructions="You are a helpful assistant.", + ) + + # List + response = litellm.interactions.agents.list(api_key="...", custom_llm_provider="gemini") + + # Get + response = litellm.interactions.agents.get(name="waverunner", api_key="...") + + # Delete + result = litellm.interactions.agents.delete(name="waverunner", api_key="...") + + # List versions + result = litellm.interactions.agents.list_versions(name="waverunner", api_key="...") + + # Async versions: acreate, alist, aget, adelete, alist_versions +""" + +import asyncio +import contextvars +from functools import partial +from typing import Any, Coroutine, Dict, Optional, Union + +import httpx + +import litellm +from litellm.interactions.agents.http_handler import agents_http_handler +from litellm.interactions.agents.utils import get_provider_agents_api_config +from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj +from litellm.types.agents import ( + AgentCreateResponse, + AgentDeleteResult, + AgentListResponse, + AgentVersionsResponse, +) +from litellm.types.interactions import InteractionEnvironment +from litellm.types.router import GenericLiteLLMParams +from litellm.utils import client + +# ------------------------------------------------------------------ # +# Shared helpers # +# ------------------------------------------------------------------ # + + +def _get_agents_api_config(custom_llm_provider: str): + config = get_provider_agents_api_config(custom_llm_provider) + if config is None: + raise litellm.BadRequestError( + message=( + f"Provider '{custom_llm_provider}' does not have a native " + "agents API. Use the proxy POST /v1/agents endpoint to store " + "agents locally." + ), + model="", + llm_provider=custom_llm_provider, + ) + return config + + +def _make_logging_obj( + kwargs: Dict[str, Any], + model: str, + custom_llm_provider: str, + call_type: str, + optional_params: Dict[str, Any], +) -> LiteLLMLoggingObj: + litellm_logging_obj: LiteLLMLoggingObj = kwargs.get("litellm_logging_obj") # type: ignore + litellm_call_id: Optional[str] = kwargs.get("litellm_call_id", None) + litellm_logging_obj.update_from_kwargs( + kwargs=kwargs, + model=model, + optional_params=optional_params, + litellm_params={"litellm_call_id": litellm_call_id}, + custom_llm_provider=custom_llm_provider, + ) + return litellm_logging_obj + + +# ================================================================== # +# CREATE # +# ================================================================== # + + +@client +async def acreate( + name: str, + base_agent: Optional[str] = None, + instructions: Optional[str] = None, + base_environment: Optional[InteractionEnvironment] = None, + custom_llm_provider: Optional[str] = None, + extra_headers: Optional[Dict[str, Any]] = None, + extra_body: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + **kwargs, +) -> AgentCreateResponse: + """Async: Create a managed agent on the provider side.""" + local_vars = locals() + try: + loop = asyncio.get_event_loop() + kwargs["acreate_agent"] = True + func = partial( + create, + name=name, + base_agent=base_agent, + instructions=instructions, + base_environment=base_environment, + custom_llm_provider=custom_llm_provider or "gemini", + extra_headers=extra_headers, + extra_body=extra_body, + timeout=timeout, + **kwargs, + ) + ctx = contextvars.copy_context() + init_response = await loop.run_in_executor(None, partial(ctx.run, func)) + if asyncio.iscoroutine(init_response): + return await init_response + return init_response + except Exception as e: + raise litellm.exception_type( + model=name, + custom_llm_provider=custom_llm_provider or "gemini", + original_exception=e, + completion_kwargs=local_vars, + extra_kwargs=kwargs, + ) + + +@client +def create( + name: str, + base_agent: Optional[str] = None, + instructions: Optional[str] = None, + base_environment: Optional[InteractionEnvironment] = None, + custom_llm_provider: Optional[str] = None, + extra_headers: Optional[Dict[str, Any]] = None, + extra_body: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + **kwargs, +) -> Union[AgentCreateResponse, Coroutine[Any, Any, AgentCreateResponse]]: + """ + Sync: Create a managed agent on the provider side. + + Args: + name: Name for the agent (required). + base_agent: Base agent to derive from (e.g. "waverunner"). + instructions: System instructions for the agent. + base_environment: Environment to fork from — an env_id string or a + dict like ``{"type": "remote", "sources": [...]}``. + custom_llm_provider: Provider to use, e.g. "gemini". + extra_headers: Additional HTTP headers. + extra_body: Additional request body fields. + timeout: Request timeout. + **kwargs: Forwarded to GenericLiteLLMParams (api_key, api_base, etc.). + """ + local_vars = locals() + custom_llm_provider = ( + custom_llm_provider or kwargs.get("custom_llm_provider") or "gemini" + ) + try: + _is_async = kwargs.pop("acreate_agent", False) is True + if base_agent is not None: + kwargs["base_agent"] = base_agent + if instructions is not None: + kwargs["instructions"] = instructions + if base_environment is not None: + kwargs["base_environment"] = base_environment + kwargs.setdefault("custom_llm_provider", custom_llm_provider) + litellm_params = GenericLiteLLMParams(**kwargs) + logging_obj = _make_logging_obj( + kwargs, name, custom_llm_provider, "create_agent", {} + ) + config = _get_agents_api_config(custom_llm_provider) + return agents_http_handler.create_agent( + agents_api_config=config, + name=name, + litellm_params=litellm_params, + logging_obj=logging_obj, + extra_headers=extra_headers, + extra_body=extra_body, + timeout=timeout, + _is_async=_is_async, + ) + except Exception as e: + raise litellm.exception_type( + model=name, + custom_llm_provider=custom_llm_provider, + original_exception=e, + completion_kwargs=local_vars, + extra_kwargs=kwargs, + ) + + +# ================================================================== # +# LIST # +# ================================================================== # + + +@client +async def alist( + custom_llm_provider: Optional[str] = None, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + **kwargs, +) -> AgentListResponse: + """Async: List all agents on the provider side.""" + local_vars = locals() + try: + loop = asyncio.get_event_loop() + kwargs["alist_agents"] = True + func = partial( + list, + custom_llm_provider=custom_llm_provider or "gemini", + extra_headers=extra_headers, + timeout=timeout, + **kwargs, + ) + ctx = contextvars.copy_context() + init_response = await loop.run_in_executor(None, partial(ctx.run, func)) + if asyncio.iscoroutine(init_response): + return await init_response + return init_response + except Exception as e: + raise litellm.exception_type( + model="", + custom_llm_provider=custom_llm_provider or "gemini", + original_exception=e, + completion_kwargs=local_vars, + extra_kwargs=kwargs, + ) + + +@client +def list( + custom_llm_provider: Optional[str] = None, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + **kwargs, +) -> Union[AgentListResponse, Coroutine[Any, Any, AgentListResponse]]: + """Sync: List all agents on the provider side.""" + local_vars = locals() + custom_llm_provider = ( + custom_llm_provider or kwargs.get("custom_llm_provider") or "gemini" + ) + try: + _is_async = kwargs.pop("alist_agents", False) is True + kwargs.setdefault("custom_llm_provider", custom_llm_provider) + litellm_params = GenericLiteLLMParams(**kwargs) + logging_obj = _make_logging_obj( + kwargs, "", custom_llm_provider, "list_agents", {} + ) + config = _get_agents_api_config(custom_llm_provider) + return agents_http_handler.list_agents( + agents_api_config=config, + litellm_params=litellm_params, + logging_obj=logging_obj, + extra_headers=extra_headers, + timeout=timeout, + _is_async=_is_async, + ) + except Exception as e: + raise litellm.exception_type( + model="", + custom_llm_provider=custom_llm_provider, + original_exception=e, + completion_kwargs=local_vars, + extra_kwargs=kwargs, + ) + + +# ================================================================== # +# GET # +# ================================================================== # + + +@client +async def aget( + name: str, + custom_llm_provider: Optional[str] = None, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + **kwargs, +) -> AgentCreateResponse: + """Async: Get a specific agent by name.""" + local_vars = locals() + try: + loop = asyncio.get_event_loop() + kwargs["aget_agent"] = True + func = partial( + get, + name=name, + custom_llm_provider=custom_llm_provider or "gemini", + extra_headers=extra_headers, + timeout=timeout, + **kwargs, + ) + ctx = contextvars.copy_context() + init_response = await loop.run_in_executor(None, partial(ctx.run, func)) + if asyncio.iscoroutine(init_response): + return await init_response + return init_response + except Exception as e: + raise litellm.exception_type( + model=name, + custom_llm_provider=custom_llm_provider or "gemini", + original_exception=e, + completion_kwargs=local_vars, + extra_kwargs=kwargs, + ) + + +@client +def get( + name: str, + custom_llm_provider: Optional[str] = None, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + **kwargs, +) -> Union[AgentCreateResponse, Coroutine[Any, Any, AgentCreateResponse]]: + """Sync: Get a specific agent by name.""" + local_vars = locals() + custom_llm_provider = ( + custom_llm_provider or kwargs.get("custom_llm_provider") or "gemini" + ) + try: + _is_async = kwargs.pop("aget_agent", False) is True + kwargs.setdefault("custom_llm_provider", custom_llm_provider) + litellm_params = GenericLiteLLMParams(**kwargs) + logging_obj = _make_logging_obj( + kwargs, name, custom_llm_provider, "get_agent", {"name": name} + ) + config = _get_agents_api_config(custom_llm_provider) + return agents_http_handler.get_agent( + agents_api_config=config, + name=name, + litellm_params=litellm_params, + logging_obj=logging_obj, + extra_headers=extra_headers, + timeout=timeout, + _is_async=_is_async, + ) + except Exception as e: + raise litellm.exception_type( + model=name, + custom_llm_provider=custom_llm_provider, + original_exception=e, + completion_kwargs=local_vars, + extra_kwargs=kwargs, + ) + + +# ================================================================== # +# DELETE # +# ================================================================== # + + +@client +async def adelete( + name: str, + custom_llm_provider: Optional[str] = None, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + **kwargs, +) -> AgentDeleteResult: + """Async: Delete a specific agent by name.""" + local_vars = locals() + try: + loop = asyncio.get_event_loop() + kwargs["adelete_agent"] = True + func = partial( + delete, + name=name, + custom_llm_provider=custom_llm_provider or "gemini", + extra_headers=extra_headers, + timeout=timeout, + **kwargs, + ) + ctx = contextvars.copy_context() + init_response = await loop.run_in_executor(None, partial(ctx.run, func)) + if asyncio.iscoroutine(init_response): + return await init_response + return init_response + except Exception as e: + raise litellm.exception_type( + model=name, + custom_llm_provider=custom_llm_provider or "gemini", + original_exception=e, + completion_kwargs=local_vars, + extra_kwargs=kwargs, + ) + + +@client +def delete( + name: str, + custom_llm_provider: Optional[str] = None, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + **kwargs, +) -> Union[AgentDeleteResult, Coroutine[Any, Any, AgentDeleteResult]]: + """Sync: Delete a specific agent by name.""" + local_vars = locals() + custom_llm_provider = ( + custom_llm_provider or kwargs.get("custom_llm_provider") or "gemini" + ) + try: + _is_async = kwargs.pop("adelete_agent", False) is True + kwargs.setdefault("custom_llm_provider", custom_llm_provider) + litellm_params = GenericLiteLLMParams(**kwargs) + logging_obj = _make_logging_obj( + kwargs, name, custom_llm_provider, "delete_agent", {"name": name} + ) + config = _get_agents_api_config(custom_llm_provider) + return agents_http_handler.delete_agent( + agents_api_config=config, + name=name, + litellm_params=litellm_params, + logging_obj=logging_obj, + extra_headers=extra_headers, + timeout=timeout, + _is_async=_is_async, + ) + except Exception as e: + raise litellm.exception_type( + model=name, + custom_llm_provider=custom_llm_provider, + original_exception=e, + completion_kwargs=local_vars, + extra_kwargs=kwargs, + ) + + +# ================================================================== # +# LIST VERSIONS # +# ================================================================== # + + +@client +async def alist_versions( + name: str, + custom_llm_provider: Optional[str] = None, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + **kwargs, +) -> AgentVersionsResponse: + """Async: List versions of a specific agent.""" + local_vars = locals() + try: + loop = asyncio.get_event_loop() + kwargs["alist_agent_versions"] = True + func = partial( + list_versions, + name=name, + custom_llm_provider=custom_llm_provider or "gemini", + extra_headers=extra_headers, + timeout=timeout, + **kwargs, + ) + ctx = contextvars.copy_context() + init_response = await loop.run_in_executor(None, partial(ctx.run, func)) + if asyncio.iscoroutine(init_response): + return await init_response + return init_response + except Exception as e: + raise litellm.exception_type( + model=name, + custom_llm_provider=custom_llm_provider or "gemini", + original_exception=e, + completion_kwargs=local_vars, + extra_kwargs=kwargs, + ) + + +@client +def list_versions( + name: str, + custom_llm_provider: Optional[str] = None, + extra_headers: Optional[Dict[str, Any]] = None, + timeout: Optional[Union[float, httpx.Timeout]] = None, + **kwargs, +) -> Union[AgentVersionsResponse, Coroutine[Any, Any, AgentVersionsResponse]]: + """Sync: List versions of a specific agent.""" + local_vars = locals() + custom_llm_provider = ( + custom_llm_provider or kwargs.get("custom_llm_provider") or "gemini" + ) + try: + _is_async = kwargs.pop("alist_agent_versions", False) is True + kwargs.setdefault("custom_llm_provider", custom_llm_provider) + litellm_params = GenericLiteLLMParams(**kwargs) + logging_obj = _make_logging_obj( + kwargs, name, custom_llm_provider, "list_agent_versions", {"name": name} + ) + config = _get_agents_api_config(custom_llm_provider) + return agents_http_handler.list_agent_versions( + agents_api_config=config, + name=name, + litellm_params=litellm_params, + logging_obj=logging_obj, + extra_headers=extra_headers, + timeout=timeout, + _is_async=_is_async, + ) + except Exception as e: + raise litellm.exception_type( + model=name, + custom_llm_provider=custom_llm_provider, + original_exception=e, + completion_kwargs=local_vars, + extra_kwargs=kwargs, + ) diff --git a/litellm/interactions/agents/utils.py b/litellm/interactions/agents/utils.py new file mode 100644 index 00000000000..d16a9597f53 --- /dev/null +++ b/litellm/interactions/agents/utils.py @@ -0,0 +1,23 @@ +""" +Utility functions for the Agents API SDK. +""" + +from typing import Optional + +from litellm.llms.base_llm.agents.transformation import BaseAgentsAPIConfig + + +def get_provider_agents_api_config( + custom_llm_provider: Optional[str], +) -> Optional[BaseAgentsAPIConfig]: + """ + Return a provider-specific BaseAgentsAPIConfig if the provider has a + native agent-creation API, or None otherwise. + """ + from litellm.types.utils import LlmProviders + + if custom_llm_provider == LlmProviders.GEMINI.value: + from litellm.llms.gemini.agents.transformation import GeminiAgentsConfig + + return GeminiAgentsConfig() + return None diff --git a/litellm/interactions/http_handler.py b/litellm/interactions/http_handler.py index 7fead07043f..695da2be89a 100644 --- a/litellm/interactions/http_handler.py +++ b/litellm/interactions/http_handler.py @@ -41,27 +41,55 @@ from litellm.types.interactions import ( from litellm.types.router import GenericLiteLLMParams -class InteractionsHTTPHandler: +class _BaseHTTPHandler: + """ + Shared HTTP infrastructure for LiteLLM handler classes. + + Provides common client resolution and error-mapping helpers so that + handler subclasses (InteractionsHTTPHandler, AgentsHTTPHandler, …) do + not duplicate this boilerplate. + """ + + def _handle_error(self, e: Exception, provider_config: Any) -> Exception: + if isinstance(e, httpx.HTTPStatusError): + return provider_config.get_error_class( + error_message=e.response.text, + status_code=e.response.status_code, + headers=dict(e.response.headers), + ) + return e + + def _sync_client( + self, + litellm_params: GenericLiteLLMParams, + client: Optional[HTTPHandler], + ) -> HTTPHandler: + return client or _get_httpx_client( + params={"ssl_verify": litellm_params.get("ssl_verify", None)} + ) + + def _async_client( + self, + litellm_params: GenericLiteLLMParams, + client: Optional[AsyncHTTPHandler], + ) -> AsyncHTTPHandler: + # GenericLiteLLMParams.get uses getattr; an unset field is None, not the default. + custom_llm_provider = litellm_params.get("custom_llm_provider") or "gemini" + return client or get_async_httpx_client( + llm_provider=litellm.LlmProviders(custom_llm_provider), + params={"ssl_verify": litellm_params.get("ssl_verify", None)}, + ) + + +class InteractionsHTTPHandler(_BaseHTTPHandler): """ HTTP handler for Interactions API requests. """ - def _handle_error( - self, - e: Exception, - provider_config: BaseInteractionsAPIConfig, - ) -> Exception: - """Handle errors from HTTP requests.""" - if isinstance(e, httpx.HTTPStatusError): - error_message = e.response.text - status_code = e.response.status_code - headers = dict(e.response.headers) - return provider_config.get_error_class( - error_message=error_message, - status_code=status_code, - headers=headers, - ) - return e + # _handle_error is inherited from _BaseHTTPHandler (accepts Any provider_config). + # AgentsHTTPHandler also extends this class and passes BaseAgentsAPIConfig, which + # is structurally compatible but a different type — keeping the override here with + # BaseInteractionsAPIConfig would cause type errors in the subclass. # ========================================================= # CREATE INTERACTION diff --git a/litellm/interactions/litellm_responses_transformation/streaming_iterator.py b/litellm/interactions/litellm_responses_transformation/streaming_iterator.py index 72a3afbc3c5..4a3eb63084e 100644 --- a/litellm/interactions/litellm_responses_transformation/streaming_iterator.py +++ b/litellm/interactions/litellm_responses_transformation/streaming_iterator.py @@ -2,7 +2,17 @@ Streaming iterator for transforming Responses API stream to Interactions API stream. """ -from typing import Any, AsyncIterator, Dict, Iterator, Optional, cast +from collections import deque +from typing import ( + Any, + AsyncIterator, + Deque, + Dict, + Iterator, + List, + Optional, + cast, +) from litellm.responses.streaming_iterator import ( BaseResponsesAPIStreamingIterator, @@ -29,7 +39,13 @@ class LiteLLMResponsesInteractionsStreamingIterator: This class handles both sync and async iteration, transforming Responses API streaming events (output.text.delta, response.completed, etc.) to Interactions - API streaming events (content.delta, interaction.complete, etc.). + API streaming events. + + Schema selection: + - New schema (default, use_legacy_interactions_schema=False): + interaction.created -> step.start -> step.delta ... -> step.stop -> interaction.completed + - Legacy schema (use_legacy_interactions_schema=True, remove after June 8 2026): + interaction.start -> content.start -> content.delta ... -> content.stop -> interaction.complete """ def __init__( @@ -41,6 +57,8 @@ class LiteLLMResponsesInteractionsStreamingIterator: custom_llm_provider: Optional[str] = None, litellm_metadata: Optional[Dict[str, Any]] = None, ): + import litellm + self.model = model self.responses_stream_iterator = litellm_custom_stream_wrapper self.request_input = request_input @@ -51,66 +69,156 @@ class LiteLLMResponsesInteractionsStreamingIterator: self.collected_text = "" self.sent_interaction_start = False self.sent_content_start = False + # Capture the schema flag once at construction time so all events + # emitted by this stream use a consistent schema, even if the global + # flag is mutated mid-stream (e.g. by a config reload). + self._use_legacy: bool = litellm.use_legacy_interactions_schema + # Buffer of events that have been derived from upstream chunks but not + # yet returned to the caller. A single Responses API chunk may expand + # into multiple Interactions API events (e.g. the first text delta + # produces interaction.created + step.start + step.delta), and the + # terminal sequence on stream end may also span multiple events + # (step.stop + interaction.completed). + self._pending_events: Deque[InteractionsAPIStreamingResponse] = deque() + # Tracks whether we've already emitted a terminal completion event so + # the StopIteration fallback path doesn't double-emit. + self._sent_completion_event = False + # ID resolved from the first upstream chunk (item_id on a text delta or + # response.id on response.created). Persisted so the EOF terminal + # events stay correlated with the start events delivered earlier. + self._interaction_id: Optional[str] = None - def _transform_responses_chunk_to_interactions_chunk( - self, - responses_chunk: ResponsesAPIStreamingResponse, - ) -> Optional[InteractionsAPIStreamingResponse]: + # ------------------------------------------------------------------ + # Event builders + # ------------------------------------------------------------------ + + def _build_interaction_start_event( + self, interaction_id: str + ) -> InteractionsAPIStreamingResponse: + event_type = "interaction.start" if self._use_legacy else "interaction.created" + return InteractionsAPIStreamingResponse( + event_type=event_type, + id=interaction_id, + object="interaction", + status="in_progress", + model=self.model, + ) + + def _build_content_start_event( + self, interaction_id: str + ) -> InteractionsAPIStreamingResponse: + if self._use_legacy: + return InteractionsAPIStreamingResponse( + event_type="content.start", + id=interaction_id, + object="content", + delta={"type": "text", "text": ""}, + ) + return InteractionsAPIStreamingResponse( + event_type="step.start", + index=0, + step={"type": "model_output", "content": []}, + ) + + def _build_text_delta_event( + self, interaction_id: str, delta_text: str + ) -> InteractionsAPIStreamingResponse: + if self._use_legacy: + return InteractionsAPIStreamingResponse( + event_type="content.delta", + id=interaction_id, + object="content", + delta={"type": "text", "text": delta_text}, + ) + return InteractionsAPIStreamingResponse( + event_type="step.delta", + index=0, + delta={"type": "text", "text": delta_text}, + ) + + def _build_content_stop_event( + self, interaction_id: Optional[str] + ) -> InteractionsAPIStreamingResponse: + if self._use_legacy: + return InteractionsAPIStreamingResponse( + event_type="content.stop", + id=interaction_id, + object="content", + delta={"type": "text", "text": self.collected_text}, + ) + return InteractionsAPIStreamingResponse( + event_type="step.stop", + index=0, + ) + + def _build_completion_event( + self, response_id: str + ) -> InteractionsAPIStreamingResponse: + if self._use_legacy: + return InteractionsAPIStreamingResponse( + event_type="interaction.complete", + id=response_id, + object="interaction", + status="completed", + model=self.model, + outputs=[{"type": "text", "text": self.collected_text}], + ) + return InteractionsAPIStreamingResponse( + event_type="interaction.completed", + id=response_id, + object="interaction", + status="completed", + model=self.model, + steps=[ + { + "type": "model_output", + "content": [{"type": "text", "text": self.collected_text}], + } + ], + ) + + # ------------------------------------------------------------------ + # Per-chunk transform (returns a list of events to enqueue) + # ------------------------------------------------------------------ + + def _events_for_chunk( + self, responses_chunk: ResponsesAPIStreamingResponse + ) -> List[InteractionsAPIStreamingResponse]: """ - Transform a Responses API streaming chunk to an Interactions API streaming chunk. + Translate a single upstream Responses API chunk into the list of + Interactions API events it should produce. - Responses API events: - - output.text.delta -> content.delta - - response.completed -> interaction.complete - - Interactions API events: - - interaction.start - - content.start - - content.delta - - content.stop - - interaction.complete + Returning a list (rather than a single event) lets a chunk emit any + synthetic start events that haven't been sent yet *together with* the + actual delta event, so we never silently drop the chunk's payload. """ if not responses_chunk: - return None + return [] - # Handle OutputTextDeltaEvent -> content.delta + # Text delta: emit any missing start events, then the delta itself. if isinstance(responses_chunk, OutputTextDeltaEvent): delta_text = ( responses_chunk.delta if isinstance(responses_chunk.delta, str) else "" ) self.collected_text += delta_text + interaction_id = ( + getattr(responses_chunk, "item_id", None) or f"interaction_{id(self)}" + ) + if self._interaction_id is None: + self._interaction_id = interaction_id - # Send interaction.start if not sent + events: List[InteractionsAPIStreamingResponse] = [] if not self.sent_interaction_start: self.sent_interaction_start = True - return InteractionsAPIStreamingResponse( - event_type="interaction.start", - id=getattr(responses_chunk, "item_id", None) - or f"interaction_{id(self)}", - object="interaction", - status="in_progress", - model=self.model, - ) - - # Send content.start if not sent + events.append(self._build_interaction_start_event(interaction_id)) if not self.sent_content_start: self.sent_content_start = True - return InteractionsAPIStreamingResponse( - event_type="content.start", - id=getattr(responses_chunk, "item_id", None), - object="content", - delta={"type": "text", "text": ""}, - ) + events.append(self._build_content_start_event(interaction_id)) + events.append(self._build_text_delta_event(interaction_id, delta_text)) + return events - # Send content.delta - return InteractionsAPIStreamingResponse( - event_type="content.delta", - id=getattr(responses_chunk, "item_id", None), - object="content", - delta={"text": delta_text}, - ) - - # Handle ResponseCreatedEvent or ResponseInProgressEvent -> interaction.start + # Response created / in-progress: synthesize interaction start if we + # haven't already sent one. if isinstance(responses_chunk, (ResponseCreatedEvent, ResponseInProgressEvent)): if not self.sent_interaction_start: self.sent_interaction_start = True @@ -118,169 +226,136 @@ class LiteLLMResponsesInteractionsStreamingIterator: getattr(responses_chunk.response, "id", None) if hasattr(responses_chunk, "response") else None - ) - return InteractionsAPIStreamingResponse( - event_type="interaction.start", - id=response_id or f"interaction_{id(self)}", - object="interaction", - status="in_progress", - model=self.model, - ) + ) or f"interaction_{id(self)}" + if self._interaction_id is None: + self._interaction_id = response_id + return [self._build_interaction_start_event(response_id)] + return [] - # Handle ResponseCompletedEvent -> interaction.complete + # Response completed: emit step.stop (if content was started) followed + # by the terminal completion event. Prefer the interaction id already + # established by earlier events so consumers can correlate the start + # and completion events by id (response.id may differ from the item_id + # used to derive the initial id when the stream starts directly with a + # text delta). if isinstance(responses_chunk, ResponseCompletedEvent): self.finished = True response = responses_chunk.response - - # Send content.stop first if content was started - if self.sent_content_start: - # Note: We'll send this in the iterator, not here - pass - - # Send interaction.complete - return InteractionsAPIStreamingResponse( - event_type="interaction.complete", - id=getattr(response, "id", None) or f"interaction_{id(self)}", - object="interaction", - status="completed", - model=self.model, - outputs=[ - { - "type": "text", - "text": self.collected_text, - } - ], + response_id = ( + self._interaction_id + or getattr(response, "id", None) + or f"interaction_{id(self)}" ) - # For other event types, return None (skip) - return None + terminal: List[InteractionsAPIStreamingResponse] = [] + if self.sent_content_start: + terminal.append(self._build_content_stop_event(response_id)) + terminal.append(self._build_completion_event(response_id)) + self._sent_completion_event = True + return terminal + + return [] + + def _build_terminal_events_on_eof( + self, + ) -> List[InteractionsAPIStreamingResponse]: + """ + Build the events to flush when the upstream stream ends without a + ResponseCompletedEvent. Ensures consumers always observe a terminal + interaction.completed/interaction.complete carrying the full text. + """ + if self._sent_completion_event: + return [] + + fallback_id = self._interaction_id or f"interaction_{id(self)}" + terminal: List[InteractionsAPIStreamingResponse] = [] + if self.sent_content_start: + terminal.append(self._build_content_stop_event(fallback_id)) + if self.sent_interaction_start or self.collected_text: + terminal.append(self._build_completion_event(fallback_id)) + self._sent_completion_event = True + return terminal + + # ------------------------------------------------------------------ + # Iteration + # ------------------------------------------------------------------ def __iter__(self) -> Iterator[InteractionsAPIStreamingResponse]: - """Sync iterator implementation.""" return self def __next__(self) -> InteractionsAPIStreamingResponse: - """Get next chunk in sync mode.""" + if self._pending_events: + return self._pending_events.popleft() + if self.finished: raise StopIteration - # Check if we have a pending interaction.complete to send - if hasattr(self, "_pending_interaction_complete"): - pending: InteractionsAPIStreamingResponse = getattr( - self, "_pending_interaction_complete" - ) - delattr(self, "_pending_interaction_complete") - return pending - - # Use a loop instead of recursion to avoid stack overflow sync_iterator = cast( SyncResponsesAPIStreamingIterator, self.responses_stream_iterator ) while True: try: - # Get next chunk from responses API stream chunk = next(sync_iterator) - - # Transform chunk (chunk is already a ResponsesAPIStreamingResponse) - transformed = self._transform_responses_chunk_to_interactions_chunk( - chunk - ) - - if transformed: - # If we finished and content was started, send content.stop before interaction.complete - if ( - self.finished - and self.sent_content_start - and transformed.event_type == "interaction.complete" - ): - # Send content.stop first - content_stop = InteractionsAPIStreamingResponse( - event_type="content.stop", - id=transformed.id, - object="content", - delta={"type": "text", "text": self.collected_text}, - ) - # Store the interaction.complete to send next - self._pending_interaction_complete = transformed - return content_stop - return transformed - - # If no transformation, continue to next chunk (loop continues) - except StopIteration: self.finished = True + self._pending_events.extend(self._build_terminal_events_on_eof()) + if self._pending_events: + return self._pending_events.popleft() + raise - # Send final events if needed - if self.sent_content_start: - return InteractionsAPIStreamingResponse( - event_type="content.stop", - object="content", - delta={"type": "text", "text": self.collected_text}, - ) - - raise StopIteration + events = self._events_for_chunk(chunk) + if events: + self._pending_events.extend(events) + return self._pending_events.popleft() def __aiter__(self) -> AsyncIterator[InteractionsAPIStreamingResponse]: - """Async iterator implementation.""" return self async def __anext__(self) -> InteractionsAPIStreamingResponse: - """Get next chunk in async mode.""" + if self._pending_events: + return self._pending_events.popleft() + if self.finished: raise StopAsyncIteration - # Check if we have a pending interaction.complete to send - if hasattr(self, "_pending_interaction_complete"): - pending: InteractionsAPIStreamingResponse = getattr( - self, "_pending_interaction_complete" - ) - delattr(self, "_pending_interaction_complete") - return pending - - # Use a loop instead of recursion to avoid stack overflow async_iterator = cast( ResponsesAPIStreamingIterator, self.responses_stream_iterator ) while True: try: - # Get next chunk from responses API stream chunk = await async_iterator.__anext__() - - # Transform chunk (chunk is already a ResponsesAPIStreamingResponse) - transformed = self._transform_responses_chunk_to_interactions_chunk( - chunk - ) - - if transformed: - # If we finished and content was started, send content.stop before interaction.complete - if ( - self.finished - and self.sent_content_start - and transformed.event_type == "interaction.complete" - ): - # Send content.stop first - content_stop = InteractionsAPIStreamingResponse( - event_type="content.stop", - id=transformed.id, - object="content", - delta={"type": "text", "text": self.collected_text}, - ) - # Store the interaction.complete to send next - self._pending_interaction_complete = transformed - return content_stop - return transformed - - # If no transformation, continue to next chunk (loop continues) - except StopAsyncIteration: self.finished = True + self._pending_events.extend(self._build_terminal_events_on_eof()) + if self._pending_events: + return self._pending_events.popleft() + raise - # Send final events if needed - if self.sent_content_start: - return InteractionsAPIStreamingResponse( - event_type="content.stop", - object="content", - delta={"type": "text", "text": self.collected_text}, - ) + events = self._events_for_chunk(chunk) + if events: + self._pending_events.extend(events) + return self._pending_events.popleft() - raise StopAsyncIteration + # ------------------------------------------------------------------ + # Backwards-compatible single-chunk transform (used by tests and any + # external callers that drove the iterator chunk-by-chunk pre-fix). + # ------------------------------------------------------------------ + + def _transform_responses_chunk_to_interactions_chunk( + self, + responses_chunk: ResponsesAPIStreamingResponse, + ) -> Optional[InteractionsAPIStreamingResponse]: + """ + Compatibility shim: returns the *first* event produced for this chunk + and queues any remaining events on ``self._pending_events`` so they + are surfaced on subsequent calls/iterations. + + Prefer ``_events_for_chunk`` in new code. + """ + events = self._events_for_chunk(responses_chunk) + if not events: + return None + first = events[0] + if len(events) > 1: + self._pending_events.extend(events[1:]) + return first diff --git a/litellm/interactions/litellm_responses_transformation/transformation.py b/litellm/interactions/litellm_responses_transformation/transformation.py index 100300af7b5..173d4ca8764 100644 --- a/litellm/interactions/litellm_responses_transformation/transformation.py +++ b/litellm/interactions/litellm_responses_transformation/transformation.py @@ -226,29 +226,37 @@ class LiteLLMResponsesInteractionsConfig: - Map status - Extract usage """ - # Extract text from outputs - outputs = [] + # Extract text from outputs and build both `outputs` (legacy) and `steps` (new schema). + outputs: List[Dict[str, Any]] = [] + steps: List[Dict[str, Any]] = [] if hasattr(responses_response, "output") and responses_response.output: for output_item in responses_response.output: # Use getattr with None default to safely access content content = getattr(output_item, "content", None) if content is not None: content_items = content if isinstance(content, list) else [content] + model_output_contents: List[Dict[str, Any]] = [] for content_item in content_items: # Check if content_item has text attribute text = getattr(content_item, "text", None) if text is not None: - outputs.append( - { - "type": "text", - "text": text, - } - ) + # Use independent dict instances so mutations to one + # of `outputs` / `steps` don't leak into the other. + outputs.append({"type": "text", "text": text}) + model_output_contents.append({"type": "text", "text": text}) elif ( isinstance(content_item, dict) and content_item.get("type") == "text" ): - outputs.append(content_item) + outputs.append({**content_item}) + model_output_contents.append({**content_item}) + if model_output_contents: + steps.append( + { + "type": "model_output", + "content": model_output_contents, + } + ) # Convert created_at to ISO string created_at = getattr(responses_response, "created_at", None) @@ -270,12 +278,14 @@ class LiteLLMResponsesInteractionsConfig: else: interactions_status = status - # Build interactions response + # Build interactions response — populate both `outputs` (legacy schema) and + # `steps` (new schema) so callers work regardless of which schema they expect. interactions_response_dict: Dict[str, Any] = { "id": getattr(responses_response, "id", ""), "object": "interaction", "status": interactions_status, "outputs": outputs, + "steps": steps, "model": model or getattr(responses_response, "model", ""), "created": created, } diff --git a/litellm/interactions/main.py b/litellm/interactions/main.py index ab429ef6db5..d99cc3d11c7 100644 --- a/litellm/interactions/main.py +++ b/litellm/interactions/main.py @@ -8,25 +8,25 @@ Per OpenAPI spec (https://ai.google.dev/static/api/interactions.openapi.json): Usage: import litellm - + # Create an interaction with a model response = litellm.interactions.create( model="gemini-2.5-flash", input="Hello, how are you?" ) - + # Create an interaction with an agent response = litellm.interactions.create( agent="deep-research-pro-preview-12-2025", input="Research the current state of cancer research" ) - + # Async version response = await litellm.interactions.acreate(...) - + # Get an interaction response = litellm.interactions.get(interaction_id="...") - + # Delete an interaction result = litellm.interactions.delete(interaction_id="...") """ @@ -48,6 +48,7 @@ from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLogging from litellm.types.interactions import ( CancelInteractionResult, DeleteInteractionResult, + InteractionEnvironment, InteractionInput, InteractionsAPIResponse, InteractionsAPIStreamingResponse, @@ -80,6 +81,8 @@ async def acreate( store: Optional[bool] = None, # Background execution background: Optional[bool] = None, + # Agent execution environment ("remote", env id, or remote config object) + environment: Optional[InteractionEnvironment] = None, # Response format response_modalities: Optional[List[str]] = None, response_format: Optional[Dict[str, Any]] = None, @@ -109,6 +112,10 @@ async def acreate( stream: Whether to stream the response store: Whether to store the response for later retrieval background: Whether to run in background + environment: Agent execution environment — ``"remote"``, an existing env id + string, or a config object such as + ``{"type": "remote", "sources": [...]}`` / + ``{"type": "remote", "network": {...}}`` response_modalities: Requested response modalities (TEXT, IMAGE, AUDIO) response_format: JSON schema for response format response_mime_type: MIME type of the response @@ -144,6 +151,7 @@ async def acreate( stream=stream, store=store, background=background, + environment=environment, response_modalities=response_modalities, response_format=response_format, response_mime_type=response_mime_type, @@ -194,6 +202,8 @@ def create( store: Optional[bool] = None, # Background execution background: Optional[bool] = None, + # Agent execution environment ("remote", env id, or remote config object) + environment: Optional[InteractionEnvironment] = None, # Response format response_modalities: Optional[List[str]] = None, response_format: Optional[Dict[str, Any]] = None, @@ -231,6 +241,10 @@ def create( stream: Whether to stream the response store: Whether to store the response for later retrieval background: Whether to run in background + environment: Agent execution environment — ``"remote"``, an existing env id + string, or a config object such as + ``{"type": "remote", "sources": [...]}`` / + ``{"type": "remote", "network": {...}}`` response_modalities: Requested response modalities (TEXT, IMAGE, AUDIO) response_format: JSON schema for response format response_mime_type: MIME type of the response @@ -252,7 +266,14 @@ def create( litellm_params = GenericLiteLLMParams(**kwargs) - if model: + # Routing logic: + # - agent provided (no model, or model accidentally set to agent name) → gemini + # - model provided → resolve provider via get_llm_provider (normal routing) + if agent and model == agent: + model = None + if agent and not model: + custom_llm_provider = custom_llm_provider or "gemini" + elif model: model, custom_llm_provider, _, _ = litellm.get_llm_provider( model=model, custom_llm_provider=custom_llm_provider, diff --git a/litellm/interactions/streaming_iterator.py b/litellm/interactions/streaming_iterator.py index a5a7f9e06e5..561686a3e1b 100644 --- a/litellm/interactions/streaming_iterator.py +++ b/litellm/interactions/streaming_iterator.py @@ -101,10 +101,14 @@ class BaseInteractionsAPIStreamingIterator: ) ) - # Store the completed response (check for status=completed) - if ( - streaming_response - and getattr(streaming_response, "status", None) == "completed" + # Store the completed response. + # Legacy schema signals completion via status="completed". + # New schema (Api-Revision: 2026-05-20) uses event_type="interaction.completed". + # Remove the legacy check after June 8, 2026. + if streaming_response and ( + getattr(streaming_response, "status", None) == "completed" + or getattr(streaming_response, "event_type", None) + == "interaction.completed" ): self.completed_response = streaming_response self._handle_logging_completed_response() diff --git a/litellm/interactions/utils.py b/litellm/interactions/utils.py index 3a18ddf52fe..84437f4d3d8 100644 --- a/litellm/interactions/utils.py +++ b/litellm/interactions/utils.py @@ -15,6 +15,7 @@ INTERACTIONS_API_OPTIONAL_PARAMS = { "stream", "store", "background", + "environment", "response_modalities", "response_format", "response_mime_type", diff --git a/litellm/litellm_core_utils/audio_utils/utils.py b/litellm/litellm_core_utils/audio_utils/utils.py index 2141df18738..82f5c27f836 100644 --- a/litellm/litellm_core_utils/audio_utils/utils.py +++ b/litellm/litellm_core_utils/audio_utils/utils.py @@ -53,8 +53,19 @@ def process_audio_file(audio_file: FileTypes) -> ProcessedAudioFile: # Raw bytes filename = "audio.wav" file_content = bytes(audio_file) - elif isinstance(audio_file, (str, os.PathLike)): - # File path or PathLike + elif isinstance(audio_file, str): + # Bare strings are rejected — see extract_file_data for the same + # rationale: in a proxy request handler the string is + # attacker-controlled, and opening it as a path is an arbitrary + # file read. + raise ValueError( + "process_audio_file does not accept bare str inputs. Pass bytes, " + "an open file handle, a (filename, content) tuple, or a " + "pathlib.Path." + ) + elif isinstance(audio_file, os.PathLike): + # File path or PathLike — PathLike is a Python-level type that + # HTTP form values can't fabricate. file_path = str(audio_file) with open(file_path, "rb") as f: file_content = f.read() @@ -66,8 +77,14 @@ def process_audio_file(audio_file: FileTypes) -> ProcessedAudioFile: content = audio_file[1] if isinstance(content, (bytes, bytearray)): file_content = bytes(content) - elif isinstance(content, (str, os.PathLike)): - # File path or PathLike + elif isinstance(content, str): + raise ValueError( + "process_audio_file does not accept bare str tuple " + "contents. Pass bytes, an open file handle, or a " + "pathlib.Path." + ) + elif isinstance(content, os.PathLike): + # PathLike: SDK convenience for local-file uploads. with open(str(content), "rb") as f: file_content = f.read() elif hasattr(content, "read"): @@ -149,7 +166,14 @@ def get_audio_file_content_hash(file_obj: FileTypes) -> str: try: if isinstance(file_content_obj, (bytes, bytearray)): file_content = bytes(file_content_obj) - elif isinstance(file_content_obj, (str, os.PathLike)): + elif isinstance(file_content_obj, str): + # Bare strings are not treated as file paths in this helper — + # the cache-key path is reached from request handlers where the + # value is attacker-controlled. Fall back to hashing the string + # itself rather than opening it. + fallback_filename = file_content_obj + file_content = None + elif isinstance(file_content_obj, os.PathLike): try: with open(str(file_content_obj), "rb") as f: file_content = f.read() @@ -229,8 +253,15 @@ def calculate_request_duration(file: FileTypes) -> Optional[float]: if isinstance(file, (bytes, bytearray)): # Raw bytes file_content = bytes(file) - elif isinstance(file, (str, os.PathLike)): - # File path + elif isinstance(file, str): + # Bare strings are rejected — see extract_file_data. + raise ValueError( + "calculate_request_duration does not accept bare str inputs. " + "Pass bytes, an open file handle, a (filename, content) " + "tuple, or a pathlib.Path." + ) + elif isinstance(file, os.PathLike): + # File path (PathLike): SDK convenience. with open(str(file), "rb") as f: file_content = f.read() elif isinstance(file, tuple): diff --git a/litellm/litellm_core_utils/get_supported_openai_params.py b/litellm/litellm_core_utils/get_supported_openai_params.py index 9d8bd7523db..b8cdc8210fc 100644 --- a/litellm/litellm_core_utils/get_supported_openai_params.py +++ b/litellm/litellm_core_utils/get_supported_openai_params.py @@ -11,6 +11,7 @@ def get_supported_openai_params( # noqa: PLR0915 request_type: Literal[ "chat_completion", "embeddings", "transcription" ] = "chat_completion", + base_model: Optional[str] = None, ) -> Optional[list]: """ Returns the supported openai params for a given model + provider @@ -20,6 +21,11 @@ def get_supported_openai_params( # noqa: PLR0915 get_supported_openai_params(model="anthropic.claude-3", custom_llm_provider="bedrock") ``` + Args: + base_model: For Azure, the true underlying model (e.g. ``"azure/gpt-5.2"``) + when the deployment name differs. Used for model-type detection so that + non-standard deployment names route to the correct config. + Returns: - List if custom_llm_provider is mapped - None if unmapped @@ -32,17 +38,21 @@ def get_supported_openai_params( # noqa: PLR0915 if custom_llm_provider in LlmProvidersSet: provider_config = litellm.ProviderConfigManager.get_provider_chat_config( - model=model, provider=LlmProviders(custom_llm_provider) + model=model, + provider=LlmProviders(custom_llm_provider), + base_model=base_model, ) elif custom_llm_provider.split("/")[0] in LlmProvidersSet: provider_config = litellm.ProviderConfigManager.get_provider_chat_config( - model=model, provider=LlmProviders(custom_llm_provider.split("/")[0]) + model=model, + provider=LlmProviders(custom_llm_provider.split("/")[0]), + base_model=base_model, ) else: provider_config = None if provider_config and request_type == "chat_completion": - return provider_config.get_supported_openai_params(model=model) + return provider_config.get_supported_openai_params(model=base_model or model) if custom_llm_provider == "bedrock": return litellm.AmazonConverseConfig().get_supported_openai_params(model=model) @@ -130,16 +140,23 @@ def get_supported_openai_params( # noqa: PLR0915 model=model ) elif custom_llm_provider == "azure": - if litellm.AzureOpenAIO1Config().is_o_series_model(model=model): + _azure_detection_model = base_model or model + if litellm.AzureOpenAIO1Config().is_o_series_model( + model=_azure_detection_model + ): return litellm.AzureOpenAIO1Config().get_supported_openai_params( - model=model + model=_azure_detection_model ) - elif litellm.AzureOpenAIGPT5Config.is_model_gpt_5_model(model=model): + elif litellm.AzureOpenAIGPT5Config.is_model_gpt_5_model( + model=_azure_detection_model + ): return litellm.AzureOpenAIGPT5Config().get_supported_openai_params( - model=model + model=_azure_detection_model ) else: - return litellm.AzureOpenAIConfig().get_supported_openai_params(model=model) + return litellm.AzureOpenAIConfig().get_supported_openai_params( + model=_azure_detection_model + ) elif custom_llm_provider == "openrouter": return litellm.OpenrouterConfig().get_supported_openai_params(model=model) elif custom_llm_provider == "vercel_ai_gateway": diff --git a/litellm/litellm_core_utils/litellm_logging.py b/litellm/litellm_core_utils/litellm_logging.py index a815442c2f9..63fa0e64695 100644 --- a/litellm/litellm_core_utils/litellm_logging.py +++ b/litellm/litellm_core_utils/litellm_logging.py @@ -994,10 +994,8 @@ class Logging(LiteLLMLoggingBaseClass): try: # [Non-blocking Extra Debug Information in metadata] if turn_off_message_logging is True: - _metadata["raw_request"] = ( - "redacted by litellm. \ + _metadata["raw_request"] = "redacted by litellm. \ 'litellm.turn_off_message_logging=True'" - ) else: curl_command = self._get_request_curl_command( api_base=additional_args.get("api_base", ""), @@ -1031,12 +1029,8 @@ class Logging(LiteLLMLoggingBaseClass): error=str(e), ) ) - _metadata["raw_request"] = ( - "Unable to Log \ - raw request: {}".format( - str(e) - ) - ) + _metadata["raw_request"] = "Unable to Log \ + raw request: {}".format(str(e)) if getattr(self, "logger_fn", None) and callable(self.logger_fn): try: self.logger_fn( @@ -1050,6 +1044,16 @@ class Logging(LiteLLMLoggingBaseClass): ) self.model_call_details["api_call_start_time"] = datetime.datetime.now() + # Set-once first provider-handoff instant. api_call_start_time + # is overwritten on every retry, so it can't measure one-time + # preprocessing; pinning the first attempt excludes retry loops + # + backoff. Logging object only — must NOT go into + # litellm_params["metadata"] (caller request metadata, typed + # Dict[str, str], echoed downstream; a datetime breaks it). + if self.model_call_details.get("first_api_call_start_time") is None: + self.model_call_details["first_api_call_start_time"] = ( + self.model_call_details["api_call_start_time"] + ) # Input Integration Logging -> If you want to log the fact that an attempt to call the model was made callbacks = litellm.input_callback + (self.dynamic_input_callbacks or []) for callback in callbacks: @@ -1212,7 +1216,7 @@ class Logging(LiteLLMLoggingBaseClass): # Log the exact result from the LLM API, for streaming - log the type of response received litellm.error_logs["POST_CALL"] = locals() if isinstance(original_response, dict): - original_response = json.dumps(original_response) + original_response = json.dumps(original_response, default=str) try: self.model_call_details["input"] = input self.model_call_details["api_key"] = api_key @@ -1759,9 +1763,12 @@ class Logging(LiteLLMLoggingBaseClass): self.model_call_details["response_cost"] = 0.0 elif "response_cost" in hidden_params: self.model_call_details["response_cost"] = hidden_params["response_cost"] - elif self.model_call_details.get("response_cost") is not None: + elif ( + existing_cost := self.model_call_details.get("response_cost") + ) is not None and existing_cost != 0: # Preserve response_cost if already calculated (e.g., by pass-through - # handlers like Gemini/Vertex which call completion_cost directly) + # handlers like Gemini/Vertex which call completion_cost directly). + # Do not preserve 0 from failure_handler on intermediate router retries. pass else: self.model_call_details["response_cost"] = self._response_cost_calculator( @@ -5133,13 +5140,17 @@ class StandardLoggingPayloadSetup: ) -> StandardLoggingPayloadErrorInformation: from litellm.constants import MAXIMUM_TRACEBACK_LINES_TO_LOG - # Check for 'code' first (used by ProxyException), then fall back to 'status_code' (used by LiteLLM exceptions) - # Ensure error_code is always a string for Prisma Python JSON field compatibility + # ProxyException uses .code, LiteLLM exceptions use .status_code, + # httpx.HTTPStatusError exposes status only as .response.status_code. + # Stringified for Prisma JSON compatibility. error_code_attr = getattr(original_exception, "code", None) if error_code_attr is not None and str(error_code_attr) not in ("", "None"): error_status: str = str(error_code_attr) else: status_code_attr = getattr(original_exception, "status_code", None) + if status_code_attr is None: + response_attr = getattr(original_exception, "response", None) + status_code_attr = getattr(response_attr, "status_code", None) error_status = str(status_code_attr) if status_code_attr is not None else "" error_class: str = ( str(original_exception.__class__.__name__) if original_exception else "" diff --git a/litellm/litellm_core_utils/prompt_templates/common_utils.py b/litellm/litellm_core_utils/prompt_templates/common_utils.py index b234e6c8f77..32ae61d7f58 100644 --- a/litellm/litellm_core_utils/prompt_templates/common_utils.py +++ b/litellm/litellm_core_utils/prompt_templates/common_utils.py @@ -20,6 +20,7 @@ from typing import ( cast, ) +import litellm from litellm import verbose_logger from litellm.router_utils.batch_utils import InMemoryFile from litellm.types.llms.openai import ( @@ -436,12 +437,21 @@ def update_messages_with_model_file_ids( """ Updates messages with model file ids. + For managed files (unified file IDs), uses model_file_id_mapping if it + resolves the id, otherwise decodes the base64-encoded unified file ID + and extracts the llm_output_file_id directly. Mirrors the Responses-API + sibling `update_responses_input_with_model_file_ids`. + model_file_id_mapping: Dict[str, Dict[str, str]] = { "litellm_proxy/file_id": { "model_id": "provider_file_id" } } """ + from litellm.proxy.openai_files_endpoints.common_utils import ( + _is_base64_encoded_unified_file_id, + convert_b64_uid_to_unified_uid, + ) for message in messages: if message.get("role") == "user": @@ -450,7 +460,13 @@ def update_messages_with_model_file_ids( if isinstance(content, str): continue for c in content: - if c["type"] == "file": + if not isinstance(c, dict): + # Content list items aren't always dicts. e.g. + # text_completion forwards a token-ids list/list-of- + # lists through this path. Skip non-dict items + # instead of indexing into them. + continue + if c.get("type") == "file": file_object = cast(ChatCompletionFileObject, c) file_object_file_field = file_object.get("file") if not isinstance(file_object_file_field, dict): @@ -468,9 +484,23 @@ def update_messages_with_model_file_ids( if file_id: provider_file_id = ( model_file_id_mapping.get(file_id, {}).get(model_id) - or file_id + if model_file_id_mapping + else None + ) + if ( + not provider_file_id + and _is_base64_encoded_unified_file_id(file_id) + ): + unified_file_id = convert_b64_uid_to_unified_uid( + file_id + ) + if "llm_output_file_id," in unified_file_id: + provider_file_id = unified_file_id.split( + "llm_output_file_id," + )[1].split(";")[0] + file_object_file_field["file_id"] = ( + provider_file_id or file_id ) - file_object_file_field["file_id"] = provider_file_id if format: file_object_file_field["format"] = format return messages @@ -726,14 +756,25 @@ def extract_file_data(file_data: FileTypes) -> ExtractedFileData: else: file_content = file_data # Convert content to bytes - if isinstance(file_content, (str, PathLike)): - # If it's a path, open and read the file - # Extract filename from path if not already set + if isinstance(file_content, str): + # Bare string inputs are rejected: when this helper runs in a proxy + # request handler the string came from an attacker-controlled form + # field, and opening it as a path is an arbitrary file read on the + # proxy host. SDK callers who want to upload from a path should + # either pass a pathlib.Path (a PathLike instance — see the branch + # below) or open the file themselves and pass the handle / bytes. + raise ValueError( + "extract_file_data does not accept bare str inputs. Pass bytes, " + "an open file handle, a (filename, content) tuple, or a " + "pathlib.Path. To upload a local file from a path, call " + "open(path, 'rb') yourself." + ) + if isinstance(file_content, PathLike): + # PathLike (pathlib.Path) is a Python-level type that HTTP form + # values can't fabricate. Treat as a local file path for SDK + # convenience. if filename is None: - if isinstance(file_content, PathLike): - filename = Path(file_content).name - else: - filename = Path(str(file_content)).name + filename = Path(file_content).name with open(file_content, "rb") as f: content = f.read() elif isinstance(file_content, io.IOBase): @@ -1130,9 +1171,16 @@ def migrate_file_to_image_url( ChatCompletionImageUrlObject, ) - file_id = message["file"].get("file_id") - file_data = message["file"].get("file_data") - format = message["file"].get("format") + file_sub = message.get("file") + if file_sub is None: + raise litellm.BadRequestError( + message="Content block has type='file' but is missing the required 'file' field", + model=None, + llm_provider=None, + ) + file_id = file_sub.get("file_id") + file_data = file_sub.get("file_data") + format = file_sub.get("format") if not file_id and not file_data: raise ValueError("file_id and file_data are both None") image_url_object = ChatCompletionImageObject( @@ -1156,12 +1204,8 @@ def get_last_user_message(messages: List[AllMessageValues]) -> Optional[str]: {"role": "assistant", "content": "I'm good, thank you!"}, {"role": "user", "content": "What is the weather in Tokyo?"}, ] - get_user_prompt(messages) -> "What is the weather in Tokyo?" + get_last_user_message(messages) -> "What is the weather in Tokyo?" """ - from litellm.litellm_core_utils.prompt_templates.common_utils import ( - convert_content_list_to_str, - ) - if not messages: return None diff --git a/litellm/litellm_core_utils/prompt_templates/factory.py b/litellm/litellm_core_utils/prompt_templates/factory.py index abe9e016e26..f169f86079a 100644 --- a/litellm/litellm_core_utils/prompt_templates/factory.py +++ b/litellm/litellm_core_utils/prompt_templates/factory.py @@ -1233,6 +1233,7 @@ def infer_protocol_value( def _gemini_tool_call_invoke_helper( function_call_params: ChatCompletionToolCallFunctionChunk, + tool_call_id: Optional[str] = None, ) -> Optional[VertexFunctionCall]: name = function_call_params.get("name", "") or "" arguments = function_call_params.get("arguments", "") @@ -1248,6 +1249,10 @@ def _gemini_tool_call_invoke_helper( name=name, args=arguments_dict, ) + if tool_call_id: + clean_id = tool_call_id.split(THOUGHT_SIGNATURE_SEPARATOR, 1)[0] + if clean_id: + function_call["id"] = clean_id return function_call @@ -1339,6 +1344,7 @@ def _get_dummy_thought_signature() -> str: def convert_to_gemini_tool_call_invoke( message: ChatCompletionAssistantMessage, model: Optional[str] = None, + custom_llm_provider: Optional[str] = None, ) -> List[VertexPartType]: """ OpenAI tool invokes: @@ -1384,12 +1390,26 @@ def convert_to_gemini_tool_call_invoke( tool_calls = message.get("tool_calls", None) function_call = message.get("function_call", None) + from litellm.llms.vertex_ai.gemini.vertex_and_google_ai_studio_gemini import ( + VertexGeminiConfig, + ) + + forward_tool_call_id = bool( + model + and VertexGeminiConfig._forward_gemini_function_call_id( + model, custom_llm_provider + ) + ) + if tool_calls is not None: for idx, tool in enumerate(tool_calls): if "function" in tool: gemini_function_call: Optional[VertexFunctionCall] = ( _gemini_tool_call_invoke_helper( - function_call_params=tool["function"] + function_call_params=tool["function"], + tool_call_id=( + tool.get("id") if forward_tool_call_id else None + ), ) ) if gemini_function_call is not None: @@ -1429,10 +1449,6 @@ def convert_to_gemini_tool_call_invoke( thought_signature = provider_fields.get("thought_signature") # If no signature found and model is gemini-3, use dummy signature - from litellm.llms.vertex_ai.gemini.vertex_and_google_ai_studio_gemini import ( - VertexGeminiConfig, - ) - if ( not thought_signature and model @@ -1462,6 +1478,8 @@ def convert_to_gemini_tool_call_invoke( def convert_to_gemini_tool_call_result( # noqa: PLR0915 message: Union[ChatCompletionToolMessage, ChatCompletionFunctionMessage], last_message_with_tool_calls: Optional[dict], + model: Optional[str] = None, + custom_llm_provider: Optional[str] = None, ) -> Union[VertexPartType, List[VertexPartType]]: """ OpenAI message with a tool result looks like: @@ -1602,6 +1620,23 @@ def convert_to_gemini_tool_call_result( # noqa: PLR0915 ): name = tool.get("function", {}).get("name", "") + # Echo the OpenAI tool_call_id on functionResponse (strip thought-signature suffix). + # Only Google AI Studio Gemini 3+ accepts `id` on function_response parts. + # Vertex AI and older Gemini models reject the field with HTTP 400. + from litellm.llms.vertex_ai.gemini.vertex_and_google_ai_studio_gemini import ( + VertexGeminiConfig, + ) + + gemini_call_id: Optional[str] = None + if model and VertexGeminiConfig._forward_gemini_function_call_id( + model, custom_llm_provider + ): + raw_tool_call_id = message.get("tool_call_id") + if raw_tool_call_id and isinstance(raw_tool_call_id, str): + stripped_id = raw_tool_call_id.split(THOUGHT_SIGNATURE_SEPARATOR, 1)[0] + if stripped_id: + gemini_call_id = stripped_id + if not name: raise Exception( "Missing corresponding tool call for tool response message. Received - message={}, last_message_with_tool_calls={}".format( @@ -1632,6 +1667,8 @@ def convert_to_gemini_tool_call_result( # noqa: PLR0915 name=name, response=response_data, # type: ignore ) + if gemini_call_id: + _function_response["id"] = gemini_call_id # Create part with function_response, and optionally inline_data for images (Computer Use) _part: VertexPartType = {"function_response": _function_response} @@ -2057,9 +2094,16 @@ def anthropic_process_openai_file_message( AnthropicMessagesContainerUploadParam, ]: file_message = cast(ChatCompletionFileObject, message) - file_data = file_message["file"].get("file_data") - file_id = file_message["file"].get("file_id") - format = file_message["file"].get("format") + file_sub = file_message.get("file") + if file_sub is None: + raise litellm.BadRequestError( + message="Content block has type='file' but is missing the required 'file' field", + model=None, + llm_provider="anthropic", + ) + file_data = file_sub.get("file_data") + file_id = file_sub.get("file_id") + format = file_sub.get("format") if file_data: image_chunk = convert_to_anthropic_image_obj( openai_image_url=file_data, @@ -4879,7 +4923,13 @@ class BedrockConverseMessagesProcessor: @staticmethod def _process_file_message(message: ChatCompletionFileObject) -> BedrockContentBlock: - file_message = message["file"] + file_message = message.get("file") + if file_message is None: + raise litellm.BadRequestError( + message="Content block has type='file' but is missing the required 'file' field", + model=None, + llm_provider="bedrock", + ) file_data = file_message.get("file_data") file_id = file_message.get("file_id") @@ -4900,7 +4950,13 @@ class BedrockConverseMessagesProcessor: async def _async_process_file_message( message: ChatCompletionFileObject, ) -> BedrockContentBlock: - file_message = message["file"] + file_message = message.get("file") + if file_message is None: + raise litellm.BadRequestError( + message="Content block has type='file' but is missing the required 'file' field", + model=None, + llm_provider="bedrock", + ) file_data = file_message.get("file_data") file_id = file_message.get("file_id") format = file_message.get("format") @@ -4977,8 +5033,9 @@ class BedrockConverseMessagesProcessor: ) if reasoning_text and not reasoning_text.get("signature"): reasoning_text_text = reasoning_text["text"] - assistants_part = BedrockContentBlock(text=reasoning_text_text) - assistant_parts.append(assistants_part) + if reasoning_text_text.strip(): + assistants_part = BedrockContentBlock(text=reasoning_text_text) + assistant_parts.append(assistants_part) else: filtered_thinking_blocks.append(block) if len(filtered_thinking_blocks) > 0: @@ -5533,9 +5590,7 @@ def default_response_schema_prompt(response_schema: dict) -> str: prompt_str = """Use this JSON schema: ```json {} - ```""".format( - response_schema - ) + ```""".format(response_schema) return prompt_str diff --git a/litellm/litellm_core_utils/specialty_caches/dynamic_logging_cache.py b/litellm/litellm_core_utils/specialty_caches/dynamic_logging_cache.py index 13341f27a61..0a6a4e82c72 100644 --- a/litellm/litellm_core_utils/specialty_caches/dynamic_logging_cache.py +++ b/litellm/litellm_core_utils/specialty_caches/dynamic_logging_cache.py @@ -1,9 +1,9 @@ """ This is a cache for LangfuseLoggers. -Langfuse Python SDK initializes a thread for each client. +Langfuse Python SDK initializes a thread for each client. -This ensures we do +This ensures we do 1. Proper cleanup of Langfuse initialized clients. 2. Re-use created langfuse clients. """ diff --git a/litellm/llms/anthropic/chat/guardrail_translation/handler.py b/litellm/llms/anthropic/chat/guardrail_translation/handler.py index 2bb82f227bb..74dadee5ecb 100644 --- a/litellm/llms/anthropic/chat/guardrail_translation/handler.py +++ b/litellm/llms/anthropic/chat/guardrail_translation/handler.py @@ -23,7 +23,9 @@ from litellm.llms.anthropic.experimental_pass_through.adapters.transformation im from litellm.llms.base_llm.guardrail_translation.base_translation import BaseTranslation from litellm.llms.base_llm.guardrail_translation.utils import ( effective_skip_system_message_for_guardrail, + effective_skip_tool_message_for_guardrail, openai_messages_without_system, + openai_messages_without_tool, ) from litellm.proxy.pass_through_endpoints.llm_provider_handlers.anthropic_passthrough_logging_handler import ( AnthropicPassthroughLoggingHandler, @@ -108,6 +110,7 @@ class AnthropicMessagesHandler(BaseTranslation): return data skip_system = effective_skip_system_message_for_guardrail(guardrail_to_apply) + skip_tool = effective_skip_tool_message_for_guardrail(guardrail_to_apply) chat_completion_compatible_request = self._translate_to_openai(data) @@ -117,6 +120,8 @@ class AnthropicMessagesHandler(BaseTranslation): ) if skip_system: structured_messages = openai_messages_without_system(structured_messages) + if skip_tool: + structured_messages = openai_messages_without_tool(structured_messages) texts_to_check: List[str] = [] images_to_check: List[str] = [] @@ -134,6 +139,7 @@ class AnthropicMessagesHandler(BaseTranslation): images_to_check=images_to_check, task_mappings=task_mappings, skip_system_message=skip_system, + skip_tool_message=skip_tool, ) # Step 2: Apply guardrail to all texts in batch @@ -198,13 +204,17 @@ class AnthropicMessagesHandler(BaseTranslation): images_to_check: List[str], task_mappings: List[Tuple[int, Optional[int]]], skip_system_message: bool = False, + skip_tool_message: bool = False, ) -> None: """ Extract text content and images from a message. Override this method to customize text/image extraction logic. """ - if skip_system_message and str(message.get("role") or "").lower() == "system": + role = str(message.get("role") or "").lower() + if skip_system_message and role == "system": + return + if skip_tool_message and role == "tool": return content = message.get("content", None) diff --git a/litellm/llms/anthropic/chat/transformation.py b/litellm/llms/anthropic/chat/transformation.py index 2f11a3fccb5..0b56eb86d9c 100644 --- a/litellm/llms/anthropic/chat/transformation.py +++ b/litellm/llms/anthropic/chat/transformation.py @@ -1506,9 +1506,21 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): optional_params["metadata"] = {"user_id": value} elif param == "thinking": optional_params["thinking"] = value - elif param == "reasoning_effort" and isinstance(value, str): + elif param == "reasoning_effort": + # Accept both string ("low") and dict ({"effort": "low", + # "summary": "concise"}). The Responses->Chat parser keeps the + # full dict when `summary` is set (see #25359), so a dict here + # is the standard shape Otto/OpenAI-Responses-Bridge callers + # send. Coerce to the effort string before mapping — same + # shape-tolerance the GPT-5 path already implements in + # `_normalize_reasoning_effort_for_chat_completion`. + effort_value = value + if isinstance(effort_value, dict): + effort_value = effort_value.get("effort") + if not isinstance(effort_value, str): + continue mapped_thinking = AnthropicConfig._map_reasoning_effort( - reasoning_effort=value, + reasoning_effort=effort_value, model=model, llm_provider=self.custom_llm_provider or "anthropic", ) @@ -1519,12 +1531,12 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): optional_params["thinking"] = mapped_thinking if AnthropicConfig._is_adaptive_thinking_model(model): mapped_effort = REASONING_EFFORT_TO_OUTPUT_CONFIG_EFFORT.get( - value + effort_value ) if mapped_effort is None: AnthropicConfig._raise_invalid_reasoning_effort( model=model, - value=value, + value=effort_value, llm_provider=self.custom_llm_provider or "anthropic", ) optional_params["output_config"] = {"effort": mapped_effort} @@ -1809,9 +1821,7 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): Translate messages to anthropic format. """ ## VALIDATE REQUEST - """ - Anthropic doesn't support tool calling without `tools=` param specified. - """ + """Anthropic requires ``tools`` when messages include tool blocks; LiteLLM injects a dummy tool if omitted (no ``modify_params`` needed).""" from litellm.litellm_core_utils.prompt_templates.factory import ( anthropic_messages_pt, ) @@ -1821,16 +1831,9 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig): and messages is not None and has_tool_call_blocks(messages) ): - if litellm.modify_params: - optional_params["tools"], _ = self._map_tools( - add_dummy_tool(custom_llm_provider="anthropic") - ) - else: - raise litellm.UnsupportedParamsError( - message="Anthropic doesn't support tool calling without `tools=` param specified. Pass `tools=` param OR set `litellm.modify_params = True` // `litellm_settings::modify_params: True` to add dummy tool to the request.", - model="", - llm_provider="anthropic", - ) + optional_params["tools"], _ = self._map_tools( + add_dummy_tool(custom_llm_provider="anthropic") + ) # Drop thinking param if thinking is enabled but thinking_blocks are missing # This prevents the error: "Expected thinking or redacted_thinking, but found tool_use" diff --git a/litellm/llms/anthropic/common_utils.py b/litellm/llms/anthropic/common_utils.py index 869a7c5fbc4..31131d722ab 100644 --- a/litellm/llms/anthropic/common_utils.py +++ b/litellm/llms/anthropic/common_utils.py @@ -832,6 +832,49 @@ def strip_thinking_blocks_from_anthropic_messages_request_dict( data.pop("thinking", None) +def strip_empty_text_blocks_from_anthropic_messages( + messages: List[Any], +) -> List[Any]: + """ + Return a new message list with empty or whitespace-only ``{"type": "text"}`` + content blocks removed. + + Anthropic's API rejects requests containing such blocks with + ``"messages: text content blocks must be non-empty"``, but assistant + messages from Anthropic routinely arrive with ``{"type": "text", "text": ""}`` + alongside ``tool_use`` blocks (see anthropics/anthropic-sdk-python#461). + Multi-turn tool-use clients (e.g. Claude Code) loop these prior responses + back as conversation history, which then causes the next request to 400 + on the unified ``/v1/messages`` path. ``/v1/chat/completions`` already + handles this in ``anthropic_messages_pt``; this helper provides the + equivalent guarantee for the native Anthropic Messages path. + + Messages whose content is a list and becomes empty after stripping are + omitted, matching :func:`strip_thinking_blocks_from_anthropic_messages`. + The caller's list and its content blocks are never mutated; modified + messages are returned as shallow copies with a fresh content list. + """ + out: List[Any] = [] + for m in messages: + if not isinstance(m, dict) or not isinstance(m.get("content"), list): + out.append(m) + continue + content = m["content"] + filtered = [b for b in content if not _is_empty_text_block(b)] + if len(filtered) == len(content): + out.append(m) + elif filtered: + out.append({**m, "content": filtered}) + return out + + +def _is_empty_text_block(block: Any) -> bool: + if not isinstance(block, dict) or block.get("type") != "text": + return False + text = block.get("text") + return not isinstance(text, str) or not text.strip() + + def process_anthropic_headers(headers: Union[httpx.Headers, dict]) -> dict: openai_headers = {} if "anthropic-ratelimit-requests-limit" in headers: diff --git a/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py b/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py index fe8e694efe5..51a1e739a0f 100644 --- a/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py +++ b/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py @@ -1299,9 +1299,18 @@ class LiteLLMAnthropicMessagesAdapter: else truncated_name ) + # Strip Gemini thought-signature suffix from id (mirrors streaming + # path below); base64 chars (+ / =) violate Anthropic's + # `^[a-zA-Z0-9_-]+$` tool_use.id pattern when replayed. + raw_id = tool_call.id or "" + base_id = ( + raw_id.split(THOUGHT_SIGNATURE_SEPARATOR, 1)[0] + if THOUGHT_SIGNATURE_SEPARATOR in raw_id + else raw_id + ) tool_use_block = AnthropicResponseContentBlockToolUse( type="tool_use", - id=tool_call.id, + id=base_id, name=original_name, input=parse_tool_call_arguments( tool_call.function.arguments, @@ -1467,7 +1476,7 @@ class LiteLLMAnthropicMessagesAdapter: for choice in choices: if choice.delta.content is not None and len(choice.delta.content) > 0: text += choice.delta.content - if choice.delta.tool_calls is not None: + if choice.delta.tool_calls: partial_json = "" for tool in choice.delta.tool_calls: if ( diff --git a/litellm/llms/anthropic/experimental_pass_through/messages/agentic_streaming_iterator.py b/litellm/llms/anthropic/experimental_pass_through/messages/agentic_streaming_iterator.py index d0780c82d06..d693d50b8e5 100644 --- a/litellm/llms/anthropic/experimental_pass_through/messages/agentic_streaming_iterator.py +++ b/litellm/llms/anthropic/experimental_pass_through/messages/agentic_streaming_iterator.py @@ -13,7 +13,6 @@ from typing import Any, AsyncIterator, Dict, List, Optional, cast from litellm._logging import verbose_logger - # --------------------------------------------------------------------------- # SSE parsing helpers (module-level to keep the class lean) # --------------------------------------------------------------------------- diff --git a/litellm/llms/anthropic/experimental_pass_through/messages/handler.py b/litellm/llms/anthropic/experimental_pass_through/messages/handler.py index 0c59e812e0b..14e06e047ea 100644 --- a/litellm/llms/anthropic/experimental_pass_through/messages/handler.py +++ b/litellm/llms/anthropic/experimental_pass_through/messages/handler.py @@ -12,6 +12,9 @@ from typing import Any, AsyncIterator, Coroutine, Dict, List, Optional, Union, c import litellm from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj +from litellm.llms.anthropic.common_utils import ( + strip_empty_text_blocks_from_anthropic_messages, +) from litellm.llms.base_llm.anthropic_messages.transformation import ( BaseAnthropicMessagesConfig, ) @@ -188,8 +191,20 @@ async def anthropic_messages( **kwargs, ) -> Union[AnthropicMessagesResponse, AsyncIterator]: """ - Async: Make llm api request in Anthropic /messages API spec + Async: Make llm api request in Anthropic /messages API spec. + + Runs the empty-text-block sanitizer before any backend dispatch. """ + # Anthropic's API rejects requests containing empty / whitespace-only + # text content blocks with "messages: text content blocks must be + # non-empty". Multi-turn tool-use clients (e.g. Claude Code) routinely + # loop assistant responses that contain {"type": "text", "text": ""} + # alongside tool_use blocks back as conversation history, which then + # causes the next /v1/messages call to 400. /v1/chat/completions + # already handles this in anthropic_messages_pt; sanitize the native + # Anthropic Messages path here for the same guarantee. See #22930. + messages = strip_empty_text_blocks_from_anthropic_messages(messages) + original_stream = stream or kwargs.get( "_websearch_interception_converted_stream", False ) @@ -278,6 +293,12 @@ async def anthropic_messages( api_base=api_base, client=client, custom_llm_provider=custom_llm_provider, + # messages were already empty-text-block sanitized at the top of this + # function and are NOT reassigned before this dispatch, so the handler + # can skip its (otherwise redundant) second full-messages scan. Passed + # explicitly (not via **kwargs) so it only affects this direct + # dispatch -- interceptor / sync entry points still sanitize. + _litellm_messages_presanitized=True, **kwargs, ) ctx = contextvars.copy_context() @@ -336,6 +357,15 @@ def anthropic_messages_handler( """ from litellm.types.utils import LlmProviders + # Sanitize empty text blocks so the sync entry point + # (litellm.messages.create -> anthropic_messages_handler) gets the same + # protection as the async wrapper. The async wrapper already sanitized and + # does not reassign messages before dispatch, so it sets + # ``_litellm_messages_presanitized`` to skip this redundant second + # full-messages scan. Pop it so it never leaks into provider params. + if not kwargs.pop("_litellm_messages_presanitized", False): + messages = strip_empty_text_blocks_from_anthropic_messages(messages) + metadata = validate_anthropic_api_metadata(metadata) local_vars = locals() diff --git a/litellm/llms/anthropic/experimental_pass_through/messages/transformation.py b/litellm/llms/anthropic/experimental_pass_through/messages/transformation.py index 35495d59610..15f404d3f53 100644 --- a/litellm/llms/anthropic/experimental_pass_through/messages/transformation.py +++ b/litellm/llms/anthropic/experimental_pass_through/messages/transformation.py @@ -312,7 +312,10 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig): ) ####### get required params for all anthropic messages requests ###### - verbose_logger.debug(f"TRANSFORMATION DEBUG - Messages: {messages}") + # Lazy %s: the f-string previously stringified the entire messages + # payload on every request regardless of log level (a full scan of the + # request body on the hot path). Defer it to when DEBUG is enabled. + verbose_logger.debug("TRANSFORMATION DEBUG - Messages: %s", messages) # Auto-strip advisor blocks from history if advisor tool is absent. # Prevents Anthropic 400: advisor_tool_result in history requires advisor tool. diff --git a/litellm/llms/anthropic/experimental_pass_through/messages/utils.py b/litellm/llms/anthropic/experimental_pass_through/messages/utils.py index fa951ebd2e5..88832fb3f63 100644 --- a/litellm/llms/anthropic/experimental_pass_through/messages/utils.py +++ b/litellm/llms/anthropic/experimental_pass_through/messages/utils.py @@ -1,4 +1,5 @@ -from typing import Any, Dict, List, cast, get_type_hints +from functools import lru_cache +from typing import Any, Dict, FrozenSet, List, cast, get_type_hints from litellm.types.llms.anthropic import AnthropicMessagesRequestOptionalParams from litellm.types.llms.anthropic_messages.anthropic_response import ( @@ -6,6 +7,18 @@ from litellm.types.llms.anthropic_messages.anthropic_response import ( ) +@lru_cache(maxsize=1) +def _anthropic_messages_optional_param_keys() -> FrozenSet[str]: + """ + Valid AnthropicMessagesRequestOptionalParams keys. + + ``typing.get_type_hints`` is ~80us/call and this TypedDict is static, so + resolving it once per process instead of once per request removes a fixed + full-pass cost from the /v1/messages request-parse path. + """ + return frozenset(get_type_hints(AnthropicMessagesRequestOptionalParams).keys()) + + class AnthropicMessagesRequestUtils: @staticmethod def get_requested_anthropic_messages_optional_param( @@ -20,7 +33,7 @@ class AnthropicMessagesRequestUtils: Returns: AnthropicMessagesRequestOptionalParams instance with only the valid parameters """ - valid_keys = get_type_hints(AnthropicMessagesRequestOptionalParams).keys() + valid_keys = _anthropic_messages_optional_param_keys() filtered_params = { k: v for k, v in params.items() if k in valid_keys and v is not None } diff --git a/litellm/llms/azure/audio_transcription/__init__.py b/litellm/llms/azure/audio_transcription/__init__.py new file mode 100644 index 00000000000..cedd0c6dbeb --- /dev/null +++ b/litellm/llms/azure/audio_transcription/__init__.py @@ -0,0 +1,3 @@ +from .transformation import AzureSpeechAudioTranscriptionConfig + +__all__ = ["AzureSpeechAudioTranscriptionConfig"] diff --git a/litellm/llms/azure/audio_transcription/transformation.py b/litellm/llms/azure/audio_transcription/transformation.py new file mode 100644 index 00000000000..e478c8ebf35 --- /dev/null +++ b/litellm/llms/azure/audio_transcription/transformation.py @@ -0,0 +1,224 @@ +""" +Azure AI Speech (Cognitive Services) speech-to-text transformation. + +Maps OpenAI-compatible audio transcription calls to Azure Speech REST +recognition for short audio. +""" + +from typing import Any, Dict, List, Optional, Union +from urllib.parse import urlencode, urlparse + +import httpx + +from litellm.litellm_core_utils.audio_utils.utils import process_audio_file +from litellm.llms.base_llm.audio_transcription.transformation import ( + AudioTranscriptionRequestData, + BaseAudioTranscriptionConfig, +) +from litellm.llms.base_llm.chat.transformation import BaseLLMException +from litellm.types.llms.openai import ( + AllMessageValues, + OpenAIAudioTranscriptionOptionalParams, +) +from litellm.secret_managers.main import get_secret_str +from litellm.types.utils import FileTypes, TranscriptionResponse + + +class AzureSpeechAudioTranscriptionException(BaseLLMException): + pass + + +class AzureSpeechAudioTranscriptionConfig(BaseAudioTranscriptionConfig): + """ + Configuration for Azure AI Speech (Cognitive Services) STT. + + Reference: + https://learn.microsoft.com/en-us/azure/ai-services/speech-service/rest-speech-to-text-short + """ + + COGNITIVE_SERVICES_DOMAIN = "api.cognitive.microsoft.com" + STT_SPEECH_DOMAIN = "stt.speech.microsoft.com" + STT_ENDPOINT_PATH = "/speech/recognition/conversation/cognitiveservices/v1" + DEFAULT_LANGUAGE = "en-US" + + def get_supported_openai_params( + self, model: str + ) -> List[OpenAIAudioTranscriptionOptionalParams]: + return ["language", "response_format"] + + def map_openai_params( + self, + non_default_params: dict, + optional_params: dict, + model: str, + drop_params: bool, + ) -> dict: + supported_params = self.get_supported_openai_params(model=model) + for key, value in non_default_params.items(): + if key in supported_params: + optional_params[key] = value + return optional_params + + def validate_environment( + self, + headers: dict, + model: str, + messages: List[AllMessageValues], + optional_params: dict, + litellm_params: dict, + api_key: Optional[str] = None, + api_base: Optional[str] = None, + ) -> dict: + api_key = api_key or get_secret_str("AZURE_SPEECH_API_KEY") + if not api_key: + raise AzureSpeechAudioTranscriptionException( + message="api_key is required for Azure AI Speech transcription.", + status_code=401, + ) + + validated_headers = headers.copy() + validated_headers["Ocp-Apim-Subscription-Key"] = api_key + validated_headers["Content-Type"] = validated_headers.get( + "Content-Type", "audio/wav" + ) + validated_headers["Accept"] = "application/json" + return validated_headers + + def get_complete_url( + self, + api_base: Optional[str], + api_key: Optional[str], + model: str, + optional_params: dict, + litellm_params: dict, + stream: Optional[bool] = None, + ) -> str: + api_base = api_base or get_secret_str("AZURE_SPEECH_API_BASE") + if api_base is None: + raise AzureSpeechAudioTranscriptionException( + message=( + "api_base is required for Azure AI Speech transcription. " + "Use a Cognitive Services endpoint like " + "https://{region}.api.cognitive.microsoft.com or an STT " + "endpoint like https://{region}.stt.speech.microsoft.com." + ), + status_code=400, + ) + + base_url = self._resolve_stt_base_url(api_base=api_base) + query_params = { + "language": optional_params.get("language", self.DEFAULT_LANGUAGE), + "format": self._get_azure_response_format( + optional_params.get("response_format") + ), + } + return f"{base_url}{self.STT_ENDPOINT_PATH}?{urlencode(query_params)}" + + def transform_audio_transcription_request( + self, + model: str, + audio_file: FileTypes, + optional_params: dict, + litellm_params: dict, + ) -> AudioTranscriptionRequestData: + processed_audio = process_audio_file(audio_file) + return AudioTranscriptionRequestData( + data=processed_audio.file_content, + files=None, + content_type=processed_audio.content_type, + ) + + def transform_audio_transcription_response( + self, + raw_response: httpx.Response, + ) -> TranscriptionResponse: + response_json = raw_response.json() + recognition_status = response_json.get("RecognitionStatus") + if recognition_status is not None and recognition_status != "Success": + raise AzureSpeechAudioTranscriptionException( + message=( + "Azure AI Speech transcription failed with " + f"RecognitionStatus={recognition_status}." + ), + status_code=raw_response.status_code, + headers=raw_response.headers, + ) + + text = self._extract_text(response_json) + response = TranscriptionResponse(text=text) + response._hidden_params = response_json + return response + + def get_error_class( + self, error_message: str, status_code: int, headers: Union[dict, httpx.Headers] + ) -> BaseLLMException: + return AzureSpeechAudioTranscriptionException( + message=error_message, + status_code=status_code, + headers=headers, + ) + + def _resolve_stt_base_url(self, api_base: str) -> str: + api_base = api_base.rstrip("/") + parsed_url = urlparse(api_base) + hostname = parsed_url.hostname or "" + + if self._is_cognitive_services_endpoint(hostname=hostname): + region = self._extract_region_from_hostname( + hostname=hostname, domain=self.COGNITIVE_SERVICES_DOMAIN + ) + return self._build_stt_base_url(region=region) + + if self._is_stt_endpoint(hostname=hostname): + return f"{parsed_url.scheme}://{hostname}" + + if self._is_azure_openai_endpoint(hostname=hostname): + raise AzureSpeechAudioTranscriptionException( + message=( + "Azure AI Speech transcription requires a Cognitive Services " + "or STT Speech endpoint, not an Azure OpenAI endpoint." + ), + status_code=400, + ) + + return api_base + + def _is_cognitive_services_endpoint(self, hostname: str) -> bool: + return hostname == self.COGNITIVE_SERVICES_DOMAIN or hostname.endswith( + f".{self.COGNITIVE_SERVICES_DOMAIN}" + ) + + def _is_stt_endpoint(self, hostname: str) -> bool: + return hostname == self.STT_SPEECH_DOMAIN or hostname.endswith( + f".{self.STT_SPEECH_DOMAIN}" + ) + + def _is_azure_openai_endpoint(self, hostname: str) -> bool: + return hostname.endswith(".openai.azure.com") + + def _extract_region_from_hostname(self, hostname: str, domain: str) -> str: + if hostname.endswith(f".{domain}"): + return hostname[: -len(f".{domain}")] + return "" + + def _build_stt_base_url(self, region: str) -> str: + if region: + return f"https://{region}.{self.STT_SPEECH_DOMAIN}" + return f"https://{self.STT_SPEECH_DOMAIN}" + + def _get_azure_response_format(self, response_format: Optional[str]) -> str: + if response_format == "verbose_json": + return "detailed" + return "simple" + + def _extract_text(self, response_json: Dict[str, Any]) -> str: + if isinstance(response_json.get("DisplayText"), str): + return response_json["DisplayText"] + + nbest = response_json.get("NBest") + if isinstance(nbest, list) and nbest: + best = nbest[0] + if isinstance(best, dict): + return best.get("Display") or best.get("Lexical") or "" + + return "" diff --git a/litellm/llms/azure/azure.py b/litellm/llms/azure/azure.py index 9291269d153..734b8ecef16 100644 --- a/litellm/llms/azure/azure.py +++ b/litellm/llms/azure/azure.py @@ -239,7 +239,9 @@ class AzureChatCompletion(BaseAzureLLM, BaseLLM): ) data = {"model": None, "messages": messages, **optional_params} - elif litellm.AzureOpenAIGPT5Config.is_model_gpt_5_model(model=model): + elif litellm.AzureOpenAIGPT5Config.is_model_gpt_5_model( + model=litellm_params.get("base_model") or model + ): data = litellm.AzureOpenAIGPT5Config().transform_request( model=model, messages=messages, diff --git a/litellm/llms/azure/chat/o_series_transformation.py b/litellm/llms/azure/chat/o_series_transformation.py index cae7513245c..0a73597a4e4 100644 --- a/litellm/llms/azure/chat/o_series_transformation.py +++ b/litellm/llms/azure/chat/o_series_transformation.py @@ -4,10 +4,10 @@ Support for o1 and o3 model families https://platform.openai.com/docs/guides/reasoning Translations handled by LiteLLM: -- modalities: image => drop param (if user opts in to dropping param) -- role: system ==> translate to role 'user' -- streaming => faked by LiteLLM -- Tools, response_format => drop param (if user opts in to dropping param) +- modalities: image => drop param (if user opts in to dropping param) +- role: system ==> translate to role 'user' +- streaming => faked by LiteLLM +- Tools, response_format => drop param (if user opts in to dropping param) - Logprobs => drop param (if user opts in to dropping param) - Temperature => drop param (if user opts in to dropping param) """ diff --git a/litellm/llms/azure/containers/transformation.py b/litellm/llms/azure/containers/transformation.py index 586b2e379a0..cd897511585 100644 --- a/litellm/llms/azure/containers/transformation.py +++ b/litellm/llms/azure/containers/transformation.py @@ -1,9 +1,16 @@ from typing import Optional +from urllib.parse import parse_qs, urlparse, urlunparse from litellm.llms.azure.common_utils import BaseAzureLLM from litellm.llms.openai.containers.transformation import OpenAIContainerConfig from litellm.types.router import GenericLiteLLMParams +# Endpoint-specific path suffixes that may appear in a deployment's api_base +# (e.g. the responses endpoint URL is stored as api_base for Azure models). +# Strip these before building the containers URL so we always start from the +# resource root (https://resource.cognitiveservices.azure.com). +_AZURE_ENDPOINT_PATHS = ("/openai/responses",) + class AzureContainerConfig(OpenAIContainerConfig): """ @@ -27,6 +34,27 @@ class AzureContainerConfig(OpenAIContainerConfig): litellm_params=GenericLiteLLMParams(api_key=api_key), ) + @staticmethod + def _normalize_api_base(api_base: Optional[str]) -> Optional[str]: + """Strip endpoint-specific path suffixes from api_base to get the resource root.""" + if not api_base: + return api_base + parsed = urlparse(api_base) + path = parsed.path.rstrip("/") + for ep in _AZURE_ENDPOINT_PATHS: + if path.endswith(ep): + return urlunparse( + (parsed.scheme, parsed.netloc, path[: -len(ep)], "", "", "") + ) + return api_base + + @staticmethod + def _extract_api_version(api_base: Optional[str]) -> Optional[str]: + """Return the api-version query param from api_base if present.""" + if not api_base: + return None + return parse_qs(urlparse(api_base).query).get("api-version", [None])[0] + def get_complete_url( self, api_base: Optional[str], @@ -39,10 +67,19 @@ class AzureContainerConfig(OpenAIContainerConfig): {endpoint}/openai/v1/containers when api_version is 'v1', 'latest', or 'preview'; otherwise: {endpoint}/openai/containers + + The deployment's api_base may be the responses endpoint URL + (e.g. .../openai/responses?api-version=2025-04-01-preview). We + prefer the api-version embedded there over the deployment's + api_version field, which may point to an older chat API version. """ + effective_params = dict(litellm_params) + api_version_from_base = self._extract_api_version(api_base) + if api_version_from_base: + effective_params["api_version"] = api_version_from_base return BaseAzureLLM._get_base_azure_url( - api_base=api_base, - litellm_params=litellm_params, + api_base=self._normalize_api_base(api_base), + litellm_params=effective_params, route="/openai/containers", default_api_version="v1", ) diff --git a/litellm/llms/azure/image_edit/transformation.py b/litellm/llms/azure/image_edit/transformation.py index 0b6ecfb0767..a450ee0b217 100644 --- a/litellm/llms/azure/image_edit/transformation.py +++ b/litellm/llms/azure/image_edit/transformation.py @@ -3,8 +3,10 @@ from typing import Optional, cast import httpx import litellm +from litellm.llms.azure.common_utils import BaseAzureLLM from litellm.llms.openai.image_edit.transformation import OpenAIImageEditConfig from litellm.secret_managers.main import get_secret_str +from litellm.types.router import GenericLiteLLMParams from litellm.utils import _add_path_to_api_base @@ -30,20 +32,42 @@ class AzureImageEditConfig(OpenAIImageEditConfig): litellm_params: Optional[dict] = None, api_base: Optional[str] = None, ) -> dict: - api_key = ( - api_key - or litellm.api_key - or litellm.azure_key - or get_secret_str("AZURE_OPENAI_API_KEY") - or get_secret_str("AZURE_API_KEY") - ) + """ + Validate Azure environment and set up authentication headers. - headers.update( - { - "Authorization": f"Bearer {api_key}", - } + Delegates to ``BaseAzureLLM._base_validate_azure_environment`` so the + Azure image-edit route uses the same auth resolution as every other + Azure provider (videos, vector_stores, responses, containers, ...): + + - prefers the Azure-style ``api-key`` header when an API key is available + - falls back to ``Authorization: Bearer `` only when AAD + auth is configured + + The previous implementation unconditionally set + ``Authorization: Bearer ``, which is correct for OpenAI direct + but not for Azure OpenAI / API Management gateways that expect the + ``api-key`` header. Subscription-key-based deployments (e.g., behind + Azure APIM) responded with ``401 "Access denied due to missing + subscription key"``. + + API-key precedence (matches ``AzureVideosConfig``): + + - ``litellm_params["api_key"]`` is the source of truth. + - The positional ``api_key`` kwarg only fills in when + ``litellm_params["api_key"]`` is empty. + - This is a deliberate change from the old ``or`` chain (where the + positional ``api_key`` argument won) so behavior matches every other + Azure ``validate_environment`` implementation. In production the only + caller (``llm_http_handler.image_edit``) sources both values from + the same ``litellm_params.api_key``, so the precedence only matters + for direct callers of this method. + """ + params = GenericLiteLLMParams(**(litellm_params or {})) + if api_key is not None and params.api_key is None: + params.api_key = api_key + return BaseAzureLLM._base_validate_azure_environment( + headers=headers, litellm_params=params ) - return headers def get_complete_url( self, diff --git a/litellm/llms/azure_ai/embed/cohere_transformation.py b/litellm/llms/azure_ai/embed/cohere_transformation.py index 64433c21b61..bbbfb60fbde 100644 --- a/litellm/llms/azure_ai/embed/cohere_transformation.py +++ b/litellm/llms/azure_ai/embed/cohere_transformation.py @@ -1,5 +1,5 @@ """ -Transformation logic from OpenAI /v1/embeddings format to Azure AI Cohere's /v1/embed. +Transformation logic from OpenAI /v1/embeddings format to Azure AI Cohere's /v1/embed. Why separate file? Make it easy to see how transformation works diff --git a/litellm/llms/azure_ai/rerank/transformation.py b/litellm/llms/azure_ai/rerank/transformation.py index b5993040ea0..f64133afa8b 100644 --- a/litellm/llms/azure_ai/rerank/transformation.py +++ b/litellm/llms/azure_ai/rerank/transformation.py @@ -1,5 +1,5 @@ """ -Translate between Cohere's `/rerank` format and Azure AI's `/rerank` format. +Translate between Cohere's `/rerank` format and Azure AI's `/rerank` format. """ from typing import Optional diff --git a/litellm/llms/base_llm/agents/__init__.py b/litellm/llms/base_llm/agents/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/litellm/llms/base_llm/agents/transformation.py b/litellm/llms/base_llm/agents/transformation.py new file mode 100644 index 00000000000..508e54cb7ab --- /dev/null +++ b/litellm/llms/base_llm/agents/transformation.py @@ -0,0 +1,165 @@ +""" +Base transformation class for provider-side Agents API. + +Providers that have a native agents CRUD API (e.g. Gemini v1beta/agents) +subclass BaseAgentsAPIConfig and implement the abstract methods. + +The HTTP calls are handled by AgentsHTTPHandler — this class is pure +transform logic (same separation as BaseInteractionsAPIConfig / +InteractionsHTTPHandler). +""" + +from abc import ABC, abstractmethod +from typing import Any, Dict, Optional, Tuple, Union + +import httpx + +from litellm.types.agents import ( + AgentCreateResponse, + AgentDeleteResult, + AgentListResponse, + AgentVersionsResponse, +) + + +class BaseAgentsAPIConfig(ABC): + """ + Minimal interface for providers that expose a native agents CRUD API. + """ + + # ------------------------------------------------------------------ # + # CREATE # + # ------------------------------------------------------------------ # + + @abstractmethod + def get_complete_url( + self, + api_base: Optional[str], + litellm_params: Dict[str, Any], + ) -> str: + """Return the full URL for POST /agents (create).""" + + @abstractmethod + def validate_environment( + self, + headers: Dict[str, str], + litellm_params: Dict[str, Any], + ) -> Dict[str, str]: + """Validate credentials and return auth headers.""" + + @abstractmethod + def transform_create_request( + self, + name: str, + litellm_params: Dict[str, Any], + ) -> Dict[str, Any]: + """Map name + litellm_params to the provider's create-agent body.""" + + @abstractmethod + def transform_create_response( + self, + raw_response: httpx.Response, + name: str, + ) -> AgentCreateResponse: + """Parse create response. Raise on non-2xx.""" + + # ------------------------------------------------------------------ # + # LIST # + # ------------------------------------------------------------------ # + + @abstractmethod + def transform_list_request( + self, + api_base: Optional[str], + litellm_params: Dict[str, Any], + ) -> Tuple[str, Dict[str, Any]]: + """Return (url, query_params) for GET /agents.""" + + @abstractmethod + def transform_list_response( + self, + raw_response: httpx.Response, + ) -> AgentListResponse: + """Parse list-agents response. Raise on non-2xx.""" + + # ------------------------------------------------------------------ # + # GET # + # ------------------------------------------------------------------ # + + @abstractmethod + def transform_get_request( + self, + name: str, + api_base: Optional[str], + litellm_params: Dict[str, Any], + ) -> Tuple[str, Dict[str, Any]]: + """Return (url, query_params) for GET /agents/{name}.""" + + @abstractmethod + def transform_get_response( + self, + raw_response: httpx.Response, + name: str, + ) -> AgentCreateResponse: + """Parse get-agent response. Raise on non-2xx.""" + + # ------------------------------------------------------------------ # + # DELETE # + # ------------------------------------------------------------------ # + + @abstractmethod + def transform_delete_request( + self, + name: str, + api_base: Optional[str], + litellm_params: Dict[str, Any], + ) -> str: + """Return the URL for DELETE /agents/{name}.""" + + @abstractmethod + def transform_delete_response( + self, + raw_response: httpx.Response, + name: str, + ) -> AgentDeleteResult: + """Parse delete-agent response. Raise on non-2xx.""" + + # ------------------------------------------------------------------ # + # LIST VERSIONS # + # ------------------------------------------------------------------ # + + @abstractmethod + def transform_list_versions_request( + self, + name: str, + api_base: Optional[str], + litellm_params: Dict[str, Any], + ) -> Tuple[str, Dict[str, Any]]: + """Return (url, query_params) for GET /agents/{name}/versions.""" + + @abstractmethod + def transform_list_versions_response( + self, + raw_response: httpx.Response, + name: str, + ) -> AgentVersionsResponse: + """Parse list-versions response. Raise on non-2xx.""" + + # ------------------------------------------------------------------ # + # ERROR HANDLING # + # ------------------------------------------------------------------ # + + def get_error_class( + self, + error_message: str, + status_code: int, + headers: Union[dict, httpx.Headers], + ) -> Exception: + """Map HTTP error status codes to provider-specific exceptions.""" + from litellm.llms.base_llm.chat.transformation import BaseLLMException + + return BaseLLMException( + status_code=status_code, + message=error_message, + headers=headers, + ) diff --git a/litellm/llms/base_llm/guardrail_translation/utils.py b/litellm/llms/base_llm/guardrail_translation/utils.py index cdd2d775371..97ece6b5eab 100644 --- a/litellm/llms/base_llm/guardrail_translation/utils.py +++ b/litellm/llms/base_llm/guardrail_translation/utils.py @@ -14,7 +14,22 @@ def effective_skip_system_message_for_guardrail(guardrail_to_apply: Any) -> bool return bool(getattr(litellm, "skip_system_message_in_guardrail", False)) +def effective_skip_tool_message_for_guardrail(guardrail_to_apply: Any) -> bool: + per = getattr(guardrail_to_apply, "skip_tool_message_in_guardrail", None) + if per is not None: + return bool(per) + import litellm + + return bool(getattr(litellm, "skip_tool_message_in_guardrail", False)) + + def openai_messages_without_system( messages: List[AllMessageValues], ) -> List[AllMessageValues]: return [m for m in messages if str((m or {}).get("role") or "").lower() != "system"] + + +def openai_messages_without_tool( + messages: List[AllMessageValues], +) -> List[AllMessageValues]: + return [m for m in messages if str((m or {}).get("role") or "").lower() != "tool"] diff --git a/litellm/llms/base_llm/ocr/transformation.py b/litellm/llms/base_llm/ocr/transformation.py index b7f4d8e3b2d..263e0c094ce 100644 --- a/litellm/llms/base_llm/ocr/transformation.py +++ b/litellm/llms/base_llm/ocr/transformation.py @@ -54,6 +54,7 @@ class OCRUsageInfo(LiteLLMPydanticObjectBase): """Usage information from OCR response.""" pages_processed: Optional[int] = None + credits: Optional[float] = None doc_size_bytes: Optional[int] = None model_config = {"extra": "allow"} diff --git a/litellm/llms/bedrock/base_aws_llm.py b/litellm/llms/bedrock/base_aws_llm.py index 0885775932c..b659c1b0a0a 100644 --- a/litellm/llms/bedrock/base_aws_llm.py +++ b/litellm/llms/bedrock/base_aws_llm.py @@ -44,6 +44,12 @@ else: # (e.g. "us-east-1", "eu-west-2", "us-gov-west-1", "cn-north-1"). _VALID_AWS_REGION_PATTERN = re.compile(r"\A[a-z0-9-]+\Z") +# Regional STS hostnames, e.g. sts.eu-west-1.amazonaws.com or +# vpce-xxx.sts.eu-west-1.vpce.amazonaws.com +_STS_REGION_FROM_ENDPOINT_PATTERN = re.compile( + r"(?:^|\.)sts(?:-fips)?\.([a-z0-9-]+)\.(?:amazonaws\.com(?:\.cn)?|vpce\.amazonaws\.com)" +) + class Boto3CredentialsInfo(BaseModel): credentials: Credentials @@ -450,6 +456,24 @@ class BaseAWSLLM: model_id = BaseAWSLLM.encode_model_id(model_id=model_id) else: model_id = model + # Strip LiteLLM routing prefixes (e.g. "bedrock/", "invoke/", + # "bedrock/invoke/", "bedrock/converse/") that are not part of the + # actual Bedrock model ID. The converse path already does this; the + # invoke path must do the same so that ARN models such as + # bedrock/arn:aws:bedrock:…:inference-profile/global.anthropic.… + # are not forwarded verbatim to the Bedrock API, which would produce + # a malformed URL and cause botocore's EventStreamBuffer to receive + # a JSON error body instead of a binary event-stream — surfaced as a + # misleading ChecksumMismatch (0x223a7b22 == ':{"'). + # Use strip_bedrock_routing_prefix (no break) so compound prefixes + # like "bedrock/invoke/arn:..." are fully stripped in one call. + from litellm.llms.bedrock.common_utils import strip_bedrock_routing_prefix + + model_id = strip_bedrock_routing_prefix(model_id) + # URL-encode ARNs so colons and slashes are safe in the URL path. + if model_id.startswith("arn:"): + model_id = BaseAWSLLM.encode_model_id(model_id=model_id) + return model_id model_id = model_id.replace("invoke/", "", 1) if provider == "llama" and "llama/" in model_id: @@ -633,6 +657,40 @@ class BaseAWSLLM: "Region names must contain only lowercase letters, digits, and hyphens." ) + @staticmethod + def _parse_sts_region_from_endpoint( + aws_sts_endpoint: Optional[str], + ) -> Optional[str]: + """Extract region from sts.{region}.amazonaws.com or vpce-x.sts.{region}.vpce.amazonaws.com.""" + if not aws_sts_endpoint: + return None + host = urllib.parse.urlparse(aws_sts_endpoint).hostname or "" + match = _STS_REGION_FROM_ENDPOINT_PATTERN.search(host) + return match.group(1) if match else None + + @staticmethod + def _resolve_sts_region(aws_sts_endpoint: Optional[str] = None) -> Optional[str]: + """STS signing region: parsed from aws_sts_endpoint else AWS_REGION / AWS_DEFAULT_REGION.""" + return ( + BaseAWSLLM._parse_sts_region_from_endpoint(aws_sts_endpoint) + or os.getenv("AWS_REGION") + or os.getenv("AWS_DEFAULT_REGION") + ) + + def _build_sts_client_kwargs( + self, + aws_sts_endpoint: Optional[str] = None, + ssl_verify: Optional[Union[bool, str]] = None, + ) -> dict: + """STS client kwargs with aligned endpoint_url and region_name (SigV4).""" + kwargs: dict = {"verify": self._get_ssl_verify(ssl_verify)} + if aws_sts_endpoint is not None: + kwargs["endpoint_url"] = aws_sts_endpoint + sts_region = self._resolve_sts_region(aws_sts_endpoint) + if sts_region is not None: + kwargs["region_name"] = sts_region + return kwargs + def get_aws_region_name_for_non_llm_api_calls( self, aws_region_name: Optional[str] = None, @@ -787,11 +845,6 @@ class BaseAWSLLM: f"IN Web Identity Token: {aws_web_identity_token} | Role Name: {aws_role_name} | Session Name: {aws_session_name}" ) - if aws_sts_endpoint is None: - sts_endpoint = f"https://sts.{aws_region_name}.amazonaws.com" - else: - sts_endpoint = aws_sts_endpoint - oidc_token = get_secret(aws_web_identity_token) if oidc_token is None: @@ -800,13 +853,13 @@ class BaseAWSLLM: status_code=401, ) + sts_client_kwargs = self._build_sts_client_kwargs( + aws_sts_endpoint=aws_sts_endpoint, + ssl_verify=ssl_verify, + ) + with tracer.trace("boto3.client(sts)"): - sts_client = boto3.client( - "sts", - region_name=aws_region_name, - endpoint_url=sts_endpoint, - verify=self._get_ssl_verify(ssl_verify), - ) + sts_client = boto3.client("sts", **sts_client_kwargs) # https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html # https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sts/client/assume_role_with_web_identity.html @@ -847,7 +900,6 @@ class BaseAWSLLM: irsa_role_arn: str, aws_role_name: str, aws_session_name: str, - region: str, web_identity_token_file: str, aws_external_id: Optional[str] = None, aws_sts_endpoint: Optional[str] = None, @@ -862,12 +914,10 @@ class BaseAWSLLM: with open(web_identity_token_file, "r") as f: web_identity_token = f.read().strip() - irsa_sts_kwargs: dict = { - "region_name": region, - "verify": self._get_ssl_verify(ssl_verify), - } - if aws_sts_endpoint is not None: - irsa_sts_kwargs["endpoint_url"] = aws_sts_endpoint + irsa_sts_kwargs = self._build_sts_client_kwargs( + aws_sts_endpoint=aws_sts_endpoint, + ssl_verify=ssl_verify, + ) # Create an STS client without credentials with tracer.trace("boto3.client(sts) for manual IRSA"): @@ -924,7 +974,6 @@ class BaseAWSLLM: self, aws_role_name: str, aws_session_name: str, - region: str, aws_external_id: Optional[str] = None, aws_sts_endpoint: Optional[str] = None, ssl_verify: Optional[Union[bool, str]] = None, @@ -932,12 +981,10 @@ class BaseAWSLLM: """Handle same-account role assumption for IRSA.""" import boto3 - irsa_sts_kwargs: dict = { - "region_name": region, - "verify": self._get_ssl_verify(ssl_verify), - } - if aws_sts_endpoint is not None: - irsa_sts_kwargs["endpoint_url"] = aws_sts_endpoint + irsa_sts_kwargs = self._build_sts_client_kwargs( + aws_sts_endpoint=aws_sts_endpoint, + ssl_verify=ssl_verify, + ) verbose_logger.debug("Same account role assumption, using automatic IRSA") with tracer.trace("boto3.client(sts) with automatic IRSA"): @@ -1010,12 +1057,6 @@ class BaseAWSLLM: web_identity_token_file = os.getenv("AWS_WEB_IDENTITY_TOKEN_FILE") irsa_role_arn = os.getenv("AWS_ROLE_ARN") - region = ( - aws_region_name - or os.getenv("AWS_REGION") - or os.getenv("AWS_DEFAULT_REGION") - ) - # If we have IRSA environment variables and no explicit credentials, # we need to use the web identity token flow if ( @@ -1031,16 +1072,12 @@ class BaseAWSLLM: ) try: - # Use passed-in region when set, else env, else default (align with AssumeRole path) - region = region or "us-east-1" - # Check if we need to do cross-account role assumption if aws_role_name != irsa_role_arn: sts_response = self._handle_irsa_cross_account( irsa_role_arn, aws_role_name, aws_session_name, - region, web_identity_token_file, aws_external_id, aws_sts_endpoint=aws_sts_endpoint, @@ -1050,7 +1087,6 @@ class BaseAWSLLM: sts_response = self._handle_irsa_same_account( aws_role_name, aws_session_name, - region, aws_external_id, aws_sts_endpoint=aws_sts_endpoint, ssl_verify=ssl_verify, @@ -1074,11 +1110,10 @@ class BaseAWSLLM: # In EKS/IRSA environments, use ambient credentials (no explicit keys needed) # This allows the web identity token to work automatically - sts_client_kwargs: dict = {"verify": self._get_ssl_verify(ssl_verify)} - if region is not None: - sts_client_kwargs["region_name"] = region - if aws_sts_endpoint is not None: - sts_client_kwargs["endpoint_url"] = aws_sts_endpoint + sts_client_kwargs = self._build_sts_client_kwargs( + aws_sts_endpoint=aws_sts_endpoint, + ssl_verify=ssl_verify, + ) if aws_access_key_id is None and aws_secret_access_key is None: with tracer.trace("boto3.client(sts)"): sts_client = boto3.client("sts", **sts_client_kwargs) @@ -1428,7 +1463,13 @@ class BaseAWSLLM: def _sign_request( self, - service_name: Literal["bedrock", "sagemaker", "bedrock-agentcore", "s3vectors"], + service_name: Literal[ + "bedrock", + "sagemaker", + "bedrock-agentcore", + "s3vectors", + "aws-external-anthropic", + ], headers: dict, optional_params: dict, request_data: dict, diff --git a/litellm/llms/bedrock/batches/handler.py b/litellm/llms/bedrock/batches/handler.py index f141bbd9ab4..c071f331337 100644 --- a/litellm/llms/bedrock/batches/handler.py +++ b/litellm/llms/bedrock/batches/handler.py @@ -1,8 +1,79 @@ +from datetime import datetime +from typing import Any, Optional, cast + from openai.types.batch import BatchRequestCounts from openai.types.batch import Metadata as OpenAIBatchMetadata from litellm.types.utils import LiteLLMBatch +# AWS Bedrock model-invocation-job statuses → OpenAI Batch statuses. +# Mirrors the mapping used by `BedrockBatchesConfig.transform_create_batch_response` +# so create / retrieve return consistent statuses. +_BEDROCK_MIJ_STATUS_TO_OPENAI = { + "Submitted": "validating", + "Validating": "validating", + "Scheduled": "validating", + "InProgress": "in_progress", + "Stopping": "cancelling", + "Stopped": "cancelled", + "Completed": "completed", + "PartiallyCompleted": "completed", + "Failed": "failed", + "Expired": "expired", +} + + +def _extract_region_from_bedrock_arn(arn: str) -> Optional[str]: + """ARN shape: ``arn:aws:bedrock:::/``""" + try: + parts = arn.split(":") + if len(parts) >= 4 and parts[2] == "bedrock": + return parts[3] or None + except Exception: + pass + return None + + +def _extract_job_id_from_arn(arn: str) -> Optional[str]: + """``arn:aws:bedrock:::model-invocation-job/`` -> ````.""" + if ":model-invocation-job/" not in arn: + return None + return arn.rsplit("/", 1)[-1] or None + + +def _predict_output_file_uri( + output_prefix: str, input_uri: str, job_id: Optional[str] +) -> Optional[str]: + """ + Compute the deterministic per-job result file URI Bedrock writes to. + + Bedrock lays results out as:: + + //.out + + We compute it client-side so OpenAI-style ``client.files.content(output_file_id)`` + works without an extra S3 ``ListObjectsV2`` round-trip. Returns ``None`` if we + don't have enough info; callers should fall back to the bare prefix. + """ + if not output_prefix or not input_uri or not job_id: + return None + if not output_prefix.endswith("/"): + output_prefix = output_prefix + "/" + input_basename = input_uri.rsplit("/", 1)[-1] + if not input_basename: + return None + return f"{output_prefix}{job_id}/{input_basename}.out" + + +def _to_epoch(value: Any) -> Optional[int]: + if value is None: + return None + if isinstance(value, (int, float)): + return int(value) + if isinstance(value, datetime): + return int(value.timestamp()) + return None + class BedrockBatchesHandler: """ @@ -97,3 +168,173 @@ class BedrockBatchesHandler: with concurrent.futures.ThreadPoolExecutor() as executor: future = executor.submit(run_in_thread) return future.result() + + @staticmethod + def _handle_model_invocation_job_status( + batch_id: str, + aws_region_name: Optional[str] = None, + logging_obj=None, + **kwargs, + ) -> "LiteLLMBatch": + """ + Handle ``GetModelInvocationJob`` status check for AWS Bedrock bulk batch + inference jobs (the ARN type returned by ``CreateModelInvocationJob``). + + ``CreateModelInvocationJob`` lives on the Bedrock **control plane** + (``bedrock..amazonaws.com``), distinct from the data-plane + ``bedrock-runtime`` endpoint that serves Twelve Labs async-invoke ARNs. + The two ARN families therefore can't share a handler — see + ``litellm/batches/main.py`` for the dispatch. + + Args: + batch_id: A ``arn:aws:bedrock:::model-invocation-job/`` + ARN (or just the trailing job id; both are accepted by + ``GetModelInvocationJob``). + aws_region_name: Region for the boto3 ``bedrock`` client. If omitted, + we fall back to parsing the region out of ``batch_id`` itself. + logging_obj: Optional litellm logging object. + **kwargs: Optional AWS credential overrides + (``aws_access_key_id``, ``aws_secret_access_key``, + ``aws_session_token``, ``aws_profile_name``, + ``aws_role_name``, ``aws_session_name``, + ``aws_web_identity_token``, ``aws_sts_endpoint``, + ``aws_external_id``). Unknown keys are ignored. + + Returns: + ``LiteLLMBatch`` shaped like an OpenAI Batch resource. Note that + ``request_counts`` is always ``(0, 0, 0)`` because + ``GetModelInvocationJob`` does not surface per-record counts; + callers that need accurate counts should parse + ``manifest.json.out`` from the output S3 prefix. + """ + try: + import boto3 + except ImportError as exc: + raise ImportError( + "Missing boto3 to call bedrock. Run 'pip install boto3'." + ) from exc + + # Resolve region: explicit > parsed-from-ARN > us-east-1 (boto3 default). + region = ( + aws_region_name or _extract_region_from_bedrock_arn(batch_id) or "us-east-1" + ) + + # Resolve credentials through the same path the rest of the bedrock + # provider uses, so model_list / env / role-assumption configs are + # honored. We instantiate BedrockBatchesConfig (which extends + # BaseAWSLLM) lazily to avoid a circular import at module load. + from litellm.llms.bedrock.batches.transformation import BedrockBatchesConfig + + creds = BedrockBatchesConfig().get_credentials( + aws_access_key_id=kwargs.get("aws_access_key_id"), + aws_secret_access_key=kwargs.get("aws_secret_access_key"), + aws_session_token=kwargs.get("aws_session_token"), + aws_region_name=region, + aws_session_name=kwargs.get("aws_session_name"), + aws_profile_name=kwargs.get("aws_profile_name"), + aws_role_name=kwargs.get("aws_role_name"), + aws_web_identity_token=kwargs.get("aws_web_identity_token"), + aws_sts_endpoint=kwargs.get("aws_sts_endpoint"), + aws_external_id=kwargs.get("aws_external_id"), + ) + + client = boto3.client( + "bedrock", + region_name=region, + aws_access_key_id=creds.access_key, + aws_secret_access_key=creds.secret_key, + aws_session_token=creds.token, + ) + + if logging_obj is not None: + # Use the bare job id in the logged URL so we don't double up the + # `model-invocation-job/` segment when `batch_id` is a full ARN. + # `GetModelInvocationJob` accepts either form, but only the bare id + # produces a sensible-looking URL in logs. + url_path_id = _extract_job_id_from_arn(batch_id) or batch_id + logging_obj.pre_call( + input=batch_id, + api_key="", + additional_args={ + "complete_input_dict": {"jobIdentifier": batch_id}, + "api_base": ( + f"https://bedrock.{region}.amazonaws.com/" + f"model-invocation-job/{url_path_id}" + ), + }, + ) + + response = client.get_model_invocation_job(jobIdentifier=batch_id) + + if logging_obj is not None: + logging_obj.post_call( + input=batch_id, + api_key="", + original_response=response, + additional_args={"complete_input_dict": {"jobIdentifier": batch_id}}, + ) + + bedrock_status = str(response.get("status", "")) + openai_status = cast( + Any, + _BEDROCK_MIJ_STATUS_TO_OPENAI.get(bedrock_status, "in_progress"), + ) + + input_uri = ( + response.get("inputDataConfig", {}) + .get("s3InputDataConfig", {}) + .get("s3Uri", "") + ) + output_prefix = ( + response.get("outputDataConfig", {}) + .get("s3OutputDataConfig", {}) + .get("s3Uri", "") + ) + + # Bedrock returns the output *prefix* the user supplied at job creation. + # Actual results land at //.out — we + # surface that single-file URI as `output_file_id` so the OpenAI-style + # download flow works without an extra S3 listing call. We deliberately + # do NOT fall back to the bare prefix when prediction fails: a prefix + # is not a downloadable object, so handing it back as `output_file_id` + # would reproduce the very NoSuchKey bug this handler exists to fix. + # The bare prefix is preserved in metadata for callers that want the + # `manifest.json.out` or want to do their own listing. + job_arn = response.get("jobArn", batch_id) + job_id = _extract_job_id_from_arn(job_arn) + output_file_uri = _predict_output_file_uri(output_prefix, input_uri, job_id) + + completed_at = _to_epoch(response.get("endTime")) + + # Note: metadata uses "" (not None) for unknown URIs to satisfy the + # OpenAI Batch metadata schema, which is `dict[str, str]`. The + # `output_file_id` field on the LiteLLMBatch itself does carry None + # correctly (see below), so callers should branch on that, not on + # `metadata["output_file_uri"]`. + openai_batch_metadata: OpenAIBatchMetadata = { + "model_arn": response.get("modelId", ""), + "job_arn": job_arn, + "job_name": response.get("jobName", ""), + "failure_message": response.get("message") or "", + "input_s3_uri": input_uri, + "output_s3_uri": output_prefix, + "output_file_uri": output_file_uri or "", + } + + return LiteLLMBatch( + id=job_arn, + object="batch", + status=openai_status, + created_at=_to_epoch(response.get("submitTime")) or 0, + in_progress_at=_to_epoch(response.get("lastModifiedTime")), + completed_at=completed_at if openai_status == "completed" else None, + failed_at=completed_at if openai_status == "failed" else None, + cancelled_at=completed_at if openai_status == "cancelled" else None, + expired_at=completed_at if openai_status == "expired" else None, + request_counts=BatchRequestCounts(total=0, completed=0, failed=0), + metadata=openai_batch_metadata, + completion_window="24h", + endpoint="/v1/chat/completions", + input_file_id=input_uri, + output_file_id=output_file_uri if openai_status == "completed" else None, + ) diff --git a/litellm/llms/bedrock/batches/transformation.py b/litellm/llms/bedrock/batches/transformation.py index 0602b1c2f62..620bc91732d 100644 --- a/litellm/llms/bedrock/batches/transformation.py +++ b/litellm/llms/bedrock/batches/transformation.py @@ -5,6 +5,7 @@ from typing import Any, Dict, List, Literal, Optional, Union, cast from httpx import Headers, Response +from litellm.litellm_core_utils.safe_json_dumps import safe_dumps from litellm.llms.base_llm.batches.transformation import BaseBatchesConfig from litellm.llms.base_llm.chat.transformation import BaseLLMException from litellm.secret_managers.main import get_secret_str @@ -263,9 +264,32 @@ class BedrockBatchesConfig(BaseAWSLLM, BaseBatchesConfig): cancelling_at=None, cancelled_at=None, request_counts=None, - metadata=original_request.get("metadata", {}), + metadata=self._get_openai_compatible_batch_metadata( + original_request.get("metadata", {}) + ), ) + @staticmethod + def _get_openai_compatible_batch_metadata(metadata: Any) -> Dict[str, str]: + """ + OpenAI Batch metadata only accepts string values. + """ + if not isinstance(metadata, dict): + return {} + + sanitized_metadata: Dict[str, str] = {} + for key, value in metadata.items(): + if key == "standard_logging_guardrail_information" or value is None: + continue + + str_key = str(key) + if isinstance(value, str): + sanitized_metadata[str_key] = value + else: + sanitized_metadata[str_key] = safe_dumps(value) + + return sanitized_metadata + def transform_retrieve_batch_request( self, batch_id: str, diff --git a/litellm/llms/bedrock/chat/invoke_agent/transformation.py b/litellm/llms/bedrock/chat/invoke_agent/transformation.py index e4072c24557..c88fa32b6a0 100644 --- a/litellm/llms/bedrock/chat/invoke_agent/transformation.py +++ b/litellm/llms/bedrock/chat/invoke_agent/transformation.py @@ -299,9 +299,9 @@ class AmazonInvokeAgentConfig(BaseConfig, BaseAWSLLM): ) def _get_response_stream_shape(self): - from litellm.llms.bedrock.common_utils import BEDROCK_RESPONSE_STREAM_SHAPE + from litellm.llms.bedrock.common_utils import get_bedrock_response_stream_shape - return BEDROCK_RESPONSE_STREAM_SHAPE + return get_bedrock_response_stream_shape() def _extract_response_content(self, events: InvokeAgentEventList) -> str: """Extract the final response content from parsed events.""" diff --git a/litellm/llms/bedrock/chat/invoke_handler.py b/litellm/llms/bedrock/chat/invoke_handler.py index 92ca75db95b..7a9916f1f31 100644 --- a/litellm/llms/bedrock/chat/invoke_handler.py +++ b/litellm/llms/bedrock/chat/invoke_handler.py @@ -68,9 +68,9 @@ from litellm.utils import CustomStreamWrapper, get_secret from ..base_aws_llm import BaseAWSLLM from ..common_utils import ( - BEDROCK_RESPONSE_STREAM_SHAPE, BedrockError, ModelResponseIterator, + get_bedrock_response_stream_shape, get_bedrock_tool_name, ) @@ -1828,7 +1828,8 @@ class AWSEventStreamDecoder: yield self._chunk_parser(chunk_data=_data) def _parse_message_from_event(self, event) -> Optional[str]: - if BEDROCK_RESPONSE_STREAM_SHAPE is None: + response_stream_shape = get_bedrock_response_stream_shape() + if response_stream_shape is None: raise BedrockError( status_code=500, message=( @@ -1837,9 +1838,7 @@ class AWSEventStreamDecoder: ), ) response_dict = event.to_response_dict() - parsed_response = self.parser.parse( - response_dict, BEDROCK_RESPONSE_STREAM_SHAPE - ) + parsed_response = self.parser.parse(response_dict, response_stream_shape) if response_dict["status_code"] != 200: decoded_body = response_dict["body"].decode() diff --git a/litellm/llms/bedrock/chat/invoke_transformations/anthropic_claude3_transformation.py b/litellm/llms/bedrock/chat/invoke_transformations/anthropic_claude3_transformation.py index c883ab68dff..d9599b8b9c4 100644 --- a/litellm/llms/bedrock/chat/invoke_transformations/anthropic_claude3_transformation.py +++ b/litellm/llms/bedrock/chat/invoke_transformations/anthropic_claude3_transformation.py @@ -3,6 +3,7 @@ from typing import TYPE_CHECKING, Any, List, Optional import httpx from litellm.anthropic_beta_headers_manager import filter_and_transform_beta_headers +from litellm.litellm_core_utils.litellm_logging import verbose_logger from litellm.litellm_core_utils.prompt_templates.factory import ( convert_to_anthropic_image_obj, ) @@ -22,6 +23,7 @@ from litellm.llms.bedrock.common_utils import ( from litellm.types.llms.anthropic import ANTHROPIC_TOOL_SEARCH_BETA_HEADER from litellm.types.llms.openai import AllMessageValues from litellm.types.utils import ModelResponse +from litellm.utils import _supports_factory if TYPE_CHECKING: from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj @@ -169,6 +171,24 @@ class AmazonAnthropicClaudeConfig(AmazonInvokeConfig, AnthropicConfig): anthropic_request.pop("model", None) anthropic_request.pop("stream", None) anthropic_request.pop("output_format", None) + if not ( + _supports_factory( + model=model, + custom_llm_provider="bedrock", + key="supports_output_config", + ) + or AnthropicConfig._model_supports_effort_param(model) + ): + if anthropic_request.pop("output_config", None) is not None: + verbose_logger.warning( + "Bedrock Invoke: stripping unsupported `output_config` for " + "model=%s — neither `supports_output_config` nor any " + "`supports_*_reasoning_effort` flag is set in " + "model_prices_and_context_window.json. Add the capability " + "flag to the model JSON entry if this model accepts " + "`output_config`.", + model, + ) if "anthropic_version" not in anthropic_request: anthropic_request["anthropic_version"] = self.anthropic_version diff --git a/litellm/llms/bedrock/chat/mantle/transformation.py b/litellm/llms/bedrock/chat/mantle/transformation.py index b9bea77c118..ef0199031af 100644 --- a/litellm/llms/bedrock/chat/mantle/transformation.py +++ b/litellm/llms/bedrock/chat/mantle/transformation.py @@ -21,7 +21,9 @@ if TYPE_CHECKING: else: LiteLLMLoggingObj = Any -MANTLE_ENDPOINT_TEMPLATE = "https://bedrock-mantle.{region}.api.aws/v1/messages" +MANTLE_ENDPOINT_TEMPLATE = ( + "https://bedrock-mantle.{region}.api.aws/anthropic/v1/messages" +) class AmazonMantleConfig(AmazonAnthropicClaudeConfig): diff --git a/litellm/llms/bedrock/claude_platform/__init__.py b/litellm/llms/bedrock/claude_platform/__init__.py new file mode 100644 index 00000000000..88d4e9783c7 --- /dev/null +++ b/litellm/llms/bedrock/claude_platform/__init__.py @@ -0,0 +1,8 @@ +from .transformation import ( + BedrockClaudePlatformConfig, +) +from .messages_transformation import ( + BedrockClaudePlatformMessagesConfig, +) + +__all__ = ["BedrockClaudePlatformConfig", "BedrockClaudePlatformMessagesConfig"] diff --git a/litellm/llms/bedrock/claude_platform/common_utils.py b/litellm/llms/bedrock/claude_platform/common_utils.py new file mode 100644 index 00000000000..3abb8710de7 --- /dev/null +++ b/litellm/llms/bedrock/claude_platform/common_utils.py @@ -0,0 +1,106 @@ +from typing import Literal, Optional, Tuple + +import litellm +from litellm.llms.bedrock.base_aws_llm import BaseAWSLLM +from litellm.secret_managers.main import get_secret_str + +CLAUDE_PLATFORM_SERVICE_NAME: Literal["aws-external-anthropic"] = ( + "aws-external-anthropic" +) +CLAUDE_PLATFORM_BEDROCK_ROUTE = "claude_platform/" + + +def strip_claude_platform_route(model: str) -> str: + if model.startswith(CLAUDE_PLATFORM_BEDROCK_ROUTE): + return model.replace(CLAUDE_PLATFORM_BEDROCK_ROUTE, "", 1) + return model + + +class BedrockClaudePlatformMixin(BaseAWSLLM): + @staticmethod + def _get_workspace_id(optional_params: dict, litellm_params: dict) -> Optional[str]: + workspace_id = ( + optional_params.get("workspace_id") + or litellm_params.get("workspace_id") + or optional_params.get("aws_workspace_id") + or litellm_params.get("aws_workspace_id") + or optional_params.get("anthropic-workspace-id") + or litellm_params.get("anthropic-workspace-id") + ) + if workspace_id is None: + workspace_id = optional_params.get( + "anthropic_workspace_id" + ) or litellm_params.get("anthropic_workspace_id") + if workspace_id is not None: + return str(workspace_id) + return get_secret_str("ANTHROPIC_AWS_WORKSPACE_ID") or get_secret_str( + "ANTHROPIC_WORKSPACE_ID" + ) + + def _get_required_aws_region_name(self, optional_params: dict) -> str: + aws_region_name = ( + optional_params.get("aws_region_name") + or get_secret_str("AWS_REGION_NAME") + or get_secret_str("AWS_REGION") + or get_secret_str("AWS_DEFAULT_REGION") + ) + if aws_region_name is None: + raise litellm.AuthenticationError( + message=( + "Missing AWS region for Claude Platform on AWS. Pass " + "`aws_region_name` or set a standard AWS region environment value." + ), + llm_provider="bedrock", + model="", + ) + self._validate_aws_region_name(str(aws_region_name)) + return str(aws_region_name) + + def get_complete_url( + self, + api_base: Optional[str], + api_key: Optional[str], + model: str, + optional_params: dict, + litellm_params: dict, + stream: Optional[bool] = None, + ) -> str: + api_base = ( + api_base + or litellm.api_base + or get_secret_str("ANTHROPIC_AWS_BASE_URL") + or get_secret_str("ANTHROPIC_AWS_API_BASE") + ) + if api_base is None: + aws_region_name = self._get_required_aws_region_name(optional_params) + api_base = ( + f"https://{CLAUDE_PLATFORM_SERVICE_NAME}.{aws_region_name}.api.aws" + ) + if not api_base.endswith("/v1/messages"): + api_base = f"{api_base.rstrip('/')}/v1/messages" + return api_base + + def sign_request( + self, + headers: dict, + optional_params: dict, + request_data: dict, + api_base: str, + api_key: Optional[str] = None, + model: Optional[str] = None, + stream: Optional[bool] = None, + fake_stream: Optional[bool] = None, + ) -> Tuple[dict, Optional[bytes]]: + if api_key or get_secret_str("ANTHROPIC_AWS_API_KEY"): + return headers, None + + return self._sign_request( + service_name=CLAUDE_PLATFORM_SERVICE_NAME, + headers=headers, + optional_params=optional_params, + request_data=request_data, + api_base=api_base, + model=model, + stream=stream, + fake_stream=fake_stream, + ) diff --git a/litellm/llms/bedrock/claude_platform/messages_transformation.py b/litellm/llms/bedrock/claude_platform/messages_transformation.py new file mode 100644 index 00000000000..66158196322 --- /dev/null +++ b/litellm/llms/bedrock/claude_platform/messages_transformation.py @@ -0,0 +1,71 @@ +from typing import Any, Dict, List, Optional, Tuple + +import litellm +from litellm.llms.anthropic.experimental_pass_through.messages.transformation import ( + DEFAULT_ANTHROPIC_API_VERSION, + AnthropicMessagesConfig, +) +from litellm.secret_managers.main import get_secret_str +from litellm.types.router import GenericLiteLLMParams + +from .common_utils import BedrockClaudePlatformMixin, strip_claude_platform_route + + +class BedrockClaudePlatformMessagesConfig( + BedrockClaudePlatformMixin, AnthropicMessagesConfig +): + def validate_anthropic_messages_environment( + self, + headers: dict, + model: str, + messages: List[Any], + optional_params: dict, + litellm_params: dict, + api_key: Optional[str] = None, + api_base: Optional[str] = None, + ) -> Tuple[dict, Optional[str]]: + workspace_id = self._get_workspace_id(optional_params, litellm_params) + if workspace_id is None: + raise litellm.AuthenticationError( + message=( + "Missing workspace ID for Claude Platform on AWS. Pass " + "`workspace_id` or configure the provider workspace setting." + ), + llm_provider="bedrock", + model=model, + ) + + resolved_api_key = api_key or get_secret_str("ANTHROPIC_AWS_API_KEY") + headers = { + **headers, + "anthropic-version": headers.get( + "anthropic-version", DEFAULT_ANTHROPIC_API_VERSION + ), + "content-type": headers.get("content-type", "application/json"), + "anthropic-workspace-id": workspace_id, + } + if resolved_api_key and "x-api-key" not in headers: + headers["x-api-key"] = resolved_api_key + + headers = self._update_headers_with_anthropic_beta( + headers=headers, + optional_params=optional_params, + ) + + return headers, api_base + + def transform_anthropic_messages_request( + self, + model: str, + messages: List[Dict], + anthropic_messages_optional_request_params: Dict, + litellm_params: GenericLiteLLMParams, + headers: dict, + ) -> Dict: + return super().transform_anthropic_messages_request( + model=strip_claude_platform_route(model), + messages=messages, + anthropic_messages_optional_request_params=anthropic_messages_optional_request_params, + litellm_params=litellm_params, + headers=headers, + ) diff --git a/litellm/llms/bedrock/claude_platform/transformation.py b/litellm/llms/bedrock/claude_platform/transformation.py new file mode 100644 index 00000000000..0167c457c96 --- /dev/null +++ b/litellm/llms/bedrock/claude_platform/transformation.py @@ -0,0 +1,94 @@ +from typing import Any, Dict, List, Optional + +import litellm +from litellm.llms.anthropic.chat.transformation import AnthropicConfig +from litellm.secret_managers.main import get_secret_str +from litellm.types.llms.openai import AllMessageValues + +from .common_utils import BedrockClaudePlatformMixin + + +class BedrockClaudePlatformConfig(BedrockClaudePlatformMixin, AnthropicConfig): + """ + Bedrock Claude Platform uses Anthropic's Messages API with AWS gateway auth. + """ + + @property + def custom_llm_provider(self) -> Optional[str]: + return "bedrock" + + def validate_environment( + self, + headers: dict, + model: str, + messages: List[AllMessageValues], + optional_params: dict, + litellm_params: dict, + api_key: Optional[str] = None, + api_base: Optional[str] = None, + ) -> Dict: + workspace_id = self._get_workspace_id(optional_params, litellm_params) + if workspace_id is None: + raise litellm.AuthenticationError( + message=( + "Missing workspace ID for Claude Platform on AWS. Pass " + "`workspace_id` or configure the provider workspace setting." + ), + llm_provider="bedrock", + model=model, + ) + + api_key = api_key or get_secret_str("ANTHROPIC_AWS_API_KEY") + anthropic_headers = self.get_anthropic_headers( + api_key=api_key, + auth_token=None, + computer_tool_used=self.is_computer_tool_used( + tools=optional_params.get("tools") + ), + prompt_caching_set=self.is_cache_control_set(messages=messages), + pdf_used=self.is_pdf_used(messages=messages), + file_id_used=self.is_file_id_used(messages=messages), + mcp_server_used=self.is_mcp_server_used( + mcp_servers=optional_params.get("mcp_servers") + ), + web_search_tool_used=self.is_web_search_tool_used( + tools=optional_params.get("tools") + ), + tool_search_used=self.is_tool_search_used( + tools=optional_params.get("tools") + ), + programmatic_tool_calling_used=self.is_programmatic_tool_calling_used( + tools=optional_params.get("tools") + ), + input_examples_used=self.is_input_examples_used( + tools=optional_params.get("tools") + ), + effort_used=self.is_effort_used( + optional_params=optional_params, model=model + ), + user_anthropic_beta_headers=self._get_user_anthropic_beta_headers( + anthropic_beta_header=headers.get("anthropic-beta") + ), + code_execution_tool_used=self.is_code_execution_tool_used( + tools=optional_params.get("tools") + ), + container_with_skills_used=self.is_container_with_skills_used( + optional_params=optional_params + ), + ) + anthropic_headers["anthropic-workspace-id"] = workspace_id + return {**headers, **anthropic_headers} + + def get_model_response_iterator( + self, + streaming_response: Any, + sync_stream: bool, + json_mode: Optional[bool] = False, + ) -> Any: + from litellm.llms.anthropic.chat.handler import ModelResponseIterator + + return ModelResponseIterator( + streaming_response=streaming_response, + sync_stream=sync_stream, + json_mode=bool(json_mode), + ) diff --git a/litellm/llms/bedrock/common_utils.py b/litellm/llms/bedrock/common_utils.py index 856a525f773..4f4729e4019 100644 --- a/litellm/llms/bedrock/common_utils.py +++ b/litellm/llms/bedrock/common_utils.py @@ -4,6 +4,7 @@ from __future__ import annotations Common utilities used across bedrock chat/embedding/image generation """ +import functools import json import os from typing import TYPE_CHECKING, Any, Dict, List, Literal, Optional, Union @@ -692,6 +693,7 @@ class BedrockModelInfo(BaseLLMModelInfo): ) -> Literal[ "converse", "invoke", + "claude_platform", "converse_like", "agent", "agentcore", @@ -706,6 +708,7 @@ class BedrockModelInfo(BaseLLMModelInfo): str, Literal[ "invoke", + "claude_platform", "converse_like", "converse", "agent", @@ -716,6 +719,7 @@ class BedrockModelInfo(BaseLLMModelInfo): ], ] = { "invoke/": "invoke", + "claude_platform/": "claude_platform", "converse_like/": "converse_like", "converse/": "converse", "agent/": "agent", @@ -753,6 +757,36 @@ class BedrockModelInfo(BaseLLMModelInfo): """ return "converse/" in model + @staticmethod + def _explicit_claude_platform_route(model: str) -> bool: + """ + Check if the model is an explicit Claude Platform on AWS route. + """ + return "claude_platform/" in model + + @staticmethod + def get_claude_platform_model(model: str) -> str: + """ + Strip the Claude Platform route prefix from a Bedrock model name. + """ + return model.replace("claude_platform/", "", 1) + + @staticmethod + def map_claude_platform_auth_params( + passed_params: dict, optional_params: dict + ) -> dict: + """ + Map Claude Platform route auth params that are not OpenAI request params. + """ + for key in ( + "workspace_id", + "aws_workspace_id", + "anthropic_workspace_id", + ): + if key in passed_params: + optional_params[key] = passed_params[key] + return optional_params + @staticmethod def _explicit_invoke_route(model: str) -> bool: """ @@ -815,6 +849,12 @@ class BedrockModelInfo(BaseLLMModelInfo): All other routes should return None since they will go through litellm.completion """ + ######################################################### + # Claude Platform route uses Anthropic Messages API via the AWS gateway. + ######################################################### + if BedrockModelInfo._explicit_claude_platform_route(model): + return litellm.BedrockClaudePlatformMessagesConfig() + ######################################################### # Converse routes should go through litellm.completion() if BedrockModelInfo._explicit_converse_route(model): @@ -860,7 +900,9 @@ def get_bedrock_chat_config(model: str): base_model = BedrockModelInfo.get_base_model(model) # Handle explicit routes first - if bedrock_route == "converse" or bedrock_route == "converse_like": + if bedrock_route == "claude_platform": + return litellm.BedrockClaudePlatformConfig() + elif bedrock_route == "converse" or bedrock_route == "converse_like": return litellm.AmazonConverseConfig() elif bedrock_route == "openai": return litellm.AmazonBedrockOpenAIConfig() @@ -922,10 +964,8 @@ def _load_bedrock_response_stream_shape(): """ Load the ResponseStream shape from botocore's bundled bedrock-runtime schema. - Called once at module import time; the result is stored in - ``BEDROCK_RESPONSE_STREAM_SHAPE`` and reused for the process lifetime. Returns ``None`` if botocore is unavailable or the service model cannot be - loaded, so the module still imports cleanly. + loaded. """ try: from botocore.loaders import Loader @@ -936,15 +976,22 @@ def _load_bedrock_response_stream_shape(): return ServiceModel(service_dict).shape_for("ResponseStream") except Exception as e: verbose_logger.warning( - "litellm: could not pre-load bedrock-runtime response stream shape " + "litellm: could not load bedrock-runtime response stream shape " "— Bedrock event-stream decoding will be unavailable. Error: %s", e, ) return None -# Eagerly resolved once per process — avoids per-instance or per-request disk I/O. -BEDROCK_RESPONSE_STREAM_SHAPE = _load_bedrock_response_stream_shape() +@functools.lru_cache(maxsize=1) +def get_bedrock_response_stream_shape(): + """ + Lazily load and cache the bedrock-runtime ResponseStream shape for the process. + + Avoids importing botocore (and logging warnings) unless Bedrock event-stream + decoding is actually needed. + """ + return _load_bedrock_response_stream_shape() class BedrockEventStreamDecoderBase: @@ -958,7 +1005,8 @@ class BedrockEventStreamDecoderBase: self.parser = EventStreamJSONParser() def _parse_message_from_event(self, event) -> Optional[str]: - if BEDROCK_RESPONSE_STREAM_SHAPE is None: + response_stream_shape = get_bedrock_response_stream_shape() + if response_stream_shape is None: raise BedrockError( status_code=500, message=( @@ -967,9 +1015,7 @@ class BedrockEventStreamDecoderBase: ), ) response_dict = event.to_response_dict() - parsed_response = self.parser.parse( - response_dict, BEDROCK_RESPONSE_STREAM_SHAPE - ) + parsed_response = self.parser.parse(response_dict, response_stream_shape) if response_dict["status_code"] != 200: decoded_body = response_dict["body"].decode() diff --git a/litellm/llms/bedrock/embed/amazon_titan_g1_transformation.py b/litellm/llms/bedrock/embed/amazon_titan_g1_transformation.py index 2747551af81..64a79b73273 100644 --- a/litellm/llms/bedrock/embed/amazon_titan_g1_transformation.py +++ b/litellm/llms/bedrock/embed/amazon_titan_g1_transformation.py @@ -1,5 +1,5 @@ """ -Transformation logic from OpenAI /v1/embeddings format to Bedrock Amazon Titan G1 /invoke format. +Transformation logic from OpenAI /v1/embeddings format to Bedrock Amazon Titan G1 /invoke format. Why separate file? Make it easy to see how transformation works diff --git a/litellm/llms/bedrock/embed/cohere_transformation.py b/litellm/llms/bedrock/embed/cohere_transformation.py index d00cb74aae0..9570ff1a14c 100644 --- a/litellm/llms/bedrock/embed/cohere_transformation.py +++ b/litellm/llms/bedrock/embed/cohere_transformation.py @@ -1,5 +1,5 @@ """ -Transformation logic from OpenAI /v1/embeddings format to Bedrock Cohere /invoke format. +Transformation logic from OpenAI /v1/embeddings format to Bedrock Cohere /invoke format. Why separate file? Make it easy to see how transformation works """ @@ -22,7 +22,7 @@ class BedrockCohereEmbeddingConfig: ) -> dict: for k, v in non_default_params.items(): if k == "encoding_format": - optional_params["embedding_types"] = v + optional_params["embedding_types"] = v if isinstance(v, list) else [v] elif k == "dimensions": optional_params["output_dimension"] = v return optional_params diff --git a/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py b/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py index aae2bc5e289..69b61298d33 100644 --- a/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py +++ b/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py @@ -45,6 +45,7 @@ from litellm.types.router import GenericLiteLLMParams from litellm.types.utils import GenericStreamingChunk from litellm.types.utils import GenericStreamingChunk as GChunk from litellm.types.utils import ModelResponseStream +from litellm.utils import _supports_factory if TYPE_CHECKING: from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj @@ -408,6 +409,47 @@ class AmazonAnthropicClaudeMessagesConfig( if self._supports_tool_search_on_bedrock(model): beta_set.add("tool-search-tool-2025-10-19") + @staticmethod + def _filter_context_management_for_bedrock_invoke( + anthropic_messages_request: Dict, + beta_set: set, + ) -> None: + """ + Bedrock InvokeModel accepts ``context_management`` only when it carries + ``compact_20260112`` edits paired with the ``compact-2026-01-12`` + anthropic-beta header. Other edit types (notably ``clear_thinking_20251015``, + which Claude Code sends on every request) are LiteLLM-internal and would + cause Bedrock to 400 with ``"context_management: Extra inputs are not + permitted"``. + + Filter the edits list to the supported subset, add the beta header when + compact edits remain, and drop ``context_management`` entirely when no + supported edits are left so the safety-net allowlist can pass it through. + + Ref: https://github.com/BerriAI/litellm/issues/27532 + """ + cm = anthropic_messages_request.get("context_management") + if not isinstance(cm, dict): + return + edits = cm.get("edits") + if not isinstance(edits, list): + anthropic_messages_request.pop("context_management", None) + return + + compact_edits = [ + e + for e in edits + if isinstance(e, dict) and e.get("type") == "compact_20260112" + ] + if compact_edits: + beta_set.add("compact-2026-01-12") + anthropic_messages_request["context_management"] = { + **cm, + "edits": compact_edits, + } + else: + anthropic_messages_request.pop("context_management", None) + def _convert_output_format_to_inline_schema( self, output_format: Dict, @@ -516,7 +558,29 @@ class AmazonAnthropicClaudeMessagesConfig( anthropic_messages_request=anthropic_messages_request, ) - # 5a. Remove `custom` field from tools (Bedrock doesn't support it) + # 5a. Bedrock Invoke supports output_config (effort) for Claude 4.6+ models, + # but older models do not — strip it to avoid request rejection. + # Ref: https://github.com/BerriAI/litellm/issues/22797 + if not ( + _supports_factory( + model=model, + custom_llm_provider="bedrock", + key="supports_output_config", + ) + or AnthropicConfig._model_supports_effort_param(model) + ): + if anthropic_messages_request.pop("output_config", None) is not None: + verbose_logger.warning( + "Bedrock Invoke: stripping unsupported `output_config` for " + "model=%s — neither `supports_output_config` nor any " + "`supports_*_reasoning_effort` flag is set in " + "model_prices_and_context_window.json. Add the capability " + "flag to the model JSON entry if this model accepts " + "`output_config`.", + model, + ) + + # 5b. Remove `custom` field from tools (Bedrock doesn't support it) # Claude Code sends `custom: {defer_loading: true}` on tool definitions, # which causes Bedrock to reject the request with "Extra inputs are not permitted" # Ref: https://github.com/BerriAI/litellm/issues/22847 @@ -551,6 +615,11 @@ class AmazonAnthropicClaudeMessagesConfig( if injected_thinking_for_clear_thinking: beta_set.add("interleaved-thinking-2025-05-14") + self._filter_context_management_for_bedrock_invoke( + anthropic_messages_request=anthropic_messages_request, + beta_set=beta_set, + ) + self._get_tool_search_beta_header_for_bedrock( model=model, tool_search_used=tool_search_used, @@ -597,8 +666,9 @@ class AmazonAnthropicClaudeMessagesConfig( anthropic_messages_request.pop("output_config", None) # 7. Final safety net: filter top-level fields to the Bedrock Invoke allowlist. - # Catches Anthropic-only extensions (context_management, output_config, speed, - # mcp_servers, ...) and any future additions Claude Code may start sending. + # Catches Anthropic-only extensions (output_config, speed, mcp_servers, ...) + # and any future additions Claude Code may start sending. ``context_management`` + # has already been pre-filtered to its Bedrock-supported subset above. allowed = self.BEDROCK_INVOKE_ALLOWED_TOP_LEVEL_FIELDS stripped = sorted(k for k in anthropic_messages_request if k not in allowed) if stripped: diff --git a/litellm/llms/bedrock/messages/mantle_transformation.py b/litellm/llms/bedrock/messages/mantle_transformation.py index 3f04c8a3052..a78f696a057 100644 --- a/litellm/llms/bedrock/messages/mantle_transformation.py +++ b/litellm/llms/bedrock/messages/mantle_transformation.py @@ -20,7 +20,9 @@ if TYPE_CHECKING: else: LiteLLMLoggingObj = Any -MANTLE_ENDPOINT_TEMPLATE = "https://bedrock-mantle.{region}.api.aws/v1/messages" +MANTLE_ENDPOINT_TEMPLATE = ( + "https://bedrock-mantle.{region}.api.aws/anthropic/v1/messages" +) class AmazonMantleMessagesConfig(AmazonAnthropicClaudeMessagesConfig): diff --git a/litellm/llms/bedrock_mantle/chat/transformation.py b/litellm/llms/bedrock_mantle/chat/transformation.py index e413bb22b2d..81a56030a5c 100644 --- a/litellm/llms/bedrock_mantle/chat/transformation.py +++ b/litellm/llms/bedrock_mantle/chat/transformation.py @@ -16,7 +16,6 @@ from litellm.secret_managers.main import get_secret_str from ...openai_like.chat.transformation import OpenAILikeChatConfig - BEDROCK_MANTLE_DEFAULT_REGION = "us-east-1" diff --git a/litellm/llms/chatgpt/responses/transformation.py b/litellm/llms/chatgpt/responses/transformation.py index 66acd933416..56b61b66c84 100644 --- a/litellm/llms/chatgpt/responses/transformation.py +++ b/litellm/llms/chatgpt/responses/transformation.py @@ -1,7 +1,5 @@ -import json -from typing import Any, Optional +from typing import Any, Dict, Optional -from litellm.constants import STREAM_SSE_DONE_STRING from litellm.exceptions import AuthenticationError from litellm.litellm_core_utils.core_helpers import process_response_headers from litellm.litellm_core_utils.llm_response_utils.convert_dict_to_response import ( @@ -9,13 +7,17 @@ from litellm.litellm_core_utils.llm_response_utils.convert_dict_to_response impo ) from litellm.llms.openai.common_utils import OpenAIError from litellm.llms.openai.responses.transformation import OpenAIResponsesAPIConfig +from litellm.responses.sse_output_recovery import ( + parse_sse_json_chunk, + record_output_item_chunk, + record_output_text_chunk, +) from litellm.types.llms.openai import ( ResponsesAPIResponse, ResponsesAPIStreamEvents, ) from litellm.types.router import GenericLiteLLMParams from litellm.types.utils import LlmProviders -from litellm.utils import CustomStreamWrapper from ..authenticator import Authenticator from ..common_utils import ( @@ -111,86 +113,139 @@ class ChatGPTResponsesAPIConfig(OpenAIResponsesAPIConfig): raw_response: Any, logging_obj: Any, ): - content_type = (raw_response.headers or {}).get("content-type", "") body_text = raw_response.text or "" - if "text/event-stream" not in content_type.lower(): - trimmed_body = body_text.lstrip() - if not ( - trimmed_body.startswith("event:") - or trimmed_body.startswith("data:") - or "\nevent:" in body_text - or "\ndata:" in body_text - ): - return super().transform_response_api_response( - model=model, - raw_response=raw_response, - logging_obj=logging_obj, - ) + if not self._should_parse_as_sse( + raw_response=raw_response, body_text=body_text + ): + return super().transform_response_api_response( + model=model, + raw_response=raw_response, + logging_obj=logging_obj, + ) logging_obj.post_call( original_response=raw_response.text, additional_args={"complete_input_dict": {}}, ) - completed_response = None - error_message = None - for chunk in body_text.splitlines(): - stripped_chunk = CustomStreamWrapper._strip_sse_data_from_chunk(chunk) - if not stripped_chunk: - continue - stripped_chunk = stripped_chunk.strip() - if not stripped_chunk: - continue - if stripped_chunk == STREAM_SSE_DONE_STRING: - break - try: - parsed_chunk = json.loads(stripped_chunk) - except json.JSONDecodeError: - continue - if not isinstance(parsed_chunk, dict): - continue - event_type = parsed_chunk.get("type") - if event_type == ResponsesAPIStreamEvents.RESPONSE_COMPLETED: - response_payload = parsed_chunk.get("response") - if isinstance(response_payload, dict): - response_payload = dict(response_payload) - if "created_at" in response_payload: - response_payload["created_at"] = _safe_convert_created_field( - response_payload["created_at"] - ) - try: - completed_response = ResponsesAPIResponse(**response_payload) - except Exception: - completed_response = ResponsesAPIResponse.model_construct( - **response_payload - ) - break - if event_type in ( - ResponsesAPIStreamEvents.RESPONSE_FAILED, - ResponsesAPIStreamEvents.ERROR, - ): - error_obj = parsed_chunk.get("error") or ( - parsed_chunk.get("response") or {} - ).get("error") - if error_obj is not None: - if isinstance(error_obj, dict): - error_message = error_obj.get("message") or str(error_obj) - else: - error_message = str(error_obj) - + completed_response, error_message = self._extract_completed_response_from_sse( + body_text=body_text + ) if completed_response is None: raise OpenAIError( message=error_message or raw_response.text, status_code=raw_response.status_code, ) + self._attach_response_headers( + completed_response=completed_response, raw_response=raw_response + ) + return completed_response + + def _should_parse_as_sse(self, raw_response: Any, body_text: str) -> bool: + content_type = (raw_response.headers or {}).get("content-type", "") + if "text/event-stream" in content_type.lower(): + return True + trimmed_body = body_text.lstrip() + return bool( + trimmed_body.startswith("event:") + or trimmed_body.startswith("data:") + or "\nevent:" in body_text + or "\ndata:" in body_text + ) + + def _extract_completed_response_from_sse( + self, body_text: str + ) -> tuple[Optional[ResponsesAPIResponse], Optional[str]]: + completed_response = None + error_message = None + streamed_output_items: Dict[int, dict] = {} + text_only_output_items: Dict[int, dict] = {} + for chunk in body_text.splitlines(): + parsed_chunk = parse_sse_json_chunk(chunk) + if parsed_chunk is None: + continue + + event_type = parsed_chunk.get("type") + if event_type == ResponsesAPIStreamEvents.OUTPUT_ITEM_DONE: + record_output_item_chunk( + parsed_chunk=parsed_chunk, + output_items=streamed_output_items, + ) + continue + + if event_type == ResponsesAPIStreamEvents.OUTPUT_TEXT_DONE: + record_output_text_chunk( + parsed_chunk=parsed_chunk, + output_items=streamed_output_items, + text_only_items=text_only_output_items, + ) + continue + + if event_type == ResponsesAPIStreamEvents.RESPONSE_COMPLETED: + # Real OUTPUT_ITEM_DONE events take precedence at any given + # output_index, but text-only items at indices without a + # matching OUTPUT_ITEM_DONE must still be preserved (e.g. + # providers that emit only OUTPUT_TEXT_DONE for some indices). + merged_items: Dict[int, dict] = {**text_only_output_items} + merged_items.update(streamed_output_items) + completed_response = self._build_completed_response_from_chunk( + parsed_chunk=parsed_chunk, + streamed_output_items=merged_items, + ) + break + + if event_type in ( + ResponsesAPIStreamEvents.RESPONSE_FAILED, + ResponsesAPIStreamEvents.ERROR, + ): + extracted_error = self._extract_error_message(parsed_chunk) + if extracted_error is not None: + error_message = extracted_error + + return completed_response, error_message + + def _build_completed_response_from_chunk( + self, parsed_chunk: Dict[str, Any], streamed_output_items: Dict[int, dict] + ) -> Optional[ResponsesAPIResponse]: + response_payload = parsed_chunk.get("response") + if not isinstance(response_payload, dict): + return None + response_payload = dict(response_payload) + if not response_payload.get("output") and streamed_output_items: + response_payload["output"] = [ + item for _, item in sorted(streamed_output_items.items()) + ] + if "created_at" in response_payload: + response_payload["created_at"] = _safe_convert_created_field( + response_payload["created_at"] + ) + try: + return ResponsesAPIResponse(**response_payload) + except Exception: + return ResponsesAPIResponse.model_construct(**response_payload) + + def _extract_error_message(self, parsed_chunk: Dict[str, Any]) -> Optional[str]: + error_obj = parsed_chunk.get("error") or ( + parsed_chunk.get("response") or {} + ).get("error") + if error_obj is None: + return None + if isinstance(error_obj, dict): + return error_obj.get("message") or str(error_obj) + return str(error_obj) + + def _attach_response_headers( + self, + completed_response: ResponsesAPIResponse, + raw_response: Any, + ) -> None: raw_headers = dict(raw_response.headers) processed_headers = process_response_headers(raw_headers) if not hasattr(completed_response, "_hidden_params"): setattr(completed_response, "_hidden_params", {}) completed_response._hidden_params["additional_headers"] = processed_headers completed_response._hidden_params["headers"] = raw_headers - return completed_response def get_complete_url( self, diff --git a/litellm/llms/cohere/embed/handler.py b/litellm/llms/cohere/embed/handler.py index 3ab8baf7ba8..81b6a1c7aec 100644 --- a/litellm/llms/cohere/embed/handler.py +++ b/litellm/llms/cohere/embed/handler.py @@ -1,5 +1,5 @@ """ -Legacy /v1/embedding handler for Bedrock Cohere. +Legacy /v1/embedding handler for Bedrock Cohere. """ import json diff --git a/litellm/llms/cohere/embed/v1_transformation.py b/litellm/llms/cohere/embed/v1_transformation.py index feca9cb5b88..82c901e7eca 100644 --- a/litellm/llms/cohere/embed/v1_transformation.py +++ b/litellm/llms/cohere/embed/v1_transformation.py @@ -110,15 +110,35 @@ class CohereEmbeddingConfig: additional_args={"complete_input_dict": data}, original_response=response_json, ) + return self._populate_embedding_response( + response_json=response_json, + model_response=model_response, + model=model, + encoding=encoding, + input=input, + ) + + def _populate_embedding_response( + self, + response_json: dict, + model_response: EmbeddingResponse, + model: str, + encoding: Any, + input: list, + ) -> EmbeddingResponse: """ - response + Parse a Cohere embed response body into an OpenAI-style EmbeddingResponse. + + Split out from `_transform_response` so callers that already log + `post_call` themselves (e.g. SageMaker's embedding handler) can reuse + the parsing without triggering a second `post_call`. + + Response shape: { 'object': "list", - 'data': [ - - ] - 'model', - 'usage' + 'data': [...], + 'model', + 'usage', } """ embeddings = response_json["embeddings"] @@ -149,9 +169,6 @@ class CohereEmbeddingConfig: model_response.object = "list" model_response.data = output_data model_response.model = model - input_tokens = 0 - for text in input: - input_tokens += len(encoding.encode(text)) setattr( model_response, diff --git a/litellm/llms/custom_httpx/container_handler.py b/litellm/llms/custom_httpx/container_handler.py index 599cd705ebf..501390d840b 100644 --- a/litellm/llms/custom_httpx/container_handler.py +++ b/litellm/llms/custom_httpx/container_handler.py @@ -257,14 +257,19 @@ class GenericContainerHandler: returns_binary = endpoint_config.get("returns_binary", False) is_multipart = endpoint_config.get("is_multipart", False) + # An empty dict passed as `params` to httpx strips any existing query + # string from the URL (e.g. ?api-version=...). Use None instead so + # httpx leaves the URL's own query string intact. + effective_params = query_params or None + try: if method == "GET": response = http_client.get( - url=url, headers=headers, params=query_params + url=url, headers=headers, params=effective_params ) elif method == "DELETE": response = http_client.delete( - url=url, headers=headers, params=query_params + url=url, headers=headers, params=effective_params ) elif method == "POST": if is_multipart and "file" in kwargs: @@ -272,11 +277,11 @@ class GenericContainerHandler: kwargs["file"], headers ) response = http_client.post( - url=url, headers=headers, params=query_params, files=files + url=url, headers=headers, params=effective_params, files=files ) else: response = http_client.post( - url=url, headers=headers, params=query_params + url=url, headers=headers, params=effective_params ) else: raise ValueError(f"Unsupported HTTP method: {method}") @@ -376,14 +381,19 @@ class GenericContainerHandler: returns_binary = endpoint_config.get("returns_binary", False) is_multipart = endpoint_config.get("is_multipart", False) + # An empty dict passed as `params` to httpx strips any existing query + # string from the URL (e.g. ?api-version=...). Use None instead so + # httpx leaves the URL's own query string intact. + effective_params = query_params or None + try: if method == "GET": response = await http_client.get( - url=url, headers=headers, params=query_params + url=url, headers=headers, params=effective_params ) elif method == "DELETE": response = await http_client.delete( - url=url, headers=headers, params=query_params + url=url, headers=headers, params=effective_params ) elif method == "POST": if is_multipart and "file" in kwargs: @@ -391,11 +401,11 @@ class GenericContainerHandler: kwargs["file"], headers ) response = await http_client.post( - url=url, headers=headers, params=query_params, files=files + url=url, headers=headers, params=effective_params, files=files ) else: response = await http_client.post( - url=url, headers=headers, params=query_params + url=url, headers=headers, params=effective_params ) else: raise ValueError(f"Unsupported HTTP method: {method}") diff --git a/litellm/llms/custom_httpx/http_handler.py b/litellm/llms/custom_httpx/http_handler.py index af18c666679..e11d8532dbf 100644 --- a/litellm/llms/custom_httpx/http_handler.py +++ b/litellm/llms/custom_httpx/http_handler.py @@ -485,11 +485,16 @@ class MaskedHTTPStatusError(httpx.HTTPStatusError): if k.lower() not in ("content-encoding", "content-length") } + try: + request_content = original_error.request.content + except httpx.RequestNotRead: + request_content = b"" + masked_request = httpx.Request( method=original_error.request.method, url=masked_url, headers=original_error.request.headers, - content=original_error.request.content, + content=request_content, ) super().__init__( diff --git a/litellm/llms/custom_httpx/llm_http_handler.py b/litellm/llms/custom_httpx/llm_http_handler.py index fa1253d9005..c9ab3c648ac 100644 --- a/litellm/llms/custom_httpx/llm_http_handler.py +++ b/litellm/llms/custom_httpx/llm_http_handler.py @@ -890,6 +890,18 @@ class BaseLLMHTTPHandler: headers=headers, ) + # Some providers (e.g. OCI) require request signing after the body is built. + # The default BaseConfig.sign_request returns (headers, None) — a no-op for + # providers that don't need signing. + headers, signed_body = provider_config.sign_request( + headers=headers, + optional_params=optional_params, + request_data=data, + api_base=api_base, + api_key=api_key, + model=model, + ) + ## LOGGING logging_obj.pre_call( input=input, @@ -916,6 +928,7 @@ class BaseLLMHTTPHandler: client=client, optional_params=optional_params, litellm_params=litellm_params, + signed_body=signed_body, ) if client is None or not isinstance(client, HTTPHandler): @@ -926,12 +939,20 @@ class BaseLLMHTTPHandler: sync_httpx_client = client try: - response = sync_httpx_client.post( - url=api_base, - headers=headers, - data=json.dumps(data), - timeout=timeout, - ) + if signed_body is not None: + response = sync_httpx_client.post( + url=api_base, + headers=headers, + data=signed_body, + timeout=timeout, + ) + else: + response = sync_httpx_client.post( + url=api_base, + headers=headers, + data=json.dumps(data), + timeout=timeout, + ) except Exception as e: raise self._handle_error( e=e, @@ -964,6 +985,7 @@ class BaseLLMHTTPHandler: api_key: Optional[str] = None, timeout: Optional[Union[float, httpx.Timeout]] = None, client: Optional[Union[HTTPHandler, AsyncHTTPHandler]] = None, + signed_body: Optional[bytes] = None, ) -> EmbeddingResponse: if client is None or not isinstance(client, AsyncHTTPHandler): async_httpx_client = get_async_httpx_client( @@ -974,12 +996,20 @@ class BaseLLMHTTPHandler: async_httpx_client = client try: - response = await async_httpx_client.post( - url=api_base, - headers=headers, - json=request_data, - timeout=timeout, - ) + if signed_body is not None: + response = await async_httpx_client.post( + url=api_base, + headers=headers, + data=signed_body, + timeout=timeout, + ) + else: + response = await async_httpx_client.post( + url=api_base, + headers=headers, + json=request_data, + timeout=timeout, + ) except Exception as e: raise self._handle_error(e=e, provider_config=provider_config) @@ -1177,6 +1207,8 @@ class BaseLLMHTTPHandler: data = transformed_result.data files = transformed_result.files + if transformed_result.content_type is not None: + headers["Content-Type"] = transformed_result.content_type ## LOGGING logging_obj.pre_call( @@ -1409,6 +1441,8 @@ class BaseLLMHTTPHandler: document=document, optional_params=optional_params, headers=headers, + api_key=api_key, + api_base=api_base, ) # All providers return OCRRequestData @@ -1477,6 +1511,8 @@ class BaseLLMHTTPHandler: document=document, optional_params=optional_params, headers=headers, + api_key=api_key, + api_base=api_base, ) # All providers return OCRRequestData @@ -1852,7 +1888,9 @@ class BaseLLMHTTPHandler: async_httpx_client: AsyncHTTPHandler, request_url: str, headers: dict, - signed_json_body: Optional[bytes], + # str when the caller passes a pre-serialized (unsigned) body to avoid + # re-dumping; bytes when a provider signed the request (e.g. Bedrock). + signed_json_body: Optional[Union[str, bytes]], request_body: dict, stream: bool, logging_obj: LiteLLMLoggingObj, @@ -2043,8 +2081,18 @@ class BaseLLMHTTPHandler: model=model, ) + # The request body was serialized once for the pre-call log input and + # again for the wire (json.dumps is O(payload), large for long-context + # Claude Code history). Serialize once and reuse for both. Only when + # the provider didn't sign the request (sign_request no-op for the + # native anthropic path -> signed_json_body is None); signed providers + # (e.g. Bedrock) keep their signed body untouched. The HTTP-error + # retry path mutates + re-signs the body, so it still re-serializes + # internally -- this only deduplicates the success path. + request_body_json = json.dumps(request_body) + logging_obj.pre_call( - input=[{"role": "user", "content": json.dumps(request_body)}], + input=[{"role": "user", "content": request_body_json}], api_key="", additional_args={ "complete_input_dict": request_body, @@ -2057,7 +2105,9 @@ class BaseLLMHTTPHandler: async_httpx_client=async_httpx_client, request_url=request_url, headers=headers, - signed_json_body=signed_json_body, + signed_json_body=( + signed_json_body if signed_json_body is not None else request_body_json + ), request_body=request_body, stream=stream or False, logging_obj=logging_obj, @@ -2079,6 +2129,14 @@ class BaseLLMHTTPHandler: litellm_logging_obj=logging_obj, ) + if not self._has_agentic_completion_hook(logging_obj): + # No callback overrides async_should_run_agentic_loop, so the + # agentic wrapper's only effect would be buffering every chunk + # and rebuilding the response from SSE at end-of-stream to call + # hooks that all return (False, {}). Stream through directly and + # skip that per-chunk + end-of-stream overhead. + return completion_stream + from litellm.llms.anthropic.experimental_pass_through.messages.agentic_streaming_iterator import ( AgenticAnthropicStreamingIterator, ) @@ -4586,6 +4644,51 @@ class BaseLLMHTTPHandler: fingerprints = list(kwargs.get("_agentic_loop_fingerprints", []) or []) return depth, max(max_loops, 1), fingerprints + @staticmethod + def _has_agentic_completion_hook(logging_obj: Any) -> bool: + """ + True if any registered callback actually overrides + ``async_should_run_agentic_loop`` (the gate every agentic hook goes + through). The base ``CustomLogger`` implementation returns + ``(False, {})``, so when nothing overrides it the agentic + post-processing is a guaranteed no-op and the streaming wrapper that + buffers + rebuilds the whole response from SSE just to call it can be + skipped entirely. + + Function-identity comparison (not a leaf ``__dict__`` check) so an + override inherited through any intermediate class is still detected -- + a false negative here would silently disable agentic features. + + String entries in ``litellm.callbacks`` (e.g. ``"datadog"``) are + resolved to their ``CustomLogger`` instance via + ``get_custom_logger_compatible_class`` -- same pattern as + ``ProxyLogging._callback_capabilities`` -- so a string-registered + agentic callback is detected too. + """ + from litellm.integrations.custom_logger import CustomLogger + from litellm.litellm_core_utils.litellm_logging import ( + get_custom_logger_compatible_class, + ) + + base_func = CustomLogger.async_should_run_agentic_loop + callbacks = litellm.callbacks + ( + getattr(logging_obj, "dynamic_success_callbacks", None) or [] + ) + for cb in callbacks: + if isinstance(cb, str): + resolved = get_custom_logger_compatible_class(cb) # type: ignore[arg-type] + if resolved is None: + continue + cb = resolved + if not isinstance(cb, CustomLogger): + continue + cb_func = getattr(type(cb), "async_should_run_agentic_loop", base_func) + if getattr(cb_func, "__func__", cb_func) is not getattr( + base_func, "__func__", base_func + ): + return True + return False + @staticmethod def _check_agentic_loop_safety( tool_calls: Any, @@ -4634,6 +4737,7 @@ class BaseLLMHTTPHandler: fingerprints: List[str], fingerprint: str, stream: bool = False, + callback: Optional[Any] = None, ) -> Any: from litellm.anthropic_interface import messages as anthropic_messages @@ -4675,7 +4779,7 @@ class BaseLLMHTTPHandler: kwargs_for_followup["max_agentic_loops"] = max_loops kwargs_for_followup["_agentic_loop_fingerprints"] = fingerprints + [fingerprint] - return await anthropic_messages.acreate( + response = await anthropic_messages.acreate( **{ "max_tokens": max_tokens, "messages": patch.messages, @@ -4686,6 +4790,23 @@ class BaseLLMHTTPHandler: } ) + if callback is not None: + try: + response = await callback.async_post_agentic_loop_response_hook( + response=response, plan=plan, kwargs=kwargs + ) + except Exception as e: + _call_id = getattr(logging_obj, "litellm_call_id", "unknown") + verbose_logger.exception( + "LiteLLM.AgenticHookError: Exception in " + "async_post_agentic_loop_response_hook [call_id=%s model=%s]: %s", + _call_id, + model, + str(e), + ) + + return response + async def _execute_chat_completion_agentic_plan( self, plan: AgenticLoopPlan, @@ -4869,6 +4990,7 @@ class BaseLLMHTTPHandler: fingerprints=fingerprints, fingerprint=fingerprint, stream=stream, + callback=callback, ) except Exception as e: _call_id = getattr(logging_obj, "litellm_call_id", "unknown") @@ -7815,7 +7937,7 @@ class BaseLLMHTTPHandler: response = sync_httpx_client.get( url=url, headers=headers, - params=params, + params=params or None, ) return container_provider_config.transform_container_list_response( @@ -7892,7 +8014,7 @@ class BaseLLMHTTPHandler: response = await async_httpx_client.get( url=url, headers=headers, - params=params, + params=params or None, ) return container_provider_config.transform_container_list_response( @@ -7982,7 +8104,7 @@ class BaseLLMHTTPHandler: response = sync_httpx_client.get( url=url, headers=headers, - params=params, + params=params or None, ) return container_provider_config.transform_container_retrieve_response( @@ -8059,7 +8181,7 @@ class BaseLLMHTTPHandler: response = await async_httpx_client.get( url=url, headers=headers, - params=params, + params=params or None, ) return container_provider_config.transform_container_retrieve_response( @@ -8149,7 +8271,7 @@ class BaseLLMHTTPHandler: response = sync_httpx_client.delete( url=url, headers=headers, - params=params, + params=params or None, ) return container_provider_config.transform_container_delete_response( @@ -8226,7 +8348,7 @@ class BaseLLMHTTPHandler: response = await async_httpx_client.delete( url=url, headers=headers, - params=params, + params=params or None, ) return container_provider_config.transform_container_delete_response( @@ -8322,7 +8444,7 @@ class BaseLLMHTTPHandler: response = sync_httpx_client.get( url=url, headers=headers, - params=params, + params=params or None, ) return container_provider_config.transform_container_file_list_response( @@ -8401,7 +8523,7 @@ class BaseLLMHTTPHandler: response = await async_httpx_client.get( url=url, headers=headers, - params=params, + params=params or None, ) return container_provider_config.transform_container_file_list_response( @@ -8489,7 +8611,7 @@ class BaseLLMHTTPHandler: response = sync_httpx_client.get( url=url, headers=headers, - params=params, + params=params or None, ) return container_provider_config.transform_container_file_content_response( @@ -8565,7 +8687,7 @@ class BaseLLMHTTPHandler: response = await async_httpx_client.get( url=url, headers=headers, - params=params, + params=params or None, ) return container_provider_config.transform_container_file_content_response( diff --git a/litellm/llms/custom_httpx/mock_transport.py b/litellm/llms/custom_httpx/mock_transport.py index c9844753e0e..ad93cc134ee 100644 --- a/litellm/llms/custom_httpx/mock_transport.py +++ b/litellm/llms/custom_httpx/mock_transport.py @@ -13,7 +13,6 @@ from typing import Tuple import httpx - # --------------------------------------------------------------------------- # Pre-built response templates # --------------------------------------------------------------------------- diff --git a/litellm/llms/dashscope/common_utils.py b/litellm/llms/dashscope/common_utils.py new file mode 100644 index 00000000000..b3b89cbbebf --- /dev/null +++ b/litellm/llms/dashscope/common_utils.py @@ -0,0 +1,28 @@ +""" +Common utilities for the DashScope LLM provider. +""" + +from typing import Optional + +import httpx + +from litellm.llms.base_llm.chat.transformation import BaseLLMException + + +class DashScopeError(BaseLLMException): + """Exception class for DashScope provider errors.""" + + def __init__( + self, + status_code: int, + message: str, + headers: Optional[httpx.Headers] = None, + ): + self.status_code = status_code + self.message = message + self.headers = headers or httpx.Headers() + super().__init__( + status_code=status_code, + message=message, + headers=dict(self.headers), + ) diff --git a/litellm/llms/dashscope/cost_calculator.py b/litellm/llms/dashscope/cost_calculator.py index 9b3e3851162..8bb7f605b82 100644 --- a/litellm/llms/dashscope/cost_calculator.py +++ b/litellm/llms/dashscope/cost_calculator.py @@ -1,5 +1,5 @@ """ -Cost calculator for Dashscope Chat models. +Cost calculator for Dashscope Chat models. Handles tiered pricing and prompt caching scenarios. """ diff --git a/litellm/llms/dashscope/embed/__init__.py b/litellm/llms/dashscope/embed/__init__.py new file mode 100644 index 00000000000..4962b1f3251 --- /dev/null +++ b/litellm/llms/dashscope/embed/__init__.py @@ -0,0 +1,7 @@ +""" +DashScope Embedding Module +""" + +from .transformation import DashScopeEmbeddingConfig + +__all__ = ["DashScopeEmbeddingConfig"] diff --git a/litellm/llms/dashscope/embed/transformation.py b/litellm/llms/dashscope/embed/transformation.py new file mode 100644 index 00000000000..5bc0e5ca817 --- /dev/null +++ b/litellm/llms/dashscope/embed/transformation.py @@ -0,0 +1,191 @@ +""" +Transformation logic from OpenAI /v1/embeddings format to DashScope's /v1/embeddings format. + +Supports +- text-embedding-v4 +- text-embedding-v3 + +Endpoint +- https://dashscope.aliyuncs.com/compatible-mode/v1/embeddings + +Docs - https://help.aliyun.com/zh/model-studio/text-embedding-synchronous-api +""" + +from typing import List, Optional, Union + +import httpx + +from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj +from litellm.llms.base_llm.chat.transformation import BaseLLMException +from litellm.llms.base_llm.embedding.transformation import BaseEmbeddingConfig +from litellm.secret_managers.main import get_secret_str +from litellm.types.llms.openai import AllEmbeddingInputValues, AllMessageValues +from litellm.types.utils import EmbeddingResponse, Usage + +from ..common_utils import DashScopeError + +DEFAULT_API_BASE = "https://dashscope.aliyuncs.com/compatible-mode/v1" + + +class DashScopeEmbeddingConfig(BaseEmbeddingConfig): + """ + Reference: https://help.aliyun.com/zh/model-studio/text-embedding-synchronous-api + + DashScope exposes an OpenAI-compatible /v1/embeddings endpoint, so the + request and response shapes are nearly identical to OpenAI's. + """ + + def __init__(self) -> None: + pass + + def get_supported_openai_params(self, model: str) -> List[str]: + # DashScope's compatible-mode embeddings API accepts the same params as OpenAI. + # `dimensions` / `encoding_format` are only honored by text-embedding-v3 / v4; + # earlier versions silently ignore them server-side. + return ["dimensions", "encoding_format", "user"] + + def map_openai_params( + self, + non_default_params: dict, + optional_params: dict, + model: str, + drop_params: bool = False, + ) -> dict: + supported = self.get_supported_openai_params(model) + for k, v in non_default_params.items(): + if v is None: + continue + if k in supported: + optional_params[k] = v + # unsupported params are dropped when drop_params=True; + # the upstream _check_valid_arg already raised UnsupportedParamsError + # for drop_params=False before this method is called. + return optional_params + + def validate_environment( + self, + headers: dict, + model: str, + messages: List[AllMessageValues], + optional_params: dict, + litellm_params: dict, + api_key: Optional[str] = None, + api_base: Optional[str] = None, + ) -> dict: + if api_key is None: + api_key = get_secret_str("DASHSCOPE_API_KEY") + if api_key is None: + raise ValueError( + "DashScope API key is required. Set 'DASHSCOPE_API_KEY' env var or pass api_key explicitly." + ) + default_headers = { + "Content-Type": "application/json", + "Authorization": f"Bearer {api_key}", + } + return {**default_headers, **headers} + + def get_complete_url( + self, + api_base: Optional[str], + api_key: Optional[str], + model: str, + optional_params: dict, + litellm_params: dict, + stream: Optional[bool] = None, + ) -> str: + base = api_base or get_secret_str("DASHSCOPE_API_BASE") or DEFAULT_API_BASE + base = base.rstrip("/") + if base.endswith("/embeddings"): + return base + return f"{base}/embeddings" + + def transform_embedding_request( + self, + model: str, + input: AllEmbeddingInputValues, + optional_params: dict, + headers: dict, + ) -> dict: + data: dict = { + "model": model, + "input": input, + } + for key in ("dimensions", "encoding_format", "user"): + value = optional_params.get(key) + if value is not None: + data[key] = value + return data + + def transform_embedding_response( + self, + model: str, + raw_response: httpx.Response, + model_response: EmbeddingResponse, + logging_obj: LiteLLMLoggingObj, + api_key: Optional[str], + request_data: dict, + optional_params: dict, + litellm_params: dict, + ) -> EmbeddingResponse: + try: + response_json = raw_response.json() + except Exception as e: + raise DashScopeError( + status_code=raw_response.status_code, + message=f"Failed to parse DashScope response as JSON: {str(e)}", + ) + + logging_obj.post_call( + input=request_data.get("input"), + api_key=api_key, + additional_args={"complete_input_dict": request_data}, + original_response=response_json, + ) + + if "error" in response_json: + error = response_json["error"] + message = ( + error.get("message", str(error)) + if isinstance(error, dict) + else str(error) + ) + raise DashScopeError( + status_code=raw_response.status_code, + message=message, + ) + + model_response.object = "list" + model_response.data = response_json.get("data", []) + model_response.model = response_json.get("model", model) + + usage = response_json.get("usage") or {} + prompt_tokens = usage.get("prompt_tokens", 0) + total_tokens = usage.get("total_tokens", prompt_tokens) + setattr( + model_response, + "usage", + Usage( + prompt_tokens=prompt_tokens, + completion_tokens=0, + total_tokens=total_tokens, + ), + ) + + if "id" in response_json: + setattr(model_response, "id", response_json["id"]) + + return model_response + + def get_error_class( + self, + error_message: str, + status_code: int, + headers: Union[dict, httpx.Headers], + ) -> BaseLLMException: + if isinstance(headers, dict): + headers = httpx.Headers(headers) + return DashScopeError( + status_code=status_code, + message=error_message, + headers=headers, + ) diff --git a/litellm/llms/dashscope/rerank/__init__.py b/litellm/llms/dashscope/rerank/__init__.py new file mode 100644 index 00000000000..2a1401f6dc0 --- /dev/null +++ b/litellm/llms/dashscope/rerank/__init__.py @@ -0,0 +1,7 @@ +""" +DashScope Rerank Module +""" + +from .transformation import DashScopeRerankConfig + +__all__ = ["DashScopeRerankConfig"] diff --git a/litellm/llms/dashscope/rerank/transformation.py b/litellm/llms/dashscope/rerank/transformation.py new file mode 100644 index 00000000000..629f3cf4af7 --- /dev/null +++ b/litellm/llms/dashscope/rerank/transformation.py @@ -0,0 +1,241 @@ +""" +Transformation logic for DashScope's OpenAI-compatible /v1/reranks API. + +Supports +- qwen3-rerank + +(Other DashScope rerankers — gte-rerank-v2 / qwen3-vl-rerank — share the same +endpoint but have not been validated against this transformer. Behavior with +those models is undefined.) + +Endpoint +- https://dashscope.aliyuncs.com/compatible-api/v1/reranks + +Note: chat/embed live under `/compatible-mode/v1/`, but DashScope's rerank +route is exposed under `/compatible-api/v1/reranks` per the docs. Override +with `DASHSCOPE_API_BASE_RERANK` to point at a different host or path. + +Empirically, qwen3-rerank accepts `return_documents=true` and echoes +`results[].document.text` back, even though the public docs list the flag +as supported only for gte-rerank-v2 / qwen3-vl-rerank. + +Docs - https://help.aliyun.com/zh/model-studio/text-rerank-api +""" + +from typing import Any, Dict, List, Optional, Union + +import httpx + +from litellm._uuid import uuid +from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj +from litellm.llms.base_llm.chat.transformation import BaseLLMException +from litellm.llms.base_llm.rerank.transformation import BaseRerankConfig +from litellm.secret_managers.main import get_secret_str +from litellm.types.rerank import ( + OptionalRerankParams, + RerankBilledUnits, + RerankResponse, + RerankResponseMeta, + RerankTokens, +) + +from ..common_utils import DashScopeError + +DEFAULT_RERANK_URL = "https://dashscope.aliyuncs.com/compatible-api/v1/reranks" + + +class DashScopeRerankConfig(BaseRerankConfig): + """ + Reference: https://help.aliyun.com/zh/model-studio/text-rerank-api + + Targets DashScope's qwen3-rerank model. Request fields: model, query, + documents, top_n, return_documents. Response: results[].index, + results[].relevance_score, optionally results[].document.text (when + return_documents=true), plus a top-level usage.total_tokens counter. + """ + + def __init__(self) -> None: + pass + + def get_complete_url( + self, + api_base: Optional[str], + model: str, + optional_params: Optional[dict] = None, + ) -> str: + if api_base is None: + api_base = get_secret_str("DASHSCOPE_API_BASE_RERANK") or DEFAULT_RERANK_URL + + if api_base == DEFAULT_RERANK_URL: + return DEFAULT_RERANK_URL + + cleaned = api_base.rstrip("/") + if cleaned.endswith("/reranks") or cleaned.endswith("/rerank"): + return cleaned + + if cleaned.endswith("/v1"): + return f"{cleaned}/reranks" + + # Unknown base: append /reranks rather than silently ignoring the caller's api_base. + return f"{cleaned}/reranks" + + def validate_environment( + self, + headers: dict, + model: str, + api_key: Optional[str] = None, + optional_params: Optional[dict] = None, + ) -> dict: + if api_key is None: + api_key = get_secret_str("DASHSCOPE_API_KEY") + if api_key is None: + raise ValueError( + "DashScope API key is required. Set 'DASHSCOPE_API_KEY' env var or pass api_key explicitly." + ) + + default_headers = { + "Authorization": f"Bearer {api_key}", + "accept": "application/json", + "content-type": "application/json", + } + return {**default_headers, **headers} + + def get_supported_cohere_rerank_params(self, model: str) -> list: + return ["query", "documents", "top_n", "return_documents"] + + def map_cohere_rerank_params( + self, + non_default_params: Optional[dict], + model: str, + drop_params: bool, + query: str, + documents: List[Union[str, Dict[str, Any]]], + custom_llm_provider: Optional[str] = None, + top_n: Optional[int] = None, + rank_fields: Optional[List[str]] = None, + return_documents: Optional[bool] = True, + max_chunks_per_doc: Optional[int] = None, + max_tokens_per_doc: Optional[int] = None, + ) -> Dict: + # qwen3-rerank accepts query/documents/top_n/return_documents. The + # rest (rank_fields, max_*_per_doc) are silently dropped. + params: OptionalRerankParams = OptionalRerankParams( + query=query, + documents=documents, + ) + if top_n is not None: + params["top_n"] = top_n + if return_documents is not None: + params["return_documents"] = return_documents + return dict(params) + + def transform_rerank_request( + self, + model: str, + optional_rerank_params: Dict, + headers: dict, + litellm_params: Optional[dict] = None, + ) -> dict: + if "query" not in optional_rerank_params: + raise ValueError("query is required for DashScope rerank") + if "documents" not in optional_rerank_params: + raise ValueError("documents is required for DashScope rerank") + + request: Dict[str, Any] = { + "model": model, + "query": optional_rerank_params["query"], + "documents": optional_rerank_params["documents"], + } + if optional_rerank_params.get("top_n") is not None: + request["top_n"] = optional_rerank_params["top_n"] + if optional_rerank_params.get("return_documents") is not None: + request["return_documents"] = optional_rerank_params["return_documents"] + return request + + def transform_rerank_response( + self, + model: str, + raw_response: httpx.Response, + model_response: RerankResponse, + logging_obj: LiteLLMLoggingObj, + api_key: Optional[str] = None, + request_data: Optional[dict] = None, + optional_params: Optional[dict] = None, + litellm_params: Optional[dict] = None, + ) -> RerankResponse: + request_data = request_data or {} + optional_params = optional_params or {} + litellm_params = litellm_params or {} + try: + response_json = raw_response.json() + except Exception: + raise DashScopeError( + status_code=raw_response.status_code, + message=raw_response.text, + ) + + logging_obj.post_call( + input=request_data.get("query"), + api_key=api_key, + additional_args={"complete_input_dict": request_data}, + original_response=response_json, + ) + + # DashScope error envelope: {"code": "...", "message": "...", "request_id": "..."} + if "code" in response_json and "results" not in response_json: + raise DashScopeError( + status_code=raw_response.status_code, + message=response_json.get("message", str(response_json)), + ) + + results = response_json.get("results") + if results is None: + raise DashScopeError( + status_code=raw_response.status_code, + message=f"No results in DashScope rerank response: {response_json}", + ) + + # qwen3-rerank returns: + # {"index": int, "relevance_score": float} + # plus, when return_documents=true was sent: + # "document": {"text": "..."} + # which already matches LiteLLM's RerankResponseDocument shape. + transformed_results: List[dict] = [] + for r in results: + item: Dict[str, Any] = { + "index": r["index"], + "relevance_score": r["relevance_score"], + } + doc = r.get("document") + if isinstance(doc, dict): + item["document"] = doc + elif isinstance(doc, str): + # Defensive: spec says dict, but normalize string-shaped echoes. + item["document"] = {"text": doc} + transformed_results.append(item) + + usage = response_json.get("usage") or {} + total_tokens = usage.get("total_tokens") + billed_units = RerankBilledUnits(total_tokens=total_tokens) + tokens = RerankTokens(input_tokens=total_tokens) + meta = RerankResponseMeta(billed_units=billed_units, tokens=tokens) + + return RerankResponse( + id=response_json.get("id") or str(uuid.uuid4()), + results=transformed_results, # type: ignore + meta=meta, + ) + + def get_error_class( + self, + error_message: str, + status_code: int, + headers: Union[dict, httpx.Headers], + ) -> BaseLLMException: + if isinstance(headers, dict): + headers = httpx.Headers(headers) + return DashScopeError( + status_code=status_code, + message=error_message, + headers=headers, + ) diff --git a/litellm/llms/datarobot/chat/transformation.py b/litellm/llms/datarobot/chat/transformation.py index 23ce63c25b2..f81e2420930 100644 --- a/litellm/llms/datarobot/chat/transformation.py +++ b/litellm/llms/datarobot/chat/transformation.py @@ -1,5 +1,5 @@ """ -Support for OpenAI's `/v1/chat/completions` endpoint. +Support for OpenAI's `/v1/chat/completions` endpoint. Calls done in OpenAI/openai.py as DataRobot is openai-compatible. """ diff --git a/litellm/llms/deepinfra/rerank/transformation.py b/litellm/llms/deepinfra/rerank/transformation.py index 276735f4758..e4bfbcb2513 100644 --- a/litellm/llms/deepinfra/rerank/transformation.py +++ b/litellm/llms/deepinfra/rerank/transformation.py @@ -1,5 +1,5 @@ """ -Translate between Cohere's `/rerank` format and Deepinfra's `/rerank` format. +Translate between Cohere's `/rerank` format and Deepinfra's `/rerank` format. """ from typing import Any, Dict, List, Optional, Union diff --git a/litellm/llms/deepseek/chat/transformation.py b/litellm/llms/deepseek/chat/transformation.py index 5cd8d119542..7ed3e484535 100644 --- a/litellm/llms/deepseek/chat/transformation.py +++ b/litellm/llms/deepseek/chat/transformation.py @@ -2,13 +2,15 @@ Translates from OpenAI's `/v1/chat/completions` to DeepSeek's `/v1/chat/completions` """ -from typing import Any, Coroutine, List, Literal, Optional, Tuple, Union, overload +from typing import Any, Coroutine, List, Literal, Optional, Tuple, Union, cast, overload +import litellm from litellm.litellm_core_utils.prompt_templates.common_utils import ( handle_messages_with_content_list_to_str_conversion, ) from litellm.secret_managers.main import get_secret_str from litellm.types.llms.openai import AllMessageValues +from litellm.utils import supports_reasoning from ...openai.chat.gpt_transformation import OpenAIGPTConfig @@ -62,6 +64,48 @@ class DeepSeekChatConfig(OpenAIGPTConfig): return optional_params + def _fill_reasoning_content( + self, messages: List[AllMessageValues] + ) -> List[AllMessageValues]: + """ + DeepSeek thinking mode requires `reasoning_content` to be passed back on + every assistant message in multi-turn conversations. If it is missing, + the API returns: + "The reasoning_content in the thinking mode must be passed back to the API." + + For each assistant message that is missing `reasoning_content`: + 1. Promote it from `provider_specific_fields["reasoning_content"]` if present + (LiteLLM stores provider-specific response fields there). + 2. Otherwise inject a single space — the minimum value the API accepts. + """ + result: List[AllMessageValues] = [] + for msg in messages: + if msg.get("role") == "assistant" and not msg.get("reasoning_content"): + patched = dict(cast(dict, msg)) + provider_fields = patched.get("provider_specific_fields") or {} + stored = provider_fields.get("reasoning_content") + if stored: + patched["reasoning_content"] = stored + cleaned = dict(provider_fields) + cleaned.pop("reasoning_content", None) + patched["provider_specific_fields"] = cleaned + else: + litellm.verbose_logger.warning( + "DeepSeek thinking mode: assistant message is missing " + "`reasoning_content` and none was saved in " + "`provider_specific_fields`. A single-space placeholder " + "is being injected to satisfy API validation, but the " + "model will receive a blank reasoning chain for this turn, " + "which may silently degrade multi-turn response quality. " + "Preserve `reasoning_content` from the original assistant " + "response when building multi-turn conversation history." + ) + patched["reasoning_content"] = " " + result.append(cast(AllMessageValues, patched)) + else: + result.append(msg) + return result + @overload def _transform_messages( self, messages: List[AllMessageValues], model: str, is_async: Literal[True] @@ -91,6 +135,66 @@ class DeepSeekChatConfig(OpenAIGPTConfig): messages=messages, model=model, is_async=False ) + def _thinking_mode_active(self, model: str, optional_params: dict) -> bool: + """ + Returns True only when thinking mode is actually active for this request: + - model supports reasoning (capability check) + - user explicitly passed thinking={"type": "enabled"} (opt-in check) + """ + return ( + supports_reasoning(model=model, custom_llm_provider="deepseek") + and (optional_params.get("thinking") or {}).get("type") == "enabled" + ) + + def transform_request( + self, + model: str, + messages: List[AllMessageValues], + optional_params: dict, + litellm_params: dict, + headers: dict, + ) -> dict: + """ + Ensures `reasoning_content` is forwarded on assistant messages for + multi-turn thinking-mode conversations (issue #28045). + + Only runs when thinking mode is actually active - guarded by both + supports_reasoning() (model capability) and optional_params["thinking"] + (user explicitly enabled it), preventing spurious injection on models + like deepseek-v3.2 that support thinking as opt-in but not always-on. + """ + if self._thinking_mode_active(model=model, optional_params=optional_params): + messages = self._fill_reasoning_content(messages) + return super().transform_request( + model=model, + messages=messages, + optional_params=optional_params, + litellm_params=litellm_params, + headers=headers, + ) + + async def async_transform_request( + self, + model: str, + messages: List[AllMessageValues], + optional_params: dict, + litellm_params: dict, + headers: dict, + ) -> dict: + """ + Async equivalent of transform_request — applies the same reasoning_content + fix for multi-turn thinking-mode conversations. + """ + if self._thinking_mode_active(model=model, optional_params=optional_params): + messages = self._fill_reasoning_content(messages) + return await super().async_transform_request( + model=model, + messages=messages, + optional_params=optional_params, + litellm_params=litellm_params, + headers=headers, + ) + def _get_openai_compatible_provider_info( self, api_base: Optional[str], api_key: Optional[str] ) -> Tuple[Optional[str], Optional[str]]: diff --git a/litellm/llms/deepseek/cost_calculator.py b/litellm/llms/deepseek/cost_calculator.py index 0f4490cb3df..e652ebeac54 100644 --- a/litellm/llms/deepseek/cost_calculator.py +++ b/litellm/llms/deepseek/cost_calculator.py @@ -1,5 +1,5 @@ """ -Cost calculator for DeepSeek Chat models. +Cost calculator for DeepSeek Chat models. Handles prompt caching scenario. """ diff --git a/litellm/llms/deepseek/messages/transformation.py b/litellm/llms/deepseek/messages/transformation.py new file mode 100644 index 00000000000..ad60478960e --- /dev/null +++ b/litellm/llms/deepseek/messages/transformation.py @@ -0,0 +1,133 @@ +""" +DeepSeek Anthropic-compatible messages transformation config. +""" + +from typing import Any, Dict, List, Optional, Tuple + +import litellm +from litellm.llms.anthropic.experimental_pass_through.messages.transformation import ( + AnthropicMessagesConfig, +) +from litellm.secret_managers.main import get_secret_str +from litellm.types.router import GenericLiteLLMParams + + +class DeepSeekAnthropicMessagesConfig(AnthropicMessagesConfig): + """ + DeepSeek exposes an Anthropic-compatible Messages API at + https://api.deepseek.com/anthropic. + + It accepts the native Anthropic Messages conversation shape, including + thinking blocks in assistant history, but rejects Anthropic's explicit + custom-tool discriminator (`{"type": "custom"}`). + """ + + @property + def custom_llm_provider(self) -> Optional[str]: + return "deepseek" + + @staticmethod + def get_api_key(api_key: Optional[str] = None) -> Optional[str]: + return api_key or get_secret_str("DEEPSEEK_API_KEY") or litellm.api_key + + @staticmethod + def get_api_base(api_base: Optional[str] = None) -> str: + return ( + api_base + or get_secret_str("DEEPSEEK_ANTHROPIC_API_BASE") + or get_secret_str("DEEPSEEK_API_BASE") + or "https://api.deepseek.com/anthropic" + ) + + def validate_anthropic_messages_environment( + self, + headers: dict, + model: str, + messages: List[Any], + optional_params: dict, + litellm_params: dict, + api_key: Optional[str] = None, + api_base: Optional[str] = None, + ) -> Tuple[dict, Optional[str]]: + dynamic_api_key = self.get_api_key(api_key=api_key) + + if ( + "x-api-key" not in headers + and "authorization" not in headers + and dynamic_api_key is not None + ): + headers["x-api-key"] = dynamic_api_key + + if "anthropic-version" not in headers: + headers["anthropic-version"] = "2023-06-01" + if "content-type" not in headers: + headers["content-type"] = "application/json" + + headers = self._update_headers_with_anthropic_beta( + headers=headers, + optional_params=optional_params, + custom_llm_provider=self.custom_llm_provider or "deepseek", + ) + + return headers, api_base + + def get_complete_url( + self, + api_base: Optional[str], + api_key: Optional[str], + model: str, + optional_params: dict, + litellm_params: dict, + stream: Optional[bool] = None, + ) -> str: + base_url = self.get_api_base(api_base=api_base).rstrip("/") + + if base_url.endswith("/v1/messages") and "/anthropic/" in base_url: + return base_url + if base_url.endswith("/v1/messages"): + base_url = base_url[: -len("/v1/messages")] + if base_url.endswith("/v1"): + base_url = base_url[: -len("/v1")] + if base_url.endswith("/beta"): + base_url = base_url[: -len("/beta")] + + if not base_url.endswith("/anthropic") and "/anthropic/" not in base_url: + base_url = f"{base_url}/anthropic" + + return f"{base_url}/v1/messages" + + @staticmethod + def _sanitize_tools_for_deepseek(tools: Any) -> Any: + if not isinstance(tools, list): + return tools + + sanitized_tools = [] + for tool in tools: + if isinstance(tool, dict) and tool.get("type") == "custom": + sanitized_tool = dict(tool) + sanitized_tool.pop("type", None) + sanitized_tools.append(sanitized_tool) + else: + sanitized_tools.append(tool) + return sanitized_tools + + def transform_anthropic_messages_request( + self, + model: str, + messages: List[Dict], + anthropic_messages_optional_request_params: Dict, + litellm_params: GenericLiteLLMParams, + headers: dict, + ) -> Dict: + anthropic_messages_request = super().transform_anthropic_messages_request( + model=model, + messages=messages, + anthropic_messages_optional_request_params=anthropic_messages_optional_request_params, + litellm_params=litellm_params, + headers=headers, + ) + if "tools" in anthropic_messages_request: + anthropic_messages_request["tools"] = self._sanitize_tools_for_deepseek( + anthropic_messages_request["tools"] + ) + return anthropic_messages_request diff --git a/litellm/llms/elevenlabs/text_to_speech/transformation.py b/litellm/llms/elevenlabs/text_to_speech/transformation.py index 6a59911701b..612fc687ef9 100644 --- a/litellm/llms/elevenlabs/text_to_speech/transformation.py +++ b/litellm/llms/elevenlabs/text_to_speech/transformation.py @@ -22,7 +22,6 @@ from litellm.types.utils import all_litellm_params from ..common_utils import ElevenLabsException - if TYPE_CHECKING: from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj from litellm.types.llms.openai import HttpxBinaryResponseContent diff --git a/litellm/llms/fireworks_ai/chat/transformation.py b/litellm/llms/fireworks_ai/chat/transformation.py index ed6d167a118..d39adf0b6f4 100644 --- a/litellm/llms/fireworks_ai/chat/transformation.py +++ b/litellm/llms/fireworks_ai/chat/transformation.py @@ -4,6 +4,7 @@ from typing import Any, List, Literal, Optional, Tuple, Union, cast import httpx import litellm +from litellm._logging import verbose_logger from litellm._uuid import uuid from litellm.constants import RESPONSE_FORMAT_TOOL_NAME from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj @@ -26,6 +27,7 @@ from litellm.types.utils import ( ProviderSpecificModelInfo, ) from litellm.utils import ( + get_model_cost_mutation_generation, supports_function_calling, supports_reasoning, supports_tool_choice, @@ -112,6 +114,19 @@ class FireworksAIConfig(OpenAIGPTConfig): # Only add tools for models that support function calling if supports_function_calling(model=model, custom_llm_provider="fireworks_ai"): supported_params.append("tools") + supported_params.append("parallel_tool_calls") + else: + # Historically every Fireworks model advertised tool support, so a + # JSON entry that flips `supports_function_calling` to false will + # silently drop `tools` from requests. Surface this so users can + # tell why their tool calls suddenly stop working. + verbose_logger.debug( + "fireworks_ai model %r is marked as not supporting " + "function calling in model_prices_and_context_window.json; " + "`tools` and `parallel_tool_calls` will be dropped from the " + "request.", + model, + ) # Only add tool_choice for models that explicitly support it if supports_tool_choice(model=model, custom_llm_provider="fireworks_ai"): @@ -241,41 +256,110 @@ class FireworksAIConfig(OpenAIGPTConfig): disable_add_transform_inline_image_block=disable_add_transform_inline_image_block, ) filter_value_from_dict(cast(dict, message), "cache_control") - # Remove fields not permitted by FireworksAI that may cause: - # "Not permitted, field: 'messages[n].provider_specific_fields'" - if isinstance(message, dict) and "provider_specific_fields" in message: - cast(dict, message).pop("provider_specific_fields", None) + # Remove fields not permitted by FireworksAI (additionalProperties: false + # on their ChatMessage schema) that may cause: + # "Extra inputs are not permitted, field: 'messages[n].'" + if isinstance(message, dict): + m = cast(dict, message) + m.pop("provider_specific_fields", None) + m.pop("thinking_blocks", None) return messages - def get_provider_info(self, model: str) -> ProviderSpecificModelInfo: - # Models that support reasoning_effort - reasoning_supported_models = [ - "qwen3-8b", - "qwen3-32b", - "qwen3-coder-480b-a35b-instruct", - "deepseek-v3p1", - "deepseek-v3p2", - "glm-4p5", - "glm-4p5-air", - "glm-4p6", - "gpt-oss-120b", - "gpt-oss-20b", + # Cached index of fireworks_ai/* entries from litellm.model_cost. Building + # this index requires a full scan of model_cost (tens of thousands of + # entries), so we memoize it. The cache key is (id(model_cost), + # mutation_generation): the generation counter is bumped on every + # register_model / reload path, so add+remove or in-place value + # replacement (which can leave id and len unchanged) still invalidates. + _fireworks_index_cache: Optional[Tuple[int, int, List[Tuple[str, dict]]]] = None + + @classmethod + def _get_fireworks_index(cls) -> List[Tuple[str, dict]]: + model_cost = litellm.model_cost + signature = (id(model_cost), get_model_cost_mutation_generation()) + cached = cls._fireworks_index_cache + if ( + cached is not None + and cached[0] == signature[0] + and cached[1] == signature[1] + ): + return cached[2] + + index: List[Tuple[str, dict]] = [] + for key, model_info in model_cost.items(): + if not key.startswith("fireworks_ai/"): + continue + if not isinstance(model_info, dict): + continue + key_short = key[len("fireworks_ai/") :] + if key_short.startswith("accounts/fireworks/models/"): + key_short = key_short[len("accounts/fireworks/models/") :] + if not key_short: + continue + index.append((key_short, model_info)) + + cls._fireworks_index_cache = (signature[0], signature[1], index) + return index + + @staticmethod + def _matches_on_hyphen_boundary(short_name: str, key_short: str) -> bool: + """Return True if `key_short` appears in `short_name` aligned to + hyphen-separated word boundaries (or end-of-string). This avoids + spurious substring matches like `"some-model"` matching + `"awesome-model"`.""" + if short_name == key_short: + return True + if short_name.startswith(key_short + "-"): + return True + if short_name.endswith("-" + key_short): + return True + return ("-" + key_short + "-") in short_name + + def _get_model_cost_capability(self, model: str, capability: str) -> Optional[bool]: + short_name = model + if short_name.startswith("fireworks_ai/"): + short_name = short_name[len("fireworks_ai/") :] + if short_name.startswith("accounts/fireworks/models/"): + short_name = short_name[len("accounts/fireworks/models/") :] + + candidate_keys = [ + model, + f"fireworks_ai/{short_name}", + f"fireworks_ai/accounts/fireworks/models/{short_name}", ] - # Normalize model name - remove prefix if present - normalized_model = model - if model.startswith("fireworks_ai/"): - normalized_model = model.replace("fireworks_ai/", "") - if normalized_model.startswith("accounts/fireworks/models/"): - normalized_model = normalized_model.replace( - "accounts/fireworks/models/", "" - ) + for candidate_key in candidate_keys: + model_info = litellm.model_cost.get(candidate_key) + if model_info is not None and model_info.get(capability) is not None: + return cast(Optional[bool], model_info.get(capability)) - # Check if model supports reasoning - supports_reasoning_value = any( - reasoning_model in normalized_model - for reasoning_model in reasoning_supported_models + # Fallback: preserve historical substring matching for model name + # variants (e.g. fine-tuned or regionally-suffixed versions of a + # known model). Pick the *longest* matching entry so a more specific + # known model (e.g. "qwen3-8b-instruct") wins over a less specific + # one (e.g. "qwen3-8b") when the query model is more specific still. + # Use hyphen-aligned matching to avoid false positives where a short + # known model name is an unrelated substring of a longer one. + best_match_short: Optional[str] = None + best_match_value: Optional[bool] = None + for key_short, model_info in self._get_fireworks_index(): + if model_info.get(capability) is None: + continue + if not self._matches_on_hyphen_boundary(short_name, key_short): + continue + if best_match_short is None or len(key_short) > len(best_match_short): + best_match_short = key_short + best_match_value = cast(Optional[bool], model_info.get(capability)) + + return best_match_value + + def get_provider_info(self, model: str) -> ProviderSpecificModelInfo: + supports_function_calling_value = self._get_model_cost_capability( + model=model, capability="supports_function_calling" + ) + supports_reasoning_value = self._get_model_cost_capability( + model=model, capability="supports_reasoning" ) provider_specific_model_info: ProviderSpecificModelInfo = { @@ -285,9 +369,16 @@ class FireworksAIConfig(OpenAIGPTConfig): "supports_vision": True, # via document inlining } + if supports_function_calling_value is not None: + provider_specific_model_info["supports_function_calling"] = ( + supports_function_calling_value + ) + # Only include supports_reasoning if True if supports_reasoning_value: - provider_specific_model_info["supports_reasoning"] = True + provider_specific_model_info["supports_reasoning"] = ( + supports_reasoning_value + ) return provider_specific_model_info diff --git a/litellm/llms/gemini/agents/__init__.py b/litellm/llms/gemini/agents/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/litellm/llms/gemini/agents/transformation.py b/litellm/llms/gemini/agents/transformation.py new file mode 100644 index 00000000000..f6e0b95cf28 --- /dev/null +++ b/litellm/llms/gemini/agents/transformation.py @@ -0,0 +1,298 @@ +""" +Google AI Studio Agents API configuration. + +Proxies the Gemini v1beta Agents API: + POST /v1beta/agents create + GET /v1beta/agents list + GET /v1beta/agents/{name} get + DELETE /v1beta/agents/{name} delete + GET /v1beta/agents/{name}/versions list versions +""" + +from typing import Any, Dict, Optional, Tuple, Union + +import httpx + +from litellm._logging import verbose_logger +from litellm.llms.base_llm.agents.transformation import BaseAgentsAPIConfig +from litellm.llms.gemini.common_utils import GeminiError, GeminiModelInfo +from litellm.types.agents import ( + AgentCreateResponse, + AgentDeleteResult, + AgentListResponse, + AgentVersionsResponse, +) + +# Keys inside litellm_params that should be forwarded to the Gemini +# create-agent body verbatim. +_GEMINI_AGENT_BODY_KEYS = ("base_agent", "instructions", "base_environment") + +# LiteLLM-internal keys that must never be forwarded to Gemini. +_LITELLM_INTERNAL_KEYS = frozenset( + { + "custom_llm_provider", + "api_key", + "api_base", + "make_public", + "cost_per_query", + "input_cost_per_token", + "output_cost_per_token", + "require_trace_id_on_calls_to_agent", + "require_trace_id_on_calls_by_agent", + "max_iterations", + "max_budget_per_session", + "guardrails", + "is_public", + "agent_name", + "agent_id", + "agent_card_params", + "provider_agent_response", + } +) + + +class GeminiAgentsConfig(BaseAgentsAPIConfig): + """ + Configuration for the Google AI Studio (Gemini) native Agents API. + + Authentication uses x-goog-api-key, resolved from (in order): + 1. litellm_params["api_key"] + 2. GOOGLE_API_KEY env var + 3. GEMINI_API_KEY env var + """ + + @property + def api_version(self) -> str: + return "v1beta" + + def _base_url(self, api_base: Optional[str]) -> str: + return f"{GeminiModelInfo.get_api_base(api_base)}/{self.api_version}" + + # ------------------------------------------------------------------ # + # Shared helpers # + # ------------------------------------------------------------------ # + + def get_error_class( + self, + error_message: str, + status_code: int, + headers: Union[dict, httpx.Headers], + ) -> Exception: + return GeminiError( + message=error_message, + status_code=status_code, + headers=dict(headers), + ) + + def get_complete_url( + self, + api_base: Optional[str], + litellm_params: Dict[str, Any], + ) -> str: + return f"{self._base_url(api_base)}/agents" + + def validate_environment( + self, + headers: Dict[str, str], + litellm_params: Dict[str, Any], + ) -> Dict[str, str]: + headers = dict(headers) + headers["Content-Type"] = "application/json" + explicit_api_key = litellm_params.get("api_key") + # SECURITY: when the caller overrides ``api_base``, refuse to fall back + # to the process-wide GOOGLE_API_KEY / GEMINI_API_KEY env vars. Otherwise + # an authenticated proxy user could set ``api_base`` to an attacker- + # controlled host and have the proxy ship its shared Gemini key in the + # ``x-goog-api-key`` header. + if litellm_params.get("api_base") and not explicit_api_key: + raise ValueError( + "When overriding api_base for Gemini agents, you must also " + "supply an explicit api_key. Falling back to GOOGLE_API_KEY / " + "GEMINI_API_KEY env vars with a custom api_base is refused " + "to prevent leaking the shared provider key to arbitrary hosts." + ) + api_key = GeminiModelInfo.get_api_key(explicit_api_key) + if not api_key: + raise ValueError( + "Google API key is required. " + "Set GOOGLE_API_KEY or GEMINI_API_KEY, or pass api_key." + ) + headers["x-goog-api-key"] = api_key + return headers + + def _raise_for_status(self, raw_response: httpx.Response) -> None: + if not (200 <= raw_response.status_code < 300): + raise GeminiError( + message=raw_response.text, + status_code=raw_response.status_code, + headers=dict(raw_response.headers), + ) + + # ------------------------------------------------------------------ # + # CREATE # + # ------------------------------------------------------------------ # + + def transform_create_request( + self, + name: str, + litellm_params: Dict[str, Any], + ) -> Dict[str, Any]: + body: Dict[str, Any] = {"name": name} + for key in _GEMINI_AGENT_BODY_KEYS: + value = litellm_params.get(key) + if value is not None: + body[key] = value + verbose_logger.debug("GeminiAgentsConfig create body: %s", body) + return body + + def transform_create_response( + self, + raw_response: httpx.Response, + name: str, + ) -> AgentCreateResponse: + """ + Gemini returns: + {"id": "my-agent", "base_agent": "waverunner", + "system_instruction": "...", "base_environment": {...}} + """ + self._raise_for_status(raw_response) + try: + data: Dict[str, Any] = raw_response.json() + except Exception: + verbose_logger.warning( + "GeminiAgentsConfig: non-JSON create response (status=%d).", + raw_response.status_code, + ) + data = {"id": name} + # Gemini uses "id" as the identifier; normalise to both fields. + data.setdefault("id", name) + data.setdefault("name", data["id"]) + verbose_logger.debug("GeminiAgentsConfig create response: %s", data) + return AgentCreateResponse(**data) + + # ------------------------------------------------------------------ # + # LIST # + # ------------------------------------------------------------------ # + + def transform_list_request( + self, + api_base: Optional[str], + litellm_params: Dict[str, Any], + ) -> Tuple[str, Dict[str, Any]]: + url = f"{self._base_url(api_base)}/agents" + params: Dict[str, Any] = {} + if litellm_params.get("page_size"): + params["pageSize"] = litellm_params["page_size"] + if litellm_params.get("page_token"): + params["pageToken"] = litellm_params["page_token"] + return url, params + + def transform_list_response( + self, + raw_response: httpx.Response, + ) -> AgentListResponse: + self._raise_for_status(raw_response) + try: + data = raw_response.json() + except Exception: + data = {} + verbose_logger.debug("GeminiAgentsConfig list response: %s", data) + return AgentListResponse( + agents=data.get("agents", []), + next_page_token=data.get("nextPageToken"), + ) + + # ------------------------------------------------------------------ # + # GET # + # ------------------------------------------------------------------ # + + def transform_get_request( + self, + name: str, + api_base: Optional[str], + litellm_params: Dict[str, Any], + ) -> Tuple[str, Dict[str, Any]]: + url = f"{self._base_url(api_base)}/agents/{name}" + return url, {} + + def transform_get_response( + self, + raw_response: httpx.Response, + name: str, + ) -> AgentCreateResponse: + """Same shape as create response — Gemini returns "id" as identifier.""" + self._raise_for_status(raw_response) + try: + data = raw_response.json() + except Exception: + data = {"id": name} + data.setdefault("id", name) + data.setdefault("name", data["id"]) + verbose_logger.debug("GeminiAgentsConfig get response: %s", data) + return AgentCreateResponse(**data) + + # ------------------------------------------------------------------ # + # DELETE # + # ------------------------------------------------------------------ # + + def transform_delete_request( + self, + name: str, + api_base: Optional[str], + litellm_params: Dict[str, Any], + ) -> str: + return f"{self._base_url(api_base)}/agents/{name}" + + def transform_delete_response( + self, + raw_response: httpx.Response, + name: str, + ) -> AgentDeleteResult: + """Gemini returns an empty body ``{}`` with HTTP 200 on success.""" + self._raise_for_status(raw_response) + verbose_logger.debug( + "GeminiAgentsConfig delete (status=%d) agent '%s'", + raw_response.status_code, + name, + ) + return AgentDeleteResult(name=name, deleted=True) + + # ------------------------------------------------------------------ # + # LIST VERSIONS # + # ------------------------------------------------------------------ # + + def transform_list_versions_request( + self, + name: str, + api_base: Optional[str], + litellm_params: Dict[str, Any], + ) -> Tuple[str, Dict[str, Any]]: + url = f"{self._base_url(api_base)}/agents/{name}/versions" + params: Dict[str, Any] = {} + if litellm_params.get("page_size"): + params["pageSize"] = litellm_params["page_size"] + if litellm_params.get("page_token"): + params["pageToken"] = litellm_params["page_token"] + return url, params + + def transform_list_versions_response( + self, + raw_response: httpx.Response, + name: str, + ) -> AgentVersionsResponse: + """ + Gemini returns: + {"agentVersions": [{"agent": "waverunner", "name": "agents/.../versions/uuid", ...}]} + """ + self._raise_for_status(raw_response) + try: + data = raw_response.json() + except Exception: + data = {} + verbose_logger.debug( + "GeminiAgentsConfig list_versions response for '%s': %s", name, data + ) + return AgentVersionsResponse( + agent_versions=data.get("agentVersions", []), + next_page_token=data.get("nextPageToken"), + ) diff --git a/litellm/llms/gemini/chat/transformation.py b/litellm/llms/gemini/chat/transformation.py index 72569e5c6cd..b69b7e1913e 100644 --- a/litellm/llms/gemini/chat/transformation.py +++ b/litellm/llms/gemini/chat/transformation.py @@ -1,5 +1,7 @@ from typing import List, Optional, cast +import litellm + from litellm.litellm_core_utils.prompt_templates.factory import ( convert_generic_image_chunk_to_openai_image_obj, convert_to_anthropic_image_obj, @@ -101,7 +103,10 @@ class GoogleAIStudioGeminiConfig(VertexGeminiConfig): return supported_params def _transform_messages( - self, messages: List[AllMessageValues], model: Optional[str] = None + self, + messages: List[AllMessageValues], + model: Optional[str] = None, + litellm_params: Optional[dict] = None, ) -> List[ContentType]: """ Google AI Studio Gemini does not support HTTP/HTTPS URLs for files. @@ -141,14 +146,26 @@ class GoogleAIStudioGeminiConfig(VertexGeminiConfig): img_element["image_url"] = converted_image_url # type: ignore elif element.get("type") == "file": file_element = cast(ChatCompletionFileObject, element) - file_id = file_element["file"].get("file_id") + _file_field = file_element.get("file") + if _file_field is None: + raise litellm.BadRequestError( + message="Content block has type='file' but is missing the required 'file' field", + model=model, + llm_provider="gemini", + ) + file_id = _file_field.get("file_id") if file_id and ("http://" in file_id or "https://" in file_id): # Convert HTTP/HTTPS file URL to base64 data try: base64_data = convert_url_to_base64(file_id) - file_element["file"]["file_data"] = base64_data # type: ignore - file_element["file"].pop("file_id", None) # type: ignore + _file_field["file_data"] = base64_data # type: ignore + _file_field.pop("file_id", None) # type: ignore except Exception: # If conversion fails, leave as is and let the API handle it pass - return _gemini_convert_messages_with_history(messages=messages, model=model) + return _gemini_convert_messages_with_history( + messages=messages, + model=model, + litellm_params=litellm_params, + custom_llm_provider="gemini", + ) diff --git a/litellm/llms/gemini/google_genai/transformation.py b/litellm/llms/gemini/google_genai/transformation.py index 7c4c7dba626..ee201af7e1a 100644 --- a/litellm/llms/gemini/google_genai/transformation.py +++ b/litellm/llms/gemini/google_genai/transformation.py @@ -2,6 +2,7 @@ Transformation for Calling Google models in their native format. """ +from copy import deepcopy from typing import TYPE_CHECKING, Any, Dict, List, Literal, Optional, Tuple, Union, cast import httpx @@ -11,6 +12,10 @@ from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLogging from litellm.llms.base_llm.google_genai.transformation import ( BaseGoogleGenAIGenerateContentConfig, ) +from litellm.llms.vertex_ai.common_utils import ( + _build_vertex_schema, + supports_response_json_schema, +) from litellm.llms.vertex_ai.gemini.vertex_and_google_ai_studio_gemini import VertexLLM from litellm.types.router import GenericLiteLLMParams @@ -302,6 +307,52 @@ class GoogleGenAIConfig(BaseGoogleGenAIGenerateContentConfig, VertexLLM): litellm_params=litellm_params, ) + @staticmethod + def _normalize_response_schema( + generate_content_config_dict: Dict, model: str + ) -> None: + schema_key = next( + ( + k + for k in ("responseSchema", "response_schema") + if k in generate_content_config_dict + ), + None, + ) + json_schema_key = next( + ( + k + for k in ("responseJsonSchema", "response_json_schema") + if k in generate_content_config_dict + ), + None, + ) + + if schema_key is None: + return + + value = generate_content_config_dict[schema_key] + if not isinstance(value, dict): + return + + if supports_response_json_schema(model): + if json_schema_key is not None: + generate_content_config_dict.pop(schema_key) + return + generate_content_config_dict.pop(schema_key) + new_json_schema_key = ( + "response_json_schema" + if schema_key == "response_schema" + else "responseJsonSchema" + ) + generate_content_config_dict[new_json_schema_key] = value + else: + if json_schema_key is not None: + generate_content_config_dict.pop(json_schema_key) + generate_content_config_dict[schema_key] = _build_vertex_schema( + parameters=deepcopy(value), add_property_ordering=True + ) + def transform_generate_content_request( self, model: str, @@ -315,6 +366,8 @@ class GoogleGenAIConfig(BaseGoogleGenAIGenerateContentConfig, VertexLLM): GenerateContentRequestDict, ) + self._normalize_response_schema(generate_content_config_dict, model) + typed_generate_content_request = GenerateContentRequestDict( model=model, contents=contents, diff --git a/litellm/llms/gemini/interactions/transformation.py b/litellm/llms/gemini/interactions/transformation.py index 593cbf7c2cf..b18b6a28ce4 100644 --- a/litellm/llms/gemini/interactions/transformation.py +++ b/litellm/llms/gemini/interactions/transformation.py @@ -6,13 +6,18 @@ Per OpenAPI spec (https://ai.google.dev/static/api/interactions.openapi.json): - Get: GET https://generativelanguage.googleapis.com/{api_version}/interactions/{interaction_id} - Delete: DELETE https://generativelanguage.googleapis.com/{api_version}/interactions/{interaction_id} -This is a thin wrapper - no transformation needed since we follow the spec directly. +Schema versioning: +- Default (Api-Revision: 2026-05-20): new `steps` schema. +- Legacy (Api-Revision: 2026-05-07): old `outputs` schema, controlled via + litellm.use_legacy_interactions_schema = True. Remove flag after June 8, 2026. """ from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple import httpx +import litellm + from litellm._logging import verbose_logger from litellm.litellm_core_utils.core_helpers import process_response_headers from litellm.litellm_core_utils.url_utils import encode_url_path_segment @@ -64,6 +69,7 @@ class GoogleAIStudioInteractionsConfig(BaseInteractionsAPIConfig): "stream", "store", "background", + "environment", "response_modalities", "response_format", "response_mime_type", @@ -83,6 +89,15 @@ class GoogleAIStudioInteractionsConfig(BaseInteractionsAPIConfig): api_key = GeminiModelInfo.get_api_key(litellm_params.get("api_key")) if api_key: headers["x-goog-api-key"] = api_key + + # Inject the Api-Revision header to select the response schema. + # Default to the new `steps` schema unless the operator has opted out. + # Remove this conditional after June 8, 2026 and always use 2026-05-20. + if litellm.use_legacy_interactions_schema: + headers["Api-Revision"] = "2026-05-07" + else: + headers["Api-Revision"] = "2026-05-20" + return headers def get_complete_url( @@ -118,8 +133,19 @@ class GoogleAIStudioInteractionsConfig(BaseInteractionsAPIConfig): headers: dict, ) -> Dict: """ - Build request body per OpenAPI spec - minimal transformation. + Build request body per OpenAPI spec. + + When on the new schema (use_legacy_interactions_schema=False, the default): + - ``response_mime_type`` is folded into ``response_format`` and stripped from + the body (the field was removed in Api-Revision 2026-05-20). + - ``generation_config.image_config`` is moved to a ``response_format`` entry + with ``"type": "image"`` (also removed from generation_config in 2026-05-20). + + When on the legacy schema (use_legacy_interactions_schema=True): + - All fields are forwarded as-is. """ + use_legacy: bool = litellm.use_legacy_interactions_schema + request_body: Dict[str, Any] = {} # Model or Agent (one required) @@ -134,23 +160,81 @@ class GoogleAIStudioInteractionsConfig(BaseInteractionsAPIConfig): if input is not None: request_body["input"] = input - # Pass through optional params directly (they match the spec) + # Pass through optional params — legacy schema keeps all fields as-is. optional_keys = [ "tools", "system_instruction", - "generation_config", "stream", "store", "background", + "environment", "response_modalities", - "response_format", - "response_mime_type", "previous_interaction_id", ] for key in optional_keys: if optional_params.get(key) is not None: request_body[key] = optional_params[key] + if use_legacy: + # Legacy schema: forward response_mime_type and response_format as-is. + for key in ("response_format", "response_mime_type", "generation_config"): + if optional_params.get(key) is not None: + request_body[key] = optional_params[key] + else: + # New schema (Api-Revision: 2026-05-20): + # response_mime_type is removed — fold it into response_format. + response_format = optional_params.get("response_format") + response_mime_type = optional_params.get("response_mime_type") + + if ( + response_mime_type + and not isinstance(response_format, list) + and ( + not isinstance(response_format, dict) + or "mime_type" not in response_format + ) + ): + # Wrap the legacy schema into the new polymorphic format. + new_rf: Dict[str, Any] = { + "type": "text", + "mime_type": response_mime_type, + } + if response_format is not None: + new_rf["schema"] = response_format + response_format = new_rf + + if response_format is not None: + request_body["response_format"] = response_format + + # image_config moves out of generation_config into response_format. + generation_config: Optional[Dict[str, Any]] = optional_params.get( + "generation_config" + ) + if generation_config is not None: + image_config = None + if isinstance(generation_config, dict): + generation_config = dict( + generation_config + ) # avoid mutating the caller's dict + image_config = generation_config.pop("image_config", None) + if not generation_config: + generation_config = None + + if generation_config is not None: + request_body["generation_config"] = generation_config + + if image_config is not None: + # Move image_config to response_format with type=image. + image_rf: Dict[str, Any] = {"type": "image", **image_config} + existing_rf = request_body.get("response_format") + if existing_rf is None: + request_body["response_format"] = image_rf + elif isinstance(existing_rf, list): + request_body["response_format"] = [*existing_rf, image_rf] + else: + # Convert single entry to array for multimodal output. + request_body["response_format"] = [existing_rf, image_rf] + return request_body def transform_response( diff --git a/litellm/llms/gemini/videos/transformation.py b/litellm/llms/gemini/videos/transformation.py index c7116940b22..9714c8a3923 100644 --- a/litellm/llms/gemini/videos/transformation.py +++ b/litellm/llms/gemini/videos/transformation.py @@ -55,7 +55,7 @@ def _convert_image_to_gemini_format(image_file) -> Dict[str, str]: def _usage_video_resolution_from_parameters( - parameters: Dict[str, Any] + parameters: Dict[str, Any], ) -> Optional[str]: """Normalize Veo ``parameters.resolution`` for usage and cost tracking.""" res = parameters.get("resolution") diff --git a/litellm/llms/infinity/rerank/transformation.py b/litellm/llms/infinity/rerank/transformation.py index 314bf2f8a36..b9804605454 100644 --- a/litellm/llms/infinity/rerank/transformation.py +++ b/litellm/llms/infinity/rerank/transformation.py @@ -1,5 +1,5 @@ """ -Transformation logic from Cohere's /v1/rerank format to Infinity's `/v1/rerank` format. +Transformation logic from Cohere's /v1/rerank format to Infinity's `/v1/rerank` format. Why separate file? Make it easy to see how transformation works """ diff --git a/litellm/llms/jina_ai/rerank/transformation.py b/litellm/llms/jina_ai/rerank/transformation.py index ad4416925a6..56be754fc34 100644 --- a/litellm/llms/jina_ai/rerank/transformation.py +++ b/litellm/llms/jina_ai/rerank/transformation.py @@ -1,5 +1,5 @@ """ -Transformation logic from Cohere's /v1/rerank format to Jina AI's `/v1/rerank` format. +Transformation logic from Cohere's /v1/rerank format to Jina AI's `/v1/rerank` format. Why separate file? Make it easy to see how transformation works diff --git a/litellm/llms/lm_studio/embed/transformation.py b/litellm/llms/lm_studio/embed/transformation.py index 1285550c30f..87f4f6e73d5 100644 --- a/litellm/llms/lm_studio/embed/transformation.py +++ b/litellm/llms/lm_studio/embed/transformation.py @@ -1,5 +1,5 @@ """ -Transformation logic from OpenAI /v1/embeddings format to LM Studio's `/v1/embeddings` format. +Transformation logic from OpenAI /v1/embeddings format to LM Studio's `/v1/embeddings` format. Why separate file? Make it easy to see how transformation works diff --git a/litellm/llms/novita/chat/transformation.py b/litellm/llms/novita/chat/transformation.py index c05d2d7b2c5..5a64a124ade 100644 --- a/litellm/llms/novita/chat/transformation.py +++ b/litellm/llms/novita/chat/transformation.py @@ -1,5 +1,5 @@ """ -Support for OpenAI's `/v1/chat/completions` endpoint. +Support for OpenAI's `/v1/chat/completions` endpoint. Calls done in OpenAI/openai.py as Novita AI is openai-compatible. diff --git a/litellm/llms/nvidia_nim/chat/transformation.py b/litellm/llms/nvidia_nim/chat/transformation.py index b8f8b04eb53..2ef92a90626 100644 --- a/litellm/llms/nvidia_nim/chat/transformation.py +++ b/litellm/llms/nvidia_nim/chat/transformation.py @@ -1,7 +1,7 @@ """ -Nvidia NIM endpoint: https://docs.api.nvidia.com/nim/reference/databricks-dbrx-instruct-infer +Nvidia NIM endpoint: https://docs.api.nvidia.com/nim/reference/databricks-dbrx-instruct-infer -This is OpenAI compatible +This is OpenAI compatible This file only contains param mapping logic diff --git a/litellm/llms/nvidia_nim/embed.py b/litellm/llms/nvidia_nim/embed.py index 24c6cc34e4d..61c8e8244e4 100644 --- a/litellm/llms/nvidia_nim/embed.py +++ b/litellm/llms/nvidia_nim/embed.py @@ -1,7 +1,7 @@ """ Nvidia NIM embeddings endpoint: https://docs.api.nvidia.com/nim/reference/nvidia-nv-embedqa-e5-v5-infer -This is OpenAI compatible +This is OpenAI compatible This file only contains param mapping logic diff --git a/litellm/llms/oci/chat/cohere.py b/litellm/llms/oci/chat/cohere.py new file mode 100644 index 00000000000..ac92fd22aa8 --- /dev/null +++ b/litellm/llms/oci/chat/cohere.py @@ -0,0 +1,386 @@ +""" +OCI Generative AI — Cohere-specific chat transformation helpers. + +Handles message history building, tool definition adaptation, non-streaming +response parsing, and streaming chunk parsing for models served with +``apiFormat="COHERE"`` (e.g. ``cohere.command-*``). +""" + +import datetime +import json +from typing import Any, Dict, List, Optional + +import httpx +from pydantic import ValidationError + +from litellm.llms.oci.chat.generic import ( + _normalize_oci_finish_reason, + _synthesize_oci_tool_call_id, +) +from litellm.llms.oci.common_utils import ( + OCI_JSON_TO_PYTHON_TYPES, + OCIError, + enrich_cohere_param_description, + resolve_oci_schema_anyof, + resolve_oci_schema_refs, + sanitize_oci_schema, +) +from litellm.types.llms.oci import ( + CohereChatResult, + CohereMessage, + CohereParameterDefinition, + CohereStreamChunk, + CohereTool, + CohereToolCall, + CohereToolMessage, + CohereToolResult, +) +from litellm.types.llms.openai import AllMessageValues +from litellm.types.utils import ( + Choices, + Delta, + ModelResponse, + ModelResponseStream, + StreamingChoices, +) +from litellm.types.utils import Usage + + +def _extract_text_content(content: Any) -> str: + """Return the plain-text representation of a message content value.""" + if content is None: + return "" + if isinstance(content, str): + return content + if isinstance(content, list): + return "".join( + item.get("text", "") + for item in content + if isinstance(item, dict) and item.get("type") == "text" + ) + return str(content) + + +def adapt_messages_to_cohere_standard( + messages: List[AllMessageValues], +) -> List[CohereMessage]: + """Build a Cohere ``chatHistory`` list from an OpenAI-format message array. + + - All messages except the *last user message* are included. The caller pulls + the last user message into the request's top-level ``message`` field, so + trailing tool results (the standard agentic continuation pattern) still + appear in ``chatHistory`` and reach the model. + - If no user message exists, every message is included (no slice). + - System messages must be filtered out by the caller (they are routed into + ``preambleOverride`` separately) — they are not represented in + ``chatHistory``. + - Tool results are expressed as OCI ``CohereToolMessage.toolResults`` entries, + with the originating call's name and parameters resolved from the preceding + assistant message via a ``tool_call_id`` lookup. + """ + # First pass: build tool_call_id → CohereToolCall so tool-result messages can + # reference the originating call by name and parameters. + tool_call_lookup: Dict[str, CohereToolCall] = {} + for msg in messages: + if msg.get("role") == "assistant": + tool_calls_raw: Any = msg.get("tool_calls") or [] + for tc in tool_calls_raw: + tc_id = tc.get("id", "") + raw_args: Any = tc.get("function", {}).get("arguments", "{}") + try: + params: Dict[str, Any] = ( + json.loads(raw_args) if isinstance(raw_args, str) else raw_args + ) + except json.JSONDecodeError: + params = {} + tool_call_lookup[tc_id] = CohereToolCall( + name=str(tc.get("function", {}).get("name", "")), + parameters=params, + ) + + last_user_index = next( + ( + i + for i in range(len(messages) - 1, -1, -1) + if messages[i].get("role") == "user" + ), + None, + ) + history_source = ( + messages + if last_user_index is None + else [m for i, m in enumerate(messages) if i != last_user_index] + ) + + chat_history: List[CohereMessage] = [] + for msg in history_source: + role = msg.get("role") + content = _extract_text_content(msg.get("content")) + + tool_calls: Optional[List[CohereToolCall]] = None + if role == "assistant" and msg.get("tool_calls"): # type: ignore[union-attr,typeddict-item] + tool_calls = [] + for tc in msg["tool_calls"]: # type: ignore[union-attr,typeddict-item] + raw_arguments: Any = tc.get("function", {}).get("arguments", {}) + if isinstance(raw_arguments, str): + try: + arguments: Dict[str, Any] = json.loads(raw_arguments) + except json.JSONDecodeError: + arguments = {} + else: + arguments = raw_arguments + tool_calls.append( + CohereToolCall( + name=str(tc.get("function", {}).get("name", "")), + parameters=arguments, + ) + ) + + if role == "user": + chat_history.append(CohereMessage(role="USER", message=content)) + elif role == "assistant": + chat_history.append( + CohereMessage(role="CHATBOT", message=content, toolCalls=tool_calls) + ) + elif role == "tool": + tool_call_id = str(msg.get("tool_call_id", "") or "") + cohere_call = tool_call_lookup.get( + tool_call_id, CohereToolCall(name="", parameters={}) + ) + tool_result = CohereToolResult( + call=cohere_call, + outputs=[{"output": content}], + ) + # OpenAI emits one tool-role message per parallel tool call, but + # the OCI Cohere API expects all results from a single assistant + # turn to share one TOOL history entry with multiple toolResults. + # Merge consecutive tool messages so the model sees the parallel + # call/result pairing correctly during agentic loops. + if chat_history and isinstance(chat_history[-1], CohereToolMessage): + chat_history[-1].toolResults.append(tool_result) + else: + chat_history.append(CohereToolMessage(toolResults=[tool_result])) + + return chat_history + + +def adapt_tool_definitions_to_cohere_standard( + tools: List[Dict[str, Any]], +) -> List[CohereTool]: + """Adapt OpenAI-format tool definitions to the OCI Cohere format. + + - Resolves ``$ref``/``$defs`` and ``anyOf`` patterns that OCI rejects. + - Maps JSON Schema type names to Python type names (``"string"`` → ``"str"``). + - Embeds unsupported constraints (enum, format, range, pattern) into the + parameter description so the model can still see them. + """ + cohere_tools = [] + for tool in tools: + function_def = tool.get("function", {}) + raw_params = function_def.get("parameters", {}) + + resolved = sanitize_oci_schema( + resolve_oci_schema_anyof(resolve_oci_schema_refs(raw_params)) + ) + properties = resolved.get("properties", {}) + required = resolved.get("required", []) + + parameter_definitions = {} + for param_name, param_schema in properties.items(): + json_type = param_schema.get("type", "string") + python_type = OCI_JSON_TO_PYTHON_TYPES.get(json_type, json_type) + parameter_definitions[param_name] = CohereParameterDefinition( + description=enrich_cohere_param_description( + param_schema.get("description", ""), param_schema + ), + type=python_type, + isRequired=param_name in required, + ) + + cohere_tools.append( + CohereTool( + name=function_def.get("name", ""), + description=function_def.get("description", ""), + parameterDefinitions=parameter_definitions, + ) + ) + + return cohere_tools + + +def handle_cohere_response( + json_response: dict, + model: str, + model_response: ModelResponse, + raw_response: httpx.Response, +) -> ModelResponse: + """Parse a non-streaming Cohere OCI response into a LiteLLM ModelResponse.""" + try: + cohere_response = CohereChatResult(**json_response) + except (TypeError, ValidationError) as e: + raise OCIError( + message=f"Response cannot be casted to CohereChatResult: {str(e)}", + status_code=raw_response.status_code, + ) + + model_response.model = model + model_response.created = int(datetime.datetime.now().timestamp()) + + response_text = cohere_response.chatResponse.text + finish_reason = _normalize_oci_finish_reason( + cohere_response.chatResponse.finishReason + ) + + tool_calls: Optional[List[Dict[str, Any]]] = None + if cohere_response.chatResponse.toolCalls: + tool_calls = [ + { + "id": _synthesize_oci_tool_call_id( + i, tc.name, json.dumps(tc.parameters, sort_keys=True) + ), + "type": "function", + "function": { + "name": tc.name, + "arguments": json.dumps(tc.parameters), + }, + } + for i, tc in enumerate(cohere_response.chatResponse.toolCalls) + ] + + content: Optional[str] = response_text if response_text else None + + # Only include ``tool_calls`` in the message dict when actually present. + # Passing an explicit ``None`` would let downstream consumers that key off + # ``"tool_calls" in message`` (rather than truthiness) incorrectly conclude + # that tool calls were attempted. Matches the generic handler's behaviour, + # which only sets ``message.tool_calls`` when tool calls are present. + message: Dict[str, Any] = {"role": "assistant", "content": content} + if tool_calls is not None: + message["tool_calls"] = tool_calls + + model_response.choices = [ + Choices( + index=0, + message=message, + finish_reason=finish_reason, + ) + ] + + usage_info = cohere_response.chatResponse.usage + if usage_info is not None: + model_response.usage = Usage( # type: ignore[attr-defined] + prompt_tokens=usage_info.promptTokens, + completion_tokens=usage_info.completionTokens, + total_tokens=usage_info.totalTokens, + ) + else: + model_response.usage = Usage(prompt_tokens=0, completion_tokens=0, total_tokens=0) # type: ignore[attr-defined] + + return model_response + + +def handle_cohere_stream_chunk( + dict_chunk: dict, + prior_tool_calls_emitted: bool = False, + prior_text_emitted: bool = False, +) -> ModelResponseStream: + """Parse a single Cohere SSE chunk into a LiteLLM ModelResponseStream. + + ``prior_tool_calls_emitted`` lets the caller signal whether tool calls + were already emitted in earlier chunks of the same stream. When set, the + terminal consolidation chunk's tool calls are suppressed (they would + duplicate prior deltas); otherwise they are passed through so a stream + that delivers tool calls only on the terminal chunk doesn't silently + drop them. + + ``prior_text_emitted`` plays the analogous role for the ``text`` field: + when set, the terminal consolidation chunk's ``text`` is suppressed + (it would re-emit the full assembled response on top of prior deltas); + when unset (e.g. a degenerate stream that delivers the entire response + in a single SSE event carrying both ``chatHistory`` and ``finishReason``), + the text is passed through so the response content isn't silently lost. + """ + try: + typed_chunk = CohereStreamChunk(**dict_chunk) + except (TypeError, ValidationError) as e: + raise OCIError( + status_code=500, + message=f"Chunk cannot be parsed as CohereStreamChunk: {str(e)}", + ) + + if typed_chunk.index is None: + typed_chunk.index = 0 + + # OCI Cohere's terminal SSE event re-sends the full assembled response in + # `text` alongside a populated `chatHistory` and a non-null `finishReason`. + # Emitting that text would concatenate the whole response onto the + # already-streamed deltas. We require both signals to be present so that a + # future API change which adds `chatHistory` to intermediate chunks (or a + # rare early-populated case) doesn't silently drop legitimate token deltas. + is_terminal_consolidation = ( + typed_chunk.chatHistory is not None and typed_chunk.finishReason is not None + ) + # On non-terminal text-free chunks (e.g. tool-call-only or keep-alive + # chunks) emit ``content=None`` rather than ``content=""`` so downstream + # stream-mergers that distinguish "no text in this delta" from "an + # explicitly empty text delta" behave correctly. + # + # We only suppress the terminal chunk's ``text`` when the caller has + # confirmed that text deltas were already emitted earlier — otherwise + # (e.g. a degenerate stream that delivers the whole response in a + # single SSE event), passing it through is the only chance to surface it. + text: Optional[str] = ( + None if (is_terminal_consolidation and prior_text_emitted) else typed_chunk.text + ) + + # Tool calls on the terminal consolidation chunk (whether from + # `typed_chunk.toolCalls` or from `chatHistory`) typically restate what + # was already streamed in intermediate chunks. Re-emitting them would + # mint fresh `uuid4` IDs and cause downstream consumers to execute each + # tool call twice. We only suppress when the caller has confirmed that + # tool calls were already emitted earlier — otherwise (e.g. a short + # response that delivers tool calls exclusively on the terminal chunk), + # passing them through is the only chance to surface them. + cohere_tool_calls = ( + None + if (is_terminal_consolidation and prior_tool_calls_emitted) + else typed_chunk.toolCalls + ) + + tool_calls: Optional[List[Dict[str, Any]]] = None + if cohere_tool_calls: + tool_calls = [ + { + # Cohere protocol has no tool-call id, so we synthesize one + # deterministically from the call's content/position. A random + # uuid4 per chunk would cause downstream stream-mergers to + # treat each chunk as a distinct tool call. + "id": _synthesize_oci_tool_call_id( + i, tc.name, json.dumps(tc.parameters, sort_keys=True) + ), + "type": "function", + "function": { + "name": tc.name, + "arguments": json.dumps(tc.parameters), + }, + } + for i, tc in enumerate(cohere_tool_calls) + ] + + finish_reason = _normalize_oci_finish_reason(typed_chunk.finishReason) + + return ModelResponseStream( + choices=[ + StreamingChoices( + index=typed_chunk.index, + delta=Delta( + content=text, + tool_calls=tool_calls, + provider_specific_fields=None, + thinking_blocks=None, + reasoning_content=None, + ), + finish_reason=finish_reason, + ) + ] + ) diff --git a/litellm/llms/oci/chat/generic.py b/litellm/llms/oci/chat/generic.py new file mode 100644 index 00000000000..2cc1ac77a40 --- /dev/null +++ b/litellm/llms/oci/chat/generic.py @@ -0,0 +1,477 @@ +""" +OCI Generative AI — Generic-format chat transformation helpers. + +Handles message building, tool definition adaptation, non-streaming response +parsing, and streaming chunk parsing for models served with +``apiFormat="GENERIC"`` (e.g. Meta Llama, xAI Grok, Google Gemini). +""" + +import datetime +import hashlib +from typing import Any, Dict, List, Optional, Union + +import httpx +from pydantic import ValidationError + +from litellm.llms.oci.common_utils import ( + OCIError, + resolve_oci_schema_anyof, + resolve_oci_schema_refs, + sanitize_oci_schema, +) +from litellm.types.llms.oci import ( + OCICompletionResponse, + OCIContentPartUnion, + OCIImageContentPart, + OCIImageUrl, + OCIMessage, + OCIRoles, + OCIStreamChunk, + OCITextContentPart, + OCIToolCall, + OCIToolDefinition, + OCIVendors, +) +from litellm.types.llms.openai import AllMessageValues +from litellm.types.utils import ( + Delta, + ModelResponse, + ModelResponseStream, + StreamingChoices, +) +from litellm.types.utils import ChatCompletionMessageToolCall, Usage + +# Maps OpenAI role names to OCI GENERIC role names. +open_ai_to_generic_oci_role_map: Dict[str, OCIRoles] = { + "system": "SYSTEM", + "user": "USER", + "assistant": "ASSISTANT", + "tool": "TOOL", +} + + +# --------------------------------------------------------------------------- +# Message building +# --------------------------------------------------------------------------- + + +def adapt_messages_to_generic_oci_standard_content_message( + role: str, content: Union[str, list] +) -> OCIMessage: + """Convert a plain-text or multipart content message to OCI format.""" + new_content: List[OCIContentPartUnion] = [] + if isinstance(content, str): + return OCIMessage( + role=open_ai_to_generic_oci_role_map[role], + content=[OCITextContentPart(text=content)], + toolCalls=None, + toolCallId=None, + ) + + for content_item in content: + if not isinstance(content_item, dict): + raise OCIError( + status_code=400, message="Each content item must be a dictionary" + ) + + item_type = content_item.get("type") + if not isinstance(item_type, str): + raise OCIError( + status_code=400, + message="Each content item must have a string `type` field", + ) + if item_type not in ["text", "image_url"]: + raise OCIError( + status_code=400, + message=f"Content type `{item_type}` is not supported by OCI", + ) + + if item_type == "text": + text = content_item.get("text") + if not isinstance(text, str): + raise OCIError( + status_code=400, + message="Content item of type `text` must have a string `text` field", + ) + new_content.append(OCITextContentPart(text=text)) + + elif item_type == "image_url": + image_url = content_item.get("image_url") + if isinstance(image_url, dict): + image_url = image_url.get("url") + if not isinstance(image_url, str): + raise OCIError( + status_code=400, + message="Prop `image_url` must be a string or an object with a `url` property", + ) + new_content.append(OCIImageContentPart(imageUrl=OCIImageUrl(url=image_url))) + + return OCIMessage( + role=open_ai_to_generic_oci_role_map[role], + content=new_content, + toolCalls=None, + toolCallId=None, + ) + + +def adapt_messages_to_generic_oci_standard_tool_call( + role: str, tool_calls: list +) -> OCIMessage: + """Convert an assistant tool-call message to OCI format.""" + tool_calls_formatted = [] + for tool_call in tool_calls: + if not isinstance(tool_call, dict): + raise OCIError( + status_code=400, message="Each tool call must be a dictionary" + ) + if tool_call.get("type") != "function": + raise OCIError( + status_code=400, message="OCI only supports function tool calls" + ) + + tool_call_id = tool_call.get("id") + if not isinstance(tool_call_id, str): + raise OCIError(status_code=400, message="Tool call `id` must be a string") + + tool_function = tool_call.get("function") + if not isinstance(tool_function, dict): + raise OCIError( + status_code=400, message="Tool call `function` must be a dictionary" + ) + + function_name = tool_function.get("name") + if not isinstance(function_name, str): + raise OCIError( + status_code=400, message="Tool call `function.name` must be a string" + ) + + arguments = tool_call["function"].get("arguments", "{}") + if not isinstance(arguments, str): + raise OCIError( + status_code=400, + message="Tool call `function.arguments` must be a JSON string", + ) + + tool_calls_formatted.append( + OCIToolCall( + id=tool_call_id, + type="FUNCTION", + name=function_name, + arguments=arguments, + ) + ) + + return OCIMessage( + role=open_ai_to_generic_oci_role_map[role], + content=None, + toolCalls=tool_calls_formatted, + toolCallId=None, + ) + + +def adapt_messages_to_generic_oci_standard_tool_response( + role: str, tool_call_id: str, content: str +) -> OCIMessage: + """Convert a tool-result message to OCI format.""" + return OCIMessage( + role=open_ai_to_generic_oci_role_map[role], + content=[OCITextContentPart(text=content)], + toolCalls=None, + toolCallId=tool_call_id, + ) + + +def adapt_messages_to_generic_oci_standard( + messages: List[AllMessageValues], +) -> List[OCIMessage]: + """Convert an OpenAI-format message array to OCI GENERIC format.""" + new_messages = [] + for message in messages: + role = message["role"] + content = message.get("content") + tool_calls = message.get("tool_calls") + tool_call_id = message.get("tool_call_id") + + if role == "assistant" and tool_calls is not None: + if not isinstance(tool_calls, list): + raise OCIError( + status_code=400, message="Message `tool_calls` must be a list" + ) + new_messages.append( + adapt_messages_to_generic_oci_standard_tool_call(role, tool_calls) + ) + + elif role in ["system", "user", "assistant"] and content is not None: + if not isinstance(content, (str, list)): + raise OCIError( + status_code=400, + message="Message `content` must be a string or list of content parts", + ) + new_messages.append( + adapt_messages_to_generic_oci_standard_content_message(role, content) + ) + + elif role == "tool": + if not isinstance(tool_call_id, str): + raise OCIError( + status_code=400, + message="Tool result message must have a string `tool_call_id`", + ) + if not isinstance(content, str): + raise OCIError( + status_code=400, + message="Tool result message `content` must be a string", + ) + new_messages.append( + adapt_messages_to_generic_oci_standard_tool_response( + role, tool_call_id, content + ) + ) + + return new_messages + + +# --------------------------------------------------------------------------- +# Tool definition adaptation +# --------------------------------------------------------------------------- + + +def adapt_tool_definition_to_oci_standard( + tools: List[Dict], vendor: OCIVendors +) -> List[OCIToolDefinition]: + """Convert OpenAI-format tool definitions to OCI GENERIC format. + + Resolves ``$ref``/``$defs`` and ``anyOf`` that the OCI endpoint rejects. + """ + new_tools = [] + for tool in tools: + if tool["type"] != "function": + raise OCIError(status_code=400, message="OCI only supports function tools") + + tool_function = tool.get("function") + if not isinstance(tool_function, dict): + raise OCIError( + status_code=400, message="Tool `function` must be a dictionary" + ) + + raw_params = tool_function.get("parameters", {}) + resolved_params = sanitize_oci_schema( + resolve_oci_schema_anyof(resolve_oci_schema_refs(raw_params)) + ) + + new_tools.append( + OCIToolDefinition( + type="FUNCTION", + name=tool_function.get("name"), + description=tool_function.get("description", ""), + parameters=resolved_params, + ) + ) + + return new_tools + + +def _normalize_oci_finish_reason(raw: Optional[str]) -> Optional[str]: + """Map an OCI-specific finish reason to its OpenAI-standard equivalent. + + OCI emits ``COMPLETE`` / ``MAX_TOKENS`` / ``TOOL_CALL(S)`` plus a long tail + of error/cancel reasons (``ERROR``, ``ERROR_TOXIC``, ``ERROR_LIMIT``, + ``USER_CANCEL``, ``CONTENT_FILTERED``, ``CANCELLED``, ...). The OpenAI + spec only defines ``stop`` / ``length`` / ``tool_calls`` / ... — anything + else is collapsed to ``"stop"`` so downstream consumers switching on + ``finish_reason`` keep working. A ``None`` input passes through unchanged. + """ + if raw is None: + return None + if raw == "COMPLETE": + return "stop" + if raw == "MAX_TOKENS": + return "length" + if raw in ("TOOL_CALL", "TOOL_CALLS"): + return "tool_calls" + return "stop" + + +def _synthesize_oci_tool_call_id(position: int, name: str, arguments: str) -> str: + """Deterministic synthetic tool-call id derived from chunk content. + + Used as a fallback when OCI omits ``id`` (always the case for the OCI + Cohere protocol, occasionally the case for OCI GENERIC streaming chunks). + A random ``uuid4`` per chunk would cause downstream stream-merging + consumers — which key off the tool-call ``id`` — to treat re-emissions of + the same logical call (e.g. terminal consolidation chunks, retries) as + distinct calls. A content-derived digest stays stable across identical + re-emissions while differing across truly distinct calls. + """ + digest = hashlib.sha256( + f"{position}|{name}|{arguments}".encode("utf-8"), + usedforsecurity=False, + ).hexdigest()[:24] + return f"call_{digest}" + + +def adapt_tools_to_openai_standard( + tools: List[OCIToolCall], +) -> List[ChatCompletionMessageToolCall]: + """Convert OCI tool-call objects in a response to the OpenAI format.""" + return [ + ChatCompletionMessageToolCall( + id=tool.id or _synthesize_oci_tool_call_id(i, tool.name, tool.arguments), + type="function", + function={"name": tool.name, "arguments": tool.arguments}, + ) + for i, tool in enumerate(tools) + ] + + +# --------------------------------------------------------------------------- +# Response parsing +# --------------------------------------------------------------------------- + + +def handle_generic_response( + json_data: dict, + model: str, + model_response: ModelResponse, + raw_response: httpx.Response, +) -> ModelResponse: + """Parse a non-streaming GENERIC OCI response into a LiteLLM ModelResponse.""" + try: + completion_response = OCICompletionResponse(**json_data) + except (TypeError, ValidationError) as e: + raise OCIError( + message=f"Response cannot be casted to OCICompletionResponse: {str(e)}", + status_code=raw_response.status_code, + ) + + iso_str = completion_response.chatResponse.timeCreated + dt = datetime.datetime.fromisoformat(iso_str.replace("Z", "+00:00")) + model_response.created = int(dt.timestamp()) + model_response.model = completion_response.modelId + + if not completion_response.chatResponse.choices: + raise OCIError( + message="OCI response contained no choices", + status_code=raw_response.status_code, + ) + + response_choice = completion_response.chatResponse.choices[0] + message = model_response.choices[0].message # type: ignore + response_message = response_choice.message + if response_message is not None: + if response_message.content: + # Concatenate all text parts — matches the streaming handler, which + # iterates the full content array. Skips non-text parts (e.g. image + # parts) so a leading non-text part doesn't suppress trailing text. + text: Optional[str] = None + for item in response_message.content: + if isinstance(item, OCITextContentPart): + text = (text or "") + item.text + if text is not None: + message.content = text + if response_message.toolCalls: + message.tool_calls = adapt_tools_to_openai_standard( + response_message.toolCalls + ) + + model_response.choices[0].finish_reason = _normalize_oci_finish_reason( # type: ignore[union-attr,assignment] + response_choice.finishReason + ) + + oci_usage = completion_response.chatResponse.usage + reasoning_tokens: Optional[int] = None + if ( + oci_usage.completionTokensDetails + and oci_usage.completionTokensDetails.reasoningTokens is not None + ): + reasoning_tokens = oci_usage.completionTokensDetails.reasoningTokens + model_response.usage = Usage( # type: ignore[attr-defined] + prompt_tokens=oci_usage.promptTokens, + completion_tokens=oci_usage.completionTokens or 0, + total_tokens=oci_usage.totalTokens, + reasoning_tokens=reasoning_tokens, + ) + + return model_response + + +def handle_generic_stream_chunk(dict_chunk: dict) -> ModelResponseStream: + """Parse a single GENERIC SSE chunk into a LiteLLM ModelResponseStream.""" + # OCI streams tool calls progressively — early chunks may omit required fields. + if dict_chunk.get("message") and dict_chunk["message"].get("toolCalls"): + for tool_call in dict_chunk["message"]["toolCalls"]: + tool_call.setdefault("arguments", "") + tool_call.setdefault("id", "") + tool_call.setdefault("name", "") + + try: + typed_chunk = OCIStreamChunk(**dict_chunk) + except (TypeError, ValidationError) as e: + raise OCIError( + status_code=500, + message=f"Chunk cannot be parsed as OCIStreamChunk: {str(e)}", + ) + + if typed_chunk.index is None: + typed_chunk.index = 0 + + # Emit ``content=None`` rather than ``content=""`` on chunks with no text + # parts (e.g. tool-call-only or keep-alive chunks) so downstream + # stream-mergers that distinguish "no text in this delta" from "an + # explicitly empty text delta" behave correctly. + text: Optional[str] = None + if typed_chunk.message and typed_chunk.message.content: + for item in typed_chunk.message.content: + if isinstance(item, OCITextContentPart): + text = (text or "") + item.text + elif isinstance(item, OCIImageContentPart): + raise OCIError( + status_code=500, + message="OCI returned image content in a streaming response — not supported", + ) + else: + raise OCIError( + status_code=500, + message=f"Unsupported content type in OCI streaming response: {item.type}", + ) + + # Build plain tool-call dicts inline (matching the shape produced by + # ``handle_cohere_stream_chunk``) rather than calling + # ``adapt_tools_to_openai_standard`` and ``model_dump``-ing the typed + # objects. Both code paths feed ``Delta.tool_calls``, so emitting the + # same minimal ``{"id", "type", "function": {"name", "arguments"}}`` + # shape keeps downstream stream-mergers behaving identically across + # GENERIC and Cohere chunks. + tool_calls: Optional[List[Dict[str, Any]]] = None + if typed_chunk.message and typed_chunk.message.toolCalls: + tool_calls = [ + { + "id": tc.id or _synthesize_oci_tool_call_id(i, tc.name, tc.arguments), + "type": "function", + "function": { + "name": tc.name, + "arguments": tc.arguments, + }, + } + for i, tc in enumerate(typed_chunk.message.toolCalls) + ] + + finish_reason: Optional[str] = _normalize_oci_finish_reason( + typed_chunk.finishReason + ) + + return ModelResponseStream( + choices=[ + StreamingChoices( + index=typed_chunk.index, + delta=Delta( + content=text, + tool_calls=tool_calls, + provider_specific_fields=None, + thinking_blocks=None, + reasoning_content=None, + ), + finish_reason=finish_reason, + ) + ] + ) diff --git a/litellm/llms/oci/chat/transformation.py b/litellm/llms/oci/chat/transformation.py index 62104e921a4..f050f9eea36 100644 --- a/litellm/llms/oci/chat/transformation.py +++ b/litellm/llms/oci/chat/transformation.py @@ -1,20 +1,26 @@ -import base64 -import datetime -import hashlib +""" +OCI Generative AI — chat transformation orchestrator. + +This module wires together the Cohere-specific and Generic-model helpers to +implement the LiteLLM BaseConfig interface. Heavy-lifting lives in: + + - :mod:`litellm.llms.oci.chat.cohere` — Cohere message/tool/response logic + - :mod:`litellm.llms.oci.chat.generic` — Generic message/tool/response logic + - :mod:`litellm.llms.oci.common_utils` — auth, signing, schema utilities +""" + import json -from dataclasses import dataclass from typing import ( TYPE_CHECKING, Any, AsyncIterator, Dict, + Iterator, List, Optional, - Protocol, Tuple, Union, ) -from urllib.parse import urlparse import httpx @@ -28,43 +34,43 @@ from litellm.llms.custom_httpx.http_handler import ( get_async_httpx_client, version, ) -from litellm.llms.oci.common_utils import OCIError +from litellm.llms.oci.chat.cohere import ( + _extract_text_content, + adapt_messages_to_cohere_standard, + adapt_tool_definitions_to_cohere_standard, + handle_cohere_response, + handle_cohere_stream_chunk, +) +from litellm.llms.oci.chat.generic import ( + adapt_messages_to_generic_oci_standard, + adapt_tool_definition_to_oci_standard, + handle_generic_response, + handle_generic_stream_chunk, +) +from litellm.llms.oci.common_utils import ( + OCI_API_VERSION, + OCIError, + OCIRequestWrapper, # re-exported for backwards compatibility + get_oci_base_url, + resolve_oci_credentials, + sign_oci_request, + validate_oci_environment, +) from litellm.types.llms.oci import ( CohereChatRequest, - CohereMessage, - CohereChatResult, - CohereParameterDefinition, - CohereStreamChunk, - CohereTool, - CohereToolCall, OCIChatRequestPayload, OCICompletionPayload, - OCICompletionResponse, - OCIContentPartUnion, - OCIImageContentPart, - OCIImageUrl, - OCIMessage, - OCIRoles, OCIServingMode, - OCIStreamChunk, - OCITextContentPart, - OCIToolCall, - OCIToolDefinition, OCIVendors, ) from litellm.types.llms.openai import AllMessageValues from litellm.types.utils import ( - Delta, LlmProviders, ModelResponse, ModelResponseStream, - StreamingChoices, -) -from litellm.utils import ( - ChatCompletionMessageToolCall, - CustomStreamWrapper, - Usage, ) +from litellm.utils import supports_reasoning +from litellm.litellm_core_utils.streaming_handler import CustomStreamWrapper if TYPE_CHECKING: from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj @@ -74,142 +80,157 @@ else: LiteLLMLoggingObj = Any -class OCISignerProtocol(Protocol): - """ - Protocol for OCI request signers (e.g., oci.signer.Signer). - - This protocol defines the interface expected for OCI SDK signer objects. - Compatible with the OCI Python SDK's Signer class. - - See: https://docs.oracle.com/en-us/iaas/tools/python/latest/api/signing.html - """ - - def do_request_sign( - self, request: Any, *, enforce_content_headers: bool = False - ) -> None: - """ - Sign an HTTP request by adding authentication headers. - - Args: - request: Request object with method, url, headers, body, and path_url attributes - enforce_content_headers: Whether to enforce content-type and content-length headers - """ - ... - - -@dataclass -class OCIRequestWrapper: - """ - Wrapper for HTTP requests compatible with OCI signer interface. - - This class wraps request data in a format compatible with OCI SDK signers, - which expect objects with method, url, headers, body, and path_url attributes. - """ - - method: str - url: str - headers: dict - body: bytes - - @property - def path_url(self) -> str: - """Returns the path + query string for OCI signing.""" - parsed_url = urlparse(self.url) - return parsed_url.path + ("?" + parsed_url.query if parsed_url.query else "") - - -def sha256_base64(data: bytes) -> str: - digest = hashlib.sha256(data).digest() - return base64.b64encode(digest).decode() - - -def build_signature_string(method, path, headers, signed_headers): - lines = [] - for header in signed_headers: - if header == "(request-target)": - value = f"{method.lower()} {path}" - else: - value = headers[header] - lines.append(f"{header}: {value}") - return "\n".join(lines) - - -def load_private_key_from_str(key_str: str): - try: - from cryptography.hazmat.primitives import serialization - from cryptography.hazmat.primitives.asymmetric import rsa - except ImportError as e: - raise ImportError( - "cryptography package is required for OCI authentication. " - "Please install it with: pip install cryptography" - ) from e - - key = serialization.load_pem_private_key( - key_str.encode("utf-8"), - password=None, - ) - if not isinstance(key, rsa.RSAPrivateKey): - raise TypeError( - "The provided private key is not an RSA key, which is required for OCI signing." - ) - return key - - -def load_private_key_from_file(file_path: str): - """Loads a private key from a file path""" - try: - with open(file_path, "r", encoding="utf-8") as f: - key_str = f.read().strip() - except FileNotFoundError: - raise FileNotFoundError(f"Private key file not found: {file_path}") - except OSError as e: - raise OSError(f"Failed to read private key file '{file_path}': {e}") from e - - if not key_str: - raise ValueError(f"Private key file is empty: {file_path}") - - return load_private_key_from_str(key_str) - - -def get_vendor_from_model(model: str) -> OCIVendors: - """ - Extracts the vendor from the model name. - - OCI GenAI API uses two apiFormat values: - - "COHERE" for Cohere models (command-r, command-a, etc.) - - "GENERIC" for all other models (Meta Llama, xAI Grok, Google Gemini, etc.) - - Args: - model (str): The model name (e.g., "cohere.command-a-03-2025", "meta.llama-3.3-70b-instruct"). - Returns: - OCIVendors: The vendor enum value. - """ - vendor = model.split(".")[0].lower() - if vendor == "cohere": - return OCIVendors.COHERE - else: - return OCIVendors.GENERIC - - -# 5 minute timeout (models may need to load) +# Streaming timeout — generous because OCI models may need to warm up on first request STREAMING_TIMEOUT = 60 * 5 +def _model_uses_max_completion_tokens(model: str) -> bool: + """Return True for OCI-hosted models that require ``maxCompletionTokens``. + + Reasoning models on OCI (e.g. the OpenAI GPT-5 family) reject ``maxTokens`` + with HTTP 400 and require ``maxCompletionTokens`` per OpenAI's reasoning-API + convention. Driven by ``supports_reasoning`` in + ``model_prices_and_context_window.json`` so new model families are picked + up via a catalog update rather than a code change. + """ + if not model: + return False + name = model[4:] if model.lower().startswith("oci/") else model + return supports_reasoning(model=name, custom_llm_provider="oci") + + +def _iter_sse_events(stream: Iterator[str]) -> Iterator[str]: + """Yield one ``data:`` SSE line at a time from a sync text stream. + + The OCI streaming endpoint does not align SSE event boundaries with HTTP + read boundaries. A single read may carry multiple events, a single event + may straddle two reads, and some events arrive separated by only ``\\n`` + instead of ``\\n\\n``. This helper buffers across reads and yields each + complete ``data:`` line so JSON parsing downstream never sees a partial + payload. + """ + buffer = "" + for item in stream: + buffer += item + while "\n" in buffer: + line, buffer = buffer.split("\n", 1) + stripped = line.strip() + if stripped.startswith("data:"): + yield stripped + stripped = buffer.strip() + if stripped.startswith("data:"): + yield stripped + + +async def _aiter_sse_events(stream: AsyncIterator[str]) -> AsyncIterator[str]: + """Async twin of :func:`_iter_sse_events`.""" + buffer = "" + async for item in stream: + buffer += item + while "\n" in buffer: + line, buffer = buffer.split("\n", 1) + stripped = line.strip() + if stripped.startswith("data:"): + yield stripped + stripped = buffer.strip() + if stripped.startswith("data:"): + yield stripped + + +def _normalize_tool_choice(selected_params: Dict) -> None: + tc = selected_params.get("toolChoice") + if tc is None: + return + if isinstance(tc, str): + tc_map = { + "auto": {"type": "AUTO"}, + "none": {"type": "NONE"}, + "required": {"type": "REQUIRED"}, + "any": {"type": "REQUIRED"}, + } + selected_params["toolChoice"] = tc_map.get( + tc.lower(), {"type": "FUNCTION", "name": tc} + ) + return + if isinstance(tc, dict): + raw_type = tc.get("type") + if not isinstance(raw_type, str): + raise OCIError( + status_code=400, + message=f"Invalid tool_choice for OCI: missing or non-string 'type' in {tc!r}", + ) + upper = raw_type.upper() + if upper == "FUNCTION": + fn = tc.get("function") + name = fn.get("name") if isinstance(fn, dict) else tc.get("name") + if not (isinstance(name, str) and name): + raise OCIError( + status_code=400, + message="Invalid tool_choice for OCI: 'FUNCTION' type requires a non-empty function name", + ) + selected_params["toolChoice"] = {"type": "FUNCTION", "name": name} + elif upper in {"AUTO", "NONE", "REQUIRED"}: + selected_params["toolChoice"] = {"type": upper} + else: + raise OCIError( + status_code=400, + message=( + f"Invalid tool_choice for OCI: unsupported type {raw_type!r}; " + "expected one of 'FUNCTION', 'AUTO', 'NONE', 'REQUIRED'" + ), + ) + return + raise OCIError( + status_code=400, + message=( + f"Invalid tool_choice for OCI: expected str or dict, got " + f"{type(tc).__name__}" + ), + ) + + +def _normalize_response_format(selected_params: Dict, vendor: OCIVendors) -> None: + rf = selected_params.get("responseFormat") + if not isinstance(rf, dict) or "type" not in rf: + return + rf_payload = dict(rf) + selected_params["responseFormat"] = rf_payload + response_type = rf_payload["type"] + if "json_schema" in rf_payload: + raw_schema = rf_payload.pop("json_schema") + rf_payload["jsonSchema"] = ( + dict(raw_schema) if isinstance(raw_schema, dict) else raw_schema + ) + if vendor == OCIVendors.COHERE: + rf_payload["type"] = response_type + else: + fmt = response_type.upper() + rf_payload["type"] = "JSON_OBJECT" if fmt == "JSON" else fmt + + +def get_vendor_from_model(model: str) -> OCIVendors: + """Return the OCI vendor enum for a model name. + + OCI GenAI uses two ``apiFormat`` values: + + - ``"COHERE"`` for Cohere models (``cohere.*``) + - ``"GENERIC"`` for all others (Meta Llama, xAI Grok, Google Gemini, …) + """ + name = model[4:] if model.lower().startswith("oci/") else model + vendor = name.split(".")[0].lower() + if vendor == "cohere": + return OCIVendors.COHERE + return OCIVendors.GENERIC + + class OCIChatConfig(BaseConfig): - """ - Configuration class for OCI's API interface. - """ + """LiteLLM BaseConfig implementation for OCI Generative AI chat.""" - def __init__( - self, - ) -> None: - locals_ = locals().copy() - for key, value in locals_.items(): - if key != "self" and value is not None: - setattr(self.__class__, key, value) - # mark the class as using a custom stream wrapper because the default only iterates on lines - setattr(self.__class__, "has_custom_stream_wrapper", True) + @property + def has_custom_stream_wrapper(self) -> bool: + return True + def __init__(self) -> None: self.openai_to_oci_generic_param_map = { "stream": "isStream", "max_tokens": "maxTokens", @@ -221,6 +242,7 @@ class OCIChatConfig(BaseConfig): "logit_bias": "logitBias", "n": "numGenerations", "presence_penalty": "presencePenalty", + "reasoning_effort": "reasoningEffort", "seed": "seed", "stop": "stop", "tool_choice": "toolChoice", @@ -239,25 +261,43 @@ class OCIChatConfig(BaseConfig): "response_format": "responseFormat", } - # Cohere and Gemini use the same parameter mapping as GENERIC - self.openai_to_oci_cohere_param_map = ( - self.openai_to_oci_generic_param_map.copy() - ) + # Cohere param map differs from GENERIC in three ways: + # - tool_choice is unsupported + # - stop sequences key is "stopSequences" not "stop" + # - n (numGenerations) is GENERIC-only + # The unsupported keys are kept in the map with value ``False`` so + # ``map_openai_params`` either drops them (under drop_params) or raises + # a clear error, rather than silently passing them through. + self.openai_to_oci_cohere_param_map = { + k: ("stopSequences" if k == "stop" else v) + for k, v in self.openai_to_oci_generic_param_map.items() + } + self.openai_to_oci_cohere_param_map["tool_choice"] = False + self.openai_to_oci_cohere_param_map["n"] = False + # ``top_k`` is not a standard OpenAI param, but Cohere's chat request + # accepts ``topK`` and LiteLLM commonly forwards ``top_k`` as a + # passthrough param. Cohere-only — ``OCIChatRequestPayload`` (GENERIC) + # has no ``topK`` field. + self.openai_to_oci_cohere_param_map["top_k"] = "topK" + # OCI Cohere models are not reasoning models; mark reasoning_effort + # explicitly unsupported so callers either get a clear error or have + # the param dropped under drop_params, rather than silently passing + # through and tripping Pydantic validation on CohereChatRequest. + self.openai_to_oci_cohere_param_map["reasoning_effort"] = False + # CohereChatRequest has no logProbs/logitBias fields, so passing these + # through would be silently dropped by Pydantic. Mark them unsupported + # so get_supported_openai_params doesn't advertise them and callers + # get a clear error (or drop_params behaviour) instead. + self.openai_to_oci_cohere_param_map["logprobs"] = False + self.openai_to_oci_cohere_param_map["logit_bias"] = False def get_supported_openai_params(self, model: str) -> List[str]: - supported_params = [] - vendor = get_vendor_from_model(model) - if vendor == OCIVendors.COHERE: - open_ai_to_oci_param_map = self.openai_to_oci_cohere_param_map - open_ai_to_oci_param_map.pop("tool_choice") - open_ai_to_oci_param_map.pop("max_retries") - else: - open_ai_to_oci_param_map = self.openai_to_oci_generic_param_map - for key, value in open_ai_to_oci_param_map.items(): - if value: - supported_params.append(key) - - return supported_params + param_map = ( + self.openai_to_oci_cohere_param_map + if get_vendor_from_model(model) == OCIVendors.COHERE + else self.openai_to_oci_generic_param_map + ) + return [key for key, value in param_map.items() if value] def map_openai_params( self, @@ -268,238 +308,34 @@ class OCIChatConfig(BaseConfig): ) -> dict: adapted_params = {} vendor = get_vendor_from_model(model) - if vendor == OCIVendors.COHERE: - open_ai_to_oci_param_map = self.openai_to_oci_cohere_param_map - else: - open_ai_to_oci_param_map = self.openai_to_oci_generic_param_map - - all_params = {**non_default_params, **optional_params} - - for key, value in all_params.items(): - alias = open_ai_to_oci_param_map.get(key) + param_map = ( + self.openai_to_oci_cohere_param_map + if vendor == OCIVendors.COHERE + else self.openai_to_oci_generic_param_map + ) + for key, value in {**non_default_params, **optional_params}.items(): + alias = param_map.get(key) if alias is False: - # Workaround for mypy issue if drop_params or litellm.drop_params: continue - raise Exception(f"param `{key}` is not supported on OCI") - + raise OCIError( + status_code=400, + message=f"param `{key}` is not supported on OCI", + ) if alias is None: adapted_params[key] = value continue - adapted_params[alias] = value - + # Preserve the original OpenAI ``response_format`` key alongside the + # OCI-mapped ``responseFormat`` so downstream litellm framework code + # (e.g. ``json_mode`` detection, logging) that inspects + # ``optional_params["response_format"]`` continues to work. if alias == "responseFormat": adapted_params["response_format"] = value return adapted_params - def _sign_with_oci_signer( - self, - headers: dict, - optional_params: dict, - request_data: dict, - api_base: str, - ) -> Tuple[dict, bytes]: - """ - Sign request using OCI SDK Signer object. - - Args: - headers: Request headers to be signed - optional_params: Optional parameters including oci_signer - request_data: The request body dict to be sent in HTTP request - api_base: The complete URL for the HTTP request - - Returns: - Tuple of (signed_headers, encoded_body) - - Raises: - OCIError: If signing fails - ValueError: If HTTP method is unsupported - """ - oci_signer = optional_params.get("oci_signer") - body = json.dumps(request_data).encode("utf-8") - method = str(optional_params.get("method", "POST")).upper() - - if method not in ["POST", "GET", "PUT", "DELETE", "PATCH"]: - raise ValueError(f"Unsupported HTTP method: {method}") - - prepared_headers = headers.copy() - prepared_headers.setdefault("content-type", "application/json") - prepared_headers.setdefault("content-length", str(len(body))) - - request_wrapper = OCIRequestWrapper( - method=method, url=api_base, headers=prepared_headers, body=body - ) - - if oci_signer is None: - raise ValueError( - "oci_signer cannot be None when calling _sign_with_oci_signer" - ) - - try: - oci_signer.do_request_sign(request_wrapper, enforce_content_headers=True) - except Exception as e: - raise OCIError( - status_code=500, - message=( - f"Failed to sign request with provided oci_signer: {str(e)}. " - "The signer must implement the OCI SDK Signer interface with a " - "do_request_sign(request, enforce_content_headers=True) method. " - "See: https://docs.oracle.com/en-us/iaas/tools/python/latest/api/signing.html" - ), - ) from e - - headers.update(request_wrapper.headers) - return headers, body - - def _sign_with_manual_credentials( - self, - headers: dict, - optional_params: dict, - request_data: dict, - api_base: str, - ) -> Tuple[dict, None]: - """ - Sign request using manual OCI credentials. - - Args: - headers: Request headers to be signed - optional_params: Optional parameters including OCI credentials - request_data: The request body dict to be sent in HTTP request - api_base: The complete URL for the HTTP request - - Returns: - Tuple of (signed_headers, None) - - Raises: - Exception: If required credentials are missing - ImportError: If cryptography package is not installed - """ - oci_region = optional_params.get("oci_region", "us-ashburn-1") - api_base = ( - api_base - or litellm.api_base - or f"https://inference.generativeai.{oci_region}.oci.oraclecloud.com" - ) - oci_user = optional_params.get("oci_user") - oci_fingerprint = optional_params.get("oci_fingerprint") - oci_tenancy = optional_params.get("oci_tenancy") - oci_key = optional_params.get("oci_key") - oci_key_file = optional_params.get("oci_key_file") - - if ( - not oci_user - or not oci_fingerprint - or not oci_tenancy - or not (oci_key or oci_key_file) - ): - raise Exception( - "Missing required parameters: oci_user, oci_fingerprint, oci_tenancy, " - "and at least one of oci_key or oci_key_file." - ) - - method = str(optional_params.get("method", "POST")).upper() - body = json.dumps(request_data).encode("utf-8") - parsed = urlparse(api_base) - path = parsed.path or "/" - host = parsed.netloc - - date = datetime.datetime.utcnow().strftime("%a, %d %b %Y %H:%M:%S GMT") - content_type = headers.get("content-type", "application/json") - content_length = str(len(body)) - x_content_sha256 = sha256_base64(body) - - headers_to_sign = { - "date": date, - "host": host, - "content-type": content_type, - "content-length": content_length, - "x-content-sha256": x_content_sha256, - } - - signed_headers = [ - "date", - "(request-target)", - "host", - "content-length", - "content-type", - "x-content-sha256", - ] - signing_string = build_signature_string( - method, path, headers_to_sign, signed_headers - ) - - try: - from cryptography.hazmat.primitives import hashes - from cryptography.hazmat.primitives.asymmetric import padding - except ImportError as e: - raise ImportError( - "cryptography package is required for OCI authentication. " - "Please install it with: pip install cryptography" - ) from e - - # Handle oci_key - it should be a string (PEM content) - oci_key_content = None - if oci_key: - if isinstance(oci_key, str): - oci_key_content = oci_key - # Fix common issues with PEM content - # Replace escaped newlines with actual newlines - oci_key_content = oci_key_content.replace("\\n", "\n") - # Ensure proper line endings - if "\r\n" in oci_key_content: - oci_key_content = oci_key_content.replace("\r\n", "\n") - else: - raise OCIError( - status_code=400, - message=f"oci_key must be a string containing the PEM private key content. " - f"Got type: {type(oci_key).__name__}", - ) - - private_key = ( - load_private_key_from_str(oci_key_content) - if oci_key_content - else load_private_key_from_file(oci_key_file) if oci_key_file else None - ) - - if private_key is None: - raise OCIError( - status_code=400, - message="Private key is required for OCI authentication. Please provide either oci_key or oci_key_file.", - ) - - signature = private_key.sign( - signing_string.encode("utf-8"), - padding.PKCS1v15(), - hashes.SHA256(), - ) - signature_b64 = base64.b64encode(signature).decode() - - key_id = f"{oci_tenancy}/{oci_user}/{oci_fingerprint}" - - authorization = ( - 'Signature version="1",' - f'keyId="{key_id}",' - 'algorithm="rsa-sha256",' - f'headers="{" ".join(signed_headers)}",' - f'signature="{signature_b64}"' - ) - - headers.update( - { - "authorization": authorization, - "date": date, - "host": host, - "content-type": content_type, - "content-length": content_length, - "x-content-sha256": x_content_sha256, - } - ) - - return headers, None - def sign_request( self, headers: dict, @@ -510,61 +346,16 @@ class OCIChatConfig(BaseConfig): model: Optional[str] = None, stream: Optional[bool] = None, fake_stream: Optional[bool] = None, - ) -> Tuple[dict, Optional[bytes]]: - """ - Sign the OCI request by adding authentication headers. - - Supports two signing modes: - 1. OCI SDK Signer: Use an oci_signer object to sign the request - 2. Manual Signing: Use OCI credentials to manually sign the request - - Args: - headers: Request headers to be signed - optional_params: Optional parameters including auth credentials or oci_signer - request_data: The request body dict to be sent in HTTP request - api_base: The complete URL for the HTTP request - api_key: Optional API key (not used for OCI) - model: Optional model name - stream: Optional streaming flag - fake_stream: Optional fake streaming flag - - Returns: - Tuple of (signed_headers, encoded_body): - - If oci_signer is provided: Returns (headers, body) where body is the encoded JSON - - If manual credentials are provided: Returns (headers, None) as body is not returned - for the manual signing path - - Raises: - OCIError: If signing fails with oci_signer - Exception: If required credentials are missing - ImportError: If cryptography package is not installed (manual signing only) - - Example: - >>> from oci.signer import Signer - >>> signer = Signer( - ... tenancy="ocid1.tenancy.oc1..", - ... user="ocid1.user.oc1..", - ... fingerprint="xx:xx:xx", - ... private_key_file_location="~/.oci/key.pem" - ... ) - >>> headers, body = config.sign_request( - ... headers={}, - ... optional_params={"oci_signer": signer}, - ... request_data={"message": "Hello"}, - ... api_base="https://inference.generativeai.us-ashburn-1.oci.oraclecloud.com/..." - ... ) - """ - oci_signer = optional_params.get("oci_signer") - - # If a signer is provided, use it for request signing - if oci_signer is not None: - return self._sign_with_oci_signer( - headers, optional_params, request_data, api_base - ) - - # Standard manual credential signing - return self._sign_with_manual_credentials( - headers, optional_params, request_data, api_base + ) -> Tuple[dict, bytes]: + return sign_oci_request( + headers=headers, + optional_params=optional_params, + request_data=request_data, + api_base=api_base, + api_key=api_key, + model=model, + stream=stream, + fake_stream=fake_stream, ) def validate_environment( @@ -577,80 +368,35 @@ class OCIChatConfig(BaseConfig): api_key: Optional[str] = None, api_base: Optional[str] = None, ) -> dict: - """ - Validate the OCI environment and credentials. - - Supports two authentication modes: - 1. OCI SDK Signer: Pass an oci_signer object (e.g., oci.signer.Signer) - 2. Manual Credentials: Pass oci_user, oci_fingerprint, oci_tenancy, and oci_key/oci_key_file - - Args: - headers: Request headers to populate - model: Model name - messages: List of chat messages - optional_params: Optional parameters including authentication credentials - litellm_params: LiteLLM parameters - api_key: Optional API key (not used for OCI) - api_base: Optional API base URL - - Returns: - Updated headers dict - - Raises: - Exception: If required parameters are missing or invalid - """ - oci_signer = optional_params.get("oci_signer") - oci_region = optional_params.get("oci_region", "us-ashburn-1") - - # Determine api_base - api_base = ( - api_base - or litellm.api_base - or f"https://inference.generativeai.{oci_region}.oci.oraclecloud.com" - ) - - if not api_base: - raise Exception( - "Either `api_base` must be provided or `litellm.api_base` must be set. " - "Alternatively, you can set the `oci_region` optional parameter to use the default OCI region." - ) - - # Validate credentials only if signer is not provided - if oci_signer is None: - oci_user = optional_params.get("oci_user") - oci_fingerprint = optional_params.get("oci_fingerprint") - oci_tenancy = optional_params.get("oci_tenancy") - oci_key = optional_params.get("oci_key") - oci_key_file = optional_params.get("oci_key_file") - oci_compartment_id = optional_params.get("oci_compartment_id") - - if ( - not oci_user - or not oci_fingerprint - or not oci_tenancy - or not (oci_key or oci_key_file) - or not oci_compartment_id - ): - raise Exception( - "Missing required parameters: oci_user, oci_fingerprint, oci_tenancy, oci_compartment_id " - "and at least one of oci_key or oci_key_file. " - "Alternatively, provide an oci_signer object from the OCI SDK." - ) - - # Common header setup - headers.update( - { - "content-type": "application/json", - "user-agent": f"litellm/{version}", - } - ) - if not messages: - raise Exception( - "kwarg `messages` must be an array of messages that follow the openai chat standard" + raise OCIError( + status_code=400, + message="kwarg `messages` must be an array of messages that follow the openai chat standard", ) - - return headers + if optional_params.get("oci_signer") is None: + creds = resolve_oci_credentials(optional_params) + missing = [ + k + for k in ( + "oci_user", + "oci_fingerprint", + "oci_tenancy", + "oci_compartment_id", + ) + if not creds.get(k) + ] + if missing or not (creds.get("oci_key") or creds.get("oci_key_file")): + raise OCIError( + status_code=401, + message=( + "Missing required parameters: oci_user, oci_fingerprint, oci_tenancy, " + "oci_compartment_id and at least one of oci_key or oci_key_file. " + "These can be supplied via optional_params or via OCI_USER, OCI_FINGERPRINT, " + "OCI_TENANCY, OCI_COMPARTMENT_ID, OCI_KEY_FILE environment variables. " + "Alternatively, provide an oci_signer object from the OCI SDK." + ), + ) + return validate_oci_environment(headers, optional_params, api_key) def get_complete_url( self, @@ -661,43 +407,63 @@ class OCIChatConfig(BaseConfig): litellm_params: dict, stream: Optional[bool] = None, ) -> str: - oci_region = optional_params.get("oci_region", "us-ashburn-1") - return f"https://inference.generativeai.{oci_region}.oci.oraclecloud.com/20231130/actions/chat" + base = get_oci_base_url(optional_params, api_base or litellm.api_base) + return f"{base}/{OCI_API_VERSION}/actions/chat" - def _get_optional_params(self, vendor: OCIVendors, optional_params: dict) -> Dict: - selected_params = {} - if vendor == OCIVendors.COHERE: - open_ai_to_oci_param_map = self.openai_to_oci_cohere_param_map - # remove tool_choice from the map - open_ai_to_oci_param_map.pop("tool_choice") - # Add default values for Cohere API - selected_params = { - "maxTokens": 600, - "temperature": 1, - "topK": 0, - "topP": 0.75, - "frequencyPenalty": 0, - } - else: - open_ai_to_oci_param_map = self.openai_to_oci_generic_param_map + def _get_optional_params( + self, vendor: OCIVendors, optional_params: dict, model: str = "" + ) -> Dict: + param_map = ( + self.openai_to_oci_cohere_param_map + if vendor == OCIVendors.COHERE + else self.openai_to_oci_generic_param_map + ) + selected_params: Dict = {} - # Map OpenAI params to OCI params - for openai_key, oci_key in open_ai_to_oci_param_map.items(): - if oci_key and openai_key in optional_params: - selected_params[oci_key] = optional_params[openai_key] # type: ignore[index] + # OpenAI reasoning models on OCI (e.g. GPT-5 family) reject "maxTokens" + # and require "maxCompletionTokens" per OCI's /20231130/Chat schema. + # Driven by the supports_reasoning flag in the model catalog. Cohere's + # endpoint uses "maxTokens" regardless, so the override is GENERIC-only. + max_tokens_key = ( + "maxCompletionTokens" + if vendor != OCIVendors.COHERE + and model + and _model_uses_max_completion_tokens(model) + else "maxTokens" + ) - # Also check for already-mapped OCI params (for backward compatibility) - for oci_value in open_ai_to_oci_param_map.values(): - if ( - oci_value - and oci_value in optional_params - and oci_value not in selected_params - ): - selected_params[oci_value] = optional_params[oci_value] # type: ignore[index] + # ``map_openai_params`` runs before ``transform_request`` (and thus + # before this helper), so by the time we see ``optional_params`` the + # OpenAI keys have already been translated to their OCI aliases. + # We still accept the original OpenAI key as a fallback for callers + # that build ``optional_params`` directly, with OpenAI keys winning + # over OCI aliases when both happen to be present. The first OpenAI + # key reaching a given OCI target wins, so ``max_tokens`` / + # ``max_completion_tokens`` (both → ``maxTokens``) don't double-write. + for openai_key, oci_alias in param_map.items(): + if not oci_alias: + continue + target = max_tokens_key if oci_alias == "maxTokens" else oci_alias + if target in selected_params: + continue + if openai_key in optional_params: + selected_params[target] = optional_params[openai_key] # type: ignore[index] + elif oci_alias in optional_params: + selected_params[target] = optional_params[oci_alias] # type: ignore[index] + + # OCI expects uppercase reasoning levels (LOW/MEDIUM/HIGH/NONE); OpenAI + # clients send lowercase. OpenAI's "disable" maps to OCI's "NONE". + if "reasoningEffort" in selected_params: + effort = selected_params["reasoningEffort"] + if isinstance(effort, str): + normalized = effort.upper() + if normalized == "DISABLE": + normalized = "NONE" + selected_params["reasoningEffort"] = normalized if "tools" in selected_params: if vendor == OCIVendors.COHERE: - selected_params["tools"] = self.adapt_tool_definitions_to_cohere_standard( # type: ignore[assignment] + selected_params["tools"] = adapt_tool_definitions_to_cohere_standard( # type: ignore[assignment] selected_params["tools"] # type: ignore[arg-type] ) else: @@ -705,146 +471,15 @@ class OCIChatConfig(BaseConfig): selected_params["tools"], vendor # type: ignore[arg-type] ) - # Transform response_format type to OCI uppercase format - if "responseFormat" in selected_params: - rf = selected_params["responseFormat"] - if isinstance(rf, dict) and "type" in rf: - rf_payload = dict(rf) - selected_params["responseFormat"] = rf_payload + # Normalise tool_choice to OCI's flat uppercase dict form + # ({"type": "AUTO"|"NONE"|"REQUIRED"} or {"type": "FUNCTION", "name": ""}). + # OCI rejects both the OpenAI string and the nested OpenAI dict shape. + _normalize_tool_choice(selected_params) - response_type = rf_payload["type"] - schema_payload: Optional[Any] = None - - if "json_schema" in rf_payload: - raw_schema_payload = rf_payload.pop("json_schema") - if isinstance(raw_schema_payload, dict): - schema_payload = dict(raw_schema_payload) - else: - schema_payload = raw_schema_payload - - if schema_payload is not None: - rf_payload["jsonSchema"] = schema_payload - - if vendor == OCIVendors.COHERE: - # Cohere expects lower-case type values - rf_payload["type"] = response_type - else: - format_type = response_type.upper() - if format_type == "JSON": - format_type = "JSON_OBJECT" - rf_payload["type"] = format_type + _normalize_response_format(selected_params, vendor) return selected_params - def adapt_messages_to_cohere_standard( - self, messages: List[AllMessageValues] - ) -> List[CohereMessage]: - """Build chat history for Cohere models.""" - chat_history = [] - for msg in messages[:-1]: # All messages except the last one - role = msg.get("role") - content = msg.get("content") - - if isinstance(content, list): - # Extract text from content array - text_content = "" - for content_item in content: - if ( - isinstance(content_item, dict) - and content_item.get("type") == "text" - ): - text_content += content_item.get("text", "") - content = text_content - - # Ensure content is a string - if not isinstance(content, str): - content = str(content) if content is not None else "" - - # Handle tool calls - tool_calls: Optional[List[CohereToolCall]] = None - if role == "assistant" and "tool_calls" in msg and msg.get("tool_calls"): # type: ignore[union-attr,typeddict-item] - tool_calls = [] - for tool_call in msg["tool_calls"]: # type: ignore[union-attr,typeddict-item] - # Parse arguments if they're a JSON string - raw_arguments: Any = tool_call.get("function", {}).get( - "arguments", {} - ) - if isinstance(raw_arguments, str): - try: - arguments: Dict[str, Any] = json.loads(raw_arguments) - except json.JSONDecodeError: - arguments = {} - else: - arguments = raw_arguments - - tool_calls.append( - CohereToolCall( - name=str(tool_call.get("function", {}).get("name", "")), - parameters=arguments, - ) - ) - - if role == "user": - chat_history.append(CohereMessage(role="USER", message=content)) - elif role == "assistant": - chat_history.append( - CohereMessage(role="CHATBOT", message=content, toolCalls=tool_calls) - ) - elif role == "tool": - # Tool messages need special handling - chat_history.append( - CohereMessage( - role="TOOL", - message=content, - toolCalls=None, # Tool messages don't have tool calls - ) - ) - - return chat_history - - def adapt_tool_definitions_to_cohere_standard( - self, tools: List[Dict[str, Any]] - ) -> List[CohereTool]: - """Adapt tool definitions to Cohere format.""" - cohere_tools = [] - for tool in tools: - function_def = tool.get("function", {}) - parameters = function_def.get("parameters", {}).get("properties", {}) - required = function_def.get("parameters", {}).get("required", []) - - parameter_definitions = {} - for param_name, param_schema in parameters.items(): - parameter_definitions[param_name] = CohereParameterDefinition( - description=param_schema.get("description", ""), - type=param_schema.get("type", "string"), - isRequired=param_name in required, - ) - - cohere_tools.append( - CohereTool( - name=function_def.get("name", ""), - description=function_def.get("description", ""), - parameterDefinitions=parameter_definitions, - ) - ) - - return cohere_tools - - def _extract_text_content(self, content: Any) -> str: - """Extract text content from message content.""" - if isinstance(content, str): - return content - elif isinstance(content, list): - text_content = "" - for content_item in content: - if ( - isinstance(content_item, dict) - and content_item.get("type") == "text" - ): - text_content += content_item.get("text", "") - return text_content - return str(content) - def transform_request( self, model: str, @@ -853,186 +488,78 @@ class OCIChatConfig(BaseConfig): litellm_params: dict, headers: dict, ) -> dict: - oci_compartment_id = optional_params.get("oci_compartment_id", None) + creds = resolve_oci_credentials(optional_params) + oci_compartment_id = creds["oci_compartment_id"] if not oci_compartment_id: - raise Exception("kwarg `oci_compartment_id` is required for OCI requests") + raise OCIError( + status_code=400, + message=( + "oci_compartment_id is required for OCI chat requests. " + "Pass it as optional_params or set the OCI_COMPARTMENT_ID env var." + ), + ) vendor = get_vendor_from_model(model) oci_serving_mode = optional_params.get("oci_serving_mode", "ON_DEMAND") if oci_serving_mode not in ["ON_DEMAND", "DEDICATED"]: - raise Exception( - "kwarg `oci_serving_mode` must be either 'ON_DEMAND' or 'DEDICATED'" + raise OCIError( + status_code=400, + message="kwarg `oci_serving_mode` must be either 'ON_DEMAND' or 'DEDICATED'", ) if oci_serving_mode == "DEDICATED": - oci_endpoint_id = optional_params.get("oci_endpoint_id", model) - servingMode = OCIServingMode( + serving_mode = OCIServingMode( servingType="DEDICATED", - endpointId=oci_endpoint_id, + endpointId=optional_params.get("oci_endpoint_id", model), ) else: - servingMode = OCIServingMode( - servingType="ON_DEMAND", - modelId=model, - ) + serving_mode = OCIServingMode(servingType="ON_DEMAND", modelId=model) - # Build request based on vendor type if vendor == OCIVendors.COHERE: - # For Cohere, we need to use the specific Cohere format - # Extract the last user message as the main message - user_messages = [msg for msg in messages if msg.get("role") == "user"] + user_messages = [m for m in messages if m.get("role") == "user"] if not user_messages: - raise Exception("No user message found for Cohere model") + raise OCIError( + status_code=400, + message="No user message found — Cohere models require at least one user message", + ) - # Extract system messages into preambleOverride - system_messages = [msg for msg in messages if msg.get("role") == "system"] + system_messages = [m for m in messages if m.get("role") == "system"] preamble_override = None if system_messages: preamble = "\n".join( - self._extract_text_content(msg["content"]) - for msg in system_messages + _extract_text_content(m["content"]) for m in system_messages ) if preamble: preamble_override = preamble - # Create Cohere-specific chat request - optional_cohere_params = self._get_optional_params( - OCIVendors.COHERE, optional_params - ) chat_request = CohereChatRequest( apiFormat="COHERE", - message=self._extract_text_content(user_messages[-1]["content"]), - chatHistory=self.adapt_messages_to_cohere_standard(messages), + message=_extract_text_content(user_messages[-1]["content"]), + chatHistory=adapt_messages_to_cohere_standard( + [m for m in messages if m.get("role") != "system"] + ), preambleOverride=preamble_override, - **optional_cohere_params, + **self._get_optional_params(OCIVendors.COHERE, optional_params, model), ) - data = OCICompletionPayload( compartmentId=oci_compartment_id, - servingMode=servingMode, + servingMode=serving_mode, chatRequest=chat_request, ) else: - # Use generic format for other vendors data = OCICompletionPayload( compartmentId=oci_compartment_id, - servingMode=servingMode, + servingMode=serving_mode, chatRequest=OCIChatRequestPayload( apiFormat=vendor.value, messages=adapt_messages_to_generic_oci_standard(messages), - **self._get_optional_params(vendor, optional_params), + **self._get_optional_params(vendor, optional_params, model), ), ) return data.model_dump(exclude_none=True) - def _handle_cohere_response( - self, json_response: dict, model: str, model_response: ModelResponse - ) -> ModelResponse: - """Handle Cohere-specific response format.""" - cohere_response = CohereChatResult(**json_response) - # Cohere response format (uses camelCase) - model_id = model - - # Set basic response info - model_response.model = model_id - model_response.created = int(datetime.datetime.now().timestamp()) - - # Extract the response text - response_text = cohere_response.chatResponse.text - oci_finish_reason = cohere_response.chatResponse.finishReason - - # Map finish reason - if oci_finish_reason == "COMPLETE": - finish_reason = "stop" - elif oci_finish_reason == "MAX_TOKENS": - finish_reason = "length" - else: - finish_reason = "stop" - - # Handle tool calls - tool_calls: Optional[List[Dict[str, Any]]] = None - if cohere_response.chatResponse.toolCalls: - tool_calls = [] - for tool_call in cohere_response.chatResponse.toolCalls: - tool_calls.append( - { - "id": f"call_{len(tool_calls)}", # Generate a simple ID - "type": "function", - "function": { - "name": tool_call.name, - "arguments": json.dumps(tool_call.parameters), - }, - } - ) - - # Create choice - from litellm.types.utils import Choices - - choice = Choices( - index=0, - message={ - "role": "assistant", - "content": response_text, - "tool_calls": tool_calls, - }, - finish_reason=finish_reason, - ) - model_response.choices = [choice] - - # Extract usage info - usage_info = cohere_response.chatResponse.usage - from litellm.types.utils import Usage - - model_response.usage = Usage( # type: ignore[attr-defined] - prompt_tokens=usage_info.promptTokens, # type: ignore[union-attr] - completion_tokens=usage_info.completionTokens, # type: ignore[union-attr] - total_tokens=usage_info.totalTokens, # type: ignore[union-attr] - ) - - return model_response - - def _handle_generic_response( - self, - json: dict, - model: str, - model_response: ModelResponse, - raw_response: httpx.Response, - ) -> ModelResponse: - """Handle generic OCI response format.""" - try: - completion_response = OCICompletionResponse(**json) - except TypeError as e: - raise OCIError( - message=f"Response cannot be casted to OCICompletionResponse: {str(e)}", - status_code=raw_response.status_code, - ) - - iso_str = completion_response.chatResponse.timeCreated - dt = datetime.datetime.fromisoformat(iso_str.replace("Z", "+00:00")) - model_response.created = int(dt.timestamp()) - - model_response.model = completion_response.modelId - - message = model_response.choices[0].message # type: ignore - response_message = completion_response.chatResponse.choices[0].message - if response_message.content and response_message.content[0].type == "TEXT": - message.content = response_message.content[0].text - if response_message.toolCalls: - message.tool_calls = adapt_tools_to_openai_standard( - response_message.toolCalls - ) - - usage = Usage( - prompt_tokens=completion_response.chatResponse.usage.promptTokens, - completion_tokens=completion_response.chatResponse.usage.completionTokens, - total_tokens=completion_response.chatResponse.usage.totalTokens, - ) - model_response.usage = usage # type: ignore - - return model_response - def transform_response( self, model: str, @@ -1047,34 +574,31 @@ class OCIChatConfig(BaseConfig): api_key: Optional[str] = None, json_mode: Optional[bool] = None, ) -> ModelResponse: - json = raw_response.json() # noqa: F811 + response_json = raw_response.json() - error = json.get("error") - - if error is not None: - raise OCIError( - message=str(json["error"]), - status_code=raw_response.status_code, - ) - - if not isinstance(json, dict): + if not isinstance(response_json, dict): raise OCIError( message="Invalid response format from OCI", status_code=raw_response.status_code, ) - vendor = get_vendor_from_model(model) + if response_json.get("error") is not None: + raise OCIError( + message=str(response_json["error"]), + status_code=raw_response.status_code, + ) - # Handle response based on vendor type + vendor = get_vendor_from_model(model) if vendor == OCIVendors.COHERE: - model_response = self._handle_cohere_response(json, model, model_response) + model_response = handle_cohere_response( + response_json, model, model_response, raw_response + ) else: - model_response = self._handle_generic_response( - json, model, model_response, raw_response + model_response = handle_generic_response( + response_json, model, model_response, raw_response ) model_response._hidden_params["additional_headers"] = raw_response.headers - return model_response @track_llm_api_timing() @@ -1091,8 +615,6 @@ class OCIChatConfig(BaseConfig): json_mode: Optional[bool] = None, signed_json_body: Optional[bytes] = None, ) -> "OCIStreamWrapper": - if "stream" in data: - del data["stream"] if client is None or isinstance(client, AsyncHTTPHandler): client = _get_httpx_client(params={}) @@ -1100,7 +622,11 @@ class OCIChatConfig(BaseConfig): response = client.post( api_base, headers=headers, - data=json.dumps(data), + data=( + signed_json_body + if signed_json_body is not None + else json.dumps(data) + ), stream=True, logging_obj=logging_obj, timeout=STREAMING_TIMEOUT, @@ -1111,15 +637,12 @@ class OCIChatConfig(BaseConfig): if response.status_code != 200: raise OCIError(status_code=response.status_code, message=response.text) - completion_stream = response.iter_text() - - streaming_response = OCIStreamWrapper( - completion_stream=completion_stream, + return OCIStreamWrapper( + completion_stream=_iter_sse_events(response.iter_text()), model=model, custom_llm_provider=custom_llm_provider, logging_obj=logging_obj, ) - return streaming_response @track_llm_api_timing() async def get_async_custom_stream_wrapper( @@ -1135,17 +658,18 @@ class OCIChatConfig(BaseConfig): json_mode: Optional[bool] = None, signed_json_body: Optional[bytes] = None, ) -> "OCIStreamWrapper": - if "stream" in data: - del data["stream"] - if client is None or isinstance(client, HTTPHandler): - client = get_async_httpx_client(llm_provider=LlmProviders.BYTEZ, params={}) + client = get_async_httpx_client(llm_provider=LlmProviders.OCI, params={}) try: response = await client.post( api_base, headers=headers, - data=json.dumps(data), + data=( + signed_json_body + if signed_json_body is not None + else json.dumps(data) + ), stream=True, logging_obj=logging_obj, timeout=STREAMING_TIMEOUT, @@ -1156,22 +680,12 @@ class OCIChatConfig(BaseConfig): if response.status_code != 200: raise OCIError(status_code=response.status_code, message=response.text) - completion_stream = response.aiter_text() - - async def split_chunks(completion_stream: AsyncIterator[str]): - async for item in completion_stream: - for chunk in item.split("\n\n"): - if not chunk: - continue - yield chunk.strip() - - streaming_response = OCIStreamWrapper( - completion_stream=split_chunks(completion_stream), + return OCIStreamWrapper( + completion_stream=_aiter_sse_events(response.aiter_text()), model=model, custom_llm_provider=custom_llm_provider, logging_obj=logging_obj, ) - return streaming_response def get_error_class( self, error_message: str, status_code: int, headers: Union[dict, httpx.Headers] @@ -1179,332 +693,61 @@ class OCIChatConfig(BaseConfig): return OCIError(status_code=status_code, message=error_message) -open_ai_to_generic_oci_role_map: Dict[str, OCIRoles] = { - "system": "SYSTEM", - "user": "USER", - "assistant": "ASSISTANT", - "tool": "TOOL", -} - - -def adapt_messages_to_generic_oci_standard_content_message( - role: str, content: Union[str, list] -) -> OCIMessage: - new_content: List[OCIContentPartUnion] = [] - if isinstance(content, str): - return OCIMessage( - role=open_ai_to_generic_oci_role_map[role], - content=[OCITextContentPart(text=content)], - toolCalls=None, - toolCallId=None, - ) - - # content is a list of content items: - # [ - # {"type": "text", "text": "Hello"}, - # {"type": "image_url", "image_url": "https://example.com/image.png"} - # ] - for content_item in content: - if not isinstance(content_item, dict): - raise Exception("Each content item must be a dictionary") - - type = content_item.get("type") - if not isinstance(type, str): - raise Exception("Prop `type` is not a string") - - if type not in ["text", "image_url"]: - raise Exception(f"Prop `{type}` is not supported") - - if type == "text": - text = content_item.get("text") - if not isinstance(text, str): - raise Exception("Prop `text` is not a string") - new_content.append(OCITextContentPart(text=text)) - - elif type == "image_url": - image_url = content_item.get("image_url") - # Handle both OpenAI format (object with url) and string format - if isinstance(image_url, dict): - image_url = image_url.get("url") - if not isinstance(image_url, str): - raise Exception( - "Prop `image_url` must be a string or an object with a `url` property" - ) - new_content.append(OCIImageContentPart(imageUrl=OCIImageUrl(url=image_url))) - - return OCIMessage( - role=open_ai_to_generic_oci_role_map[role], - content=new_content, - toolCalls=None, - toolCallId=None, - ) - - -def adapt_messages_to_generic_oci_standard_tool_call( - role: str, tool_calls: list -) -> OCIMessage: - tool_calls_formated = [] - for tool_call in tool_calls: - if not isinstance(tool_call, dict): - raise Exception("Each tool call must be a dictionary") - - if tool_call.get("type") != "function": - raise Exception("OCI only supports function tools") - - tool_call_id = tool_call.get("id") - if not isinstance(tool_call_id, str): - raise Exception("Prop `id` is not a string") - - tool_function = tool_call.get("function") - if not isinstance(tool_function, dict): - raise Exception("Prop `function` is not a dictionary") - - function_name = tool_function.get("name") - if not isinstance(function_name, str): - raise Exception("Prop `name` is not a string") - - arguments = tool_call["function"].get("arguments", "{}") - if not isinstance(arguments, str): - raise Exception("Prop `arguments` is not a string") - - # tool_calls_formated.append(OCIToolCall( - # id=tool_call_id, - # type="FUNCTION", - # function=OCIFunction( - # name=function_name, - # arguments=arguments - # ) - # )) - - tool_calls_formated.append( - OCIToolCall( - id=tool_call_id, - type="FUNCTION", - name=function_name, - arguments=arguments, - ) - ) - - return OCIMessage( - role=open_ai_to_generic_oci_role_map[role], - content=None, - toolCalls=tool_calls_formated, - toolCallId=None, - ) - - -def adapt_messages_to_generic_oci_standard_tool_response( - role: str, tool_call_id: str, content: str -) -> OCIMessage: - return OCIMessage( - role=open_ai_to_generic_oci_role_map[role], - content=[OCITextContentPart(text=content)], - toolCalls=None, - toolCallId=tool_call_id, - ) - - -def adapt_messages_to_generic_oci_standard( - messages: List[AllMessageValues], -) -> List[OCIMessage]: - new_messages = [] - for message in messages: - role = message["role"] - content = message.get("content") - tool_calls = message.get("tool_calls") - tool_call_id = message.get("tool_call_id") - - if role == "assistant" and tool_calls is not None: - if not isinstance(tool_calls, list): - raise Exception("Prop `tool_calls` must be a list of tool calls") - new_messages.append( - adapt_messages_to_generic_oci_standard_tool_call(role, tool_calls) - ) - - elif role in ["system", "user", "assistant"] and content is not None: - if not isinstance(content, (str, list)): - raise Exception( - "Prop `content` must be a string or a list of content items" - ) - new_messages.append( - adapt_messages_to_generic_oci_standard_content_message(role, content) - ) - - elif role == "tool": - if not isinstance(tool_call_id, str): - raise Exception("Prop `tool_call_id` is required and must be a string") - if not isinstance(content, str): - raise Exception("Prop `content` is not a string") - new_messages.append( - adapt_messages_to_generic_oci_standard_tool_response( - role, tool_call_id, content - ) - ) - - return new_messages - - -def adapt_tool_definition_to_oci_standard(tools: List[Dict], vendor: OCIVendors): - new_tools = [] - for tool in tools: - if tool["type"] != "function": - raise Exception("OCI only supports function tools") - - tool_function = tool.get("function") - if not isinstance(tool_function, dict): - raise Exception("Prop `function` is not a dictionary") - - new_tool = OCIToolDefinition( - type="FUNCTION", - name=tool_function.get("name"), - description=tool_function.get("description", ""), - parameters=tool_function.get("parameters", {}), - ) - new_tools.append(new_tool) - - return new_tools - - -def adapt_tools_to_openai_standard( - tools: List[OCIToolCall], -) -> List[ChatCompletionMessageToolCall]: - new_tools = [] - for tool in tools: - new_tool = ChatCompletionMessageToolCall( - id=tool.id, - type="function", - function={ - "name": tool.name, - "arguments": tool.arguments, - }, - ) - new_tools.append(new_tool) - return new_tools - - class OCIStreamWrapper(CustomStreamWrapper): - """ - Custom stream wrapper for OCI responses. - This class is used to handle streaming responses from OCI's API. - """ + """Custom stream wrapper that dispatches OCI SSE chunks to the correct handler.""" - def __init__( - self, - **kwargs: Any, - ): + def __init__(self, **kwargs: Any): super().__init__(**kwargs) + # Tracks whether any prior Cohere chunk in this stream has emitted + # tool calls. The Cohere handler uses this to decide whether the + # terminal consolidation chunk's tool calls are duplicates (suppress) + # or the only copy of the tool calls (pass through). + self._cohere_tool_calls_emitted = False + # Analogous flag for text content. Lets the Cohere handler distinguish + # the common case (prior deltas already streamed the text, so the + # terminal chunk's text is a duplicate to suppress) from the degenerate + # single-event case (terminal chunk carries the only copy of the text). + self._cohere_text_emitted = False - def chunk_creator(self, chunk: Any): + def chunk_creator(self, chunk: Any) -> ModelResponseStream: if not isinstance(chunk, str): raise ValueError(f"Chunk is not a string: {chunk}") if not chunk.startswith("data:"): raise ValueError(f"Chunk does not start with 'data:': {chunk}") - dict_chunk = json.loads(chunk[5:]) # Remove 'data: ' prefix and parse JSON - - # Check if this is a Cohere stream chunk - if "apiFormat" in dict_chunk and dict_chunk.get("apiFormat") == "COHERE": - return self._handle_cohere_stream_chunk(dict_chunk) - else: - return self._handle_generic_stream_chunk(dict_chunk) - - def _handle_cohere_stream_chunk(self, dict_chunk: dict): - """Handle Cohere-specific streaming chunks.""" try: - typed_chunk = CohereStreamChunk(**dict_chunk) - except TypeError as e: - raise ValueError(f"Chunk cannot be casted to CohereStreamChunk: {str(e)}") + dict_chunk = json.loads(chunk[5:]) + except json.JSONDecodeError as e: + raise OCIError( + status_code=500, + message=f"Chunk cannot be parsed as JSON: {str(e)}", + ) - if typed_chunk.index is None: - typed_chunk.index = 0 + if dict_chunk.get("apiFormat") == "COHERE": + result = handle_cohere_stream_chunk( + dict_chunk, + prior_tool_calls_emitted=self._cohere_tool_calls_emitted, + prior_text_emitted=self._cohere_text_emitted, + ) + if not self._cohere_tool_calls_emitted: + for choice in result.choices: + if getattr(choice.delta, "tool_calls", None) is not None: + self._cohere_tool_calls_emitted = True + break + if not self._cohere_text_emitted: + for choice in result.choices: + if getattr(choice.delta, "content", None): + self._cohere_text_emitted = True + break + return result + return handle_generic_stream_chunk(dict_chunk) - # Extract text content - text = typed_chunk.text or "" - # Map finish reason to standard format - finish_reason = typed_chunk.finishReason - if finish_reason == "COMPLETE": - finish_reason = "stop" - elif finish_reason == "MAX_TOKENS": - finish_reason = "length" - elif finish_reason is None: - finish_reason = None - else: - finish_reason = "stop" - - # For Cohere, we don't have tool calls in the streaming format - tool_calls = None - - return ModelResponseStream( - choices=[ - StreamingChoices( - index=typed_chunk.index if typed_chunk.index else 0, - delta=Delta( - content=text, - tool_calls=tool_calls, - provider_specific_fields=None, - thinking_blocks=None, - reasoning_content=None, - ), - finish_reason=finish_reason, - ) - ] - ) - - def _handle_generic_stream_chunk(self, dict_chunk: dict): - """Handle generic OCI streaming chunks.""" - # Fix missing required fields in tool calls before Pydantic validation - # OCI streams tool calls progressively, so early chunks may be missing required fields - if dict_chunk.get("message") and dict_chunk["message"].get("toolCalls"): - for tool_call in dict_chunk["message"]["toolCalls"]: - if "arguments" not in tool_call: - tool_call["arguments"] = "" - if "id" not in tool_call: - tool_call["id"] = "" - if "name" not in tool_call: - tool_call["name"] = "" - - try: - typed_chunk = OCIStreamChunk(**dict_chunk) - except TypeError as e: - raise ValueError(f"Chunk cannot be casted to OCIStreamChunk: {str(e)}") - - if typed_chunk.index is None: - typed_chunk.index = 0 - - text = "" - if typed_chunk.message and typed_chunk.message.content: - for item in typed_chunk.message.content: - if isinstance(item, OCITextContentPart): - text += item.text - elif isinstance(item, OCIImageContentPart): - raise ValueError( - "OCI does not support image content in streaming responses" - ) - else: - raise ValueError( - f"Unsupported content type in OCI response: {item.type}" - ) - - tool_calls = None - if typed_chunk.message and typed_chunk.message.toolCalls: - tool_calls = adapt_tools_to_openai_standard(typed_chunk.message.toolCalls) - - return ModelResponseStream( - choices=[ - StreamingChoices( - index=typed_chunk.index if typed_chunk.index else 0, - delta=Delta( - content=text, - tool_calls=( - [tool.model_dump() for tool in tool_calls] - if tool_calls - else None - ), - provider_specific_fields=None, # OCI does not have provider specific fields in the response - thinking_blocks=None, # OCI does not have thinking blocks in the response - reasoning_content=None, # OCI does not have reasoning content in the response - ), - finish_reason=typed_chunk.finishReason, - ) - ] - ) +__all__ = [ + "OCIChatConfig", + "OCIStreamWrapper", + "OCIRequestWrapper", + "OCI_API_VERSION", + "STREAMING_TIMEOUT", + "get_vendor_from_model", + "version", +] diff --git a/litellm/llms/oci/common_utils.py b/litellm/llms/oci/common_utils.py index 661a6c89e4b..8785b1548a5 100644 --- a/litellm/llms/oci/common_utils.py +++ b/litellm/llms/oci/common_utils.py @@ -1,9 +1,42 @@ -from typing import Optional +import base64 +import hashlib +import json +import os +import re +from dataclasses import dataclass +from email.utils import formatdate +from typing import Any, Dict, Optional, Protocol, Tuple +from urllib.parse import urlparse import httpx from litellm.llms.base_llm.chat.transformation import BaseLLMException +try: + from cryptography.hazmat.primitives import hashes, serialization + from cryptography.hazmat.primitives.asymmetric import padding, rsa + + _CRYPTOGRAPHY_AVAILABLE = True +except ImportError: + _CRYPTOGRAPHY_AVAILABLE = False + +try: + from litellm._version import version as _litellm_version +except ImportError: + _litellm_version = "0.0.0" + + +# OCI GenAI REST API version — stable since service launch, unlikely to change +OCI_API_VERSION = "20231130" + + +def _require_cryptography() -> None: + if not _CRYPTOGRAPHY_AVAILABLE: + raise ImportError( + "cryptography package is required for OCI authentication. " + "Please install it with: pip install cryptography" + ) + class OCIError(BaseLLMException): def __init__( @@ -17,3 +50,520 @@ class OCIError(BaseLLMException): message=message, headers=headers, ) + + +# --------------------------------------------------------------------------- +# OCI signing protocol and helpers +# --------------------------------------------------------------------------- + + +class OCISignerProtocol(Protocol): + """ + Protocol for OCI request signers (e.g., oci.signer.Signer). + + Compatible with the OCI Python SDK's Signer class. + See: https://docs.oracle.com/en-us/iaas/tools/python/latest/api/signing.html + """ + + def do_request_sign( + self, request: Any, *, enforce_content_headers: bool = False + ) -> None: + pass + + +@dataclass +class OCIRequestWrapper: + """ + Wrapper for HTTP requests compatible with OCI signer interface. + + Wraps request data in the format expected by OCI SDK signers, which require + objects with method, url, headers, body, and path_url attributes. + """ + + method: str + url: str + headers: dict + body: bytes + + @property + def path_url(self) -> str: + """Returns the path + query string for OCI signing.""" + parsed = urlparse(self.url) + return parsed.path + ("?" + parsed.query if parsed.query else "") + + +def sha256_base64(data: bytes) -> str: + # SHA-256 is used here to compute the x-content-sha256 header required by the + # OCI HTTP signing specification (RSA-SHA256 request signing), not for password + # or secret hashing. This is the correct and mandated algorithm for this purpose. + # See: https://docs.oracle.com/en-us/iaas/Content/API/Concepts/signingrequests.htm + # + # ``usedforsecurity=False`` declares non-security intent to static analyzers + # (CodeQL ``py/weak-sensitive-data-hashing``) — without it the request body + # gets flagged as "password-like data" via taint tracking. + digest = hashlib.sha256(data, usedforsecurity=False).digest() # noqa: S324 + return base64.b64encode(digest).decode() + + +def build_signature_string( + method: str, path: str, headers: dict, signed_headers: list +) -> str: + lines = [] + for header in signed_headers: + if header == "(request-target)": + value = f"{method.lower()} {path}" + else: + value = headers[header] + lines.append(f"{header}: {value}") + return "\n".join(lines) + + +def load_private_key_from_str(key_str: str) -> Any: + _require_cryptography() + key = serialization.load_pem_private_key( # type: ignore[union-attr] + key_str.encode("utf-8"), + password=None, + ) + if not isinstance(key, rsa.RSAPrivateKey): # type: ignore[union-attr] + raise TypeError( + "The provided private key is not an RSA key, which is required for OCI signing." + ) + return key + + +def load_private_key_from_file(file_path: str) -> Any: + """Loads a private key from a file path.""" + try: + with open(file_path, "r", encoding="utf-8") as f: + key_str = f.read().strip() + except FileNotFoundError: + raise FileNotFoundError(f"Private key file not found: {file_path}") + except OSError as e: + raise OSError(f"Failed to read private key file '{file_path}': {e}") from e + + if not key_str: + raise ValueError(f"Private key file is empty: {file_path}") + + return load_private_key_from_str(key_str) + + +# --------------------------------------------------------------------------- +# Env-var credential resolution +# --------------------------------------------------------------------------- + +_OCI_REGION_ENV = "OCI_REGION" +_OCI_USER_ENV = "OCI_USER" +_OCI_FINGERPRINT_ENV = "OCI_FINGERPRINT" +_OCI_TENANCY_ENV = "OCI_TENANCY" +_OCI_KEY_FILE_ENV = "OCI_KEY_FILE" +_OCI_KEY_ENV = "OCI_KEY" +_OCI_COMPARTMENT_ID_ENV = "OCI_COMPARTMENT_ID" + + +def resolve_oci_credentials(optional_params: dict) -> dict: + """ + Merge OCI credentials from optional_params (explicit, always wins) and + environment variables (fallback). + + Returns a dict with resolved values for: + oci_region, oci_user, oci_fingerprint, oci_tenancy, + oci_key, oci_key_file, oci_compartment_id + """ + return { + "oci_region": optional_params.get("oci_region") + or os.environ.get(_OCI_REGION_ENV) + or "us-ashburn-1", + "oci_user": optional_params.get("oci_user") or os.environ.get(_OCI_USER_ENV), + "oci_fingerprint": optional_params.get("oci_fingerprint") + or os.environ.get(_OCI_FINGERPRINT_ENV), + "oci_tenancy": optional_params.get("oci_tenancy") + or os.environ.get(_OCI_TENANCY_ENV), + "oci_key": optional_params.get("oci_key") or os.environ.get(_OCI_KEY_ENV), + "oci_key_file": optional_params.get("oci_key_file") + or os.environ.get(_OCI_KEY_FILE_ENV), + "oci_compartment_id": optional_params.get("oci_compartment_id") + or os.environ.get(_OCI_COMPARTMENT_ID_ENV), + } + + +_OCI_REGION_RE = re.compile(r"^[a-z][a-z0-9-]{0,30}[a-z0-9]$") +_OCI_ACTION_PATH_RE = re.compile(rf"/{OCI_API_VERSION}/actions/[^/?#]+/?$") + + +def get_oci_base_url(optional_params: dict, api_base: Optional[str] = None) -> str: + """Return the OCI inference base URL, respecting any explicit api_base override. + + If ``api_base`` already ends with a fully-formed OCI action path + (``/{OCI_API_VERSION}/actions/``), that suffix is stripped so callers + can append their own action path without producing a doubled URL. + """ + if api_base: + return _OCI_ACTION_PATH_RE.sub("", api_base).rstrip("/") + creds = resolve_oci_credentials(optional_params) + region = creds["oci_region"] + if not isinstance(region, str) or not _OCI_REGION_RE.match(region): + raise OCIError( + status_code=400, + message=( + f"Invalid OCI region {region!r}: must match " + "^[a-z][a-z0-9-]{0,30}[a-z0-9]$ (e.g. 'us-ashburn-1')." + ), + ) + return f"https://inference.generativeai.{region}.oci.oraclecloud.com" + + +# --------------------------------------------------------------------------- +# Signing implementations (shared by chat, embed, and rerank configs) +# --------------------------------------------------------------------------- + + +def sign_with_oci_signer( + headers: dict, + optional_params: dict, + request_data: dict, + api_base: str, +) -> Tuple[dict, bytes]: + """Sign a request using an OCI SDK Signer object passed in optional_params.""" + oci_signer = optional_params.get("oci_signer") + body = json.dumps(request_data).encode("utf-8") + method = str(optional_params.get("method", "POST")).upper() + + if method not in {"POST", "GET", "PUT", "DELETE", "PATCH"}: + raise ValueError(f"Unsupported HTTP method: {method}") + + prepared_headers = {**headers} + prepared_headers.setdefault("content-type", "application/json") + prepared_headers.setdefault("content-length", str(len(body))) + + request_wrapper = OCIRequestWrapper( + method=method, url=api_base, headers=prepared_headers, body=body + ) + + if oci_signer is None: + raise ValueError("oci_signer cannot be None when calling sign_with_oci_signer") + + try: + oci_signer.do_request_sign(request_wrapper, enforce_content_headers=True) + except Exception as e: + raise OCIError( + status_code=500, + message=( + f"Failed to sign request with provided oci_signer: {str(e)}. " + "The signer must implement the OCI SDK Signer interface with a " + "do_request_sign(request, enforce_content_headers=True) method. " + "See: https://docs.oracle.com/en-us/iaas/tools/python/latest/api/signing.html" + ), + ) from e + + headers.update(request_wrapper.headers) + return headers, body + + +def sign_with_manual_credentials( + headers: dict, + optional_params: dict, + request_data: dict, + api_base: str, +) -> Tuple[dict, bytes]: + """Sign a request using manually provided OCI credentials (user/fingerprint/tenancy/key).""" + creds = resolve_oci_credentials(optional_params) + oci_user = creds["oci_user"] + oci_fingerprint = creds["oci_fingerprint"] + oci_tenancy = creds["oci_tenancy"] + oci_key = creds["oci_key"] + oci_key_file = creds["oci_key_file"] + + if ( + not oci_user + or not oci_fingerprint + or not oci_tenancy + or not (oci_key or oci_key_file) + ): + raise OCIError( + status_code=401, + message=( + "Missing required OCI credentials: oci_user, oci_fingerprint, oci_tenancy, " + "and at least one of oci_key or oci_key_file. " + "These can also be supplied via environment variables: " + f"{_OCI_USER_ENV}, {_OCI_FINGERPRINT_ENV}, {_OCI_TENANCY_ENV}, {_OCI_KEY_ENV} (or {_OCI_KEY_FILE_ENV}). " + "Alternatively, provide an oci_signer object from the OCI SDK." + ), + ) + + method = str(optional_params.get("method", "POST")).upper() + body = json.dumps(request_data).encode("utf-8") + parsed = urlparse(api_base) + path = parsed.path or "/" + host = parsed.netloc + + date = formatdate(usegmt=True) + content_type = headers.get("content-type", "application/json") + content_length = str(len(body)) + x_content_sha256 = sha256_base64(body) + + headers_to_sign: Dict[str, str] = { + "date": date, + "host": host, + "content-type": content_type, + "content-length": content_length, + "x-content-sha256": x_content_sha256, + } + + signed_header_names = [ + "date", + "(request-target)", + "host", + "content-length", + "content-type", + "x-content-sha256", + ] + signing_string = build_signature_string( + method, path, headers_to_sign, signed_header_names + ) + + _require_cryptography() + + # Resolve the private key — prefer inline PEM content over file path + oci_key_content: Optional[str] = None + if oci_key: + if not isinstance(oci_key, str): + raise OCIError( + status_code=400, + message=( + f"oci_key must be a string containing the PEM private key content. " + f"Got type: {type(oci_key).__name__}" + ), + ) + oci_key_content = oci_key.replace("\\n", "\n").replace("\r\n", "\n") + + private_key = ( + load_private_key_from_str(oci_key_content) + if oci_key_content + else load_private_key_from_file(oci_key_file) if oci_key_file else None + ) + + if private_key is None: + raise OCIError( + status_code=400, + message="Private key is required for OCI authentication. Provide either oci_key or oci_key_file.", + ) + + signature = private_key.sign( + signing_string.encode("utf-8"), + padding.PKCS1v15(), # type: ignore[union-attr] + hashes.SHA256(), # type: ignore[union-attr] + ) + signature_b64 = base64.b64encode(signature).decode() + + key_id = f"{oci_tenancy}/{oci_user}/{oci_fingerprint}" + authorization = ( + 'Signature version="1",' + f'keyId="{key_id}",' + 'algorithm="rsa-sha256",' + f'headers="{" ".join(signed_header_names)}",' + f'signature="{signature_b64}"' + ) + + headers.update( + { + "authorization": authorization, + "date": date, + "host": host, + "content-type": content_type, + "content-length": content_length, + "x-content-sha256": x_content_sha256, + } + ) + return headers, body + + +def sign_oci_request( + headers: dict, + optional_params: dict, + request_data: dict, + api_base: str, + api_key: Optional[str] = None, + model: Optional[str] = None, + stream: Optional[bool] = None, + fake_stream: Optional[bool] = None, +) -> Tuple[dict, bytes]: + """ + Route to the appropriate OCI signing method based on what credentials are present. + + If ``oci_signer`` is in optional_params, use the OCI SDK signer object. + Otherwise use manual RSA-SHA256 signing with explicit credentials (which can + also be supplied via OCI_* environment variables). + + Returns: + Tuple of (signed_headers, signed_body_bytes) + """ + if optional_params.get("oci_signer") is not None: + return sign_with_oci_signer(headers, optional_params, request_data, api_base) + return sign_with_manual_credentials( + headers, optional_params, request_data, api_base + ) + + +def validate_oci_environment( + headers: dict, + optional_params: dict, + api_key: Optional[str] = None, +) -> dict: + """ + Populate common OCI request headers (content-type, user-agent). + + Full credential validation is deferred to signing time so that credentials + supplied via environment variables are resolved at call time rather than + at construction time. + """ + headers.setdefault("content-type", "application/json") + headers.setdefault("user-agent", f"litellm/{_litellm_version}") + return headers + + +# --------------------------------------------------------------------------- +# JSON schema utilities for OCI tool definitions +# +# OCI Generative AI does not support JSON Schema extensions ($ref, $defs, +# anyOf). Pydantic v2 emits all three for models with Optional fields or +# nested schemas. The helpers below are ported from the official +# langchain-oracle reference implementation so that tool schemas are always +# valid before they reach the OCI endpoint. +# --------------------------------------------------------------------------- + +# Mapping from JSON Schema type names to Python type names, as expected by +# the OCI Cohere API's CohereParameterDefinition.type field. +OCI_JSON_TO_PYTHON_TYPES: Dict[str, str] = { + "string": "str", + "number": "float", + "boolean": "bool", + "integer": "int", + "array": "List", + "object": "Dict", + "any": "any", +} + + +def resolve_oci_schema_refs(schema: Dict[str, Any]) -> Dict[str, Any]: + """Inline all ``$ref``/``$defs`` references — OCI does not support JSON Schema ``$ref``.""" + defs = schema.get("$defs", {}) + resolving_stack: set = set() + + def _resolve(obj: Any) -> Any: + if isinstance(obj, dict): + if "$ref" in obj: + ref = obj["$ref"] + if ref.startswith("#/$defs/"): + key = ref.split("/")[-1] + if key in resolving_stack: + return {"type": "object"} # break cycles + resolving_stack.add(key) + try: + return _resolve(defs.get(key, obj)) + finally: + resolving_stack.discard(key) + return obj # external $ref — leave unchanged + return {k: _resolve(v) for k, v in obj.items()} + if isinstance(obj, list): + return [_resolve(item) for item in obj] + return obj + + resolved = _resolve(schema) + if isinstance(resolved, dict): + resolved.pop("$defs", None) + return resolved + + +def resolve_oci_schema_anyof(obj: Any) -> Any: + """Resolve Pydantic v2 ``Optional[T]`` → ``anyOf`` patterns. + + Pydantic v2 emits ``{"anyOf": [{"type": "T"}, {"type": "null"}]}`` for + ``Optional[T]``. OCI models don't understand ``anyOf``, so we pick the + first non-null branch and merge top-level metadata into it. + """ + if isinstance(obj, dict): + if "anyOf" in obj and "type" not in obj: + non_null = [ + t + for t in obj["anyOf"] + if not (isinstance(t, dict) and t.get("type") == "null") + ] + if non_null: + resolved = {**obj, **non_null[0]} + resolved.pop("anyOf", None) + return resolve_oci_schema_anyof(resolved) + return {k: resolve_oci_schema_anyof(v) for k, v in obj.items()} + if isinstance(obj, list): + return [resolve_oci_schema_anyof(item) for item in obj] + return obj + + +def sanitize_oci_schema(schema: Any) -> Any: + """Recursively remove OCI-incompatible fields from a JSON schema. + + Strips ``title`` keys, removes ``None``-valued ``default`` entries, + normalises ``type: [T, "null"]`` list types, and ensures arrays carry an + ``items`` definition. + """ + if isinstance(schema, list): + return [sanitize_oci_schema(item) for item in schema] + if not isinstance(schema, dict): + return schema + + sanitized: Dict[str, Any] = {} + for key, value in schema.items(): + if key == "title": + continue + if key == "default" and value is None: + continue + if key == "type": + if value == "any": + sanitized[key] = "object" + continue + if isinstance(value, list): + non_null = [t for t in value if t != "null"] + sanitized[key] = non_null[0] if non_null else "string" + continue + sanitized[key] = sanitize_oci_schema(value) + + if sanitized.get("type") == "array" and "items" not in sanitized: + sanitized["items"] = {"type": "object"} + + required = sanitized.get("required") + properties = sanitized.get("properties") + if "required" in sanitized: + if isinstance(required, list) and isinstance(properties, dict): + sanitized["required"] = [ + f for f in required if isinstance(f, str) and f in properties + ] + elif not isinstance(required, list): + sanitized["required"] = [] + + return sanitized + + +def enrich_cohere_param_description( + description: str, param_schema: Dict[str, Any] +) -> str: + """Embed schema constraints into a Cohere parameter description. + + ``CohereParameterDefinition`` only has ``type``, ``description``, and + ``isRequired``. Rich constraints (``enum``, ``format``, ``minimum``, + ``maximum``, ``pattern``) are appended to the description string so the + model can still see and respect them. + """ + parts = [description] if description else [] + if "enum" in param_schema: + parts.append(f"Allowed values: {param_schema['enum']}") + if "format" in param_schema: + parts.append(f"Format: {param_schema['format']}") + if "minimum" in param_schema or "maximum" in param_schema: + range_parts = [] + if "minimum" in param_schema: + range_parts.append(f"min={param_schema['minimum']}") + if "maximum" in param_schema: + range_parts.append(f"max={param_schema['maximum']}") + parts.append(f"Range: {', '.join(range_parts)}") + if "pattern" in param_schema: + parts.append(f"Pattern: {param_schema['pattern']}") + return ". ".join(parts) if parts else "" diff --git a/litellm/llms/oci/embed/transformation.py b/litellm/llms/oci/embed/transformation.py index 1dcd8c5213c..6cfa85b4bc4 100644 --- a/litellm/llms/oci/embed/transformation.py +++ b/litellm/llms/oci/embed/transformation.py @@ -1,8 +1,14 @@ """ -OCI Generative AI Embedding Configuration +OCI Generative AI — Embedding transformation. -Supports embedding models available on Oracle Cloud Infrastructure Generative AI service. -Uses the same authentication mechanisms as OCI chat (manual signing or OCI SDK Signer). +Endpoint: POST /20231130/actions/embedText +Supported models: cohere.embed-english-v3.0, cohere.embed-multilingual-v3.0, +cohere.embed-v4.0, and all other Cohere embed variants available on OCI +(including dedicated endpoints). + +Authentication follows the same RSA-SHA256 / OCI SDK signer pattern as chat. +The base handler (base_llm_http_handler.embedding) calls sign_request after +building the body, so signing happens automatically. Supported models: - cohere.embed-english-v3.0 @@ -10,25 +16,45 @@ Supported models: - cohere.embed-multilingual-v3.0 - cohere.embed-multilingual-light-v3.0 - cohere.embed-english-image-v3.0 -- cohere.embed-english-light-image-v3.0 -- cohere.embed-multilingual-light-image-v3.0 +- cohere.embed-multilingual-image-v3.0 - cohere.embed-v4.0 Reference: https://docs.oracle.com/en-us/iaas/api/#/en/generative-ai-inference/latest/EmbedTextResult/EmbedText """ -from typing import Any, Dict, List, Optional, Union +from typing import TYPE_CHECKING, Any, List, Optional, Tuple, Union import httpx -from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj +import litellm from litellm.llms.base_llm.chat.transformation import BaseLLMException from litellm.llms.base_llm.embedding.transformation import BaseEmbeddingConfig -from litellm.llms.oci.chat.transformation import OCIChatConfig -from litellm.llms.oci.common_utils import OCIError +from litellm.llms.oci.common_utils import ( + OCI_API_VERSION, + OCIError, + get_oci_base_url, + resolve_oci_credentials, + sign_oci_request, + validate_oci_environment, +) +from litellm.types.llms.oci import ( + OCIEmbedRequest, + OCIEmbedResponse, + OCIServingMode, +) from litellm.types.llms.openai import AllEmbeddingInputValues, AllMessageValues from litellm.types.utils import EmbeddingResponse, Usage +if TYPE_CHECKING: + from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj + + LiteLLMLoggingObj = _LiteLLMLoggingObj +else: + LiteLLMLoggingObj = Any + +# OCI sends up to 96 texts per embedText request (Cohere limit). +OCI_EMBED_BATCH_LIMIT = 96 + # Input type mapping from OpenAI conventions to OCI/Cohere conventions _INPUT_TYPE_MAP = { "search_document": "SEARCH_DOCUMENT", @@ -38,65 +64,43 @@ _INPUT_TYPE_MAP = { } -class OCIEmbeddingConfig(BaseEmbeddingConfig): +class OCIEmbedConfig(BaseEmbeddingConfig): """ - Configuration for OCI Generative AI Embedding API. + Transformation config for OCI Generative AI embeddings. - The OCI embedding endpoint uses the Cohere embed models hosted on OCI. - Authentication is handled via OCI request signing (manual credentials or OCI SDK Signer). + Supports both text and (on cohere.embed-v4.0) multimodal inputs. - Usage: - ```python - import litellm + Authentication — same two modes as chat: + - **OCI SDK signer**: pass ``oci_signer`` in optional_params. + - **Manual RSA-SHA256**: pass ``oci_user``, ``oci_fingerprint``, ``oci_tenancy``, + and ``oci_key`` or ``oci_key_file``, or set the corresponding ``OCI_*`` env vars. - response = litellm.embedding( - model="oci/cohere.embed-english-v3.0", - input=["Hello world", "Goodbye world"], - oci_compartment_id="ocid1.compartment.oc1..xxx", - oci_region="us-ashburn-1", - oci_user="ocid1.user.oc1..xxx", - oci_fingerprint="xx:xx:xx:xx", - oci_tenancy="ocid1.tenancy.oc1..xxx", - oci_key_file="~/.oci/key.pem", - ) - ``` + Required call-time params (via optional_params or env vars): + - ``oci_compartment_id`` / ``OCI_COMPARTMENT_ID`` + - ``oci_region`` / ``OCI_REGION`` (default: ``us-ashburn-1``) + + Optional call-time params: + - ``oci_serving_mode``: ``"ON_DEMAND"`` (default) or ``"DEDICATED"`` + - ``oci_endpoint_id``: endpoint OCID for dedicated serving mode + - ``input_type``: ``SEARCH_DOCUMENT``, ``SEARCH_QUERY``, ``CLASSIFICATION``, ``CLUSTERING`` + - ``truncate``: ``NONE``, ``START``, or ``END`` (default ``END``) + - ``dimensions``: output embedding dimensions (cohere.embed-v4.0+) """ - def __init__(self) -> None: - # We reuse OCIChatConfig for signing logic - self._chat_config = OCIChatConfig() - - def get_complete_url( - self, - api_base: Optional[str], - api_key: Optional[str], - model: str, - optional_params: dict, - litellm_params: dict, - stream: Optional[bool] = None, - ) -> str: - if api_base: - return api_base - - oci_region = optional_params.get("oci_region", "us-ashburn-1") - return f"https://inference.generativeai.{oci_region}.oci.oraclecloud.com/20231130/actions/embedText" - - def get_supported_openai_params(self, model: str) -> list: - return [ - "dimensions", - ] + def get_supported_openai_params(self, model: str) -> List[str]: + return ["dimensions"] def map_openai_params( self, non_default_params: dict, optional_params: dict, model: str, - drop_params: bool, + drop_params: bool = False, ) -> dict: - # Note: OCI Cohere embed does not support custom dimensions natively, - # but we pass it through in case future models support it - if "dimensions" in non_default_params: - optional_params["dimensions"] = non_default_params["dimensions"] + for key, value in non_default_params.items(): + if key == "dimensions": + # OCI API uses outputDimensions (cohere.embed-v4.0+) + optional_params["outputDimensions"] = value return optional_params def validate_environment( @@ -109,49 +113,42 @@ class OCIEmbeddingConfig(BaseEmbeddingConfig): api_key: Optional[str] = None, api_base: Optional[str] = None, ) -> dict: - """ - Validate OCI credentials for embedding requests. - Supports both OCI SDK Signer and manual credential signing. - """ - oci_signer = optional_params.get("oci_signer") - oci_region = optional_params.get("oci_region", "us-ashburn-1") - - api_base = ( - api_base - or f"https://inference.generativeai.{oci_region}.oci.oraclecloud.com" - ) - - if oci_signer is None: - oci_user = optional_params.get("oci_user") - oci_fingerprint = optional_params.get("oci_fingerprint") - oci_tenancy = optional_params.get("oci_tenancy") - oci_key = optional_params.get("oci_key") - oci_key_file = optional_params.get("oci_key_file") - oci_compartment_id = optional_params.get("oci_compartment_id") - - if ( - not oci_user - or not oci_fingerprint - or not oci_tenancy - or not (oci_key or oci_key_file) - or not oci_compartment_id - ): - raise Exception( - "Missing required parameters: oci_user, oci_fingerprint, oci_tenancy, oci_compartment_id " - "and at least one of oci_key or oci_key_file. " - "Alternatively, provide an oci_signer object from the OCI SDK." + if optional_params.get("oci_signer") is None: + creds = resolve_oci_credentials(optional_params) + missing = [ + k + for k in ( + "oci_user", + "oci_fingerprint", + "oci_tenancy", + "oci_compartment_id", ) + if not creds.get(k) + ] + if missing or not (creds.get("oci_key") or creds.get("oci_key_file")): + raise OCIError( + status_code=401, + message=( + "Missing required parameters: oci_user, oci_fingerprint, oci_tenancy, " + "oci_compartment_id and at least one of oci_key or oci_key_file. " + "These can be supplied via optional_params or via OCI_USER, OCI_FINGERPRINT, " + "OCI_TENANCY, OCI_COMPARTMENT_ID, OCI_KEY_FILE environment variables. " + "Alternatively, provide an oci_signer object from the OCI SDK." + ), + ) + return validate_oci_environment(headers, optional_params, api_key) - from litellm.llms.custom_httpx.http_handler import version - - headers.update( - { - "content-type": "application/json", - "user-agent": f"litellm/{version}", - } - ) - - return headers + def get_complete_url( + self, + api_base: Optional[str], + api_key: Optional[str], + model: str, + optional_params: dict, + litellm_params: dict, + stream: Optional[bool] = None, + ) -> str: + base = get_oci_base_url(optional_params, api_base or litellm.api_base) + return f"{base}/{OCI_API_VERSION}/actions/embedText" def sign_request( self, @@ -163,9 +160,8 @@ class OCIEmbeddingConfig(BaseEmbeddingConfig): model: Optional[str] = None, stream: Optional[bool] = None, fake_stream: Optional[bool] = None, - ): - """Delegate to OCIChatConfig's signing logic.""" - return self._chat_config.sign_request( + ) -> Tuple[dict, bytes]: + return sign_oci_request( headers=headers, optional_params=optional_params, request_data=request_data, @@ -182,91 +178,74 @@ class OCIEmbeddingConfig(BaseEmbeddingConfig): input: AllEmbeddingInputValues, optional_params: dict, headers: dict, - api_base: Optional[str] = None, ) -> dict: - """ - Transform the embedding request to OCI format. - - OCI embedText API expects: - { - "compartmentId": "...", - "servingMode": {"servingType": "ON_DEMAND", "modelId": "..."}, - "inputs": ["text1", "text2"], - "truncate": "END", - "inputType": "SEARCH_DOCUMENT" - } - """ - oci_compartment_id = optional_params.get("oci_compartment_id") - if not oci_compartment_id: - raise Exception( - "kwarg `oci_compartment_id` is required for OCI embedding requests" + creds = resolve_oci_credentials(optional_params) + compartment_id = creds["oci_compartment_id"] + if not compartment_id: + raise OCIError( + status_code=400, + message=( + "oci_compartment_id is required for OCI embedding requests. " + "Pass it as optional_params or set the OCI_COMPARTMENT_ID env var." + ), ) - # Build serving mode - oci_serving_mode = optional_params.get("oci_serving_mode", "ON_DEMAND") - if oci_serving_mode == "DEDICATED": - oci_endpoint_id = optional_params.get("oci_endpoint_id", model) - serving_mode = { - "servingType": "DEDICATED", - "endpointId": oci_endpoint_id, - } - else: - serving_mode = { - "servingType": "ON_DEMAND", - "modelId": model, - } - - # Normalize input to list of strings + # Normalise input to a flat list of strings if isinstance(input, str): - inputs = [input] + texts = [input] elif isinstance(input, list): - inputs = [] + texts = [] for item in input: - if isinstance(item, str): - inputs.append(item) - elif isinstance(item, list): - raise ValueError( - "OCI embedding does not support token-array inputs. " - "Please convert token lists to strings before calling embedding()." + if isinstance(item, list): + raise OCIError( + status_code=400, + message=( + "OCI embedText does not support token-array inputs. " + "Convert token lists to strings before calling embedding()." + ), ) - else: - inputs.append(str(item)) + texts.append(item if isinstance(item, str) else str(item)) else: - inputs = [str(input)] + texts = [str(input)] - # Build request data — OCI embedText API expects inputs, truncate, - # and inputType at the top level alongside compartmentId and servingMode - request_data: Dict[str, Any] = { - "compartmentId": oci_compartment_id, - "servingMode": serving_mode, - "inputs": inputs, - "truncate": optional_params.get("truncate", "END"), - } + if len(texts) > OCI_EMBED_BATCH_LIMIT: + raise OCIError( + status_code=400, + message=( + f"OCI embedText accepts at most {OCI_EMBED_BATCH_LIMIT} inputs per request " + f"(got {len(texts)}). Batch your requests." + ), + ) - # Map input_type if provided + serving_mode_type = optional_params.get("oci_serving_mode", "ON_DEMAND").upper() + if serving_mode_type not in {"ON_DEMAND", "DEDICATED"}: + raise OCIError( + status_code=400, + message="oci_serving_mode must be 'ON_DEMAND' or 'DEDICATED'.", + ) + + if serving_mode_type == "DEDICATED": + endpoint_id = optional_params.get("oci_endpoint_id", model) + serving_mode = OCIServingMode( + servingType="DEDICATED", endpointId=endpoint_id + ) + else: + serving_mode = OCIServingMode(servingType="ON_DEMAND", modelId=model) + + # Map input_type from OpenAI convention to OCI/Cohere convention input_type = optional_params.get("input_type") if input_type: - mapped_type = _INPUT_TYPE_MAP.get(input_type.lower(), input_type.upper()) - request_data["inputType"] = mapped_type + input_type = _INPUT_TYPE_MAP.get(input_type.lower(), input_type.upper()) - # Sign the request using the same URL the HTTP handler will POST to - signing_url = self.get_complete_url( - api_base=api_base, - api_key=None, - model=model, - optional_params=optional_params, - litellm_params={}, + request = OCIEmbedRequest( + compartmentId=compartment_id, + servingMode=serving_mode, + inputs=texts, + inputType=input_type, + truncate=optional_params.get("truncate", "END"), + outputDimensions=optional_params.get("outputDimensions"), ) - - signed_headers, body = self.sign_request( - headers=headers, - optional_params=optional_params, - request_data=request_data, - api_base=signing_url, - ) - headers.update(signed_headers) - - return request_data + return request.model_dump(exclude_none=True) def transform_embedding_response( self, @@ -274,63 +253,57 @@ class OCIEmbeddingConfig(BaseEmbeddingConfig): raw_response: httpx.Response, model_response: EmbeddingResponse, logging_obj: LiteLLMLoggingObj, - api_key: Optional[str] = None, - request_data: dict = {}, - optional_params: dict = {}, - litellm_params: dict = {}, + api_key: Optional[str], + request_data: dict, + optional_params: dict, + litellm_params: dict, ) -> EmbeddingResponse: - """ - Transform OCI embedding response to standard EmbeddingResponse format. - - OCI response format: - { - "embeddings": [[0.1, 0.2, ...], [0.3, 0.4, ...]], - "modelId": "cohere.embed-english-v3.0", - "modelVersion": "3.0", - "inputTextTokenCounts": [5, 4] - } - """ if raw_response.status_code != 200: raise OCIError( - message=raw_response.text, status_code=raw_response.status_code, + message=raw_response.text, ) try: - raw_response_json = raw_response.json() - except Exception: + json_response = raw_response.json() + except Exception as e: raise OCIError( - message=raw_response.text, status_code=raw_response.status_code, + message=f"Failed to parse OCI embed response as JSON: {e}", ) - embeddings = raw_response_json.get("embeddings", []) - model_id = raw_response_json.get("modelId", model) - - # Build response data in OpenAI format - embedding_data = [] - for idx, embedding in enumerate(embeddings): - embedding_data.append( - { - "object": "embedding", - "index": idx, - "embedding": embedding, - } + try: + parsed = OCIEmbedResponse(**json_response) + except Exception as e: + raise OCIError( + status_code=500, + message=f"OCI embed response does not match expected schema: {e}", ) - model_response.model = model_id - model_response.data = embedding_data - model_response.object = "list" + model_response.model = parsed.modelId + model_response.data = [ + { + "object": "embedding", + "index": i, + "embedding": embedding, + } + for i, embedding in enumerate(parsed.embeddings) + ] - # Calculate token usage - input_token_counts = raw_response_json.get("inputTextTokenCounts", []) - total_tokens = sum(input_token_counts) if input_token_counts else 0 - - usage = Usage( - prompt_tokens=total_tokens, - total_tokens=total_tokens, - ) - model_response.usage = usage + if parsed.inputTextTokenCounts is not None: + # Actual OCI API returns per-input token counts — sum for total usage + total = sum(parsed.inputTextTokenCounts) + model_response.usage = Usage(prompt_tokens=total, total_tokens=total) + elif parsed.usage is not None: + # Some deployments may return a usage object directly + model_response.usage = Usage( + prompt_tokens=parsed.usage.promptTokens, + total_tokens=parsed.usage.totalTokens, + ) + else: + # Neither field returned — default to zero so downstream consumers + # can always rely on usage being populated. + model_response.usage = Usage(prompt_tokens=0, total_tokens=0) return model_response @@ -340,8 +313,8 @@ class OCIEmbeddingConfig(BaseEmbeddingConfig): status_code: int, headers: Union[dict, httpx.Headers], ) -> BaseLLMException: - return OCIError( - message=error_message, - status_code=status_code, - headers=headers if isinstance(headers, httpx.Headers) else None, - ) + return OCIError(status_code=status_code, message=error_message) + + +# Alias for backwards compatibility with any code that imports OCIEmbeddingConfig +OCIEmbeddingConfig = OCIEmbedConfig diff --git a/litellm/llms/ollama/chat/transformation.py b/litellm/llms/ollama/chat/transformation.py index 48534799c97..e36150a4954 100644 --- a/litellm/llms/ollama/chat/transformation.py +++ b/litellm/llms/ollama/chat/transformation.py @@ -507,10 +507,10 @@ class OllamaChatCompletionResponseIterator(BaseModelResponseIterator): # PROCESS REASONING CONTENT reasoning_content: Optional[str] = None content: Optional[str] = None - if chunk["message"].get("thinking") is not None: + if chunk["message"].get("thinking"): reasoning_content = chunk["message"].get("thinking") self.started_reasoning_content = True - elif chunk["message"].get("content") is not None: + if chunk["message"].get("content"): if ( self.started_reasoning_content and not self.finished_reasoning_content diff --git a/litellm/llms/ollama/common_utils.py b/litellm/llms/ollama/common_utils.py index 8aedd9b3500..8ca8b7d383a 100644 --- a/litellm/llms/ollama/common_utils.py +++ b/litellm/llms/ollama/common_utils.py @@ -108,7 +108,7 @@ class OllamaModelInfo(BaseLLMModelInfo): continue nm = entry.get("name") or entry.get("model") if isinstance(nm, str): - names.add(nm) + names.add(nm if nm.startswith("ollama/") else f"ollama/{nm}") except Exception as e: verbose_logger.warning(f"Error retrieving ollama tag endpoint: {e}") # If tags endpoint fails, fall back to static list diff --git a/litellm/llms/openai/chat/gpt_5_transformation.py b/litellm/llms/openai/chat/gpt_5_transformation.py index 4e34d10b187..9ccb2e1c267 100644 --- a/litellm/llms/openai/chat/gpt_5_transformation.py +++ b/litellm/llms/openai/chat/gpt_5_transformation.py @@ -3,7 +3,10 @@ from typing import Optional, Union import litellm -from litellm.utils import _is_explicitly_disabled_factory, _supports_factory +from litellm.utils import ( + _is_explicitly_disabled_factory, + _supports_factory, +) from .gpt_transformation import OpenAIGPTConfig diff --git a/litellm/llms/openai/chat/gpt_transformation.py b/litellm/llms/openai/chat/gpt_transformation.py index 6b7ec4dfb1c..5464b5bb7ee 100644 --- a/litellm/llms/openai/chat/gpt_transformation.py +++ b/litellm/llms/openai/chat/gpt_transformation.py @@ -287,7 +287,13 @@ class OpenAIGPTConfig(BaseLLMModelInfo, BaseConfig): content_item["image_url"] = new_image_url_obj elif content_item.get("type") == "file": content_item = cast(ChatCompletionFileObject, content_item) - file_obj = content_item["file"] + file_obj = content_item.get("file") + if file_obj is None: + raise litellm.BadRequestError( + message="Content block has type='file' but is missing the required 'file' field", + model=None, + llm_provider="openai", + ) new_file_obj = ChatCompletionFileObjectFile( **{ # type: ignore k: v diff --git a/litellm/llms/openai/chat/guardrail_translation/handler.py b/litellm/llms/openai/chat/guardrail_translation/handler.py index 86ca6625629..d413a244539 100644 --- a/litellm/llms/openai/chat/guardrail_translation/handler.py +++ b/litellm/llms/openai/chat/guardrail_translation/handler.py @@ -21,7 +21,9 @@ from litellm._logging import verbose_proxy_logger from litellm.llms.base_llm.guardrail_translation.base_translation import BaseTranslation from litellm.llms.base_llm.guardrail_translation.utils import ( effective_skip_system_message_for_guardrail, + effective_skip_tool_message_for_guardrail, openai_messages_without_system, + openai_messages_without_tool, ) from litellm.main import stream_chunk_builder from litellm.types.llms.openai import AllMessageValues, ChatCompletionToolParam @@ -73,6 +75,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): return data skip_system = effective_skip_system_message_for_guardrail(guardrail_to_apply) + skip_tool = effective_skip_tool_message_for_guardrail(guardrail_to_apply) texts_to_check: List[str] = [] images_to_check: List[str] = [] @@ -91,6 +94,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation): text_task_mappings=text_task_mappings, tool_call_task_mappings=tool_call_task_mappings, skip_system_message=skip_system, + skip_tool_message=skip_tool, ) # Step 2: Apply guardrail to all texts and tool calls in batch @@ -102,11 +106,15 @@ class OpenAIChatCompletionsHandler(BaseTranslation): inputs["tool_calls"] = tool_calls_to_check # type: ignore structured_messages = self.get_structured_messages(data) if structured_messages: - inputs["structured_messages"] = ( - openai_messages_without_system(structured_messages) - if skip_system - else structured_messages - ) + if skip_system: + structured_messages = openai_messages_without_system( + structured_messages + ) + if skip_tool: + structured_messages = openai_messages_without_tool( + structured_messages + ) + inputs["structured_messages"] = structured_messages # Pass tools (function definitions) to the guardrail tools = data.get("tools") if tools: @@ -176,13 +184,17 @@ class OpenAIChatCompletionsHandler(BaseTranslation): text_task_mappings: List[Tuple[int, Optional[int]]], tool_call_task_mappings: List[Tuple[int, int]], skip_system_message: bool = False, + skip_tool_message: bool = False, ) -> None: """ Extract text content, images, and tool calls from a message. Override this method to customize text/image/tool call extraction logic. """ - if skip_system_message and str(message.get("role") or "").lower() == "system": + role = str(message.get("role") or "").lower() + if skip_system_message and role == "system": + return + if skip_tool_message and role == "tool": return content = message.get("content", None) diff --git a/litellm/llms/openai/chat/o_series_transformation.py b/litellm/llms/openai/chat/o_series_transformation.py index 02ae2cc9750..8db7ecf7b3a 100644 --- a/litellm/llms/openai/chat/o_series_transformation.py +++ b/litellm/llms/openai/chat/o_series_transformation.py @@ -1,14 +1,14 @@ """ -Support for o1/o3 model family +Support for o1/o3 model family https://platform.openai.com/docs/guides/reasoning Translations handled by LiteLLM: -- modalities: image => drop param (if user opts in to dropping param) -- role: system ==> translate to role 'user' -- streaming => faked by LiteLLM -- Tools, response_format => drop param (if user opts in to dropping param) -- Logprobs => drop param (if user opts in to dropping param) +- modalities: image => drop param (if user opts in to dropping param) +- role: system ==> translate to role 'user' +- streaming => faked by LiteLLM +- Tools, response_format => drop param (if user opts in to dropping param) +- Logprobs => drop param (if user opts in to dropping param) """ from typing import Any, Coroutine, List, Literal, Optional, Union, cast, overload diff --git a/litellm/llms/openai/common_utils.py b/litellm/llms/openai/common_utils.py index c13a976c1b9..381f215a13f 100644 --- a/litellm/llms/openai/common_utils.py +++ b/litellm/llms/openai/common_utils.py @@ -201,7 +201,7 @@ class BaseOpenAILLM: @staticmethod def get_openai_client_initialization_param_fields( - client_type: Literal["openai", "azure"] + client_type: Literal["openai", "azure"], ) -> Tuple[str, ...]: """Returns a tuple of fields that are used to initialize the OpenAI client""" if client_type == "openai": diff --git a/litellm/llms/openai/responses/transformation.py b/litellm/llms/openai/responses/transformation.py index b7d5340d8d4..5043d25ee37 100644 --- a/litellm/llms/openai/responses/transformation.py +++ b/litellm/llms/openai/responses/transformation.py @@ -126,9 +126,21 @@ class OpenAIResponsesAPIConfig(BaseResponsesAPIConfig): litellm_params: GenericLiteLLMParams, headers: dict, ) -> Dict: - """No transform applied since inputs are in OpenAI spec already""" + """Strip Anthropic-only `cache_control` markers before sending to OpenAI. + + OpenAI's Responses API rejects unknown fields on input content blocks + with HTTP 400 ("Unknown parameter: 'input[0].content[0].cache_control'"). + Chat Completions strips these in + `remove_cache_control_flag_from_messages_and_tools`; mirror that here. + """ input = self._validate_input_param(input) + tools = response_api_optional_request_params.get("tools") + input, tools = self.remove_cache_control_flag_from_input_and_tools( + model=model, input=input, tools=tools + ) + if tools is not None: + response_api_optional_request_params["tools"] = tools final_request_params = dict( ResponsesAPIRequestParams( model=model, input=input, **response_api_optional_request_params @@ -137,6 +149,38 @@ class OpenAIResponsesAPIConfig(BaseResponsesAPIConfig): return final_request_params + def remove_cache_control_flag_from_input_and_tools( + self, + model: str, # allows overrides to selectively run this + input: Union[str, ResponseInputParam], + tools: Optional[List[ALL_RESPONSES_API_TOOL_PARAMS]] = None, + ) -> Tuple[ + Union[str, ResponseInputParam], + Optional[List[ALL_RESPONSES_API_TOOL_PARAMS]], + ]: + """Sibling of `remove_cache_control_flag_from_messages_and_tools` on + the chat path. Strips Anthropic-only `cache_control` markers from + Responses API input content blocks and tools. + + `filter_value_from_dict` mutates each dict in place, so the same + objects are returned. + """ + from litellm.litellm_core_utils.prompt_templates.common_utils import ( + filter_value_from_dict, + ) + + if isinstance(input, list): + for item in input: + if isinstance(item, dict): + filter_value_from_dict(cast(dict, item), "cache_control") + + if tools is not None: + for tool in tools: + if isinstance(tool, dict): + filter_value_from_dict(cast(dict, tool), "cache_control") + + return input, tools + def _validate_input_param( self, input: Union[str, ResponseInputParam] ) -> Union[str, ResponseInputParam]: @@ -604,6 +648,12 @@ class OpenAIResponsesAPIConfig(BaseResponsesAPIConfig): url = str(parsed_url.copy_with(path=compact_path)) input = self._validate_input_param(input) + tools = response_api_optional_request_params.get("tools") + input, tools = self.remove_cache_control_flag_from_input_and_tools( + model=model, input=input, tools=tools + ) + if tools is not None: + response_api_optional_request_params["tools"] = tools data = dict( ResponsesAPIRequestParams( model=model, input=input, **response_api_optional_request_params diff --git a/litellm/llms/openrouter/image_generation/transformation.py b/litellm/llms/openrouter/image_generation/transformation.py index a55716a5e50..9c2293eb3f1 100644 --- a/litellm/llms/openrouter/image_generation/transformation.py +++ b/litellm/llms/openrouter/image_generation/transformation.py @@ -49,7 +49,6 @@ from litellm.types.utils import ( ) from litellm.llms.openrouter.common_utils import OpenRouterException - if TYPE_CHECKING: from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj else: diff --git a/litellm/llms/ovhcloud/audio_transcription/transformation.py b/litellm/llms/ovhcloud/audio_transcription/transformation.py index 7ff6dc986be..f49f31d7ecd 100644 --- a/litellm/llms/ovhcloud/audio_transcription/transformation.py +++ b/litellm/llms/ovhcloud/audio_transcription/transformation.py @@ -156,5 +156,17 @@ class OVHCloudAudioTranscriptionConfig(BaseAudioTranscriptionConfig): text = response_json.get("text") or response_json.get("transcript") or "" response = TranscriptionResponse(text=text) + # OVHCloud field migration (deadline: 2026-05-11): + # `duration` is replaced by `seconds` in STT responses. + # Prefer `seconds`, fall back to `duration`, normalize to `duration` + # so downstream consumers see a consistent key. + duration = ( + response_json["seconds"] + if "seconds" in response_json and response_json["seconds"] is not None + else response_json.get("duration") + ) + if duration is not None: + response_json["duration"] = duration + response._hidden_params = response_json return response diff --git a/litellm/llms/ovhcloud/chat/transformation.py b/litellm/llms/ovhcloud/chat/transformation.py index ae9271ddb16..62f51f1e9da 100644 --- a/litellm/llms/ovhcloud/chat/transformation.py +++ b/litellm/llms/ovhcloud/chat/transformation.py @@ -13,6 +13,7 @@ from litellm.llms.openai.chat.gpt_transformation import OpenAIGPTConfig from litellm.llms.ovhcloud.utils import OVHCloudException from litellm.llms.base_llm.base_model_iterator import BaseModelResponseIterator from litellm.llms.base_llm.chat.transformation import BaseLLMException + from litellm.types.llms.openai import AllMessageValues @@ -98,10 +99,16 @@ class OVHCloudChatCompletionStreamingHandler(BaseModelResponseIterator): new_choices = [] for choice in chunk["choices"]: - if "delta" in choice and "reasoning" in choice["delta"]: - choice["delta"]["reasoning_content"] = choice["delta"].get( - "reasoning" - ) + if "delta" in choice: + delta = choice["delta"] + # OVHCloud field migration (deadline: 2026-05-11): + # `reasoning_content` is replaced by `reasoning`. + # Normalise to `reasoning_content` so downstream consumers + # see a consistent key during the transition window. + reasoning_new = delta.get("reasoning") + reasoning_legacy = delta.get("reasoning_content") + if reasoning_new is not None and reasoning_legacy is None: + delta["reasoning_content"] = reasoning_new new_choices.append(choice) return ModelResponseStream( diff --git a/litellm/llms/reducto/__init__.py b/litellm/llms/reducto/__init__.py new file mode 100644 index 00000000000..8b137891791 --- /dev/null +++ b/litellm/llms/reducto/__init__.py @@ -0,0 +1 @@ + diff --git a/litellm/llms/reducto/common.py b/litellm/llms/reducto/common.py new file mode 100644 index 00000000000..4e7d96dbe87 --- /dev/null +++ b/litellm/llms/reducto/common.py @@ -0,0 +1,159 @@ +import base64 +import binascii +from collections import defaultdict +from typing import TYPE_CHECKING, Any, Dict, List, NoReturn, Optional, Tuple + +from litellm.constants import request_timeout + +REDUCTO_API_BASE = "https://platform.reducto.ai" +REDUCTO_ID_PREFIX = "reducto://" + +if TYPE_CHECKING: + from litellm.llms.base_llm.ocr.transformation import OCRPage + + +def _normalize_api_base(api_base: Optional[str]) -> str: + return (api_base or REDUCTO_API_BASE).rstrip("/") + + +def _raise_bad_request(message: str, model: str) -> NoReturn: + import litellm + + raise litellm.BadRequestError( + message=message, + model=model, + llm_provider="reducto", + ) + + +def extract_file_id_or_bytes( + source_url: str, + model: str, +) -> Tuple[Optional[str], Optional[bytes], Optional[str]]: + if source_url.startswith(REDUCTO_ID_PREFIX): + return source_url, None, None + + if source_url.startswith("http://") or source_url.startswith("https://"): + _raise_bad_request( + "Reducto requires type='file' (auto-uploaded) or a reducto:// id. Plain http(s) URLs are not supported; upload the file first.", + model=model, + ) + + if not source_url.startswith("data:"): + _raise_bad_request( + "Reducto requires a reducto:// id or a base64 data URI after OCR preprocessing.", + model=model, + ) + + try: + header, encoded = source_url.split(",", 1) + except ValueError: + _raise_bad_request("Invalid Reducto data URI provided.", model=model) + + if ";base64" not in header: + _raise_bad_request( + "Reducto only supports base64-encoded data URIs.", model=model + ) + + mime = header.removeprefix("data:").split(";")[0] or "application/octet-stream" + try: + raw_bytes = base64.b64decode(encoded, validate=True) + except (binascii.Error, ValueError): + _raise_bad_request("Invalid Reducto base64 payload provided.", model=model) + + return None, raw_bytes, mime + + +def _extract_file_id_from_upload_response(response: Any) -> str: + try: + payload = response.json() + except ValueError as exc: + raise ValueError( + "Reducto /upload returned a non-JSON 200 response: {}".format(response.text) + ) from exc + file_id = (payload or {}).get("file_id") if isinstance(payload, dict) else None + if not isinstance(file_id, str) or not file_id: + raise ValueError( + "Reducto /upload returned 200 without a file_id; got payload={}".format( + payload + ) + ) + return file_id + + +def upload_bytes_sync( + raw_bytes: bytes, + mime: Optional[str], + api_key: str, + api_base: Optional[str], +) -> str: + import litellm + + response = litellm.module_level_client.post( + url="{}{}".format(_normalize_api_base(api_base), "/upload"), + headers={"Authorization": f"Bearer {api_key}"}, + files={"file": ("document", raw_bytes, mime or "application/octet-stream")}, + timeout=request_timeout, + ) + response.raise_for_status() + return _extract_file_id_from_upload_response(response) + + +async def upload_bytes_async( + raw_bytes: bytes, + mime: Optional[str], + api_key: str, + api_base: Optional[str], +) -> str: + import litellm + + response = await litellm.module_level_aclient.post( + url="{}{}".format(_normalize_api_base(api_base), "/upload"), + headers={"Authorization": f"Bearer {api_key}"}, + files={"file": ("document", raw_bytes, mime or "application/octet-stream")}, + timeout=request_timeout, + ) + response.raise_for_status() + return _extract_file_id_from_upload_response(response) + + +def build_pages_from_reducto(result: Dict[str, Any]) -> List["OCRPage"]: + from litellm.llms.base_llm.ocr.transformation import OCRPage + + chunks = result.get("chunks", []) or [] + blocks_by_page: Dict[int, List[Dict[str, Any]]] = defaultdict(list) + + for chunk in chunks: + for block in chunk.get("blocks", []) or []: + page_no = (block.get("bbox") or {}).get("page") + if page_no is None: + continue + try: + normalized_page = int(page_no) + except (TypeError, ValueError): + continue + blocks_by_page[normalized_page].append(block) + + if not blocks_by_page: + fallback_markdown = "\n\n".join( + chunk.get("content", "") for chunk in chunks if chunk.get("content") + ) + if fallback_markdown == "": + return [] + return [OCRPage(index=0, markdown=fallback_markdown)] + + pages: List["OCRPage"] = [] + for page_no, blocks in sorted(blocks_by_page.items()): + markdown = "\n\n".join( + block.get("content", "") for block in blocks if block.get("content") + ) + page_index = max(page_no - 1, 0) + page = OCRPage( + index=page_index, + markdown=markdown, + ) + # OCRPage accepts extra keys at runtime; assign blocks after construction + # so static typing does not reject provider-specific metadata. + setattr(page, "blocks", blocks) + pages.append(page) + return pages diff --git a/litellm/llms/reducto/ocr/__init__.py b/litellm/llms/reducto/ocr/__init__.py new file mode 100644 index 00000000000..8b137891791 --- /dev/null +++ b/litellm/llms/reducto/ocr/__init__.py @@ -0,0 +1 @@ + diff --git a/litellm/llms/reducto/ocr/transformation.py b/litellm/llms/reducto/ocr/transformation.py new file mode 100644 index 00000000000..cc338ecc484 --- /dev/null +++ b/litellm/llms/reducto/ocr/transformation.py @@ -0,0 +1,241 @@ +from typing import Any, Dict, Optional, Tuple + +import httpx + +from litellm.llms.base_llm.ocr.transformation import ( + BaseOCRConfig, + DocumentType, + OCRRequestData, + OCRResponse, + OCRUsageInfo, +) +from litellm.llms.reducto.common import ( + REDUCTO_API_BASE, + build_pages_from_reducto, + extract_file_id_or_bytes, + upload_bytes_async, + upload_bytes_sync, +) + + +class _BaseReductoOCRConfig(BaseOCRConfig): + def map_ocr_params( + self, + non_default_params: dict, + optional_params: dict, + model: str, + ) -> dict: + mapped_params = dict(optional_params) + supported_params = self.get_supported_ocr_params(model=model) + for param, value in non_default_params.items(): + if param in supported_params: + mapped_params[param] = value + return mapped_params + + def validate_environment( + self, + headers: Dict, + model: str, + api_key: Optional[str] = None, + api_base: Optional[str] = None, + litellm_params: Optional[dict] = None, + **kwargs, + ) -> Dict: + from litellm.secret_managers.main import get_secret_str + + resolved_key = api_key or get_secret_str("REDUCTO_API_KEY") + if resolved_key is None: + raise ValueError( + "Missing REDUCTO_API_KEY - set it in the environment or pass api_key to litellm.ocr()/litellm.aocr()" + ) + + return { + "Authorization": f"Bearer {resolved_key}", + "Content-Type": "application/json", + **headers, + } + + def get_complete_url( + self, + api_base: Optional[str], + model: str, + optional_params: dict, + litellm_params: Optional[dict] = None, + **kwargs, + ) -> str: + return "{}/parse".format((api_base or REDUCTO_API_BASE).rstrip("/")) + + def _get_source_url(self, document: DocumentType, model: str) -> str: + source_url = document.get("document_url") or document.get("image_url") + if source_url is None: + raise ValueError( + "Reducto expected OCR preprocessing to produce document_url or image_url for model={}".format( + model + ) + ) + return source_url + + @staticmethod + def _resolve_credentials( + api_key: Optional[str], api_base: Optional[str] + ) -> Tuple[str, str]: + from litellm.secret_managers.main import get_secret_str + + resolved_key = api_key or get_secret_str("REDUCTO_API_KEY") + if resolved_key is None: + raise ValueError( + "Missing REDUCTO_API_KEY - set it in the environment or pass api_key to litellm.ocr()/litellm.aocr()" + ) + resolved_base = (api_base or REDUCTO_API_BASE).rstrip("/") + return resolved_key, resolved_base + + def _ensure_file_id_sync( + self, + model: str, + document: DocumentType, + api_key: Optional[str], + api_base: Optional[str], + ) -> str: + source_url = self._get_source_url(document=document, model=model) + file_id, raw_bytes, mime = extract_file_id_or_bytes(source_url, model=model) + if file_id is not None: + return file_id + resolved_key, resolved_base = self._resolve_credentials(api_key, api_base) + return upload_bytes_sync( + raw_bytes=raw_bytes or b"", + mime=mime, + api_key=resolved_key, + api_base=resolved_base, + ) + + async def _ensure_file_id_async( + self, + model: str, + document: DocumentType, + api_key: Optional[str], + api_base: Optional[str], + ) -> str: + source_url = self._get_source_url(document=document, model=model) + file_id, raw_bytes, mime = extract_file_id_or_bytes(source_url, model=model) + if file_id is not None: + return file_id + resolved_key, resolved_base = self._resolve_credentials(api_key, api_base) + return await upload_bytes_async( + raw_bytes=raw_bytes or b"", + mime=mime, + api_key=resolved_key, + api_base=resolved_base, + ) + + def transform_ocr_response( + self, + model: str, + raw_response: httpx.Response, + logging_obj: Any, + **kwargs, + ) -> OCRResponse: + response_json = raw_response.json() + result = response_json.get("result", response_json) or {} + usage = response_json.get("usage", {}) or {} + response = OCRResponse( + pages=build_pages_from_reducto(result), + model=model, + usage_info=OCRUsageInfo( + pages_processed=usage.get("num_pages"), + credits=usage.get("credits"), + ), + object="ocr", + ) + response._hidden_params["reducto_raw"] = response_json + return response + + +class ReductoParseV3Config(_BaseReductoOCRConfig): + def get_supported_ocr_params(self, model: str) -> list: + return ["formatting", "retrieval", "settings"] + + def transform_ocr_request( + self, + model: str, + document: DocumentType, + optional_params: dict, + headers: dict, + **kwargs, + ) -> OCRRequestData: + file_id = self._ensure_file_id_sync( + model=model, + document=document, + api_key=kwargs.get("api_key"), + api_base=kwargs.get("api_base"), + ) + return OCRRequestData(data={"input": file_id, **optional_params}, files=None) + + async def async_transform_ocr_request( + self, + model: str, + document: DocumentType, + optional_params: dict, + headers: dict, + **kwargs, + ) -> OCRRequestData: + file_id = await self._ensure_file_id_async( + model=model, + document=document, + api_key=kwargs.get("api_key"), + api_base=kwargs.get("api_base"), + ) + return OCRRequestData(data={"input": file_id, **optional_params}, files=None) + + +class ReductoParseLegacyConfig(_BaseReductoOCRConfig): + def get_supported_ocr_params(self, model: str) -> list: + return ["enhance"] + + def _build_legacy_body(self, file_id: str, optional_params: dict) -> Dict[str, Any]: + body: Dict[str, Any] = {"document_url": file_id} + enhance = optional_params.get("enhance") + if enhance is not None: + body["options"] = {"enhance": enhance} + return body + + def transform_ocr_request( + self, + model: str, + document: DocumentType, + optional_params: dict, + headers: dict, + **kwargs, + ) -> OCRRequestData: + file_id = self._ensure_file_id_sync( + model=model, + document=document, + api_key=kwargs.get("api_key"), + api_base=kwargs.get("api_base"), + ) + return OCRRequestData( + data=self._build_legacy_body( + file_id=file_id, optional_params=optional_params + ), + files=None, + ) + + async def async_transform_ocr_request( + self, + model: str, + document: DocumentType, + optional_params: dict, + headers: dict, + **kwargs, + ) -> OCRRequestData: + file_id = await self._ensure_file_id_async( + model=model, + document=document, + api_key=kwargs.get("api_key"), + api_base=kwargs.get("api_base"), + ) + return OCRRequestData( + data=self._build_legacy_body( + file_id=file_id, optional_params=optional_params + ), + files=None, + ) diff --git a/litellm/llms/sagemaker/common_utils.py b/litellm/llms/sagemaker/common_utils.py index 50c8ee4220e..6c15d642f8c 100644 --- a/litellm/llms/sagemaker/common_utils.py +++ b/litellm/llms/sagemaker/common_utils.py @@ -1,3 +1,4 @@ +import functools import json from typing import AsyncIterator, Iterator, List, Optional, Union @@ -22,14 +23,22 @@ def _load_sagemaker_response_stream_shape(): ) except Exception as e: verbose_logger.warning( - "litellm: could not pre-load sagemaker-runtime response stream shape " + "litellm: could not load sagemaker-runtime response stream shape " "— SageMaker event-stream decoding will be unavailable. Error: %s", e, ) return None -SAGEMAKER_RESPONSE_STREAM_SHAPE = _load_sagemaker_response_stream_shape() +@functools.lru_cache(maxsize=1) +def get_sagemaker_response_stream_shape(): + """ + Lazily load and cache the sagemaker-runtime stream shape for the process. + + Avoids importing botocore (and logging warnings) unless SageMaker event-stream + decoding is actually needed. + """ + return _load_sagemaker_response_stream_shape() class SagemakerError(BaseLLMException): @@ -207,7 +216,8 @@ class AWSEventStreamDecoder: verbose_logger.error(f"Final error parsing accumulated JSON: {e}") def _parse_message_from_event(self, event) -> Optional[str]: - if SAGEMAKER_RESPONSE_STREAM_SHAPE is None: + response_stream_shape = get_sagemaker_response_stream_shape() + if response_stream_shape is None: raise SagemakerError( status_code=500, message=( @@ -216,9 +226,7 @@ class AWSEventStreamDecoder: ), ) response_dict = event.to_response_dict() - parsed_response = self.parser.parse( - response_dict, SAGEMAKER_RESPONSE_STREAM_SHAPE - ) + parsed_response = self.parser.parse(response_dict, response_stream_shape) if response_dict["status_code"] != 200: raise ValueError(f"Bad response code, expected 200: {response_dict}") diff --git a/litellm/llms/sagemaker/completion/handler.py b/litellm/llms/sagemaker/completion/handler.py index efbb218f575..de7be18e8ba 100644 --- a/litellm/llms/sagemaker/completion/handler.py +++ b/litellm/llms/sagemaker/completion/handler.py @@ -578,7 +578,7 @@ class SagemakerLLM(BaseAWSLLM): logger_fn=None, ): """ - Supports both Huggingface Jumpstart embeddings and Voyage models + Supports Hugging Face (TGI), Voyage, and Cohere embedding endpoints """ ### BOTO3 INIT import boto3 diff --git a/litellm/llms/sagemaker/completion/transformation.py b/litellm/llms/sagemaker/completion/transformation.py index 3e4e2460cdb..8fd32bc4460 100644 --- a/litellm/llms/sagemaker/completion/transformation.py +++ b/litellm/llms/sagemaker/completion/transformation.py @@ -1,7 +1,7 @@ """ Translate from OpenAI's `/v1/chat/completions` to Sagemaker's `/invoke` -In the Huggingface TGI format. +In the Huggingface TGI format. """ import json diff --git a/litellm/llms/sagemaker/embedding/cohere_transformation.py b/litellm/llms/sagemaker/embedding/cohere_transformation.py new file mode 100644 index 00000000000..fdb67202ebb --- /dev/null +++ b/litellm/llms/sagemaker/embedding/cohere_transformation.py @@ -0,0 +1,141 @@ +""" +Translate from OpenAI's `/v1/embeddings` to Sagemaker's `/invoke` + +In the native Cohere embed format for self-hosted Cohere endpoints +(AWS Marketplace / JumpStart). Cohere containers expect +`{"texts": [...], "input_type": "..."}` and reject the HuggingFace TGI shape +`{"inputs": [...]}` with `422 EmbedReqV2.inputs is of type string but should +be of type Object`. + +Reference: https://docs.cohere.com/v2/reference/embed +""" + +from typing import TYPE_CHECKING, Any, List, Optional, Union, cast + +if TYPE_CHECKING: + from litellm.types.llms.openai import AllEmbeddingInputValues + +from httpx._models import Headers, Response + +import litellm +from litellm.llms.base_llm.chat.transformation import BaseLLMException +from litellm.llms.base_llm.embedding.transformation import BaseEmbeddingConfig +from litellm.llms.bedrock.embed.cohere_transformation import ( + BedrockCohereEmbeddingConfig, +) +from litellm.llms.cohere.embed.v1_transformation import CohereEmbeddingConfig +from litellm.types.utils import EmbeddingResponse + +from ..common_utils import SagemakerError + + +class SagemakerCohereEmbeddingConfig(BaseEmbeddingConfig): + """ + SageMaker invoke payload for self-hosted Cohere embed models. + """ + + def __init__(self) -> None: + pass + + def get_supported_openai_params(self, model: str) -> List[str]: + return ["encoding_format", "dimensions", "input_type"] + + def map_openai_params( + self, + non_default_params: dict, + optional_params: dict, + model: str, + drop_params: bool, + ) -> dict: + optional_params = BedrockCohereEmbeddingConfig().map_openai_params( + non_default_params=non_default_params, + optional_params=optional_params, + ) + if "input_type" in non_default_params: + optional_params["input_type"] = non_default_params["input_type"] + return optional_params + + def get_error_class( + self, error_message: str, status_code: int, headers: Union[dict, Headers] + ) -> BaseLLMException: + return SagemakerError( + message=error_message, status_code=status_code, headers=headers + ) + + def transform_embedding_request( + self, + model: str, + input: "AllEmbeddingInputValues", + optional_params: dict, + headers: dict, + ) -> dict: + """ + Transform embedding request for Cohere models on SageMaker + """ + if isinstance(input, str): + input_list: List[str] = [input] + elif isinstance(input, list): + if input and (isinstance(input[0], list) or isinstance(input[0], int)): + raise ValueError("Input must be a list of strings") + input_list = cast(List[str], input) + else: + input_list = [str(input)] + + return dict( + BedrockCohereEmbeddingConfig()._transform_request( + model=model, + input=input_list, + inference_params=optional_params, + ) + ) + + def transform_embedding_response( + self, + model: str, + raw_response: Response, + model_response: "EmbeddingResponse", + logging_obj: Any, + api_key: Optional[str] = None, + request_data: dict = {}, + optional_params: dict = {}, + litellm_params: dict = {}, + ) -> "EmbeddingResponse": + """ + Transform embedding response for Cohere models on SageMaker. + + Uses `CohereEmbeddingConfig._populate_embedding_response` (not + `_transform_response`) so we do not log `post_call` a second time + — the SageMaker embedding handler already logs `post_call` before + invoking this transform. + """ + input_value = ( + logging_obj.model_call_details.get("input") + or request_data.get("texts") + or request_data.get("images") + or [] + ) + if isinstance(input_value, str): + input_value = [input_value] + + return CohereEmbeddingConfig()._populate_embedding_response( + response_json=raw_response.json(), + model_response=model_response, + model=model, + encoding=litellm.encoding, + input=input_value, + ) + + def validate_environment( + self, + headers: dict, + model: str, + messages: List[Any], + optional_params: dict, + litellm_params: dict, + api_key: Optional[str] = None, + api_base: Optional[str] = None, + ) -> dict: + """ + Validate environment for SageMaker Cohere embeddings + """ + return {"Content-Type": "application/json"} diff --git a/litellm/llms/sagemaker/embedding/transformation.py b/litellm/llms/sagemaker/embedding/transformation.py index 04430171187..5e2aa99534f 100644 --- a/litellm/llms/sagemaker/embedding/transformation.py +++ b/litellm/llms/sagemaker/embedding/transformation.py @@ -1,7 +1,7 @@ """ Translate from OpenAI's `/v1/embeddings` to Sagemaker's `/invoke` -In the Huggingface TGI format. +In the Huggingface TGI format. """ from typing import TYPE_CHECKING, Any, List, Optional, Union @@ -11,12 +11,13 @@ if TYPE_CHECKING: from httpx._models import Headers, Response -from litellm.llms.base_llm.embedding.transformation import BaseEmbeddingConfig from litellm.llms.base_llm.chat.transformation import BaseLLMException -from litellm.types.utils import Usage, EmbeddingResponse +from litellm.llms.base_llm.embedding.transformation import BaseEmbeddingConfig from litellm.llms.voyage.embedding.transformation import VoyageEmbeddingConfig +from litellm.types.utils import EmbeddingResponse, Usage from ..common_utils import SagemakerError +from .cohere_transformation import SagemakerCohereEmbeddingConfig class SagemakerEmbeddingConfig(BaseEmbeddingConfig): @@ -38,17 +39,20 @@ class SagemakerEmbeddingConfig(BaseEmbeddingConfig): Returns: Appropriate embedding config instance """ - if "voyage" in model.lower(): + model_lower = model.lower() + if "voyage" in model_lower: return VoyageEmbeddingConfig() - else: - return cls() + if "cohere" in model_lower: + return SagemakerCohereEmbeddingConfig() + return cls() def get_supported_openai_params(self, model: str) -> List[str]: - # Check if this is an embedding model - if "voyage" in model.lower(): + model_lower = model.lower() + if "voyage" in model_lower: return VoyageEmbeddingConfig().get_supported_openai_params(model) - else: - return [] + if "cohere" in model_lower: + return SagemakerCohereEmbeddingConfig().get_supported_openai_params(model) + return [] def map_openai_params( self, diff --git a/litellm/llms/sap/credentials.py b/litellm/llms/sap/credentials.py index 0ae351783e8..dd307ddf496 100644 --- a/litellm/llms/sap/credentials.py +++ b/litellm/llms/sap/credentials.py @@ -207,7 +207,7 @@ def resolve_resource_group(sources: List[Source]) -> Optional[str]: def _parse_service_key_once( - service_key: Optional[Union[str, dict]] + service_key: Optional[Union[str, dict]], ) -> Optional[Dict[str, Any]]: """ Pre-parse service_key if it's a string to avoid repeated JSON parsing. diff --git a/litellm/llms/snowflake/chat/transformation.py b/litellm/llms/snowflake/chat/transformation.py index 3e590680a75..23bb6f44757 100644 --- a/litellm/llms/snowflake/chat/transformation.py +++ b/litellm/llms/snowflake/chat/transformation.py @@ -14,7 +14,6 @@ from ...openai_like.chat.transformation import OpenAIGPTConfig from ..utils import SnowflakeBaseConfig - if TYPE_CHECKING: from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj diff --git a/litellm/llms/together_ai/chat.py b/litellm/llms/together_ai/chat.py index 7efb12fc1b2..238849cc1ec 100644 --- a/litellm/llms/together_ai/chat.py +++ b/litellm/llms/together_ai/chat.py @@ -1,5 +1,5 @@ """ -Support for OpenAI's `/v1/chat/completions` endpoint. +Support for OpenAI's `/v1/chat/completions` endpoint. Calls done in OpenAI/openai.py as TogetherAI is openai-compatible. diff --git a/litellm/llms/together_ai/embed.py b/litellm/llms/together_ai/embed.py index 577df0256cc..6a39b94acfc 100644 --- a/litellm/llms/together_ai/embed.py +++ b/litellm/llms/together_ai/embed.py @@ -1,5 +1,5 @@ """ -Support for OpenAI's `/v1/embeddings` endpoint. +Support for OpenAI's `/v1/embeddings` endpoint. Calls done in OpenAI/openai.py as TogetherAI is openai-compatible. diff --git a/litellm/llms/together_ai/rerank/transformation.py b/litellm/llms/together_ai/rerank/transformation.py index 63b593dfe42..f4d642bd25a 100644 --- a/litellm/llms/together_ai/rerank/transformation.py +++ b/litellm/llms/together_ai/rerank/transformation.py @@ -1,5 +1,5 @@ """ -Transformation logic from Cohere's /v1/rerank format to Together AI's `/v1/rerank` format. +Transformation logic from Cohere's /v1/rerank format to Together AI's `/v1/rerank` format. Why separate file? Make it easy to see how transformation works """ diff --git a/litellm/llms/vertex_ai/context_caching/transformation.py b/litellm/llms/vertex_ai/context_caching/transformation.py index 950edbeb478..f73eb220cc6 100644 --- a/litellm/llms/vertex_ai/context_caching/transformation.py +++ b/litellm/llms/vertex_ai/context_caching/transformation.py @@ -1,5 +1,5 @@ """ -Transformation logic for context caching. +Transformation logic for context caching. Why separate file? Make it easy to see how transformation works """ @@ -19,7 +19,7 @@ from ..gemini.transformation import ( def get_first_continuous_block_idx( - filtered_messages: List[Tuple[int, AllMessageValues]] # (idx, message) + filtered_messages: List[Tuple[int, AllMessageValues]], # (idx, message) ) -> int: """ Find the array index that ends the first continuous sequence of message blocks. @@ -174,7 +174,9 @@ def transform_openai_messages_to_gemini_context_caching( ) transformed_messages = _gemini_convert_messages_with_history( - messages=new_messages, model=model + messages=new_messages, + model=model, + custom_llm_provider=custom_llm_provider, ) model_name = "models/{}".format(model) diff --git a/litellm/llms/vertex_ai/context_caching/vertex_ai_context_caching.py b/litellm/llms/vertex_ai/context_caching/vertex_ai_context_caching.py index ac0f07b8e0b..3f945adca0d 100644 --- a/litellm/llms/vertex_ai/context_caching/vertex_ai_context_caching.py +++ b/litellm/llms/vertex_ai/context_caching/vertex_ai_context_caching.py @@ -41,7 +41,7 @@ class ContextCachingEndpoints(VertexBase): """ def __init__(self) -> None: - pass + super().__init__() def _get_token_and_url_context_caching( self, diff --git a/litellm/llms/vertex_ai/gemini/transformation.py b/litellm/llms/vertex_ai/gemini/transformation.py index 9afa5dec465..4f5846cc5b6 100644 --- a/litellm/llms/vertex_ai/gemini/transformation.py +++ b/litellm/llms/vertex_ai/gemini/transformation.py @@ -6,13 +6,16 @@ Why separate file? Make it easy to see how transformation works import json import os -from typing import TYPE_CHECKING, Dict, List, Literal, Optional, Tuple, Union, cast +import re +from typing import TYPE_CHECKING, Any, Dict, List, Literal, Optional, Tuple, Union, cast +from urllib.parse import quote import httpx from pydantic import BaseModel import litellm from litellm._logging import verbose_logger +from litellm.litellm_core_utils.asyncify import asyncify from litellm.litellm_core_utils.prompt_templates.common_utils import ( _get_image_mime_type_from_url, ) @@ -57,6 +60,45 @@ from ..common_utils import ( get_supports_system_message, ) +# Typed as Any to avoid introducing a module-load-time cyclic import to +# vertex_llm_base. The instance is lazily constructed by _get_vertex_base() +# the first time GCS metadata needs to be fetched. +_GCS_METADATA_VERTEX_BASE: Optional[Any] = None +# Shared sync client for GCS JSON API metadata reads so proxy/SSL settings +# from litellm's HTTP stack apply (see Greptile review on PR #27278). +_GCS_METADATA_HTTP_HANDLER: Optional[HTTPHandler] = None +_GEMINI_MIME_TYPE_ALIASES: Dict[str, str] = { + "image/jpg": "image/jpeg", +} + + +def _apply_gemini_mime_type_aliases(mime_type: str) -> str: + """Normalize known MIME aliases only; does not consult the file-type registry. + + Also strips MIME parameters (e.g. ``; charset=utf-8``) so that values + sourced from GCS object metadata (``contentType``) validate correctly. + """ + normalized = mime_type.split(";", 1)[0].strip().lower() + return _GEMINI_MIME_TYPE_ALIASES.get(normalized, normalized) + + +def _get_vertex_base() -> Any: + """Lazily return the shared VertexBase instance to avoid a module-load-time cyclic import.""" + global _GCS_METADATA_VERTEX_BASE + if _GCS_METADATA_VERTEX_BASE is None: + from ..vertex_llm_base import VertexBase + + _GCS_METADATA_VERTEX_BASE = VertexBase() + return _GCS_METADATA_VERTEX_BASE + + +def _get_gcs_metadata_http_handler() -> HTTPHandler: + global _GCS_METADATA_HTTP_HANDLER + if _GCS_METADATA_HTTP_HANDLER is None: + _GCS_METADATA_HTTP_HANDLER = HTTPHandler(timeout=5.0) + return _GCS_METADATA_HTTP_HANDLER + + if TYPE_CHECKING: from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj @@ -171,12 +213,299 @@ def _apply_gemini_metadata( return cast(PartType, part_dict) +def _parse_gs_uri(gs_uri: str) -> Tuple[str, str]: + if not gs_uri.startswith("gs://"): + raise ValueError(f"Invalid gs URI: {gs_uri}") + uri_without_scheme = gs_uri[5:] # drop gs:// + uri_parts = uri_without_scheme.split("/", 1) + if len(uri_parts) != 2 or not uri_parts[0] or not uri_parts[1]: + raise ValueError(f"Invalid gs URI: {gs_uri}") + return uri_parts[0], uri_parts[1] + + +def _is_valid_gcs_bucket_name(bucket: str) -> bool: + """ + Validate bucket name against core GCS naming constraints. + """ + bucket_length = len(bucket) + max_bucket_length = 222 if "." in bucket else 63 + if bucket_length < 3 or bucket_length > max_bucket_length: + return False + if "." in bucket and any( + len(label) == 0 or len(label) > 63 for label in bucket.split(".") + ): + return False + if not re.fullmatch(r"[a-z0-9][a-z0-9._-]*[a-z0-9]", bucket): + return False + if ".." in bucket: + return False + if re.fullmatch(r"\d+\.\d+\.\d+\.\d+", bucket): + return False + return True + + +def _gs_uri_requires_content_type_metadata(url: str) -> bool: + """ + True when _process_gemini_media would call _get_gcs_object_content_type + (extension-less gs:// and no explicit format passed into that helper). + """ + if "gs://" not in url: + return False + extension_with_dot = os.path.splitext(url)[-1] + extension = extension_with_dot[1:] if extension_with_dot else "" + return len(extension) == 0 + + +def _image_url_payload_may_need_sync_gcs_metadata_fetch( + raw_image_url: Any, +) -> bool: + """ + True when this image_url value (content-part image_url or assistant ``images[]`` + entry) can trigger a blocking GCS metadata read for MIME resolution. + """ + fmt: Optional[str] = None + url: Optional[str] = None + if isinstance(raw_image_url, dict): + url = raw_image_url.get("url") # type: ignore[assignment] + if not isinstance(url, str): + return False + fmt = ( + raw_image_url.get("format") + or raw_image_url.get("mime_type") + or raw_image_url.get("content_type") + ) + elif isinstance(raw_image_url, str): + url = raw_image_url + else: + return False + if "gs://" not in url or fmt: + return False + return _gs_uri_requires_content_type_metadata(url) + + +def _openai_messages_may_need_sync_gcs_metadata_fetch( + messages: List[AllMessageValues], +) -> bool: + """ + Heuristic: True if any message part can trigger a blocking GCS JSON + metadata read inside _transform_request_body (extension-less gs:// without + explicit MIME hints). Covers user/system ``content`` parts and assistant + ``images`` (same paths as ``_gemini_convert_messages_with_history``). Used + to decide whether ``async_transform_request_body`` should offload the sync + transform via ``asyncify``. + """ + for raw in messages: + msg: Any = raw + if not isinstance(msg, dict) and hasattr(msg, "model_dump"): + msg = msg.model_dump(exclude_none=False) + if not isinstance(msg, dict): + continue + images_field = msg.get("images") + if isinstance(images_field, list): + for image_item in images_field: + if not isinstance(image_item, dict): + continue + if _image_url_payload_may_need_sync_gcs_metadata_fetch( + image_item.get("image_url") + ): + return True + + content = msg.get("content") + if not isinstance(content, list): + continue + for item in content: + if not isinstance(item, dict): + continue + itype = item.get("type") + if itype == "image_url": + if _image_url_payload_may_need_sync_gcs_metadata_fetch( + item.get("image_url") + ): + return True + elif itype == "file": + file_obj = item.get("file") + if not isinstance(file_obj, dict): + continue + fmt = ( + file_obj.get("format") + or file_obj.get("mime_type") + or file_obj.get("content_type") + ) + passed = file_obj.get("file_id") or file_obj.get("file_data") + if ( + isinstance(passed, str) + and "gs://" in passed + and not fmt + and _gs_uri_requires_content_type_metadata(passed) + ): + return True + return False + + +def _get_gcs_object_content_type( + image_url: str, + vertex_project: Optional[str] = None, + vertex_credentials: Optional[Any] = None, +) -> Optional[str]: + """ + Resolve content type from GCS object metadata. + + Only attaches a Bearer token when the caller explicitly supplies Vertex + credentials, to avoid using the server's default Google credentials on + the Gemini API-key (Google AI Studio) path and being used as an oracle + for private GCS object metadata. Without explicit credentials we only + issue an anonymous request, which only succeeds for publicly-readable + objects. + """ + try: + bucket, object_name = _parse_gs_uri(image_url) + except ValueError: + return None + if not _is_valid_gcs_bucket_name(bucket): + return None + + headers: Dict[str, str] = {} + explicit_vertex_auth_provided = ( + vertex_project is not None or vertex_credentials is not None + ) + if explicit_vertex_auth_provided: + try: + access_token, _ = _get_vertex_base().get_access_token( + credentials=vertex_credentials, + project_id=vertex_project, + ) + headers["Authorization"] = f"Bearer {access_token}" + except Exception as e: + raise litellm.BadRequestError( + message=( + "Unable to fetch GCS metadata with provided Vertex credentials/project. " + f"Original error: {str(e)}" + ), + model=None, + llm_provider="vertex_ai", + ) + + # Build the URL via httpx.URL with a fixed scheme/host and URL-encode both + # bucket and object so CodeQL does not flag the interpolation as a + # potential SSRF that could resolve to an arbitrary host. + encoded_bucket = quote(bucket, safe="") + encoded_object = quote(object_name, safe="") + metadata_url = httpx.URL( + scheme="https", + host="storage.googleapis.com", + path=f"/storage/v1/b/{encoded_bucket}/o/{encoded_object}", + params={"fields": "contentType"}, + ) + try: + response = _get_gcs_metadata_http_handler().get( + url=str(metadata_url), + headers=headers or None, + ) + except httpx.RequestError as e: + if explicit_vertex_auth_provided: + raise litellm.BadRequestError( + message=( + "Unable to reach GCS JSON API for object metadata with provided " + f"Vertex credentials. {type(e).__name__}: {e}" + ), + model=None, + llm_provider="vertex_ai", + ) from e + return None + + if response.is_error: + if explicit_vertex_auth_provided: + preview = (response.text or "")[:1024] + raise litellm.BadRequestError( + message=( + "Unable to read GCS object metadata with provided Vertex credentials. " + f"HTTP {response.status_code}. Response body (truncated): {preview!r}" + ), + model=None, + llm_provider="vertex_ai", + ) + return None + + try: + payload = response.json() + except ValueError as e: + if explicit_vertex_auth_provided: + raise litellm.BadRequestError( + message=( + "GCS metadata response was not valid JSON when using provided " + f"Vertex credentials (HTTP {response.status_code}). Error: {e}" + ), + model=None, + llm_provider="vertex_ai", + ) from e + return None + + if not isinstance(payload, dict): + if explicit_vertex_auth_provided: + raise litellm.BadRequestError( + message=( + "GCS metadata response was not a JSON object when using provided " + f"Vertex credentials (HTTP {response.status_code})." + ), + model=None, + llm_provider="vertex_ai", + ) + return None + + content_type = payload.get("contentType") + if isinstance(content_type, str) and len(content_type) > 0: + return content_type + + if explicit_vertex_auth_provided: + preview = (response.text or "")[:1024] + raise litellm.BadRequestError( + message=( + "GCS metadata JSON did not include a non-empty contentType field when " + f"using provided Vertex credentials (HTTP {response.status_code}). " + f"Body (truncated): {preview!r}" + ), + model=None, + llm_provider="vertex_ai", + ) + return None + + +def _normalize_and_validate_gemini_mime_type( + mime_type: str, model: Optional[str] +) -> str: + # Import lazily to avoid a module-level cyclic-import alert with + # litellm.types.files. + from litellm.types.files import get_file_extension_from_mime_type + + normalized_mime_type = _apply_gemini_mime_type_aliases(mime_type) + try: + file_extension = get_file_extension_from_mime_type(normalized_mime_type) + file_type = get_file_type_from_extension(file_extension) + except ValueError: + raise litellm.BadRequestError( + message=f"File type not supported by gemini - {normalized_mime_type}", + model=model, + llm_provider="vertex_ai", + ) + + if not is_gemini_1_5_accepted_file_type(file_type): + raise litellm.BadRequestError( + message=f"File type not supported by gemini - {file_type}", + model=model, + llm_provider="vertex_ai", + ) + + return get_file_mime_type_for_file_type(file_type) + + def _process_gemini_media( image_url: str, format: Optional[str] = None, media_resolution_enum: Optional[Dict[str, str]] = None, model: Optional[str] = None, video_metadata: Optional[Dict[str, Any]] = None, + vertex_project: Optional[str] = None, + vertex_credentials: Optional[Any] = None, ) -> PartType: """ Given a media URL (image, audio, or video), return the appropriate PartType for Gemini @@ -193,20 +522,63 @@ def _process_gemini_media( try: # GCS URIs if "gs://" in image_url: - # Figure out file type extension_with_dot = os.path.splitext(image_url)[-1] # Ex: ".png" extension = extension_with_dot[1:] # Ex: "png" + explicit_gcs_format = False if not format: - file_type = get_file_type_from_extension(extension) + mime_type: Optional[str] = None + # For extension-less gs:// URIs, we cannot infer from path. + # If callers pass `format`/`mime_type`, this branch is skipped. + if extension: + file_type = get_file_type_from_extension(extension) - # Validate the file type is supported by Gemini - if not is_gemini_1_5_accepted_file_type(file_type): - raise Exception(f"File type not supported by gemini - {file_type}") + # Validate the file type is supported by Gemini + if not is_gemini_1_5_accepted_file_type(file_type): + raise litellm.BadRequestError( + message=f"File type not supported by gemini - {file_type}", + model=model, + llm_provider="vertex_ai", + ) - mime_type = get_file_mime_type_for_file_type(file_type) + mime_type = get_file_mime_type_for_file_type(file_type) + else: + mime_type = _get_gcs_object_content_type( + image_url=image_url, + vertex_project=vertex_project, + vertex_credentials=vertex_credentials, + ) + if mime_type is None: + raise litellm.BadRequestError( + message=( + f"Unable to determine mime type for gs URI: {image_url}. " + "This gs:// URI has no file extension and GCS metadata " + "lookup failed. Set it explicitly using image_url.format " + "(or image_url.mime_type/content_type) or " + "message.content[].file.format." + ), + model=model, + llm_provider="vertex_ai", + ) else: mime_type = format + explicit_gcs_format = True + if mime_type is None: + raise litellm.BadRequestError( + message=f"File type not supported by gemini - {image_url}", + model=model, + llm_provider="vertex_ai", + ) + if explicit_gcs_format: + # Callers who pass format/mime_type explicitly for gs:// URIs + # rely on pass-through to Gemini (pre-PR behavior). Only apply + # known MIME aliases; skip litellm's file-type registry. + mime_type = _apply_gemini_mime_type_aliases(mime_type) + else: + mime_type = _normalize_and_validate_gemini_mime_type( + mime_type=mime_type, + model=model, + ) file_data = FileDataType(mime_type=mime_type, file_uri=image_url) part: PartType = {"file_data": file_data} return _apply_gemini_metadata( @@ -258,8 +630,6 @@ def _snake_to_camel(snake_str: str) -> str: def _camel_to_snake(camel_str: str) -> str: """Convert camelCase to snake_case""" - import re - return re.sub(r"(? List[ContentType]: """ Converts given messages from OpenAI format to Gemini format @@ -326,6 +698,16 @@ def _gemini_convert_messages_with_history( # noqa: PLR0915 msg_i = 0 tool_call_responses = [] + vertex_project = None + vertex_credentials = None + if litellm_params: + vertex_project = litellm_params.get("vertex_project") or litellm_params.get( + "vertex_ai_project" + ) + vertex_credentials = litellm_params.get( + "vertex_credentials" + ) or litellm_params.get("vertex_ai_credentials") + try: while msg_i < len(messages): user_content: List[PartType] = [] @@ -351,20 +733,42 @@ def _gemini_convert_messages_with_history( # noqa: PLR0915 img_element = element format: Optional[str] = None media_resolution_enum: Optional[Dict[str, str]] = None - if isinstance(img_element["image_url"], dict): - image_url = img_element["image_url"]["url"] - format = img_element["image_url"].get("format") - detail = img_element["image_url"].get("detail") + raw_image_url = img_element.get("image_url") + if raw_image_url is None: + raise litellm.BadRequestError( + message="Invalid message content: element type is 'image_url' but 'image_url' field is missing ", + model=model, + llm_provider="vertex_ai", + ) + if isinstance(raw_image_url, dict): + image_url = raw_image_url.get("url") + if image_url is None: + raise litellm.BadRequestError( + message="Invalid message content: element type is 'image_url' but 'url' field is missing inside 'image_url' ", + model=model, + llm_provider="vertex_ai", + ) + # TypedDict does not declare mime_type/content_type; + # read via Dict[str, Any] for caller-provided MIME fields. + image_url_dict = cast(Dict[str, Any], raw_image_url) + format = ( + image_url_dict.get("format") + or image_url_dict.get("mime_type") + or image_url_dict.get("content_type") + ) + detail = image_url_dict.get("detail") media_resolution_enum = ( _convert_detail_to_media_resolution_enum(detail) ) else: - image_url = img_element["image_url"] + image_url = raw_image_url _part = _process_gemini_media( image_url=image_url, format=format, media_resolution_enum=media_resolution_enum, model=model, + vertex_project=vertex_project, + vertex_credentials=vertex_credentials, ) _parts.append(_part) elif element["type"] == "input_audio": @@ -390,15 +794,31 @@ def _gemini_convert_messages_with_history( # noqa: PLR0915 image_url=openai_image_str, format=audio_format_modified, model=model, + vertex_project=vertex_project, + vertex_credentials=vertex_credentials, ) _parts.append(_part) elif element["type"] == "file": file_element = cast(ChatCompletionFileObject, element) - file_id = file_element["file"].get("file_id") - format = file_element["file"].get("format") - file_data = file_element["file"].get("file_data") - detail = file_element["file"].get("detail") - video_metadata = file_element["file"].get("video_metadata") + _file_field = file_element.get("file") + if _file_field is None: + raise litellm.BadRequestError( + message="Content block has type='file' but is missing the required 'file' field", + model=model, + llm_provider="vertex_ai", + ) + # TypedDict does not declare mime_type/content_type; + # read via Dict[str, Any] for caller-provided MIME fields. + file_dict = cast(Dict[str, Any], _file_field) + file_id = file_dict.get("file_id") + format = ( + file_dict.get("format") + or file_dict.get("mime_type") + or file_dict.get("content_type") + ) + file_data = file_dict.get("file_data") + detail = file_dict.get("detail") + video_metadata = file_dict.get("video_metadata") passed_file = file_id or file_data if passed_file is None: raise Exception( @@ -417,13 +837,23 @@ def _gemini_convert_messages_with_history( # noqa: PLR0915 model=model, media_resolution_enum=media_resolution_enum, video_metadata=video_metadata, + vertex_project=vertex_project, + vertex_credentials=vertex_credentials, ) _parts.append(_part) - except Exception: - raise Exception( - "Unable to determine mime type for file_id: {}, set this explicitly using message[{}].content[{}].file.format".format( - file_id, msg_i, element_idx - ) + except litellm.BadRequestError: + raise + except Exception as e: + raise litellm.BadRequestError( + message=( + f"Unable to determine mime type for file: " + f"{file_id or 'provided data'}, set this explicitly " + f"using message[{msg_i}].content[{element_idx}].file.format " + f"(or file.mime_type/content_type). " + f"Original error: {str(e)}" + ), + model=model, + llm_provider="vertex_ai", ) user_content.extend(_parts) elif _message_content is not None and isinstance(_message_content, str): @@ -528,7 +958,11 @@ def _gemini_convert_messages_with_history( # noqa: PLR0915 image_url_obj = image_item.get("image_url") if isinstance(image_url_obj, dict): assistant_image_url = image_url_obj.get("url") - format = image_url_obj.get("format") + format = ( + image_url_obj.get("format") + or image_url_obj.get("mime_type") + or image_url_obj.get("content_type") + ) detail = image_url_obj.get("detail") media_resolution_enum = ( _convert_detail_to_media_resolution_enum(detail) @@ -539,6 +973,8 @@ def _gemini_convert_messages_with_history( # noqa: PLR0915 format=format, media_resolution_enum=media_resolution_enum, model=model, + vertex_project=vertex_project, + vertex_credentials=vertex_credentials, ) assistant_content.append(_part) @@ -548,7 +984,9 @@ def _gemini_convert_messages_with_history( # noqa: PLR0915 or assistant_msg.get("function_call") is not None ): # support assistant tool invoke conversion gemini_tool_call_parts = convert_to_gemini_tool_call_invoke( - assistant_msg, model=model + assistant_msg, + model=model, + custom_llm_provider=custom_llm_provider, ) ## check if gemini_tool_call already exists in assistant_content for gemini_tool_call_part in gemini_tool_call_parts: @@ -607,7 +1045,10 @@ def _gemini_convert_messages_with_history( # noqa: PLR0915 and messages[msg_i]["role"] in tool_call_message_roles ): _part = convert_to_gemini_tool_call_result( - messages[msg_i], last_message_with_tool_calls # type: ignore + messages[msg_i], # type: ignore + last_message_with_tool_calls, # type: ignore + model=model, + custom_llm_provider=custom_llm_provider, ) msg_i += 1 # Handle both single part and list of parts (for Computer Use with images) @@ -632,16 +1073,14 @@ def _gemini_convert_messages_with_history( # noqa: PLR0915 contents.append(ContentType(role="user", parts=tool_call_responses)) if len(contents) == 0: - verbose_logger.warning( - """ + verbose_logger.warning(""" No contents in messages. Contents are required. See https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.publishers.models/generateContent#request-body. If the original request did not comply to OpenAI API requirements it should have failed by now, but LiteLLM does not check for missing messages. Setting an empty content to prevent an 400 error. Relevant Issue - https://github.com/BerriAI/litellm/issues/9733 - """ - ) + """) contents.append(ContentType(role="user", parts=[PartType(text=" ")])) return contents except Exception as e: @@ -713,11 +1152,11 @@ def _transform_request_body( # noqa: PLR0915 try: if custom_llm_provider == "gemini": content = litellm.GoogleAIStudioGeminiConfig()._transform_messages( - messages=messages, model=model + messages=messages, model=model, litellm_params=litellm_params ) else: content = litellm.VertexGeminiConfig()._transform_messages( - messages=messages, model=model + messages=messages, model=model, litellm_params=litellm_params ) tools: Optional[Tools] = optional_params.pop("tools", None) tool_choice: Optional[ToolConfig] = optional_params.pop("tool_choice", None) @@ -893,6 +1332,20 @@ async def async_transform_request_body( vertex_auth_header=vertex_auth_header, ) + if _openai_messages_may_need_sync_gcs_metadata_fetch(messages): + # _transform_request_body may issue a sync httpx.get (up to 5s timeout) + # via _get_gcs_object_content_type to fetch GCS object metadata. Run the + # whole sync transformation on a worker thread so it does not block the + # async event loop. + return await asyncify(_transform_request_body)( + messages=messages, + model=model, + custom_llm_provider=custom_llm_provider, + litellm_params=litellm_params, + cached_content=cached_content, + optional_params=optional_params, + ) + return _transform_request_body( messages=messages, model=model, diff --git a/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py b/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py index 6278de662f8..189ac7a7f6a 100644 --- a/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py +++ b/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py @@ -280,6 +280,8 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): - gemini-3-pro-preview - gemini-3-flash - gemini-3-flash-preview (Gemini 3 Flash) + - gemini-3.1-pro-preview, gemini-3.1-flash, gemini-3.1-flash-lite-preview + - gemini-3.5-flash - Any future Gemini 3.x models """ # Check for Gemini 3 models @@ -287,6 +289,20 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): return True return False + @staticmethod + def _forward_gemini_function_call_id( + model: str, custom_llm_provider: Optional[str] = None + ) -> bool: + """ + Whether to include `id` on function_call / function_response parts. + + Gemini 3+ on Google AI Studio accepts (and returns) `id` for strict + tool-call matching. Vertex AI rejects the field with HTTP 400. + """ + if custom_llm_provider != "gemini": + return False + return VertexGeminiConfig._is_gemini_3_or_newer(model) + def _supports_penalty_parameters(self, model: str) -> bool: # Gemini 3 models do not support penalty parameters if VertexGeminiConfig._is_gemini_3_or_newer(model): @@ -300,6 +316,7 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): supported_params = [ "temperature", "top_p", + "top_k", "max_tokens", "max_completion_tokens", "stream", @@ -363,6 +380,66 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): """ return Tools(googleSearch={}) + @staticmethod + def _search_tool_keys() -> set: + return { + VertexToolName.GOOGLE_SEARCH.value, + VertexToolName.GOOGLE_SEARCH_RETRIEVAL.value, + VertexToolName.ENTERPRISE_WEB_SEARCH.value, + VertexToolName.URL_CONTEXT.value, + "google_search", + "google_search_retrieval", + "enterprise_web_search", + "urlContext", + } + + @classmethod + def _drop_search_tools_mixed_with_functions(cls, optional_params: dict) -> None: + """ + Drop search tools from optional_params when mixed with function declarations + and include_server_side_tool_invocations is not enabled. + + Runs after map_openai_params merges tools and web_search_options so both + code paths (single _map_function call vs split tools + web_search_options) + get the same conflict resolution. + """ + if optional_params.get("include_server_side_tool_invocations"): + return + + tools = optional_params.get("tools") + if not isinstance(tools, list) or not tools: + return + + search_tool_keys = cls._search_tool_keys() + has_function_declarations = any( + isinstance(tool, dict) and tool.get("function_declarations") + for tool in tools + ) + if not has_function_declarations: + return + + has_search_tools = any( + isinstance(tool, dict) and any(key in tool for key in search_tool_keys) + for tool in tools + ) + if not has_search_tools: + return + + verbose_logger.warning( + "Vertex AI does not support mixing function declarations with " + "search tools (googleSearch, enterpriseWebSearch, urlContext, " + "googleSearchRetrieval) in the same request. Dropping search " + "tools and keeping function declarations. To use search tools, " + "send a request without function calling tools." + ) + optional_params["tools"] = [ + tool + for tool in tools + if not ( + isinstance(tool, dict) and any(key in tool for key in search_tool_keys) + ) + ] + def _map_service_tier_param(self, value: str, optional_params: dict) -> None: """ Map OpenAI service_tier (string) to Gemini serviceTier. @@ -884,9 +961,10 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): GeminiThinkingConfig with thinkingLevel and includeThoughts """ # Check if this is gemini-3-flash which supports MINIMAL thinking level - # Covers gemini-3-flash, gemini-3-flash-preview, gemini-3.1-flash, gemini-3.1-flash-lite-preview, etc. + # Covers gemini-3-flash, gemini-3-flash-preview, gemini-3.1-flash, gemini-3.1-flash-lite-preview, + # gemini-3.5-flash, and any future 3.x-flash variants. is_gemini3flash = model and ( - "gemini-3-flash" in model.lower() or "gemini-3.1-flash" in model.lower() + "flash" in model.lower() and "gemini-3" in model.lower() ) is_gemini31pro = model and ("gemini-3.1-pro-preview" in model.lower()) if reasoning_effort == "minimal": @@ -982,8 +1060,7 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): # Follow provider defaults unless explicitly opted into legacy behavior. if litellm.enable_gemini_default_thinking_level_low is True: is_gemini3flash = ( - "gemini-3-flash-preview" in model.lower() - or "gemini-3-flash" in model.lower() + "gemini-3" in model.lower() and "flash" in model.lower() ) params["thinkingLevel"] = ( "minimal" if is_gemini3flash else "low" @@ -1077,6 +1154,7 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): model: str, drop_params: bool, ) -> Dict: + gemini_sampling_params_warned: bool = False for param, value in non_default_params.items(): if param == "temperature": if VertexGeminiConfig._is_gemini_3_or_newer(model): @@ -1086,9 +1164,41 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): "can cause infinite loops, degraded reasoning performance, and failure on complex tasks. " "Strongly recommended to use temperature = 1.0 (default)." ) + if not gemini_sampling_params_warned: + verbose_logger.warning( + "DeprecationWarning: `temperature`, `top_p`, and `top_k` continue to " + f"function for Gemini 3+ ({model}) but are planned for removal in a " + "future release. Move sampling guidance into the `system` " + "instructions instead." + ) + gemini_sampling_params_warned = True optional_params["temperature"] = value elif param == "top_p": + if ( + VertexGeminiConfig._is_gemini_3_or_newer(model) + and not gemini_sampling_params_warned + ): + verbose_logger.warning( + "DeprecationWarning: `temperature`, `top_p`, and `top_k` continue to " + f"function for Gemini 3+ ({model}) but are planned for removal in a " + "future release. Move sampling guidance into the `system` " + "instructions instead." + ) + gemini_sampling_params_warned = True optional_params["top_p"] = value + elif param == "top_k": + if ( + VertexGeminiConfig._is_gemini_3_or_newer(model) + and not gemini_sampling_params_warned + ): + verbose_logger.warning( + "DeprecationWarning: `temperature`, `top_p`, and `top_k` continue to " + f"function for Gemini 3+ ({model}) but are planned for removal in a " + "future release. Move sampling guidance into the `system` " + "instructions instead." + ) + gemini_sampling_params_warned = True + optional_params["top_k"] = value elif ( param == "stream" and value is True ): # sending stream = False, can cause it to get passed unchecked and raise issues @@ -1139,11 +1249,14 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): if _tool_choice_value is not None: optional_params["tool_choice"] = _tool_choice_value elif param == "parallel_tool_calls": - if value is False and not ( - drop_params or litellm.drop_params - ): # if drop params is True, then we should just ignore this - self.validate_parallel_tool_calls(value, non_default_params) - else: + tools_list = non_default_params.get( + "tools", non_default_params.get("functions") + ) + num_tools = len(tools_list) if isinstance(tools_list, list) else 0 + # Gemini does not support parallel_tool_calls=False with multiple + # tools. Drop the param instead of failing — Responses API clients + # often send parallel_tool_calls=false by default. + if not (value is False and num_tools > 1): optional_params["parallel_tool_calls"] = value elif param == "seed": optional_params["seed"] = value @@ -1216,6 +1329,8 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): if "temperature" not in optional_params: optional_params["temperature"] = 1.0 + self._drop_search_tools_mixed_with_functions(optional_params) + return optional_params def get_mapped_special_auth_params(self) -> dict: @@ -1588,6 +1703,10 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): } # Extract thought signature if present thought_signature = part.get("thoughtSignature") + # Gemini 3.5+ returns a stable `id` per function call to enable + # strict response matching. Preserve it as the OpenAI + # tool_call_id so it can be echoed back unchanged. + gemini_call_id = part["functionCall"].get("id") if is_function_call is True: function_dict: Dict[str, Any] = dict(_function_chunk) @@ -1605,6 +1724,11 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): "function": _function_chunk, "index": cumulative_tool_call_idx, } + # Gemini 3.5+ returns a stable native `id`; prefer it over + # the synthetic call_ so the same value can be echoed + # back on the matching `functionResponse`. + if gemini_call_id: + _tool_response_chunk["id"] = gemini_call_id # Embed thought signature in ID for OpenAI client compatibility if thought_signature: _tool_response_chunk["provider_specific_fields"] = { # type: ignore @@ -2533,9 +2657,17 @@ class VertexGeminiConfig(VertexAIBaseConfig, BaseConfig): return model_response def _transform_messages( - self, messages: List[AllMessageValues], model: Optional[str] = None + self, + messages: List[AllMessageValues], + model: Optional[str] = None, + litellm_params: Optional[dict] = None, ) -> List[ContentType]: - return _gemini_convert_messages_with_history(messages=messages, model=model) + return _gemini_convert_messages_with_history( + messages=messages, + model=model, + litellm_params=litellm_params, + custom_llm_provider="vertex_ai", + ) def get_error_class( self, error_message: str, status_code: int, headers: Union[Dict, httpx.Headers] @@ -3139,6 +3271,31 @@ class ModelResponseIterator: self.cumulative_tool_call_index: int = 0 self.has_seen_tool_calls: bool = False + @staticmethod + def _check_streaming_error(chunk: dict) -> None: + """Detect embedded errors (e.g. 429 RESOURCE_EXHAUSTED) in streaming chunks and raise VertexAIError.""" + if "error" not in chunk: + return + error_data = chunk["error"] + if not isinstance(error_data, dict): + raise VertexAIError( + status_code=500, + message=f"Unexpected error format in mid-stream chunk: {error_data}", + ) + raw_code = error_data.get("code", 500) + if raw_code is None: + raw_code = 500 + try: + error_code = int(raw_code) + except (TypeError, ValueError): + error_code = 500 + error_message = error_data.get("message", "Unknown error") + error_status = error_data.get("status", "UNKNOWN") + raise VertexAIError( + status_code=error_code, + message=f"{error_status} - {error_message}", + ) + def _apply_stream_candidates( self, _candidates: List[Candidates], @@ -3256,6 +3413,11 @@ class ModelResponseIterator: def chunk_parser(self, chunk: dict) -> Optional["ModelResponseStream"]: try: verbose_logger.debug(f"RAW GEMINI CHUNK: {chunk}") + + # Detect mid-stream error chunks (e.g. 429 RESOURCE_EXHAUSTED). + # Vertex AI can return errors as HTTP 200 but with an "error" field in the SSE body. + self._check_streaming_error(chunk) + from litellm.types.utils import ModelResponseStream processed_chunk = GenerateContentResponseBody(**chunk) # type: ignore diff --git a/litellm/llms/vertex_ai/gemini_embeddings/batch_embed_content_transformation.py b/litellm/llms/vertex_ai/gemini_embeddings/batch_embed_content_transformation.py index e1b365c9f42..ba6e6f0c056 100644 --- a/litellm/llms/vertex_ai/gemini_embeddings/batch_embed_content_transformation.py +++ b/litellm/llms/vertex_ai/gemini_embeddings/batch_embed_content_transformation.py @@ -1,5 +1,5 @@ """ -Transformation logic from OpenAI /v1/embeddings format to Google AI Studio /batchEmbedContents format. +Transformation logic from OpenAI /v1/embeddings format to Google AI Studio /batchEmbedContents format. Why separate file? Make it easy to see how transformation works """ diff --git a/litellm/llms/vertex_ai/google_genai/transformation.py b/litellm/llms/vertex_ai/google_genai/transformation.py index d7a4ceeb3e7..c1120d9ab8b 100644 --- a/litellm/llms/vertex_ai/google_genai/transformation.py +++ b/litellm/llms/vertex_ai/google_genai/transformation.py @@ -79,6 +79,9 @@ class VertexAIGoogleGenAIConfig(GoogleGenAIConfig): Transform the generate content request for Vertex AI. Since Vertex AI natively supports Google GenAI format, we can pass most fields directly. """ + if generate_content_config_dict: + self._normalize_response_schema(generate_content_config_dict, model) + # Build the request in Google GenAI format that Vertex AI expects result = { "model": model, diff --git a/litellm/llms/vertex_ai/text_to_speech/text_to_speech_handler.py b/litellm/llms/vertex_ai/text_to_speech/text_to_speech_handler.py index 9d9015c2b91..b835ad7d8fa 100644 --- a/litellm/llms/vertex_ai/text_to_speech/text_to_speech_handler.py +++ b/litellm/llms/vertex_ai/text_to_speech/text_to_speech_handler.py @@ -139,7 +139,7 @@ class VertexTextToSpeechAPI(VertexLLM): ########## End of logging ############ ####### Send the request ################### if _is_async is True: - return self.async_audio_speech( # type:ignore + return self.async_audio_speech( # type: ignore logging_obj=logging_obj, url=url, headers=headers, request=request ) sync_handler = _get_httpx_client() diff --git a/litellm/llms/vertex_ai/vertex_ai_partner_models/main.py b/litellm/llms/vertex_ai/vertex_ai_partner_models/main.py index 123d925f7c1..13aa2a5350e 100644 --- a/litellm/llms/vertex_ai/vertex_ai_partner_models/main.py +++ b/litellm/llms/vertex_ai/vertex_ai_partner_models/main.py @@ -45,7 +45,7 @@ class PartnerModelPrefixes(str, Enum): class VertexAIPartnerModels(VertexBase): def __init__(self) -> None: - pass + super().__init__() @staticmethod def is_vertex_partner_model(model: str): @@ -116,9 +116,6 @@ class VertexAIPartnerModels(VertexBase): CodestralTextCompletion, ) from litellm.llms.openai_like.chat.handler import OpenAILikeChatHandler - from litellm.llms.vertex_ai.gemini.vertex_and_google_ai_studio_gemini import ( - VertexLLM, - ) except Exception as e: raise VertexAIError( status_code=400, @@ -133,9 +130,7 @@ class VertexAIPartnerModels(VertexBase): message="""Upgrade vertex ai. Run `pip install "google-cloud-aiplatform>=1.38"`""", ) try: - vertex_httpx_logic = VertexLLM() - - access_token, project_id = vertex_httpx_logic._ensure_access_token( + access_token, project_id = self._ensure_access_token( credentials=vertex_credentials, project_id=vertex_project, custom_llm_provider="vertex_ai", @@ -292,22 +287,15 @@ class VertexAIPartnerModels(VertexBase): Returns: Dict containing token count information """ - try: - import vertexai - except Exception as e: - raise VertexAIError( - status_code=400, - message=f"""vertexai import failed please run `pip install -U "google-cloud-aiplatform>=1.38"`. Got error: {e}""", - ) - - if not ( - hasattr(vertexai, "preview") or hasattr(vertexai.preview, "language_models") - ): - raise VertexAIError( - status_code=400, - message="""Upgrade vertex ai. Run `pip install "google-cloud-aiplatform>=1.38"`""", - ) - + # Note: we intentionally do not import `vertexai` (the Gemini SDK shipped + # by `google-cloud-aiplatform`) on this path. Partner models such as + # Claude on Vertex use the Anthropic Messages API protocol directly via + # `:rawPredict`, and `VertexAIPartnerModelsTokenCounter` reaches that + # endpoint with an authenticated httpx client — it never touches the + # Gemini SDK. Requiring `google-cloud-aiplatform>=1.38` here turned a + # SDK-free Anthropic-protocol call into a hard dependency on the Gemini + # SDK (see #28084), breaking `/v1/messages/count_tokens` for Claude-on- + # Vertex on any LiteLLM install without that extra. Stay SDK-free. try: from litellm.llms.vertex_ai.vertex_ai_partner_models.count_tokens.handler import ( VertexAIPartnerModelsTokenCounter, diff --git a/litellm/llms/vertex_ai/vertex_gemma_models/main.py b/litellm/llms/vertex_ai/vertex_gemma_models/main.py index 82cfe6de984..b6bf2f73b72 100644 --- a/litellm/llms/vertex_ai/vertex_gemma_models/main.py +++ b/litellm/llms/vertex_ai/vertex_gemma_models/main.py @@ -31,7 +31,7 @@ from ..vertex_llm_base import VertexBase class VertexAIGemmaModels(VertexBase): def __init__(self) -> None: - pass + super().__init__() def completion( self, @@ -62,9 +62,6 @@ class VertexAIGemmaModels(VertexBase): try: import vertexai - from litellm.llms.vertex_ai.gemini.vertex_and_google_ai_studio_gemini import ( - VertexLLM, - ) from litellm.llms.vertex_ai.vertex_gemma_models.transformation import ( VertexGemmaConfig, ) @@ -83,9 +80,8 @@ class VertexAIGemmaModels(VertexBase): ) try: model = get_vertex_base_model_name(model=model) - vertex_httpx_logic = VertexLLM() - access_token, project_id = vertex_httpx_logic._ensure_access_token( + access_token, project_id = self._ensure_access_token( credentials=vertex_credentials, project_id=vertex_project, custom_llm_provider="vertex_ai", diff --git a/litellm/llms/vertex_ai/vertex_gemma_models/transformation.py b/litellm/llms/vertex_ai/vertex_gemma_models/transformation.py index 6c6446958bc..35cd54d65f6 100644 --- a/litellm/llms/vertex_ai/vertex_gemma_models/transformation.py +++ b/litellm/llms/vertex_ai/vertex_gemma_models/transformation.py @@ -91,6 +91,10 @@ class VertexGemmaConfig(OpenAIGPTConfig): "stream", None ) # Streaming not supported, will be faked client-side openai_request.pop("stream_options", None) # Stream options not supported + # Vertex Gemma's chatCompletions wrapper does not understand + # `context_management` (an Anthropic/Responses API concept). Strip it + # so the upstream endpoint does not 400 on the unknown field. + openai_request.pop("context_management", None) # Wrap in Vertex Gemma format return { diff --git a/litellm/llms/vertex_ai/vertex_llm_base.py b/litellm/llms/vertex_ai/vertex_llm_base.py index 6f687dae7e8..990063bb9fb 100644 --- a/litellm/llms/vertex_ai/vertex_llm_base.py +++ b/litellm/llms/vertex_ai/vertex_llm_base.py @@ -4,8 +4,10 @@ Base Vertex, Google AI Studio LLM Class Handles Authentication and generating request urls for Vertex AI and Google AI Studio """ +import asyncio import json import os +import threading from typing import TYPE_CHECKING, Any, Dict, Literal, Optional, Tuple import litellm @@ -30,6 +32,7 @@ GOOGLE_IMPORT_ERROR_MESSAGE = ( if TYPE_CHECKING: from google.auth.credentials import Credentials as GoogleCredentialsObject + from google.auth.credentials import TokenState else: GoogleCredentialsObject = Any @@ -42,10 +45,28 @@ class VertexBase: self._credentials: Optional[GoogleCredentialsObject] = None self._credentials_project_mapping: Dict[ Tuple[Optional[VERTEX_CREDENTIALS_TYPES], Optional[str]], - Tuple[GoogleCredentialsObject, str], + Tuple[GoogleCredentialsObject, Optional[str]], ] = {} self.project_id: Optional[str] = None self.async_handler: Optional[AsyncHTTPHandler] = None + # Per-credential-key asyncio.Lock for single-flight async refresh. + # Prevents thundering herd when token expires under high concurrency. + # Uses a regular dict (not WeakValueDictionary) so the lock identity is + # stable across concurrent callers — a weak reference can be GC'd + # between two coroutines arriving at the lock, breaking single-flight. + # An explicit refcount tracks the number of coroutines currently using + # each lock; the entry is pruned when the count reaches zero, so the + # dict stays bounded even in long-running high-cardinality deployments + # without depending on any private asyncio internals. + self._async_refresh_locks: Dict[tuple, asyncio.Lock] = {} + self._async_refresh_lock_refcounts: Dict[tuple, int] = {} + # Tracks in-flight background refresh tasks to avoid duplicate refreshes. + self._background_refresh_tasks: Dict[tuple, asyncio.Task] = {} + # Protects the sync get_access_token refresh path. + # Use RLock so that the reauthentication retry path (which calls + # back into get_access_token while still holding the lock) can + # re-acquire it without deadlocking the current thread. + self._sync_refresh_lock = threading.RLock() def get_vertex_region(self, vertex_region: Optional[str], model: str) -> str: import litellm @@ -77,7 +98,9 @@ class VertexBase: return vertex_region or "us-central1" def load_auth( - self, credentials: Optional[VERTEX_CREDENTIALS_TYPES], project_id: Optional[str] + self, + credentials: Optional[VERTEX_CREDENTIALS_TYPES], + project_id: Optional[str], ) -> Tuple[Any, str]: if credentials is not None: if isinstance(credentials, str): @@ -343,7 +366,241 @@ class VertexBase: except ImportError: raise ImportError(GOOGLE_IMPORT_ERROR_MESSAGE) - credentials.refresh(Request()) + # Serialize all refreshes on this VertexBase across threads. + # ``credentials.refresh()`` is not safe to call concurrently on the + # same credentials object, and this method is invoked from three + # places that can run on different threads: + # - sync ``get_access_token`` (already holds ``_sync_refresh_lock``) + # - the async slow path (via ``asyncify`` in a worker thread) + # - the background proactive refresh task (via ``asyncify``) + # ``_sync_refresh_lock`` is an ``RLock`` so reentrant acquisition + # from the sync path is safe. + with self._sync_refresh_lock: + credentials.refresh(Request()) + + def _acquire_async_refresh_lock(self, credential_cache_key: tuple) -> asyncio.Lock: + """Increment the refcount and return the lock for ``credential_cache_key``. + + Every call must be paired with ``_release_async_refresh_lock`` once the + caller is done with the lock so the entry can be pruned when no other + coroutine is holding or waiting on it. + """ + lock = self._async_refresh_locks.setdefault( + credential_cache_key, asyncio.Lock() + ) + self._async_refresh_lock_refcounts[credential_cache_key] = ( + self._async_refresh_lock_refcounts.get(credential_cache_key, 0) + 1 + ) + return lock + + def _release_async_refresh_lock( + self, credential_cache_key: tuple, lock: asyncio.Lock + ) -> None: + """Decrement the refcount and drop the lock entry when it reaches zero. + + Must be called only after the caller has released ``lock`` (i.e. once + the surrounding ``async with`` has exited). asyncio is cooperative, so + the decrement-then-pop sequence below runs atomically with respect to + other coroutines. + """ + remaining = self._async_refresh_lock_refcounts.get(credential_cache_key, 0) - 1 + if remaining > 0: + self._async_refresh_lock_refcounts[credential_cache_key] = remaining + return + self._async_refresh_lock_refcounts.pop(credential_cache_key, None) + if self._async_refresh_locks.get(credential_cache_key) is lock: + self._async_refresh_locks.pop(credential_cache_key, None) + + def _try_get_cached_token( + self, + credential_cache_key: tuple, + project_id: Optional[str], + ) -> Optional[Tuple[str, str]]: + """ + Look up cached credentials and return (token, project_id) if the token + is FRESH. Returns None if not cached or not fresh. + """ + from google.auth.credentials import TokenState + + creds, cached_project_id = self._unpack_cached_credentials(credential_cache_key) + if ( + creds is not None + and self._get_token_state(creds) == TokenState.FRESH + and creds.token is not None + and isinstance(creds.token, str) + ): + resolved_project = project_id or cached_project_id + if resolved_project: + return creds.token, resolved_project + return None + + def _try_get_usable_cached_token( + self, + credential_cache_key: tuple, + project_id: Optional[str], + ) -> Optional[Tuple[str, str, "TokenState", Any, Optional[str]]]: + """ + Look up cached credentials and return usable token info for FRESH or + STALE tokens (both are still valid for outbound requests). STALE + tokens are returned along with their state and the underlying + credentials object so the caller can schedule a background refresh + without holding the per-key async lock. + """ + from google.auth.credentials import TokenState + + creds, cached_project_id = self._unpack_cached_credentials(credential_cache_key) + if creds is None: + return None + token_state = self._get_token_state(creds) + if token_state not in (TokenState.FRESH, TokenState.STALE): + return None + if creds.token is None or not isinstance(creds.token, str): + return None + resolved_project = project_id or cached_project_id + if not resolved_project: + return None + return creds.token, resolved_project, token_state, creds, cached_project_id + + def _unpack_cached_credentials( + self, credential_cache_key: tuple + ) -> Tuple[Any, Optional[str]]: + """ + Return (credentials, project_id) from the cache, or (None, None) if + not cached. Handles both tuple and legacy cache formats. + """ + if credential_cache_key not in self._credentials_project_mapping: + return None, None + cached_entry = self._credentials_project_mapping[credential_cache_key] + if isinstance(cached_entry, tuple): + return cached_entry + return cached_entry, cached_entry.quota_project_id or getattr( + cached_entry, "project_id", None + ) + + def _get_token_state(self, credentials: Any) -> "TokenState": + """ + Return the token state using google-auth's TokenState enum. + + Falls back to expired/valid checks if token_state is unavailable + (e.g. older google-auth versions or mock objects in tests). + """ + from google.auth.credentials import TokenState as _TokenState + + token_state = getattr(credentials, "token_state", None) + if isinstance(token_state, _TokenState): + return token_state + # Fallback for credentials without a real token_state (e.g. mocks) + if getattr(credentials, "expired", True): + return _TokenState.INVALID + if getattr(credentials, "valid", False): + return _TokenState.FRESH + return _TokenState.INVALID + + async def _load_and_cache_credentials( + self, + credentials: Optional[VERTEX_CREDENTIALS_TYPES], + project_id: Optional[str], + credential_cache_key: tuple, + ) -> Tuple[Any, Optional[str]]: + """Load credentials via load_auth (in thread) and cache the result.""" + try: + _credentials, credential_project_id = await asyncify(self.load_auth)( + credentials=credentials, + project_id=project_id, + ) + except Exception as e: + verbose_logger.exception("Failed to load vertex credentials: %s", str(e)) + raise + if _credentials is None: + raise ValueError("Could not resolve credentials") + self._credentials_project_mapping[credential_cache_key] = ( + _credentials, + credential_project_id, + ) + return _credentials, credential_project_id + + async def _background_refresh_credentials( + self, + credentials: Any, + credential_cache_key: tuple, + credential_project_id: Optional[str], + ) -> None: + """ + Refresh credentials in the background without blocking the calling request. + + Called when the token is still valid but nearing expiry (proactive refresh). + Errors are logged but not raised — the current token is still usable. + """ + try: + verbose_logger.debug("Background proactive credential refresh") + await asyncify(self.refresh_auth)(credentials) + # Only update the cache if it still points at the credentials + # object we just refreshed. The per-key async lock is not held + # here, so a concurrent INVALID path may have already replaced + # this entry (e.g. via _handle_reauthentication_async, which + # creates a fresh credentials object). In that case our write + # would clobber the newer entry with a stale reference. + cached_creds, _ = self._unpack_cached_credentials(credential_cache_key) + if cached_creds is credentials: + self._credentials_project_mapping[credential_cache_key] = ( + credentials, + credential_project_id, + ) + except Exception: + verbose_logger.debug( + "Background credential refresh failed, will retry on next request", + exc_info=True, + ) + + async def _await_in_flight_background_refresh( + self, credential_cache_key: tuple + ) -> None: + """Wait for an in-flight background refresh to finish, if any. + + google-auth's ``Credentials.refresh()`` is not safe to invoke + concurrently on the same credentials object. Coroutines that need a + blocking refresh must first drain any background refresh that was + scheduled while a previous STALE token was being served. + """ + existing_task = self._background_refresh_tasks.get(credential_cache_key) + if existing_task is None or existing_task.done(): + return + try: + await existing_task + except Exception: + # Background refresh failures are already logged inside + # _background_refresh_credentials; the caller will fall through + # to its own blocking refresh. + pass + + def _schedule_background_refresh( + self, + credentials: Any, + credential_cache_key: tuple, + credential_project_id: Optional[str], + ) -> None: + """Kick off a single background refresh for ``credential_cache_key``. + + Skips scheduling if a refresh is already in flight. The done-callback + guards against removing a newer task that has replaced this one in the + tracking dict (done_callbacks are scheduled via ``call_soon``). + """ + existing = self._background_refresh_tasks.get(credential_cache_key) + if existing is not None and not existing.done(): + return + self._background_refresh_tasks.pop(credential_cache_key, None) + task = asyncio.create_task( + self._background_refresh_credentials( + credentials, credential_cache_key, credential_project_id + ) + ) + + def _drop_background_refresh_task(_fut: asyncio.Future[Any]) -> None: + if self._background_refresh_tasks.get(credential_cache_key) is _fut: + self._background_refresh_tasks.pop(credential_cache_key, None) + + task.add_done_callback(_drop_background_refresh_task) + self._background_refresh_tasks[credential_cache_key] = task def _ensure_access_token( self, @@ -563,6 +820,65 @@ class VertexBase: # Re-raise the original error for better context raise error + async def _handle_reauthentication_async( + self, + credentials: Optional[VERTEX_CREDENTIALS_TYPES], + project_id: Optional[str], + credential_cache_key: Tuple, + error: Exception, + ) -> Tuple[str, str]: + """ + Async reauthentication retry that stays within the per-key async lock. + """ + verbose_logger.debug( + f"Handling async reauthentication for project_id: {project_id}. " + f"Clearing cache and retrying once." + ) + + self._credentials_project_mapping.pop(credential_cache_key, None) + + try: + _credentials, credential_project_id = ( + await self._load_and_cache_credentials( + credentials=credentials, + project_id=project_id, + credential_cache_key=credential_cache_key, + ) + ) + if project_id is None and isinstance(credential_project_id, str): + project_id = credential_project_id + cache_credentials = ( + json.dumps(credentials) + if isinstance(credentials, dict) + else credentials + ) + resolved_cache_key = (cache_credentials, project_id) + # Always overwrite — any pre-existing entry at the resolved key + # references the OLD credentials object we just replaced, and + # leaving it would force the next request to do a redundant + # refresh/reauth before realizing the cached creds are stale. + self._credentials_project_mapping[resolved_cache_key] = ( + _credentials, + credential_project_id, + ) + + if _credentials.token is None or not isinstance(_credentials.token, str): + raise ValueError( + "Could not resolve credentials token. Got None or non-string token (type={})".format( + type(_credentials.token).__name__ + ) + ) + if project_id is None: + raise ValueError("Could not resolve project_id") + + return _credentials.token, project_id + except Exception as retry_error: + verbose_logger.error( + f"Async reauthentication retry failed for project_id: {project_id}. " + f"Original error: {str(error)}. Retry error: {str(retry_error)}" + ) + raise error + def get_access_token( self, credentials: Optional[VERTEX_CREDENTIALS_TYPES], @@ -646,7 +962,7 @@ class VertexBase: ) ## VALIDATE CREDENTIALS - verbose_logger.debug(f"Validating credentials for project_id: {project_id}") + verbose_logger.debug("Validating credentials") if ( project_id is None and credential_project_id is not None @@ -666,26 +982,27 @@ class VertexBase: raise ValueError("Credentials are None after loading") if _credentials.expired: - try: - verbose_logger.debug( - f"Credentials expired, refreshing for project_id: {project_id}" - ) - self.refresh_auth(_credentials) - self._credentials_project_mapping[credential_cache_key] = ( - _credentials, - credential_project_id, - ) - except Exception as e: - # if refresh fails, it's possible the user has re-authenticated via `gcloud auth application-default login` - # in this case, we should try to reload the credentials by clearing the cache and retrying - if "Reauthentication is needed" in str(e) and not _retry_reauth: - return self._handle_reauthentication( - credentials=credentials, - project_id=project_id, - credential_cache_key=credential_cache_key, - error=e, - ) - raise e + with self._sync_refresh_lock: + # Double-check after acquiring lock + if _credentials.expired: + try: + verbose_logger.debug("Credentials expired, refreshing") + self.refresh_auth(_credentials) + self._credentials_project_mapping[credential_cache_key] = ( + _credentials, + credential_project_id, + ) + except Exception as e: + # if refresh fails, it's possible the user has re-authenticated via `gcloud auth application-default login` + # in this case, we should try to reload the credentials by clearing the cache and retrying + if "Reauthentication is needed" in str(e) and not _retry_reauth: + return self._handle_reauthentication( + credentials=credentials, + project_id=project_id, + credential_cache_key=credential_cache_key, + error=e, + ) + raise e ## VALIDATION STEP if _credentials.token is None or not isinstance(_credentials.token, str): @@ -700,6 +1017,149 @@ class VertexBase: return _credentials.token, project_id + async def get_access_token_async( + self, + credentials: Optional[VERTEX_CREDENTIALS_TYPES], + project_id: Optional[str], + ) -> Tuple[str, str]: + """ + Async version of get_access_token with single-flight refresh coordination. + + Prevents thundering herd: when credentials expire under high concurrency, + only one coroutine refreshes while others wait on the lock. Uses native + async refresh for service_account and authorized_user credentials. + """ + from google.auth.credentials import TokenState + + cache_credentials = ( + json.dumps(credentials) if isinstance(credentials, dict) else credentials + ) + credential_cache_key = (cache_credentials, project_id) + + # === FAST PATH (no lock) === + # If credentials are FRESH or STALE, return immediately without + # touching the per-key async lock. STALE tokens are still usable; + # we kick off a deduplicated background refresh so subsequent + # requests get a fresh token, but we must not serialize concurrent + # callers on the lock just to schedule that refresh. + usable = self._try_get_usable_cached_token(credential_cache_key, project_id) + if usable is not None: + cached_token, resolved_project, token_state, creds, cached_project_id = ( + usable + ) + if token_state == TokenState.STALE: + self._schedule_background_refresh( + creds, credential_cache_key, cached_project_id + ) + return cached_token, resolved_project + + # === SLOW PATH (per-key lock) === + lock = self._acquire_async_refresh_lock(credential_cache_key) + try: + async with lock: + # Double-check after acquiring lock — another coroutine may have refreshed. + cached = self._try_get_cached_token(credential_cache_key, project_id) + if cached is not None: + return cached + + _credentials, credential_project_id = self._unpack_cached_credentials( + credential_cache_key + ) + + # Load credentials if not cached + if _credentials is None: + _credentials, credential_project_id = ( + await self._load_and_cache_credentials( + credentials, project_id, credential_cache_key + ) + ) + + # Resolve project_id from credentials if not provided + if project_id is None and isinstance(credential_project_id, str): + project_id = credential_project_id + resolved_cache_key = (cache_credentials, project_id) + # Always overwrite — a pre-existing entry at the resolved + # key may reference stale credentials (e.g. from before a + # reauth that only repopulated the unresolved key), which + # would force the next request through an unnecessary + # refresh/reauth cycle. + self._credentials_project_mapping[resolved_cache_key] = ( + _credentials, + credential_project_id, + ) + + # Use google-auth's token_state to decide refresh strategy: + # - STALE: token is usable but within REFRESH_THRESHOLD (3:45) of + # expiry — return it immediately and refresh in the background. + # - INVALID: token is expired or missing — must block on refresh. + token_state = self._get_token_state(_credentials) + + if token_state == TokenState.STALE: + if project_id is None: + raise ValueError("Could not resolve project_id") + current_token = _credentials.token + if current_token is None or not isinstance(current_token, str): + # Token is malformed despite STALE state — block on a full + # refresh using the same path as INVALID credentials. + token_state = TokenState.INVALID + else: + self._schedule_background_refresh( + _credentials, + credential_cache_key, + credential_project_id, + ) + return current_token, project_id + + if token_state == TokenState.INVALID: + # Drain any in-flight background refresh before invoking + # refresh_auth ourselves; google-auth's + # Credentials.refresh() is not safe to call concurrently + # on the same credentials object, and the background task + # runs outside this lock. + await self._await_in_flight_background_refresh(credential_cache_key) + cached = self._try_get_cached_token( + credential_cache_key, project_id + ) + if cached is not None: + return cached + + # Token is expired or missing — must block until refresh completes. + try: + verbose_logger.debug("Credentials expired, refreshing") + await asyncify(self.refresh_auth)(_credentials) + self._credentials_project_mapping[credential_cache_key] = ( + _credentials, + credential_project_id, + ) + except Exception as e: + if "Reauthentication is needed" in str(e): + verbose_logger.debug( + "Reauthentication needed, clearing cache and retrying" + ) + return await self._handle_reauthentication_async( + credentials=credentials, + project_id=project_id, + credential_cache_key=credential_cache_key, + error=e, + ) + raise + + # Final validation + if _credentials.token is None or not isinstance( + _credentials.token, str + ): + raise ValueError( + "Could not resolve credentials token. Got None or non-string token (type={})".format( + type(_credentials.token).__name__ + ) + ) + if project_id is None: + raise ValueError("Could not resolve project_id") + + return _credentials.token, project_id + finally: + self._release_async_refresh_lock(credential_cache_key, lock) + async def _ensure_access_token_async( self, credentials: Optional[VERTEX_CREDENTIALS_TYPES], @@ -714,13 +1174,10 @@ class VertexBase: if custom_llm_provider == "gemini": return "", "" else: - try: - return await asyncify(self.get_access_token)( - credentials=credentials, - project_id=project_id, - ) - except Exception as e: - raise e + return await self.get_access_token_async( + credentials=credentials, + project_id=project_id, + ) def set_headers( self, auth_header: Optional[str], extra_headers: Optional[dict] diff --git a/litellm/llms/vertex_ai/vertex_model_garden/main.py b/litellm/llms/vertex_ai/vertex_model_garden/main.py index 7240d9dce57..732d5f90dc2 100644 --- a/litellm/llms/vertex_ai/vertex_model_garden/main.py +++ b/litellm/llms/vertex_ai/vertex_model_garden/main.py @@ -57,7 +57,7 @@ def create_vertex_url( class VertexAIModelGardenModels(VertexBase): def __init__(self) -> None: - pass + super().__init__() def completion( self, @@ -89,9 +89,6 @@ class VertexAIModelGardenModels(VertexBase): import vertexai from litellm.llms.openai_like.chat.handler import OpenAILikeChatHandler - from litellm.llms.vertex_ai.gemini.vertex_and_google_ai_studio_gemini import ( - VertexLLM, - ) except Exception as e: raise VertexAIError( status_code=400, @@ -107,9 +104,8 @@ class VertexAIModelGardenModels(VertexBase): ) try: model = get_vertex_base_model_name(model=model) - vertex_httpx_logic = VertexLLM() - access_token, project_id = vertex_httpx_logic._ensure_access_token( + access_token, project_id = self._ensure_access_token( credentials=vertex_credentials, project_id=vertex_project, custom_llm_provider="vertex_ai", diff --git a/litellm/llms/vllm/completion/transformation.py b/litellm/llms/vllm/completion/transformation.py index ec4c07e95d8..e03b07f9897 100644 --- a/litellm/llms/vllm/completion/transformation.py +++ b/litellm/llms/vllm/completion/transformation.py @@ -1,5 +1,5 @@ """ -Translates from OpenAI's `/v1/chat/completions` to the VLLM sdk `llm.generate`. +Translates from OpenAI's `/v1/chat/completions` to the VLLM sdk `llm.generate`. NOT RECOMMENDED FOR PRODUCTION USE. Use `hosted_vllm/` instead. """ diff --git a/litellm/llms/voyage/embedding/transformation_contextual.py b/litellm/llms/voyage/embedding/transformation_contextual.py index 40328062e09..1f5ca99f47d 100644 --- a/litellm/llms/voyage/embedding/transformation_contextual.py +++ b/litellm/llms/voyage/embedding/transformation_contextual.py @@ -1,6 +1,6 @@ """ -This module is used to transform the request and response for the Voyage contextualized embeddings API. -This would be used for all the contextualized embeddings models in Voyage. +This module is used to transform the request and response for the Voyage contextualized embeddings API. +This would be used for all the contextualized embeddings models in Voyage. """ from typing import List, Optional, Union diff --git a/litellm/llms/xai/chat/transformation.py b/litellm/llms/xai/chat/transformation.py index 6300868a641..7325c0596a6 100644 --- a/litellm/llms/xai/chat/transformation.py +++ b/litellm/llms/xai/chat/transformation.py @@ -1,4 +1,4 @@ -from typing import Any, AsyncIterator, Iterator, List, Optional, Tuple, Union +from typing import Any, AsyncIterator, Dict, Iterator, List, Optional, Tuple, Union import httpx @@ -26,6 +26,7 @@ from ...openai.chat.gpt_transformation import ( class XAIChatConfig(OpenAIGPTConfig): + @property def custom_llm_provider(self) -> Optional[str]: return "xai" @@ -225,21 +226,57 @@ class XAIChatConfig(OpenAIGPTConfig): verbose_logger.debug(f"Error extracting X.AI web search usage: {e}") self._fold_reasoning_tokens_into_completion(response) + self._normalize_openai_compatible_usage_totals(getattr(response, "usage", None)) return response @staticmethod - def _fold_reasoning_tokens_into_completion(model_response: ModelResponse) -> None: + def _fold_reasoning_tokens_into_completion( + target: Union[ModelResponse, Usage, Dict[str, Any], None], + ) -> None: """Reconcile xAI Usage to the OpenAI invariant. xAI accounts ``reasoning_tokens`` separately from ``completion_tokens`` while still summing them into ``total_tokens``. OpenAI's contract (o1/o3) folds reasoning into ``completion_tokens``, so fold here to keep ``total = prompt + completion``. Idempotent. + + Accepts a ``ModelResponse`` (non-streaming), a ``Usage`` object, or a + raw usage ``dict`` (streaming chunk) so streaming and non-streaming + paths stay in sync. """ - usage = getattr(model_response, "usage", None) + if target is None: + return + + if isinstance(target, ModelResponse): + usage: Union[Usage, Dict[str, Any], None] = getattr(target, "usage", None) + else: + usage = target if usage is None: return + if isinstance(usage, dict): + details = usage.get("completion_tokens_details") or {} + if isinstance(details, dict): + reasoning_tokens = int(details.get("reasoning_tokens") or 0) + else: + reasoning_tokens = int(getattr(details, "reasoning_tokens", 0) or 0) + if reasoning_tokens <= 0: + return + + prompt_tokens = int(usage.get("prompt_tokens") or 0) + completion_tokens = int(usage.get("completion_tokens") or 0) + total_tokens = int(usage.get("total_tokens") or 0) + + if total_tokens == prompt_tokens + completion_tokens: + return + + # Guard against double-counting if xAI changes accounting. + if total_tokens != prompt_tokens + completion_tokens + reasoning_tokens: + return + + usage["completion_tokens"] = completion_tokens + reasoning_tokens + return + details = getattr(usage, "completion_tokens_details", None) reasoning_tokens = ( int(getattr(details, "reasoning_tokens", 0) or 0) if details else 0 @@ -284,6 +321,25 @@ class XAIChatConfig(OpenAIGPTConfig): setattr(usage, "num_sources_used", int(num_sources_used)) verbose_logger.debug(f"X.AI web search sources used: {num_sources_used}") + @staticmethod + def _normalize_openai_compatible_usage_totals( + usage: Union[Usage, Dict[str, Any], None], + ) -> None: + if usage is None: + return + if isinstance(usage, dict): + prompt_tokens = int(usage.get("prompt_tokens") or 0) + completion_tokens = int(usage.get("completion_tokens") or 0) + expected_total = prompt_tokens + completion_tokens + if int(usage.get("total_tokens") or 0) < expected_total: + usage["total_tokens"] = expected_total + return + prompt_tokens = int(usage.prompt_tokens or 0) + completion_tokens = int(usage.completion_tokens or 0) + expected_total = prompt_tokens + completion_tokens + if int(usage.total_tokens or 0) < expected_total: + usage.total_tokens = expected_total + class XAIChatCompletionStreamingHandler(OpenAIChatCompletionStreamingHandler): def chunk_parser(self, chunk: dict) -> ModelResponseStream: @@ -304,4 +360,8 @@ class XAIChatCompletionStreamingHandler(OpenAIChatCompletionStreamingHandler): # Add a dummy choice with empty delta to ensure proper processing chunk["choices"] = [{"index": 0, "delta": {}, "finish_reason": None}] + if "usage" in chunk and chunk["usage"] is not None: + XAIChatConfig._fold_reasoning_tokens_into_completion(chunk["usage"]) + XAIChatConfig._normalize_openai_compatible_usage_totals(chunk["usage"]) + return super().chunk_parser(chunk) diff --git a/litellm/main.py b/litellm/main.py index 3e31ab04ee1..09c70998cf7 100644 --- a/litellm/main.py +++ b/litellm/main.py @@ -1,3 +1,5 @@ +# LiteLLM main module: public completion, embedding, streaming, and moderation entrypoints. +# # +-----------------------------------------------+ # | | # | Give Feedback / Get Help | @@ -59,7 +61,13 @@ import litellm from litellm import client # Other utils are imported directly to avoid circular imports -from litellm.utils import exception_type, get_litellm_params, get_optional_params +from litellm.utils import ( + exception_type, + get_litellm_params, + get_optional_params, + peek_reasoning_summary_aliases, + strip_reasoning_summary_aliases_from_optional_params, +) # Logging is imported lazily when needed to avoid loading litellm_logging at import time if TYPE_CHECKING: @@ -946,6 +954,7 @@ def responses_api_bridge_check( web_search_options: Optional[OpenAIWebSearchOptions] = None, tools: Optional[List[Any]] = None, reasoning_effort: Optional[Any] = None, + reasoning_summary: Optional[Any] = None, ) -> Tuple[dict, str]: model_info: Dict[str, Any] = {} @@ -982,14 +991,23 @@ def responses_api_bridge_check( mode = "responses" model_info["mode"] = mode - # OpenAI/Azure gpt-5.4+ chat-completions calls with both tools + reasoning_effort - # must be bridged to Responses API. + # OpenAI/Azure GPT-5 chat-completions that need Responses-only fields (e.g. + # ``reasoningSummary`` in ``extra_body``) must be bridged; Chat Completions rejects + # those keys. + # + # - gpt-5.4+: tools + reasoning_effort (original) or any reasoning-summary alias. + # - Older GPT-5 names (e.g. ``gpt-5``, ``gpt-5.1``): bridge only when a reasoning + # summary alias is present with ``reasoning_effort`` (tools alone stay on chat). if ( custom_llm_provider in ("openai", "azure") - and OpenAIGPT5Config.is_model_gpt_5_4_plus_model(model) - and tools - and reasoning_effort is not None and model_info.get("mode") != "responses" + and OpenAIGPT5Config.is_model_gpt_5_model(model) + and not OpenAIGPT5Config.is_model_gpt_5_search_model(model) + and reasoning_effort is not None + and ( + reasoning_summary is not None + or (OpenAIGPT5Config.is_model_gpt_5_4_plus_model(model) and tools) + ) ): model_info["mode"] = "responses" model = model.replace("responses/", "") @@ -1459,21 +1477,23 @@ def completion( # type: ignore # noqa: PLR0915 if eos_token: custom_prompt_dict[model]["eos_token"] = eos_token - if kwargs.get("model_file_id_mapping"): - messages = update_messages_with_model_file_ids( - messages=messages, - model_id=kwargs.get("model_info", {}).get("id", None), - model_file_id_mapping=cast( - Dict[str, Dict[str, str]], kwargs.get("model_file_id_mapping") - ), - ) + messages = update_messages_with_model_file_ids( + messages=messages, + model_id=kwargs.get("model_info", {}).get("id", None), + model_file_id_mapping=cast( + Dict[str, Dict[str, str]], + kwargs.get("model_file_id_mapping") or {}, + ), + ) provider_config: Optional[BaseConfig] = None if custom_llm_provider is not None and custom_llm_provider in [ provider.value for provider in LlmProviders ]: provider_config = ProviderConfigManager.get_provider_chat_config( - model=model, provider=LlmProviders(custom_llm_provider) + model=model, + provider=LlmProviders(custom_llm_provider), + base_model=base_model, ) if provider_config is not None: @@ -1510,7 +1530,11 @@ def completion( # type: ignore # noqa: PLR0915 "logit_bias": logit_bias, "user": user, # params to identify the model - "model": model, + "model": ( + model_info.get("base_model") + if isinstance(model_info, dict) and model_info.get("base_model") + else model + ), "custom_llm_provider": custom_llm_provider, "response_format": response_format, "seed": seed, @@ -1528,6 +1552,7 @@ def completion( # type: ignore # noqa: PLR0915 "safety_identifier": safety_identifier, "service_tier": service_tier, "allowed_openai_params": kwargs.get("allowed_openai_params"), + "base_model": base_model, } optional_params = get_optional_params( **optional_param_args, **non_default_params @@ -1634,8 +1659,10 @@ def completion( # type: ignore # noqa: PLR0915 ## RESPONSES API BRIDGE LOGIC ## - check if model has 'mode: responses' in litellm.model_cost map # Only run the second bridge check if the first one didn't already # detect responses mode (e.g. via the "responses/" prefix). The second - # check handles cases like gpt-5.4+ with tools+reasoning_effort that - # the first (early) check doesn't cover. + # check handles cases like gpt-5.4+ with tools+reasoning_effort or + # reasoningSummary/reasoning_summary without tools (AI SDK) that the first + # (early) check doesn't cover. + _reasoning_summary_for_bridge = peek_reasoning_summary_aliases(optional_params) if responses_api_model_info.get("mode") != "responses": responses_api_model_info, model = responses_api_bridge_check( model=model, @@ -1643,14 +1670,33 @@ def completion( # type: ignore # noqa: PLR0915 web_search_options=web_search_options, tools=tools, reasoning_effort=reasoning_effort, + reasoning_summary=_reasoning_summary_for_bridge, ) + # Use base_model (the true underlying model) for Azure model-type + # detection when the deployment name differs from the model name. + _azure_detection_model = base_model or model + if responses_api_model_info.get("mode") == "responses": from litellm.completion_extras import responses_api_bridge + optional_params, rs_val = ( + strip_reasoning_summary_aliases_from_optional_params(optional_params) + ) + if isinstance(reasoning_effort, dict) and "summary" in reasoning_effort: - optional_params = dict(optional_params) optional_params["reasoning_effort"] = reasoning_effort + elif rs_val is not None: + eff = optional_params.get("reasoning_effort", reasoning_effort) + if isinstance(eff, dict): + optional_params["reasoning_effort"] = {**eff, "summary": rs_val} + elif eff is not None: + optional_params["reasoning_effort"] = { + "effort": eff, + "summary": rs_val, + } + else: + optional_params["reasoning_effort"] = {"summary": rs_val} return responses_api_bridge.completion( model=model, @@ -1669,6 +1715,18 @@ def completion( # type: ignore # noqa: PLR0915 encoding=_get_encoding(), stream=stream, ) + elif ( + custom_llm_provider == "openai" + and OpenAIGPT5Config.is_model_gpt_5_model(model) + ) or ( + custom_llm_provider == "azure" + and litellm.AzureOpenAIGPT5Config.is_model_gpt_5_model( + _azure_detection_model + ) + ): + optional_params, _ = strip_reasoning_summary_aliases_from_optional_params( + optional_params + ) if custom_llm_provider == "azure": # azure configs @@ -1717,7 +1775,9 @@ def completion( # type: ignore # noqa: PLR0915 if max_retries is not None: optional_params["max_retries"] = max_retries - if litellm.AzureOpenAIO1Config().is_o_series_model(model=model): + if litellm.AzureOpenAIO1Config().is_o_series_model( + model=_azure_detection_model + ): ## LOAD CONFIG - if set config = litellm.AzureOpenAIO1Config.get_config() for k, v in config.items(): @@ -3813,7 +3873,33 @@ def completion( # type: ignore # noqa: PLR0915 ) bedrock_route = BedrockModelInfo.get_bedrock_route(model) - if bedrock_route == "converse": + if bedrock_route == "claude_platform": + provider_config = ProviderConfigManager.get_provider_chat_config( + model=model, + provider=LlmProviders.BEDROCK, + ) + model = BedrockModelInfo.get_claude_platform_model(model) + response = base_llm_http_handler.completion( + model=model, + stream=stream, + messages=messages, + acompletion=acompletion, + api_base=api_base, + model_response=model_response, + optional_params=optional_params, + litellm_params=litellm_params, + shared_session=shared_session, + custom_llm_provider="bedrock", + timeout=timeout, + headers=headers, + encoding=_get_encoding(), + api_key=api_key, + logging_obj=logging, + client=client, + provider_config=provider_config, + ) + return response + elif bedrock_route == "converse": model = model.replace("converse/", "") response = bedrock_converse_chat_completion.completion( model=model, @@ -5041,6 +5127,24 @@ def embedding( # noqa: PLR0915 client=client, aembedding=aembedding, ) + elif custom_llm_provider == "oci": + if headers is None: + headers = {} + response = base_llm_http_handler.embedding( + model=model, + input=input, + custom_llm_provider=custom_llm_provider, + api_base=api_base, + api_key=api_key, + logging_obj=logging, + timeout=timeout, + model_response=EmbeddingResponse(), + optional_params=optional_params, + client=client, + aembedding=aembedding, + litellm_params=litellm_params_dict, + headers=headers, + ) elif custom_llm_provider == "cohere" or custom_llm_provider == "cohere_chat": cohere_key = ( api_key @@ -5645,6 +5749,33 @@ def embedding( # noqa: PLR0915 aembedding=aembedding, headers=headers, ) + elif custom_llm_provider == "dashscope": + dashscope_key = ( + api_key or litellm.api_key or get_secret_str("DASHSCOPE_API_KEY") + ) + if dashscope_key is None: + raise ValueError( + "Missing API key for DashScope. Set DASHSCOPE_API_KEY environment variable or pass api_key parameter." + ) + if extra_headers is not None and isinstance(extra_headers, dict): + headers = extra_headers + else: + headers = {} + response = base_llm_http_handler.embedding( + model=model, + input=input, + timeout=timeout, + custom_llm_provider=custom_llm_provider, + logging_obj=logging, + api_base=api_base, + optional_params=optional_params, + litellm_params={}, + model_response=EmbeddingResponse(), + api_key=dashscope_key, + client=client, + aembedding=aembedding, + headers=headers, + ) elif custom_llm_provider == "ovhcloud": api_key = api_key or litellm.api_key or get_secret_str("OVHCLOUD_API_KEY") api_base = ( @@ -5694,22 +5825,6 @@ def embedding( # noqa: PLR0915 aembedding=aembedding, litellm_params={}, ) - elif custom_llm_provider == "oci": - response = base_llm_http_handler.embedding( - model=model, - input=input, - custom_llm_provider=custom_llm_provider, - api_base=api_base, - api_key=api_key, - logging_obj=logging, - timeout=timeout, - model_response=EmbeddingResponse(), - optional_params=optional_params, - client=client, - aembedding=aembedding, - litellm_params=litellm_params_dict, - headers=headers, - ) elif custom_llm_provider in litellm._custom_providers: custom_handler: Optional[CustomLLM] = None for item in litellm.custom_provider_map: @@ -6500,8 +6615,7 @@ def transcription( api_key=api_key, ) # type: ignore - if dynamic_api_key is not None: - api_key = dynamic_api_key + api_key = dynamic_api_key if dynamic_api_key is not None else api_key optional_params = get_optional_params_transcription( model=model, @@ -6541,7 +6655,7 @@ def transcription( provider=LlmProviders(custom_llm_provider), ) - if custom_llm_provider == "azure": + if custom_llm_provider == "azure" and provider_config is None: # azure configs api_base = api_base or litellm.api_base or get_secret_str("AZURE_API_BASE") diff --git a/litellm/model_prices_and_context_window_backup.json b/litellm/model_prices_and_context_window_backup.json index d609a3d1f4b..62e576ea0f7 100644 --- a/litellm/model_prices_and_context_window_backup.json +++ b/litellm/model_prices_and_context_window_backup.json @@ -1448,6 +1448,35 @@ "supports_native_structured_output": true, "supports_minimal_reasoning_effort": true }, + "jp.anthropic.claude-sonnet-4-6": { + "cache_creation_input_token_cost": 4.125e-06, + "cache_read_input_token_cost": 3.3e-07, + "input_cost_per_token": 3.3e-06, + "litellm_provider": "bedrock_converse", + "max_input_tokens": 1000000, + "max_output_tokens": 64000, + "max_tokens": 64000, + "mode": "chat", + "output_cost_per_token": 1.65e-05, + "search_context_cost_per_query": { + "search_context_size_high": 0.01, + "search_context_size_low": 0.01, + "search_context_size_medium": 0.01 + }, + "supports_assistant_prefill": true, + "supports_computer_use": true, + "supports_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_max_reasoning_effort": true, + "supports_tool_choice": true, + "supports_vision": true, + "tool_use_system_prompt_tokens": 346, + "supports_native_structured_output": true, + "supports_minimal_reasoning_effort": true + }, "anthropic.claude-sonnet-4-20250514-v1:0": { "cache_creation_input_token_cost": 3.75e-06, "cache_read_input_token_cost": 3e-07, @@ -2112,6 +2141,380 @@ "supports_response_schema": true, "supports_tool_choice": true }, + "azure_ai/gpt-5.4": { + "cache_read_input_token_cost": 2.5e-07, + "cache_read_input_token_cost_above_272k_tokens": 5e-07, + "cache_read_input_token_cost_priority": 5e-07, + "cache_read_input_token_cost_above_272k_tokens_priority": 1e-06, + "input_cost_per_token": 2.5e-06, + "input_cost_per_token_above_272k_tokens": 5e-06, + "input_cost_per_token_priority": 5e-06, + "input_cost_per_token_above_272k_tokens_priority": 1e-05, + "litellm_provider": "azure_ai", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 1.5e-05, + "output_cost_per_token_above_272k_tokens": 2.25e-05, + "output_cost_per_token_priority": 3e-05, + "output_cost_per_token_above_272k_tokens_priority": 4.5e-05, + "source": "https://ai.azure.com/catalog/models/gpt-5.4", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_service_tier": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": true + }, + "azure_ai/gpt-5.4-2026-03-05": { + "cache_read_input_token_cost": 2.5e-07, + "cache_read_input_token_cost_above_272k_tokens": 5e-07, + "cache_read_input_token_cost_priority": 5e-07, + "cache_read_input_token_cost_above_272k_tokens_priority": 1e-06, + "input_cost_per_token": 2.5e-06, + "input_cost_per_token_above_272k_tokens": 5e-06, + "input_cost_per_token_priority": 5e-06, + "input_cost_per_token_above_272k_tokens_priority": 1e-05, + "litellm_provider": "azure_ai", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 1.5e-05, + "output_cost_per_token_above_272k_tokens": 2.25e-05, + "output_cost_per_token_priority": 3e-05, + "output_cost_per_token_above_272k_tokens_priority": 4.5e-05, + "source": "https://ai.azure.com/catalog/models/gpt-5.4", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_service_tier": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": true + }, + "azure_ai/gpt-5.4-pro": { + "cache_read_input_token_cost": 3e-06, + "cache_read_input_token_cost_above_272k_tokens": 6e-06, + "cache_read_input_token_cost_priority": 6e-06, + "cache_read_input_token_cost_above_272k_tokens_priority": 1.2e-05, + "input_cost_per_token": 3e-05, + "input_cost_per_token_above_272k_tokens": 6e-05, + "input_cost_per_token_priority": 6e-05, + "input_cost_per_token_above_272k_tokens_priority": 0.00012, + "litellm_provider": "azure_ai", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "output_cost_per_token": 0.00018, + "output_cost_per_token_above_272k_tokens": 0.00027, + "output_cost_per_token_priority": 0.00036, + "output_cost_per_token_above_272k_tokens_priority": 0.00054, + "source": "https://ai.azure.com/catalog/models/gpt-5.4-pro", + "supported_endpoints": [ + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": false, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_service_tier": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": false, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": true + }, + "azure_ai/gpt-5.4-pro-2026-03-05": { + "cache_read_input_token_cost": 3e-06, + "cache_read_input_token_cost_above_272k_tokens": 6e-06, + "cache_read_input_token_cost_priority": 6e-06, + "cache_read_input_token_cost_above_272k_tokens_priority": 1.2e-05, + "input_cost_per_token": 3e-05, + "input_cost_per_token_above_272k_tokens": 6e-05, + "input_cost_per_token_priority": 6e-05, + "input_cost_per_token_above_272k_tokens_priority": 0.00012, + "litellm_provider": "azure_ai", + "max_input_tokens": 1050000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "responses", + "output_cost_per_token": 0.00018, + "output_cost_per_token_above_272k_tokens": 0.00027, + "output_cost_per_token_priority": 0.00036, + "output_cost_per_token_above_272k_tokens_priority": 0.00054, + "source": "https://ai.azure.com/catalog/models/gpt-5.4-pro", + "supported_endpoints": [ + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": false, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_service_tier": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": false, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": true + }, + "azure_ai/gpt-5.4-mini": { + "cache_read_input_token_cost": 7.5e-08, + "cache_read_input_token_cost_above_272k_tokens": 1.5e-07, + "cache_read_input_token_cost_priority": 1.5e-07, + "cache_read_input_token_cost_above_272k_tokens_priority": 3e-07, + "input_cost_per_token": 7.5e-07, + "input_cost_per_token_above_272k_tokens": 1.5e-06, + "input_cost_per_token_priority": 1.5e-06, + "input_cost_per_token_above_272k_tokens_priority": 3e-06, + "litellm_provider": "azure_ai", + "max_input_tokens": 400000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 4.5e-06, + "output_cost_per_token_above_272k_tokens": 6.75e-06, + "output_cost_per_token_priority": 9e-06, + "output_cost_per_token_above_272k_tokens_priority": 1.35e-05, + "source": "https://ai.azure.com/catalog/models/gpt-5.4-mini", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_service_tier": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure_ai/gpt-5.4-mini-2026-03-17": { + "cache_read_input_token_cost": 7.5e-08, + "cache_read_input_token_cost_above_272k_tokens": 1.5e-07, + "cache_read_input_token_cost_priority": 1.5e-07, + "cache_read_input_token_cost_above_272k_tokens_priority": 3e-07, + "input_cost_per_token": 7.5e-07, + "input_cost_per_token_above_272k_tokens": 1.5e-06, + "input_cost_per_token_priority": 1.5e-06, + "input_cost_per_token_above_272k_tokens_priority": 3e-06, + "litellm_provider": "azure_ai", + "max_input_tokens": 400000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 4.5e-06, + "output_cost_per_token_above_272k_tokens": 6.75e-06, + "output_cost_per_token_priority": 9e-06, + "output_cost_per_token_above_272k_tokens_priority": 1.35e-05, + "source": "https://ai.azure.com/catalog/models/gpt-5.4-mini", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_service_tier": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure_ai/gpt-5.4-nano": { + "cache_read_input_token_cost": 2e-08, + "cache_read_input_token_cost_above_272k_tokens": 4e-08, + "cache_read_input_token_cost_priority": 4e-08, + "cache_read_input_token_cost_above_272k_tokens_priority": 8e-08, + "input_cost_per_token": 2e-07, + "input_cost_per_token_above_272k_tokens": 4e-07, + "input_cost_per_token_priority": 4e-07, + "input_cost_per_token_above_272k_tokens_priority": 8e-07, + "litellm_provider": "azure_ai", + "max_input_tokens": 400000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 1.25e-06, + "output_cost_per_token_above_272k_tokens": 1.875e-06, + "output_cost_per_token_priority": 2.5e-06, + "output_cost_per_token_above_272k_tokens_priority": 3.75e-06, + "source": "https://ai.azure.com/catalog/models/gpt-5.4-nano", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_service_tier": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, + "azure_ai/gpt-5.4-nano-2026-03-17": { + "cache_read_input_token_cost": 2e-08, + "cache_read_input_token_cost_above_272k_tokens": 4e-08, + "cache_read_input_token_cost_priority": 4e-08, + "cache_read_input_token_cost_above_272k_tokens_priority": 8e-08, + "input_cost_per_token": 2e-07, + "input_cost_per_token_above_272k_tokens": 4e-07, + "input_cost_per_token_priority": 4e-07, + "input_cost_per_token_above_272k_tokens_priority": 8e-07, + "litellm_provider": "azure_ai", + "max_input_tokens": 400000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 1.25e-06, + "output_cost_per_token_above_272k_tokens": 1.875e-06, + "output_cost_per_token_priority": 2.5e-06, + "output_cost_per_token_above_272k_tokens_priority": 3.75e-06, + "source": "https://ai.azure.com/catalog/models/gpt-5.4-nano", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/batch", + "/v1/responses" + ], + "supported_modalities": [ + "text", + "image" + ], + "supported_output_modalities": [ + "text" + ], + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_service_tier": true, + "supports_vision": true, + "supports_web_search": true, + "supports_none_reasoning_effort": true, + "supports_xhigh_reasoning_effort": true, + "supports_minimal_reasoning_effort": false + }, "azure_ai/model_router": { "input_cost_per_token": 1.4e-07, "output_cost_per_token": 0, @@ -3521,7 +3924,7 @@ "supports_tool_choice": true }, "azure/gpt-4o-mini-transcribe": { - "input_cost_per_audio_token": 3e-06, + "input_cost_per_audio_token": 1.25e-06, "input_cost_per_token": 1.25e-06, "litellm_provider": "azure", "max_input_tokens": 16000, @@ -3596,7 +3999,7 @@ "supports_tool_choice": true }, "azure/gpt-4o-transcribe": { - "input_cost_per_audio_token": 6e-06, + "input_cost_per_audio_token": 2.5e-06, "input_cost_per_token": 2.5e-06, "litellm_provider": "azure", "max_input_tokens": 16000, @@ -3608,7 +4011,7 @@ ] }, "azure/gpt-4o-transcribe-diarize": { - "input_cost_per_audio_token": 6e-06, + "input_cost_per_audio_token": 2.5e-06, "input_cost_per_token": 2.5e-06, "litellm_provider": "azure", "max_input_tokens": 16000, @@ -5651,6 +6054,17 @@ "mode": "audio_speech", "source": "https://azure.microsoft.com/en-us/pricing/calculator/" }, + "azure/speech/azure-stt": { + "audio_transcription_config": "azure_speech", + "input_cost_per_second": 0.0002777778, + "litellm_provider": "azure", + "mode": "audio_transcription", + "output_cost_per_second": 0.0, + "source": "https://azure.microsoft.com/en-us/pricing/details/cognitive-services/speech-services/", + "supported_endpoints": [ + "/v1/audio/transcriptions" + ] + }, "azure/tts-1": { "input_cost_per_character": 1.5e-05, "litellm_provider": "azure", @@ -8974,7 +9388,7 @@ "supports_vision": true }, "gpt-4o-transcribe-diarize": { - "input_cost_per_audio_token": 6e-06, + "input_cost_per_audio_token": 2.5e-06, "input_cost_per_token": 2.5e-06, "litellm_provider": "openai", "max_input_tokens": 16000, @@ -9228,6 +9642,7 @@ "search_context_size_low": 0.01, "search_context_size_medium": 0.01 }, + "supports_adaptive_thinking": true, "supports_assistant_prefill": true, "supports_computer_use": true, "supports_function_calling": true, @@ -9421,6 +9836,7 @@ "search_context_size_low": 0.01, "search_context_size_medium": 0.01 }, + "supports_adaptive_thinking": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -9454,6 +9870,7 @@ "search_context_size_low": 0.01, "search_context_size_medium": 0.01 }, + "supports_adaptive_thinking": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -9487,6 +9904,7 @@ "search_context_size_low": 0.01, "search_context_size_medium": 0.01 }, + "supports_adaptive_thinking": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -9521,6 +9939,7 @@ "search_context_size_low": 0.01, "search_context_size_medium": 0.01 }, + "supports_adaptive_thinking": true, "supports_assistant_prefill": false, "supports_computer_use": true, "supports_function_calling": true, @@ -13574,6 +13993,21 @@ "supports_response_schema": true, "supports_tool_choice": true }, + "fireworks_ai/accounts/fireworks/models/glm-5p1": { + "cache_read_input_token_cost": 2.6e-07, + "input_cost_per_token": 1.4e-06, + "litellm_provider": "fireworks_ai", + "max_input_tokens": 202800, + "max_output_tokens": 202800, + "max_tokens": 202800, + "mode": "chat", + "output_cost_per_token": 4.4e-06, + "source": "https://fireworks.ai/models/fireworks/glm-5p1", + "supports_function_calling": false, + "supports_reasoning": true, + "supports_response_schema": false, + "supports_tool_choice": false + }, "fireworks_ai/accounts/fireworks/models/gpt-oss-120b": { "input_cost_per_token": 1.5e-07, "litellm_provider": "fireworks_ai", @@ -13840,6 +14274,21 @@ "supports_response_schema": true, "supports_tool_choice": true }, + "fireworks_ai/glm-5p1": { + "cache_read_input_token_cost": 2.6e-07, + "input_cost_per_token": 1.4e-06, + "litellm_provider": "fireworks_ai", + "max_input_tokens": 202800, + "max_output_tokens": 202800, + "max_tokens": 202800, + "mode": "chat", + "output_cost_per_token": 4.4e-06, + "source": "https://fireworks.ai/models/fireworks/glm-5p1", + "supports_function_calling": false, + "supports_reasoning": true, + "supports_response_schema": false, + "supports_tool_choice": false + }, "fireworks_ai/kimi-k2p5": { "cache_read_input_token_cost": 1e-07, "input_cost_per_token": 6e-07, @@ -14509,7 +14958,65 @@ "mode": "chat", "output_cost_per_reasoning_token": 1.5e-06, "output_cost_per_token": 1.5e-06, - "source": "https://ai.google.dev/gemini-api/docs/models", + "source": "https://cloud.google.com/vertex-ai/generative-ai/pricing#gemini-models", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_input": true, + "supports_audio_output": false, + "supports_code_execution": true, + "supports_file_search": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query", + "supports_service_tier": true + }, + "gemini-3.1-flash-lite": { + "cache_read_input_token_cost": 4.5e-08, + "cache_read_input_token_cost_per_audio_token": 9e-08, + "input_cost_per_audio_token": 9e-07, + "input_cost_per_token": 4.5e-07, + "litellm_provider": "vertex_ai-language-models", + "max_audio_length_hours": 8.4, + "max_audio_per_prompt": 1, + "max_images_per_prompt": 3000, + "max_input_tokens": 1048576, + "max_output_tokens": 65536, + "max_pdf_size_mb": 30, + "max_tokens": 65536, + "max_video_length": 1, + "max_videos_per_prompt": 10, + "mode": "chat", + "output_cost_per_reasoning_token": 2.7e-06, + "output_cost_per_token": 2.7e-06, + "source": "https://cloud.google.com/vertex-ai/generative-ai/pricing#gemini-models", "supported_endpoints": [ "/v1/chat/completions", "/v1/completions", @@ -15237,6 +15744,64 @@ }, "web_search_billing_unit": "per_query" }, + "vertex_ai/gemini-3.5-flash": { + "cache_read_input_token_cost": 1.5e-07, + "input_cost_per_token": 1.5e-06, + "input_cost_per_audio_token": 1e-06, + "litellm_provider": "vertex_ai", + "max_audio_length_hours": 8.4, + "max_audio_per_prompt": 1, + "max_images_per_prompt": 3000, + "max_input_tokens": 1048576, + "max_output_tokens": 65535, + "max_pdf_size_mb": 30, + "max_tokens": 65535, + "max_video_length": 1, + "max_videos_per_prompt": 10, + "mode": "chat", + "output_cost_per_reasoning_token": 9e-06, + "output_cost_per_token": 9e-06, + "source": "https://cloud.google.com/vertex-ai/generative-ai/pricing", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_input": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "input_cost_per_token_priority": 2.7e-06, + "input_cost_per_audio_token_priority": 1.8e-06, + "output_cost_per_token_priority": 1.62e-05, + "cache_read_input_token_cost_priority": 2.7e-07, + "supports_service_tier": true, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, "vertex_ai/gemini-3.1-pro-preview": { "cache_read_input_token_cost": 2e-07, "cache_read_input_token_cost_above_200k_tokens": 4e-07, @@ -15551,14 +16116,17 @@ "uses_embed_content": true }, "vertex_ai/gemini-embedding-2-preview": { - "input_cost_per_token": 1.5e-07, + "input_cost_per_audio_per_second": 0.00016, + "input_cost_per_image": 0.00012, + "input_cost_per_token": 2e-07, + "input_cost_per_video_per_second": 0.00079, "litellm_provider": "vertex_ai", "max_input_tokens": 8192, "max_tokens": 8192, "mode": "embedding", "output_cost_per_token": 0, "output_vector_size": 3072, - "source": "https://ai.google.dev/gemini-api/docs/embeddings#multimodal", + "source": "https://cloud.google.com/vertex-ai/generative-ai/pricing", "supports_multimodal": true, "uses_embed_content": true }, @@ -15573,7 +16141,7 @@ "mode": "embedding", "output_cost_per_token": 0, "output_vector_size": 3072, - "source": "https://ai.google.dev/gemini-api/docs/embeddings#multimodal", + "source": "https://cloud.google.com/vertex-ai/generative-ai/pricing", "supports_multimodal": true, "uses_embed_content": true }, @@ -16552,6 +17120,66 @@ "web_search_billing_unit": "per_query", "supports_service_tier": true }, + "gemini/gemini-3.1-flash-lite": { + "cache_read_input_token_cost": 4.5e-08, + "cache_read_input_token_cost_per_audio_token": 9e-08, + "input_cost_per_audio_token": 9e-07, + "input_cost_per_token": 4.5e-07, + "litellm_provider": "gemini", + "max_audio_length_hours": 8.4, + "max_audio_per_prompt": 1, + "max_images_per_prompt": 3000, + "max_input_tokens": 1048576, + "max_output_tokens": 65536, + "max_pdf_size_mb": 30, + "max_tokens": 65536, + "max_video_length": 1, + "max_videos_per_prompt": 10, + "mode": "chat", + "output_cost_per_reasoning_token": 2.7e-06, + "output_cost_per_token": 2.7e-06, + "rpm": 15, + "source": "https://ai.google.dev/gemini-api/docs/pricing", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_input": true, + "supports_audio_output": false, + "supports_code_execution": true, + "supports_file_search": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "tpm": 250000, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query", + "supports_service_tier": true + }, "gemini/gemini-3-flash-preview": { "cache_read_input_token_cost": 5e-08, "input_cost_per_audio_token": 1e-06, @@ -16611,6 +17239,67 @@ }, "web_search_billing_unit": "per_query" }, + "gemini/gemini-3.5-flash": { + "cache_read_input_token_cost": 1.5e-07, + "input_cost_per_audio_token": 1e-06, + "input_cost_per_token": 1.5e-06, + "litellm_provider": "gemini", + "max_audio_length_hours": 8.4, + "max_audio_per_prompt": 1, + "max_images_per_prompt": 3000, + "max_input_tokens": 1048576, + "max_output_tokens": 65535, + "max_pdf_size_mb": 30, + "max_tokens": 65535, + "max_video_length": 1, + "max_videos_per_prompt": 10, + "mode": "chat", + "output_cost_per_reasoning_token": 9e-06, + "output_cost_per_token": 9e-06, + "rpm": 2000, + "source": "https://ai.google.dev/pricing/gemini-3", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_output": false, + "supports_audio_input": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "tpm": 800000, + "input_cost_per_token_priority": 2.7e-06, + "input_cost_per_audio_token_priority": 1.8e-06, + "output_cost_per_token_priority": 1.62e-05, + "cache_read_input_token_cost_priority": 2.7e-07, + "supports_service_tier": true, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, "gemini/gemini-3.1-pro-preview": { "cache_read_input_token_cost": 2e-07, "cache_read_input_token_cost_above_200k_tokens": 4e-07, @@ -16796,6 +17485,65 @@ }, "web_search_billing_unit": "per_query" }, + "gemini-3.5-flash": { + "cache_read_input_token_cost": 1.5e-07, + "input_cost_per_audio_token": 1e-06, + "input_cost_per_token": 1.5e-06, + "litellm_provider": "vertex_ai-language-models", + "max_audio_length_hours": 8.4, + "max_audio_per_prompt": 1, + "max_images_per_prompt": 3000, + "max_input_tokens": 1048576, + "max_output_tokens": 65535, + "max_pdf_size_mb": 30, + "max_tokens": 65535, + "max_video_length": 1, + "max_videos_per_prompt": 10, + "mode": "chat", + "output_cost_per_reasoning_token": 9e-06, + "output_cost_per_token": 9e-06, + "source": "https://ai.google.dev/pricing/gemini-3", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_output": false, + "supports_audio_input": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "input_cost_per_token_priority": 2.7e-06, + "input_cost_per_audio_token_priority": 1.8e-06, + "output_cost_per_token_priority": 1.62e-05, + "cache_read_input_token_cost_priority": 2.7e-07, + "supports_service_tier": true, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query" + }, "gemini/gemini-2.5-pro-preview-tts": { "cache_read_input_token_cost": 1.25e-07, "cache_read_input_token_cost_above_200k_tokens": 2.5e-07, @@ -18988,7 +19736,7 @@ "supports_vision": true }, "gpt-4o-mini-transcribe": { - "input_cost_per_audio_token": 3e-06, + "input_cost_per_audio_token": 1.25e-06, "input_cost_per_token": 1.25e-06, "litellm_provider": "openai", "max_input_tokens": 16000, @@ -19118,7 +19866,7 @@ "supports_vision": true }, "gpt-4o-transcribe": { - "input_cost_per_audio_token": 6e-06, + "input_cost_per_audio_token": 2.5e-06, "input_cost_per_token": 2.5e-06, "litellm_provider": "openai", "max_input_tokens": 16000, @@ -21104,6 +21852,38 @@ "supports_system_messages": true, "supports_tool_choice": true }, + "gpt-realtime-2": { + "cache_creation_input_audio_token_cost": 4e-07, + "cache_read_input_token_cost": 4e-07, + "input_cost_per_audio_token": 3.2e-05, + "input_cost_per_image": 5e-06, + "input_cost_per_token": 4e-06, + "litellm_provider": "openai", + "max_input_tokens": 32000, + "max_output_tokens": 4096, + "max_tokens": 4096, + "mode": "chat", + "output_cost_per_audio_token": 6.4e-05, + "output_cost_per_token": 1.6e-05, + "supported_endpoints": [ + "/v1/realtime" + ], + "supported_modalities": [ + "text", + "image", + "audio" + ], + "supported_output_modalities": [ + "text", + "audio" + ], + "supports_audio_input": true, + "supports_audio_output": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_system_messages": true, + "supports_tool_choice": true + }, "gpt-realtime-mini": { "cache_creation_input_audio_token_cost": 3e-07, "cache_read_input_audio_token_cost": 3e-07, @@ -23698,6 +24478,21 @@ "supports_tool_choice": true, "supports_vision": true }, + "mistral/ministral-8b-2512": { + "input_cost_per_token": 1.5e-07, + "litellm_provider": "mistral", + "max_input_tokens": 262144, + "max_output_tokens": 262144, + "max_tokens": 262144, + "mode": "chat", + "output_cost_per_token": 1.5e-07, + "source": "https://mistral.ai/pricing", + "supports_assistant_prefill": true, + "supports_function_calling": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true + }, "mistral/mistral-tiny": { "input_cost_per_token": 2.5e-07, "litellm_provider": "mistral", @@ -25513,6 +26308,51 @@ "supports_function_calling": true, "supports_response_schema": false }, + "oci/openai.gpt-5": { + "input_cost_per_token": 1.25e-06, + "litellm_provider": "oci", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 1e-05, + "source": "https://www.oracle.com/artificial-intelligence/generative-ai/generative-ai-service/pricing", + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_vision": true + }, + "oci/openai.gpt-5-mini": { + "input_cost_per_token": 2.5e-07, + "litellm_provider": "oci", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 2e-06, + "source": "https://www.oracle.com/artificial-intelligence/generative-ai/generative-ai-service/pricing", + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_vision": true + }, + "oci/openai.gpt-5-nano": { + "input_cost_per_token": 5e-08, + "litellm_provider": "oci", + "max_input_tokens": 272000, + "max_output_tokens": 128000, + "max_tokens": 128000, + "mode": "chat", + "output_cost_per_token": 4e-07, + "source": "https://www.oracle.com/artificial-intelligence/generative-ai/generative-ai-service/pricing", + "supports_function_calling": true, + "supports_native_streaming": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_vision": true + }, "oci/google.gemini-2.5-pro": { "input_cost_per_token": 1.25e-06, "litellm_provider": "oci", @@ -26542,6 +27382,58 @@ "supports_web_search": true, "tpm": 800000 }, + "openrouter/google/gemini-3.1-flash-lite": { + "cache_read_input_token_cost": 2.5e-08, + "cache_read_input_token_cost_per_audio_token": 5e-08, + "input_cost_per_audio_token": 5e-07, + "input_cost_per_token": 2.5e-07, + "litellm_provider": "openrouter", + "max_audio_length_hours": 8.4, + "max_audio_per_prompt": 1, + "max_images_per_prompt": 3000, + "max_input_tokens": 1048576, + "max_output_tokens": 65536, + "max_pdf_size_mb": 30, + "max_tokens": 65536, + "max_video_length": 1, + "max_videos_per_prompt": 10, + "mode": "chat", + "output_cost_per_reasoning_token": 1.5e-06, + "output_cost_per_token": 1.5e-06, + "rpm": 2000, + "source": "https://ai.google.dev/gemini-api/docs/pricing#gemini-3.1-flash-lite", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_input": true, + "supports_audio_output": false, + "supports_code_execution": true, + "supports_file_search": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "tpm": 800000 + }, "openrouter/google/gemini-3.1-pro-preview": { "cache_read_input_token_cost": 2e-07, "cache_read_input_token_cost_above_200k_tokens": 4e-07, @@ -27187,6 +28079,20 @@ "supports_reasoning": true, "supports_tool_choice": true }, + "openrouter/qwen/qwen3.6-plus": { + "input_cost_per_token": 3.25e-07, + "litellm_provider": "openrouter", + "max_input_tokens": 1000000, + "max_output_tokens": 65536, + "max_tokens": 65536, + "mode": "chat", + "output_cost_per_token": 1.95e-06, + "source": "https://openrouter.ai/qwen/qwen3.6-plus", + "supports_function_calling": true, + "supports_reasoning": true, + "supports_tool_choice": true, + "supports_vision": true + }, "openrouter/qwen/qwen3.5-35b-a3b": { "input_cost_per_token": 2.5e-07, "litellm_provider": "openrouter", @@ -28302,6 +29208,24 @@ "supports_tool_choice": true, "source": "https://aws.amazon.com/bedrock/pricing/" }, + "reducto/parse-legacy": { + "litellm_provider": "reducto", + "mode": "ocr", + "ocr_cost_per_credit": 0.015, + "source": "https://reducto.ai/pricing", + "supported_endpoints": [ + "/v1/ocr" + ] + }, + "reducto/parse-v3": { + "litellm_provider": "reducto", + "mode": "ocr", + "ocr_cost_per_credit": 0.015, + "source": "https://reducto.ai/pricing", + "supported_endpoints": [ + "/v1/ocr" + ] + }, "recraft/recraftv2": { "litellm_provider": "recraft", "mode": "image_generation", @@ -33004,6 +33928,64 @@ }, "web_search_billing_unit": "per_query" }, + "vertex_ai/gemini-3.1-flash-lite": { + "cache_read_input_token_cost": 4.5e-08, + "cache_read_input_token_cost_per_audio_token": 9e-08, + "input_cost_per_audio_token": 9e-07, + "input_cost_per_token": 4.5e-07, + "litellm_provider": "vertex_ai-language-models", + "max_audio_length_hours": 8.4, + "max_audio_per_prompt": 1, + "max_images_per_prompt": 3000, + "max_input_tokens": 1048576, + "max_output_tokens": 65536, + "max_pdf_size_mb": 30, + "max_tokens": 65536, + "max_video_length": 1, + "max_videos_per_prompt": 10, + "mode": "chat", + "output_cost_per_reasoning_token": 2.7e-06, + "output_cost_per_token": 2.7e-06, + "source": "https://cloud.google.com/vertex-ai/generative-ai/pricing#gemini-models", + "supported_endpoints": [ + "/v1/chat/completions", + "/v1/completions", + "/v1/batch" + ], + "supported_modalities": [ + "text", + "image", + "audio", + "video" + ], + "supported_output_modalities": [ + "text" + ], + "supports_audio_input": true, + "supports_audio_output": false, + "supports_code_execution": true, + "supports_file_search": true, + "supports_function_calling": true, + "supports_parallel_function_calling": true, + "supports_pdf_input": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_system_messages": true, + "supports_tool_choice": true, + "supports_url_context": true, + "supports_video_input": true, + "supports_vision": true, + "supports_web_search": true, + "supports_native_streaming": true, + "search_context_cost_per_query": { + "search_context_size_low": 0.014, + "search_context_size_medium": 0.014, + "search_context_size_high": 0.014 + }, + "web_search_billing_unit": "per_query", + "supports_service_tier": true + }, "vertex_ai/deep-research-pro-preview-12-2025": { "input_cost_per_image": 0.0011, "input_cost_per_token": 2e-06, @@ -34940,6 +35922,48 @@ "supports_vision": true, "supports_web_search": true }, + "xai/grok-4.3": { + "cache_read_input_token_cost": 2e-07, + "cache_read_input_token_cost_above_200k_tokens": 4e-07, + "input_cost_per_token": 1.25e-06, + "input_cost_per_token_above_200k_tokens": 2.5e-06, + "litellm_provider": "xai", + "max_input_tokens": 1000000, + "max_output_tokens": 1000000, + "max_tokens": 1000000, + "mode": "chat", + "output_cost_per_token": 2.5e-06, + "output_cost_per_token_above_200k_tokens": 5e-06, + "source": "https://docs.x.ai/docs/models", + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true + }, + "xai/grok-4.3-latest": { + "cache_read_input_token_cost": 2e-07, + "cache_read_input_token_cost_above_200k_tokens": 4e-07, + "input_cost_per_token": 1.25e-06, + "input_cost_per_token_above_200k_tokens": 2.5e-06, + "litellm_provider": "xai", + "max_input_tokens": 1000000, + "max_output_tokens": 1000000, + "max_tokens": 1000000, + "mode": "chat", + "output_cost_per_token": 2.5e-06, + "output_cost_per_token_above_200k_tokens": 5e-06, + "source": "https://docs.x.ai/docs/models", + "supports_function_calling": true, + "supports_prompt_caching": true, + "supports_reasoning": true, + "supports_response_schema": true, + "supports_tool_choice": true, + "supports_vision": true, + "supports_web_search": true + }, "xai/grok-beta": { "input_cost_per_token": 5e-06, "litellm_provider": "xai", @@ -38842,7 +39866,7 @@ ] }, "gpt-4o-mini-transcribe-2025-03-20": { - "input_cost_per_audio_token": 3e-06, + "input_cost_per_audio_token": 1.25e-06, "input_cost_per_token": 1.25e-06, "litellm_provider": "openai", "max_input_tokens": 16000, @@ -38854,7 +39878,7 @@ ] }, "gpt-4o-mini-transcribe-2025-12-15": { - "input_cost_per_audio_token": 3e-06, + "input_cost_per_audio_token": 1.25e-06, "input_cost_per_token": 1.25e-06, "litellm_provider": "openai", "max_input_tokens": 16000, diff --git a/litellm/ocr/main.py b/litellm/ocr/main.py index 5d73ddc8972..b27082c361a 100644 --- a/litellm/ocr/main.py +++ b/litellm/ocr/main.py @@ -10,7 +10,6 @@ import os import re from functools import partial from io import IOBase -from pathlib import Path from typing import Any, Coroutine, Dict, Optional, Union import httpx @@ -376,11 +375,13 @@ def convert_file_document_to_url_document(document: Dict[str, Any]) -> Dict[str, with an inline base64 data URI. Accepts document dicts like: - {"type": "file", "file": "/path/to/document.pdf"} # file path string {"type": "file", "file": Path("/path/to/doc.pdf")} # pathlib.Path {"type": "file", "file": } # file-like object (BinaryIO) {"type": "file", "file": b"raw bytes"} # raw bytes + Bare ``str`` paths are not accepted — pass a ``pathlib.Path`` or + ``open(path, "rb")`` instead. See the str check below for the rationale. + Returns: {"type": "document_url", "document_url": "data:;base64,"} or {"type": "image_url", "image_url": "data:;base64,"} @@ -389,14 +390,28 @@ def convert_file_document_to_url_document(document: Dict[str, Any]) -> Dict[str, if file_input is None: raise ValueError( "document with type='file' must include a 'file' field containing " - "a file path (str), pathlib.Path, file-like object, or bytes" + "a pathlib.Path, file-like object, or bytes" ) file_bytes: bytes mime_type: str = "application/octet-stream" file_name: Optional[str] = None - if isinstance(file_input, (str, Path)): + if isinstance(file_input, str): + # Bare strings are rejected here. The OCR ``document`` accepts a + # ``{"type": "file", "file": }`` shape, and when this helper + # runs in a proxy request handler ```` is attacker-controlled. + # Opening it as a path is an arbitrary local file read on the proxy + # host, which is then base64-encoded and forwarded to the OCR + # provider — an exfiltration primitive. + raise ValueError( + "OCR file input does not accept bare str values. Pass bytes, " + "a pathlib.Path, or a file-like object. To OCR a local file " + "from a path, call open(path, 'rb') yourself." + ) + if isinstance(file_input, os.PathLike): + # os.PathLike (pathlib.Path and custom __fspath__ classes) is a + # Python-level type that HTTP form values can't fabricate. file_path = str(file_input) if not os.path.isfile(file_path): raise FileNotFoundError(f"File not found: {file_path}") @@ -417,7 +432,7 @@ def convert_file_document_to_url_document(document: Dict[str, Any]) -> Dict[str, else: raise ValueError( f"Unsupported file input type: {type(file_input)}. " - "Expected str (file path), pathlib.Path, bytes, or a file-like object." + "Expected pathlib.Path, bytes, or a file-like object." ) if not file_bytes: diff --git a/litellm/passthrough/utils.py b/litellm/passthrough/utils.py index d39a0dda152..9484922833a 100644 --- a/litellm/passthrough/utils.py +++ b/litellm/passthrough/utils.py @@ -71,6 +71,11 @@ class BasePassthroughUtils: request_headers.pop("content-length", None) request_headers.pop("host", None) + custom_header_names = {header_name.lower() for header_name in headers} + for header_name in list(request_headers.keys()): + if header_name.lower() in custom_header_names: + request_headers.pop(header_name, None) + # Combine request headers with custom headers headers = {**request_headers, **headers} diff --git a/litellm/proxy/_experimental/mcp_server/auth/token_exchange.py b/litellm/proxy/_experimental/mcp_server/auth/token_exchange.py new file mode 100644 index 00000000000..97a16ad3e15 --- /dev/null +++ b/litellm/proxy/_experimental/mcp_server/auth/token_exchange.py @@ -0,0 +1,196 @@ +""" +OAuth 2.0 Token Exchange (RFC 8693) handler for MCP servers. + +Exchanges a user's incoming JWT (subject_token) for a scoped access token +at an IDP's token exchange endpoint. The exchanged token is then used to +authenticate requests to the upstream MCP server. + +See: https://datatracker.ietf.org/doc/html/rfc8693 +""" + +import asyncio +import hashlib +import weakref +from typing import TYPE_CHECKING, Dict, Tuple + +import httpx + +from litellm._logging import verbose_logger +from litellm.caching.in_memory_cache import InMemoryCache +from litellm.constants import ( + MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL, + MCP_OAUTH2_TOKEN_CACHE_MIN_TTL, + MCP_OAUTH2_TOKEN_EXPIRY_BUFFER_SECONDS, + MCP_TOKEN_EXCHANGE_CACHE_MAX_SIZE, +) +from litellm.llms.custom_httpx.http_handler import get_async_httpx_client +from litellm.types.llms.custom_http import httpxSpecialProvider + +if TYPE_CHECKING: + from litellm.types.mcp_server.mcp_server_manager import MCPServer + +# RFC 8693 grant type constant +TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange" + +DEFAULT_SUBJECT_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token" + + +class TokenExchangeHandler: + """Handles OAuth 2.0 Token Exchange (RFC 8693) for MCP servers. + + Caches exchanged tokens keyed by ``hash(subject_token + server_id)`` so + repeated calls with the same user token skip the IDP round-trip. + """ + + def __init__(self) -> None: + self._cache = InMemoryCache( + max_size_in_memory=MCP_TOKEN_EXCHANGE_CACHE_MAX_SIZE, + default_ttl=MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL, + ) + # WeakValueDictionary so locks are GC'd once no coroutine holds a reference, + # preventing unbounded growth with many rotating user tokens. + self._locks: weakref.WeakValueDictionary[str, asyncio.Lock] = ( + weakref.WeakValueDictionary() + ) + + def _get_lock(self, cache_key: str) -> asyncio.Lock: + lock = self._locks.get(cache_key) + if lock is None: + lock = asyncio.Lock() + self._locks[cache_key] = lock + return lock + + @staticmethod + def _cache_key(subject_token: str, server_id: str) -> str: + raw = f"{subject_token}:{server_id}" + return hashlib.sha256(raw.encode()).hexdigest() + + async def exchange_token( + self, + subject_token: str, + server: "MCPServer", + ) -> str: + """Exchange *subject_token* for a scoped access token. + + Returns the exchanged ``access_token`` string (suitable for a + ``Bearer`` header). + + Raises ``ValueError`` on configuration or IDP errors. + """ + cache_key = self._cache_key(subject_token, server.server_id) + + # Fast path + cached = self._cache.get_cache(cache_key) + if cached is not None: + return cached + + # Slow path — one exchange at a time per (user, server) pair + async with self._get_lock(cache_key): + cached = self._cache.get_cache(cache_key) + if cached is not None: + return cached + + token, ttl = await self._do_exchange(subject_token, server) + self._cache.set_cache(cache_key, token, ttl=ttl) + return token + + async def _do_exchange( + self, + subject_token: str, + server: "MCPServer", + ) -> Tuple[str, int]: + """POST to the token exchange endpoint with RFC 8693 parameters. + + Returns ``(access_token, ttl_seconds)``. + """ + endpoint = server.token_exchange_endpoint or server.token_url + if not endpoint: + raise ValueError( + f"MCP server '{server.server_id}' has auth_type=oauth2_token_exchange " + f"but no token_exchange_endpoint or token_url configured" + ) + if not server.client_id or not server.client_secret: + raise ValueError( + f"MCP server '{server.server_id}' has auth_type=oauth2_token_exchange " + f"but missing client_id or client_secret" + ) + + data: Dict[str, str] = { + "grant_type": TOKEN_EXCHANGE_GRANT_TYPE, + "subject_token": subject_token, + "subject_token_type": server.subject_token_type + or DEFAULT_SUBJECT_TOKEN_TYPE, + "client_id": server.client_id, + "client_secret": server.client_secret, + } + if server.audience: + data["audience"] = server.audience + if server.scopes: + data["scope"] = " ".join(server.scopes) + + verbose_logger.debug( + "Exchanging token for MCP server %s at %s (audience=%s)", + server.server_id, + endpoint, + server.audience, + ) + + client = get_async_httpx_client(llm_provider=httpxSpecialProvider.MCP) + try: + response = await client.post(endpoint, data=data) + response.raise_for_status() + except httpx.HTTPStatusError as exc: + verbose_logger.debug( + "Token exchange IDP error for MCP server %s (status %d)", + server.server_id, + exc.response.status_code, + ) + raise ValueError( + f"Token exchange for MCP server '{server.server_id}' " + f"failed with status {exc.response.status_code}" + ) from exc + + body = response.json() + if not isinstance(body, dict): + raise ValueError( + f"Token exchange response for MCP server '{server.server_id}' " + f"returned non-object JSON (got {type(body).__name__})" + ) + + access_token = body.get("access_token") + if not access_token: + raise ValueError( + f"Token exchange response for MCP server '{server.server_id}' " + f"missing 'access_token'" + ) + + raw_expires_in = body.get("expires_in") + try: + expires_in = ( + int(raw_expires_in) + if raw_expires_in is not None + else MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL + ) + except (TypeError, ValueError): + expires_in = MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL + + ttl = max( + expires_in - MCP_OAUTH2_TOKEN_EXPIRY_BUFFER_SECONDS, + MCP_OAUTH2_TOKEN_CACHE_MIN_TTL, + ) + + verbose_logger.info( + "Token exchange succeeded for MCP server %s (expires in %ds)", + server.server_id, + expires_in, + ) + return access_token, ttl + + def invalidate(self, subject_token: str, server_id: str) -> None: + """Remove a cached exchanged token (e.g. after a 401).""" + cache_key = self._cache_key(subject_token, server_id) + self._cache.delete_cache(cache_key) + + +# Module-level singleton +mcp_token_exchange_handler = TokenExchangeHandler() diff --git a/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py b/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py index a05af66118c..708ec7f1176 100644 --- a/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py +++ b/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py @@ -1,3 +1,4 @@ +import re from typing import Dict, List, Optional, Set, Tuple, cast from fastapi import HTTPException @@ -122,6 +123,24 @@ class MCPRequestHandler: # cannot be smuggled via query string, hostname, or a deeper URL segment. if request.url.path.startswith("/.well-known/"): validated_user_api_key_auth = UserAPIKeyAuth() + elif ( + not litellm_api_key + and MCPRequestHandler._target_servers_delegate_auth_to_upstream( # noqa: E501 + path=request.url.path, mcp_servers=mcp_servers + ) + ): + # Operator opted this oauth2 server into upstream-delegated auth + # (PKCE passthrough): skip LiteLLM API-key/SSO entirely so the + # client authenticates directly with the upstream MCP server. + # Fires ONLY when neither x-litellm-api-key nor Authorization is + # present. If any LiteLLM key is supplied (primary or secondary + # header), we fall through so user_id is resolved, spend/rate + # limiting apply, and any stored OAuth token can be retrieved + # and forwarded upstream. Gated by + # _target_servers_delegate_auth_to_upstream, which only returns + # True when EVERY target is auth_type=oauth2 AND has the + # delegate_auth_to_upstream flag set — fails closed otherwise. + validated_user_api_key_auth = UserAPIKeyAuth() elif has_explicit_litellm_key: # Explicit x-litellm-api-key provided - always validate normally validated_user_api_key_auth = await user_api_key_auth( @@ -181,23 +200,62 @@ class MCPRequestHandler: @staticmethod def _extract_target_server_names_from_path(path: str) -> List[str]: """ - Extract the target MCP server name from the standard MCP transport - URL patterns: ``/mcp/{server_name}[/...]`` and + Extract the target MCP server name(s) from the standard MCP transport + URL patterns: ``/mcp/{server_name_or_csv}[/...]`` and ``/{server_name}/mcp[/...]``. Returns ``[]`` for any other path so callers fail closed when the target cannot be resolved. + Mirrors the regex-based parser in ``server.py::_get_mcp_servers_in_path`` + so the names used for auth gating match the names used for downstream + filtering. Without this alignment, an attacker could craft + ``/mcp//`` so that auth treats the request + as targeting the delegate server (bypassing LiteLLM auth) while + downstream filtering sees a different (non-existent) target and falls + back to the caller's full allowed-server set. + REST/admin endpoints, OAuth2 server endpoints (``/{server_name}/authorize``, ``/token`` etc.), and ``.well-known`` discovery routes intentionally fall through — those flows do not need OAuth2 token passthrough. Clients aggregating multiple servers should - use ``x-mcp-servers``, which takes precedence over path parsing. + use ``x-mcp-servers`` on a path that does not encode a target. """ + # ``/{server_name}/mcp[/...]`` form — single server. The literal + # ``mcp`` must be the second segment (not the first, which would be + # the ``/mcp/...`` form handled below). This branch must stay in sync + # with ``server.py::_get_mcp_servers_in_path``, which also accepts the + # un-rewritten form (some entry points may skip the + # ``dynamic_mcp_route`` rewrite). segments = [s for s in path.split("/") if s] - if len(segments) >= 2 and segments[0] == "mcp": - return [segments[1]] - if len(segments) >= 2 and segments[1] == "mcp": + if len(segments) >= 2 and segments[1] == "mcp" and segments[0] != "mcp": return [segments[0]] - return [] + + # ``/mcp/...`` form — server name(s) may contain a slash (e.g. + # ``custom_solutions/user_123``) and may be a comma-separated list. + # Use the same parsing logic as ``_get_mcp_servers_in_path`` so the + # parsed names match downstream routing. + mcp_path_match = re.match(r"^/mcp/([^?#]+)(?:\?.*)?(?:#.*)?$", path) + if not mcp_path_match: + return [] + servers_and_path = mcp_path_match.group(1) + if not servers_and_path: + return [] + + if "," in servers_and_path: + # Comma-separated servers, possibly followed by a trailing path. + path_match = re.search(r"/([^/,]+(?:/[^/,]+)*)$", servers_and_path) + if path_match: + servers_part = servers_and_path[: -(len(path_match.group(1)) + 1)] + else: + servers_part = servers_and_path + return [s.strip() for s in servers_part.split(",") if s.strip()] + + # Single-server case — server name may contain at most one slash. + single_server_match = re.match( + r"^([^/]+(?:/[^/]+)?)(?:/.*)?$", servers_and_path + ) + if single_server_match: + return [single_server_match.group(1)] + return [servers_and_path] @staticmethod def _target_servers_use_oauth2(path: str, mcp_servers: Optional[List[str]]) -> bool: @@ -217,13 +275,13 @@ class MCPRequestHandler: ) from litellm.types.mcp import MCPAuth - # Use the x-mcp-servers header verbatim when present (including the - # explicitly-empty list, which means "no targets" → fail closed). - # Only fall back to path parsing when the header was absent entirely. - target_names = ( - mcp_servers - if mcp_servers is not None - else MCPRequestHandler._extract_target_server_names_from_path(path) + # Resolve the same target list downstream routing will use. For + # ``/mcp/...`` routes, ``extract_mcp_auth_context`` overrides the + # ``x-mcp-servers`` header with path-derived names, so we must mirror + # that here — otherwise a caller could set the header to a permissive + # server while the path targets a stricter one (header/path TOCTOU). + target_names = MCPRequestHandler._resolve_target_server_names( + path=path, mcp_servers_header=mcp_servers ) if not target_names: return False @@ -234,6 +292,76 @@ class MCPRequestHandler: return False return True + @staticmethod + def _target_servers_delegate_auth_to_upstream( + path: str, mcp_servers: Optional[List[str]] + ) -> bool: + """ + True only when EVERY MCP server the request targets is configured for + ``auth_type == oauth2`` AND has ``delegate_auth_to_upstream=True``. + Fails closed when any target does not opt in or cannot be resolved. + + Used by :meth:`process_mcp_request` to skip LiteLLM API-key/SSO auth + entirely (PKCE passthrough) so the client authenticates directly with + the upstream MCP server. Mixed-target requests (e.g. one delegated + + one non-delegated server) fall back to normal LiteLLM auth. + """ + # Inline imports avoid a circular dependency: mcp_server_manager imports + # from this module. + from litellm.proxy._experimental.mcp_server.mcp_server_manager import ( + global_mcp_server_manager, + ) + from litellm.types.mcp import MCPAuth + + # See _target_servers_use_oauth2: must mirror the downstream + # header-vs-path override or an attacker could set + # ``x-mcp-servers`` to a delegate-enabled server while the URL path + # targets a non-delegate server, skipping LiteLLM auth for it. + target_names = MCPRequestHandler._resolve_target_server_names( + path=path, mcp_servers_header=mcp_servers + ) + if not target_names: + return False + + for name in target_names: + server = global_mcp_server_manager.get_mcp_server_by_name(name) + if server is None or server.auth_type != MCPAuth.oauth2: + return False + # `is True` is intentional: opt-in must be an explicit boolean + # True. A MagicMock attribute (in tests) or any other truthy + # non-bool must not silently enable the bypass. + if getattr(server, "delegate_auth_to_upstream", False) is not True: + return False + # Never delegate for M2M (client_credentials) servers: LiteLLM + # fetches the upstream token automatically using stored credentials, + # so allowing anonymous bypass would let any external caller invoke + # tools authenticated as LiteLLM's service account. + if server.has_client_credentials: + return False + return True + + @staticmethod + def _resolve_target_server_names( + path: str, mcp_servers_header: Optional[List[str]] + ) -> List[str]: + """ + Resolve the target MCP server names exactly as downstream routing + does (``server.py::extract_mcp_auth_context``). + + For ``/mcp/...`` paths, downstream routing **overrides** any + ``x-mcp-servers`` header value with the path-derived names. Mirror + that here so an attacker cannot use a permissive header value to + flip an auth gate while the path targets a stricter server + (header/path TOCTOU). For non-``/mcp/...`` paths (where the path + does not encode targets), fall back to the header. + """ + path_targets = MCPRequestHandler._extract_target_server_names_from_path(path) + if path_targets: + return path_targets + # Path did not resolve to /mcp/... targets — trust the header + # (including an explicitly empty list, which means "no targets"). + return mcp_servers_header if mcp_servers_header is not None else [] + @staticmethod def _get_mcp_auth_header_from_headers(headers: Headers) -> Optional[str]: """ diff --git a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py index 1794cd14381..652e284ed49 100644 --- a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py +++ b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py @@ -12,7 +12,8 @@ from litellm.llms.custom_httpx.http_handler import ( ) from litellm.proxy._experimental.mcp_server.oauth_utils import ( TOKEN_NO_CACHE_HEADERS, - validate_loopback_redirect_uri, + get_request_base_url, + validate_trusted_redirect_uri, ) from litellm.proxy.auth.ip_address_utils import IPAddressUtils from litellm.proxy.common_utils.encrypt_decrypt_utils import ( @@ -29,51 +30,6 @@ router = APIRouter( ) -def get_request_base_url(request: Request) -> str: - """ - Get the base URL for the request, considering X-Forwarded-* headers. - - X-Forwarded-Proto / X-Forwarded-Host / X-Forwarded-Port are only honoured - when the request comes from a configured trusted proxy - (``use_x_forwarded_for`` enabled AND caller in ``mcp_trusted_proxy_ranges``). - Otherwise the request's literal ``base_url`` is returned, so an - untrusted caller cannot poison OAuth-discovery / redirect_uri values - by injecting headers. - - Args: - request: FastAPI Request object - - Returns: - The reconstructed base URL (e.g., "https://proxy.example.com") - """ - base_url = str(request.base_url).rstrip("/") - parsed = urlparse(base_url) - - if not IPAddressUtils.is_request_from_trusted_proxy(request): - return base_url - - x_forwarded_proto = request.headers.get("X-Forwarded-Proto") - x_forwarded_host = request.headers.get("X-Forwarded-Host") - x_forwarded_port = request.headers.get("X-Forwarded-Port") - - scheme = x_forwarded_proto if x_forwarded_proto else parsed.scheme - - if x_forwarded_host: - # X-Forwarded-Host may already include port (e.g., "example.com:8080") - if ":" in x_forwarded_host and not x_forwarded_host.startswith("["): - netloc = x_forwarded_host - elif x_forwarded_port: - netloc = f"{x_forwarded_host}:{x_forwarded_port}" - else: - netloc = x_forwarded_host - else: - netloc = parsed.netloc - if x_forwarded_port and ":" not in netloc: - netloc = f"{netloc}:{x_forwarded_port}" - - return urlunparse((scheme, netloc, parsed.path, "", "", "")) - - def encode_state_with_base_url( base_url: str, original_state: str, @@ -127,12 +83,16 @@ def decode_state_hash(encrypted_state: str) -> dict: return state_data -def _get_validated_client_redirect_uri(state_data: Dict[str, Any]) -> str: - """Return a loopback client redirect URI from OAuth state.""" +def _get_validated_client_redirect_uri( + request: Request, state_data: Dict[str, Any] +) -> str: + """Return a trusted (same-origin, loopback, or ops-allowlisted) + client redirect URI from OAuth state. + """ redirect_uri = state_data.get("client_redirect_uri") or state_data.get("base_url") if not redirect_uri or not isinstance(redirect_uri, str): raise HTTPException(status_code=400, detail="Invalid redirect URI") - validate_loopback_redirect_uri(redirect_uri) + validate_trusted_redirect_uri(request, redirect_uri) return redirect_uri @@ -338,12 +298,11 @@ async def authorize_with_server( status_code=400, detail="MCP server authorization url is not set" ) - # Loopback-only redirect_uri. The URI is encrypted into the OAuth - # state and decoded on /callback to redirect the user back; a non- - # loopback URI would be an open-redirect + code-theft primitive - # (VERIA-57 root cause B). MCP clients are native apps — loopback is - # the spec-compliant callback pattern. - validate_loopback_redirect_uri(redirect_uri) + # Trusted redirect_uri: same-origin, loopback, or ops-allowlisted. + # The URI is encrypted into the OAuth state and decoded on + # /callback to redirect the user back; a non-trusted URI would be + # an open-redirect + code-theft primitive (VERIA-57 root cause B). + validate_trusted_redirect_uri(request, redirect_uri) parsed = urlparse(redirect_uri) base_url = urlunparse(parsed._replace(query="")) request_base_url = get_request_base_url(request) @@ -660,17 +619,18 @@ async def token_endpoint( @router.get("/callback") -async def callback(code: str, state: str): +async def callback(request: Request, code: str, state: str): try: state_data = decode_state_hash(state) original_state = state_data["original_state"] - # Re-validate loopback at the sink. /authorize rejects non-loopback - # redirect_uri before encoding into state, but encrypted states - # minted before that check was added have no expiry and remain - # valid indefinitely. Validating here blocks the open-redirect + - # code-theft primitive even for pre-fix states. - redirect_uri = _get_validated_client_redirect_uri(state_data) + # Re-validate the client redirect URI at the sink. /authorize + # rejects untrusted URIs before encoding them into state, but + # encrypted states minted before that check was added have no + # expiry and remain valid indefinitely. Validating here blocks + # the open-redirect + code-theft primitive even for pre-fix + # states while permitting same-origin / allowlisted clients. + redirect_uri = _get_validated_client_redirect_uri(request, state_data) params = {"code": code, "state": original_state} complete_returned_url = _append_query_params(redirect_uri, params) diff --git a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py index 12fd1ef89a5..d0e9ad7b2a4 100644 --- a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py +++ b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py @@ -12,6 +12,7 @@ import hashlib import json import os import re +import time from typing import Any, Callable, Dict, List, Literal, Optional, Set, Tuple, Union, cast from urllib.parse import urlparse @@ -145,6 +146,30 @@ def _warn_on_server_name_fields( _warn("server_name", server_name) +def _warn_internal_delegate_pkce_if_applicable( + server: MCPServer, *, source: str +) -> None: + """Surface internal + upstream PKCE delegate in logs for operators.""" + if server.auth_type != MCPAuth.oauth2: + return + if getattr(server, "delegate_auth_to_upstream", False) is not True: + return + if getattr(server, "available_on_public_internet", True): + return + if server.has_client_credentials: + return + label = get_server_prefix(server) + verbose_logger.warning( + "MCP server %r (id=%s, source=%s): internal-only (available_on_public_internet=false) " + "with delegate_auth_to_upstream=true. Anonymous callers can reach the upstream OAuth2 " + "/authorize flow and complete PKCE without a LiteLLM API key session; ensure the " + "upstream IdP and network enforce your access policy.", + label, + server.server_id, + source, + ) + + def _deserialize_json_dict(data: Any) -> Optional[Dict[str, str]]: """ Deserialize optional JSON mappings stored in the database. @@ -226,6 +251,10 @@ class MCPServerManager: } """ self._upstream_initialize_instructions_by_server_id: Dict[str, str] = {} + # Per-server monotonic timestamp of last upstream prefetch attempt (success, + # empty result, or failure). Used to throttle re-probes for servers that do + # not return instructions, and to apply a short cooldown after failures. + self._upstream_initialize_instructions_probed_at: Dict[str, float] = {} def _remember_upstream_initialize_instructions( self, server: MCPServer, client: MCPClient @@ -236,6 +265,80 @@ class MCPServerManager: raw ).strip() + async def _ensure_upstream_initialize_instructions_cached( + self, server: MCPServer + ) -> None: + """ + Open one upstream session and cache InitializeResult.instructions if missing. + + No-op when: + - YAML/DB instructions are set on the server record, + - server is OpenAPI (spec_path), + - non-empty upstream instructions are already cached, + - auth preconditions match health_check_server's skip rules + (per-user auth / missing static auth token), + - a prior probe attempt for this server is within + MCP_HEALTH_CHECK_TIMEOUT seconds (the probe is a health-check-shaped + op and already uses this knob for its inner call timeout; reusing it + as the cooldown avoids reconnecting on every gateway initialize when + upstream returns empty or fails). + """ + if server.spec_path: + return + if server.instructions and server.instructions.strip(): + return + if self._upstream_initialize_instructions_by_server_id.get(server.server_id): + return + if server.requires_per_user_auth: + return + if ( + server.auth_type + and server.auth_type != MCPAuth.none + and server.auth_type != MCPAuth.aws_sigv4 + and not server.authentication_token + ): + return + + last_probed_at = self._upstream_initialize_instructions_probed_at.get( + server.server_id + ) + if ( + last_probed_at is not None + and (time.monotonic() - last_probed_at) < MCP_HEALTH_CHECK_TIMEOUT + ): + return + + # Record the attempt up-front so that a failure / empty response does not + # cause every subsequent initialize request to re-open the upstream session. + self._upstream_initialize_instructions_probed_at[server.server_id] = ( + time.monotonic() + ) + + try: + extra_headers: Optional[Dict[str, str]] = ( + dict(server.static_headers) if server.static_headers else None + ) + client = await self._create_mcp_client( + server=server, + mcp_auth_header=None, + extra_headers=extra_headers, + stdio_env=None, + ) + + async def _noop(_session): + return "ok" + + await asyncio.wait_for( + client.run_with_session(_noop), timeout=MCP_HEALTH_CHECK_TIMEOUT + ) + self._remember_upstream_initialize_instructions(server, client) + except Exception as e: + verbose_logger.debug( + "Upstream initialize instructions prefetch failed for %s: %s", + server.name, + e, + ) + def get_registry(self) -> Dict[str, MCPServer]: """ Get the registered MCP Servers from the registry and union with the config MCP Servers @@ -256,6 +359,7 @@ class MCPServerManager: """ verbose_logger.debug("Loading MCP Servers from config-----") self._upstream_initialize_instructions_by_server_id.clear() + self._upstream_initialize_instructions_probed_at.clear() # Track which aliases have been used to ensure only first occurrence is used used_aliases = set() @@ -297,32 +401,6 @@ class MCPServerManager: )() name_for_prefix = get_server_prefix(temp_server) - # Use alias for name if present, else server_name - alias = server_config.get("alias", None) - - # Apply mcp_aliases mapping if provided - if mcp_aliases and alias is None: - # Check if this server_name has an alias in mcp_aliases - for alias_name, target_server_name in mcp_aliases.items(): - if ( - target_server_name == server_name - and alias_name not in used_aliases - ): - alias = alias_name - used_aliases.add(alias_name) - verbose_logger.debug( - f"Mapped alias '{alias_name}' to server '{server_name}'" - ) - break - - # Create a temporary server object to use with get_server_prefix utility - temp_server = type( - "TempServer", - (), - {"alias": alias, "server_name": server_name, "server_id": None}, - )() - name_for_prefix = get_server_prefix(temp_server) - server_url = server_config.get("url", None) or "" # Generate stable server ID based on parameters server_id = self._generate_stable_server_id( @@ -402,6 +480,9 @@ class MCPServerManager: available_on_public_internet=bool( server_config.get("available_on_public_internet", True) ), + delegate_auth_to_upstream=bool( + server_config.get("delegate_auth_to_upstream", False) + ), # AWS SigV4 fields aws_access_key_id=server_config.get("aws_access_key_id", None), aws_secret_access_key=server_config.get("aws_secret_access_key", None), @@ -411,8 +492,18 @@ class MCPServerManager: aws_role_name=server_config.get("aws_role_name", None), aws_session_name=server_config.get("aws_session_name", None), instructions=server_config.get("instructions", None), + # Token Exchange (OBO) fields + token_exchange_endpoint=server_config.get( + "token_exchange_endpoint", None + ), + audience=server_config.get("audience", None), + subject_token_type=server_config.get( + "subject_token_type", + "urn:ietf:params:oauth:token-type:access_token", + ), ) self._assign_unique_short_prefix(new_server) + _warn_internal_delegate_pkce_if_applicable(new_server, source="config") self.config_mcp_servers[server_id] = new_server # Check if this is an OpenAPI-based server @@ -497,7 +588,8 @@ class MCPServerManager: # Add any static headers from server config. # # Note: `extra_headers` on MCPServer is a List[str] of header names to forward - # from the client request (not available in this OpenAPI tool generation step). + # from each client MCP request; values are applied at call time via + # `_request_extra_headers` in server.py (not baked in here). # `static_headers` is a dict of concrete headers to always send. headers = ( merge_mcp_headers( @@ -589,16 +681,57 @@ class MCPServerManager: ) raise e + def _cleanup_server_tool_routing_artifacts(self, server: MCPServer) -> None: + """Drop OpenAPI global tools and name-mapping rows owned by ``server``. + + When a server leaves ``self.registry`` (eviction, ``remove_server``, etc.), + OpenAPI tools remain in ``global_mcp_tool_registry`` and + ``tool_name_to_mcp_server_name_mapping`` unless removed here. Stale + mappings make ``_get_mcp_server_from_tool_name`` resolve to a prefix that + no longer exists in the live registry. + """ + from litellm.proxy._experimental.mcp_server.tool_registry import ( + global_mcp_tool_registry, + ) + + prefix_root = normalize_server_name(get_server_prefix(server)) + if server.spec_path and prefix_root: + openapi_key_prefix = prefix_root + MCP_TOOL_PREFIX_SEPARATOR + global_mcp_tool_registry.unregister_tools_with_prefix(openapi_key_prefix) + + owned_raw: Set[str] = set() + for p in iter_known_server_prefixes(server): + if p: + owned_raw.add(p) + if server.name: + owned_raw.add(server.name) + + owned_normalized = {normalize_server_name(x) for x in owned_raw} + + stale_mapping_keys: List[str] = [] + for tool_name, mapped_server in list( + self.tool_name_to_mcp_server_name_mapping.items() + ): + if mapped_server in owned_raw: + stale_mapping_keys.append(tool_name) + elif normalize_server_name(str(mapped_server)) in owned_normalized: + stale_mapping_keys.append(tool_name) + + for key in stale_mapping_keys: + del self.tool_name_to_mcp_server_name_mapping[key] + def remove_server(self, mcp_server: LiteLLM_MCPServerTable): """ Remove a server from the registry """ - if mcp_server.server_name in self.get_registry(): - del self.registry[mcp_server.server_name] - verbose_logger.debug(f"Removed MCP Server: {mcp_server.server_name}") - elif mcp_server.server_id in self.get_registry(): - del self.registry[mcp_server.server_id] - verbose_logger.debug(f"Removed MCP Server: {mcp_server.server_id}") + evicted: Optional[MCPServer] = self.registry.pop(mcp_server.server_id, None) + if evicted is None and mcp_server.server_name: + evicted = self.registry.pop(mcp_server.server_name, None) + if evicted is not None: + verbose_logger.debug( + "Removed MCP Server: %s", mcp_server.server_id or mcp_server.server_name + ) + self._cleanup_server_tool_routing_artifacts(evicted) else: verbose_logger.warning( f"Server ID {mcp_server.server_id} not found in registry" @@ -745,6 +878,9 @@ class MCPServerManager: available_on_public_internet=bool( getattr(mcp_server, "available_on_public_internet", True) ), + delegate_auth_to_upstream=bool( + getattr(mcp_server, "delegate_auth_to_upstream", False) + ), created_at=getattr(mcp_server, "created_at", None), updated_at=getattr(mcp_server, "updated_at", None), tool_name_to_display_name=_deserialize_json_dict( @@ -765,7 +901,19 @@ class MCPServerManager: aws_role_name=aws_creds.get("aws_role_name"), aws_session_name=aws_creds.get("aws_session_name"), instructions=mcp_server.instructions, + # Token Exchange (OBO) fields — read from credentials JSON blob + token_exchange_endpoint=( + credentials_dict.get("token_exchange_endpoint") + if credentials_dict + else None + ), + audience=(credentials_dict.get("audience") if credentials_dict else None), + subject_token_type=( + credentials_dict.get("subject_token_type") if credentials_dict else None + ) + or "urn:ietf:params:oauth:token-type:access_token", ) + _warn_internal_delegate_pkce_if_applicable(new_server, source="database") return new_server async def _maybe_register_openapi_tools( @@ -785,6 +933,13 @@ class MCPServerManager: self.initialize_tool_name_to_mcp_server_name_mapping() async def add_server(self, mcp_server: LiteLLM_MCPServerTable): + # The runtime registry is the allowlist for tool calls and health + # probes (which spawn the underlying transport, including stdio + # subprocesses). Match the eligibility set used by the bulk DB + # filter in reload_servers_from_database() — NULL is legacy and + # "approved" is a legacy alias for "active". + if mcp_server.approval_status not in (None, "active", "approved"): + return try: if mcp_server.server_id not in self.registry: new_server = await self.build_mcp_server_from_table(mcp_server) @@ -798,6 +953,16 @@ class MCPServerManager: raise e async def update_server(self, mcp_server: LiteLLM_MCPServerTable): + # If a previously-active server has been moved out of the active + # state, evict any stale registry entry so subsequent tool calls and + # health probes can't reach it. + if mcp_server.approval_status not in (None, "active", "approved"): + evicted = self.registry.pop(mcp_server.server_id, None) + if evicted is None and mcp_server.server_name: + evicted = self.registry.pop(mcp_server.server_name, None) + if evicted is not None: + self._cleanup_server_tool_routing_artifacts(evicted) + return try: if mcp_server.server_id in self.registry: new_server = await self.build_mcp_server_from_table(mcp_server) @@ -888,6 +1053,31 @@ class MCPServerManager: if not in_toolset_scope: combined_servers.update(allow_all_server_ids) + # For anonymous callers (no user_id, no role), also surface any + # servers the operator has opted into upstream-delegated auth. + # These servers handle their own auth at the upstream level, so + # LiteLLM granting access here does not bypass any security gate. + is_anonymous = not ( + user_api_key_auth + and ( + getattr(user_api_key_auth, "user_id", None) + or getattr(user_api_key_auth, "user_role", None) + or getattr(user_api_key_auth, "api_key", None) + ) + ) + if is_anonymous: + delegate_server_ids = [ + server.server_id + for server in self.get_registry().values() + if getattr(server, "auth_type", None) == MCPAuth.oauth2 + and getattr(server, "delegate_auth_to_upstream", False) is True + # M2M servers must not be exposed anonymously: an + # unauthenticated caller would get LiteLLM to proxy tool + # calls using its stored client_credentials. + and not server.has_client_credentials + ] + combined_servers.update(delegate_server_ids) + if len(combined_servers) == 0: verbose_logger.debug( "No allowed MCP Servers found for user api key auth." @@ -1102,11 +1292,17 @@ class MCPServerManager: return [] # Get server-specific auth header if available - server_auth_header = None - if mcp_server_auth_headers and server.alias: - server_auth_header = mcp_server_auth_headers.get(server.alias) - elif mcp_server_auth_headers and server.server_name: - server_auth_header = mcp_server_auth_headers.get(server.server_name) + server_auth_header: Optional[Union[str, Dict[str, str]]] = None + if mcp_server_auth_headers: + from litellm.proxy._experimental.mcp_server.utils import ( + lookup_mcp_server_auth_in_headers, + ) + + server_auth_header = lookup_mcp_server_auth_in_headers( + mcp_server_auth_headers, + alias=server.alias, + server_name=server.server_name, + ) # Fall back to deprecated mcp_auth_header if no server-specific header found if server_auth_header is None: @@ -1116,6 +1312,7 @@ class MCPServerManager: tools = await self._get_tools_from_server( server=server, mcp_auth_header=server_auth_header, + user_api_key_auth=user_api_key_auth, ) return tools except Exception as e: @@ -1139,6 +1336,29 @@ class MCPServerManager: ######################################################### # Methods that call the upstream MCP servers ######################################################### + @staticmethod + def _extract_bearer_token( + oauth2_headers: Optional[Dict[str, str]], + raw_headers: Optional[Dict[str, str]], + ) -> Optional[str]: + """Extract the bare Bearer token from oauth2_headers or raw_headers. + + Returns the token string without the ``Bearer `` prefix, or ``None`` + if no Authorization header is found. + """ + auth_value: Optional[str] = None + if oauth2_headers and "Authorization" in oauth2_headers: + auth_value = oauth2_headers["Authorization"] + elif raw_headers: + # raw_headers may have lowercase keys depending on the ASGI server + normalized = {k.lower(): v for k, v in raw_headers.items()} + auth_value = normalized.get("authorization") + if auth_value: + if auth_value.startswith("Bearer "): + return auth_value[len("Bearer ") :] + return auth_value + return None + def _build_stdio_env( self, server: MCPServer, @@ -1172,25 +1392,30 @@ class MCPServerManager: mcp_auth_header: Optional[Union[str, Dict[str, str]]] = None, extra_headers: Optional[Dict[str, str]] = None, stdio_env: Optional[Dict[str, str]] = None, + subject_token: Optional[str] = None, ) -> MCPClient: """ Create an MCPClient instance for the given server. Auth resolution (single place for all auth logic): 1. ``mcp_auth_header`` — per-request/per-user override - 2. OAuth2 client_credentials token — auto-fetched and cached - 3. ``server.authentication_token`` — static token from config/DB + 2. OAuth2 Token Exchange (OBO) — exchange user token for scoped token + 3. OAuth2 client_credentials token — auto-fetched and cached + 4. ``server.authentication_token`` — static token from config/DB Args: server: The server configuration. mcp_auth_header: Optional per-request auth override. extra_headers: Additional headers to forward. stdio_env: Environment variables for stdio transport. + subject_token: Optional user JWT for token exchange (OBO) flow. Returns: Configured MCP client instance. """ - auth_value = await resolve_mcp_auth(server, mcp_auth_header) + auth_value = await resolve_mcp_auth( + server, mcp_auth_header, subject_token=subject_token + ) transport = server.transport or MCPTransport.sse @@ -1268,6 +1493,7 @@ class MCPServerManager: extra_headers: Optional[Dict[str, str]] = None, add_prefix: bool = True, raw_headers: Optional[Dict[str, str]] = None, + user_api_key_auth: Optional[UserAPIKeyAuth] = None, ) -> List[MCPTool]: """ Helper method to get tools from a single MCP server with prefixed names. @@ -1294,6 +1520,46 @@ class MCPServerManager: extra_headers = {} extra_headers.update(server.static_headers) + # MCPJWTSigner: inject signed JWT for tools/list (list path skips pre_call_hook). + # Skip entirely when the signer is not configured (avoid an unnecessary + # dict copy on every list call), when the server has its own static + # Authorization header, when a per-user mcp_auth_header has already + # been resolved, or when the caller already supplied an Authorization + # entry in extra_headers (e.g. a per-user OAuth token resolved + # upstream) — admin-configured static auth and per-user OAuth must + # take precedence so the signer doesn't silently overwrite e.g. an + # upstream API key or a user's OAuth token (MCPClient._get_auth_headers + # applies extra_headers after writing Authorization from auth_value, so + # an injected JWT would otherwise clobber the per-user token). + if user_api_key_auth is not None and not server.spec_path: + from litellm.proxy.guardrails.guardrail_hooks.mcp_jwt_signer.mcp_jwt_signer import ( + get_mcp_jwt_signer, + inject_mcp_jwt_headers_for_upstream, + ) + + static_headers = server.static_headers or {} + has_static_authorization = any( + isinstance(k, str) and k.lower() == "authorization" + for k in static_headers.keys() + ) + has_extra_authorization = bool(extra_headers) and any( + isinstance(k, str) and k.lower() == "authorization" + for k in (extra_headers or {}).keys() + ) + + if ( + get_mcp_jwt_signer() is not None + and not has_static_authorization + and not mcp_auth_header + and not has_extra_authorization + ): + extra_headers = await inject_mcp_jwt_headers_for_upstream( + user_api_key_dict=user_api_key_auth, + extra_headers=extra_headers, + raw_headers=raw_headers, + for_list_tools=True, + ) + stdio_env = self._build_stdio_env(server, raw_headers) client = await self._create_mcp_client( @@ -2527,24 +2793,26 @@ class MCPServerManager: server_auth_header: Optional[Union[Dict[str, str], str]] = None if mcp_server_auth_headers: # Normalize keys for case-insensitive lookup - normalized_headers = { - k.lower(): v for k, v in mcp_server_auth_headers.items() - } + from litellm.proxy._experimental.mcp_server.utils import ( + lookup_mcp_server_auth_in_headers, + ) - if mcp_server.alias: - server_auth_header = normalized_headers.get(mcp_server.alias.lower()) - if server_auth_header is None and mcp_server.server_name: - server_auth_header = normalized_headers.get( - mcp_server.server_name.lower() - ) + server_auth_header = lookup_mcp_server_auth_in_headers( + mcp_server_auth_headers, + alias=mcp_server.alias, + server_name=mcp_server.server_name, + ) # Fall back to deprecated mcp_auth_header if no server-specific header found if server_auth_header is None: server_auth_header = mcp_auth_header - # oauth2 headers + # Extract subject token for OAuth2 Token Exchange (OBO) flow + subject_token: Optional[str] = None extra_headers: Optional[Dict[str, str]] = None - if mcp_server.auth_type == MCPAuth.oauth2: + if mcp_server.auth_type == MCPAuth.oauth2_token_exchange: + subject_token = self._extract_bearer_token(oauth2_headers, raw_headers) + elif mcp_server.auth_type == MCPAuth.oauth2: if mcp_server.has_client_credentials: # For M2M OAuth servers, Authorization must come from token fetch. extra_headers = None @@ -2612,6 +2880,7 @@ class MCPServerManager: mcp_auth_header=server_auth_header, extra_headers=extra_headers, stdio_env=stdio_env, + subject_token=subject_token, ) call_tool_params = MCPCallToolRequestParams( @@ -2649,6 +2918,112 @@ class MCPServerManager: return cast(CallToolResult, result) + def _resolve_mcp_server_for_tool_call( + self, + server_name: str, + name: str, + ) -> MCPServer: + """Resolve MCP server for call_tool (prefixed name, registry, fallback).""" + prefixed_tool_name = add_server_prefix_to_name(name, server_name) + mcp_server = self._get_mcp_server_from_tool_name(prefixed_tool_name) + resolved_by_server_name_only = False + normalized_server_name = normalize_server_name(server_name) + + def _candidate_matches_server_name(candidate: MCPServer) -> bool: + for identifier in ( + candidate.alias, + candidate.server_name, + candidate.name, + ): + if identifier and normalize_server_name(identifier) == ( + normalized_server_name + ): + return True + return False + + if mcp_server is None: + for candidate in self.get_registry().values(): + if _candidate_matches_server_name(candidate): + mcp_server = candidate + resolved_by_server_name_only = True + break + if mcp_server is None: + fallback = self._get_mcp_server_from_tool_name(name) + if fallback is not None and ( + not server_name or _candidate_matches_server_name(fallback) + ): + mcp_server = fallback + if mcp_server is None: + raise ValueError(f"Tool {name} not found") + + if resolved_by_server_name_only: + tool_known = ( + name in self.tool_name_to_mcp_server_name_mapping + or prefixed_tool_name in self.tool_name_to_mcp_server_name_mapping + ) + if not tool_known: + raise ValueError(f"Tool {name} not found") + + return mcp_server + + async def _resolve_oauth2_headers_for_tool_call( + self, + mcp_server: MCPServer, + oauth2_headers: Optional[Dict[str, str]], + user_api_key_auth: Optional[UserAPIKeyAuth], + ) -> Optional[Dict[str, str]]: + """Look up per-user OAuth headers when the client did not supply a token.""" + if ( + not mcp_server.needs_user_oauth_token + or oauth2_headers + or user_api_key_auth is None + ): + return oauth2_headers + + user_id = getattr(user_api_key_auth, "user_id", None) + if not user_id: + return oauth2_headers + + try: + from litellm.proxy._experimental.mcp_server.server import ( # noqa: PLC0415 + _get_user_oauth_extra_headers_from_db, + ) + + stored_headers = await _get_user_oauth_extra_headers_from_db( + server=mcp_server, + user_api_key_auth=user_api_key_auth, + ) + if stored_headers: + return stored_headers + except Exception as _lookup_exc: + verbose_logger.debug( + "call_tool: per-user token lookup failed for " "user=%s server=%s: %s", + user_id, + mcp_server.server_id, + _lookup_exc, + ) + return oauth2_headers + + async def _gather_openapi_tool_tasks( + self, + tasks: List[Any], + proxy_logging_obj: Optional[ProxyLogging], + ) -> CallToolResult: + """Await OpenAPI tool tasks and return the tool call result.""" + try: + mcp_responses = await asyncio.gather(*tasks) + result_index = 1 if proxy_logging_obj else 0 + return cast(CallToolResult, mcp_responses[result_index]) + except ( + BlockedPiiEntityError, + GuardrailRaisedException, + HTTPException, + ) as e: + verbose_logger.error( + f"Guardrail blocked MCP tool call during result check: {str(e)}" + ) + raise e + async def call_tool( self, server_name: str, @@ -2679,12 +3054,7 @@ class MCPServerManager: CallToolResult from the MCP server """ start_time = datetime.datetime.now() - - # Get the MCP server - prefixed_tool_name = add_server_prefix_to_name(name, server_name) - mcp_server = self._get_mcp_server_from_tool_name(prefixed_tool_name) - if mcp_server is None: - raise ValueError(f"Tool {name} not found") + mcp_server = self._resolve_mcp_server_for_tool_call(server_name, name) ######################################################### # Pre MCP Tool Call Hook @@ -2718,36 +3088,9 @@ class MCPServerManager: ) tasks.append(during_hook_task) - # For per-user OAuth servers: if the client didn't supply a token in - # oauth2_headers, look up the stored token from Redis / DB. This is the - # call_tool equivalent of _get_user_oauth_extra_headers_from_db used in - # list_tools. - if ( - mcp_server.needs_user_oauth_token - and not oauth2_headers - and user_api_key_auth is not None - ): - user_id = getattr(user_api_key_auth, "user_id", None) - if user_id: - try: - from litellm.proxy._experimental.mcp_server.server import ( # noqa: PLC0415 - _get_user_oauth_extra_headers_from_db, - ) - - stored_headers = await _get_user_oauth_extra_headers_from_db( - server=mcp_server, - user_api_key_auth=user_api_key_auth, - ) - if stored_headers: - oauth2_headers = stored_headers - except Exception as _lookup_exc: - verbose_logger.debug( - "call_tool: per-user token lookup failed for " - "user=%s server=%s: %s", - user_id, - mcp_server.server_id, - _lookup_exc, - ) + oauth2_headers = await self._resolve_oauth2_headers_for_tool_call( + mcp_server, oauth2_headers, user_api_key_auth + ) # For OpenAPI servers, call the tool handler directly instead of via MCP client if mcp_server.spec_path: @@ -2783,26 +3126,7 @@ class MCPServerManager: hook_extra_headers=hook_result.get("extra_headers"), ) - # For OpenAPI tools, await outside the client context - try: - mcp_responses = await asyncio.gather(*tasks) - - # If proxy_logging_obj is None, the tool call result is at index 0 - # If proxy_logging_obj is not None, the tool call result is at index 1 (after the during hook task) - result_index = 1 if proxy_logging_obj else 0 - result = mcp_responses[result_index] - - return cast(CallToolResult, result) - except ( - BlockedPiiEntityError, - GuardrailRaisedException, - HTTPException, - ) as e: - # Re-raise guardrail exceptions to properly fail the MCP call - verbose_logger.error( - f"Guardrail blocked MCP tool call during result check: {str(e)}" - ) - raise e + return await self._gather_openapi_tool_tasks(tasks, proxy_logging_obj) ######################################################### # End of Methods that call the upstream MCP servers @@ -2897,6 +3221,7 @@ class MCPServerManager: verbose_logger.debug("Loading MCP servers from database into registry...") self._upstream_initialize_instructions_by_server_id.clear() + self._upstream_initialize_instructions_probed_at.clear() # perform authz check to filter the mcp servers user has access to prisma_client = get_prisma_client_or_throw( @@ -3421,6 +3746,7 @@ class MCPServerManager: registration_url=server.registration_url, allow_all_keys=server.allow_all_keys, available_on_public_internet=server.available_on_public_internet, + delegate_auth_to_upstream=server.delegate_auth_to_upstream, is_byok=server.is_byok, byok_description=server.byok_description, byok_api_key_help_url=server.byok_api_key_help_url, diff --git a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py index 476e215666e..92ef57d8cd5 100644 --- a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py +++ b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py @@ -26,6 +26,7 @@ from litellm.proxy.common_utils.encrypt_decrypt_utils import ( decrypt_value_helper, encrypt_value_helper, ) +from litellm.proxy._experimental.mcp_server.auth import token_exchange from litellm.types.llms.custom_http import httpxSpecialProvider if TYPE_CHECKING: @@ -50,12 +51,23 @@ class MCPOAuth2TokenCache(InMemoryCache): def _get_lock(self, server_id: str) -> asyncio.Lock: return self._locks.setdefault(server_id, asyncio.Lock()) - async def async_get_token(self, server: "MCPServer") -> Optional[str]: + @staticmethod + def _has_client_credentials_config(server: "MCPServer") -> bool: + return bool(server.client_id and server.client_secret and server.token_url) + + async def async_get_token( + self, + server: "MCPServer", + *, + require_client_credentials_flow: bool = True, + ) -> Optional[str]: """Return a valid access token, fetching or refreshing as needed. Returns ``None`` when the server lacks client credentials config. """ - if not server.has_client_credentials: + if require_client_credentials_flow and not server.has_client_credentials: + return None + if not self._has_client_credentials_config(server): return None server_id = server.server_id @@ -263,16 +275,38 @@ mcp_per_user_token_cache = MCPPerUserTokenCache() async def resolve_mcp_auth( server: "MCPServer", mcp_auth_header: Optional[Union[str, Dict[str, str]]] = None, + subject_token: Optional[str] = None, ) -> Optional[Union[str, Dict[str, str]]]: """Resolve the auth value for an MCP server. Priority: 1. ``mcp_auth_header`` — per-request/per-user override - 2. OAuth2 client_credentials token — auto-fetched and cached - 3. ``server.authentication_token`` — static token from config/DB + 2. OAuth2 Token Exchange (OBO / RFC 8693) — exchange user token for scoped token + 3. OAuth2 client_credentials token — auto-fetched and cached + 4. ``server.authentication_token`` — static token from config/DB """ if mcp_auth_header: return mcp_auth_header + if server.has_token_exchange_config: + if subject_token: + return await token_exchange.mcp_token_exchange_handler.exchange_token( + subject_token, server + ) + # No subject_token — fall back to client_credentials using the same client + # credentials and token_url so M2M scenarios still work. + if server.client_id and server.client_secret and server.token_url: + return await mcp_oauth2_token_cache.async_get_token( + server, + require_client_credentials_flow=False, + ) + # OBO configured but no subject_token and missing client credentials — warn + # rather than silently proceeding unauthenticated. + verbose_logger.warning( + "MCP server '%s' is configured for token exchange (OBO) but no subject_token " + "was provided and client credentials (client_id/client_secret/token_url) are " + "incomplete. The request will proceed without authentication.", + server.server_id, + ) if server.has_client_credentials: return await mcp_oauth2_token_cache.async_get_token(server) return server.authentication_token diff --git a/litellm/proxy/_experimental/mcp_server/oauth_utils.py b/litellm/proxy/_experimental/mcp_server/oauth_utils.py index b13cf83058c..e8b591c39cf 100644 --- a/litellm/proxy/_experimental/mcp_server/oauth_utils.py +++ b/litellm/proxy/_experimental/mcp_server/oauth_utils.py @@ -1,15 +1,136 @@ """Shared helpers for the MCP OAuth authorization endpoints (BYOK + discoverable / pass-through OAuth proxy).""" +import os from ipaddress import ip_address -from urllib.parse import urlparse +from typing import Any, Dict, List, NoReturn, Optional +from urllib.parse import ParseResult, urlparse, urlunparse -from fastapi import HTTPException +from fastapi import HTTPException, Request + +from litellm._logging import verbose_logger +from litellm.proxy.auth.ip_address_utils import IPAddressUtils # RFC 6749 §5.1 / OAuth 2.1 draft-15 §4.1.3: token-endpoint responses # must not be cached — both success and error bodies may reveal secrets. TOKEN_NO_CACHE_HEADERS = {"Cache-Control": "no-store", "Pragma": "no-cache"} +# Stripped from netloc before same-origin comparison so +# ``llm.example.com`` matches ``llm.example.com:443`` (load balancers +# routinely set X-Forwarded-Port: 443 even when the client URL has no +# explicit port, which would otherwise break a literal netloc compare). +_DEFAULT_PORTS = {"http": 80, "https": 443} + +# Env var for ops to allowlist additional redirect_uri origins beyond +# same-origin + loopback — needed for first-party OAuth clients hosted +# on sister domains (e.g. a web app on app.example.com registering as +# an OAuth client of the MCP proxy on llm.example.com). Comma-separated; +# each entry is ``host`` or ``host:port``; a ``*.`` prefix matches any +# subdomain. HTTPS only. +_TRUSTED_REDIRECT_ORIGINS_ENV = "MCP_TRUSTED_REDIRECT_ORIGINS" + +# Comma-separated private-use URI allowlist for native MCP clients. +# A trailing ``*`` is a prefix match; end the prefix with ``/`` (e.g. +# ``myapp://host/oauth/*``) so ``.../oauth/callback*`` does not also +# match ``.../oauth/callback-2``. +_TRUSTED_NATIVE_REDIRECT_URIS_ENV = "MCP_TRUSTED_NATIVE_REDIRECT_URIS" + +# Default allowlist for trusted native redirect URIs. +_DEFAULT_NATIVE_REDIRECT_URIS: List[str] = [ + "cursor://anysphere.cursor-mcp/oauth/callback", +] + +_warned_invalid_proxy_base_url: Optional[str] = None + + +def _oauth_invalid_request( + error_description: str, + *, + hint: Optional[str] = None, + **extra: Any, +) -> NoReturn: + """Raise ``invalid_request`` (RFC 6749) with a debuggable description. + + FastAPI serializes ``detail`` as JSON. Callers still see ``error``: + ``invalid_request``; ``error_description`` and ``hint`` explain what + failed and how to fix it (e.g. reverse-proxy / PROXY_BASE_URL issues). + """ + detail: Dict[str, Any] = { + "error": "invalid_request", + "error_description": error_description, + } + if hint: + detail["hint"] = hint + detail.update(extra) + raise HTTPException(status_code=400, detail=detail) + + +def _origin_label(scheme: str, netloc: str) -> str: + """Human-readable origin for error messages (scheme + host[:port]).""" + return f"{scheme}://{netloc}" if netloc else f"{scheme}://" + + +def _resolve_proxy_base_url_env() -> Optional[str]: + global _warned_invalid_proxy_base_url + configured = os.environ.get("PROXY_BASE_URL", "").strip() + if not configured: + return None + parsed = urlparse(configured) + if parsed.scheme in ("http", "https") and parsed.netloc: + normalized = urlunparse((parsed.scheme, parsed.netloc, parsed.path, "", "", "")) + return normalized.rstrip("/") + if _warned_invalid_proxy_base_url != configured: + verbose_logger.warning( + "PROXY_BASE_URL=%r is not a valid http(s) URL (missing scheme " + "or host) and will be ignored for MCP OAuth origin resolution. " + "Set it to a full URL like https://litellm.example.com.", + configured, + ) + _warned_invalid_proxy_base_url = configured + return None + + +def get_request_base_url(request: Request) -> str: + """ + Get the base URL for the request, considering X-Forwarded-* headers. + + Resolution order: ``PROXY_BASE_URL`` env var, then X-Forwarded-* when + the caller is a trusted proxy (``use_x_forwarded_for`` enabled AND + caller in ``mcp_trusted_proxy_ranges``), otherwise the request's + literal ``base_url``. Untrusted callers cannot poison OAuth-discovery + / redirect_uri values by injecting headers. + """ + configured = _resolve_proxy_base_url_env() + if configured: + return configured + + base_url = str(request.base_url).rstrip("/") + parsed = urlparse(base_url) + + if not IPAddressUtils.is_request_from_trusted_proxy(request): + return base_url + + x_forwarded_proto = request.headers.get("X-Forwarded-Proto") + x_forwarded_host = request.headers.get("X-Forwarded-Host") + x_forwarded_port = request.headers.get("X-Forwarded-Port") + + scheme = x_forwarded_proto if x_forwarded_proto else parsed.scheme + + if x_forwarded_host: + # X-Forwarded-Host may already include port (e.g., "example.com:8080") + if ":" in x_forwarded_host and not x_forwarded_host.startswith("["): + netloc = x_forwarded_host + elif x_forwarded_port: + netloc = f"{x_forwarded_host}:{x_forwarded_port}" + else: + netloc = x_forwarded_host + else: + netloc = parsed.netloc + if x_forwarded_port and ":" not in netloc: + netloc = f"{netloc}:{x_forwarded_port}" + + return urlunparse((scheme, netloc, parsed.path, "", "", "")) + def validate_loopback_redirect_uri(redirect_uri: str) -> None: """Require a loopback ``redirect_uri`` (OAuth 2.1 §4.1.2.1 + RFC 8252 @@ -24,17 +145,15 @@ def validate_loopback_redirect_uri(redirect_uri: str) -> None: ``"127.0.0.1"`` alone would miss ``127.0.0.2`` and the full-form IPv6 loopback ``0:0:0:0:0:0:0:1``. """ - try: - parsed = urlparse(redirect_uri) - except ValueError: - raise HTTPException(status_code=400, detail="invalid_request") + parsed = _parse_redirect_uri_for_validation(redirect_uri) if parsed.scheme not in ("http", "https"): - raise HTTPException(status_code=400, detail="invalid_request") - # Fragments are not allowed in OAuth redirect URIs (RFC 6749 §3.1.2) - # — rejecting them prevents a ``http://127.0.0.1/cb#frag?code=...`` - # from silently eating the authorization code. + _oauth_invalid_request( + f"redirect_uri scheme {parsed.scheme!r} is not allowed; use http or https.", + ) if parsed.fragment: - raise HTTPException(status_code=400, detail="invalid_request") + _oauth_invalid_request( + "redirect_uri must not contain a URL fragment (#...).", + ) host = (parsed.hostname or "").lower() if host == "localhost": return @@ -45,4 +164,367 @@ def validate_loopback_redirect_uri(redirect_uri: str) -> None: # Unparseable host (malformed IPv6, etc.) — treat as invalid, # don't let it bubble up as a 500. pass - raise HTTPException(status_code=400, detail="invalid_request") + _oauth_invalid_request( + "redirect_uri must use a loopback host (localhost or 127.0.0.0/8).", + hint="Native MCP clients should register a callback on http://127.0.0.1:/...", + ) + + +def _strip_default_port(scheme: str, netloc: str) -> str: + """Return ``netloc`` lowercased with the scheme's default port + stripped. ``Llm.Example.com:443`` with scheme ``https`` becomes + ``llm.example.com``. Used so a literal netloc comparison between + the proxy's origin and the client redirect_uri survives a load- + balancer that sets ``X-Forwarded-Port: 443``. + """ + if not netloc: + return netloc + lowered = netloc.lower() + if lowered.startswith("["): + # IPv6 literal: port (if any) appears after the "]". + close = lowered.rfind("]") + if close != -1 and lowered[close + 1 :].startswith(":"): + try: + port = int(lowered[close + 2 :]) + except ValueError: + return lowered + if _DEFAULT_PORTS.get(scheme) == port: + return lowered[: close + 1] + return lowered + if ":" in lowered: + host, _, port_str = lowered.rpartition(":") + try: + port = int(port_str) + except ValueError: + return lowered + if _DEFAULT_PORTS.get(scheme) == port: + return host + return lowered + + +def _parse_trusted_redirect_origins() -> List[str]: + """Parse ``MCP_TRUSTED_REDIRECT_ORIGINS`` into normalized entries. + Empty / unset env var → empty list. Entries are lowercased and any + scheme / path component the operator included is stripped. Default + ``:443`` is also stripped from non-wildcard entries so + ``app.example.com:443`` matches a redirect_netloc whose own ``:443`` + has already been normalized away — the allowlist path is https-only, + so ``:443`` is the only default port that can legitimately appear. + """ + raw = os.environ.get(_TRUSTED_REDIRECT_ORIGINS_ENV, "").strip() + if not raw: + return [] + entries: List[str] = [] + for token in raw.split(","): + entry = token.strip().lower() + if not entry: + continue + if "://" in entry: + entry = entry.split("://", 1)[1] + entry = entry.split("/", 1)[0] + if not entry: + continue + # Wildcards don't express port constraints; leave them alone. + if not entry.startswith("*."): + entry = _strip_default_port("https", entry) + if entry: + entries.append(entry) + return entries + + +def _matches_trusted_origin_entry(netloc: str, entry: str) -> bool: + """``entry`` is either ``host[:port]`` (exact match after port + normalization) or ``*.suffix`` (subdomain wildcard; matches any + strictly-deeper subdomain of ``suffix`` but not ``suffix`` itself). + ``netloc`` is the already-port-normalized, lowercased netloc of + the redirect_uri being validated. + """ + if entry.startswith("*."): + suffix = entry[2:] + if not suffix or suffix.startswith("."): + return False + # Strip port from netloc for wildcard host comparison; + # wildcards don't express port constraints. + host = netloc.split(":", 1)[0] if ":" in netloc else netloc + return host != suffix and host.endswith("." + suffix) + return netloc == entry + + +def _normalize_native_redirect_uri( + parsed, +) -> str: + """Lowercase scheme, netloc, and path for allowlist comparison.""" + return urlunparse( + ( + (parsed.scheme or "").lower(), + (parsed.netloc or "").lower(), + (parsed.path or "").lower(), + "", + "", + "", + ) + ) + + +def _parse_trusted_native_redirect_uris() -> List[str]: + """Built-in native MCP callbacks plus ``MCP_TRUSTED_NATIVE_REDIRECT_URIS``.""" + entries: List[str] = [uri.lower() for uri in _DEFAULT_NATIVE_REDIRECT_URIS] + raw = os.environ.get(_TRUSTED_NATIVE_REDIRECT_URIS_ENV, "").strip() + if not raw: + return entries + for token in raw.split(","): + entry = token.strip().lower() + if entry and entry not in entries: + entries.append(entry) + return entries + + +def _native_wildcard_prefix_matches(normalized: str, prefix: str) -> bool: + """Prefix match for ``entry*`` allowlist rows. + + When the prefix does not end with ``/``, only exact matches or + deeper path segments (``prefix/...``) are accepted — not siblings + like ``prefix-2``. + """ + if not normalized.startswith(prefix): + return False + suffix = normalized[len(prefix) :] + if not suffix: + return True + if prefix.endswith("/"): + return True + return suffix[0] == "/" + + +def _matches_trusted_native_redirect_uri(parsed) -> bool: + """Allowlisted private-use / custom-scheme OAuth callbacks for native MCP clients.""" + if parsed.fragment: + return False + # Query strings are not part of registered redirect_uris (RFC 6749 §3.1.2). + # Rejecting them prevents allowlist bypass via ``.../callback?injected=...``. + if parsed.query: + return False + if not parsed.netloc: + return False + if parsed.username is not None or parsed.password is not None: + return False + if "\\" in parsed.netloc: + return False + + normalized = _normalize_native_redirect_uri(parsed) + for entry in _parse_trusted_native_redirect_uris(): + if entry.endswith("*"): + if _native_wildcard_prefix_matches(normalized, entry[:-1]): + return True + elif normalized == entry: + return True + return False + + +def _parse_redirect_uri_for_validation(redirect_uri: str) -> ParseResult: + try: + return urlparse(redirect_uri) + except ValueError: + _oauth_invalid_request( + "redirect_uri is not a valid URL.", + hint="Use a full absolute URL for redirect_uri (e.g. https://your-host/ui/mcp/oauth/callback).", + ) + + +def _validate_trusted_http_redirect_shape(parsed: ParseResult) -> bool: + """Return True when ``parsed`` is an allowlisted native callback (caller may return).""" + if parsed.scheme not in ("http", "https"): + if _matches_trusted_native_redirect_uri(parsed): + return True + _oauth_invalid_request( + f"redirect_uri scheme {parsed.scheme!r} is not allowed; use http/https " + "or a registered native callback (e.g. cursor://).", + hint="Add the full URI to MCP_TRUSTED_NATIVE_REDIRECT_URIS for custom native clients.", + ) + if parsed.fragment: + _oauth_invalid_request( + "redirect_uri must not contain a URL fragment (#...).", + ) + if not parsed.netloc: + _oauth_invalid_request( + "redirect_uri must include a host (e.g. https://your-host/path).", + ) + if parsed.username is not None or parsed.password is not None: + _oauth_invalid_request( + "redirect_uri must not contain userinfo (user:pass@host).", + ) + if "\\" in parsed.netloc: + _oauth_invalid_request( + "redirect_uri host must not contain backslashes.", + ) + return False + + +def _resolve_proxy_base_for_redirect(request: Request) -> Optional[str]: + try: + return get_request_base_url(request) + except Exception as exc: + verbose_logger.warning( + "validate_trusted_redirect_uri: could not determine proxy origin, " + "falling back to loopback + allowlist. error=%s", + exc, + ) + return None + + +def _trusted_redirect_uri_is_allowed( + parsed: ParseResult, + redirect_netloc: str, + proxy_base: Optional[str], +) -> bool: + if proxy_base: + proxy_parsed = urlparse(proxy_base) + if ( + parsed.scheme == proxy_parsed.scheme + and redirect_netloc + == _strip_default_port(proxy_parsed.scheme, proxy_parsed.netloc) + ): + return True + + host = (parsed.hostname or "").lower() + if host == "localhost": + return True + try: + if ip_address(host).is_loopback: + return True + except ValueError: + pass + + if parsed.scheme == "https": + for entry in _parse_trusted_redirect_origins(): + if _matches_trusted_origin_entry(redirect_netloc, entry): + return True + return False + + +def _build_trusted_redirect_rejection_message( + redirect_uri: str, + parsed: ParseResult, + redirect_netloc: str, + proxy_base: Optional[str], +) -> str: + """Build a client-facing rejection message. + + Intentionally omits the proxy's resolved scheme / host / port to avoid + leaking internal network topology (e.g. ``http://litellm-internal:4000``) + through an unauthenticated endpoint. Full diagnostic detail — including + the computed proxy base — is logged server-side by the caller. + """ + redirect_origin = _origin_label(parsed.scheme, redirect_netloc) + proxy_parsed = urlparse(proxy_base) if proxy_base else None + proxy_netloc_norm = ( + _strip_default_port(proxy_parsed.scheme, proxy_parsed.netloc) + if proxy_parsed and proxy_parsed.netloc + else "" + ) + + mismatch_parts: List[str] = [] + if proxy_parsed and proxy_parsed.netloc: + if parsed.scheme != proxy_parsed.scheme: + mismatch_parts.append( + f"scheme: redirect_uri uses {parsed.scheme!r}, but the proxy " + "resolved a different scheme " + "(TLS often terminates at ingress — set PROXY_BASE_URL to https://… " + "or trust X-Forwarded-Proto from your ingress)" + ) + if redirect_netloc != proxy_netloc_norm: + mismatch_parts.append( + f"host/port: redirect_uri {redirect_netloc!r} does not match " + "the proxy origin" + ) + + if mismatch_parts: + return ( + f"redirect_uri origin ({redirect_origin}) does not match the proxy " + "origin. " + "; ".join(mismatch_parts) + ) + return ( + f"redirect_uri ({redirect_uri!r}) is not allowed: not same-origin with " + f"the proxy origin, not loopback, and not listed in " + f"{_TRUSTED_REDIRECT_ORIGINS_ENV}." + ) + + +def _raise_trusted_redirect_uri_rejected( + request: Request, + redirect_uri: str, + parsed: ParseResult, + redirect_netloc: str, + proxy_base: Optional[str], +) -> NoReturn: + description = _build_trusted_redirect_rejection_message( + redirect_uri, parsed, redirect_netloc, proxy_base + ) + + hint = ( + "Align the proxy public URL with the browser URL. Set PROXY_BASE_URL to your " + "HTTPS origin (e.g. https://litellm.example.com), or enable " + "general_settings.use_x_forwarded_for with mcp_trusted_proxy_ranges for your " + "ingress. Verify: curl https:///.well-known/oauth-authorization-server " + "| jq .issuer — issuer must match window.location.origin in the UI." + ) + + verbose_logger.warning( + "MCP OAuth: rejecting redirect_uri %r. %s " + "Computed proxy base=%r (PROXY_BASE_URL=%r). " + "Inbound headers: X-Forwarded-Proto=%r X-Forwarded-Host=%r " + "X-Forwarded-Port=%r Host=%r. " + "Trusted-redirect-origins env=%r. " + "Trusted-native-redirect-uris env=%r.", + redirect_uri, + description, + proxy_base, + os.environ.get("PROXY_BASE_URL"), + request.headers.get("X-Forwarded-Proto"), + request.headers.get("X-Forwarded-Host"), + request.headers.get("X-Forwarded-Port"), + request.headers.get("Host"), + os.environ.get(_TRUSTED_REDIRECT_ORIGINS_ENV), + os.environ.get(_TRUSTED_NATIVE_REDIRECT_URIS_ENV), + ) + + _oauth_invalid_request( + description, + hint=hint, + redirect_uri=redirect_uri, + ) + + +def validate_trusted_redirect_uri(request: Request, redirect_uri: str) -> None: + """Accept ``redirect_uri`` when it is (a) same-origin with the + proxy's own request origin, (b) loopback, (c) listed in the + ``MCP_TRUSTED_REDIRECT_ORIGINS`` ops allowlist, or (d) a built-in / + env-configured native MCP client callback (e.g. ``cursor://``). + + Same-origin is VERIA-57's threat-model-safe equivalent of loopback: + an attacker who can host content on the proxy's own HTTPS origin + has already compromised the proxy, so the open-redirect + code- + theft primitive that motivated the loopback-only rule does not + apply. The same reasoning extends to ops-trusted first-party + hosts (e.g. an internal web app registering as an OAuth client of + the proxy on a sister domain). + + Allowlisted non-loopback hosts are accepted only when the + redirect_uri scheme is ``https`` — an attacker on the network + cannot elevate to https without controlling the host's TLS key. + + Use this in the discoverable OAuth proxy endpoints that serve both + native clients and the proxy's UI / cross-origin web clients. The + BYOK endpoints, which only serve native MCP clients, retain + :func:`validate_loopback_redirect_uri`. + """ + parsed = _parse_redirect_uri_for_validation(redirect_uri) + if _validate_trusted_http_redirect_shape(parsed): + return + redirect_netloc = _strip_default_port(parsed.scheme, parsed.netloc) + proxy_base = _resolve_proxy_base_for_redirect(request) + if _trusted_redirect_uri_is_allowed(parsed, redirect_netloc, proxy_base): + return + _raise_trusted_redirect_uri_rejected( + request, redirect_uri, parsed, redirect_netloc, proxy_base + ) diff --git a/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py b/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py index 718435cce6f..de70fe1331e 100644 --- a/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py +++ b/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py @@ -55,6 +55,13 @@ _request_auth_header: contextvars.ContextVar[Optional[str]] = contextvars.Contex "_request_auth_header", default=None ) +# Per-request extra headers forwarded from the client request. +# Populated from MCPServer.extra_headers names matched against raw request +# headers in server.py before dispatching to a local/OpenAPI tool handler. +_request_extra_headers: contextvars.ContextVar[Optional[Dict[str, str]]] = ( + contextvars.ContextVar("_request_extra_headers", default=None) +) + def _sanitize_path_parameter_value(param_value: Any, param_name: str) -> str: """Ensure path params cannot introduce directory traversal.""" @@ -297,6 +304,46 @@ def build_input_schema(operation: Dict[str, Any]) -> Dict[str, Any]: } +def _merge_openapi_tool_request_headers( + static_headers: Dict[str, str], +) -> Dict[str, str]: + """Merge static closure headers with per-request ContextVar overrides. + + Precedence (highest to lowest): + 1. ``_request_auth_header`` — BYOK override of ``Authorization`` + 2. ``static_headers`` — operator-configured headers baked into the + tool closure at registration time + 3. ``_request_extra_headers`` — per-request headers forwarded from + the MCP caller (allowlisted by ``MCPServer.extra_headers``) + + This matches the existing MCP invariant in + :func:`litellm.proxy._experimental.mcp_server.utils.merge_mcp_headers` + and the managed MCP path, where ``static_headers`` always wins over + caller-forwarded headers. Keeping the same precedence here prevents an + authenticated caller from overriding an operator-configured value + (e.g. a tenant id or upstream API key) by sending the same header name. + + Header names are compared case-insensitively so different casing cannot + bypass the precedence rules. + """ + request_extra = _request_extra_headers.get() or {} + static = static_headers or {} + + static_lower_names = {k.lower() for k in static} + effective_headers: Dict[str, str] = { + k: v for k, v in request_extra.items() if k.lower() not in static_lower_names + } + effective_headers.update(static) + + override_auth = _request_auth_header.get() + if override_auth: + for existing in [k for k in effective_headers if k.lower() == "authorization"]: + del effective_headers[existing] + effective_headers["Authorization"] = override_auth + + return effective_headers + + def create_tool_function( path: str, method: str, @@ -334,14 +381,7 @@ def create_tool_function( The function safely handles parameter names that aren't valid Python identifiers by using **kwargs instead of named parameters. """ - # Allow per-request auth override (e.g. BYOK credential set via ContextVar). - # The ContextVar holds the full Authorization header value, including the - # correct prefix (Bearer / ApiKey / Basic) formatted by the caller in - # server.py based on the server's configured auth_type. - effective_headers = dict(headers) - override_auth = _request_auth_header.get() - if override_auth: - effective_headers["Authorization"] = override_auth + effective_headers = _merge_openapi_tool_request_headers(headers) # Build URL from base_url and path url = base_url + path diff --git a/litellm/proxy/_experimental/mcp_server/rest_endpoints.py b/litellm/proxy/_experimental/mcp_server/rest_endpoints.py index 829863d2dbb..cec5224e183 100644 --- a/litellm/proxy/_experimental/mcp_server/rest_endpoints.py +++ b/litellm/proxy/_experimental/mcp_server/rest_endpoints.py @@ -1,6 +1,17 @@ import importlib from datetime import datetime -from typing import Any, Awaitable, Callable, Dict, List, Literal, Optional, Set, Union +from typing import ( + Any, + Awaitable, + Callable, + Dict, + List, + Literal, + Optional, + Set, + Tuple, + Union, +) from fastapi import APIRouter, Depends, HTTPException, Query, Request, status @@ -51,20 +62,16 @@ if MCP_AVAILABLE: mcp_auth_header: Optional[str], ) -> Optional[Union[Dict[str, str], str]]: """Helper function to get server-specific auth header with case-insensitive matching.""" - if mcp_server_auth_headers and server.alias: - normalized_server_alias = server.alias.lower() - normalized_headers = { - k.lower(): v for k, v in mcp_server_auth_headers.items() - } - server_auth = normalized_headers.get(normalized_server_alias) - if server_auth is not None: - return server_auth - elif mcp_server_auth_headers and server.server_name: - normalized_server_name = server.server_name.lower() - normalized_headers = { - k.lower(): v for k, v in mcp_server_auth_headers.items() - } - server_auth = normalized_headers.get(normalized_server_name) + from litellm.proxy._experimental.mcp_server.utils import ( + lookup_mcp_server_auth_in_headers, + ) + + if mcp_server_auth_headers: + server_auth = lookup_mcp_server_auth_in_headers( + mcp_server_auth_headers, + alias=getattr(server, "alias", None), + server_name=getattr(server, "server_name", None), + ) if server_auth is not None: return server_auth return mcp_auth_header @@ -231,11 +238,32 @@ if MCP_AVAILABLE: ) return mcp_auth_header, mcp_server_auth_headers, raw_headers + def _resolve_mcp_server_id_for_rest( + server_id: str, + allowed_server_ids: Union[Set[str], List[str]], + client_ip: Optional[str] = None, + ) -> str: + """ + Map REST ``server_id`` (UUID, server_name, or alias) to canonical server_id. + + tools/list already did this; tools/call must match so clients can pass + server names like ``order_status_mcp`` instead of only UUIDs. + """ + allowed = set(allowed_server_ids) + if server_id in allowed: + return server_id + by_name = global_mcp_server_manager.get_mcp_server_by_name( + server_id, client_ip=client_ip + ) + if by_name is not None and by_name.server_id in allowed: + return by_name.server_id + return server_id + async def _resolve_allowed_mcp_servers_with_ip_filter( request: Request, user_api_key_dict: UserAPIKeyAuth, server_id: str, - ) -> List[MCPServer]: + ) -> Tuple[List[MCPServer], str]: """ Resolve allowed MCP servers for a tool call with IP filtering. @@ -245,10 +273,10 @@ if MCP_AVAILABLE: server_id: The server ID to validate access for Returns: - List of allowed MCPServer objects + Tuple of (allowed MCPServer objects, canonical server_id) Raises: - HTTPException: If the server_id is not allowed + HTTPException: If the server_id is not allowed or not found """ # Get all auth contexts auth_contexts = await build_effective_auth_contexts(user_api_key_dict) @@ -268,8 +296,41 @@ if MCP_AVAILABLE: ) ) - # Check if the specified server_id is allowed - if server_id not in allowed_server_ids_set: + canonical_server_id = _resolve_mcp_server_id_for_rest( + server_id, allowed_server_ids_set, _rest_client_ip + ) + + if canonical_server_id not in allowed_server_ids_set: + _server = global_mcp_server_manager.get_mcp_server_by_id( + server_id + ) or global_mcp_server_manager.get_mcp_server_by_name(server_id) + if ( + _server is not None + and _rest_client_ip is not None + and not global_mcp_server_manager._is_server_accessible_from_ip( + _server, _rest_client_ip + ) + ): + raise HTTPException( + status_code=403, + detail={ + "error": "ip_filtering", + "message": ( + f"MCP server '{server_id}' is not accessible from your IP address " + f"({_rest_client_ip}). This server is restricted to internal " + "networks only. To make it externally accessible, set " + "'available_on_public_internet: true' in the server configuration." + ), + }, + ) + if _server is None: + raise HTTPException( + status_code=404, + detail={ + "error": "server_not_found", + "message": f"MCP server '{server_id}' was not found", + }, + ) raise HTTPException( status_code=403, detail={ @@ -285,7 +346,7 @@ if MCP_AVAILABLE: if server is not None: allowed_mcp_servers.append(server) - return allowed_mcp_servers + return allowed_mcp_servers, canonical_server_id async def _get_tools_for_single_server( server, @@ -301,6 +362,7 @@ if MCP_AVAILABLE: extra_headers=extra_headers, add_prefix=False, raw_headers=raw_headers, + user_api_key_auth=user_api_key_auth, ) # Filter tools based on allowed_tools configuration @@ -753,7 +815,7 @@ if MCP_AVAILABLE: }, ) - tool_arguments = data.get("arguments") + tool_arguments = data.get("arguments") or {} proxy_base_llm_response_processor = ProxyBaseLLMRequestProcessing(data=data) ( @@ -786,14 +848,18 @@ if MCP_AVAILABLE: data["user_api_key_auth"] = data["metadata"]["user_api_key_auth"] # Resolve allowed MCP servers with IP filtering - allowed_mcp_servers = await _resolve_allowed_mcp_servers_with_ip_filter( + ( + allowed_mcp_servers, + canonical_server_id, + ) = await _resolve_allowed_mcp_servers_with_ip_filter( request, user_api_key_dict, server_id ) # Look up per-user OAuth headers for this server (mirrors list_tool_rest_api). user_oauth_extra_headers: Optional[Dict[str, str]] = None target_server = next( - (s for s in allowed_mcp_servers if s.server_id == server_id), None + (s for s in allowed_mcp_servers if s.server_id == canonical_server_id), + None, ) if target_server is not None: user_oauth_extra_headers = await _get_user_oauth_extra_headers( @@ -812,6 +878,7 @@ if MCP_AVAILABLE: oauth2_headers=user_oauth_extra_headers or data.get("oauth2_headers"), raw_headers=data.get("raw_headers"), litellm_logging_obj=data.get("litellm_logging_obj"), + requested_server_id=canonical_server_id, ) return result except BlockedPiiEntityError as e: diff --git a/litellm/proxy/_experimental/mcp_server/server.py b/litellm/proxy/_experimental/mcp_server/server.py index 54d9bbe6e28..f31005be0cb 100644 --- a/litellm/proxy/_experimental/mcp_server/server.py +++ b/litellm/proxy/_experimental/mcp_server/server.py @@ -23,6 +23,7 @@ from typing import ( cast, ) +import httpx from fastapi import FastAPI, HTTPException from pydantic import AnyUrl, ConfigDict from starlette.requests import Request as StarletteRequest @@ -51,13 +52,17 @@ from litellm.proxy._experimental.mcp_server.utils import ( get_server_prefix, iter_known_server_prefixes, ) +from litellm.llms.custom_httpx.http_handler import ( + get_async_httpx_client, + httpxSpecialProvider, +) from litellm.proxy._types import UserAPIKeyAuth from litellm.proxy.auth.ip_address_utils import IPAddressUtils from litellm.proxy.litellm_pre_call_utils import ( LiteLLMProxyRequestSetup, get_chain_id_from_headers, ) -from litellm.types.mcp import MCPAuth +from litellm.types.mcp import MCPAuth, MCPSpecVersion from litellm.types.mcp_server.mcp_server_manager import MCPInfo, MCPServer from litellm.types.utils import CallTypes, StandardLoggingMCPToolCall from litellm.utils import Rules, client, function_setup @@ -158,6 +163,7 @@ if MCP_AVAILABLE: ) from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import ( _request_auth_header, + _request_extra_headers, ) from litellm.proxy._experimental.mcp_server.sse_transport import SseServerTransport from litellm.proxy._experimental.mcp_server.tool_registry import ( @@ -1108,10 +1114,16 @@ if MCP_AVAILABLE: ) -> Tuple[Optional[Union[Dict[str, str], str]], Optional[Dict[str, str]]]: """Build auth and extra headers for a server.""" server_auth_header: Optional[Union[Dict[str, str], str]] = None - if mcp_server_auth_headers and server.alias is not None: - server_auth_header = mcp_server_auth_headers.get(server.alias) - elif mcp_server_auth_headers and server.server_name is not None: - server_auth_header = mcp_server_auth_headers.get(server.server_name) + if mcp_server_auth_headers: + from litellm.proxy._experimental.mcp_server.utils import ( + lookup_mcp_server_auth_in_headers, + ) + + server_auth_header = lookup_mcp_server_auth_in_headers( + mcp_server_auth_headers, + alias=server.alias, + server_name=server.server_name, + ) extra_headers: Optional[Dict[str, str]] = None if server.auth_type == MCPAuth.oauth2: @@ -1153,7 +1165,7 @@ if MCP_AVAILABLE: def _merge_gateway_initialize_instructions( allowed_mcp_servers: List[MCPServer], ) -> Optional[str]: - """YAML/DB override, else in-memory upstream text from list_tools / health_check / call_tool.""" + """YAML/DB override, else upstream text (prefetch on init, or list_tools / health_check / call_tool cache).""" if not allowed_mcp_servers: return None @@ -1194,6 +1206,20 @@ if MCP_AVAILABLE: mcp_servers=mcp_servers, client_ip=client_ip, ) + if allowed: + # return_exceptions=True: a per-server probe failure (incl. CancelledError + # bubbled from anyio task group teardown on connection refused) must not + # cancel sibling probes or 500 the gateway initialize request. + await asyncio.gather( + *[ + global_mcp_server_manager._ensure_upstream_initialize_instructions_cached( + s + ) + for s in allowed + if s is not None + ], + return_exceptions=True, + ) merged = _merge_gateway_initialize_instructions(allowed_mcp_servers=allowed) tok = _mcp_gateway_initialize_instructions.set(merged) try: @@ -1331,8 +1357,24 @@ if MCP_AVAILABLE: raw_headers=raw_headers, ) - # If no OAuth2 token came from request headers, fall back to pre-fetched creds - if extra_headers is None and server.auth_type == MCPAuth.oauth2: + # Prefer server-stored per-user OAuth when configured, so a stale + # Authorization header from the MCP client cannot override Redis/DB + # (same issue as call_tool in mcp_server_manager: VS Code caches tokens). + if ( + server.auth_type == MCPAuth.oauth2 + and getattr(server, "needs_user_oauth_token", False) + and user_api_key_auth is not None + ): + db_headers = await _get_user_oauth_extra_headers_from_db( + server, + user_api_key_auth, + prefetched_creds=_prefetched_oauth_creds, + ) + if db_headers: + extra_headers = db_headers + + # If still no OAuth2 token, fall back to pre-fetched creds (non-stale-client path) + elif extra_headers is None and server.auth_type == MCPAuth.oauth2: extra_headers = await _get_user_oauth_extra_headers_from_db( server, user_api_key_auth, @@ -1346,6 +1388,7 @@ if MCP_AVAILABLE: extra_headers=extra_headers, add_prefix=True, # Always add server prefix raw_headers=raw_headers, + user_api_key_auth=user_api_key_auth, ) filtered_tools = filter_tools_by_allowed_tools(tools, server) @@ -2052,6 +2095,7 @@ if MCP_AVAILABLE: """ # Track resolved MCP server for both permission checks and dispatch mcp_server: Optional[MCPServer] = None + requested_server_id: Optional[str] = kwargs.get("requested_server_id") # If the client called with a display-name override (e.g. "Get Pet"), # translate it back to the original prefixed name before any routing. @@ -2060,14 +2104,55 @@ if MCP_AVAILABLE: # Remove prefix from tool name for logging and processing original_tool_name, server_name = split_server_prefix_from_name(name) + requested_server: Optional[MCPServer] = None + if requested_server_id: + requested_server = next( + (s for s in allowed_mcp_servers if s.server_id == requested_server_id), + None, + ) + # Resolve the actual MCP server up-front so the permission check uses # the canonical server.name even when the tool name is prefixed with a # short ID (LITELLM_USE_SHORT_MCP_TOOL_PREFIX) that doesn't match the # server's display name directly. mcp_server = global_mcp_server_manager._get_mcp_server_from_tool_name(name) + if mcp_server is None and requested_server is not None: + # REST callers may pass the raw tool name (no prefix) plus a + # ``requested_server_id``. The mapping might only contain the + # prefixed form, so retry the lookup with every known prefix of + # the requested server before treating the tool as unresolved — + # otherwise the tool_server_mismatch guard below is silently + # bypassed. + for known_prefix in iter_known_server_prefixes(requested_server): + candidate = global_mcp_server_manager._get_mcp_server_from_tool_name( + add_server_prefix_to_name(name, known_prefix) + ) + if candidate is not None: + mcp_server = candidate + break if mcp_server is not None: server_name = mcp_server.name + # REST /mcp-rest/tools/call passes server_id — tool must belong to that server + if requested_server is not None: + if ( + mcp_server is not None + and mcp_server.server_id != requested_server.server_id + ): + raise HTTPException( + status_code=403, + detail={ + "error": "tool_server_mismatch", + "message": ( + f"Tool '{name}' belongs to MCP server '{mcp_server.name}' " + f"but request specified server_id for '{requested_server.name}'." + ), + }, + ) + if mcp_server is None: + mcp_server = requested_server + server_name = requested_server.name + # Only enforce server-level permissions when we can resolve a server if server_name: if not MCPRequestHandler.is_tool_allowed( @@ -2195,11 +2280,40 @@ if MCP_AVAILABLE: auth_header_value = f"Basic {mcp_auth_header}" else: auth_header_value = f"Bearer {mcp_auth_header}" + + # Forward named client headers to OpenAPI tool upstream requests. + # MCPServer.extra_headers lists header names to copy from raw_headers. + # OAuth2 M2M: never take Authorization from the caller (matches + # _prepare_mcp_server_headers for managed MCP). + forwarded_headers: Optional[Dict[str, str]] = None + if mcp_server and mcp_server.extra_headers and raw_headers: + normalized_raw = { + str(k).lower(): v + for k, v in raw_headers.items() + if isinstance(k, str) + } + skip_caller_authorization = bool(mcp_server.has_client_credentials) + for header_name in mcp_server.extra_headers: + if not isinstance(header_name, str): + continue + if ( + skip_caller_authorization + and header_name.lower() == "authorization" + ): + continue + value = normalized_raw.get(header_name.lower()) + if value is not None: + if forwarded_headers is None: + forwarded_headers = {} + forwarded_headers[header_name] = value + _auth_token = _request_auth_header.set(auth_header_value) + _extra_token = _request_extra_headers.set(forwarded_headers) try: local_content = await _handle_local_mcp_tool(name, arguments) finally: _request_auth_header.reset(_auth_token) + _request_extra_headers.reset(_extra_token) response = CallToolResult(content=cast(Any, local_content), isError=False) # Try managed MCP server tool (pass the full prefixed name) @@ -2506,6 +2620,10 @@ if MCP_AVAILABLE: import re mcp_servers_from_path: Optional[List[str]] = None + segments = [s for s in path.split("/") if s] + if len(segments) >= 2 and segments[1] == "mcp" and segments[0] != "mcp": + return [segments[0]] + # Match /mcp/ # Where servers can be comma-separated list of server names # Server names can contain slashes (e.g., "custom_solutions/user_123") @@ -2724,6 +2842,157 @@ if MCP_AVAILABLE: ) return user_api_key_auth.model_copy(update={"object_permission": updated_op}) + def _get_forwarded_auth_from_scope(scope: Scope) -> Optional[str]: + """Return the upstream-bound ``Authorization`` header value, or None. + + Only returns the ``Authorization`` header when ``x-litellm-api-key`` is + also present. In that case ``Authorization`` is unambiguously the + upstream token the caller wants forwarded to the MCP server. When + ``x-litellm-api-key`` is absent the ``Authorization`` header may itself + be the LiteLLM proxy API key (backward-compat path in + ``MCPRequestHandler.process_mcp_request``), and forwarding it upstream + would leak the proxy key to a third-party MCP server. + """ + authorization = None + has_litellm_key_header = False + for key, value in scope.get("headers", []): + key_lower = key.lower() + if key_lower == b"authorization": + authorization = value.decode("latin-1") + elif key_lower == b"x-litellm-api-key": + has_litellm_key_header = True + if not has_litellm_key_header: + return None + return authorization + + async def _probe_upstream_auth( + url: str, + auth_header: str, + timeout: float = 5.0, + ) -> tuple: + """JSON-RPC initialize-probe the upstream URL to check whether the token is accepted. + + Uses POST so StreamableHTTP MCP servers run the same auth path as a + real client request. Returns (status_code, www_authenticate). + Fails-open with (200, None) on network errors so a transient hiccup + does not block valid requests. + + Uses the public ``AsyncHTTPHandler.post()`` interface and catches + ``httpx.HTTPStatusError`` separately so the 401/403 we want to surface + is not swallowed by the broad fail-open ``except Exception`` below. + """ + client = get_async_httpx_client( + llm_provider=httpxSpecialProvider.MCP, + params={"timeout": timeout}, + ) + probe_payload = { + "jsonrpc": "2.0", + "id": "litellm-mcp-auth-probe", + "method": "initialize", + "params": { + "protocolVersion": MCPSpecVersion.jun_2025.value, + "capabilities": {}, + "clientInfo": { + "name": "litellm-mcp-auth-probe", + "version": "1.0.0", + }, + }, + } + probe_headers = { + "Authorization": auth_header, + "Accept": "application/json, text/event-stream", + } + try: + resp = await client.post( + url=url, + headers=probe_headers, + json=probe_payload, + timeout=timeout, + ) + return resp.status_code, resp.headers.get("www-authenticate") + except httpx.HTTPStatusError as exc: + # AsyncHTTPHandler.post() calls raise_for_status(); a 401/403 from + # upstream lands here. Return its status so the caller can map it + # to the appropriate response. + return exc.response.status_code, exc.response.headers.get( + "www-authenticate" + ) + except Exception as exc: + verbose_logger.debug( + f"_probe_upstream_auth: probe to {url} failed ({exc}), allowing request through" + ) + return 200, None + + async def _check_passthrough_upstream_auth( + scope: Scope, + user_api_key_auth: Optional[UserAPIKeyAuth], + mcp_servers: Optional[List[str]], + client_ip: Optional[str], + ) -> None: + """Probe pass-through upstream servers in parallel before the MCP session starts. + + Only servers the caller's key is already authorized to reach are probed — + the list is derived from _get_allowed_mcp_servers so that a user cannot + trigger an upstream probe against a server their key is not permitted for. + + The MCP SDK commits HTTP 200 headers before invoking handlers, so a 401 + can only be returned before that point. This function raises HTTPException(401) + with a WWW-Authenticate header if any upstream rejects the client token. + Fails-open: network errors are logged and the request is allowed through. + """ + forwarded_auth = _get_forwarded_auth_from_scope(scope) + if not forwarded_auth: + return + + # Use the authorized server set, not the raw user-supplied names, so that + # a caller cannot force a probe to a server their key is not allowed to use. + allowed_servers = await _get_allowed_mcp_servers( + user_api_key_auth=user_api_key_auth, + mcp_servers=mcp_servers, + client_ip=client_ip, + ) + passthrough_servers = [ + srv + for srv in allowed_servers + if srv.extra_headers + and any(h.lower() == "authorization" for h in srv.extra_headers) + # Exclude M2M servers: _prepare_mcp_server_headers skips caller + # Authorization when has_client_credentials is set, so probing + # those with the caller's token would send the wrong credential. + and not srv.has_client_credentials + ] + if not passthrough_servers: + return + + probe_results = await asyncio.gather( + *[ + _probe_upstream_auth(srv.url or "", forwarded_auth) + for srv in passthrough_servers + ] + ) + request = StarletteRequest(scope) + base_url = get_request_base_url(request) + for srv, (probe_status, _) in zip(passthrough_servers, probe_results): + if probe_status == 401: + # Token is missing or expired — direct the client to re-authorize. + authorization_uri = ( + f"Bearer authorization_uri=" + f"{base_url}/.well-known/oauth-authorization-server/{srv.name}" + ) + raise HTTPException( + status_code=401, + detail="Unauthorized", + headers={"WWW-Authenticate": authorization_uri}, + ) + if probe_status == 403: + # Token is valid but the caller lacks permission — do not hint + # at re-authorization (RFC 9110: a fresh token with the same + # scopes would just hit 403 again and loop indefinitely). + raise HTTPException( + status_code=403, + detail="Forbidden", + ) + async def handle_streamable_http_mcp( scope: Scope, receive: Receive, send: Send ) -> None: @@ -2797,6 +3066,13 @@ if MCP_AVAILABLE: user_api_key_auth, active_toolset_id ) + # Pre-flight auth check for pass-through servers. Must run after + # toolset scoping so the probe list is derived from the fully-authorized + # server set, not the raw user-supplied names. + await _check_passthrough_upstream_auth( + scope, user_api_key_auth, mcp_servers, _client_ip + ) + # Inject masked debug headers when client sends x-litellm-mcp-debug: true _debug_headers = MCPDebug.maybe_build_debug_headers( raw_headers=raw_headers, diff --git a/litellm/proxy/_experimental/mcp_server/tool_registry.py b/litellm/proxy/_experimental/mcp_server/tool_registry.py index 58570aafadf..bb30ff55c5c 100644 --- a/litellm/proxy/_experimental/mcp_server/tool_registry.py +++ b/litellm/proxy/_experimental/mcp_server/tool_registry.py @@ -59,6 +59,22 @@ class MCPToolRegistry: ] return list(self.tools.values()) + def unregister_tools_with_prefix(self, prefix: str) -> int: + """Remove tools whose registered name starts with ``prefix``. + + Used when an OpenAPI-backed MCP server leaves the runtime registry so + stale tool handlers cannot be invoked after eviction. + """ + if not prefix: + return 0 + removed = 0 + for name in list(self.tools.keys()): + if name.startswith(prefix): + del self.tools[name] + removed += 1 + verbose_logger.debug("Unregistered MCP tool %s", name) + return removed + def convert_tools_to_mcp_sdk_tool_type( self, tools: List[MCPTool] ) -> List["MCPToolSDKTool"]: @@ -76,13 +92,20 @@ class MCPToolRegistry: ] def load_tools_from_config( - self, mcp_tools_config: Optional[Dict[str, Any]] = None + self, + mcp_tools_config: Optional[Dict[str, Any]] = None, + config_file_path: Optional[str] = None, ) -> None: """ Load and register tools from the proxy config Args: mcp_tools_config: The mcp_tools config from the proxy config + config_file_path: Path to the operator's config.yaml. Threaded + through to ``get_instance_fn`` so an ``s3://``/``gcs://`` + ``handler`` declared in the YAML resolves; callers from a + non-YAML path must leave this ``None`` so the runtime gate + fires. """ if mcp_tools_config is None: raise ValueError( @@ -105,7 +128,7 @@ class MCPToolRegistry: # First check if it's a module path (e.g., "module.submodule.function") if handler_name is None: raise ValueError(f"handler is required for tool {name}") - handler = get_instance_fn(handler_name) + handler = get_instance_fn(handler_name, config_file_path) if handler is None: verbose_logger.warning( diff --git a/litellm/proxy/_experimental/mcp_server/utils.py b/litellm/proxy/_experimental/mcp_server/utils.py index df5705c3425..b8b9207555e 100644 --- a/litellm/proxy/_experimental/mcp_server/utils.py +++ b/litellm/proxy/_experimental/mcp_server/utils.py @@ -2,7 +2,8 @@ MCP Server Utilities """ -from typing import Any, Dict, Iterator, Mapping, Optional, Tuple +import re +from typing import Any, Dict, Iterator, Mapping, Optional, Tuple, Union import hashlib import importlib @@ -117,6 +118,50 @@ def normalize_server_name(server_name: str) -> str: return server_name.replace(" ", "_") +_MCP_ALIAS_HEADER_INVALID_RE = re.compile(r"[^a-z0-9_]") + + +def sanitize_mcp_alias_for_header(alias: str) -> str: + """ + Sanitize an MCP server alias for x-mcp-{alias}-{header} HTTP headers. + + Must stay in sync with ui/litellm-dashboard/src/utils/mcpHeaderUtils.ts. + """ + sanitized = _MCP_ALIAS_HEADER_INVALID_RE.sub("_", alias.lower().strip()) + sanitized = re.sub(r"_+", "_", sanitized) + return sanitized.strip("_") + + +def lookup_mcp_server_auth_in_headers( + mcp_server_auth_headers: Mapping[str, Union[str, Dict[str, str]]], + *, + alias: Optional[str] = None, + server_name: Optional[str] = None, +) -> Optional[Union[str, Dict[str, str]]]: + """ + Resolve server-specific auth headers with case-insensitive matching. + + Tries the raw alias/server_name (lowercased) and the header-safe sanitized + alias so dashboard clients using sanitize_mcp_alias_for_header() still match. + """ + if not mcp_server_auth_headers: + return None + + normalized_headers = {k.lower(): v for k, v in mcp_server_auth_headers.items()} + + for identifier in (alias, server_name): + if not identifier: + continue + keys_to_try = [identifier.lower()] + sanitized = sanitize_mcp_alias_for_header(identifier) + if sanitized and sanitized not in keys_to_try: + keys_to_try.append(sanitized) + for key in keys_to_try: + if key in normalized_headers: + return normalized_headers[key] + return None + + def validate_and_normalize_mcp_server_payload(payload: Any) -> None: """ Validate and normalize MCP server payload fields (server_name and alias). diff --git a/litellm/proxy/_experimental/out/404.html b/litellm/proxy/_experimental/out/404.html index 17fdb3b3582..38a2c3bd836 100644 --- a/litellm/proxy/_experimental/out/404.html +++ b/litellm/proxy/_experimental/out/404.html @@ -1 +1 @@ -404: This page could not be found.LiteLLM Dashboard

404

This page could not be found.

\ No newline at end of file +404: This page could not be found.LiteLLM Dashboard

404

This page could not be found.

\ No newline at end of file diff --git a/litellm/proxy/_experimental/out/__next.__PAGE__.txt b/litellm/proxy/_experimental/out/__next.__PAGE__.txt index cf19a1edd6c..18bda7f1065 100644 --- a/litellm/proxy/_experimental/out/__next.__PAGE__.txt +++ b/litellm/proxy/_experimental/out/__next.__PAGE__.txt @@ -1,30 +1,30 @@ 1:"$Sreact.fragment" 2:I[347257,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"ClientPageRoot"] -3:I[952683,["/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js","/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js","/litellm-asset-prefix/_next/static/chunks/0493aafc4891dd29.js","/litellm-asset-prefix/_next/static/chunks/f7e1d08418645368.js","/litellm-asset-prefix/_next/static/chunks/b3d198d6c56a21b8.js","/litellm-asset-prefix/_next/static/chunks/403c4d96324c23a6.js","/litellm-asset-prefix/_next/static/chunks/37e77c06e99eb8ff.js","/litellm-asset-prefix/_next/static/chunks/adb8beb738574863.js","/litellm-asset-prefix/_next/static/chunks/0549bc9afa7d4888.js","/litellm-asset-prefix/_next/static/chunks/0b470ffc60999bf4.js","/litellm-asset-prefix/_next/static/chunks/c847ecdf8c790b0b.js","/litellm-asset-prefix/_next/static/chunks/baadbd26839e7b66.js","/litellm-asset-prefix/_next/static/chunks/ee5f9a39a526e423.js","/litellm-asset-prefix/_next/static/chunks/6eee262391715440.js","/litellm-asset-prefix/_next/static/chunks/4e17b625d75327a7.js","/litellm-asset-prefix/_next/static/chunks/7b788dd93ad868b3.js","/litellm-asset-prefix/_next/static/chunks/a06cc76a774dd182.js","/litellm-asset-prefix/_next/static/chunks/264fd32eefec52b6.js","/litellm-asset-prefix/_next/static/chunks/86828bdbafb8b581.js","/litellm-asset-prefix/_next/static/chunks/10dc4591ef08a91f.js","/litellm-asset-prefix/_next/static/chunks/e099566e8bd4ee4e.js","/litellm-asset-prefix/_next/static/chunks/fbe12a36d22e9554.js","/litellm-asset-prefix/_next/static/chunks/2971c4658f1bcd7d.js","/litellm-asset-prefix/_next/static/chunks/134f728fa7099e3e.js","/litellm-asset-prefix/_next/static/chunks/679dbd657c8b5aef.js","/litellm-asset-prefix/_next/static/chunks/94f7208f5087e27c.js","/litellm-asset-prefix/_next/static/chunks/43f6fc3c2ab9cf23.js","/litellm-asset-prefix/_next/static/chunks/4e06277331e725da.js","/litellm-asset-prefix/_next/static/chunks/3b30ab8eaa03bc21.js","/litellm-asset-prefix/_next/static/chunks/ac3cf77acb5bf234.js","/litellm-asset-prefix/_next/static/chunks/fb125648f2dae104.js","/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js","/litellm-asset-prefix/_next/static/chunks/a09028cd611c08ef.js","/litellm-asset-prefix/_next/static/chunks/6967a3b4ecbd3785.js","/litellm-asset-prefix/_next/static/chunks/3e917c79aadd945b.js","/litellm-asset-prefix/_next/static/chunks/9bbebdeb3f1cb03f.js","/litellm-asset-prefix/_next/static/chunks/0a65da2cd24e2ab6.js","/litellm-asset-prefix/_next/static/chunks/908828a91f602d8b.js","/litellm-asset-prefix/_next/static/chunks/5f2d62a75803a3f7.js","/litellm-asset-prefix/_next/static/chunks/ca5fbafaf3826374.js","/litellm-asset-prefix/_next/static/chunks/d3ac82723ec9e30d.js","/litellm-asset-prefix/_next/static/chunks/9b0ee76cbdef1a2a.js","/litellm-asset-prefix/_next/static/chunks/1bc2898be56acd1b.js","/litellm-asset-prefix/_next/static/chunks/fcdf7322b0aa3e2e.js","/litellm-asset-prefix/_next/static/chunks/878832edb30e99a4.js","/litellm-asset-prefix/_next/static/chunks/496b84010c33cf69.js","/litellm-asset-prefix/_next/static/chunks/8e3d0ce9505a304f.js","/litellm-asset-prefix/_next/static/chunks/e1f23fd814ac3500.js","/litellm-asset-prefix/_next/static/chunks/88c74f8b4b20d25a.js","/litellm-asset-prefix/_next/static/chunks/99cf9cf99df5ccfc.js","/litellm-asset-prefix/_next/static/chunks/4980372eaa37b78b.js","/litellm-asset-prefix/_next/static/chunks/0cdfadbcf4b8c9e4.js","/litellm-asset-prefix/_next/static/chunks/8f3bf592254c6c3b.js","/litellm-asset-prefix/_next/static/chunks/8c17e934bd227606.js","/litellm-asset-prefix/_next/static/chunks/b98447395b5d37ef.js"],"default"] +3:I[952683,["/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js","/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js","/litellm-asset-prefix/_next/static/chunks/0493aafc4891dd29.js","/litellm-asset-prefix/_next/static/chunks/f7e1d08418645368.js","/litellm-asset-prefix/_next/static/chunks/b3d198d6c56a21b8.js","/litellm-asset-prefix/_next/static/chunks/c847ecdf8c790b0b.js","/litellm-asset-prefix/_next/static/chunks/ee5f9a39a526e423.js","/litellm-asset-prefix/_next/static/chunks/adb8beb738574863.js","/litellm-asset-prefix/_next/static/chunks/0549bc9afa7d4888.js","/litellm-asset-prefix/_next/static/chunks/0b470ffc60999bf4.js","/litellm-asset-prefix/_next/static/chunks/0b3d09ff6c6e4335.js","/litellm-asset-prefix/_next/static/chunks/e099566e8bd4ee4e.js","/litellm-asset-prefix/_next/static/chunks/403c4d96324c23a6.js","/litellm-asset-prefix/_next/static/chunks/b1c98cc932a0ab19.js","/litellm-asset-prefix/_next/static/chunks/4e17b625d75327a7.js","/litellm-asset-prefix/_next/static/chunks/7b788dd93ad868b3.js","/litellm-asset-prefix/_next/static/chunks/a06cc76a774dd182.js","/litellm-asset-prefix/_next/static/chunks/fcdf7322b0aa3e2e.js","/litellm-asset-prefix/_next/static/chunks/0974abc09c5e7ada.js","/litellm-asset-prefix/_next/static/chunks/ae625aa52246581e.js","/litellm-asset-prefix/_next/static/chunks/7a9066dcd4a390ff.js","/litellm-asset-prefix/_next/static/chunks/baadbd26839e7b66.js","/litellm-asset-prefix/_next/static/chunks/2971c4658f1bcd7d.js","/litellm-asset-prefix/_next/static/chunks/134f728fa7099e3e.js","/litellm-asset-prefix/_next/static/chunks/679dbd657c8b5aef.js","/litellm-asset-prefix/_next/static/chunks/88001a7ecaf7b1af.js","/litellm-asset-prefix/_next/static/chunks/cbc99c8fae110c02.js","/litellm-asset-prefix/_next/static/chunks/4e06277331e725da.js","/litellm-asset-prefix/_next/static/chunks/3b30ab8eaa03bc21.js","/litellm-asset-prefix/_next/static/chunks/1c881baaaa68b7a5.js","/litellm-asset-prefix/_next/static/chunks/9955c118354ef6cc.js","/litellm-asset-prefix/_next/static/chunks/496b84010c33cf69.js","/litellm-asset-prefix/_next/static/chunks/a09028cd611c08ef.js","/litellm-asset-prefix/_next/static/chunks/99cf9cf99df5ccfc.js","/litellm-asset-prefix/_next/static/chunks/ad02f56c287539eb.js","/litellm-asset-prefix/_next/static/chunks/5181a28310842d3d.js","/litellm-asset-prefix/_next/static/chunks/0a65da2cd24e2ab6.js","/litellm-asset-prefix/_next/static/chunks/16a1651c0b3e7c8e.js","/litellm-asset-prefix/_next/static/chunks/a8f7c8c5eeb6e042.js","/litellm-asset-prefix/_next/static/chunks/4980372eaa37b78b.js","/litellm-asset-prefix/_next/static/chunks/d3ac82723ec9e30d.js","/litellm-asset-prefix/_next/static/chunks/631b1874cba557c9.js","/litellm-asset-prefix/_next/static/chunks/1bc2898be56acd1b.js","/litellm-asset-prefix/_next/static/chunks/908828a91f602d8b.js","/litellm-asset-prefix/_next/static/chunks/878832edb30e99a4.js","/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js","/litellm-asset-prefix/_next/static/chunks/003f1ffc5817ab83.js","/litellm-asset-prefix/_next/static/chunks/e1f23fd814ac3500.js","/litellm-asset-prefix/_next/static/chunks/88c74f8b4b20d25a.js","/litellm-asset-prefix/_next/static/chunks/23bfdf9b0544f0b1.js","/litellm-asset-prefix/_next/static/chunks/ca5fbafaf3826374.js","/litellm-asset-prefix/_next/static/chunks/726bebeef472c6cb.js","/litellm-asset-prefix/_next/static/chunks/8f3bf592254c6c3b.js","/litellm-asset-prefix/_next/static/chunks/659ce28f2cb74401.js","/litellm-asset-prefix/_next/static/chunks/16c0e58809eaf2b5.js"],"default"] 1a:I[897367,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"OutletBoundary"] 1b:"$Sreact.suspense" :HL["/litellm-asset-prefix/_next/static/chunks/3f3fa56b5786d58c.css","style"] -0:{"buildId":"8TZ2JbOi7SZ6BCj9ScTHW","rsc":["$","$1","c",{"children":[["$","$L2",null,{"Component":"$3","serverProvidedParams":{"searchParams":{},"params":{},"promises":["$@4","$@5"]}}],[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/3f3fa56b5786d58c.css","precedence":"next"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/0493aafc4891dd29.js","async":true}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/f7e1d08418645368.js","async":true}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/b3d198d6c56a21b8.js","async":true}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/403c4d96324c23a6.js","async":true}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/37e77c06e99eb8ff.js","async":true}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/adb8beb738574863.js","async":true}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/0549bc9afa7d4888.js","async":true}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/0b470ffc60999bf4.js","async":true}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/c847ecdf8c790b0b.js","async":true}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/baadbd26839e7b66.js","async":true}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/ee5f9a39a526e423.js","async":true}],["$","script","script-11",{"src":"/litellm-asset-prefix/_next/static/chunks/6eee262391715440.js","async":true}],["$","script","script-12",{"src":"/litellm-asset-prefix/_next/static/chunks/4e17b625d75327a7.js","async":true}],["$","script","script-13",{"src":"/litellm-asset-prefix/_next/static/chunks/7b788dd93ad868b3.js","async":true}],["$","script","script-14",{"src":"/litellm-asset-prefix/_next/static/chunks/a06cc76a774dd182.js","async":true}],["$","script","script-15",{"src":"/litellm-asset-prefix/_next/static/chunks/264fd32eefec52b6.js","async":true}],["$","script","script-16",{"src":"/litellm-asset-prefix/_next/static/chunks/86828bdbafb8b581.js","async":true}],["$","script","script-17",{"src":"/litellm-asset-prefix/_next/static/chunks/10dc4591ef08a91f.js","async":true}],["$","script","script-18",{"src":"/litellm-asset-prefix/_next/static/chunks/e099566e8bd4ee4e.js","async":true}],["$","script","script-19",{"src":"/litellm-asset-prefix/_next/static/chunks/fbe12a36d22e9554.js","async":true}],["$","script","script-20",{"src":"/litellm-asset-prefix/_next/static/chunks/2971c4658f1bcd7d.js","async":true}],["$","script","script-21",{"src":"/litellm-asset-prefix/_next/static/chunks/134f728fa7099e3e.js","async":true}],["$","script","script-22",{"src":"/litellm-asset-prefix/_next/static/chunks/679dbd657c8b5aef.js","async":true}],["$","script","script-23",{"src":"/litellm-asset-prefix/_next/static/chunks/94f7208f5087e27c.js","async":true}],["$","script","script-24",{"src":"/litellm-asset-prefix/_next/static/chunks/43f6fc3c2ab9cf23.js","async":true}],["$","script","script-25",{"src":"/litellm-asset-prefix/_next/static/chunks/4e06277331e725da.js","async":true}],["$","script","script-26",{"src":"/litellm-asset-prefix/_next/static/chunks/3b30ab8eaa03bc21.js","async":true}],["$","script","script-27",{"src":"/litellm-asset-prefix/_next/static/chunks/ac3cf77acb5bf234.js","async":true}],["$","script","script-28",{"src":"/litellm-asset-prefix/_next/static/chunks/fb125648f2dae104.js","async":true}],["$","script","script-29",{"src":"/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js","async":true}],["$","script","script-30",{"src":"/litellm-asset-prefix/_next/static/chunks/a09028cd611c08ef.js","async":true}],["$","script","script-31",{"src":"/litellm-asset-prefix/_next/static/chunks/6967a3b4ecbd3785.js","async":true}],["$","script","script-32",{"src":"/litellm-asset-prefix/_next/static/chunks/3e917c79aadd945b.js","async":true}],["$","script","script-33",{"src":"/litellm-asset-prefix/_next/static/chunks/9bbebdeb3f1cb03f.js","async":true}],"$L6","$L7","$L8","$L9","$La","$Lb","$Lc","$Ld","$Le","$Lf","$L10","$L11","$L12","$L13","$L14","$L15","$L16","$L17","$L18"],"$L19"]}],"loading":null,"isPartial":false} +0:{"buildId":"wnL6e5S6xaG1UdkxtYrTo","rsc":["$","$1","c",{"children":[["$","$L2",null,{"Component":"$3","serverProvidedParams":{"searchParams":{},"params":{},"promises":["$@4","$@5"]}}],[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/3f3fa56b5786d58c.css","precedence":"next"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/0493aafc4891dd29.js","async":true}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/f7e1d08418645368.js","async":true}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/b3d198d6c56a21b8.js","async":true}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/c847ecdf8c790b0b.js","async":true}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/ee5f9a39a526e423.js","async":true}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/adb8beb738574863.js","async":true}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/0549bc9afa7d4888.js","async":true}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/0b470ffc60999bf4.js","async":true}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/0b3d09ff6c6e4335.js","async":true}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/e099566e8bd4ee4e.js","async":true}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/403c4d96324c23a6.js","async":true}],["$","script","script-11",{"src":"/litellm-asset-prefix/_next/static/chunks/b1c98cc932a0ab19.js","async":true}],["$","script","script-12",{"src":"/litellm-asset-prefix/_next/static/chunks/4e17b625d75327a7.js","async":true}],["$","script","script-13",{"src":"/litellm-asset-prefix/_next/static/chunks/7b788dd93ad868b3.js","async":true}],["$","script","script-14",{"src":"/litellm-asset-prefix/_next/static/chunks/a06cc76a774dd182.js","async":true}],["$","script","script-15",{"src":"/litellm-asset-prefix/_next/static/chunks/fcdf7322b0aa3e2e.js","async":true}],["$","script","script-16",{"src":"/litellm-asset-prefix/_next/static/chunks/0974abc09c5e7ada.js","async":true}],["$","script","script-17",{"src":"/litellm-asset-prefix/_next/static/chunks/ae625aa52246581e.js","async":true}],["$","script","script-18",{"src":"/litellm-asset-prefix/_next/static/chunks/7a9066dcd4a390ff.js","async":true}],["$","script","script-19",{"src":"/litellm-asset-prefix/_next/static/chunks/baadbd26839e7b66.js","async":true}],["$","script","script-20",{"src":"/litellm-asset-prefix/_next/static/chunks/2971c4658f1bcd7d.js","async":true}],["$","script","script-21",{"src":"/litellm-asset-prefix/_next/static/chunks/134f728fa7099e3e.js","async":true}],["$","script","script-22",{"src":"/litellm-asset-prefix/_next/static/chunks/679dbd657c8b5aef.js","async":true}],["$","script","script-23",{"src":"/litellm-asset-prefix/_next/static/chunks/88001a7ecaf7b1af.js","async":true}],["$","script","script-24",{"src":"/litellm-asset-prefix/_next/static/chunks/cbc99c8fae110c02.js","async":true}],["$","script","script-25",{"src":"/litellm-asset-prefix/_next/static/chunks/4e06277331e725da.js","async":true}],["$","script","script-26",{"src":"/litellm-asset-prefix/_next/static/chunks/3b30ab8eaa03bc21.js","async":true}],["$","script","script-27",{"src":"/litellm-asset-prefix/_next/static/chunks/1c881baaaa68b7a5.js","async":true}],["$","script","script-28",{"src":"/litellm-asset-prefix/_next/static/chunks/9955c118354ef6cc.js","async":true}],["$","script","script-29",{"src":"/litellm-asset-prefix/_next/static/chunks/496b84010c33cf69.js","async":true}],["$","script","script-30",{"src":"/litellm-asset-prefix/_next/static/chunks/a09028cd611c08ef.js","async":true}],["$","script","script-31",{"src":"/litellm-asset-prefix/_next/static/chunks/99cf9cf99df5ccfc.js","async":true}],["$","script","script-32",{"src":"/litellm-asset-prefix/_next/static/chunks/ad02f56c287539eb.js","async":true}],["$","script","script-33",{"src":"/litellm-asset-prefix/_next/static/chunks/5181a28310842d3d.js","async":true}],"$L6","$L7","$L8","$L9","$La","$Lb","$Lc","$Ld","$Le","$Lf","$L10","$L11","$L12","$L13","$L14","$L15","$L16","$L17","$L18"],"$L19"]}],"loading":null,"isPartial":false} 4:{} 5:"$0:rsc:props:children:0:props:serverProvidedParams:params" 6:["$","script","script-34",{"src":"/litellm-asset-prefix/_next/static/chunks/0a65da2cd24e2ab6.js","async":true}] -7:["$","script","script-35",{"src":"/litellm-asset-prefix/_next/static/chunks/908828a91f602d8b.js","async":true}] -8:["$","script","script-36",{"src":"/litellm-asset-prefix/_next/static/chunks/5f2d62a75803a3f7.js","async":true}] -9:["$","script","script-37",{"src":"/litellm-asset-prefix/_next/static/chunks/ca5fbafaf3826374.js","async":true}] +7:["$","script","script-35",{"src":"/litellm-asset-prefix/_next/static/chunks/16a1651c0b3e7c8e.js","async":true}] +8:["$","script","script-36",{"src":"/litellm-asset-prefix/_next/static/chunks/a8f7c8c5eeb6e042.js","async":true}] +9:["$","script","script-37",{"src":"/litellm-asset-prefix/_next/static/chunks/4980372eaa37b78b.js","async":true}] a:["$","script","script-38",{"src":"/litellm-asset-prefix/_next/static/chunks/d3ac82723ec9e30d.js","async":true}] -b:["$","script","script-39",{"src":"/litellm-asset-prefix/_next/static/chunks/9b0ee76cbdef1a2a.js","async":true}] +b:["$","script","script-39",{"src":"/litellm-asset-prefix/_next/static/chunks/631b1874cba557c9.js","async":true}] c:["$","script","script-40",{"src":"/litellm-asset-prefix/_next/static/chunks/1bc2898be56acd1b.js","async":true}] -d:["$","script","script-41",{"src":"/litellm-asset-prefix/_next/static/chunks/fcdf7322b0aa3e2e.js","async":true}] +d:["$","script","script-41",{"src":"/litellm-asset-prefix/_next/static/chunks/908828a91f602d8b.js","async":true}] e:["$","script","script-42",{"src":"/litellm-asset-prefix/_next/static/chunks/878832edb30e99a4.js","async":true}] -f:["$","script","script-43",{"src":"/litellm-asset-prefix/_next/static/chunks/496b84010c33cf69.js","async":true}] -10:["$","script","script-44",{"src":"/litellm-asset-prefix/_next/static/chunks/8e3d0ce9505a304f.js","async":true}] +f:["$","script","script-43",{"src":"/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js","async":true}] +10:["$","script","script-44",{"src":"/litellm-asset-prefix/_next/static/chunks/003f1ffc5817ab83.js","async":true}] 11:["$","script","script-45",{"src":"/litellm-asset-prefix/_next/static/chunks/e1f23fd814ac3500.js","async":true}] 12:["$","script","script-46",{"src":"/litellm-asset-prefix/_next/static/chunks/88c74f8b4b20d25a.js","async":true}] -13:["$","script","script-47",{"src":"/litellm-asset-prefix/_next/static/chunks/99cf9cf99df5ccfc.js","async":true}] -14:["$","script","script-48",{"src":"/litellm-asset-prefix/_next/static/chunks/4980372eaa37b78b.js","async":true}] -15:["$","script","script-49",{"src":"/litellm-asset-prefix/_next/static/chunks/0cdfadbcf4b8c9e4.js","async":true}] +13:["$","script","script-47",{"src":"/litellm-asset-prefix/_next/static/chunks/23bfdf9b0544f0b1.js","async":true}] +14:["$","script","script-48",{"src":"/litellm-asset-prefix/_next/static/chunks/ca5fbafaf3826374.js","async":true}] +15:["$","script","script-49",{"src":"/litellm-asset-prefix/_next/static/chunks/726bebeef472c6cb.js","async":true}] 16:["$","script","script-50",{"src":"/litellm-asset-prefix/_next/static/chunks/8f3bf592254c6c3b.js","async":true}] -17:["$","script","script-51",{"src":"/litellm-asset-prefix/_next/static/chunks/8c17e934bd227606.js","async":true}] -18:["$","script","script-52",{"src":"/litellm-asset-prefix/_next/static/chunks/b98447395b5d37ef.js","async":true}] +17:["$","script","script-51",{"src":"/litellm-asset-prefix/_next/static/chunks/659ce28f2cb74401.js","async":true}] +18:["$","script","script-52",{"src":"/litellm-asset-prefix/_next/static/chunks/16c0e58809eaf2b5.js","async":true}] 19:["$","$L1a",null,{"children":["$","$1b",null,{"name":"Next.MetadataOutlet","children":"$@1c"}]}] 1c:null diff --git a/litellm/proxy/_experimental/out/__next._full.txt b/litellm/proxy/_experimental/out/__next._full.txt index 6b75bee8839..d213f7190c4 100644 --- a/litellm/proxy/_experimental/out/__next._full.txt +++ b/litellm/proxy/_experimental/out/__next._full.txt @@ -4,54 +4,54 @@ 4:I[339756,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"default"] 5:I[837457,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"default"] 6:I[347257,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"ClientPageRoot"] -7:I[952683,["/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js","/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js","/litellm-asset-prefix/_next/static/chunks/0493aafc4891dd29.js","/litellm-asset-prefix/_next/static/chunks/f7e1d08418645368.js","/litellm-asset-prefix/_next/static/chunks/b3d198d6c56a21b8.js","/litellm-asset-prefix/_next/static/chunks/403c4d96324c23a6.js","/litellm-asset-prefix/_next/static/chunks/37e77c06e99eb8ff.js","/litellm-asset-prefix/_next/static/chunks/adb8beb738574863.js","/litellm-asset-prefix/_next/static/chunks/0549bc9afa7d4888.js","/litellm-asset-prefix/_next/static/chunks/0b470ffc60999bf4.js","/litellm-asset-prefix/_next/static/chunks/c847ecdf8c790b0b.js","/litellm-asset-prefix/_next/static/chunks/baadbd26839e7b66.js","/litellm-asset-prefix/_next/static/chunks/ee5f9a39a526e423.js","/litellm-asset-prefix/_next/static/chunks/6eee262391715440.js","/litellm-asset-prefix/_next/static/chunks/4e17b625d75327a7.js","/litellm-asset-prefix/_next/static/chunks/7b788dd93ad868b3.js","/litellm-asset-prefix/_next/static/chunks/a06cc76a774dd182.js","/litellm-asset-prefix/_next/static/chunks/264fd32eefec52b6.js","/litellm-asset-prefix/_next/static/chunks/86828bdbafb8b581.js","/litellm-asset-prefix/_next/static/chunks/10dc4591ef08a91f.js","/litellm-asset-prefix/_next/static/chunks/e099566e8bd4ee4e.js","/litellm-asset-prefix/_next/static/chunks/fbe12a36d22e9554.js","/litellm-asset-prefix/_next/static/chunks/2971c4658f1bcd7d.js","/litellm-asset-prefix/_next/static/chunks/134f728fa7099e3e.js","/litellm-asset-prefix/_next/static/chunks/679dbd657c8b5aef.js","/litellm-asset-prefix/_next/static/chunks/94f7208f5087e27c.js","/litellm-asset-prefix/_next/static/chunks/43f6fc3c2ab9cf23.js","/litellm-asset-prefix/_next/static/chunks/4e06277331e725da.js","/litellm-asset-prefix/_next/static/chunks/3b30ab8eaa03bc21.js","/litellm-asset-prefix/_next/static/chunks/ac3cf77acb5bf234.js","/litellm-asset-prefix/_next/static/chunks/fb125648f2dae104.js","/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js","/litellm-asset-prefix/_next/static/chunks/a09028cd611c08ef.js","/litellm-asset-prefix/_next/static/chunks/6967a3b4ecbd3785.js","/litellm-asset-prefix/_next/static/chunks/3e917c79aadd945b.js","/litellm-asset-prefix/_next/static/chunks/9bbebdeb3f1cb03f.js","/litellm-asset-prefix/_next/static/chunks/0a65da2cd24e2ab6.js","/litellm-asset-prefix/_next/static/chunks/908828a91f602d8b.js","/litellm-asset-prefix/_next/static/chunks/5f2d62a75803a3f7.js","/litellm-asset-prefix/_next/static/chunks/ca5fbafaf3826374.js","/litellm-asset-prefix/_next/static/chunks/d3ac82723ec9e30d.js","/litellm-asset-prefix/_next/static/chunks/9b0ee76cbdef1a2a.js","/litellm-asset-prefix/_next/static/chunks/1bc2898be56acd1b.js","/litellm-asset-prefix/_next/static/chunks/fcdf7322b0aa3e2e.js","/litellm-asset-prefix/_next/static/chunks/878832edb30e99a4.js","/litellm-asset-prefix/_next/static/chunks/496b84010c33cf69.js","/litellm-asset-prefix/_next/static/chunks/8e3d0ce9505a304f.js","/litellm-asset-prefix/_next/static/chunks/e1f23fd814ac3500.js","/litellm-asset-prefix/_next/static/chunks/88c74f8b4b20d25a.js","/litellm-asset-prefix/_next/static/chunks/99cf9cf99df5ccfc.js","/litellm-asset-prefix/_next/static/chunks/4980372eaa37b78b.js","/litellm-asset-prefix/_next/static/chunks/0cdfadbcf4b8c9e4.js","/litellm-asset-prefix/_next/static/chunks/8f3bf592254c6c3b.js","/litellm-asset-prefix/_next/static/chunks/8c17e934bd227606.js","/litellm-asset-prefix/_next/static/chunks/b98447395b5d37ef.js"],"default"] +7:I[952683,["/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js","/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js","/litellm-asset-prefix/_next/static/chunks/0493aafc4891dd29.js","/litellm-asset-prefix/_next/static/chunks/f7e1d08418645368.js","/litellm-asset-prefix/_next/static/chunks/b3d198d6c56a21b8.js","/litellm-asset-prefix/_next/static/chunks/c847ecdf8c790b0b.js","/litellm-asset-prefix/_next/static/chunks/ee5f9a39a526e423.js","/litellm-asset-prefix/_next/static/chunks/adb8beb738574863.js","/litellm-asset-prefix/_next/static/chunks/0549bc9afa7d4888.js","/litellm-asset-prefix/_next/static/chunks/0b470ffc60999bf4.js","/litellm-asset-prefix/_next/static/chunks/0b3d09ff6c6e4335.js","/litellm-asset-prefix/_next/static/chunks/e099566e8bd4ee4e.js","/litellm-asset-prefix/_next/static/chunks/403c4d96324c23a6.js","/litellm-asset-prefix/_next/static/chunks/b1c98cc932a0ab19.js","/litellm-asset-prefix/_next/static/chunks/4e17b625d75327a7.js","/litellm-asset-prefix/_next/static/chunks/7b788dd93ad868b3.js","/litellm-asset-prefix/_next/static/chunks/a06cc76a774dd182.js","/litellm-asset-prefix/_next/static/chunks/fcdf7322b0aa3e2e.js","/litellm-asset-prefix/_next/static/chunks/0974abc09c5e7ada.js","/litellm-asset-prefix/_next/static/chunks/ae625aa52246581e.js","/litellm-asset-prefix/_next/static/chunks/7a9066dcd4a390ff.js","/litellm-asset-prefix/_next/static/chunks/baadbd26839e7b66.js","/litellm-asset-prefix/_next/static/chunks/2971c4658f1bcd7d.js","/litellm-asset-prefix/_next/static/chunks/134f728fa7099e3e.js","/litellm-asset-prefix/_next/static/chunks/679dbd657c8b5aef.js","/litellm-asset-prefix/_next/static/chunks/88001a7ecaf7b1af.js","/litellm-asset-prefix/_next/static/chunks/cbc99c8fae110c02.js","/litellm-asset-prefix/_next/static/chunks/4e06277331e725da.js","/litellm-asset-prefix/_next/static/chunks/3b30ab8eaa03bc21.js","/litellm-asset-prefix/_next/static/chunks/1c881baaaa68b7a5.js","/litellm-asset-prefix/_next/static/chunks/9955c118354ef6cc.js","/litellm-asset-prefix/_next/static/chunks/496b84010c33cf69.js","/litellm-asset-prefix/_next/static/chunks/a09028cd611c08ef.js","/litellm-asset-prefix/_next/static/chunks/99cf9cf99df5ccfc.js","/litellm-asset-prefix/_next/static/chunks/ad02f56c287539eb.js","/litellm-asset-prefix/_next/static/chunks/5181a28310842d3d.js","/litellm-asset-prefix/_next/static/chunks/0a65da2cd24e2ab6.js","/litellm-asset-prefix/_next/static/chunks/16a1651c0b3e7c8e.js","/litellm-asset-prefix/_next/static/chunks/a8f7c8c5eeb6e042.js","/litellm-asset-prefix/_next/static/chunks/4980372eaa37b78b.js","/litellm-asset-prefix/_next/static/chunks/d3ac82723ec9e30d.js","/litellm-asset-prefix/_next/static/chunks/631b1874cba557c9.js","/litellm-asset-prefix/_next/static/chunks/1bc2898be56acd1b.js","/litellm-asset-prefix/_next/static/chunks/908828a91f602d8b.js","/litellm-asset-prefix/_next/static/chunks/878832edb30e99a4.js","/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js","/litellm-asset-prefix/_next/static/chunks/003f1ffc5817ab83.js","/litellm-asset-prefix/_next/static/chunks/e1f23fd814ac3500.js","/litellm-asset-prefix/_next/static/chunks/88c74f8b4b20d25a.js","/litellm-asset-prefix/_next/static/chunks/23bfdf9b0544f0b1.js","/litellm-asset-prefix/_next/static/chunks/ca5fbafaf3826374.js","/litellm-asset-prefix/_next/static/chunks/726bebeef472c6cb.js","/litellm-asset-prefix/_next/static/chunks/8f3bf592254c6c3b.js","/litellm-asset-prefix/_next/static/chunks/659ce28f2cb74401.js","/litellm-asset-prefix/_next/static/chunks/16c0e58809eaf2b5.js"],"default"] 31:I[168027,[],"default"] :HL["/litellm-asset-prefix/_next/static/chunks/4e20891f2fd03463.css","style"] :HL["/litellm-asset-prefix/_next/static/chunks/91037395c95e366d.css","style"] :HL["/litellm-asset-prefix/_next/static/media/83afe278b6a6bb3c-s.p.3a6ba036.woff2","font",{"crossOrigin":"","type":"font/woff2"}] :HL["/litellm-asset-prefix/_next/static/chunks/3f3fa56b5786d58c.css","style"] -0:{"P":null,"b":"8TZ2JbOi7SZ6BCj9ScTHW","c":["",""],"q":"","i":false,"f":[[["",{"children":["__PAGE__",{}]},"$undefined","$undefined",true],[["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/4e20891f2fd03463.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","link","1",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/91037395c95e366d.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js","async":true,"nonce":"$undefined"}]],["$","html",null,{"lang":"en","children":["$","body",null,{"className":"inter_5972bc34-module__OU16Qa__className","children":["$","$L2",null,{"children":["$","$L3",null,{"children":["$","$L4",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L5",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]],"forbidden":"$undefined","unauthorized":"$undefined"}]}]}]}]}]]}],{"children":[["$","$1","c",{"children":[["$","$L6",null,{"Component":"$7","serverProvidedParams":{"searchParams":{},"params":{},"promises":["$@8","$@9"]}}],[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/3f3fa56b5786d58c.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/0493aafc4891dd29.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/f7e1d08418645368.js","async":true,"nonce":"$undefined"}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/b3d198d6c56a21b8.js","async":true,"nonce":"$undefined"}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/403c4d96324c23a6.js","async":true,"nonce":"$undefined"}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/37e77c06e99eb8ff.js","async":true,"nonce":"$undefined"}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/adb8beb738574863.js","async":true,"nonce":"$undefined"}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/0549bc9afa7d4888.js","async":true,"nonce":"$undefined"}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/0b470ffc60999bf4.js","async":true,"nonce":"$undefined"}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/c847ecdf8c790b0b.js","async":true,"nonce":"$undefined"}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/baadbd26839e7b66.js","async":true,"nonce":"$undefined"}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/ee5f9a39a526e423.js","async":true,"nonce":"$undefined"}],["$","script","script-11",{"src":"/litellm-asset-prefix/_next/static/chunks/6eee262391715440.js","async":true,"nonce":"$undefined"}],["$","script","script-12",{"src":"/litellm-asset-prefix/_next/static/chunks/4e17b625d75327a7.js","async":true,"nonce":"$undefined"}],["$","script","script-13",{"src":"/litellm-asset-prefix/_next/static/chunks/7b788dd93ad868b3.js","async":true,"nonce":"$undefined"}],["$","script","script-14",{"src":"/litellm-asset-prefix/_next/static/chunks/a06cc76a774dd182.js","async":true,"nonce":"$undefined"}],["$","script","script-15",{"src":"/litellm-asset-prefix/_next/static/chunks/264fd32eefec52b6.js","async":true,"nonce":"$undefined"}],"$La","$Lb","$Lc","$Ld","$Le","$Lf","$L10","$L11","$L12","$L13","$L14","$L15","$L16","$L17","$L18","$L19","$L1a","$L1b","$L1c","$L1d","$L1e","$L1f","$L20","$L21","$L22","$L23","$L24","$L25","$L26","$L27","$L28","$L29","$L2a","$L2b","$L2c","$L2d","$L2e"],"$L2f"]}],{},null,false,false]},null,false,false],"$L30",false]],"m":"$undefined","G":["$31",[]],"S":true} +0:{"P":null,"b":"wnL6e5S6xaG1UdkxtYrTo","c":["",""],"q":"","i":false,"f":[[["",{"children":["__PAGE__",{}]},"$undefined","$undefined",true],[["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/4e20891f2fd03463.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","link","1",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/91037395c95e366d.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js","async":true,"nonce":"$undefined"}]],["$","html",null,{"lang":"en","children":["$","body",null,{"className":"inter_5972bc34-module__OU16Qa__className","children":["$","$L2",null,{"children":["$","$L3",null,{"children":["$","$L4",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L5",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]],"forbidden":"$undefined","unauthorized":"$undefined"}]}]}]}]}]]}],{"children":[["$","$1","c",{"children":[["$","$L6",null,{"Component":"$7","serverProvidedParams":{"searchParams":{},"params":{},"promises":["$@8","$@9"]}}],[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/3f3fa56b5786d58c.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/0493aafc4891dd29.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/f7e1d08418645368.js","async":true,"nonce":"$undefined"}],["$","script","script-2",{"src":"/litellm-asset-prefix/_next/static/chunks/b3d198d6c56a21b8.js","async":true,"nonce":"$undefined"}],["$","script","script-3",{"src":"/litellm-asset-prefix/_next/static/chunks/c847ecdf8c790b0b.js","async":true,"nonce":"$undefined"}],["$","script","script-4",{"src":"/litellm-asset-prefix/_next/static/chunks/ee5f9a39a526e423.js","async":true,"nonce":"$undefined"}],["$","script","script-5",{"src":"/litellm-asset-prefix/_next/static/chunks/adb8beb738574863.js","async":true,"nonce":"$undefined"}],["$","script","script-6",{"src":"/litellm-asset-prefix/_next/static/chunks/0549bc9afa7d4888.js","async":true,"nonce":"$undefined"}],["$","script","script-7",{"src":"/litellm-asset-prefix/_next/static/chunks/0b470ffc60999bf4.js","async":true,"nonce":"$undefined"}],["$","script","script-8",{"src":"/litellm-asset-prefix/_next/static/chunks/0b3d09ff6c6e4335.js","async":true,"nonce":"$undefined"}],["$","script","script-9",{"src":"/litellm-asset-prefix/_next/static/chunks/e099566e8bd4ee4e.js","async":true,"nonce":"$undefined"}],["$","script","script-10",{"src":"/litellm-asset-prefix/_next/static/chunks/403c4d96324c23a6.js","async":true,"nonce":"$undefined"}],["$","script","script-11",{"src":"/litellm-asset-prefix/_next/static/chunks/b1c98cc932a0ab19.js","async":true,"nonce":"$undefined"}],["$","script","script-12",{"src":"/litellm-asset-prefix/_next/static/chunks/4e17b625d75327a7.js","async":true,"nonce":"$undefined"}],["$","script","script-13",{"src":"/litellm-asset-prefix/_next/static/chunks/7b788dd93ad868b3.js","async":true,"nonce":"$undefined"}],["$","script","script-14",{"src":"/litellm-asset-prefix/_next/static/chunks/a06cc76a774dd182.js","async":true,"nonce":"$undefined"}],["$","script","script-15",{"src":"/litellm-asset-prefix/_next/static/chunks/fcdf7322b0aa3e2e.js","async":true,"nonce":"$undefined"}],"$La","$Lb","$Lc","$Ld","$Le","$Lf","$L10","$L11","$L12","$L13","$L14","$L15","$L16","$L17","$L18","$L19","$L1a","$L1b","$L1c","$L1d","$L1e","$L1f","$L20","$L21","$L22","$L23","$L24","$L25","$L26","$L27","$L28","$L29","$L2a","$L2b","$L2c","$L2d","$L2e"],"$L2f"]}],{},null,false,false]},null,false,false],"$L30",false]],"m":"$undefined","G":["$31",[]],"S":true} 32:I[897367,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"OutletBoundary"] 33:"$Sreact.suspense" 35:I[897367,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"ViewportBoundary"] 37:I[897367,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"MetadataBoundary"] -a:["$","script","script-16",{"src":"/litellm-asset-prefix/_next/static/chunks/86828bdbafb8b581.js","async":true,"nonce":"$undefined"}] -b:["$","script","script-17",{"src":"/litellm-asset-prefix/_next/static/chunks/10dc4591ef08a91f.js","async":true,"nonce":"$undefined"}] -c:["$","script","script-18",{"src":"/litellm-asset-prefix/_next/static/chunks/e099566e8bd4ee4e.js","async":true,"nonce":"$undefined"}] -d:["$","script","script-19",{"src":"/litellm-asset-prefix/_next/static/chunks/fbe12a36d22e9554.js","async":true,"nonce":"$undefined"}] +a:["$","script","script-16",{"src":"/litellm-asset-prefix/_next/static/chunks/0974abc09c5e7ada.js","async":true,"nonce":"$undefined"}] +b:["$","script","script-17",{"src":"/litellm-asset-prefix/_next/static/chunks/ae625aa52246581e.js","async":true,"nonce":"$undefined"}] +c:["$","script","script-18",{"src":"/litellm-asset-prefix/_next/static/chunks/7a9066dcd4a390ff.js","async":true,"nonce":"$undefined"}] +d:["$","script","script-19",{"src":"/litellm-asset-prefix/_next/static/chunks/baadbd26839e7b66.js","async":true,"nonce":"$undefined"}] e:["$","script","script-20",{"src":"/litellm-asset-prefix/_next/static/chunks/2971c4658f1bcd7d.js","async":true,"nonce":"$undefined"}] f:["$","script","script-21",{"src":"/litellm-asset-prefix/_next/static/chunks/134f728fa7099e3e.js","async":true,"nonce":"$undefined"}] 10:["$","script","script-22",{"src":"/litellm-asset-prefix/_next/static/chunks/679dbd657c8b5aef.js","async":true,"nonce":"$undefined"}] -11:["$","script","script-23",{"src":"/litellm-asset-prefix/_next/static/chunks/94f7208f5087e27c.js","async":true,"nonce":"$undefined"}] -12:["$","script","script-24",{"src":"/litellm-asset-prefix/_next/static/chunks/43f6fc3c2ab9cf23.js","async":true,"nonce":"$undefined"}] +11:["$","script","script-23",{"src":"/litellm-asset-prefix/_next/static/chunks/88001a7ecaf7b1af.js","async":true,"nonce":"$undefined"}] +12:["$","script","script-24",{"src":"/litellm-asset-prefix/_next/static/chunks/cbc99c8fae110c02.js","async":true,"nonce":"$undefined"}] 13:["$","script","script-25",{"src":"/litellm-asset-prefix/_next/static/chunks/4e06277331e725da.js","async":true,"nonce":"$undefined"}] 14:["$","script","script-26",{"src":"/litellm-asset-prefix/_next/static/chunks/3b30ab8eaa03bc21.js","async":true,"nonce":"$undefined"}] -15:["$","script","script-27",{"src":"/litellm-asset-prefix/_next/static/chunks/ac3cf77acb5bf234.js","async":true,"nonce":"$undefined"}] -16:["$","script","script-28",{"src":"/litellm-asset-prefix/_next/static/chunks/fb125648f2dae104.js","async":true,"nonce":"$undefined"}] -17:["$","script","script-29",{"src":"/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js","async":true,"nonce":"$undefined"}] +15:["$","script","script-27",{"src":"/litellm-asset-prefix/_next/static/chunks/1c881baaaa68b7a5.js","async":true,"nonce":"$undefined"}] +16:["$","script","script-28",{"src":"/litellm-asset-prefix/_next/static/chunks/9955c118354ef6cc.js","async":true,"nonce":"$undefined"}] +17:["$","script","script-29",{"src":"/litellm-asset-prefix/_next/static/chunks/496b84010c33cf69.js","async":true,"nonce":"$undefined"}] 18:["$","script","script-30",{"src":"/litellm-asset-prefix/_next/static/chunks/a09028cd611c08ef.js","async":true,"nonce":"$undefined"}] -19:["$","script","script-31",{"src":"/litellm-asset-prefix/_next/static/chunks/6967a3b4ecbd3785.js","async":true,"nonce":"$undefined"}] -1a:["$","script","script-32",{"src":"/litellm-asset-prefix/_next/static/chunks/3e917c79aadd945b.js","async":true,"nonce":"$undefined"}] -1b:["$","script","script-33",{"src":"/litellm-asset-prefix/_next/static/chunks/9bbebdeb3f1cb03f.js","async":true,"nonce":"$undefined"}] +19:["$","script","script-31",{"src":"/litellm-asset-prefix/_next/static/chunks/99cf9cf99df5ccfc.js","async":true,"nonce":"$undefined"}] +1a:["$","script","script-32",{"src":"/litellm-asset-prefix/_next/static/chunks/ad02f56c287539eb.js","async":true,"nonce":"$undefined"}] +1b:["$","script","script-33",{"src":"/litellm-asset-prefix/_next/static/chunks/5181a28310842d3d.js","async":true,"nonce":"$undefined"}] 1c:["$","script","script-34",{"src":"/litellm-asset-prefix/_next/static/chunks/0a65da2cd24e2ab6.js","async":true,"nonce":"$undefined"}] -1d:["$","script","script-35",{"src":"/litellm-asset-prefix/_next/static/chunks/908828a91f602d8b.js","async":true,"nonce":"$undefined"}] -1e:["$","script","script-36",{"src":"/litellm-asset-prefix/_next/static/chunks/5f2d62a75803a3f7.js","async":true,"nonce":"$undefined"}] -1f:["$","script","script-37",{"src":"/litellm-asset-prefix/_next/static/chunks/ca5fbafaf3826374.js","async":true,"nonce":"$undefined"}] +1d:["$","script","script-35",{"src":"/litellm-asset-prefix/_next/static/chunks/16a1651c0b3e7c8e.js","async":true,"nonce":"$undefined"}] +1e:["$","script","script-36",{"src":"/litellm-asset-prefix/_next/static/chunks/a8f7c8c5eeb6e042.js","async":true,"nonce":"$undefined"}] +1f:["$","script","script-37",{"src":"/litellm-asset-prefix/_next/static/chunks/4980372eaa37b78b.js","async":true,"nonce":"$undefined"}] 20:["$","script","script-38",{"src":"/litellm-asset-prefix/_next/static/chunks/d3ac82723ec9e30d.js","async":true,"nonce":"$undefined"}] -21:["$","script","script-39",{"src":"/litellm-asset-prefix/_next/static/chunks/9b0ee76cbdef1a2a.js","async":true,"nonce":"$undefined"}] +21:["$","script","script-39",{"src":"/litellm-asset-prefix/_next/static/chunks/631b1874cba557c9.js","async":true,"nonce":"$undefined"}] 22:["$","script","script-40",{"src":"/litellm-asset-prefix/_next/static/chunks/1bc2898be56acd1b.js","async":true,"nonce":"$undefined"}] -23:["$","script","script-41",{"src":"/litellm-asset-prefix/_next/static/chunks/fcdf7322b0aa3e2e.js","async":true,"nonce":"$undefined"}] +23:["$","script","script-41",{"src":"/litellm-asset-prefix/_next/static/chunks/908828a91f602d8b.js","async":true,"nonce":"$undefined"}] 24:["$","script","script-42",{"src":"/litellm-asset-prefix/_next/static/chunks/878832edb30e99a4.js","async":true,"nonce":"$undefined"}] -25:["$","script","script-43",{"src":"/litellm-asset-prefix/_next/static/chunks/496b84010c33cf69.js","async":true,"nonce":"$undefined"}] -26:["$","script","script-44",{"src":"/litellm-asset-prefix/_next/static/chunks/8e3d0ce9505a304f.js","async":true,"nonce":"$undefined"}] +25:["$","script","script-43",{"src":"/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js","async":true,"nonce":"$undefined"}] +26:["$","script","script-44",{"src":"/litellm-asset-prefix/_next/static/chunks/003f1ffc5817ab83.js","async":true,"nonce":"$undefined"}] 27:["$","script","script-45",{"src":"/litellm-asset-prefix/_next/static/chunks/e1f23fd814ac3500.js","async":true,"nonce":"$undefined"}] 28:["$","script","script-46",{"src":"/litellm-asset-prefix/_next/static/chunks/88c74f8b4b20d25a.js","async":true,"nonce":"$undefined"}] -29:["$","script","script-47",{"src":"/litellm-asset-prefix/_next/static/chunks/99cf9cf99df5ccfc.js","async":true,"nonce":"$undefined"}] -2a:["$","script","script-48",{"src":"/litellm-asset-prefix/_next/static/chunks/4980372eaa37b78b.js","async":true,"nonce":"$undefined"}] -2b:["$","script","script-49",{"src":"/litellm-asset-prefix/_next/static/chunks/0cdfadbcf4b8c9e4.js","async":true,"nonce":"$undefined"}] +29:["$","script","script-47",{"src":"/litellm-asset-prefix/_next/static/chunks/23bfdf9b0544f0b1.js","async":true,"nonce":"$undefined"}] +2a:["$","script","script-48",{"src":"/litellm-asset-prefix/_next/static/chunks/ca5fbafaf3826374.js","async":true,"nonce":"$undefined"}] +2b:["$","script","script-49",{"src":"/litellm-asset-prefix/_next/static/chunks/726bebeef472c6cb.js","async":true,"nonce":"$undefined"}] 2c:["$","script","script-50",{"src":"/litellm-asset-prefix/_next/static/chunks/8f3bf592254c6c3b.js","async":true,"nonce":"$undefined"}] -2d:["$","script","script-51",{"src":"/litellm-asset-prefix/_next/static/chunks/8c17e934bd227606.js","async":true,"nonce":"$undefined"}] -2e:["$","script","script-52",{"src":"/litellm-asset-prefix/_next/static/chunks/b98447395b5d37ef.js","async":true,"nonce":"$undefined"}] +2d:["$","script","script-51",{"src":"/litellm-asset-prefix/_next/static/chunks/659ce28f2cb74401.js","async":true,"nonce":"$undefined"}] +2e:["$","script","script-52",{"src":"/litellm-asset-prefix/_next/static/chunks/16c0e58809eaf2b5.js","async":true,"nonce":"$undefined"}] 2f:["$","$L32",null,{"children":["$","$33",null,{"name":"Next.MetadataOutlet","children":"$@34"}]}] 30:["$","$1","h",{"children":[null,["$","$L35",null,{"children":"$L36"}],["$","div",null,{"hidden":true,"children":["$","$L37",null,{"children":["$","$33",null,{"name":"Next.Metadata","children":"$L38"}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}] 8:{} diff --git a/litellm/proxy/_experimental/out/__next._head.txt b/litellm/proxy/_experimental/out/__next._head.txt index 680119eb918..82758aa5c3f 100644 --- a/litellm/proxy/_experimental/out/__next._head.txt +++ b/litellm/proxy/_experimental/out/__next._head.txt @@ -3,4 +3,4 @@ 3:I[897367,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"MetadataBoundary"] 4:"$Sreact.suspense" 5:I[27201,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"IconMark"] -0:{"buildId":"8TZ2JbOi7SZ6BCj9ScTHW","rsc":["$","$1","h",{"children":[null,["$","$L2",null,{"children":[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]]}],["$","div",null,{"hidden":true,"children":["$","$L3",null,{"children":["$","$4",null,{"name":"Next.Metadata","children":[["$","title","0",{"children":"LiteLLM Dashboard"}],["$","meta","1",{"name":"description","content":"LiteLLM Proxy Admin UI"}],["$","link","2",{"rel":"icon","href":"/favicon.ico?favicon.1d32c690.ico","sizes":"48x48","type":"image/x-icon"}],["$","link","3",{"rel":"icon","href":"./favicon.ico"}],["$","$L5","4",{}]]}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],"loading":null,"isPartial":false} +0:{"buildId":"wnL6e5S6xaG1UdkxtYrTo","rsc":["$","$1","h",{"children":[null,["$","$L2",null,{"children":[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]]}],["$","div",null,{"hidden":true,"children":["$","$L3",null,{"children":["$","$4",null,{"name":"Next.Metadata","children":[["$","title","0",{"children":"LiteLLM Dashboard"}],["$","meta","1",{"name":"description","content":"LiteLLM Proxy Admin UI"}],["$","link","2",{"rel":"icon","href":"/favicon.ico?favicon.1d32c690.ico","sizes":"48x48","type":"image/x-icon"}],["$","link","3",{"rel":"icon","href":"./favicon.ico"}],["$","$L5","4",{}]]}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],"loading":null,"isPartial":false} diff --git a/litellm/proxy/_experimental/out/__next._index.txt b/litellm/proxy/_experimental/out/__next._index.txt index f23ca44427c..545ff2e55cc 100644 --- a/litellm/proxy/_experimental/out/__next._index.txt +++ b/litellm/proxy/_experimental/out/__next._index.txt @@ -5,4 +5,4 @@ 5:I[837457,["/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js","/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js"],"default"] :HL["/litellm-asset-prefix/_next/static/chunks/4e20891f2fd03463.css","style"] :HL["/litellm-asset-prefix/_next/static/chunks/91037395c95e366d.css","style"] -0:{"buildId":"8TZ2JbOi7SZ6BCj9ScTHW","rsc":["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/4e20891f2fd03463.css","precedence":"next"}],["$","link","1",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/91037395c95e366d.css","precedence":"next"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js","async":true}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js","async":true}]],["$","html",null,{"lang":"en","children":["$","body",null,{"className":"inter_5972bc34-module__OU16Qa__className","children":["$","$L2",null,{"children":["$","$L3",null,{"children":["$","$L4",null,{"parallelRouterKey":"children","template":["$","$L5",null,{}],"notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]]}]}]}]}]}]]}],"loading":null,"isPartial":false} +0:{"buildId":"wnL6e5S6xaG1UdkxtYrTo","rsc":["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/4e20891f2fd03463.css","precedence":"next"}],["$","link","1",{"rel":"stylesheet","href":"/litellm-asset-prefix/_next/static/chunks/91037395c95e366d.css","precedence":"next"}],["$","script","script-0",{"src":"/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js","async":true}],["$","script","script-1",{"src":"/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js","async":true}]],["$","html",null,{"lang":"en","children":["$","body",null,{"className":"inter_5972bc34-module__OU16Qa__className","children":["$","$L2",null,{"children":["$","$L3",null,{"children":["$","$L4",null,{"parallelRouterKey":"children","template":["$","$L5",null,{}],"notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]]}]}]}]}]}]]}],"loading":null,"isPartial":false} diff --git a/litellm/proxy/_experimental/out/__next._tree.txt b/litellm/proxy/_experimental/out/__next._tree.txt index 45dbee66029..10f5e5c2721 100644 --- a/litellm/proxy/_experimental/out/__next._tree.txt +++ b/litellm/proxy/_experimental/out/__next._tree.txt @@ -2,4 +2,4 @@ :HL["/litellm-asset-prefix/_next/static/chunks/91037395c95e366d.css","style"] :HL["/litellm-asset-prefix/_next/static/media/83afe278b6a6bb3c-s.p.3a6ba036.woff2","font",{"crossOrigin":"","type":"font/woff2"}] :HL["/litellm-asset-prefix/_next/static/chunks/3f3fa56b5786d58c.css","style"] -0:{"buildId":"8TZ2JbOi7SZ6BCj9ScTHW","tree":{"name":"","paramType":null,"paramKey":"","hasRuntimePrefetch":false,"slots":{"children":{"name":"__PAGE__","paramType":null,"paramKey":"__PAGE__","hasRuntimePrefetch":false,"slots":null,"isRootLayout":false}},"isRootLayout":true},"staleTime":300} +0:{"buildId":"wnL6e5S6xaG1UdkxtYrTo","tree":{"name":"","paramType":null,"paramKey":"","hasRuntimePrefetch":false,"slots":{"children":{"name":"__PAGE__","paramType":null,"paramKey":"__PAGE__","hasRuntimePrefetch":false,"slots":null,"isRootLayout":false}},"isRootLayout":true},"staleTime":300} diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/003f1ffc5817ab83.js b/litellm/proxy/_experimental/out/_next/static/chunks/003f1ffc5817ab83.js new file mode 100644 index 00000000000..0311d4a524c --- /dev/null +++ b/litellm/proxy/_experimental/out/_next/static/chunks/003f1ffc5817ab83.js @@ -0,0 +1 @@ +(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,625901,e=>{"use strict";var t=e.i(266027),l=e.i(621482),a=e.i(243652),r=e.i(764205),s=e.i(135214);let i=(0,a.createQueryKeys)("models"),o=(0,a.createQueryKeys)("modelHub"),n=(0,a.createQueryKeys)("allProxyModels");(0,a.createQueryKeys)("selectedTeamModels");let d=(0,a.createQueryKeys)("infiniteModels");e.s(["useAllProxyModels",0,()=>{let{accessToken:e,userId:l,userRole:a}=(0,s.default)();return(0,t.useQuery)({queryKey:n.list({}),queryFn:async()=>await (0,r.modelAvailableCall)(e,l,a,!0,null,!0,!1,"expand"),enabled:!!(e&&l&&a)})},"useInfiniteModelInfo",0,(e=50,t)=>{let{accessToken:a,userId:i,userRole:o}=(0,s.default)();return(0,l.useInfiniteQuery)({queryKey:d.list({filters:{...i&&{userId:i},...o&&{userRole:o},size:e,...t&&{search:t}}}),queryFn:async({pageParam:l})=>await (0,r.modelInfoCall)(a,i,o,l,e,t),initialPageParam:1,getNextPageParam:e=>{if(e.current_page{let{accessToken:e}=(0,s.default)();return(0,t.useQuery)({queryKey:o.list({}),queryFn:async()=>await (0,r.modelHubCall)(e),enabled:!!e})},"useModelsInfo",0,(e=1,l=50,a,o,n,d,m)=>{let{accessToken:c,userId:u,userRole:g}=(0,s.default)();return(0,t.useQuery)({queryKey:i.list({filters:{...u&&{userId:u},...g&&{userRole:g},page:e,size:l,...a&&{search:a},...o&&{modelId:o},...n&&{teamId:n},...d&&{sortBy:d},...m&&{sortOrder:m}}}),queryFn:async()=>await (0,r.modelInfoCall)(c,u,g,e,l,a,o,n,d,m),enabled:!!(c&&u&&g)})}])},91979,e=>{"use strict";e.i(247167);var t=e.i(931067),l=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M909.1 209.3l-56.4 44.1C775.8 155.1 656.2 92 521.9 92 290 92 102.3 279.5 102 511.5 101.7 743.7 289.8 932 521.9 932c181.3 0 335.8-115 394.6-276.1 1.5-4.2-.7-8.9-4.9-10.3l-56.7-19.5a8 8 0 00-10.1 4.8c-1.8 5-3.8 10-5.9 14.9-17.3 41-42.1 77.8-73.7 109.4A344.77 344.77 0 01655.9 829c-42.3 17.9-87.4 27-133.8 27-46.5 0-91.5-9.1-133.8-27A341.5 341.5 0 01279 755.2a342.16 342.16 0 01-73.7-109.4c-17.9-42.4-27-87.4-27-133.9s9.1-91.5 27-133.9c17.3-41 42.1-77.8 73.7-109.4 31.6-31.6 68.4-56.4 109.3-73.8 42.3-17.9 87.4-27 133.8-27 46.5 0 91.5 9.1 133.8 27a341.5 341.5 0 01109.3 73.8c9.9 9.9 19.2 20.4 27.8 31.4l-60.2 47a8 8 0 003 14.1l175.6 43c5 1.2 9.9-2.6 9.9-7.7l.8-180.9c-.1-6.6-7.8-10.3-13-6.2z"}}]},name:"reload",theme:"outlined"};var r=e.i(9583),s=l.forwardRef(function(e,s){return l.createElement(r.default,(0,t.default)({},e,{ref:s,icon:a}))});e.s(["ReloadOutlined",0,s],91979)},969550,e=>{"use strict";var t=e.i(843476),l=e.i(271645);let a=l.forwardRef(function(e,t){return l.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),l.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M3 4a1 1 0 011-1h16a1 1 0 011 1v2.586a1 1 0 01-.293.707l-6.414 6.414a1 1 0 00-.293.707V17l-4 4v-6.586a1 1 0 00-.293-.707L3.293 7.293A1 1 0 013 6.586V4z"}))});var r=e.i(464571),s=e.i(311451),i=e.i(199133),o=e.i(374009);e.s(["default",0,({options:e,onApplyFilters:n,onResetFilters:d,initialValues:m={},buttonLabel:c="Filters"})=>{let[u,g]=(0,l.useState)(!1),[h,p]=(0,l.useState)(m),[x,b]=(0,l.useState)({}),[_,f]=(0,l.useState)({}),[y,j]=(0,l.useState)({}),[v,w]=(0,l.useState)({}),C=(0,l.useCallback)((0,o.default)(async(e,t)=>{if(t.isSearchable&&t.searchFn){f(e=>({...e,[t.name]:!0}));try{let l=await t.searchFn(e);b(e=>({...e,[t.name]:l}))}catch(e){console.error("Error searching:",e),b(e=>({...e,[t.name]:[]}))}finally{f(e=>({...e,[t.name]:!1}))}}},300),[]),S=(0,l.useCallback)(async e=>{if(e.isSearchable&&e.searchFn&&!v[e.name]){f(t=>({...t,[e.name]:!0})),w(t=>({...t,[e.name]:!0}));try{let t=await e.searchFn("");b(l=>({...l,[e.name]:t}))}catch(t){console.error("Error loading initial options:",t),b(t=>({...t,[e.name]:[]}))}finally{f(t=>({...t,[e.name]:!1}))}}},[v]);(0,l.useEffect)(()=>{u&&e.forEach(e=>{e.isSearchable&&!v[e.name]&&S(e)})},[u,e,S,v]);let T=(e,t)=>{let l={...h,[e]:t};p(l),n(l)};return(0,t.jsxs)("div",{className:"w-full",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2 mb-6",children:[(0,t.jsx)(r.Button,{icon:(0,t.jsx)(a,{className:"h-4 w-4"}),onClick:()=>g(!u),className:"flex items-center gap-2",children:c}),(0,t.jsx)(r.Button,{onClick:()=>{let t={};e.forEach(e=>{t[e.name]=""}),p(t),d()},children:"Reset Filters"})]}),u&&(0,t.jsx)("div",{className:"grid grid-cols-3 gap-x-6 gap-y-4 mb-6",children:["Team ID","Status","Organization ID","Key Alias","User ID","End User","Error Code","Error Message","Key Hash","Model","Public model / search tool"].map(l=>{let a,r=e.find(e=>e.label===l||e.name===l);return r?(0,t.jsxs)("div",{className:"flex flex-col gap-2",children:[(0,t.jsx)("label",{className:"text-sm text-gray-600",children:r.label||r.name}),r.isSearchable?(0,t.jsx)(i.Select,{showSearch:!0,className:"w-full",placeholder:`Search ${r.label||r.name}...`,value:h[r.name]||void 0,onChange:e=>T(r.name,e),onOpenChange:e=>{e&&r.isSearchable&&!v[r.name]&&S(r)},onSearch:e=>{j(t=>({...t,[r.name]:e})),r.searchFn&&C(e,r)},filterOption:!1,loading:_[r.name],options:x[r.name]||[],allowClear:!0,notFoundContent:_[r.name]?"Loading...":"No results found"}):r.options?(0,t.jsx)(i.Select,{className:"w-full",placeholder:`Select ${r.label||r.name}...`,value:h[r.name]||void 0,onChange:e=>T(r.name,e),allowClear:!0,children:r.options.map(e=>(0,t.jsx)(i.Select.Option,{value:e.value,children:e.label},e.value))}):r.customComponent?(a=r.customComponent,(0,t.jsx)(a,{value:h[r.name]||void 0,onChange:e=>T(r.name,e??""),placeholder:`Select ${r.label||r.name}...`,allFilters:h})):(0,t.jsx)(s.Input,{className:"w-full",placeholder:`Enter ${r.label||r.name}...`,value:h[r.name]||"",onChange:e=>T(r.name,e.target.value),allowClear:!0})]},r.name):null})})]})}],969550)},633627,e=>{"use strict";var t=e.i(764205);let l=(e,t,l,a)=>{for(let r of e){let e=r?.key_alias;e&&"string"==typeof e&&t.add(e.trim());let s=r?.organization_id??r?.org_id;s&&"string"==typeof s&&l.add(s.trim());let i=r?.user_id;if(i&&"string"==typeof i){let e=r?.user?.user_email||i;a.set(i,e)}}},a=async(e,a)=>{if(!e||!a)return{keyAliases:[],organizationIds:[],userIds:[]};try{let r=new Set,s=new Set,i=new Map,o=await (0,t.keyListCall)(e,null,a,null,null,null,1,100,null,null,"user",null),n=o?.keys||[],d=o?.total_pages??1;l(n,r,s,i);let m=Math.min(d,10)-1;if(m>0){let o=Array.from({length:m},(l,r)=>(0,t.keyListCall)(e,null,a,null,null,null,r+2,100,null,null,"user",null));for(let e of(await Promise.allSettled(o)))"fulfilled"===e.status&&l(e.value?.keys||[],r,s,i)}return{keyAliases:Array.from(r).sort(),organizationIds:Array.from(s).sort(),userIds:Array.from(i.entries()).map(([e,t])=>({id:e,email:t}))}}catch(e){return console.error("Error fetching team filter options:",e),{keyAliases:[],organizationIds:[],userIds:[]}}},r=async(e,l)=>{if(!e)return[];try{let a=[],r=1,s=!0;for(;s;){let i=await (0,t.teamListCall)(e,l||null,null);a=[...a,...i],r{if(!e)return[];try{let l=[],a=1,r=!0;for(;r;){let s=await (0,t.organizationListCall)(e);l=[...l,...s],a{"use strict";var t=e.i(271645);let l=t.forwardRef(function(e,l){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:l},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M8 5H6a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2v-1M8 5a2 2 0 002 2h2a2 2 0 002-2M8 5a2 2 0 012-2h2a2 2 0 012 2m0 0h2a2 2 0 012 2v3m2 4H10m0 0l3-3m-3 3l3 3"}))});e.s(["ClipboardCopyIcon",0,l],551332)},122577,e=>{"use strict";var t=e.i(271645);let l=t.forwardRef(function(e,l){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:l},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M14.752 11.168l-3.197-2.132A1 1 0 0010 9.87v4.263a1 1 0 001.555.832l3.197-2.132a1 1 0 000-1.664z"}),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M21 12a9 9 0 11-18 0 9 9 0 0118 0z"}))});e.s(["PlayIcon",0,l],122577)},902555,e=>{"use strict";var t=e.i(843476),l=e.i(591935),a=e.i(122577),r=e.i(278587),s=e.i(68155),i=e.i(360820),o=e.i(871943),n=e.i(434626),d=e.i(551332),m=e.i(592968),c=e.i(115504),u=e.i(752978);function g({icon:e,onClick:l,className:a,disabled:r,dataTestId:s}){return r?(0,t.jsx)(u.Icon,{icon:e,size:"sm",className:"opacity-50 cursor-not-allowed","data-testid":s}):(0,t.jsx)(u.Icon,{icon:e,size:"sm",onClick:l,className:(0,c.cx)("cursor-pointer",a),"data-testid":s})}let h={Edit:{icon:l.PencilAltIcon,className:"hover:text-blue-600"},Delete:{icon:s.TrashIcon,className:"hover:text-red-600"},Test:{icon:a.PlayIcon,className:"hover:text-blue-600"},Regenerate:{icon:r.RefreshIcon,className:"hover:text-green-600"},Up:{icon:i.ChevronUpIcon,className:"hover:text-blue-600"},Down:{icon:o.ChevronDownIcon,className:"hover:text-blue-600"},Open:{icon:n.ExternalLinkIcon,className:"hover:text-green-600"},Copy:{icon:d.ClipboardCopyIcon,className:"hover:text-blue-600"}};function p({onClick:e,tooltipText:l,disabled:a=!1,disabledTooltipText:r,dataTestId:s,variant:i}){let{icon:o,className:n}=h[i];return(0,t.jsx)(m.Tooltip,{title:a?r:l,children:(0,t.jsx)("span",{children:(0,t.jsx)(g,{icon:o,onClick:e,className:n,disabled:a,dataTestId:s})})})}e.s(["default",()=>p],902555)},434626,e=>{"use strict";var t=e.i(271645);let l=t.forwardRef(function(e,l){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:l},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"}))});e.s(["ExternalLinkIcon",0,l],434626)},278587,e=>{"use strict";var t=e.i(271645);let l=t.forwardRef(function(e,l){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:l},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"}))});e.s(["RefreshIcon",0,l],278587)},207670,e=>{"use strict";function t(){for(var e,t,l=0,a="",r=arguments.length;lt,"default",0,t])},728889,e=>{"use strict";var t=e.i(290571),l=e.i(271645),a=e.i(829087),r=e.i(480731),s=e.i(444755),i=e.i(673706),o=e.i(95779);let n={xs:{paddingX:"px-1.5",paddingY:"py-1.5"},sm:{paddingX:"px-1.5",paddingY:"py-1.5"},md:{paddingX:"px-2",paddingY:"py-2"},lg:{paddingX:"px-2",paddingY:"py-2"},xl:{paddingX:"px-2.5",paddingY:"py-2.5"}},d={xs:{height:"h-3",width:"w-3"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-7",width:"w-7"},xl:{height:"h-9",width:"w-9"}},m={simple:{rounded:"",border:"",ring:"",shadow:""},light:{rounded:"rounded-tremor-default",border:"",ring:"",shadow:""},shadow:{rounded:"rounded-tremor-default",border:"border",ring:"",shadow:"shadow-tremor-card dark:shadow-dark-tremor-card"},solid:{rounded:"rounded-tremor-default",border:"border-2",ring:"ring-1",shadow:""},outlined:{rounded:"rounded-tremor-default",border:"border",ring:"ring-2",shadow:""}},c=(0,i.makeClassName)("Icon"),u=l.default.forwardRef((e,u)=>{let{icon:g,variant:h="simple",tooltip:p,size:x=r.Sizes.SM,color:b,className:_}=e,f=(0,t.__rest)(e,["icon","variant","tooltip","size","color","className"]),y=((e,t)=>{switch(e){case"simple":return{textColor:t?(0,i.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:"",borderColor:"",ringColor:""};case"light":return{textColor:t?(0,i.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,s.tremorTwMerge)((0,i.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand-muted dark:bg-dark-tremor-brand-muted",borderColor:"",ringColor:""};case"shadow":return{textColor:t?(0,i.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,s.tremorTwMerge)((0,i.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:"border-tremor-border dark:border-dark-tremor-border",ringColor:""};case"solid":return{textColor:t?(0,i.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:t?(0,s.tremorTwMerge)((0,i.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand dark:bg-dark-tremor-brand",borderColor:"border-tremor-brand-inverted dark:border-dark-tremor-brand-inverted",ringColor:"ring-tremor-ring dark:ring-dark-tremor-ring"};case"outlined":return{textColor:t?(0,i.getColorClassNames)(t,o.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,s.tremorTwMerge)((0,i.getColorClassNames)(t,o.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:t?(0,i.getColorClassNames)(t,o.colorPalette.ring).borderColor:"border-tremor-brand-subtle dark:border-dark-tremor-brand-subtle",ringColor:t?(0,s.tremorTwMerge)((0,i.getColorClassNames)(t,o.colorPalette.ring).ringColor,"ring-opacity-40"):"ring-tremor-brand-muted dark:ring-dark-tremor-brand-muted"}}})(h,b),{tooltipProps:j,getReferenceProps:v}=(0,a.useTooltip)();return l.default.createElement("span",Object.assign({ref:(0,i.mergeRefs)([u,j.refs.setReference]),className:(0,s.tremorTwMerge)(c("root"),"inline-flex shrink-0 items-center justify-center",y.bgColor,y.textColor,y.borderColor,y.ringColor,m[h].rounded,m[h].border,m[h].shadow,m[h].ring,n[x].paddingX,n[x].paddingY,_)},v,f),l.default.createElement(a.default,Object.assign({text:p},j)),l.default.createElement(g,{className:(0,s.tremorTwMerge)(c("icon"),"shrink-0",d[x].height,d[x].width)}))});u.displayName="Icon",e.s(["default",()=>u],728889)},752978,e=>{"use strict";var t=e.i(728889);e.s(["Icon",()=>t.default])},591935,e=>{"use strict";var t=e.i(271645);let l=t.forwardRef(function(e,l){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:l},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"}))});e.s(["PencilAltIcon",0,l],591935)},907308,e=>{"use strict";var t=e.i(843476),l=e.i(271645),a=e.i(212931),r=e.i(808613),s=e.i(464571),i=e.i(199133),o=e.i(592968),n=e.i(213205),d=e.i(374009),m=e.i(764205);e.s(["default",0,({isVisible:e,onCancel:c,onSubmit:u,accessToken:g,title:h="Add Team Member",roles:p=[{label:"admin",value:"admin",description:"Admin role. Can create team keys, add members, and manage settings."},{label:"user",value:"user",description:"User role. Can view team info, but not manage it."}],defaultRole:x="user",teamId:b})=>{let[_]=r.Form.useForm(),[f,y]=(0,l.useState)([]),[j,v]=(0,l.useState)(!1),[w,C]=(0,l.useState)("user_email"),[S,T]=(0,l.useState)(!1),N=async(e,t)=>{if(!e)return void y([]);v(!0);try{let l=new URLSearchParams;if(l.append(t,e),b&&l.append("team_id",b),null==g)return;let a=(await (0,m.userFilterUICall)(g,l)).map(e=>({label:"user_email"===t?`${e.user_email}`:`${e.user_id}`,value:"user_email"===t?e.user_email:e.user_id,user:e}));y(a)}catch(e){console.error("Error fetching users:",e)}finally{v(!1)}},k=(0,l.useCallback)((0,d.default)((e,t)=>N(e,t),300),[]),I=(e,t)=>{C(t),k(e,t)},M=(e,t)=>{let l=t.user;_.setFieldsValue({user_email:l.user_email,user_id:l.user_id,role:_.getFieldValue("role")})},A=async e=>{T(!0);try{await u(e)}finally{T(!1)}};return(0,t.jsx)(a.Modal,{title:h,open:e,onCancel:()=>{_.resetFields(),y([]),c()},footer:null,width:800,maskClosable:!S,children:(0,t.jsxs)(r.Form,{form:_,onFinish:A,labelCol:{span:8},wrapperCol:{span:16},labelAlign:"left",initialValues:{role:x},children:[(0,t.jsx)(r.Form.Item,{label:"Email",name:"user_email",className:"mb-4",children:(0,t.jsx)(i.Select,{showSearch:!0,className:"w-full",placeholder:"Search by email",filterOption:!1,onSearch:e=>I(e,"user_email"),onSelect:(e,t)=>M(e,t),options:"user_email"===w?f:[],loading:j,allowClear:!0,"data-testid":"member-email-search"})}),(0,t.jsx)("div",{className:"text-center mb-4",children:"OR"}),(0,t.jsx)(r.Form.Item,{label:"User ID",name:"user_id",className:"mb-4",children:(0,t.jsx)(i.Select,{showSearch:!0,className:"w-full",placeholder:"Search by user ID",filterOption:!1,onSearch:e=>I(e,"user_id"),onSelect:(e,t)=>M(e,t),options:"user_id"===w?f:[],loading:j,allowClear:!0})}),(0,t.jsx)(r.Form.Item,{label:"Member Role",name:"role",className:"mb-4",children:(0,t.jsx)(i.Select,{defaultValue:x,children:p.map(e=>(0,t.jsx)(i.Select.Option,{value:e.value,children:(0,t.jsxs)(o.Tooltip,{title:e.description,children:[(0,t.jsx)("span",{className:"font-medium",children:e.label}),(0,t.jsxs)("span",{className:"ml-2 text-gray-500 text-sm",children:["- ",e.description]})]})},e.value))})}),(0,t.jsx)("div",{className:"text-right mt-4",children:(0,t.jsx)(s.Button,{type:"primary",htmlType:"submit",icon:(0,t.jsx)(n.UserAddOutlined,{}),loading:S,children:S?"Adding...":"Add Member"})})]})})}])},162386,e=>{"use strict";var t=e.i(843476),l=e.i(625901),a=e.i(109799),r=e.i(785242),s=e.i(738014),i=e.i(199133),o=e.i(981339),n=e.i(592968);let d={label:"All Proxy Models",value:"all-proxy-models"},m={label:"No Default Models",value:"no-default-models"},c=[d,m],u={user:({allProxyModels:e,userModels:t,options:l})=>t&&l?.includeUserModels?t:[],team:({allProxyModels:e,selectedOrganization:t,userModels:l})=>t?t.models.includes(d.value)||0===t.models.length?e:e.filter(e=>t.models.includes(e)):e??[],organization:({allProxyModels:e})=>e,global:({allProxyModels:e})=>e};e.s(["ModelSelect",0,e=>{let{teamID:g,organizationID:h,options:p,context:x,dataTestId:b,value:_=[],onChange:f,style:y}=e,{includeUserModels:j,showAllTeamModelsOption:v,showAllProxyModelsOverride:w,includeSpecialOptions:C}=p||{},{data:S,isLoading:T}=(0,l.useAllProxyModels)(),{data:N,isLoading:k}=(0,r.useTeam)(g),{data:I,isLoading:M}=(0,a.useOrganization)(h),{data:A,isLoading:F}=(0,s.useCurrentUser)(),O=e=>c.some(t=>t.value===e),z=_.some(O),P=I?.models.includes(d.value)||I?.models.length===0;if(T||k||M||F)return(0,t.jsx)(o.Skeleton.Input,{active:!0,block:!0});let{wildcard:L,regular:D}=(e=>{let t=[],l=[];for(let a of e)a.endsWith("/*")?t.push(a):l.push(a);return{wildcard:t,regular:l}})(((e,t,l)=>{let a=Array.from(new Map(e.map(e=>[e.id,e])).values()).map(e=>e.id);if(t.options?.showAllProxyModelsOverride)return a;let r=u[t.context];return r?r({allProxyModels:a,...l,options:t.options}):[]})(S?.data??[],e,{selectedTeam:N,selectedOrganization:I,userModels:A?.models}));return(0,t.jsx)(i.Select,{"data-testid":b,value:_,onChange:e=>{let t=e.filter(O);f(t.length>0?[t[t.length-1]]:e)},style:y,options:[...C?[{label:(0,t.jsx)("span",{children:"Special Options"}),title:"Special Options",options:[...w||P&&C||"global"===x?[{label:(0,t.jsx)("span",{children:"All Proxy Models"}),value:d.value,disabled:_.length>0&&_.some(e=>O(e)&&e!==d.value),key:d.value}]:[],{label:(0,t.jsx)("span",{children:"No Default Models"}),value:m.value,disabled:_.length>0&&_.some(e=>O(e)&&e!==m.value),key:m.value}]}]:[],...L.length>0?[{label:(0,t.jsx)("span",{children:"Wildcard Options"}),title:"Wildcard Options",options:L.map(e=>{let l=e.replace("/*",""),a=l.charAt(0).toUpperCase()+l.slice(1);return{label:(0,t.jsx)("span",{children:`All ${a} models`}),value:e,disabled:z}})}]:[],{label:(0,t.jsx)("span",{children:"Models"}),title:"Models",options:D.map(e=>({label:(0,t.jsx)("span",{children:e}),value:e,disabled:z}))}],mode:"multiple",placeholder:"Select Models",allowClear:!0,maxTagCount:"responsive",maxTagPlaceholder:e=>(0,t.jsx)(n.Tooltip,{styles:{root:{pointerEvents:"none"}},title:e.map(({value:e})=>e).join(", "),children:(0,t.jsxs)("span",{children:["+",e.length," more"]})})})}],162386)},276173,e=>{"use strict";var t=e.i(843476),l=e.i(599724),a=e.i(779241),r=e.i(464571),s=e.i(808613),i=e.i(212931),o=e.i(199133),n=e.i(271645),d=e.i(435451);e.s(["default",0,({visible:e,onCancel:m,onSubmit:c,initialData:u,mode:g,config:h})=>{let p,[x]=s.Form.useForm(),[b,_]=(0,n.useState)(!1);console.log("Initial Data:",u),(0,n.useEffect)(()=>{if(e)if("edit"===g&&u){let e={...u,role:u.role||h.defaultRole,max_budget_in_team:u.max_budget_in_team||null,tpm_limit:u.tpm_limit||null,rpm_limit:u.rpm_limit||null,allowed_models:u.allowed_models||[]};console.log("Setting form values:",e),x.setFieldsValue(e)}else x.resetFields(),x.setFieldsValue({role:h.defaultRole||h.roleOptions[0]?.value})},[e,u,g,x,h.defaultRole,h.roleOptions]);let f=async e=>{try{_(!0);let t=Object.entries(e).reduce((e,[t,l])=>{if("string"==typeof l){let a=l.trim();return""===a&&("max_budget_in_team"===t||"tpm_limit"===t||"rpm_limit"===t)?{...e,[t]:null}:{...e,[t]:a}}return{...e,[t]:l}},{});console.log("Submitting form data:",t),await Promise.resolve(c(t)),x.resetFields()}catch(e){console.error("Form submission error:",e)}finally{_(!1)}};return(0,t.jsx)(i.Modal,{title:h.title||("add"===g?"Add Member":"Edit Member"),open:e,width:1e3,footer:null,onCancel:m,children:(0,t.jsxs)(s.Form,{form:x,onFinish:f,labelCol:{span:8},wrapperCol:{span:16},labelAlign:"left",children:[h.showEmail&&(0,t.jsx)(s.Form.Item,{label:"Email",name:"user_email",className:"mb-4",rules:[{type:"email",message:"Please enter a valid email!"}],children:(0,t.jsx)(a.TextInput,{placeholder:"user@example.com"})}),h.showEmail&&h.showUserId&&(0,t.jsx)("div",{className:"text-center mb-4",children:(0,t.jsx)(l.Text,{children:"OR"})}),h.showUserId&&(0,t.jsx)(s.Form.Item,{label:"User ID",name:"user_id",className:"mb-4",children:(0,t.jsx)(a.TextInput,{placeholder:"user_123"})}),(0,t.jsx)(s.Form.Item,{label:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)("span",{children:"Role"}),"edit"===g&&u&&(0,t.jsxs)("span",{className:"text-gray-500 text-sm",children:["(Current: ",(p=u.role,h.roleOptions.find(e=>e.value===p)?.label||p),")"]})]}),name:"role",className:"mb-4",rules:[{required:!0,message:"Please select a role!"}],children:(0,t.jsx)(o.Select,{children:"edit"===g&&u?[...h.roleOptions.filter(e=>e.value===u.role),...h.roleOptions.filter(e=>e.value!==u.role)].map(e=>(0,t.jsx)(o.Select.Option,{value:e.value,children:e.label},e.value)):h.roleOptions.map(e=>(0,t.jsx)(o.Select.Option,{value:e.value,children:e.label},e.value))})}),h.additionalFields?.map(e=>(0,t.jsx)(s.Form.Item,{label:e.label,name:e.name,className:"mb-4",rules:e.rules,children:(e=>{switch(e.type){case"input":return(0,t.jsx)(a.TextInput,{placeholder:e.placeholder});case"numerical":return(0,t.jsx)(d.default,{step:e.step||1,min:e.min||0,style:{width:"100%"},placeholder:e.placeholder||"Enter a numerical value"});case"select":return(0,t.jsx)(o.Select,{children:e.options?.map(e=>(0,t.jsx)(o.Select.Option,{value:e.value,children:e.label},e.value))});case"multi-select":return(0,t.jsx)(o.Select,{mode:"multiple",placeholder:e.placeholder||"Select options",options:e.options,allowClear:!0});default:return null}})(e)},e.name)),(0,t.jsxs)("div",{className:"text-right mt-6",children:[(0,t.jsx)(r.Button,{onClick:m,className:"mr-2",disabled:b,children:"Cancel"}),(0,t.jsx)(r.Button,{type:"default",htmlType:"submit",loading:b,children:"add"===g?b?"Adding...":"Add Member":b?"Saving...":"Save Changes"})]})]})})}])},294612,e=>{"use strict";var t=e.i(843476),l=e.i(100486),a=e.i(827252),r=e.i(213205),s=e.i(771674),i=e.i(464571),o=e.i(770914),n=e.i(291542),d=e.i(262218),m=e.i(592968),c=e.i(898586),u=e.i(902555);let{Text:g}=c.Typography;function h({members:e,canEdit:c,onEdit:h,onDelete:p,onAddMember:x,roleColumnTitle:b="Role",roleTooltip:_,extraColumns:f=[],showDeleteForMember:y,emptyText:j}){let v=[{title:"User Email",dataIndex:"user_email",key:"user_email",render:e=>(0,t.jsx)(g,{children:e||"-"})},{title:"User ID",dataIndex:"user_id",key:"user_id",render:e=>"default_user_id"===e?(0,t.jsx)(d.Tag,{color:"blue",children:"Default Proxy Admin"}):(0,t.jsx)(g,{children:e||"-"})},{title:_?(0,t.jsxs)(o.Space,{direction:"horizontal",children:[b,(0,t.jsx)(m.Tooltip,{title:_,children:(0,t.jsx)(a.InfoCircleOutlined,{})})]}):b,dataIndex:"role",key:"role",render:e=>(0,t.jsxs)(o.Space,{children:[e?.toLowerCase()==="admin"||e?.toLowerCase()==="org_admin"?(0,t.jsx)(l.CrownOutlined,{}):(0,t.jsx)(s.UserOutlined,{}),(0,t.jsx)(g,{style:{textTransform:"capitalize"},children:e||"-"})]})},...f,{title:"Actions",key:"actions",fixed:"right",width:120,render:(e,l)=>c?(0,t.jsxs)(o.Space,{children:[(0,t.jsx)(u.default,{variant:"Edit",tooltipText:"Edit member",dataTestId:"edit-member",onClick:()=>h(l)}),(!y||y(l))&&(0,t.jsx)(u.default,{variant:"Delete",tooltipText:"Delete member",dataTestId:"delete-member",onClick:()=>p(l)})]}):null}];return(0,t.jsxs)(o.Space,{direction:"vertical",style:{width:"100%"},children:[(0,t.jsxs)("span",{className:"inline-flex text-sm text-gray-700",children:[e.length," Member",1!==e.length?"s":""]}),(0,t.jsx)(n.Table,{columns:v,dataSource:e,rowKey:e=>e.user_id??e.user_email??JSON.stringify(e),pagination:!1,size:"small",scroll:{x:"max-content"},locale:j?{emptyText:j}:void 0}),x&&c&&(0,t.jsx)(i.Button,{icon:(0,t.jsx)(r.UserAddOutlined,{}),type:"primary",onClick:x,children:"Add Member"})]})}e.s(["default",()=>h])},56567,838932,471145,e=>{"use strict";var t=e.i(843476),l=e.i(135214),a=e.i(109799),r=e.i(912598),s=e.i(907308),i=e.i(764205),o=e.i(266027);let n=(0,e.i(243652).createQueryKeys)("guardrails"),d=()=>{let{accessToken:e,userId:t,userRole:a}=(0,l.default)();return(0,o.useQuery)({queryKey:n.list({}),queryFn:async()=>(0,i.getGuardrailsList)(e),enabled:!!(e&&t&&a),select:e=>{let t=e?.guardrails??[],l=new Set,a=new Set;for(let e of t)e.litellm_params?.default_on?l.add(e.guardrail_name):a.add(e.guardrail_name);return{guardrails:t,globalGuardrailNames:l,optionalGuardrailNames:a}}})};e.s(["useGuardrails",0,d],838932);var m=e.i(500330),c=e.i(11751),u=e.i(708347),g=e.i(751904),h=e.i(160818),p=e.i(827252),x=e.i(564897),b=e.i(646563),_=e.i(987432),f=e.i(530212),y=e.i(677667),j=e.i(130643),v=e.i(898667),w=e.i(389083),C=e.i(304967),S=e.i(350967),T=e.i(599724),N=e.i(779241),k=e.i(629569),I=e.i(464571),M=e.i(808613),A=e.i(311451),F=e.i(28651),O=e.i(199133),z=e.i(770914),P=e.i(790848),L=e.i(653496),D=e.i(262218),R=e.i(592968),E=e.i(888259),B=e.i(678784),U=e.i(118366),V=e.i(271645),K=e.i(9314),$=e.i(552130),G=e.i(127952);function W({className:e,value:l,onChange:a}){return(0,t.jsxs)(O.Select,{className:e,value:l,onChange:a,children:[(0,t.jsx)(O.Select.Option,{value:"24h",children:"Daily"}),(0,t.jsx)(O.Select.Option,{value:"7d",children:"Weekly"}),(0,t.jsx)(O.Select.Option,{value:"30d",children:"Monthly"})]})}var q=e.i(844565),H=e.i(355619);let Q=function({globalGuardrailNames:e,teamGuardrails:l=[],optedOutGlobalGuardrails:a=[],killSwitchOn:r=!1,variant:s="card",className:i=""}){let o=new Set(a),n=Array.from(e).filter(e=>!o.has(e)),d=l.filter(t=>!e.has(t)),m=r||0!==n.length||0!==d.length?(0,t.jsxs)("div",{className:"flex flex-col gap-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsxs)("span",{className:"block text-sm font-medium text-gray-700 mb-2",children:[(0,t.jsx)(h.GlobalOutlined,{style:{marginInlineEnd:4},"aria-label":"Global guardrail"}),"Global"]}),r?(0,t.jsx)(D.Tag,{color:"gold",children:"Bypassed for this team"}):n.length>0?(0,t.jsx)("div",{className:"flex flex-wrap gap-2",children:n.map(e=>(0,t.jsx)(D.Tag,{color:"blue",children:e},e))}):(0,t.jsx)("span",{className:"block text-sm text-gray-500",children:"None configured"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{className:"block text-sm font-medium text-gray-700 mb-2",children:"Team-specific"}),d.length>0?(0,t.jsx)("div",{className:"flex flex-wrap gap-2",children:d.map(e=>(0,t.jsx)(D.Tag,{color:"blue",children:e},e))}):(0,t.jsx)("span",{className:"block text-sm text-gray-500",children:"None configured"})]})]}):(0,t.jsx)("span",{className:"block text-gray-500",children:"No guardrails configured"});return"card"===s?(0,t.jsxs)("div",{className:`bg-white border border-gray-200 rounded-lg p-6 ${i}`,children:[(0,t.jsx)("div",{className:"flex items-center gap-2 mb-6",children:(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{className:"block font-semibold text-gray-900",children:"Guardrails Settings"}),(0,t.jsx)("span",{className:"block text-xs text-gray-500",children:"Global and team-specific guardrails applied to this team"})]})}),m]}):(0,t.jsxs)("div",{className:`${i}`,children:[(0,t.jsx)("span",{className:"block font-medium text-gray-900 mb-3",children:"Guardrails Settings"}),m]})};var Y=e.i(643449),J=e.i(75921),X=e.i(390605),Z=e.i(162386),ee=e.i(727749),et=e.i(384767),el=e.i(435451),ea=e.i(916940);let er=({onChange:e,value:l,className:a,accessToken:r,placeholder:s="Select search tools (optional)",disabled:o=!1})=>{let[n,d]=(0,V.useState)([]),[m,c]=(0,V.useState)(!1);return(0,V.useEffect)(()=>{(async()=>{if(r){c(!0);try{let e=await (0,i.fetchSearchTools)(r),t=Array.isArray(e?.search_tools)?e.search_tools:Array.isArray(e?.data)?e.data:[];d(t.map(e=>e?.search_tool_name).filter(e=>"string"==typeof e&&e.length>0).map(e=>({label:e,value:e})))}catch(e){console.error("Failed to load search tools:",e)}finally{c(!1)}}})()},[r]),(0,t.jsx)(O.Select,{mode:"multiple",allowClear:!0,showSearch:!0,optionFilterProp:"label",placeholder:s,onChange:e,value:l,loading:m,className:a,options:n,style:{width:"100%"},disabled:o})};e.s(["default",0,er],471145);var es=e.i(183588),ei=e.i(460285),eo=e.i(276173),en=e.i(91979),ed=e.i(269200),em=e.i(942232),ec=e.i(977572),eu=e.i(427612),eg=e.i(64848),eh=e.i(496020),ep=e.i(536916),ex=e.i(21548);let eb={"/key/generate":"Member can generate a virtual key for this team","/key/service-account/generate":"Member can generate a service account key (not belonging to any user) for this team","/key/update":"Member can update a virtual key belonging to this team","/key/delete":"Member can delete a virtual key belonging to this team","/key/info":"Member can get info about a virtual key belonging to this team","/key/regenerate":"Member can regenerate a virtual key belonging to this team","/key/{key_id}/regenerate":"Member can regenerate a virtual key belonging to this team","/key/list":"Member can list virtual keys belonging to this team","/key/block":"Member can block a virtual key belonging to this team","/key/unblock":"Member can unblock a virtual key belonging to this team","/team/daily/activity":"Member can view all team usage data (not just their own)","/spend/logs":"Member can view spend logs for the entire team (not just their own)"},e_=({teamId:e,accessToken:l,canEditTeam:a})=>{let[r,s]=(0,V.useState)([]),[o,n]=(0,V.useState)([]),[d,m]=(0,V.useState)(!0),[c,u]=(0,V.useState)(!1),[g,h]=(0,V.useState)(!1),p=async()=>{try{if(m(!0),!l)return;let t=await (0,i.getTeamPermissionsCall)(l,e),a=t.all_available_permissions||[];s(a);let r=t.team_member_permissions||[];n(r),h(!1)}catch(e){ee.default.fromBackend("Failed to load permissions"),console.error("Error fetching permissions:",e)}finally{m(!1)}};(0,V.useEffect)(()=>{p()},[e,l]);let x=async()=>{try{if(!l)return;u(!0),await (0,i.teamPermissionsUpdateCall)(l,e,o),ee.default.success("Permissions updated successfully"),h(!1)}catch(e){ee.default.fromBackend("Failed to update permissions"),console.error("Error updating permissions:",e)}finally{u(!1)}};if(d)return(0,t.jsx)("div",{className:"p-6 text-center",children:"Loading permissions..."});let b=r.length>0;return(0,t.jsxs)(C.Card,{className:"bg-white shadow-md rounded-md p-6",children:[(0,t.jsxs)("div",{className:"flex flex-col sm:flex-row justify-between items-start sm:items-center border-b pb-4 mb-6",children:[(0,t.jsx)(k.Title,{className:"mb-2 sm:mb-0",children:"Member Permissions"}),a&&g&&(0,t.jsxs)("div",{className:"flex gap-3",children:[(0,t.jsx)(I.Button,{icon:(0,t.jsx)(en.ReloadOutlined,{}),onClick:()=>{p()},children:"Reset"}),(0,t.jsx)(I.Button,{onClick:x,loading:c,type:"primary",icon:(0,t.jsx)(_.SaveOutlined,{}),children:"Save Changes"})]})]}),(0,t.jsx)(T.Text,{className:"mb-6 text-gray-600",children:"Control what team members can do when they are not team admins."}),b?(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(ed.Table,{className:" min-w-full",children:[(0,t.jsx)(eu.TableHead,{children:(0,t.jsxs)(eh.TableRow,{children:[(0,t.jsx)(eg.TableHeaderCell,{children:"Method"}),(0,t.jsx)(eg.TableHeaderCell,{children:"Endpoint"}),(0,t.jsx)(eg.TableHeaderCell,{children:"Description"}),(0,t.jsx)(eg.TableHeaderCell,{className:"sticky right-0 bg-white shadow-[-4px_0_4px_-4px_rgba(0,0,0,0.1)] text-center",children:"Allow Access"})]})}),(0,t.jsx)(em.TableBody,{children:r.map(e=>{let l=(e=>{let t=e.includes("/info")||e.includes("/list")||e.includes("/activity")||"/spend/logs"===e?"GET":"POST",l=eb[e];if(!l){for(let[t,a]of Object.entries(eb))if(e.includes(t)){l=a;break}}return l||(l=`Access ${e}`),{method:t,endpoint:e,description:l,route:e}})(e);return(0,t.jsxs)(eh.TableRow,{className:"hover:bg-gray-50 transition-colors",children:[(0,t.jsx)(ec.TableCell,{children:(0,t.jsx)("span",{className:`px-2 py-1 rounded text-xs font-medium ${"GET"===l.method?"bg-blue-100 text-blue-800":"bg-green-100 text-green-800"}`,children:l.method})}),(0,t.jsx)(ec.TableCell,{children:(0,t.jsx)("span",{className:"font-mono text-sm text-gray-800",children:l.endpoint})}),(0,t.jsx)(ec.TableCell,{className:"text-gray-700",children:l.description}),(0,t.jsx)(ec.TableCell,{className:"sticky right-0 bg-white shadow-[-4px_0_4px_-4px_rgba(0,0,0,0.1)] text-center",children:(0,t.jsx)(ep.Checkbox,{checked:o.includes(e),onChange:t=>{n(t.target.checked?[...o,e]:o.filter(t=>t!==e)),h(!0)},disabled:!a})})]},e)})})]})}):(0,t.jsx)("div",{className:"py-12",children:(0,t.jsx)(ex.Empty,{description:"No permissions available"})})]})};var ef=e.i(822315);function ey(e){if(!e)return null;let t=(0,ef.default)(e);return t.isValid()?t.format("MMM D, YYYY"):null}var ej=e.i(175712),ev=e.i(178654),ew=e.i(621192),eC=e.i(898586);let eS=async(e,t)=>{let l=(0,i.getProxyBaseUrl)(),a=l?`${l}/team/${encodeURIComponent(t)}/members/me`:`/team/${encodeURIComponent(t)}/members/me`,r=await fetch(a,{method:"GET",headers:{[(0,i.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(404===r.status)return null;if(!r.ok){let e=await r.json().catch(()=>({}));throw Error((0,i.deriveErrorMessage)(e))}return await r.json()},eT=(e,l)=>(0,t.jsxs)(z.Space,{size:4,children:[(0,t.jsx)(eC.Typography.Text,{type:"secondary",children:e}),(0,t.jsx)(R.Tooltip,{title:l,children:(0,t.jsx)(p.InfoCircleOutlined,{style:{color:"#8c8c8c"}})})]}),eN=(e,t=4)=>null==e?"0":(0,m.formatNumberWithCommas)(e,t),ek=e=>null==e?"Unlimited":(0,m.formatNumberWithCommas)(e,0);function eI({teamId:e}){let{data:a,isLoading:r,error:s}=(e=>{let{accessToken:t}=(0,l.default)();return(0,o.useQuery)({queryKey:["team",e,"members","me"],queryFn:()=>eS(t,e),enabled:!!(t&&e)})})(e);if(r)return(0,t.jsx)(ej.Card,{children:(0,t.jsx)(eC.Typography.Text,{type:"secondary",children:"Loading your membership info…"})});if(s)return(0,t.jsx)(ej.Card,{children:(0,t.jsx)(eC.Typography.Text,{type:"danger",children:s instanceof Error?s.message:"Failed to load your membership info for this team."})});if(!a)return(0,t.jsx)(ej.Card,{children:(0,t.jsx)(eC.Typography.Text,{type:"secondary",children:"No membership info available for the current user in this team."})});let i=a.litellm_budget_table??null,n=i?.max_budget??null,d=a.spend??0,m=a.total_spend??0,c=i?.tpm_limit??null,u=i?.rpm_limit??null,g=ey(i?.budget_reset_at),h=i?.allowed_models??null;return(0,t.jsxs)(z.Space,{direction:"vertical",size:"middle",style:{width:"100%"},children:[(0,t.jsx)(ej.Card,{children:(0,t.jsxs)(ew.Row,{gutter:[24,16],children:[(0,t.jsxs)(ev.Col,{xs:24,sm:12,md:8,children:[(0,t.jsx)(eC.Typography.Text,{type:"secondary",children:"User"}),(0,t.jsx)("div",{style:{marginTop:4},children:(0,t.jsx)(eC.Typography.Text,{strong:!0,children:a.user_email||a.user_id})}),(0,t.jsx)(eC.Typography.Text,{type:"secondary",style:{fontSize:12,fontFamily:"monospace"},children:a.user_id})]}),(0,t.jsxs)(ev.Col,{xs:24,sm:12,md:8,children:[(0,t.jsx)(eC.Typography.Text,{type:"secondary",children:"Team Role"}),(0,t.jsx)("div",{style:{marginTop:4},children:(0,t.jsx)(D.Tag,{color:"admin"===a.role?"blue":"default",children:a.role||"user"})})]})]})}),(0,t.jsxs)(ew.Row,{gutter:[16,16],children:[(0,t.jsx)(ev.Col,{xs:24,md:12,children:(0,t.jsxs)(ej.Card,{children:[eT("Current Cycle Spend (USD)","Spend for the current budget cycle. Resets to $0 when the budget window rolls over."),(0,t.jsxs)("div",{style:{marginTop:8},children:[(0,t.jsxs)(eC.Typography.Title,{level:3,style:{margin:0},children:["$",eN(d,4)]}),(0,t.jsxs)(eC.Typography.Text,{type:"secondary",children:["of ",null===n?"Unlimited":`$${eN(n,4)}`]})]}),g&&(0,t.jsx)("div",{style:{marginTop:4},children:(0,t.jsxs)(eC.Typography.Text,{type:"secondary",children:["Resets ",g]})})]})}),(0,t.jsx)(ev.Col,{xs:24,md:12,children:(0,t.jsxs)(ej.Card,{children:[eT("Rate Limits","Your per-member rate limits within this team."),(0,t.jsxs)("div",{style:{marginTop:8},children:[(0,t.jsxs)(eC.Typography.Text,{children:["TPM: ",ek(c)]}),(0,t.jsx)("br",{}),(0,t.jsxs)(eC.Typography.Text,{children:["RPM: ",ek(u)]})]})]})}),(0,t.jsx)(ev.Col,{xs:24,md:12,children:(0,t.jsxs)(ej.Card,{children:[eT("Total Spend (USD)","Cumulative spend across all budget cycles within this team."),(0,t.jsx)("div",{style:{marginTop:8},children:(0,t.jsxs)(eC.Typography.Title,{level:4,style:{margin:0},children:["$",eN(m,4)]})})]})}),(0,t.jsx)(ev.Col,{xs:24,md:12,children:(0,t.jsxs)(ej.Card,{children:[eT("Model Scope","Models you can access within this team."),(0,t.jsx)("div",{style:{marginTop:8},children:h&&h.length>0?(0,t.jsx)(z.Space,{wrap:!0,children:h.map(e=>(0,t.jsx)(D.Tag,{children:e},e))}):(0,t.jsx)(eC.Typography.Text,{children:"All Team Models"})})]})})]})]})}let eM="overview",eA="my-user",eF="virtual-keys",eO="members",ez="member-permissions",eP="settings",eL={[eM]:"Overview",[eA]:"My User",[eF]:"Virtual Keys",[eO]:"Members",[ez]:"Member Permissions",[eP]:"Settings"};var eD=e.i(292639),eR=e.i(294612);function eE({teamData:e,canEditTeam:a,handleMemberDelete:r,setSelectedEditMember:s,setIsEditMemberModalVisible:i,setIsAddMemberModalVisible:o}){let n=e=>{if(null==e)return"0";if("number"==typeof e){let t=Number(e);return t===Math.floor(t)?t.toString():(0,m.formatNumberWithCommas)(t,8).replace(/\.?0+$/,"")}return"0"},{data:d}=(0,eD.useUISettings)(),{userId:c,userRole:g}=(0,l.default)(),h=!!d?.values?.disable_team_admin_delete_team_user,x=(0,u.isUserTeamAdminForSingleTeam)(e.team_info.members_with_roles,c||""),b=(0,u.isProxyAdminRole)(g||""),_=[{title:(0,t.jsxs)(z.Space,{direction:"horizontal",children:["Model Scope",(0,t.jsx)(R.Tooltip,{title:"Models this member can access. Empty means they inherit all team models.",children:(0,t.jsx)(p.InfoCircleOutlined,{})})]}),key:"model_scope",render:(l,a)=>{let r=(t=>{if(!t)return null;let l=e.team_memberships.find(e=>e.user_id===t),a=l?.litellm_budget_table?.allowed_models;return a&&a.length>0?a:null})(a.user_id);if(!r)return(0,t.jsx)(eC.Typography.Text,{type:"secondary",children:"(all team models)"});let s=r.slice(0,2),i=r.length-s.length;return(0,t.jsxs)(z.Space,{wrap:!0,children:[s.map(e=>(0,t.jsx)(eC.Typography.Text,{code:!0,style:{fontSize:"12px"},children:e},e)),i>0&&(0,t.jsx)(R.Tooltip,{title:r.slice(2).join(", "),children:(0,t.jsxs)(eC.Typography.Text,{type:"secondary",children:["+",i," more"]})})]})}},{title:(0,t.jsxs)(z.Space,{direction:"horizontal",children:["Current Cycle Spend (USD)",(0,t.jsx)(R.Tooltip,{title:"Spend for the current budget cycle. Resets to $0 when the member's budget window rolls over. This is the value checked against the member's budget.",children:(0,t.jsx)(p.InfoCircleOutlined,{})})]}),key:"spend",render:(l,a)=>(0,t.jsxs)(eC.Typography.Text,{children:["$",(0,m.formatNumberWithCommas)((t=>{if(!t)return 0;let l=e.team_memberships.find(e=>e.user_id===t);return l?.spend??0})(a.user_id),4)]})},{title:(0,t.jsxs)(z.Space,{direction:"horizontal",children:["Total Spend (USD)",(0,t.jsx)(R.Tooltip,{title:"Cumulative spend by this member within this team, across all budget cycles. Tracking began 2026-04-21; spend from before that date is not included.",children:(0,t.jsx)(p.InfoCircleOutlined,{})})]}),key:"total_spend",render:(l,a)=>(0,t.jsxs)(eC.Typography.Text,{children:["$",(0,m.formatNumberWithCommas)((t=>{if(!t)return 0;let l=e.team_memberships.find(e=>e.user_id===t);return l?.total_spend??0})(a.user_id),4)]})},{title:"Team Member Budget (USD)",key:"budget",render:(l,a)=>{let r=(t=>{if(!t)return null;let l=e.team_memberships.find(e=>e.user_id===t),a=l?.litellm_budget_table?.max_budget;return null==a?null:n(a)})(a.user_id);return(0,t.jsx)(eC.Typography.Text,{children:r?`$${(0,m.formatNumberWithCommas)(Number(r),4)}`:"No Limit"})}},{title:"Budget Reset",key:"budget_reset",render:(l,a)=>{let r=(t=>{if(!t)return null;let l=e.team_memberships.find(e=>e.user_id===t);return ey(l?.litellm_budget_table?.budget_reset_at)})(a.user_id);return r?(0,t.jsx)(eC.Typography.Text,{children:r}):(0,t.jsx)(eC.Typography.Text,{type:"secondary",children:"—"})}},{title:(0,t.jsxs)(z.Space,{direction:"horizontal",children:["Team Member Rate Limits",(0,t.jsx)(R.Tooltip,{title:"Rate limits for this member's usage within this team.",children:(0,t.jsx)(p.InfoCircleOutlined,{})})]}),key:"rate_limits",render:(l,a)=>(0,t.jsx)(eC.Typography.Text,{children:(t=>{if(!t)return"No Limits";let l=e.team_memberships.find(e=>e.user_id===t),a=l?.litellm_budget_table?.rpm_limit,r=l?.litellm_budget_table?.tpm_limit,s=[a?`${n(a)} RPM`:null,r?`${n(r)} TPM`:null].filter(Boolean);return s.length>0?s.join(" / "):"No Limits"})(a.user_id)})}];return(0,t.jsx)(eR.default,{members:e.team_info.members_with_roles,canEdit:a,onEdit:t=>{let l=e.team_memberships.find(e=>e.user_id===t.user_id);s({...t,max_budget_in_team:l?.litellm_budget_table?.max_budget||null,tpm_limit:l?.litellm_budget_table?.tpm_limit||null,rpm_limit:l?.litellm_budget_table?.rpm_limit||null,allowed_models:l?.litellm_budget_table?.allowed_models||[]}),i(!0)},onDelete:r,onAddMember:()=>o(!0),roleColumnTitle:"Team Role",roleTooltip:"This role applies only to this team and is independent from the user's proxy-level role.",extraColumns:_,showDeleteForMember:()=>b||a&&!x||x&&!h})}var eB=e.i(207082),eU=e.i(871943),eV=e.i(502547),eK=e.i(360820),e$=e.i(94629),eG=e.i(152990),eW=e.i(682830),eq=e.i(994388),eH=e.i(752978),eQ=e.i(282786),eY=e.i(981339),eJ=e.i(304911),eX=e.i(969550),eZ=e.i(20147),e0=e.i(633627);function e1({teamId:e,teamAlias:a,organization:r}){let{accessToken:s}=(0,l.default)(),[i,n]=(0,V.useState)(null),[d,c]=(0,V.useState)([{id:"created_at",desc:!0}]),[u,g]=(0,V.useState)({pageIndex:0,pageSize:50}),[h,x]=(0,V.useState)({"Organization ID":"","Key Alias":"","User ID":"","Sort By":"created_at","Sort Order":"desc"}),b=d.length>0?d[0].id:"created_at",_=d.length>0?d[0].desc?"desc":"asc":"desc",f=u.pageIndex,y=u.pageSize,{data:j,isPending:v,isFetching:C,refetch:S}=(0,eB.useKeys)(f+1,y,{teamID:e,organizationID:h["Organization ID"]?.trim()||void 0,selectedKeyAlias:h["Key Alias"]?.trim()||void 0,userID:h["User ID"]?.trim()||void 0,sortBy:b||void 0,sortOrder:_||void 0,expand:"user"}),N=(0,V.useMemo)(()=>{let e=j?.keys||[],t=r?.organization_id;return t?e.map(e=>({...e,organization_id:(e.organization_id??e.org_id)||t})):e},[j?.keys,r?.organization_id]),k=j?.total_pages??0,[I,M]=(0,V.useState)({}),A=(0,V.useMemo)(()=>({team_id:e,team_alias:a||e,models:[],max_budget:null,budget_duration:null,tpm_limit:null,rpm_limit:null,organization_id:r?.organization_id||"",created_at:"",keys:[],members_with_roles:[],spend:0}),[e,a,r]),F=(0,o.useQuery)({queryKey:["teamFilterOptions",e,s],queryFn:async()=>(0,e0.fetchTeamFilterOptions)(s,e),enabled:!!s&&!!e,staleTime:3e4}).data||{keyAliases:[],organizationIds:[],userIds:[]},O=(0,V.useCallback)(()=>{S?.()},[S]);(0,V.useEffect)(()=>(window.addEventListener("storage",O),()=>window.removeEventListener("storage",O)),[O]);let z=(0,V.useCallback)((e,t=!1)=>{x(t=>({...t,"Organization ID":e["Organization ID"]??t["Organization ID"],"Key Alias":e["Key Alias"]??t["Key Alias"],"User ID":e["User ID"]??t["User ID"],"Sort By":e["Sort By"]??t["Sort By"]??"created_at","Sort Order":e["Sort Order"]??t["Sort Order"]??"desc"})),t||g(e=>({...e,pageIndex:0}))},[]),P=(0,V.useCallback)(()=>{x({"Organization ID":"","Key Alias":"","User ID":"","Sort By":"created_at","Sort Order":"desc"}),g(e=>({...e,pageIndex:0}))},[]),L=(0,V.useMemo)(()=>[{name:"Organization ID",label:"Organization ID",isSearchable:!0,searchFn:async e=>{let{organizationIds:t}=F;if(!t.length)return[];let l=e.toLowerCase();return(l?t.filter(e=>e.toLowerCase().includes(l)):t).map(e=>({label:e,value:e}))}},{name:"Key Alias",label:"Key Alias",isSearchable:!0,searchFn:async e=>{let{keyAliases:t}=F,l=e.toLowerCase();return(l?t.filter(e=>e.toLowerCase().includes(l)):t).map(e=>({label:e,value:e}))}},{name:"User ID",label:"User ID",isSearchable:!0,searchFn:async e=>{let{userIds:t}=F,l=e.toLowerCase();return(l?t.filter(e=>e.id.toLowerCase().includes(l)||e.email.toLowerCase().includes(l)):t).map(e=>({label:e.email?`${e.id} (${e.email})`:e.id,value:e.id}))}}],[F]),D=(0,V.useMemo)(()=>[{id:"token",accessorKey:"token",header:"Key ID",size:100,enableSorting:!0,cell:e=>{let l=e.getValue(),a=e.cell.column.getSize();return(0,t.jsx)(R.Tooltip,{title:l,children:(0,t.jsx)(eq.Button,{size:"xs",variant:"light",className:"font-mono text-blue-500 bg-blue-50 hover:bg-blue-100 text-xs font-normal px-2 py-0.5 text-left overflow-hidden truncate block",style:{maxWidth:a,overflow:"hidden"},onClick:()=>n(e.row.original),children:l??"-"})})}},{id:"key_alias",accessorKey:"key_alias",header:"Key Alias",size:150,enableSorting:!0,cell:e=>{let l=e.getValue(),a=e.cell.column.getSize();return(0,t.jsx)(R.Tooltip,{title:l,children:(0,t.jsx)("span",{className:"font-mono text-xs truncate block",style:{maxWidth:a,overflow:"hidden"},children:l??"-"})})}},{id:"key_name",accessorKey:"key_name",header:"Secret Key",size:120,enableSorting:!1,cell:e=>(0,t.jsx)("span",{className:"font-mono text-xs",children:e.getValue()})},{id:"organization_id",accessorKey:"organization_id",header:"Organization ID",size:140,enableSorting:!1,cell:e=>e.getValue()?e.renderValue():"-"},{id:"user_email",accessorKey:"user",header:"User Email",size:160,enableSorting:!1,cell:e=>{let l=e.getValue(),a=l?.user_email,r=e.cell.column.getSize();return(0,t.jsx)(R.Tooltip,{title:a,children:(0,t.jsx)("span",{className:"font-mono text-xs truncate block",style:{maxWidth:r,overflow:"hidden"},children:a??"-"})})}},{id:"user_id",accessorKey:"user_id",header:"User ID",size:70,enableSorting:!1,cell:e=>{let l=e.getValue(),a="default_user_id"===l?"Default Proxy Admin":l,r=e.cell.column.getSize();return(0,t.jsx)(R.Tooltip,{title:a,children:(0,t.jsx)("span",{className:"font-mono text-xs truncate block",style:{maxWidth:r,overflow:"hidden"},children:a??"-"})})}},{id:"created_at",accessorKey:"created_at",header:"Created At",size:120,enableSorting:!0,cell:e=>{let t=e.getValue();return t?new Date(t).toLocaleDateString():"-"}},{id:"created_by",accessorKey:"created_by",header:"Created By",size:70,enableSorting:!1,cell:e=>{let l=e.getValue();if(!l)return"-";let{created_by_user:a}=e.row.original,r=a?.user_alias??null,s=a?.user_email??null,i="default_user_id"===l,o=r||s||l,n=e.cell.column.getSize(),d=(0,t.jsx)("div",{className:"flex flex-col gap-2 text-xs min-w-[200px] max-w-[300px]",children:[{label:"User Alias",value:r},{label:"User Email",value:s},{label:"User ID",value:l}].map(({label:e,value:l})=>(0,t.jsxs)("div",{className:"flex flex-col min-w-0",children:[(0,t.jsx)("span",{className:"text-gray-400",children:e}),l?(0,t.jsx)(eC.Typography.Text,{className:"font-mono text-xs",ellipsis:{tooltip:l},copyable:!0,children:l}):(0,t.jsx)("span",{className:"font-mono",children:"-"})]},e))});return!i||r||s?(0,t.jsx)(eQ.Popover,{content:d,trigger:"hover",placement:"bottomLeft",children:(0,t.jsx)("span",{className:"font-mono text-xs truncate block cursor-default",style:{maxWidth:n,overflow:"hidden"},children:o})}):(0,t.jsx)(eQ.Popover,{content:d,trigger:"hover",placement:"bottomLeft",children:(0,t.jsx)("span",{className:"cursor-default",children:(0,t.jsx)(eJ.default,{userId:l})})})}},{id:"updated_at",accessorKey:"updated_at",header:"Updated At",size:120,enableSorting:!0,cell:e=>{let t=e.getValue();return t?new Date(t).toLocaleDateString():"Never"}},{id:"last_active",accessorKey:"last_active",header:()=>(0,t.jsxs)("span",{className:"flex items-center gap-1",children:["Last Active",(0,t.jsx)(eQ.Popover,{content:"This is a new field and is not backfilled. Only new key usage will update this value.",trigger:"hover",children:(0,t.jsx)(p.InfoCircleOutlined,{className:"text-gray-400 text-xs cursor-help"})})]}),size:130,enableSorting:!1,cell:e=>{let l=e.getValue();if(!l)return"Unknown";let a=new Date(l);return(0,t.jsx)(R.Tooltip,{title:a.toLocaleString(void 0,{dateStyle:"medium",timeStyle:"long"}),children:(0,t.jsx)("span",{children:a.toLocaleDateString()})})}},{id:"expires",accessorKey:"expires",header:"Expires",size:120,enableSorting:!1,cell:e=>{let t=e.getValue();return t?new Date(t).toLocaleDateString():"Never"}},{id:"spend",accessorKey:"spend",header:"Spend (USD)",size:100,enableSorting:!0,cell:e=>(0,m.formatNumberWithCommas)(e.getValue(),4)},{id:"max_budget",accessorKey:"max_budget",header:"Budget (USD)",size:110,enableSorting:!0,cell:e=>{let t=e.getValue();return null===t?"Unlimited":`$${(0,m.formatNumberWithCommas)(t)}`}},{id:"budget_reset_at",accessorKey:"budget_reset_at",header:"Budget Reset",size:130,enableSorting:!1,cell:e=>{let t=e.getValue();return t?new Date(t).toLocaleString():"Never"}},{id:"models",accessorKey:"models",header:"Models",size:200,enableSorting:!1,cell:e=>{let l=e.getValue();return(0,t.jsx)("div",{className:"flex flex-col py-2",children:Array.isArray(l)?(0,t.jsx)("div",{className:"flex flex-col",children:0===l.length?(0,t.jsx)(w.Badge,{size:"xs",className:"mb-1",color:"red",children:(0,t.jsx)(T.Text,{children:"All Proxy Models"})}):(0,t.jsx)(t.Fragment,{children:(0,t.jsxs)("div",{className:"flex items-start",children:[l.length>3&&(0,t.jsx)("div",{children:(0,t.jsx)(eH.Icon,{icon:I[e.row.id]?eU.ChevronDownIcon:eV.ChevronRightIcon,className:"cursor-pointer",size:"xs",onClick:()=>M(t=>({...t,[e.row.id]:!t[e.row.id]}))})}),(0,t.jsxs)("div",{className:"flex flex-wrap gap-1",children:[l.slice(0,3).map((e,l)=>"all-proxy-models"===e?(0,t.jsx)(w.Badge,{size:"xs",color:"red",children:(0,t.jsx)(T.Text,{children:"All Proxy Models"})},l):(0,t.jsx)(w.Badge,{size:"xs",color:"blue",children:(0,t.jsx)(T.Text,{children:e.length>30?`${(0,H.getModelDisplayName)(e).slice(0,30)}...`:(0,H.getModelDisplayName)(e)})},l)),l.length>3&&!I[e.row.id]&&(0,t.jsx)(w.Badge,{size:"xs",color:"gray",className:"cursor-pointer",children:(0,t.jsxs)(T.Text,{children:["+",l.length-3," ",l.length-3==1?"more model":"more models"]})}),I[e.row.id]&&(0,t.jsx)("div",{className:"flex flex-wrap gap-1",children:l.slice(3).map((e,l)=>"all-proxy-models"===e?(0,t.jsx)(w.Badge,{size:"xs",color:"red",children:(0,t.jsx)(T.Text,{children:"All Proxy Models"})},l+3):(0,t.jsx)(w.Badge,{size:"xs",color:"blue",children:(0,t.jsx)(T.Text,{children:e.length>30?`${(0,H.getModelDisplayName)(e).slice(0,30)}...`:(0,H.getModelDisplayName)(e)})},l+3))})]})]})})}):null})}},{id:"rate_limits",header:"Rate Limits",size:140,enableSorting:!1,cell:({row:e})=>{let l=e.original;return(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{children:["TPM: ",null!==l.tpm_limit?l.tpm_limit:"Unlimited"]}),(0,t.jsxs)("div",{children:["RPM: ",null!==l.rpm_limit?l.rpm_limit:"Unlimited"]})]})}}],[I]),E=(0,V.useCallback)(e=>{let t="function"==typeof e?e(d):e;if(c(t),t?.length>0){let e=t[0];z({"Sort By":e.id,"Sort Order":e.desc?"desc":"asc"},!0)}},[d,z]),B=(0,eG.useReactTable)({data:N,columns:D,columnResizeMode:"onChange",columnResizeDirection:"ltr",state:{sorting:d,pagination:u},onSortingChange:E,onPaginationChange:g,getCoreRowModel:(0,eW.getCoreRowModel)(),enableSorting:!0,manualSorting:!0,manualPagination:!0,pageCount:k});return(0,t.jsx)("div",{className:"w-full h-full overflow-hidden",children:i?(0,t.jsx)(eZ.default,{keyId:i.token,onClose:()=>n(null),keyData:i,teams:[A],onDelete:S}):(0,t.jsxs)("div",{className:"border-b py-4 flex-1 overflow-hidden",children:[(0,t.jsx)("div",{className:"w-full mb-6",children:(0,t.jsx)(eX.default,{options:L,onApplyFilters:z,initialValues:h,onResetFilters:P})}),(0,t.jsx)("div",{className:"flex items-center justify-end w-full mb-4",children:(0,t.jsxs)("div",{className:"inline-flex items-center gap-2",children:[v||C?(0,t.jsx)(eY.Skeleton.Node,{active:!0,style:{width:74,height:20}}):(0,t.jsxs)("span",{className:"text-sm text-gray-700",children:["Page ",f+1," of ",B.getPageCount()]}),v||C?(0,t.jsx)(eY.Skeleton.Button,{active:!0,size:"small",style:{width:84,height:30}}):(0,t.jsx)("button",{onClick:()=>B.previousPage(),disabled:v||C||!B.getCanPreviousPage(),className:"px-3 py-1 text-sm border rounded-md hover:bg-gray-50 disabled:opacity-50 disabled:cursor-not-allowed",children:"Previous"}),v||C?(0,t.jsx)(eY.Skeleton.Button,{active:!0,size:"small",style:{width:58,height:30}}):(0,t.jsx)("button",{onClick:()=>B.nextPage(),disabled:v||C||!B.getCanNextPage(),className:"px-3 py-1 text-sm border rounded-md hover:bg-gray-50 disabled:opacity-50 disabled:cursor-not-allowed",children:"Next"})]})}),(0,t.jsx)("div",{className:"h-[75vh] overflow-auto",children:(0,t.jsx)("div",{className:"rounded-lg custom-border relative",children:(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(ed.Table,{className:"[&_td]:py-0.5 [&_th]:py-1",style:{width:B.getCenterTotalSize()},children:[(0,t.jsx)(eu.TableHead,{children:B.getHeaderGroups().map(e=>(0,t.jsx)(eh.TableRow,{children:e.headers.map(e=>(0,t.jsx)(eg.TableHeaderCell,{"data-header-id":e.id,className:`py-1 h-8 relative hover:bg-gray-50 ${"actions"===e.id?"sticky right-0 bg-white shadow-[-4px_0_8px_-6px_rgba(0,0,0,0.1)]":""}`,style:{width:e.getSize(),position:"relative",cursor:e.column.getCanSort()?"pointer":"default"},onMouseEnter:()=>{let t=document.querySelector(`[data-header-id="${e.id}"] .resizer`);t&&(t.style.opacity="0.5")},onMouseLeave:()=>{let t=document.querySelector(`[data-header-id="${e.id}"] .resizer`);t&&!e.column.getIsResizing()&&(t.style.opacity="0")},onClick:e.column.getCanSort()?e.column.getToggleSortingHandler():void 0,children:(0,t.jsxs)("div",{className:"flex items-center justify-between gap-2",children:[(0,t.jsx)("div",{className:"flex items-center",children:e.isPlaceholder?null:(0,eG.flexRender)(e.column.columnDef.header,e.getContext())}),"actions"!==e.id&&e.column.getCanSort()&&(0,t.jsx)("div",{className:"w-4",children:e.column.getIsSorted()?({asc:(0,t.jsx)(eK.ChevronUpIcon,{className:"h-4 w-4 text-blue-500"}),desc:(0,t.jsx)(eU.ChevronDownIcon,{className:"h-4 w-4 text-blue-500"})})[e.column.getIsSorted()]:(0,t.jsx)(e$.SwitchVerticalIcon,{className:"h-4 w-4 text-gray-400"})}),(0,t.jsx)("div",{onDoubleClick:()=>e.column.resetSize(),onMouseDown:e.getResizeHandler(),onTouchStart:e.getResizeHandler(),className:`resizer ${B.options.columnResizeDirection} ${e.column.getIsResizing()?"isResizing":""}`,style:{position:"absolute",right:0,top:0,height:"100%",width:"5px",background:e.column.getIsResizing()?"#3b82f6":"transparent",cursor:"col-resize",userSelect:"none",touchAction:"none",opacity:+!!e.column.getIsResizing()}})]})},e.id))},e.id))}),(0,t.jsx)(em.TableBody,{children:v||C?(0,t.jsx)(eh.TableRow,{children:(0,t.jsx)(ec.TableCell,{colSpan:D.length,className:"h-8 text-center",children:(0,t.jsx)("div",{className:"text-center text-gray-500",children:(0,t.jsx)("p",{children:"Loading keys..."})})})}):N.length>0?B.getRowModel().rows.map(e=>(0,t.jsx)(eh.TableRow,{className:"h-8",children:e.getVisibleCells().map(e=>(0,t.jsx)(ec.TableCell,{style:{width:e.column.getSize(),maxWidth:"8-x",whiteSpace:"pre-wrap",overflow:"hidden"},className:`py-0.5 max-h-8 overflow-hidden text-ellipsis whitespace-nowrap ${"models"===e.column.id&&Array.isArray(e.getValue())&&e.getValue().length>3?"px-0":""}`,children:(0,eG.flexRender)(e.column.columnDef.cell,e.getContext())},e.id))},e.id)):(0,t.jsx)(eh.TableRow,{children:(0,t.jsx)(ec.TableCell,{colSpan:D.length,className:"h-8 text-center",children:(0,t.jsx)("div",{className:"text-center text-gray-500",children:(0,t.jsx)("p",{children:"No keys found"})})})})})]})})})})]})})}e.s(["default",0,({teamId:e,onClose:o,accessToken:n,is_team_admin:en,is_proxy_admin:ed,is_org_admin:em=!1,userModels:ec,editTeam:eu,premiumUser:eg=!1,onUpdate:eh})=>{let ep,ex,eb,ef,ey,ej,[ev,ew]=(0,V.useState)(null),[eC,eS]=(0,V.useState)(!0),[eT,eN]=(0,V.useState)(!1),[ek]=M.Form.useForm(),[eD,eR]=(0,V.useState)(!1),[eB,eU]=(0,V.useState)(null),[eV,eK]=(0,V.useState)(!1),[e$,eG]=(0,V.useState)([]),[eW,eq]=(0,V.useState)(!1),[eH,eQ]=(0,V.useState)({}),{data:eY,isLoading:eJ}=d(),eX=eY?.globalGuardrailNames??new Set,[eZ,e0]=(0,V.useState)([]),[e2,e4]=(0,V.useState)({}),[e5,e3]=(0,V.useState)(!1),[e7,e6]=(0,V.useState)(null),[e9,e8]=(0,V.useState)(!1),[te,tt]=(0,V.useState)(!1),[tl,ta]=(0,V.useState)(!1),tr=V.default.useRef(null),[ts,ti]=(0,V.useState)(null),{userRole:to,userId:tn}=(0,l.default)(),{data:td=[]}=(0,a.useOrganizations)(),tm=(0,r.useQueryClient)(),tc=(0,V.useMemo)(()=>{let e=ev?.team_info?.organization_id;if(!e||!tn)return!1;let t=td.find(t=>t.organization_id===e);return t?.members?.some(e=>e.user_id===tn&&"org_admin"===e.user_role)??!1},[ev,td,tn]),tu=M.Form.useWatch("models",ek),tg=M.Form.useWatch("disable_global_guardrails",ek),th=(0,V.useMemo)(()=>{let e=tu??ev?.team_info?.models??[];return e.includes("all-proxy-models")||e.includes("all-team-models")?ec:(0,H.unfurlWildcardModelsInList)(e,ec)},[tu,ev,ec]),tp=en||ed||em||tc,tx=(0,V.useMemo)(()=>{let e;return e=[eM,eA,eF],tp?[...e,eO,ez,eP]:e},[tp]),tb=(0,V.useMemo)(()=>eu&&tp?eP:eM,[eu,tp]),t_=async()=>{try{if(eS(!0),!n)return;let t=await (0,i.teamInfoCall)(n,e);ew(t)}catch(e){ee.default.fromBackend("Failed to load team information"),console.error("Error fetching team info:",e)}finally{eS(!1)}};(0,V.useEffect)(()=>{t_()},[e,n]),(0,V.useEffect)(()=>{(async()=>{if(!n||!ev?.team_info?.organization_id)return ti(null);try{let e=await (0,i.organizationInfoCall)(n,ev.team_info.organization_id);ti(e)}catch(e){console.error("Error fetching organization info:",e),ti(null)}})()},[n,ev?.team_info?.organization_id]),(0,V.useMemo)(()=>{let e;return e=[],e=ts?ts.models.includes("all-proxy-models")?ec:ts.models.length>0?ts.models:ec:ec,(0,H.unfurlWildcardModelsInList)(e,ec)},[ts,ec]),(0,V.useEffect)(()=>{(async()=>{try{if(!n)return;let e=(await (0,i.getPoliciesList)(n)).policies.map(e=>e.policy_name);e0(e)}catch(e){console.error("Failed to fetch policies:",e)}})()},[n]),(0,V.useEffect)(()=>{(async()=>{if(!n||!ev?.team_info?.policies||0===ev.team_info.policies.length)return;e3(!0);let e={};try{await Promise.all(ev.team_info.policies.map(async t=>{try{let l=await (0,i.getPolicyInfoWithGuardrails)(n,t);e[t]=l.resolved_guardrails||[]}catch(l){console.error(`Failed to fetch guardrails for policy ${t}:`,l),e[t]=[]}})),e4(e)}catch(e){console.error("Failed to fetch policy guardrails:",e)}finally{e3(!1)}})()},[n,ev?.team_info?.policies]);let tf=async t=>{try{if(null==n)return;let l={user_email:t.user_email,user_id:t.user_id,role:t.role};await (0,i.teamMemberAddCall)(n,e,l),ee.default.success("Team member added successfully"),eN(!1),ek.resetFields();let a=await (0,i.teamInfoCall)(n,e);ew(a),eh(a)}catch(t){let e="Failed to add team member";t?.raw?.detail?.error?.includes("Assigning team admins is a premium feature")?e="Assigning admins is an enterprise-only feature. Please upgrade your LiteLLM plan to enable this.":t?.message&&(e=t.message),ee.default.fromBackend(e),console.error("Error adding team member:",t)}},ty=async t=>{try{if(null==n)return;let l={user_email:t.user_email,user_id:t.user_id,role:t.role,max_budget_in_team:t.max_budget_in_team,tpm_limit:t.tpm_limit,rpm_limit:t.rpm_limit,allowed_models:t.allowed_models};E.default.destroy(),await (0,i.teamMemberUpdateCall)(n,e,l),ee.default.success("Team member updated successfully"),eR(!1);let a=await (0,i.teamInfoCall)(n,e);ew(a),eh(a)}catch(t){let e="Failed to update team member";t?.raw?.detail?.includes("Assigning team admins is a premium feature")?e="Assigning admins is an enterprise-only feature. Please upgrade your LiteLLM plan to enable this.":t?.message&&(e=t.message),eR(!1),E.default.destroy(),ee.default.fromBackend(e),console.error("Error updating team member:",t)}},tj=async()=>{if(e7&&n){tt(!0);try{await (0,i.teamMemberDeleteCall)(n,e,e7),ee.default.success("Team member removed successfully");let t=await (0,i.teamInfoCall)(n,e);ew(t),eh(t)}catch(e){ee.default.fromBackend("Failed to remove team member"),console.error("Error removing team member:",e)}finally{tt(!1),e8(!1),e6(null)}}},tv=async t=>{try{let l;if(!n)return;ta(!0);let r={};try{let{soft_budget_alerting_emails:e,...l}=t.metadata?JSON.parse(t.metadata):{};r=l}catch(e){ee.default.fromBackend("Invalid JSON in metadata field");return}if("string"==typeof t.secret_manager_settings&&t.secret_manager_settings.trim().length>0)try{l=JSON.parse(t.secret_manager_settings)}catch(e){ee.default.fromBackend("Invalid JSON in secret manager settings");return}let s=e=>null==e||"string"==typeof e&&""===e.trim()||"number"==typeof e&&Number.isNaN(e)?null:e,o={},d={};for(let e of t.modelLimits??[])e?.model&&(null!=e.tpm&&(o[e.model]=e.tpm),null!=e.rpm&&(d[e.model]=e.rpm));let m=!0===t.disable_global_guardrails,u=m?Array.from(eX):Array.from(eX).filter(e=>!(t.guardrails||[]).includes(e)),g=ed?{allowed_passthrough_routes:t.allowed_passthrough_routes||[]}:tw.metadata?.allowed_passthrough_routes?{allowed_passthrough_routes:tw.metadata.allowed_passthrough_routes}:{},h={team_id:e,team_alias:t.team_alias,models:t.models,tpm_limit:s(t.tpm_limit),rpm_limit:s(t.rpm_limit),model_tpm_limit:o,model_rpm_limit:d,max_budget:t.max_budget,soft_budget:s(t.soft_budget),budget_duration:t.budget_duration,metadata:{...r,...g,guardrails:(t.guardrails||[]).filter(e=>!eX.has(e)),opted_out_global_guardrails:u,...t.logging_settings?.length>0?{logging:t.logging_settings}:{},disable_global_guardrails:m,soft_budget_alerting_emails:"string"==typeof t.soft_budget_alerting_emails?t.soft_budget_alerting_emails.split(",").map(e=>e.trim()).filter(e=>e.length>0):t.soft_budget_alerting_emails||[],...void 0!==l?{secret_manager_settings:l}:{}},...t.policies?.length>0?{policies:t.policies}:{},...t.organization_id!==tw.organization_id?{organization_id:t.organization_id??null}:{}};h.max_budget=(0,c.mapEmptyStringToNull)(h.max_budget),h.team_member_budget_duration=t.team_member_budget_duration,void 0!==t.team_member_budget&&(h.team_member_budget=Number(t.team_member_budget)),void 0!==t.team_member_key_duration&&(h.team_member_key_duration=t.team_member_key_duration),(void 0!==t.team_member_tpm_limit||void 0!==t.team_member_rpm_limit)&&(h.team_member_tpm_limit=s(t.team_member_tpm_limit),h.team_member_rpm_limit=s(t.team_member_rpm_limit));let{servers:p,accessGroups:x,toolsets:b}=t.mcp_servers_and_groups||{servers:[],accessGroups:[],toolsets:[]},_=new Set(p||[]),f=Object.fromEntries(Object.entries(t.mcp_tool_permissions||{}).filter(([e])=>_.has(e)));h.object_permission={},p&&(h.object_permission.mcp_servers=p),x&&(h.object_permission.mcp_access_groups=x),f&&(h.object_permission.mcp_tool_permissions=f),b&&(h.object_permission.mcp_toolsets=b),delete t.mcp_servers_and_groups,delete t.mcp_tool_permissions;let{agents:y,accessGroups:j}=t.agents_and_groups||{agents:[],accessGroups:[]};y&&y.length>0&&(h.object_permission.agents=y),j&&j.length>0&&(h.object_permission.agent_access_groups=j),delete t.agents_and_groups,t.vector_stores&&t.vector_stores.length>0&&(h.object_permission.vector_stores=t.vector_stores),Array.isArray(t.object_permission_search_tools)&&(h.object_permission.search_tools=t.object_permission_search_tools),void 0!==t.access_group_ids&&(h.access_group_ids=t.access_group_ids),void 0!==t.default_team_member_models&&(h.default_team_member_models=t.default_team_member_models);let v=tr.current?.getValue();if(v?.router_settings){let e=e=>null!=e&&""!==e&&!1!==e&&!(Array.isArray(e)&&0===e.length),t=Object.values(v.router_settings).some(e),l=tw.router_settings&&Object.values(tw.router_settings).some(e);(t||l)&&(h.router_settings=v.router_settings)}await (0,i.teamUpdateCall)(n,h),tm.invalidateQueries({queryKey:a.organizationKeys.all}),ee.default.success("Team settings updated successfully"),eK(!1),t_()}catch(e){console.error("Error updating team:",e)}finally{ta(!1)}};if(eC)return(0,t.jsx)("div",{className:"p-4",children:"Loading..."});if(!ev?.team_info)return(0,t.jsx)("div",{className:"p-4",children:"Team not found"});let{team_info:tw}=ev,tC=tw.metadata?.disable_global_guardrails===!0,tS=new Set(Array.isArray(tw.metadata?.opted_out_global_guardrails)?tw.metadata.opted_out_global_guardrails:[]),tT=(Array.isArray(tw.metadata?.guardrails)?tw.metadata.guardrails:[]).filter(e=>!eX.has(e)),tN=tC?tT:[...Array.from(eX).filter(e=>!tS.has(e)),...tT],tk=e=>{e.preventDefault(),e.stopPropagation()},tI=async(e,t)=>{await (0,m.copyToClipboard)(e)&&(eQ(e=>({...e,[t]:!0})),setTimeout(()=>{eQ(e=>({...e,[t]:!1}))},2e3))};return(0,t.jsxs)("div",{className:"p-4",children:[(0,t.jsx)("div",{className:"flex justify-between items-center mb-6",children:(0,t.jsxs)("div",{children:[(0,t.jsx)(I.Button,{type:"text",icon:(0,t.jsx)(f.ArrowLeftIcon,{className:"h-4 w-4"}),onClick:o,className:"mb-4",children:"Back to Teams"}),(0,t.jsx)(k.Title,{children:tw.team_alias}),(0,t.jsxs)("div",{className:"flex items-center",children:[(0,t.jsx)(T.Text,{className:"text-gray-500 font-mono",children:tw.team_id}),(0,t.jsx)(I.Button,{type:"text",size:"small",icon:eH["team-id"]?(0,t.jsx)(B.CheckIcon,{size:12}):(0,t.jsx)(U.CopyIcon,{size:12}),onClick:()=>tI(tw.team_id,"team-id"),className:`left-2 z-10 transition-all duration-200 ${eH["team-id"]?"text-green-600 bg-green-50 border-green-200":"text-gray-500 hover:text-gray-700 hover:bg-gray-100"}`})]})]})}),(0,t.jsx)(L.Tabs,{defaultActiveKey:tb,className:"mb-4",items:[{key:eM,label:eL[eM],children:(0,t.jsxs)(S.Grid,{numItems:1,numItemsSm:2,numItemsLg:3,className:"gap-6",children:[(0,t.jsxs)(C.Card,{children:[(0,t.jsx)(T.Text,{children:"Budget Status"}),(0,t.jsxs)("div",{className:"mt-2",children:[(0,t.jsxs)(k.Title,{children:["$",(0,m.formatNumberWithCommas)(tw.spend,4)]}),(0,t.jsxs)(T.Text,{children:["of ",null===tw.max_budget?"Unlimited":`$${(0,m.formatNumberWithCommas)(tw.max_budget,4)}`]}),tw.budget_duration&&(0,t.jsxs)(T.Text,{className:"text-gray-500",children:["Reset: ",tw.budget_duration]}),(0,t.jsx)("br",{}),tw.team_member_budget_table&&(0,t.jsxs)(T.Text,{className:"text-gray-500",children:["Team Member Budget: $",(0,m.formatNumberWithCommas)(tw.team_member_budget_table.max_budget,4)]})]})]}),(0,t.jsxs)(C.Card,{children:[(0,t.jsx)(T.Text,{children:"Rate Limits"}),(0,t.jsxs)("div",{className:"mt-2",children:[(0,t.jsxs)(T.Text,{children:["TPM: ",tw.tpm_limit||"Unlimited"]}),(0,t.jsxs)(T.Text,{children:["RPM: ",tw.rpm_limit||"Unlimited"]}),tw.max_parallel_requests&&(0,t.jsxs)(T.Text,{children:["Max Parallel Requests: ",tw.max_parallel_requests]}),(ep=tw.metadata?.model_tpm_limit??{},ex=tw.metadata?.model_rpm_limit??{},0===(eb=Array.from(new Set([...Object.keys(ep),...Object.keys(ex)]))).length?null:(0,t.jsxs)("div",{className:"mt-3",children:[(0,t.jsx)(T.Text,{className:"text-gray-500",children:"Per-model limits:"}),eb.map(e=>(0,t.jsxs)(T.Text,{className:"text-xs",children:[e,": TPM ",ep[e]??"—",", RPM ",ex[e]??"—"]},e))]}))]})]}),(0,t.jsxs)(C.Card,{children:[(0,t.jsx)(T.Text,{children:"Models"}),(0,t.jsx)("div",{className:"mt-2 flex flex-wrap gap-2",children:0===tw.models.length||tw.models.includes("all-proxy-models")?(0,t.jsx)(w.Badge,{color:"red",children:"All proxy models"}):(0,t.jsxs)(t.Fragment,{children:[tw.models.map((e,l)=>(0,t.jsx)(w.Badge,{color:"blue",children:e},`direct-${l}`)),(tw.access_group_models||[]).map((e,l)=>(0,t.jsx)(w.Badge,{color:"green",title:"From access group",children:e},`ag-${l}`))]})})]}),(0,t.jsxs)(C.Card,{children:[(0,t.jsx)(T.Text,{className:"font-semibold text-gray-900",children:"Virtual Keys"}),(0,t.jsxs)("div",{className:"mt-2",children:[(0,t.jsxs)(T.Text,{children:["User Keys: ",ev.keys.filter(e=>e.user_id).length]}),(0,t.jsxs)(T.Text,{children:["Service Account Keys: ",ev.keys.filter(e=>!e.user_id).length]}),(0,t.jsxs)(T.Text,{className:"text-gray-500",children:["Total: ",ev.keys.length]})]})]}),(0,t.jsx)(et.default,{objectPermission:tw.object_permission,variant:"card",accessToken:n}),(0,t.jsx)(C.Card,{children:(0,t.jsx)(Q,{globalGuardrailNames:eX,teamGuardrails:Array.isArray(tw.metadata?.guardrails)?tw.metadata.guardrails:[],optedOutGlobalGuardrails:Array.isArray(tw.metadata?.opted_out_global_guardrails)?tw.metadata.opted_out_global_guardrails:[],killSwitchOn:tC,variant:"inline"})}),(0,t.jsxs)(C.Card,{children:[(0,t.jsx)(T.Text,{className:"font-semibold text-gray-900 mb-3",children:"Policies"}),tw.policies&&tw.policies.length>0?(0,t.jsx)("div",{className:"space-y-4",children:tw.policies.map((e,l)=>(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(w.Badge,{color:"purple",children:e}),e5&&(0,t.jsx)(T.Text,{className:"text-xs text-gray-400",children:"Loading guardrails..."})]}),!e5&&e2[e]&&e2[e].length>0&&(0,t.jsxs)("div",{className:"ml-4 pl-3 border-l-2 border-gray-200",children:[(0,t.jsx)(T.Text,{className:"text-xs text-gray-500 mb-1",children:"Resolved Guardrails:"}),(0,t.jsx)("div",{className:"flex flex-wrap gap-1",children:e2[e].map((e,l)=>(0,t.jsx)(w.Badge,{color:"blue",size:"xs",children:e},l))})]})]},l))}):(0,t.jsx)(T.Text,{className:"text-gray-500",children:"No policies configured"})]}),(0,t.jsx)(Y.default,{loggingConfigs:tw.metadata?.logging||[],disabledCallbacks:[],variant:"card"})]})},{key:eA,label:eL[eA],children:(0,t.jsx)(eI,{teamId:e})},{key:eF,label:eL[eF],children:(0,t.jsx)(e1,{teamId:e,teamAlias:tw.team_alias,organization:ts})},{key:eO,label:eL[eO],children:(0,t.jsx)(eE,{teamData:ev,canEditTeam:tp,handleMemberDelete:e=>{e6(e),e8(!0)},setSelectedEditMember:eU,setIsEditMemberModalVisible:eR,setIsAddMemberModalVisible:eN})},{key:ez,label:eL[ez],children:(0,t.jsx)(e_,{teamId:e,accessToken:n,canEditTeam:tp})},{key:eP,label:eL[eP],children:(0,t.jsxs)(C.Card,{className:"overflow-y-auto max-h-[65vh]",children:[(0,t.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,t.jsx)(k.Title,{children:"Team Settings"}),tp&&!eV&&(0,t.jsx)(I.Button,{icon:(0,t.jsx)(g.EditOutlined,{className:"h-4 w-4"}),onClick:()=>eK(!0),children:"Edit Settings"})]}),eV&&eJ?(0,t.jsx)("div",{className:"p-4",children:"Loading..."}):eV?(0,t.jsxs)(M.Form,{form:ek,onFinish:tv,onValuesChange:e=>{if("disable_global_guardrails"in e){let t=!0===e.disable_global_guardrails,l=(ek.getFieldValue("guardrails")||[]).filter(e=>!eX.has(e));ek.setFieldValue("guardrails",t?l:[...Array.from(eX),...l])}},initialValues:{...tw,team_alias:tw.team_alias,models:tw.models,tpm_limit:tw.tpm_limit,rpm_limit:tw.rpm_limit,object_permission_search_tools:tw.object_permission?.search_tools||[],modelLimits:Array.from(new Set([...Object.keys(tw.metadata?.model_tpm_limit??{}),...Object.keys(tw.metadata?.model_rpm_limit??{})])).map(e=>({model:e,tpm:tw.metadata?.model_tpm_limit?.[e],rpm:tw.metadata?.model_rpm_limit?.[e]})),max_budget:tw.max_budget,soft_budget:tw.soft_budget,budget_duration:tw.budget_duration,team_member_tpm_limit:tw.team_member_budget_table?.tpm_limit,team_member_rpm_limit:tw.team_member_budget_table?.rpm_limit,team_member_budget:tw.team_member_budget_table?.max_budget,team_member_budget_duration:tw.team_member_budget_table?.budget_duration,guardrails:tN,policies:tw.policies||[],disable_global_guardrails:tw.metadata?.disable_global_guardrails||!1,soft_budget_alerting_emails:Array.isArray(tw.metadata?.soft_budget_alerting_emails)?tw.metadata.soft_budget_alerting_emails.join(", "):"",metadata:tw.metadata?JSON.stringify((({logging:e,secret_manager_settings:t,soft_budget_alerting_emails:l,model_tpm_limit:a,model_rpm_limit:r,allowed_passthrough_routes:s,...i})=>i)(tw.metadata),null,2):"",logging_settings:tw.metadata?.logging||[],secret_manager_settings:tw.metadata?.secret_manager_settings?JSON.stringify(tw.metadata.secret_manager_settings,null,2):"",organization_id:tw.organization_id,vector_stores:tw.object_permission?.vector_stores||[],mcp_servers:tw.object_permission?.mcp_servers||[],mcp_access_groups:tw.object_permission?.mcp_access_groups||[],mcp_servers_and_groups:{servers:tw.object_permission?.mcp_servers||[],accessGroups:tw.object_permission?.mcp_access_groups||[],toolsets:tw.object_permission?.mcp_toolsets||[]},mcp_tool_permissions:tw.object_permission?.mcp_tool_permissions||{},agents_and_groups:{agents:tw.object_permission?.agents||[],accessGroups:tw.object_permission?.agent_access_groups||[]},access_group_ids:tw.access_group_ids||[],default_team_member_models:tw.default_team_member_models||[],allowed_passthrough_routes:tw.metadata?.allowed_passthrough_routes||[]},layout:"vertical",children:[(0,t.jsx)(M.Form.Item,{label:"Team Name",name:"team_alias",rules:[{required:!0,message:"Please input a team name"}],children:(0,t.jsx)(A.Input,{type:""})}),(0,t.jsx)(M.Form.Item,{label:"Models",name:"models",rules:[{required:!0,message:"Please select at least one model"}],children:(0,t.jsx)(Z.ModelSelect,{value:ek.getFieldValue("models")||[],onChange:e=>ek.setFieldValue("models",e),teamID:e,organizationID:ev?.team_info?.organization_id||void 0,options:{includeSpecialOptions:!0,includeUserModels:!ev?.team_info?.organization_id,showAllProxyModelsOverride:(0,u.isProxyAdminRole)(to)&&!ev?.team_info?.organization_id},context:"team",dataTestId:"models-select"})}),(0,t.jsx)(M.Form.Item,{label:"Max Budget (USD)",name:"max_budget",children:(0,t.jsx)(el.default,{step:.01,precision:2,style:{width:"100%"}})}),(0,t.jsx)(M.Form.Item,{label:"Soft Budget (USD)",name:"soft_budget",children:(0,t.jsx)(el.default,{step:.01,precision:2,style:{width:"100%"}})}),(0,t.jsx)(M.Form.Item,{label:"Soft Budget Alerting Emails",name:"soft_budget_alerting_emails",tooltip:"Comma-separated email addresses to receive alerts when the soft budget is reached",children:(0,t.jsx)(A.Input,{placeholder:"example1@test.com, example2@test.com"})}),(0,t.jsxs)(y.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(v.AccordionHeader,{children:(0,t.jsx)("b",{children:"Team Member Settings"})}),(0,t.jsxs)(j.AccordionBody,{children:[(0,t.jsx)(T.Text,{className:"text-xs text-gray-500 mb-4",children:"Optional defaults applied when members join this team. All fields can be overridden per member."}),(0,t.jsx)(M.Form.Item,{label:(0,t.jsxs)("span",{children:["Default Model Access"," ",(0,t.jsx)(R.Tooltip,{title:"Optional. If set, new members can only access these models by default. Must be a subset of the team's models above. Leave empty to give all members access to all team models.",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"default_team_member_models",children:(0,t.jsx)(M.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.models!==t.models,children:({getFieldValue:e})=>{let l=e("models")||tw.models||[];return(0,t.jsx)(O.Select,{mode:"multiple",placeholder:"Leave empty — all team models accessible to every member",value:ek.getFieldValue("default_team_member_models")||[],onChange:e=>ek.setFieldValue("default_team_member_models",e),options:l.map(e=>({label:e,value:e}))})}})}),(0,t.jsx)(M.Form.Item,{label:"Default Budget (USD)",name:"team_member_budget",tooltip:"Default spend budget for each member in this team.",children:(0,t.jsx)(el.default,{step:.01,precision:2,style:{width:"100%"}})}),(0,t.jsx)(M.Form.Item,{label:"Default Budget Duration",name:"team_member_budget_duration",children:(0,t.jsx)(W,{onChange:e=>ek.setFieldValue("team_member_budget_duration",e),value:ek.getFieldValue("team_member_budget_duration")})}),(0,t.jsx)(M.Form.Item,{label:"Default Key Duration (eg: 1d, 1mo)",name:"team_member_key_duration",tooltip:"Set a limit to the duration of a team member's key. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days), 1mo (month)",children:(0,t.jsx)(N.TextInput,{placeholder:"e.g., 30d"})}),(0,t.jsx)(M.Form.Item,{label:"Default TPM Limit",name:"team_member_tpm_limit",tooltip:"Default tokens per minute limit for each member. Can be overridden per member.",children:(0,t.jsx)(el.default,{step:1,style:{width:"100%"},placeholder:"e.g., 1000"})}),(0,t.jsx)(M.Form.Item,{label:"Default RPM Limit",name:"team_member_rpm_limit",tooltip:"Default requests per minute limit for each member. Can be overridden per member.",children:(0,t.jsx)(el.default,{step:1,style:{width:"100%"},placeholder:"e.g., 100"})})]})]}),(0,t.jsx)(M.Form.Item,{label:"Reset Budget",name:"budget_duration",children:(0,t.jsxs)(O.Select,{placeholder:"n/a",children:[(0,t.jsx)(O.Select.Option,{value:"24h",children:"daily"}),(0,t.jsx)(O.Select.Option,{value:"7d",children:"weekly"}),(0,t.jsx)(O.Select.Option,{value:"30d",children:"monthly"})]})}),(0,t.jsx)(M.Form.Item,{label:"Tokens per minute Limit (TPM)",name:"tpm_limit",children:(0,t.jsx)(el.default,{step:1,style:{width:"100%"}})}),(0,t.jsx)(M.Form.Item,{label:"Requests per minute Limit (RPM)",name:"rpm_limit",children:(0,t.jsx)(el.default,{step:1,style:{width:"100%"}})}),(0,t.jsx)(M.Form.Item,{label:"Model-Specific Rate Limits",tooltip:"Set per-model TPM/RPM limits that apply across the whole team.",children:(0,t.jsx)(M.Form.List,{name:"modelLimits",children:(e,{add:l,remove:a})=>(0,t.jsxs)(t.Fragment,{children:[e.map(({key:e,name:l,...r})=>(0,t.jsxs)(z.Space,{style:{display:"flex",marginBottom:8},align:"baseline",children:[(0,t.jsx)(M.Form.Item,{...r,name:[l,"model"],rules:[{required:!0,message:"Missing model"},{validator:(e,t)=>t&&(ek.getFieldValue("modelLimits")??[]).filter(e=>e?.model===t).length>1?Promise.reject(Error("Duplicate model")):Promise.resolve()}],style:{minWidth:240},children:(0,t.jsx)(O.Select,{showSearch:!0,placeholder:"Select model",allowClear:!0,options:th.map(e=>({value:e,label:e}))})}),(0,t.jsx)(M.Form.Item,{...r,name:[l,"tpm"],rules:[{validator:async(e,t)=>{let a=(ek.getFieldValue("modelLimits")??[])[l]??{};return a.model&&null==t&&null==a.rpm?Promise.reject(Error("Set at least one of TPM or RPM")):Promise.resolve()}}],children:(0,t.jsx)(F.InputNumber,{placeholder:"TPM Limit",min:0})}),(0,t.jsx)(M.Form.Item,{...r,name:[l,"rpm"],children:(0,t.jsx)(F.InputNumber,{placeholder:"RPM Limit",min:0})}),(0,t.jsx)(x.MinusCircleOutlined,{onClick:()=>a(l),style:{color:"#ef4444"}})]},e)),(0,t.jsx)(M.Form.Item,{children:(0,t.jsx)(I.Button,{type:"dashed",onClick:()=>l(),block:!0,icon:(0,t.jsx)(b.PlusOutlined,{}),children:"Add Model Limit"})})]})})}),(0,t.jsx)(M.Form.Item,{label:"Router Settings",children:(0,t.jsx)(ei.default,{ref:tr,accessToken:n||"",value:tw.router_settings?{router_settings:tw.router_settings}:void 0})}),(0,t.jsx)(M.Form.Item,{label:(0,t.jsxs)("span",{children:["Guardrails"," ",(0,t.jsx)(R.Tooltip,{title:"Select which guardrails apply to this team. Global guardrails are enabled by default — uncheck to opt out. Other guardrails are opt-in.",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"guardrails",children:(0,t.jsxs)(O.Select,{mode:"multiple",placeholder:"Select guardrails",optionLabelProp:"label",tagRender:({label:e,value:l,closable:a,onClose:r})=>{let s=eX.has(l);return(0,t.jsxs)(D.Tag,{color:"blue",closable:a,onClose:r,onMouseDown:tk,style:{marginInlineEnd:4},children:[s&&(0,t.jsx)(h.GlobalOutlined,{style:{marginInlineEnd:4},"aria-label":"Global guardrail"}),e]})},children:[(0,t.jsx)(O.Select.OptGroup,{label:(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(h.GlobalOutlined,{style:{marginInlineEnd:4}}),"Global"]}),children:(eY?.guardrails??[]).filter(e=>e.litellm_params?.default_on).map(e=>(0,t.jsx)(O.Select.Option,{value:e.guardrail_name,label:e.guardrail_name,disabled:tg,children:e.guardrail_name},e.guardrail_name))}),(0,t.jsx)(O.Select.OptGroup,{label:"Other",children:(eY?.guardrails??[]).filter(e=>!e.litellm_params?.default_on).map(e=>(0,t.jsx)(O.Select.Option,{value:e.guardrail_name,label:e.guardrail_name,children:e.guardrail_name},e.guardrail_name))})]})}),(0,t.jsx)(M.Form.Item,{label:(0,t.jsxs)("span",{children:["Disable all global guardrails"," ",(0,t.jsx)(R.Tooltip,{title:"Kill switch: bypass every global guardrail for this team, including any added in the future. For per-guardrail opt-out instead, use the Guardrails dropdown above.",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"disable_global_guardrails",valuePropName:"checked",children:(0,t.jsx)(P.Switch,{checkedChildren:"Yes",unCheckedChildren:"No"})}),(0,t.jsx)(M.Form.Item,{label:(0,t.jsxs)("span",{children:["Policies"," ",(0,t.jsx)(R.Tooltip,{title:"Apply policies to this team to control guardrails and other settings",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"policies",children:(0,t.jsx)(O.Select,{mode:"tags",placeholder:"Select or enter policies",options:eZ.map(e=>({value:e,label:e}))})}),(0,t.jsx)(M.Form.Item,{label:(0,t.jsxs)("span",{children:["Access Groups"," ",(0,t.jsx)(R.Tooltip,{title:"Assign access groups to this team. Access groups control which models, MCP servers, and agents this team can use",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"access_group_ids",children:(0,t.jsx)(K.default,{placeholder:"Select access groups (optional)"})}),(0,t.jsx)(M.Form.Item,{label:"Vector Stores",name:"vector_stores","aria-label":"Vector Stores",children:(0,t.jsx)(ea.default,{onChange:e=>ek.setFieldValue("vector_stores",e),value:ek.getFieldValue("vector_stores"),accessToken:n||"",placeholder:"Select vector stores"})}),(0,t.jsx)(M.Form.Item,{label:"Allowed Pass Through Routes",name:"allowed_passthrough_routes",children:(0,t.jsx)(R.Tooltip,{title:eg?ed?"":"Only proxy admins can set allowed pass through routes":"Premium feature - Upgrade to set allowed pass through routes",placement:"top",children:(0,t.jsx)(q.default,{onChange:e=>ek.setFieldValue("allowed_passthrough_routes",e),value:ek.getFieldValue("allowed_passthrough_routes"),accessToken:n||"",placeholder:"Select pass through routes",disabled:!eg||!ed})})}),(0,t.jsx)(M.Form.Item,{label:"MCP Servers / Access Groups",name:"mcp_servers_and_groups",children:(0,t.jsx)(J.default,{onChange:e=>ek.setFieldValue("mcp_servers_and_groups",e),value:ek.getFieldValue("mcp_servers_and_groups"),accessToken:n||"",placeholder:"Select MCP servers or access groups (optional)"})}),(0,t.jsx)(M.Form.Item,{name:"mcp_tool_permissions",initialValue:{},hidden:!0,children:(0,t.jsx)(A.Input,{type:"hidden"})}),(0,t.jsx)(M.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.mcp_servers_and_groups!==t.mcp_servers_and_groups||e.mcp_tool_permissions!==t.mcp_tool_permissions,children:()=>(0,t.jsx)("div",{className:"mb-6",children:(0,t.jsx)(X.default,{accessToken:n||"",selectedServers:ek.getFieldValue("mcp_servers_and_groups")?.servers||[],toolPermissions:ek.getFieldValue("mcp_tool_permissions")||{},onChange:e=>ek.setFieldsValue({mcp_tool_permissions:e})})})}),(0,t.jsx)(M.Form.Item,{label:"Agents / Access Groups",name:"agents_and_groups",children:(0,t.jsx)($.default,{onChange:e=>ek.setFieldValue("agents_and_groups",e),value:ek.getFieldValue("agents_and_groups"),accessToken:n||"",placeholder:"Select agents or access groups (optional)"})}),(0,t.jsxs)(y.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(v.AccordionHeader,{children:(0,t.jsx)("b",{children:"Search Tool Settings"})}),(0,t.jsx)(j.AccordionBody,{children:(0,t.jsx)(M.Form.Item,{label:"Allowed Search Tools",name:"object_permission_search_tools",tooltip:"Select which search tools this team can access. Leave empty to allow all search tools.",children:(0,t.jsx)(er,{onChange:e=>ek.setFieldValue("object_permission_search_tools",e),value:ek.getFieldValue("object_permission_search_tools"),accessToken:n||"",placeholder:"Select search tools (optional, empty = all allowed)"})})})]}),(0,t.jsx)(M.Form.Item,{label:"Organization",name:"organization_id",children:(0,t.jsx)(O.Select,{allowClear:!0,placeholder:"Select an organization",showSearch:!0,optionFilterProp:"label",options:td.map(e=>({value:e.organization_id,label:e.organization_alias||e.organization_id}))})}),(0,t.jsx)(M.Form.Item,{label:"Logging Settings",name:"logging_settings",children:(0,t.jsx)(es.default,{value:ek.getFieldValue("logging_settings"),onChange:e=>ek.setFieldValue("logging_settings",e)})}),(0,t.jsx)(M.Form.Item,{label:"Secret Manager Settings",name:"secret_manager_settings",help:eg?"Enter secret manager configuration as a JSON object.":"Premium feature - Upgrade to manage secret manager settings.",rules:[{validator:async(e,t)=>{if(!t)return Promise.resolve();try{return JSON.parse(t),Promise.resolve()}catch(e){return Promise.reject(Error("Please enter valid JSON"))}}}],children:(0,t.jsx)(A.Input.TextArea,{rows:6,placeholder:'{"namespace": "admin", "mount": "secret", "path_prefix": "litellm"}',disabled:!eg})}),(0,t.jsx)(M.Form.Item,{label:"Metadata",name:"metadata",children:(0,t.jsx)(A.Input.TextArea,{rows:10})}),(0,t.jsx)("div",{className:"sticky z-10 bg-white p-4 pr-0 border-t border-gray-200 bottom-[-1.5rem] inset-x-[-1.5rem]",children:(0,t.jsxs)("div",{className:"flex justify-end items-center gap-2",children:[(0,t.jsx)(I.Button,{onClick:()=>eK(!1),disabled:tl,children:"Cancel"}),(0,t.jsx)(I.Button,{icon:(0,t.jsx)(_.SaveOutlined,{className:"h-4 w-4"}),type:"primary",htmlType:"submit",loading:tl,children:"Save Changes"})]})})]}):(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Team Name"}),(0,t.jsx)("div",{children:tw.team_alias})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Team ID"}),(0,t.jsx)("div",{className:"font-mono",children:tw.team_id})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Created At"}),(0,t.jsx)("div",{children:new Date(tw.created_at).toLocaleString()})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Models"}),(0,t.jsx)("div",{className:"flex flex-wrap gap-2 mt-1",children:tw.models.map((e,l)=>(0,t.jsx)(w.Badge,{color:"red",children:e},l))})]}),tw.default_team_member_models&&tw.default_team_member_models.length>0&&(0,t.jsxs)("div",{children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Default Member Models"}),(0,t.jsx)("div",{className:"flex flex-wrap gap-2 mt-1",children:tw.default_team_member_models.map((e,l)=>(0,t.jsx)(w.Badge,{color:"blue",children:e},l))})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Rate Limits"}),(0,t.jsxs)("div",{children:["TPM: ",tw.tpm_limit||"Unlimited"]}),(0,t.jsxs)("div",{children:["RPM: ",tw.rpm_limit||"Unlimited"]}),(ef=tw.metadata?.model_tpm_limit??{},ey=tw.metadata?.model_rpm_limit??{},0===(ej=Array.from(new Set([...Object.keys(ef),...Object.keys(ey)]))).length?null:(0,t.jsxs)("div",{className:"mt-2",children:[(0,t.jsx)(T.Text,{className:"text-gray-500",children:"Per-model limits:"}),ej.map(e=>(0,t.jsxs)("div",{className:"text-xs ml-2",children:[e,": TPM ",ef[e]??"—",", RPM ",ey[e]??"—"]},e))]}))]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Team Budget"}),(0,t.jsxs)("div",{children:["Max Budget:"," ",null!==tw.max_budget?`$${(0,m.formatNumberWithCommas)(tw.max_budget,4)}`:"No Limit"]}),(0,t.jsxs)("div",{children:["Soft Budget:"," ",null!==tw.soft_budget&&void 0!==tw.soft_budget?`$${(0,m.formatNumberWithCommas)(tw.soft_budget,4)}`:"No Limit"]}),(0,t.jsxs)("div",{children:["Budget Reset: ",tw.budget_duration||"Never"]}),tw.metadata?.soft_budget_alerting_emails&&Array.isArray(tw.metadata.soft_budget_alerting_emails)&&tw.metadata.soft_budget_alerting_emails.length>0&&(0,t.jsxs)("div",{children:["Soft Budget Alerting Emails: ",tw.metadata.soft_budget_alerting_emails.join(", ")]})]}),(0,t.jsxs)("div",{children:[(0,t.jsxs)(T.Text,{className:"font-medium",children:["Team Member Settings"," ",(0,t.jsx)(R.Tooltip,{title:"These are limits on individual team members",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),(0,t.jsxs)("div",{children:["Max Budget: ",tw.team_member_budget_table?.max_budget||"No Limit"]}),(0,t.jsxs)("div",{children:["Budget Duration: ",tw.team_member_budget_table?.budget_duration||"No Limit"]}),(0,t.jsxs)("div",{children:["Key Duration: ",tw.metadata?.team_member_key_duration||"No Limit"]}),(0,t.jsxs)("div",{children:["TPM Limit: ",tw.team_member_budget_table?.tpm_limit||"No Limit"]}),(0,t.jsxs)("div",{children:["RPM Limit: ",tw.team_member_budget_table?.rpm_limit||"No Limit"]})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Router Settings"}),tw.router_settings&&Object.values(tw.router_settings).some(e=>null!=e&&""!==e&&!(Array.isArray(e)&&0===e.length))?(0,t.jsxs)("div",{className:"mt-1 space-y-1",children:[tw.router_settings.routing_strategy&&(0,t.jsxs)("div",{children:["Routing Strategy:"," ",(0,t.jsx)(w.Badge,{color:"blue",children:tw.router_settings.routing_strategy})]}),null!=tw.router_settings.num_retries&&(0,t.jsxs)("div",{children:["Number of Retries: ",tw.router_settings.num_retries]}),null!=tw.router_settings.allowed_fails&&(0,t.jsxs)("div",{children:["Allowed Failures: ",tw.router_settings.allowed_fails]}),null!=tw.router_settings.cooldown_time&&(0,t.jsxs)("div",{children:["Cooldown Time: ",tw.router_settings.cooldown_time,"s"]}),null!=tw.router_settings.timeout&&(0,t.jsxs)("div",{children:["Timeout: ",tw.router_settings.timeout,"s"]}),null!=tw.router_settings.retry_after&&(0,t.jsxs)("div",{children:["Retry After: ",tw.router_settings.retry_after,"s"]}),tw.router_settings.fallbacks&&Array.isArray(tw.router_settings.fallbacks)&&tw.router_settings.fallbacks.length>0&&(0,t.jsxs)("div",{children:["Fallbacks: ",tw.router_settings.fallbacks.length," configured"]}),tw.router_settings.enable_tag_filtering&&(0,t.jsx)("div",{children:"Tag Filtering: Enabled"})]}):(0,t.jsx)("div",{className:"text-gray-400",children:"No router settings configured"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Organization ID"}),(0,t.jsx)("div",{children:tw.organization_id})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Status"}),(0,t.jsx)(w.Badge,{color:tw.blocked?"red":"green",children:tw.blocked?"Blocked":"Active"})]}),(0,t.jsx)(et.default,{objectPermission:tw.object_permission,variant:"inline",className:"pt-4 border-t border-gray-200",accessToken:n}),(0,t.jsx)(Q,{globalGuardrailNames:eX,teamGuardrails:Array.isArray(tw.metadata?.guardrails)?tw.metadata.guardrails:[],optedOutGlobalGuardrails:Array.isArray(tw.metadata?.opted_out_global_guardrails)?tw.metadata.opted_out_global_guardrails:[],killSwitchOn:tC,variant:"inline",className:"pt-4 border-t border-gray-200"}),(0,t.jsx)(Y.default,{loggingConfigs:tw.metadata?.logging||[],disabledCallbacks:[],variant:"inline",className:"pt-4 border-t border-gray-200"}),tw.metadata?.secret_manager_settings&&(0,t.jsxs)("div",{className:"pt-4 border-t border-gray-200",children:[(0,t.jsx)(T.Text,{className:"font-medium",children:"Secret Manager Settings"}),(0,t.jsx)("pre",{className:"mt-2 bg-gray-50 p-3 rounded text-xs overflow-x-auto",children:JSON.stringify(tw.metadata.secret_manager_settings,null,2)})]})]})]})}].filter(e=>tx.includes(e.key))}),(0,t.jsx)(eo.default,{visible:eD,onCancel:()=>eR(!1),onSubmit:ty,initialData:eB,mode:"edit",config:{title:"Edit Member",showEmail:!0,showUserId:!0,roleOptions:[{label:"Admin",value:"admin"},{label:"User",value:"user"}],additionalFields:[{name:"max_budget_in_team",label:(0,t.jsxs)("span",{children:["Team Member Budget (USD)"," ",(0,t.jsx)(R.Tooltip,{title:"Maximum amount in USD this member can spend within this team. This is separate from any global user budget limits",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),type:"numerical",step:.01,min:0,placeholder:"Budget limit for this member within this team"},{name:"tpm_limit",label:(0,t.jsxs)("span",{children:["Team Member TPM Limit"," ",(0,t.jsx)(R.Tooltip,{title:"Maximum tokens per minute this member can use within this team. This is separate from any global user TPM limit",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),type:"numerical",step:1,min:0,placeholder:"Tokens per minute limit for this member in this team"},{name:"rpm_limit",label:(0,t.jsxs)("span",{children:["Team Member RPM Limit"," ",(0,t.jsx)(R.Tooltip,{title:"Maximum requests per minute this member can make within this team. This is separate from any global user RPM limit",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),type:"numerical",step:1,min:0,placeholder:"Requests per minute limit for this member in this team"},{name:"allowed_models",label:(0,t.jsxs)("span",{children:["Allowed Models"," ",(0,t.jsx)(R.Tooltip,{title:"Models this member can access within this team. Leave empty to inherit all team models.",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),type:"multi-select",options:(tw.models||[]).map(e=>({label:e,value:e})),placeholder:"Leave empty to inherit all team models"}]}}),(0,t.jsx)(s.default,{isVisible:eT,onCancel:()=>eN(!1),onSubmit:tf,accessToken:n,teamId:e}),(0,t.jsx)(G.default,{isOpen:e9,title:"Delete Team Member",alertMessage:"Removing team members will also delete any keys created by or created for this member.",message:"Are you sure you want to remove this member from the team? This action cannot be undone.",resourceInformationTitle:"Team Member Information",resourceInformation:[{label:"User ID",value:e7?.user_id,code:!0},{label:"Email",value:e7?.user_email},{label:"Role",value:e7?.role}],onCancel:()=>{e8(!1),e6(null)},onOk:tj,confirmLoading:te})]})}],56567)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/03c715f5e0f1425c.js b/litellm/proxy/_experimental/out/_next/static/chunks/03c715f5e0f1425c.js deleted file mode 100644 index 963ac87c939..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/03c715f5e0f1425c.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,56567,838932,471145,e=>{"use strict";var t=e.i(843476),l=e.i(135214),a=e.i(109799),s=e.i(912598),i=e.i(907308),r=e.i(764205),n=e.i(266027);let o=(0,e.i(243652).createQueryKeys)("guardrails"),d=()=>{let{accessToken:e,userId:t,userRole:a}=(0,l.default)();return(0,n.useQuery)({queryKey:o.list({}),queryFn:async()=>(0,r.getGuardrailsList)(e),enabled:!!(e&&t&&a),select:e=>{let t=e?.guardrails??[],l=new Set,a=new Set;for(let e of t)e.litellm_params?.default_on?l.add(e.guardrail_name):a.add(e.guardrail_name);return{guardrails:t,globalGuardrailNames:l,optionalGuardrailNames:a}}})};e.s(["useGuardrails",0,d],838932);var m=e.i(500330),c=e.i(11751),u=e.i(708347),g=e.i(751904),h=e.i(160818),p=e.i(827252),x=e.i(564897),_=e.i(646563),b=e.i(987432),y=e.i(530212),j=e.i(677667),f=e.i(130643),v=e.i(898667),T=e.i(389083),S=e.i(304967),w=e.i(350967),N=e.i(599724),C=e.i(779241),k=e.i(629569),I=e.i(464571),M=e.i(808613),z=e.i(311451),A=e.i(28651),F=e.i(199133),O=e.i(770914),P=e.i(790848),D=e.i(653496),L=e.i(262218),R=e.i(592968),B=e.i(888259),V=e.i(678784),U=e.i(118366),E=e.i(271645),$=e.i(9314),K=e.i(552130),G=e.i(127952);function W({className:e,value:l,onChange:a}){return(0,t.jsxs)(F.Select,{className:e,value:l,onChange:a,children:[(0,t.jsx)(F.Select.Option,{value:"24h",children:"Daily"}),(0,t.jsx)(F.Select.Option,{value:"7d",children:"Weekly"}),(0,t.jsx)(F.Select.Option,{value:"30d",children:"Monthly"})]})}var q=e.i(844565),H=e.i(355619);let J=function({globalGuardrailNames:e,teamGuardrails:l=[],optedOutGlobalGuardrails:a=[],killSwitchOn:s=!1,variant:i="card",className:r=""}){let n=new Set(a),o=Array.from(e).filter(e=>!n.has(e)),d=l.filter(t=>!e.has(t)),m=s||0!==o.length||0!==d.length?(0,t.jsxs)("div",{className:"flex flex-col gap-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsxs)("span",{className:"block text-sm font-medium text-gray-700 mb-2",children:[(0,t.jsx)(h.GlobalOutlined,{style:{marginInlineEnd:4},"aria-label":"Global guardrail"}),"Global"]}),s?(0,t.jsx)(L.Tag,{color:"gold",children:"Bypassed for this team"}):o.length>0?(0,t.jsx)("div",{className:"flex flex-wrap gap-2",children:o.map(e=>(0,t.jsx)(L.Tag,{color:"blue",children:e},e))}):(0,t.jsx)("span",{className:"block text-sm text-gray-500",children:"None configured"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{className:"block text-sm font-medium text-gray-700 mb-2",children:"Team-specific"}),d.length>0?(0,t.jsx)("div",{className:"flex flex-wrap gap-2",children:d.map(e=>(0,t.jsx)(L.Tag,{color:"blue",children:e},e))}):(0,t.jsx)("span",{className:"block text-sm text-gray-500",children:"None configured"})]})]}):(0,t.jsx)("span",{className:"block text-gray-500",children:"No guardrails configured"});return"card"===i?(0,t.jsxs)("div",{className:`bg-white border border-gray-200 rounded-lg p-6 ${r}`,children:[(0,t.jsx)("div",{className:"flex items-center gap-2 mb-6",children:(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{className:"block font-semibold text-gray-900",children:"Guardrails Settings"}),(0,t.jsx)("span",{className:"block text-xs text-gray-500",children:"Global and team-specific guardrails applied to this team"})]})}),m]}):(0,t.jsxs)("div",{className:`${r}`,children:[(0,t.jsx)("span",{className:"block font-medium text-gray-900 mb-3",children:"Guardrails Settings"}),m]})};var Q=e.i(643449),Y=e.i(75921),X=e.i(390605),Z=e.i(162386),ee=e.i(727749),et=e.i(384767),el=e.i(435451),ea=e.i(916940);let es=({onChange:e,value:l,className:a,accessToken:s,placeholder:i="Select search tools (optional)",disabled:n=!1})=>{let[o,d]=(0,E.useState)([]),[m,c]=(0,E.useState)(!1);return(0,E.useEffect)(()=>{(async()=>{if(s){c(!0);try{let e=await (0,r.fetchSearchTools)(s),t=Array.isArray(e?.search_tools)?e.search_tools:Array.isArray(e?.data)?e.data:[];d(t.map(e=>e?.search_tool_name).filter(e=>"string"==typeof e&&e.length>0).map(e=>({label:e,value:e})))}catch(e){console.error("Failed to load search tools:",e)}finally{c(!1)}}})()},[s]),(0,t.jsx)(F.Select,{mode:"multiple",allowClear:!0,showSearch:!0,optionFilterProp:"label",placeholder:i,onChange:e,value:l,loading:m,className:a,options:o,style:{width:"100%"},disabled:n})};e.s(["default",0,es],471145);var ei=e.i(183588),er=e.i(460285),en=e.i(276173),eo=e.i(91979),ed=e.i(269200),em=e.i(942232),ec=e.i(977572),eu=e.i(427612),eg=e.i(64848),eh=e.i(496020),ep=e.i(536916),ex=e.i(21548);let e_={"/key/generate":"Member can generate a virtual key for this team","/key/service-account/generate":"Member can generate a service account key (not belonging to any user) for this team","/key/update":"Member can update a virtual key belonging to this team","/key/delete":"Member can delete a virtual key belonging to this team","/key/info":"Member can get info about a virtual key belonging to this team","/key/regenerate":"Member can regenerate a virtual key belonging to this team","/key/{key_id}/regenerate":"Member can regenerate a virtual key belonging to this team","/key/list":"Member can list virtual keys belonging to this team","/key/block":"Member can block a virtual key belonging to this team","/key/unblock":"Member can unblock a virtual key belonging to this team","/team/daily/activity":"Member can view all team usage data (not just their own)","/spend/logs":"Member can view spend logs for the entire team (not just their own)"},eb=({teamId:e,accessToken:l,canEditTeam:a})=>{let[s,i]=(0,E.useState)([]),[n,o]=(0,E.useState)([]),[d,m]=(0,E.useState)(!0),[c,u]=(0,E.useState)(!1),[g,h]=(0,E.useState)(!1),p=async()=>{try{if(m(!0),!l)return;let t=await (0,r.getTeamPermissionsCall)(l,e),a=t.all_available_permissions||[];i(a);let s=t.team_member_permissions||[];o(s),h(!1)}catch(e){ee.default.fromBackend("Failed to load permissions"),console.error("Error fetching permissions:",e)}finally{m(!1)}};(0,E.useEffect)(()=>{p()},[e,l]);let x=async()=>{try{if(!l)return;u(!0),await (0,r.teamPermissionsUpdateCall)(l,e,n),ee.default.success("Permissions updated successfully"),h(!1)}catch(e){ee.default.fromBackend("Failed to update permissions"),console.error("Error updating permissions:",e)}finally{u(!1)}};if(d)return(0,t.jsx)("div",{className:"p-6 text-center",children:"Loading permissions..."});let _=s.length>0;return(0,t.jsxs)(S.Card,{className:"bg-white shadow-md rounded-md p-6",children:[(0,t.jsxs)("div",{className:"flex flex-col sm:flex-row justify-between items-start sm:items-center border-b pb-4 mb-6",children:[(0,t.jsx)(k.Title,{className:"mb-2 sm:mb-0",children:"Member Permissions"}),a&&g&&(0,t.jsxs)("div",{className:"flex gap-3",children:[(0,t.jsx)(I.Button,{icon:(0,t.jsx)(eo.ReloadOutlined,{}),onClick:()=>{p()},children:"Reset"}),(0,t.jsx)(I.Button,{onClick:x,loading:c,type:"primary",icon:(0,t.jsx)(b.SaveOutlined,{}),children:"Save Changes"})]})]}),(0,t.jsx)(N.Text,{className:"mb-6 text-gray-600",children:"Control what team members can do when they are not team admins."}),_?(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(ed.Table,{className:" min-w-full",children:[(0,t.jsx)(eu.TableHead,{children:(0,t.jsxs)(eh.TableRow,{children:[(0,t.jsx)(eg.TableHeaderCell,{children:"Method"}),(0,t.jsx)(eg.TableHeaderCell,{children:"Endpoint"}),(0,t.jsx)(eg.TableHeaderCell,{children:"Description"}),(0,t.jsx)(eg.TableHeaderCell,{className:"sticky right-0 bg-white shadow-[-4px_0_4px_-4px_rgba(0,0,0,0.1)] text-center",children:"Allow Access"})]})}),(0,t.jsx)(em.TableBody,{children:s.map(e=>{let l=(e=>{let t=e.includes("/info")||e.includes("/list")||e.includes("/activity")||"/spend/logs"===e?"GET":"POST",l=e_[e];if(!l){for(let[t,a]of Object.entries(e_))if(e.includes(t)){l=a;break}}return l||(l=`Access ${e}`),{method:t,endpoint:e,description:l,route:e}})(e);return(0,t.jsxs)(eh.TableRow,{className:"hover:bg-gray-50 transition-colors",children:[(0,t.jsx)(ec.TableCell,{children:(0,t.jsx)("span",{className:`px-2 py-1 rounded text-xs font-medium ${"GET"===l.method?"bg-blue-100 text-blue-800":"bg-green-100 text-green-800"}`,children:l.method})}),(0,t.jsx)(ec.TableCell,{children:(0,t.jsx)("span",{className:"font-mono text-sm text-gray-800",children:l.endpoint})}),(0,t.jsx)(ec.TableCell,{className:"text-gray-700",children:l.description}),(0,t.jsx)(ec.TableCell,{className:"sticky right-0 bg-white shadow-[-4px_0_4px_-4px_rgba(0,0,0,0.1)] text-center",children:(0,t.jsx)(ep.Checkbox,{checked:n.includes(e),onChange:t=>{o(t.target.checked?[...n,e]:n.filter(t=>t!==e)),h(!0)},disabled:!a})})]},e)})})]})}):(0,t.jsx)("div",{className:"py-12",children:(0,t.jsx)(ex.Empty,{description:"No permissions available"})})]})};var ey=e.i(822315);function ej(e){if(!e)return null;let t=(0,ey.default)(e);return t.isValid()?t.format("MMM D, YYYY"):null}var ef=e.i(175712),ev=e.i(178654),eT=e.i(621192),eS=e.i(898586);let ew=async(e,t)=>{let l=(0,r.getProxyBaseUrl)(),a=l?`${l}/team/${encodeURIComponent(t)}/members/me`:`/team/${encodeURIComponent(t)}/members/me`,s=await fetch(a,{method:"GET",headers:{[(0,r.getGlobalLitellmHeaderName)()]:`Bearer ${e}`,"Content-Type":"application/json"}});if(404===s.status)return null;if(!s.ok){let e=await s.json().catch(()=>({}));throw Error((0,r.deriveErrorMessage)(e))}return await s.json()},eN=(e,l)=>(0,t.jsxs)(O.Space,{size:4,children:[(0,t.jsx)(eS.Typography.Text,{type:"secondary",children:e}),(0,t.jsx)(R.Tooltip,{title:l,children:(0,t.jsx)(p.InfoCircleOutlined,{style:{color:"#8c8c8c"}})})]}),eC=(e,t=4)=>null==e?"0":(0,m.formatNumberWithCommas)(e,t),ek=e=>null==e?"Unlimited":(0,m.formatNumberWithCommas)(e,0);function eI({teamId:e}){let{data:a,isLoading:s,error:i}=(e=>{let{accessToken:t}=(0,l.default)();return(0,n.useQuery)({queryKey:["team",e,"members","me"],queryFn:()=>ew(t,e),enabled:!!(t&&e)})})(e);if(s)return(0,t.jsx)(ef.Card,{children:(0,t.jsx)(eS.Typography.Text,{type:"secondary",children:"Loading your membership info…"})});if(i)return(0,t.jsx)(ef.Card,{children:(0,t.jsx)(eS.Typography.Text,{type:"danger",children:i instanceof Error?i.message:"Failed to load your membership info for this team."})});if(!a)return(0,t.jsx)(ef.Card,{children:(0,t.jsx)(eS.Typography.Text,{type:"secondary",children:"No membership info available for the current user in this team."})});let r=a.litellm_budget_table??null,o=r?.max_budget??null,d=a.spend??0,m=a.total_spend??0,c=r?.tpm_limit??null,u=r?.rpm_limit??null,g=ej(r?.budget_reset_at),h=r?.allowed_models??null;return(0,t.jsxs)(O.Space,{direction:"vertical",size:"middle",style:{width:"100%"},children:[(0,t.jsx)(ef.Card,{children:(0,t.jsxs)(eT.Row,{gutter:[24,16],children:[(0,t.jsxs)(ev.Col,{xs:24,sm:12,md:8,children:[(0,t.jsx)(eS.Typography.Text,{type:"secondary",children:"User"}),(0,t.jsx)("div",{style:{marginTop:4},children:(0,t.jsx)(eS.Typography.Text,{strong:!0,children:a.user_email||a.user_id})}),(0,t.jsx)(eS.Typography.Text,{type:"secondary",style:{fontSize:12,fontFamily:"monospace"},children:a.user_id})]}),(0,t.jsxs)(ev.Col,{xs:24,sm:12,md:8,children:[(0,t.jsx)(eS.Typography.Text,{type:"secondary",children:"Team Role"}),(0,t.jsx)("div",{style:{marginTop:4},children:(0,t.jsx)(L.Tag,{color:"admin"===a.role?"blue":"default",children:a.role||"user"})})]})]})}),(0,t.jsxs)(eT.Row,{gutter:[16,16],children:[(0,t.jsx)(ev.Col,{xs:24,md:12,children:(0,t.jsxs)(ef.Card,{children:[eN("Current Cycle Spend (USD)","Spend for the current budget cycle. Resets to $0 when the budget window rolls over."),(0,t.jsxs)("div",{style:{marginTop:8},children:[(0,t.jsxs)(eS.Typography.Title,{level:3,style:{margin:0},children:["$",eC(d,4)]}),(0,t.jsxs)(eS.Typography.Text,{type:"secondary",children:["of ",null===o?"Unlimited":`$${eC(o,4)}`]})]}),g&&(0,t.jsx)("div",{style:{marginTop:4},children:(0,t.jsxs)(eS.Typography.Text,{type:"secondary",children:["Resets ",g]})})]})}),(0,t.jsx)(ev.Col,{xs:24,md:12,children:(0,t.jsxs)(ef.Card,{children:[eN("Rate Limits","Your per-member rate limits within this team."),(0,t.jsxs)("div",{style:{marginTop:8},children:[(0,t.jsxs)(eS.Typography.Text,{children:["TPM: ",ek(c)]}),(0,t.jsx)("br",{}),(0,t.jsxs)(eS.Typography.Text,{children:["RPM: ",ek(u)]})]})]})}),(0,t.jsx)(ev.Col,{xs:24,md:12,children:(0,t.jsxs)(ef.Card,{children:[eN("Total Spend (USD)","Cumulative spend across all budget cycles within this team."),(0,t.jsx)("div",{style:{marginTop:8},children:(0,t.jsxs)(eS.Typography.Title,{level:4,style:{margin:0},children:["$",eC(m,4)]})})]})}),(0,t.jsx)(ev.Col,{xs:24,md:12,children:(0,t.jsxs)(ef.Card,{children:[eN("Model Scope","Models you can access within this team."),(0,t.jsx)("div",{style:{marginTop:8},children:h&&h.length>0?(0,t.jsx)(O.Space,{wrap:!0,children:h.map(e=>(0,t.jsx)(L.Tag,{children:e},e))}):(0,t.jsx)(eS.Typography.Text,{children:"All Team Models"})})]})})]})]})}let eM="overview",ez="my-user",eA="virtual-keys",eF="members",eO="member-permissions",eP="settings",eD={[eM]:"Overview",[ez]:"My User",[eA]:"Virtual Keys",[eF]:"Members",[eO]:"Member Permissions",[eP]:"Settings"};var eL=e.i(292639),eR=e.i(294612);function eB({teamData:e,canEditTeam:a,handleMemberDelete:s,setSelectedEditMember:i,setIsEditMemberModalVisible:r,setIsAddMemberModalVisible:n}){let o=e=>{if(null==e)return"0";if("number"==typeof e){let t=Number(e);return t===Math.floor(t)?t.toString():(0,m.formatNumberWithCommas)(t,8).replace(/\.?0+$/,"")}return"0"},{data:d}=(0,eL.useUISettings)(),{userId:c,userRole:g}=(0,l.default)(),h=!!d?.values?.disable_team_admin_delete_team_user,x=(0,u.isUserTeamAdminForSingleTeam)(e.team_info.members_with_roles,c||""),_=(0,u.isProxyAdminRole)(g||""),b=[{title:(0,t.jsxs)(O.Space,{direction:"horizontal",children:["Model Scope",(0,t.jsx)(R.Tooltip,{title:"Models this member can access. Empty means they inherit all team models.",children:(0,t.jsx)(p.InfoCircleOutlined,{})})]}),key:"model_scope",render:(l,a)=>{let s=(t=>{if(!t)return null;let l=e.team_memberships.find(e=>e.user_id===t),a=l?.litellm_budget_table?.allowed_models;return a&&a.length>0?a:null})(a.user_id);if(!s)return(0,t.jsx)(eS.Typography.Text,{type:"secondary",children:"(all team models)"});let i=s.slice(0,2),r=s.length-i.length;return(0,t.jsxs)(O.Space,{wrap:!0,children:[i.map(e=>(0,t.jsx)(eS.Typography.Text,{code:!0,style:{fontSize:"12px"},children:e},e)),r>0&&(0,t.jsx)(R.Tooltip,{title:s.slice(2).join(", "),children:(0,t.jsxs)(eS.Typography.Text,{type:"secondary",children:["+",r," more"]})})]})}},{title:(0,t.jsxs)(O.Space,{direction:"horizontal",children:["Current Cycle Spend (USD)",(0,t.jsx)(R.Tooltip,{title:"Spend for the current budget cycle. Resets to $0 when the member's budget window rolls over. This is the value checked against the member's budget.",children:(0,t.jsx)(p.InfoCircleOutlined,{})})]}),key:"spend",render:(l,a)=>(0,t.jsxs)(eS.Typography.Text,{children:["$",(0,m.formatNumberWithCommas)((t=>{if(!t)return 0;let l=e.team_memberships.find(e=>e.user_id===t);return l?.spend??0})(a.user_id),4)]})},{title:(0,t.jsxs)(O.Space,{direction:"horizontal",children:["Total Spend (USD)",(0,t.jsx)(R.Tooltip,{title:"Cumulative spend by this member within this team, across all budget cycles. Tracking began 2026-04-21; spend from before that date is not included.",children:(0,t.jsx)(p.InfoCircleOutlined,{})})]}),key:"total_spend",render:(l,a)=>(0,t.jsxs)(eS.Typography.Text,{children:["$",(0,m.formatNumberWithCommas)((t=>{if(!t)return 0;let l=e.team_memberships.find(e=>e.user_id===t);return l?.total_spend??0})(a.user_id),4)]})},{title:"Team Member Budget (USD)",key:"budget",render:(l,a)=>{let s=(t=>{if(!t)return null;let l=e.team_memberships.find(e=>e.user_id===t),a=l?.litellm_budget_table?.max_budget;return null==a?null:o(a)})(a.user_id);return(0,t.jsx)(eS.Typography.Text,{children:s?`$${(0,m.formatNumberWithCommas)(Number(s),4)}`:"No Limit"})}},{title:"Budget Reset",key:"budget_reset",render:(l,a)=>{let s=(t=>{if(!t)return null;let l=e.team_memberships.find(e=>e.user_id===t);return ej(l?.litellm_budget_table?.budget_reset_at)})(a.user_id);return s?(0,t.jsx)(eS.Typography.Text,{children:s}):(0,t.jsx)(eS.Typography.Text,{type:"secondary",children:"—"})}},{title:(0,t.jsxs)(O.Space,{direction:"horizontal",children:["Team Member Rate Limits",(0,t.jsx)(R.Tooltip,{title:"Rate limits for this member's usage within this team.",children:(0,t.jsx)(p.InfoCircleOutlined,{})})]}),key:"rate_limits",render:(l,a)=>(0,t.jsx)(eS.Typography.Text,{children:(t=>{if(!t)return"No Limits";let l=e.team_memberships.find(e=>e.user_id===t),a=l?.litellm_budget_table?.rpm_limit,s=l?.litellm_budget_table?.tpm_limit,i=[a?`${o(a)} RPM`:null,s?`${o(s)} TPM`:null].filter(Boolean);return i.length>0?i.join(" / "):"No Limits"})(a.user_id)})}];return(0,t.jsx)(eR.default,{members:e.team_info.members_with_roles,canEdit:a,onEdit:t=>{let l=e.team_memberships.find(e=>e.user_id===t.user_id);i({...t,max_budget_in_team:l?.litellm_budget_table?.max_budget||null,tpm_limit:l?.litellm_budget_table?.tpm_limit||null,rpm_limit:l?.litellm_budget_table?.rpm_limit||null,allowed_models:l?.litellm_budget_table?.allowed_models||[]}),r(!0)},onDelete:s,onAddMember:()=>n(!0),roleColumnTitle:"Team Role",roleTooltip:"This role applies only to this team and is independent from the user's proxy-level role.",extraColumns:b,showDeleteForMember:()=>_||a&&!x||x&&!h})}var eV=e.i(207082),eU=e.i(871943),eE=e.i(502547),e$=e.i(360820),eK=e.i(94629),eG=e.i(152990),eW=e.i(682830),eq=e.i(994388),eH=e.i(752978),eJ=e.i(282786),eQ=e.i(981339),eY=e.i(969550),eX=e.i(20147),eZ=e.i(633627);function e0({teamId:e,teamAlias:a,organization:s}){let{accessToken:i}=(0,l.default)(),[r,o]=(0,E.useState)(null),[d,c]=(0,E.useState)([{id:"created_at",desc:!0}]),[u,g]=(0,E.useState)({pageIndex:0,pageSize:50}),[h,x]=(0,E.useState)({"Organization ID":"","Key Alias":"","User ID":"","Sort By":"created_at","Sort Order":"desc"}),_=d.length>0?d[0].id:"created_at",b=d.length>0?d[0].desc?"desc":"asc":"desc",y=u.pageIndex,j=u.pageSize,{data:f,isPending:v,isFetching:S,refetch:w}=(0,eV.useKeys)(y+1,j,{teamID:e,organizationID:h["Organization ID"]?.trim()||void 0,selectedKeyAlias:h["Key Alias"]?.trim()||void 0,userID:h["User ID"]?.trim()||void 0,sortBy:_||void 0,sortOrder:b||void 0,expand:"user"}),C=(0,E.useMemo)(()=>{let e=f?.keys||[],t=s?.organization_id;return t?e.map(e=>({...e,organization_id:(e.organization_id??e.org_id)||t})):e},[f?.keys,s?.organization_id]),k=f?.total_pages??0,[I,M]=(0,E.useState)({}),z=(0,E.useMemo)(()=>({team_id:e,team_alias:a||e,models:[],max_budget:null,budget_duration:null,tpm_limit:null,rpm_limit:null,organization_id:s?.organization_id||"",created_at:"",keys:[],members_with_roles:[],spend:0}),[e,a,s]),A=(0,n.useQuery)({queryKey:["teamFilterOptions",e,i],queryFn:async()=>(0,eZ.fetchTeamFilterOptions)(i,e),enabled:!!i&&!!e,staleTime:3e4}).data||{keyAliases:[],organizationIds:[],userIds:[]},F=(0,E.useCallback)(()=>{w?.()},[w]);(0,E.useEffect)(()=>(window.addEventListener("storage",F),()=>window.removeEventListener("storage",F)),[F]);let O=(0,E.useCallback)((e,t=!1)=>{x(t=>({...t,"Organization ID":e["Organization ID"]??t["Organization ID"],"Key Alias":e["Key Alias"]??t["Key Alias"],"User ID":e["User ID"]??t["User ID"],"Sort By":e["Sort By"]??t["Sort By"]??"created_at","Sort Order":e["Sort Order"]??t["Sort Order"]??"desc"})),t||g(e=>({...e,pageIndex:0}))},[]),P=(0,E.useCallback)(()=>{x({"Organization ID":"","Key Alias":"","User ID":"","Sort By":"created_at","Sort Order":"desc"}),g(e=>({...e,pageIndex:0}))},[]),D=(0,E.useMemo)(()=>[{name:"Organization ID",label:"Organization ID",isSearchable:!0,searchFn:async e=>{let{organizationIds:t}=A;if(!t.length)return[];let l=e.toLowerCase();return(l?t.filter(e=>e.toLowerCase().includes(l)):t).map(e=>({label:e,value:e}))}},{name:"Key Alias",label:"Key Alias",isSearchable:!0,searchFn:async e=>{let{keyAliases:t}=A,l=e.toLowerCase();return(l?t.filter(e=>e.toLowerCase().includes(l)):t).map(e=>({label:e,value:e}))}},{name:"User ID",label:"User ID",isSearchable:!0,searchFn:async e=>{let{userIds:t}=A,l=e.toLowerCase();return(l?t.filter(e=>e.id.toLowerCase().includes(l)||e.email.toLowerCase().includes(l)):t).map(e=>({label:e.email?`${e.id} (${e.email})`:e.id,value:e.id}))}}],[A]),L=(0,E.useMemo)(()=>[{id:"token",accessorKey:"token",header:"Key ID",size:100,enableSorting:!0,cell:e=>{let l=e.getValue(),a=e.cell.column.getSize();return(0,t.jsx)(R.Tooltip,{title:l,children:(0,t.jsx)(eq.Button,{size:"xs",variant:"light",className:"font-mono text-blue-500 bg-blue-50 hover:bg-blue-100 text-xs font-normal px-2 py-0.5 text-left overflow-hidden truncate block",style:{maxWidth:a,overflow:"hidden"},onClick:()=>o(e.row.original),children:l??"-"})})}},{id:"key_alias",accessorKey:"key_alias",header:"Key Alias",size:150,enableSorting:!0,cell:e=>{let l=e.getValue(),a=e.cell.column.getSize();return(0,t.jsx)(R.Tooltip,{title:l,children:(0,t.jsx)("span",{className:"font-mono text-xs truncate block",style:{maxWidth:a,overflow:"hidden"},children:l??"-"})})}},{id:"key_name",accessorKey:"key_name",header:"Secret Key",size:120,enableSorting:!1,cell:e=>(0,t.jsx)("span",{className:"font-mono text-xs",children:e.getValue()})},{id:"organization_id",accessorKey:"organization_id",header:"Organization ID",size:140,enableSorting:!1,cell:e=>e.getValue()?e.renderValue():"-"},{id:"user_email",accessorKey:"user",header:"User Email",size:160,enableSorting:!1,cell:e=>{let l=e.getValue(),a=l?.user_email,s=e.cell.column.getSize();return(0,t.jsx)(R.Tooltip,{title:a,children:(0,t.jsx)("span",{className:"font-mono text-xs truncate block",style:{maxWidth:s,overflow:"hidden"},children:a??"-"})})}},{id:"user_id",accessorKey:"user_id",header:"User ID",size:70,enableSorting:!1,cell:e=>{let l=e.getValue(),a="default_user_id"===l?"Default Proxy Admin":l,s=e.cell.column.getSize();return(0,t.jsx)(R.Tooltip,{title:a,children:(0,t.jsx)("span",{className:"font-mono text-xs truncate block",style:{maxWidth:s,overflow:"hidden"},children:a??"-"})})}},{id:"created_at",accessorKey:"created_at",header:"Created At",size:120,enableSorting:!0,cell:e=>{let t=e.getValue();return t?new Date(t).toLocaleDateString():"-"}},{id:"created_by",accessorKey:"created_by",header:"Created By",size:70,enableSorting:!1,cell:e=>{let l=e.getValue(),a="default_user_id"===l?"Default Proxy Admin":l,s=e.cell.column.getSize();return(0,t.jsx)(R.Tooltip,{title:a,children:(0,t.jsx)("span",{className:"font-mono text-xs truncate block",style:{maxWidth:s,overflow:"hidden"},children:a??"-"})})}},{id:"updated_at",accessorKey:"updated_at",header:"Updated At",size:120,enableSorting:!0,cell:e=>{let t=e.getValue();return t?new Date(t).toLocaleDateString():"Never"}},{id:"last_active",accessorKey:"last_active",header:()=>(0,t.jsxs)("span",{className:"flex items-center gap-1",children:["Last Active",(0,t.jsx)(eJ.Popover,{content:"This is a new field and is not backfilled. Only new key usage will update this value.",trigger:"hover",children:(0,t.jsx)(p.InfoCircleOutlined,{className:"text-gray-400 text-xs cursor-help"})})]}),size:130,enableSorting:!1,cell:e=>{let l=e.getValue();if(!l)return"Unknown";let a=new Date(l);return(0,t.jsx)(R.Tooltip,{title:a.toLocaleString(void 0,{dateStyle:"medium",timeStyle:"long"}),children:(0,t.jsx)("span",{children:a.toLocaleDateString()})})}},{id:"expires",accessorKey:"expires",header:"Expires",size:120,enableSorting:!1,cell:e=>{let t=e.getValue();return t?new Date(t).toLocaleDateString():"Never"}},{id:"spend",accessorKey:"spend",header:"Spend (USD)",size:100,enableSorting:!0,cell:e=>(0,m.formatNumberWithCommas)(e.getValue(),4)},{id:"max_budget",accessorKey:"max_budget",header:"Budget (USD)",size:110,enableSorting:!0,cell:e=>{let t=e.getValue();return null===t?"Unlimited":`$${(0,m.formatNumberWithCommas)(t)}`}},{id:"budget_reset_at",accessorKey:"budget_reset_at",header:"Budget Reset",size:130,enableSorting:!1,cell:e=>{let t=e.getValue();return t?new Date(t).toLocaleString():"Never"}},{id:"models",accessorKey:"models",header:"Models",size:200,enableSorting:!1,cell:e=>{let l=e.getValue();return(0,t.jsx)("div",{className:"flex flex-col py-2",children:Array.isArray(l)?(0,t.jsx)("div",{className:"flex flex-col",children:0===l.length?(0,t.jsx)(T.Badge,{size:"xs",className:"mb-1",color:"red",children:(0,t.jsx)(N.Text,{children:"All Proxy Models"})}):(0,t.jsx)(t.Fragment,{children:(0,t.jsxs)("div",{className:"flex items-start",children:[l.length>3&&(0,t.jsx)("div",{children:(0,t.jsx)(eH.Icon,{icon:I[e.row.id]?eU.ChevronDownIcon:eE.ChevronRightIcon,className:"cursor-pointer",size:"xs",onClick:()=>M(t=>({...t,[e.row.id]:!t[e.row.id]}))})}),(0,t.jsxs)("div",{className:"flex flex-wrap gap-1",children:[l.slice(0,3).map((e,l)=>"all-proxy-models"===e?(0,t.jsx)(T.Badge,{size:"xs",color:"red",children:(0,t.jsx)(N.Text,{children:"All Proxy Models"})},l):(0,t.jsx)(T.Badge,{size:"xs",color:"blue",children:(0,t.jsx)(N.Text,{children:e.length>30?`${(0,H.getModelDisplayName)(e).slice(0,30)}...`:(0,H.getModelDisplayName)(e)})},l)),l.length>3&&!I[e.row.id]&&(0,t.jsx)(T.Badge,{size:"xs",color:"gray",className:"cursor-pointer",children:(0,t.jsxs)(N.Text,{children:["+",l.length-3," ",l.length-3==1?"more model":"more models"]})}),I[e.row.id]&&(0,t.jsx)("div",{className:"flex flex-wrap gap-1",children:l.slice(3).map((e,l)=>"all-proxy-models"===e?(0,t.jsx)(T.Badge,{size:"xs",color:"red",children:(0,t.jsx)(N.Text,{children:"All Proxy Models"})},l+3):(0,t.jsx)(T.Badge,{size:"xs",color:"blue",children:(0,t.jsx)(N.Text,{children:e.length>30?`${(0,H.getModelDisplayName)(e).slice(0,30)}...`:(0,H.getModelDisplayName)(e)})},l+3))})]})]})})}):null})}},{id:"rate_limits",header:"Rate Limits",size:140,enableSorting:!1,cell:({row:e})=>{let l=e.original;return(0,t.jsxs)("div",{children:[(0,t.jsxs)("div",{children:["TPM: ",null!==l.tpm_limit?l.tpm_limit:"Unlimited"]}),(0,t.jsxs)("div",{children:["RPM: ",null!==l.rpm_limit?l.rpm_limit:"Unlimited"]})]})}}],[I]),B=(0,E.useCallback)(e=>{let t="function"==typeof e?e(d):e;if(c(t),t?.length>0){let e=t[0];O({"Sort By":e.id,"Sort Order":e.desc?"desc":"asc"},!0)}},[d,O]),V=(0,eG.useReactTable)({data:C,columns:L,columnResizeMode:"onChange",columnResizeDirection:"ltr",state:{sorting:d,pagination:u},onSortingChange:B,onPaginationChange:g,getCoreRowModel:(0,eW.getCoreRowModel)(),enableSorting:!0,manualSorting:!0,manualPagination:!0,pageCount:k});return(0,t.jsx)("div",{className:"w-full h-full overflow-hidden",children:r?(0,t.jsx)(eX.default,{keyId:r.token,onClose:()=>o(null),keyData:r,teams:[z],onDelete:w}):(0,t.jsxs)("div",{className:"border-b py-4 flex-1 overflow-hidden",children:[(0,t.jsx)("div",{className:"w-full mb-6",children:(0,t.jsx)(eY.default,{options:D,onApplyFilters:O,initialValues:h,onResetFilters:P})}),(0,t.jsx)("div",{className:"flex items-center justify-end w-full mb-4",children:(0,t.jsxs)("div",{className:"inline-flex items-center gap-2",children:[v||S?(0,t.jsx)(eQ.Skeleton.Node,{active:!0,style:{width:74,height:20}}):(0,t.jsxs)("span",{className:"text-sm text-gray-700",children:["Page ",y+1," of ",V.getPageCount()]}),v||S?(0,t.jsx)(eQ.Skeleton.Button,{active:!0,size:"small",style:{width:84,height:30}}):(0,t.jsx)("button",{onClick:()=>V.previousPage(),disabled:v||S||!V.getCanPreviousPage(),className:"px-3 py-1 text-sm border rounded-md hover:bg-gray-50 disabled:opacity-50 disabled:cursor-not-allowed",children:"Previous"}),v||S?(0,t.jsx)(eQ.Skeleton.Button,{active:!0,size:"small",style:{width:58,height:30}}):(0,t.jsx)("button",{onClick:()=>V.nextPage(),disabled:v||S||!V.getCanNextPage(),className:"px-3 py-1 text-sm border rounded-md hover:bg-gray-50 disabled:opacity-50 disabled:cursor-not-allowed",children:"Next"})]})}),(0,t.jsx)("div",{className:"h-[75vh] overflow-auto",children:(0,t.jsx)("div",{className:"rounded-lg custom-border relative",children:(0,t.jsx)("div",{className:"overflow-x-auto",children:(0,t.jsxs)(ed.Table,{className:"[&_td]:py-0.5 [&_th]:py-1",style:{width:V.getCenterTotalSize()},children:[(0,t.jsx)(eu.TableHead,{children:V.getHeaderGroups().map(e=>(0,t.jsx)(eh.TableRow,{children:e.headers.map(e=>(0,t.jsx)(eg.TableHeaderCell,{"data-header-id":e.id,className:`py-1 h-8 relative hover:bg-gray-50 ${"actions"===e.id?"sticky right-0 bg-white shadow-[-4px_0_8px_-6px_rgba(0,0,0,0.1)]":""}`,style:{width:e.getSize(),position:"relative",cursor:e.column.getCanSort()?"pointer":"default"},onMouseEnter:()=>{let t=document.querySelector(`[data-header-id="${e.id}"] .resizer`);t&&(t.style.opacity="0.5")},onMouseLeave:()=>{let t=document.querySelector(`[data-header-id="${e.id}"] .resizer`);t&&!e.column.getIsResizing()&&(t.style.opacity="0")},onClick:e.column.getCanSort()?e.column.getToggleSortingHandler():void 0,children:(0,t.jsxs)("div",{className:"flex items-center justify-between gap-2",children:[(0,t.jsx)("div",{className:"flex items-center",children:e.isPlaceholder?null:(0,eG.flexRender)(e.column.columnDef.header,e.getContext())}),"actions"!==e.id&&e.column.getCanSort()&&(0,t.jsx)("div",{className:"w-4",children:e.column.getIsSorted()?({asc:(0,t.jsx)(e$.ChevronUpIcon,{className:"h-4 w-4 text-blue-500"}),desc:(0,t.jsx)(eU.ChevronDownIcon,{className:"h-4 w-4 text-blue-500"})})[e.column.getIsSorted()]:(0,t.jsx)(eK.SwitchVerticalIcon,{className:"h-4 w-4 text-gray-400"})}),(0,t.jsx)("div",{onDoubleClick:()=>e.column.resetSize(),onMouseDown:e.getResizeHandler(),onTouchStart:e.getResizeHandler(),className:`resizer ${V.options.columnResizeDirection} ${e.column.getIsResizing()?"isResizing":""}`,style:{position:"absolute",right:0,top:0,height:"100%",width:"5px",background:e.column.getIsResizing()?"#3b82f6":"transparent",cursor:"col-resize",userSelect:"none",touchAction:"none",opacity:+!!e.column.getIsResizing()}})]})},e.id))},e.id))}),(0,t.jsx)(em.TableBody,{children:v||S?(0,t.jsx)(eh.TableRow,{children:(0,t.jsx)(ec.TableCell,{colSpan:L.length,className:"h-8 text-center",children:(0,t.jsx)("div",{className:"text-center text-gray-500",children:(0,t.jsx)("p",{children:"Loading keys..."})})})}):C.length>0?V.getRowModel().rows.map(e=>(0,t.jsx)(eh.TableRow,{className:"h-8",children:e.getVisibleCells().map(e=>(0,t.jsx)(ec.TableCell,{style:{width:e.column.getSize(),maxWidth:"8-x",whiteSpace:"pre-wrap",overflow:"hidden"},className:`py-0.5 max-h-8 overflow-hidden text-ellipsis whitespace-nowrap ${"models"===e.column.id&&Array.isArray(e.getValue())&&e.getValue().length>3?"px-0":""}`,children:(0,eG.flexRender)(e.column.columnDef.cell,e.getContext())},e.id))},e.id)):(0,t.jsx)(eh.TableRow,{children:(0,t.jsx)(ec.TableCell,{colSpan:L.length,className:"h-8 text-center",children:(0,t.jsx)("div",{className:"text-center text-gray-500",children:(0,t.jsx)("p",{children:"No keys found"})})})})})]})})})})]})})}e.s(["default",0,({teamId:e,onClose:n,accessToken:o,is_team_admin:eo,is_proxy_admin:ed,is_org_admin:em=!1,userModels:ec,editTeam:eu,premiumUser:eg=!1,onUpdate:eh})=>{let ep,ex,e_,ey,ej,ef,[ev,eT]=(0,E.useState)(null),[eS,ew]=(0,E.useState)(!0),[eN,eC]=(0,E.useState)(!1),[ek]=M.Form.useForm(),[eL,eR]=(0,E.useState)(!1),[eV,eU]=(0,E.useState)(null),[eE,e$]=(0,E.useState)(!1),[eK,eG]=(0,E.useState)([]),[eW,eq]=(0,E.useState)(!1),[eH,eJ]=(0,E.useState)({}),{data:eQ,isLoading:eY}=d(),eX=eQ?.globalGuardrailNames??new Set,[eZ,e1]=(0,E.useState)([]),[e4,e2]=(0,E.useState)({}),[e5,e3]=(0,E.useState)(!1),[e6,e8]=(0,E.useState)(null),[e7,e9]=(0,E.useState)(!1),[te,tt]=(0,E.useState)(!1),[tl,ta]=(0,E.useState)(!1),ts=E.default.useRef(null),[ti,tr]=(0,E.useState)(null),{userRole:tn,userId:to}=(0,l.default)(),{data:td=[]}=(0,a.useOrganizations)(),tm=(0,s.useQueryClient)(),tc=(0,E.useMemo)(()=>{let e=ev?.team_info?.organization_id;if(!e||!to)return!1;let t=td.find(t=>t.organization_id===e);return t?.members?.some(e=>e.user_id===to&&"org_admin"===e.user_role)??!1},[ev,td,to]),tu=M.Form.useWatch("models",ek),tg=M.Form.useWatch("disable_global_guardrails",ek),th=(0,E.useMemo)(()=>{let e=tu??ev?.team_info?.models??[];return e.includes("all-proxy-models")||e.includes("all-team-models")?ec:(0,H.unfurlWildcardModelsInList)(e,ec)},[tu,ev,ec]),tp=eo||ed||em||tc,tx=(0,E.useMemo)(()=>{let e;return e=[eM,ez,eA],tp?[...e,eF,eO,eP]:e},[tp]),t_=(0,E.useMemo)(()=>eu&&tp?eP:eM,[eu,tp]),tb=async()=>{try{if(ew(!0),!o)return;let t=await (0,r.teamInfoCall)(o,e);eT(t)}catch(e){ee.default.fromBackend("Failed to load team information"),console.error("Error fetching team info:",e)}finally{ew(!1)}};(0,E.useEffect)(()=>{tb()},[e,o]),(0,E.useEffect)(()=>{(async()=>{if(!o||!ev?.team_info?.organization_id)return tr(null);try{let e=await (0,r.organizationInfoCall)(o,ev.team_info.organization_id);tr(e)}catch(e){console.error("Error fetching organization info:",e),tr(null)}})()},[o,ev?.team_info?.organization_id]),(0,E.useMemo)(()=>{let e;return e=[],e=ti?ti.models.includes("all-proxy-models")?ec:ti.models.length>0?ti.models:ec:ec,(0,H.unfurlWildcardModelsInList)(e,ec)},[ti,ec]),(0,E.useEffect)(()=>{(async()=>{try{if(!o)return;let e=(await (0,r.getPoliciesList)(o)).policies.map(e=>e.policy_name);e1(e)}catch(e){console.error("Failed to fetch policies:",e)}})()},[o]),(0,E.useEffect)(()=>{(async()=>{if(!o||!ev?.team_info?.policies||0===ev.team_info.policies.length)return;e3(!0);let e={};try{await Promise.all(ev.team_info.policies.map(async t=>{try{let l=await (0,r.getPolicyInfoWithGuardrails)(o,t);e[t]=l.resolved_guardrails||[]}catch(l){console.error(`Failed to fetch guardrails for policy ${t}:`,l),e[t]=[]}})),e2(e)}catch(e){console.error("Failed to fetch policy guardrails:",e)}finally{e3(!1)}})()},[o,ev?.team_info?.policies]);let ty=async t=>{try{if(null==o)return;let l={user_email:t.user_email,user_id:t.user_id,role:t.role};await (0,r.teamMemberAddCall)(o,e,l),ee.default.success("Team member added successfully"),eC(!1),ek.resetFields();let a=await (0,r.teamInfoCall)(o,e);eT(a),eh(a)}catch(t){let e="Failed to add team member";t?.raw?.detail?.error?.includes("Assigning team admins is a premium feature")?e="Assigning admins is an enterprise-only feature. Please upgrade your LiteLLM plan to enable this.":t?.message&&(e=t.message),ee.default.fromBackend(e),console.error("Error adding team member:",t)}},tj=async t=>{try{if(null==o)return;let l={user_email:t.user_email,user_id:t.user_id,role:t.role,max_budget_in_team:t.max_budget_in_team,tpm_limit:t.tpm_limit,rpm_limit:t.rpm_limit,allowed_models:t.allowed_models};B.default.destroy(),await (0,r.teamMemberUpdateCall)(o,e,l),ee.default.success("Team member updated successfully"),eR(!1);let a=await (0,r.teamInfoCall)(o,e);eT(a),eh(a)}catch(t){let e="Failed to update team member";t?.raw?.detail?.includes("Assigning team admins is a premium feature")?e="Assigning admins is an enterprise-only feature. Please upgrade your LiteLLM plan to enable this.":t?.message&&(e=t.message),eR(!1),B.default.destroy(),ee.default.fromBackend(e),console.error("Error updating team member:",t)}},tf=async()=>{if(e6&&o){tt(!0);try{await (0,r.teamMemberDeleteCall)(o,e,e6),ee.default.success("Team member removed successfully");let t=await (0,r.teamInfoCall)(o,e);eT(t),eh(t)}catch(e){ee.default.fromBackend("Failed to remove team member"),console.error("Error removing team member:",e)}finally{tt(!1),e9(!1),e8(null)}}},tv=async t=>{try{let l;if(!o)return;ta(!0);let s={};try{let{soft_budget_alerting_emails:e,...l}=t.metadata?JSON.parse(t.metadata):{};s=l}catch(e){ee.default.fromBackend("Invalid JSON in metadata field");return}if("string"==typeof t.secret_manager_settings&&t.secret_manager_settings.trim().length>0)try{l=JSON.parse(t.secret_manager_settings)}catch(e){ee.default.fromBackend("Invalid JSON in secret manager settings");return}let i=e=>null==e||"string"==typeof e&&""===e.trim()||"number"==typeof e&&Number.isNaN(e)?null:e,n={},d={};for(let e of t.modelLimits??[])e?.model&&(null!=e.tpm&&(n[e.model]=e.tpm),null!=e.rpm&&(d[e.model]=e.rpm));let m=!0===t.disable_global_guardrails,u=m?Array.from(eX):Array.from(eX).filter(e=>!(t.guardrails||[]).includes(e)),g={team_id:e,team_alias:t.team_alias,models:t.models,tpm_limit:i(t.tpm_limit),rpm_limit:i(t.rpm_limit),model_tpm_limit:n,model_rpm_limit:d,max_budget:t.max_budget,soft_budget:i(t.soft_budget),budget_duration:t.budget_duration,metadata:{...s,guardrails:(t.guardrails||[]).filter(e=>!eX.has(e)),opted_out_global_guardrails:u,...t.logging_settings?.length>0?{logging:t.logging_settings}:{},disable_global_guardrails:m,soft_budget_alerting_emails:"string"==typeof t.soft_budget_alerting_emails?t.soft_budget_alerting_emails.split(",").map(e=>e.trim()).filter(e=>e.length>0):t.soft_budget_alerting_emails||[],...void 0!==l?{secret_manager_settings:l}:{}},...t.policies?.length>0?{policies:t.policies}:{},...t.organization_id!==tT.organization_id?{organization_id:t.organization_id??null}:{}};g.max_budget=(0,c.mapEmptyStringToNull)(g.max_budget),g.team_member_budget_duration=t.team_member_budget_duration,void 0!==t.team_member_budget&&(g.team_member_budget=Number(t.team_member_budget)),void 0!==t.team_member_key_duration&&(g.team_member_key_duration=t.team_member_key_duration),(void 0!==t.team_member_tpm_limit||void 0!==t.team_member_rpm_limit)&&(g.team_member_tpm_limit=i(t.team_member_tpm_limit),g.team_member_rpm_limit=i(t.team_member_rpm_limit));let{servers:h,accessGroups:p,toolsets:x}=t.mcp_servers_and_groups||{servers:[],accessGroups:[],toolsets:[]},_=new Set(h||[]),b=Object.fromEntries(Object.entries(t.mcp_tool_permissions||{}).filter(([e])=>_.has(e)));g.object_permission={},h&&(g.object_permission.mcp_servers=h),p&&(g.object_permission.mcp_access_groups=p),b&&(g.object_permission.mcp_tool_permissions=b),x&&(g.object_permission.mcp_toolsets=x),delete t.mcp_servers_and_groups,delete t.mcp_tool_permissions;let{agents:y,accessGroups:j}=t.agents_and_groups||{agents:[],accessGroups:[]};y&&y.length>0&&(g.object_permission.agents=y),j&&j.length>0&&(g.object_permission.agent_access_groups=j),delete t.agents_and_groups,t.vector_stores&&t.vector_stores.length>0&&(g.object_permission.vector_stores=t.vector_stores),Array.isArray(t.object_permission_search_tools)&&(g.object_permission.search_tools=t.object_permission_search_tools),void 0!==t.access_group_ids&&(g.access_group_ids=t.access_group_ids),void 0!==t.default_team_member_models&&(g.default_team_member_models=t.default_team_member_models);let f=ts.current?.getValue();if(f?.router_settings){let e=e=>null!=e&&""!==e&&!1!==e&&!(Array.isArray(e)&&0===e.length),t=Object.values(f.router_settings).some(e),l=tT.router_settings&&Object.values(tT.router_settings).some(e);(t||l)&&(g.router_settings=f.router_settings)}await (0,r.teamUpdateCall)(o,g),tm.invalidateQueries({queryKey:a.organizationKeys.all}),ee.default.success("Team settings updated successfully"),e$(!1),tb()}catch(e){console.error("Error updating team:",e)}finally{ta(!1)}};if(eS)return(0,t.jsx)("div",{className:"p-4",children:"Loading..."});if(!ev?.team_info)return(0,t.jsx)("div",{className:"p-4",children:"Team not found"});let{team_info:tT}=ev,tS=tT.metadata?.disable_global_guardrails===!0,tw=new Set(Array.isArray(tT.metadata?.opted_out_global_guardrails)?tT.metadata.opted_out_global_guardrails:[]),tN=(Array.isArray(tT.metadata?.guardrails)?tT.metadata.guardrails:[]).filter(e=>!eX.has(e)),tC=tS?tN:[...Array.from(eX).filter(e=>!tw.has(e)),...tN],tk=e=>{e.preventDefault(),e.stopPropagation()},tI=async(e,t)=>{await (0,m.copyToClipboard)(e)&&(eJ(e=>({...e,[t]:!0})),setTimeout(()=>{eJ(e=>({...e,[t]:!1}))},2e3))};return(0,t.jsxs)("div",{className:"p-4",children:[(0,t.jsx)("div",{className:"flex justify-between items-center mb-6",children:(0,t.jsxs)("div",{children:[(0,t.jsx)(I.Button,{type:"text",icon:(0,t.jsx)(y.ArrowLeftIcon,{className:"h-4 w-4"}),onClick:n,className:"mb-4",children:"Back to Teams"}),(0,t.jsx)(k.Title,{children:tT.team_alias}),(0,t.jsxs)("div",{className:"flex items-center",children:[(0,t.jsx)(N.Text,{className:"text-gray-500 font-mono",children:tT.team_id}),(0,t.jsx)(I.Button,{type:"text",size:"small",icon:eH["team-id"]?(0,t.jsx)(V.CheckIcon,{size:12}):(0,t.jsx)(U.CopyIcon,{size:12}),onClick:()=>tI(tT.team_id,"team-id"),className:`left-2 z-10 transition-all duration-200 ${eH["team-id"]?"text-green-600 bg-green-50 border-green-200":"text-gray-500 hover:text-gray-700 hover:bg-gray-100"}`})]})]})}),(0,t.jsx)(D.Tabs,{defaultActiveKey:t_,className:"mb-4",items:[{key:eM,label:eD[eM],children:(0,t.jsxs)(w.Grid,{numItems:1,numItemsSm:2,numItemsLg:3,className:"gap-6",children:[(0,t.jsxs)(S.Card,{children:[(0,t.jsx)(N.Text,{children:"Budget Status"}),(0,t.jsxs)("div",{className:"mt-2",children:[(0,t.jsxs)(k.Title,{children:["$",(0,m.formatNumberWithCommas)(tT.spend,4)]}),(0,t.jsxs)(N.Text,{children:["of ",null===tT.max_budget?"Unlimited":`$${(0,m.formatNumberWithCommas)(tT.max_budget,4)}`]}),tT.budget_duration&&(0,t.jsxs)(N.Text,{className:"text-gray-500",children:["Reset: ",tT.budget_duration]}),(0,t.jsx)("br",{}),tT.team_member_budget_table&&(0,t.jsxs)(N.Text,{className:"text-gray-500",children:["Team Member Budget: $",(0,m.formatNumberWithCommas)(tT.team_member_budget_table.max_budget,4)]})]})]}),(0,t.jsxs)(S.Card,{children:[(0,t.jsx)(N.Text,{children:"Rate Limits"}),(0,t.jsxs)("div",{className:"mt-2",children:[(0,t.jsxs)(N.Text,{children:["TPM: ",tT.tpm_limit||"Unlimited"]}),(0,t.jsxs)(N.Text,{children:["RPM: ",tT.rpm_limit||"Unlimited"]}),tT.max_parallel_requests&&(0,t.jsxs)(N.Text,{children:["Max Parallel Requests: ",tT.max_parallel_requests]}),(ep=tT.metadata?.model_tpm_limit??{},ex=tT.metadata?.model_rpm_limit??{},0===(e_=Array.from(new Set([...Object.keys(ep),...Object.keys(ex)]))).length?null:(0,t.jsxs)("div",{className:"mt-3",children:[(0,t.jsx)(N.Text,{className:"text-gray-500",children:"Per-model limits:"}),e_.map(e=>(0,t.jsxs)(N.Text,{className:"text-xs",children:[e,": TPM ",ep[e]??"—",", RPM ",ex[e]??"—"]},e))]}))]})]}),(0,t.jsxs)(S.Card,{children:[(0,t.jsx)(N.Text,{children:"Models"}),(0,t.jsx)("div",{className:"mt-2 flex flex-wrap gap-2",children:0===tT.models.length||tT.models.includes("all-proxy-models")?(0,t.jsx)(T.Badge,{color:"red",children:"All proxy models"}):(0,t.jsxs)(t.Fragment,{children:[tT.models.map((e,l)=>(0,t.jsx)(T.Badge,{color:"blue",children:e},`direct-${l}`)),(tT.access_group_models||[]).map((e,l)=>(0,t.jsx)(T.Badge,{color:"green",title:"From access group",children:e},`ag-${l}`))]})})]}),(0,t.jsxs)(S.Card,{children:[(0,t.jsx)(N.Text,{className:"font-semibold text-gray-900",children:"Virtual Keys"}),(0,t.jsxs)("div",{className:"mt-2",children:[(0,t.jsxs)(N.Text,{children:["User Keys: ",ev.keys.filter(e=>e.user_id).length]}),(0,t.jsxs)(N.Text,{children:["Service Account Keys: ",ev.keys.filter(e=>!e.user_id).length]}),(0,t.jsxs)(N.Text,{className:"text-gray-500",children:["Total: ",ev.keys.length]})]})]}),(0,t.jsx)(et.default,{objectPermission:tT.object_permission,variant:"card",accessToken:o}),(0,t.jsx)(S.Card,{children:(0,t.jsx)(J,{globalGuardrailNames:eX,teamGuardrails:Array.isArray(tT.metadata?.guardrails)?tT.metadata.guardrails:[],optedOutGlobalGuardrails:Array.isArray(tT.metadata?.opted_out_global_guardrails)?tT.metadata.opted_out_global_guardrails:[],killSwitchOn:tS,variant:"inline"})}),(0,t.jsxs)(S.Card,{children:[(0,t.jsx)(N.Text,{className:"font-semibold text-gray-900 mb-3",children:"Policies"}),tT.policies&&tT.policies.length>0?(0,t.jsx)("div",{className:"space-y-4",children:tT.policies.map((e,l)=>(0,t.jsxs)("div",{className:"space-y-2",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)(T.Badge,{color:"purple",children:e}),e5&&(0,t.jsx)(N.Text,{className:"text-xs text-gray-400",children:"Loading guardrails..."})]}),!e5&&e4[e]&&e4[e].length>0&&(0,t.jsxs)("div",{className:"ml-4 pl-3 border-l-2 border-gray-200",children:[(0,t.jsx)(N.Text,{className:"text-xs text-gray-500 mb-1",children:"Resolved Guardrails:"}),(0,t.jsx)("div",{className:"flex flex-wrap gap-1",children:e4[e].map((e,l)=>(0,t.jsx)(T.Badge,{color:"blue",size:"xs",children:e},l))})]})]},l))}):(0,t.jsx)(N.Text,{className:"text-gray-500",children:"No policies configured"})]}),(0,t.jsx)(Q.default,{loggingConfigs:tT.metadata?.logging||[],disabledCallbacks:[],variant:"card"})]})},{key:ez,label:eD[ez],children:(0,t.jsx)(eI,{teamId:e})},{key:eA,label:eD[eA],children:(0,t.jsx)(e0,{teamId:e,teamAlias:tT.team_alias,organization:ti})},{key:eF,label:eD[eF],children:(0,t.jsx)(eB,{teamData:ev,canEditTeam:tp,handleMemberDelete:e=>{e8(e),e9(!0)},setSelectedEditMember:eU,setIsEditMemberModalVisible:eR,setIsAddMemberModalVisible:eC})},{key:eO,label:eD[eO],children:(0,t.jsx)(eb,{teamId:e,accessToken:o,canEditTeam:tp})},{key:eP,label:eD[eP],children:(0,t.jsxs)(S.Card,{className:"overflow-y-auto max-h-[65vh]",children:[(0,t.jsxs)("div",{className:"flex justify-between items-center mb-4",children:[(0,t.jsx)(k.Title,{children:"Team Settings"}),tp&&!eE&&(0,t.jsx)(I.Button,{icon:(0,t.jsx)(g.EditOutlined,{className:"h-4 w-4"}),onClick:()=>e$(!0),children:"Edit Settings"})]}),eE&&eY?(0,t.jsx)("div",{className:"p-4",children:"Loading..."}):eE?(0,t.jsxs)(M.Form,{form:ek,onFinish:tv,onValuesChange:e=>{if("disable_global_guardrails"in e){let t=!0===e.disable_global_guardrails,l=(ek.getFieldValue("guardrails")||[]).filter(e=>!eX.has(e));ek.setFieldValue("guardrails",t?l:[...Array.from(eX),...l])}},initialValues:{...tT,team_alias:tT.team_alias,models:tT.models,tpm_limit:tT.tpm_limit,rpm_limit:tT.rpm_limit,object_permission_search_tools:tT.object_permission?.search_tools||[],modelLimits:Array.from(new Set([...Object.keys(tT.metadata?.model_tpm_limit??{}),...Object.keys(tT.metadata?.model_rpm_limit??{})])).map(e=>({model:e,tpm:tT.metadata?.model_tpm_limit?.[e],rpm:tT.metadata?.model_rpm_limit?.[e]})),max_budget:tT.max_budget,soft_budget:tT.soft_budget,budget_duration:tT.budget_duration,team_member_tpm_limit:tT.team_member_budget_table?.tpm_limit,team_member_rpm_limit:tT.team_member_budget_table?.rpm_limit,team_member_budget:tT.team_member_budget_table?.max_budget,team_member_budget_duration:tT.team_member_budget_table?.budget_duration,guardrails:tC,policies:tT.policies||[],disable_global_guardrails:tT.metadata?.disable_global_guardrails||!1,soft_budget_alerting_emails:Array.isArray(tT.metadata?.soft_budget_alerting_emails)?tT.metadata.soft_budget_alerting_emails.join(", "):"",metadata:tT.metadata?JSON.stringify((({logging:e,secret_manager_settings:t,soft_budget_alerting_emails:l,model_tpm_limit:a,model_rpm_limit:s,...i})=>i)(tT.metadata),null,2):"",logging_settings:tT.metadata?.logging||[],secret_manager_settings:tT.metadata?.secret_manager_settings?JSON.stringify(tT.metadata.secret_manager_settings,null,2):"",organization_id:tT.organization_id,vector_stores:tT.object_permission?.vector_stores||[],mcp_servers:tT.object_permission?.mcp_servers||[],mcp_access_groups:tT.object_permission?.mcp_access_groups||[],mcp_servers_and_groups:{servers:tT.object_permission?.mcp_servers||[],accessGroups:tT.object_permission?.mcp_access_groups||[],toolsets:tT.object_permission?.mcp_toolsets||[]},mcp_tool_permissions:tT.object_permission?.mcp_tool_permissions||{},agents_and_groups:{agents:tT.object_permission?.agents||[],accessGroups:tT.object_permission?.agent_access_groups||[]},access_group_ids:tT.access_group_ids||[],default_team_member_models:tT.default_team_member_models||[]},layout:"vertical",children:[(0,t.jsx)(M.Form.Item,{label:"Team Name",name:"team_alias",rules:[{required:!0,message:"Please input a team name"}],children:(0,t.jsx)(z.Input,{type:""})}),(0,t.jsx)(M.Form.Item,{label:"Models",name:"models",rules:[{required:!0,message:"Please select at least one model"}],children:(0,t.jsx)(Z.ModelSelect,{value:ek.getFieldValue("models")||[],onChange:e=>ek.setFieldValue("models",e),teamID:e,organizationID:ev?.team_info?.organization_id||void 0,options:{includeSpecialOptions:!0,includeUserModels:!ev?.team_info?.organization_id,showAllProxyModelsOverride:(0,u.isProxyAdminRole)(tn)&&!ev?.team_info?.organization_id},context:"team",dataTestId:"models-select"})}),(0,t.jsx)(M.Form.Item,{label:"Max Budget (USD)",name:"max_budget",children:(0,t.jsx)(el.default,{step:.01,precision:2,style:{width:"100%"}})}),(0,t.jsx)(M.Form.Item,{label:"Soft Budget (USD)",name:"soft_budget",children:(0,t.jsx)(el.default,{step:.01,precision:2,style:{width:"100%"}})}),(0,t.jsx)(M.Form.Item,{label:"Soft Budget Alerting Emails",name:"soft_budget_alerting_emails",tooltip:"Comma-separated email addresses to receive alerts when the soft budget is reached",children:(0,t.jsx)(z.Input,{placeholder:"example1@test.com, example2@test.com"})}),(0,t.jsxs)(j.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(v.AccordionHeader,{children:(0,t.jsx)("b",{children:"Team Member Settings"})}),(0,t.jsxs)(f.AccordionBody,{children:[(0,t.jsx)(N.Text,{className:"text-xs text-gray-500 mb-4",children:"Optional defaults applied when members join this team. All fields can be overridden per member."}),(0,t.jsx)(M.Form.Item,{label:(0,t.jsxs)("span",{children:["Default Model Access"," ",(0,t.jsx)(R.Tooltip,{title:"Optional. If set, new members can only access these models by default. Must be a subset of the team's models above. Leave empty to give all members access to all team models.",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"default_team_member_models",children:(0,t.jsx)(M.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.models!==t.models,children:({getFieldValue:e})=>{let l=e("models")||tT.models||[];return(0,t.jsx)(F.Select,{mode:"multiple",placeholder:"Leave empty — all team models accessible to every member",value:ek.getFieldValue("default_team_member_models")||[],onChange:e=>ek.setFieldValue("default_team_member_models",e),options:l.map(e=>({label:e,value:e}))})}})}),(0,t.jsx)(M.Form.Item,{label:"Default Budget (USD)",name:"team_member_budget",tooltip:"Default spend budget for each member in this team.",children:(0,t.jsx)(el.default,{step:.01,precision:2,style:{width:"100%"}})}),(0,t.jsx)(M.Form.Item,{label:"Default Budget Duration",name:"team_member_budget_duration",children:(0,t.jsx)(W,{onChange:e=>ek.setFieldValue("team_member_budget_duration",e),value:ek.getFieldValue("team_member_budget_duration")})}),(0,t.jsx)(M.Form.Item,{label:"Default Key Duration (eg: 1d, 1mo)",name:"team_member_key_duration",tooltip:"Set a limit to the duration of a team member's key. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days), 1mo (month)",children:(0,t.jsx)(C.TextInput,{placeholder:"e.g., 30d"})}),(0,t.jsx)(M.Form.Item,{label:"Default TPM Limit",name:"team_member_tpm_limit",tooltip:"Default tokens per minute limit for each member. Can be overridden per member.",children:(0,t.jsx)(el.default,{step:1,style:{width:"100%"},placeholder:"e.g., 1000"})}),(0,t.jsx)(M.Form.Item,{label:"Default RPM Limit",name:"team_member_rpm_limit",tooltip:"Default requests per minute limit for each member. Can be overridden per member.",children:(0,t.jsx)(el.default,{step:1,style:{width:"100%"},placeholder:"e.g., 100"})})]})]}),(0,t.jsx)(M.Form.Item,{label:"Reset Budget",name:"budget_duration",children:(0,t.jsxs)(F.Select,{placeholder:"n/a",children:[(0,t.jsx)(F.Select.Option,{value:"24h",children:"daily"}),(0,t.jsx)(F.Select.Option,{value:"7d",children:"weekly"}),(0,t.jsx)(F.Select.Option,{value:"30d",children:"monthly"})]})}),(0,t.jsx)(M.Form.Item,{label:"Tokens per minute Limit (TPM)",name:"tpm_limit",children:(0,t.jsx)(el.default,{step:1,style:{width:"100%"}})}),(0,t.jsx)(M.Form.Item,{label:"Requests per minute Limit (RPM)",name:"rpm_limit",children:(0,t.jsx)(el.default,{step:1,style:{width:"100%"}})}),(0,t.jsx)(M.Form.Item,{label:"Model-Specific Rate Limits",tooltip:"Set per-model TPM/RPM limits that apply across the whole team.",children:(0,t.jsx)(M.Form.List,{name:"modelLimits",children:(e,{add:l,remove:a})=>(0,t.jsxs)(t.Fragment,{children:[e.map(({key:e,name:l,...s})=>(0,t.jsxs)(O.Space,{style:{display:"flex",marginBottom:8},align:"baseline",children:[(0,t.jsx)(M.Form.Item,{...s,name:[l,"model"],rules:[{required:!0,message:"Missing model"},{validator:(e,t)=>t&&(ek.getFieldValue("modelLimits")??[]).filter(e=>e?.model===t).length>1?Promise.reject(Error("Duplicate model")):Promise.resolve()}],style:{minWidth:240},children:(0,t.jsx)(F.Select,{showSearch:!0,placeholder:"Select model",allowClear:!0,options:th.map(e=>({value:e,label:e}))})}),(0,t.jsx)(M.Form.Item,{...s,name:[l,"tpm"],rules:[{validator:async(e,t)=>{let a=(ek.getFieldValue("modelLimits")??[])[l]??{};return a.model&&null==t&&null==a.rpm?Promise.reject(Error("Set at least one of TPM or RPM")):Promise.resolve()}}],children:(0,t.jsx)(A.InputNumber,{placeholder:"TPM Limit",min:0})}),(0,t.jsx)(M.Form.Item,{...s,name:[l,"rpm"],children:(0,t.jsx)(A.InputNumber,{placeholder:"RPM Limit",min:0})}),(0,t.jsx)(x.MinusCircleOutlined,{onClick:()=>a(l),style:{color:"#ef4444"}})]},e)),(0,t.jsx)(M.Form.Item,{children:(0,t.jsx)(I.Button,{type:"dashed",onClick:()=>l(),block:!0,icon:(0,t.jsx)(_.PlusOutlined,{}),children:"Add Model Limit"})})]})})}),(0,t.jsx)(M.Form.Item,{label:"Router Settings",children:(0,t.jsx)(er.default,{ref:ts,accessToken:o||"",value:tT.router_settings?{router_settings:tT.router_settings}:void 0})}),(0,t.jsx)(M.Form.Item,{label:(0,t.jsxs)("span",{children:["Guardrails"," ",(0,t.jsx)(R.Tooltip,{title:"Select which guardrails apply to this team. Global guardrails are enabled by default — uncheck to opt out. Other guardrails are opt-in.",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/quick_start",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"guardrails",children:(0,t.jsxs)(F.Select,{mode:"multiple",placeholder:"Select guardrails",optionLabelProp:"label",tagRender:({label:e,value:l,closable:a,onClose:s})=>{let i=eX.has(l);return(0,t.jsxs)(L.Tag,{color:"blue",closable:a,onClose:s,onMouseDown:tk,style:{marginInlineEnd:4},children:[i&&(0,t.jsx)(h.GlobalOutlined,{style:{marginInlineEnd:4},"aria-label":"Global guardrail"}),e]})},children:[(0,t.jsx)(F.Select.OptGroup,{label:(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(h.GlobalOutlined,{style:{marginInlineEnd:4}}),"Global"]}),children:(eQ?.guardrails??[]).filter(e=>e.litellm_params?.default_on).map(e=>(0,t.jsx)(F.Select.Option,{value:e.guardrail_name,label:e.guardrail_name,disabled:tg,children:e.guardrail_name},e.guardrail_name))}),(0,t.jsx)(F.Select.OptGroup,{label:"Other",children:(eQ?.guardrails??[]).filter(e=>!e.litellm_params?.default_on).map(e=>(0,t.jsx)(F.Select.Option,{value:e.guardrail_name,label:e.guardrail_name,children:e.guardrail_name},e.guardrail_name))})]})}),(0,t.jsx)(M.Form.Item,{label:(0,t.jsxs)("span",{children:["Disable all global guardrails"," ",(0,t.jsx)(R.Tooltip,{title:"Kill switch: bypass every global guardrail for this team, including any added in the future. For per-guardrail opt-out instead, use the Guardrails dropdown above.",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"disable_global_guardrails",valuePropName:"checked",children:(0,t.jsx)(P.Switch,{checkedChildren:"Yes",unCheckedChildren:"No"})}),(0,t.jsx)(M.Form.Item,{label:(0,t.jsxs)("span",{children:["Policies"," ",(0,t.jsx)(R.Tooltip,{title:"Apply policies to this team to control guardrails and other settings",children:(0,t.jsx)("a",{href:"https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies",target:"_blank",rel:"noopener noreferrer",onClick:e=>e.stopPropagation(),children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})})]}),name:"policies",children:(0,t.jsx)(F.Select,{mode:"tags",placeholder:"Select or enter policies",options:eZ.map(e=>({value:e,label:e}))})}),(0,t.jsx)(M.Form.Item,{label:(0,t.jsxs)("span",{children:["Access Groups"," ",(0,t.jsx)(R.Tooltip,{title:"Assign access groups to this team. Access groups control which models, MCP servers, and agents this team can use",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),name:"access_group_ids",children:(0,t.jsx)($.default,{placeholder:"Select access groups (optional)"})}),(0,t.jsx)(M.Form.Item,{label:"Vector Stores",name:"vector_stores","aria-label":"Vector Stores",children:(0,t.jsx)(ea.default,{onChange:e=>ek.setFieldValue("vector_stores",e),value:ek.getFieldValue("vector_stores"),accessToken:o||"",placeholder:"Select vector stores"})}),(0,t.jsx)(M.Form.Item,{label:"Allowed Pass Through Routes",name:"allowed_passthrough_routes",children:(0,t.jsx)(q.default,{onChange:e=>ek.setFieldValue("allowed_passthrough_routes",e),value:ek.getFieldValue("allowed_passthrough_routes"),accessToken:o||"",placeholder:"Select pass through routes"})}),(0,t.jsx)(M.Form.Item,{label:"MCP Servers / Access Groups",name:"mcp_servers_and_groups",children:(0,t.jsx)(Y.default,{onChange:e=>ek.setFieldValue("mcp_servers_and_groups",e),value:ek.getFieldValue("mcp_servers_and_groups"),accessToken:o||"",placeholder:"Select MCP servers or access groups (optional)"})}),(0,t.jsx)(M.Form.Item,{name:"mcp_tool_permissions",initialValue:{},hidden:!0,children:(0,t.jsx)(z.Input,{type:"hidden"})}),(0,t.jsx)(M.Form.Item,{noStyle:!0,shouldUpdate:(e,t)=>e.mcp_servers_and_groups!==t.mcp_servers_and_groups||e.mcp_tool_permissions!==t.mcp_tool_permissions,children:()=>(0,t.jsx)("div",{className:"mb-6",children:(0,t.jsx)(X.default,{accessToken:o||"",selectedServers:ek.getFieldValue("mcp_servers_and_groups")?.servers||[],toolPermissions:ek.getFieldValue("mcp_tool_permissions")||{},onChange:e=>ek.setFieldsValue({mcp_tool_permissions:e})})})}),(0,t.jsx)(M.Form.Item,{label:"Agents / Access Groups",name:"agents_and_groups",children:(0,t.jsx)(K.default,{onChange:e=>ek.setFieldValue("agents_and_groups",e),value:ek.getFieldValue("agents_and_groups"),accessToken:o||"",placeholder:"Select agents or access groups (optional)"})}),(0,t.jsxs)(j.Accordion,{className:"mt-4 mb-4",children:[(0,t.jsx)(v.AccordionHeader,{children:(0,t.jsx)("b",{children:"Search Tool Settings"})}),(0,t.jsx)(f.AccordionBody,{children:(0,t.jsx)(M.Form.Item,{label:"Allowed Search Tools",name:"object_permission_search_tools",tooltip:"Select which search tools this team can access. Leave empty to allow all search tools.",children:(0,t.jsx)(es,{onChange:e=>ek.setFieldValue("object_permission_search_tools",e),value:ek.getFieldValue("object_permission_search_tools"),accessToken:o||"",placeholder:"Select search tools (optional, empty = all allowed)"})})})]}),(0,t.jsx)(M.Form.Item,{label:"Organization",name:"organization_id",children:(0,t.jsx)(F.Select,{allowClear:!0,placeholder:"Select an organization",showSearch:!0,optionFilterProp:"label",options:td.map(e=>({value:e.organization_id,label:e.organization_alias||e.organization_id}))})}),(0,t.jsx)(M.Form.Item,{label:"Logging Settings",name:"logging_settings",children:(0,t.jsx)(ei.default,{value:ek.getFieldValue("logging_settings"),onChange:e=>ek.setFieldValue("logging_settings",e)})}),(0,t.jsx)(M.Form.Item,{label:"Secret Manager Settings",name:"secret_manager_settings",help:eg?"Enter secret manager configuration as a JSON object.":"Premium feature - Upgrade to manage secret manager settings.",rules:[{validator:async(e,t)=>{if(!t)return Promise.resolve();try{return JSON.parse(t),Promise.resolve()}catch(e){return Promise.reject(Error("Please enter valid JSON"))}}}],children:(0,t.jsx)(z.Input.TextArea,{rows:6,placeholder:'{"namespace": "admin", "mount": "secret", "path_prefix": "litellm"}',disabled:!eg})}),(0,t.jsx)(M.Form.Item,{label:"Metadata",name:"metadata",children:(0,t.jsx)(z.Input.TextArea,{rows:10})}),(0,t.jsx)("div",{className:"sticky z-10 bg-white p-4 pr-0 border-t border-gray-200 bottom-[-1.5rem] inset-x-[-1.5rem]",children:(0,t.jsxs)("div",{className:"flex justify-end items-center gap-2",children:[(0,t.jsx)(I.Button,{onClick:()=>e$(!1),disabled:tl,children:"Cancel"}),(0,t.jsx)(I.Button,{icon:(0,t.jsx)(b.SaveOutlined,{className:"h-4 w-4"}),type:"primary",htmlType:"submit",loading:tl,children:"Save Changes"})]})})]}):(0,t.jsxs)("div",{className:"space-y-4",children:[(0,t.jsxs)("div",{children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Team Name"}),(0,t.jsx)("div",{children:tT.team_alias})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Team ID"}),(0,t.jsx)("div",{className:"font-mono",children:tT.team_id})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Created At"}),(0,t.jsx)("div",{children:new Date(tT.created_at).toLocaleString()})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Models"}),(0,t.jsx)("div",{className:"flex flex-wrap gap-2 mt-1",children:tT.models.map((e,l)=>(0,t.jsx)(T.Badge,{color:"red",children:e},l))})]}),tT.default_team_member_models&&tT.default_team_member_models.length>0&&(0,t.jsxs)("div",{children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Default Member Models"}),(0,t.jsx)("div",{className:"flex flex-wrap gap-2 mt-1",children:tT.default_team_member_models.map((e,l)=>(0,t.jsx)(T.Badge,{color:"blue",children:e},l))})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Rate Limits"}),(0,t.jsxs)("div",{children:["TPM: ",tT.tpm_limit||"Unlimited"]}),(0,t.jsxs)("div",{children:["RPM: ",tT.rpm_limit||"Unlimited"]}),(ey=tT.metadata?.model_tpm_limit??{},ej=tT.metadata?.model_rpm_limit??{},0===(ef=Array.from(new Set([...Object.keys(ey),...Object.keys(ej)]))).length?null:(0,t.jsxs)("div",{className:"mt-2",children:[(0,t.jsx)(N.Text,{className:"text-gray-500",children:"Per-model limits:"}),ef.map(e=>(0,t.jsxs)("div",{className:"text-xs ml-2",children:[e,": TPM ",ey[e]??"—",", RPM ",ej[e]??"—"]},e))]}))]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Team Budget"}),(0,t.jsxs)("div",{children:["Max Budget:"," ",null!==tT.max_budget?`$${(0,m.formatNumberWithCommas)(tT.max_budget,4)}`:"No Limit"]}),(0,t.jsxs)("div",{children:["Soft Budget:"," ",null!==tT.soft_budget&&void 0!==tT.soft_budget?`$${(0,m.formatNumberWithCommas)(tT.soft_budget,4)}`:"No Limit"]}),(0,t.jsxs)("div",{children:["Budget Reset: ",tT.budget_duration||"Never"]}),tT.metadata?.soft_budget_alerting_emails&&Array.isArray(tT.metadata.soft_budget_alerting_emails)&&tT.metadata.soft_budget_alerting_emails.length>0&&(0,t.jsxs)("div",{children:["Soft Budget Alerting Emails: ",tT.metadata.soft_budget_alerting_emails.join(", ")]})]}),(0,t.jsxs)("div",{children:[(0,t.jsxs)(N.Text,{className:"font-medium",children:["Team Member Settings"," ",(0,t.jsx)(R.Tooltip,{title:"These are limits on individual team members",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),(0,t.jsxs)("div",{children:["Max Budget: ",tT.team_member_budget_table?.max_budget||"No Limit"]}),(0,t.jsxs)("div",{children:["Budget Duration: ",tT.team_member_budget_table?.budget_duration||"No Limit"]}),(0,t.jsxs)("div",{children:["Key Duration: ",tT.metadata?.team_member_key_duration||"No Limit"]}),(0,t.jsxs)("div",{children:["TPM Limit: ",tT.team_member_budget_table?.tpm_limit||"No Limit"]}),(0,t.jsxs)("div",{children:["RPM Limit: ",tT.team_member_budget_table?.rpm_limit||"No Limit"]})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Router Settings"}),tT.router_settings&&Object.values(tT.router_settings).some(e=>null!=e&&""!==e&&!(Array.isArray(e)&&0===e.length))?(0,t.jsxs)("div",{className:"mt-1 space-y-1",children:[tT.router_settings.routing_strategy&&(0,t.jsxs)("div",{children:["Routing Strategy:"," ",(0,t.jsx)(T.Badge,{color:"blue",children:tT.router_settings.routing_strategy})]}),null!=tT.router_settings.num_retries&&(0,t.jsxs)("div",{children:["Number of Retries: ",tT.router_settings.num_retries]}),null!=tT.router_settings.allowed_fails&&(0,t.jsxs)("div",{children:["Allowed Failures: ",tT.router_settings.allowed_fails]}),null!=tT.router_settings.cooldown_time&&(0,t.jsxs)("div",{children:["Cooldown Time: ",tT.router_settings.cooldown_time,"s"]}),null!=tT.router_settings.timeout&&(0,t.jsxs)("div",{children:["Timeout: ",tT.router_settings.timeout,"s"]}),null!=tT.router_settings.retry_after&&(0,t.jsxs)("div",{children:["Retry After: ",tT.router_settings.retry_after,"s"]}),tT.router_settings.fallbacks&&Array.isArray(tT.router_settings.fallbacks)&&tT.router_settings.fallbacks.length>0&&(0,t.jsxs)("div",{children:["Fallbacks: ",tT.router_settings.fallbacks.length," configured"]}),tT.router_settings.enable_tag_filtering&&(0,t.jsx)("div",{children:"Tag Filtering: Enabled"})]}):(0,t.jsx)("div",{className:"text-gray-400",children:"No router settings configured"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Organization ID"}),(0,t.jsx)("div",{children:tT.organization_id})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Status"}),(0,t.jsx)(T.Badge,{color:tT.blocked?"red":"green",children:tT.blocked?"Blocked":"Active"})]}),(0,t.jsx)(et.default,{objectPermission:tT.object_permission,variant:"inline",className:"pt-4 border-t border-gray-200",accessToken:o}),(0,t.jsx)(J,{globalGuardrailNames:eX,teamGuardrails:Array.isArray(tT.metadata?.guardrails)?tT.metadata.guardrails:[],optedOutGlobalGuardrails:Array.isArray(tT.metadata?.opted_out_global_guardrails)?tT.metadata.opted_out_global_guardrails:[],killSwitchOn:tS,variant:"inline",className:"pt-4 border-t border-gray-200"}),(0,t.jsx)(Q.default,{loggingConfigs:tT.metadata?.logging||[],disabledCallbacks:[],variant:"inline",className:"pt-4 border-t border-gray-200"}),tT.metadata?.secret_manager_settings&&(0,t.jsxs)("div",{className:"pt-4 border-t border-gray-200",children:[(0,t.jsx)(N.Text,{className:"font-medium",children:"Secret Manager Settings"}),(0,t.jsx)("pre",{className:"mt-2 bg-gray-50 p-3 rounded text-xs overflow-x-auto",children:JSON.stringify(tT.metadata.secret_manager_settings,null,2)})]})]})]})}].filter(e=>tx.includes(e.key))}),(0,t.jsx)(en.default,{visible:eL,onCancel:()=>eR(!1),onSubmit:tj,initialData:eV,mode:"edit",config:{title:"Edit Member",showEmail:!0,showUserId:!0,roleOptions:[{label:"Admin",value:"admin"},{label:"User",value:"user"}],additionalFields:[{name:"max_budget_in_team",label:(0,t.jsxs)("span",{children:["Team Member Budget (USD)"," ",(0,t.jsx)(R.Tooltip,{title:"Maximum amount in USD this member can spend within this team. This is separate from any global user budget limits",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),type:"numerical",step:.01,min:0,placeholder:"Budget limit for this member within this team"},{name:"tpm_limit",label:(0,t.jsxs)("span",{children:["Team Member TPM Limit"," ",(0,t.jsx)(R.Tooltip,{title:"Maximum tokens per minute this member can use within this team. This is separate from any global user TPM limit",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),type:"numerical",step:1,min:0,placeholder:"Tokens per minute limit for this member in this team"},{name:"rpm_limit",label:(0,t.jsxs)("span",{children:["Team Member RPM Limit"," ",(0,t.jsx)(R.Tooltip,{title:"Maximum requests per minute this member can make within this team. This is separate from any global user RPM limit",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),type:"numerical",step:1,min:0,placeholder:"Requests per minute limit for this member in this team"},{name:"allowed_models",label:(0,t.jsxs)("span",{children:["Allowed Models"," ",(0,t.jsx)(R.Tooltip,{title:"Models this member can access within this team. Leave empty to inherit all team models.",children:(0,t.jsx)(p.InfoCircleOutlined,{style:{marginLeft:"4px"}})})]}),type:"multi-select",options:(tT.models||[]).map(e=>({label:e,value:e})),placeholder:"Leave empty to inherit all team models"}]}}),(0,t.jsx)(i.default,{isVisible:eN,onCancel:()=>eC(!1),onSubmit:ty,accessToken:o,teamId:e}),(0,t.jsx)(G.default,{isOpen:e7,title:"Delete Team Member",alertMessage:"Removing team members will also delete any keys created by or created for this member.",message:"Are you sure you want to remove this member from the team? This action cannot be undone.",resourceInformationTitle:"Team Member Information",resourceInformation:[{label:"User ID",value:e6?.user_id,code:!0},{label:"Email",value:e6?.user_email},{label:"Role",value:e6?.role}],onCancel:()=>{e9(!1),e8(null)},onOk:tf,confirmLoading:te})]})}],56567)}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/048f065ef4eab631.js b/litellm/proxy/_experimental/out/_next/static/chunks/048f065ef4eab631.js new file mode 100644 index 00000000000..2a53043e934 --- /dev/null +++ b/litellm/proxy/_experimental/out/_next/static/chunks/048f065ef4eab631.js @@ -0,0 +1 @@ +(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,888288,e=>{"use strict";var t=e.i(271645);let r=(e,r)=>{let a=void 0!==r,[n,l]=(0,t.useState)(e);return[a?r:n,e=>{a||l(e)}]};e.s(["default",()=>r])},757440,e=>{"use strict";var t=e.i(290571),r=e.i(271645);let a=e=>{var a=(0,t.__rest)(e,[]);return r.default.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24",fill:"currentColor"},a),r.default.createElement("path",{d:"M11.9999 13.1714L16.9497 8.22168L18.3639 9.63589L11.9999 15.9999L5.63599 9.63589L7.0502 8.22168L11.9999 13.1714Z"}))};e.s(["default",()=>a])},446428,854056,e=>{"use strict";let t;var r=e.i(290571),a=e.i(271645);let n=e=>{var t=(0,r.__rest)(e,[]);return a.default.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24",fill:"currentColor"},t),a.default.createElement("path",{d:"M12 22C6.47715 22 2 17.5228 2 12C2 6.47715 6.47715 2 12 2C17.5228 2 22 6.47715 22 12C22 17.5228 17.5228 22 12 22ZM12 10.5858L9.17157 7.75736L7.75736 9.17157L10.5858 12L7.75736 14.8284L9.17157 16.2426L12 13.4142L14.8284 16.2426L16.2426 14.8284L13.4142 12L16.2426 9.17157L14.8284 7.75736L12 10.5858Z"}))};e.s(["default",()=>n],446428);var l=e.i(746725),s=e.i(914189),i=e.i(553521),o=e.i(835696),u=e.i(941444),d=e.i(178677),c=e.i(294316),m=e.i(83733),h=e.i(233137),f=e.i(732607),p=e.i(397701),g=e.i(700020);function v(e){var t;return!!(e.enter||e.enterFrom||e.enterTo||e.leave||e.leaveFrom||e.leaveTo)||(null!=(t=e.as)?t:k)!==a.Fragment||1===a.default.Children.count(e.children)}let b=(0,a.createContext)(null);b.displayName="TransitionContext";var x=((t=x||{}).Visible="visible",t.Hidden="hidden",t);let w=(0,a.createContext)(null);function y(e){return"children"in e?y(e.children):e.current.filter(({el:e})=>null!==e.current).filter(({state:e})=>"visible"===e).length>0}function C(e,t){let r=(0,u.useLatestValue)(e),n=(0,a.useRef)([]),o=(0,i.useIsMounted)(),d=(0,l.useDisposables)(),c=(0,s.useEvent)((e,t=g.RenderStrategy.Hidden)=>{let a=n.current.findIndex(({el:t})=>t===e);-1!==a&&((0,p.match)(t,{[g.RenderStrategy.Unmount](){n.current.splice(a,1)},[g.RenderStrategy.Hidden](){n.current[a].state="hidden"}}),d.microTask(()=>{var e;!y(n)&&o.current&&(null==(e=r.current)||e.call(r))}))}),m=(0,s.useEvent)(e=>{let t=n.current.find(({el:t})=>t===e);return t?"visible"!==t.state&&(t.state="visible"):n.current.push({el:e,state:"visible"}),()=>c(e,g.RenderStrategy.Unmount)}),h=(0,a.useRef)([]),f=(0,a.useRef)(Promise.resolve()),v=(0,a.useRef)({enter:[],leave:[]}),b=(0,s.useEvent)((e,r,a)=>{h.current.splice(0),t&&(t.chains.current[r]=t.chains.current[r].filter(([t])=>t!==e)),null==t||t.chains.current[r].push([e,new Promise(e=>{h.current.push(e)})]),null==t||t.chains.current[r].push([e,new Promise(e=>{Promise.all(v.current[r].map(([e,t])=>t)).then(()=>e())})]),"enter"===r?f.current=f.current.then(()=>null==t?void 0:t.wait.current).then(()=>a(r)):a(r)}),x=(0,s.useEvent)((e,t,r)=>{Promise.all(v.current[t].splice(0).map(([e,t])=>t)).then(()=>{var e;null==(e=h.current.shift())||e()}).then(()=>r(t))});return(0,a.useMemo)(()=>({children:n,register:m,unregister:c,onStart:b,onStop:x,wait:f,chains:v}),[m,c,n,b,x,v,f])}w.displayName="NestingContext";let k=a.Fragment,M=g.RenderFeatures.RenderStrategy,S=(0,g.forwardRefWithAs)(function(e,t){let{show:r,appear:n=!1,unmount:l=!0,...i}=e,u=(0,a.useRef)(null),m=v(e),f=(0,c.useSyncRefs)(...m?[u,t]:null===t?[]:[t]);(0,d.useServerHandoffComplete)();let p=(0,h.useOpenClosed)();if(void 0===r&&null!==p&&(r=(p&h.State.Open)===h.State.Open),void 0===r)throw Error("A is used but it is missing a `show={true | false}` prop.");let[x,k]=(0,a.useState)(r?"visible":"hidden"),S=C(()=>{r||k("hidden")}),[E,N]=(0,a.useState)(!0),T=(0,a.useRef)([r]);(0,o.useIsoMorphicEffect)(()=>{!1!==E&&T.current[T.current.length-1]!==r&&(T.current.push(r),N(!1))},[T,r]);let $=(0,a.useMemo)(()=>({show:r,appear:n,initial:E}),[r,n,E]);(0,o.useIsoMorphicEffect)(()=>{r?k("visible"):y(S)||null===u.current||k("hidden")},[r,S]);let O={unmount:l},_=(0,s.useEvent)(()=>{var t;E&&N(!1),null==(t=e.beforeEnter)||t.call(e)}),I=(0,s.useEvent)(()=>{var t;E&&N(!1),null==(t=e.beforeLeave)||t.call(e)}),L=(0,g.useRender)();return a.default.createElement(w.Provider,{value:S},a.default.createElement(b.Provider,{value:$},L({ourProps:{...O,as:a.Fragment,children:a.default.createElement(j,{ref:f,...O,...i,beforeEnter:_,beforeLeave:I})},theirProps:{},defaultTag:a.Fragment,features:M,visible:"visible"===x,name:"Transition"})))}),j=(0,g.forwardRefWithAs)(function(e,t){var r,n;let{transition:l=!0,beforeEnter:i,afterEnter:u,beforeLeave:x,afterLeave:S,enter:j,enterFrom:E,enterTo:N,entered:T,leave:$,leaveFrom:O,leaveTo:_,...I}=e,[L,A]=(0,a.useState)(null),D=(0,a.useRef)(null),R=v(e),F=(0,c.useSyncRefs)(...R?[D,t,A]:null===t?[]:[t]),P=null==(r=I.unmount)||r?g.RenderStrategy.Unmount:g.RenderStrategy.Hidden,{show:z,appear:H,initial:U}=function(){let e=(0,a.useContext)(b);if(null===e)throw Error("A is used but it is missing a parent or .");return e}(),[V,B]=(0,a.useState)(z?"visible":"hidden"),W=function(){let e=(0,a.useContext)(w);if(null===e)throw Error("A is used but it is missing a parent or .");return e}(),{register:Y,unregister:K}=W;(0,o.useIsoMorphicEffect)(()=>Y(D),[Y,D]),(0,o.useIsoMorphicEffect)(()=>{if(P===g.RenderStrategy.Hidden&&D.current)return z&&"visible"!==V?void B("visible"):(0,p.match)(V,{hidden:()=>K(D),visible:()=>Y(D)})},[V,D,Y,K,z,P]);let q=(0,d.useServerHandoffComplete)();(0,o.useIsoMorphicEffect)(()=>{if(R&&q&&"visible"===V&&null===D.current)throw Error("Did you forget to passthrough the `ref` to the actual DOM node?")},[D,V,q,R]);let Q=U&&!H,Z=H&&z&&U,X=(0,a.useRef)(!1),J=C(()=>{X.current||(B("hidden"),K(D))},W),G=(0,s.useEvent)(e=>{X.current=!0,J.onStart(D,e?"enter":"leave",e=>{"enter"===e?null==i||i():"leave"===e&&(null==x||x())})}),ee=(0,s.useEvent)(e=>{let t=e?"enter":"leave";X.current=!1,J.onStop(D,t,e=>{"enter"===e?null==u||u():"leave"===e&&(null==S||S())}),"leave"!==t||y(J)||(B("hidden"),K(D))});(0,a.useEffect)(()=>{R&&l||(G(z),ee(z))},[z,R,l]);let et=!(!l||!R||!q||Q),[,er]=(0,m.useTransition)(et,L,z,{start:G,end:ee}),ea=(0,g.compact)({ref:F,className:(null==(n=(0,f.classNames)(I.className,Z&&j,Z&&E,er.enter&&j,er.enter&&er.closed&&E,er.enter&&!er.closed&&N,er.leave&&$,er.leave&&!er.closed&&O,er.leave&&er.closed&&_,!er.transition&&z&&T))?void 0:n.trim())||void 0,...(0,m.transitionDataAttributes)(er)}),en=0;"visible"===V&&(en|=h.State.Open),"hidden"===V&&(en|=h.State.Closed),er.enter&&(en|=h.State.Opening),er.leave&&(en|=h.State.Closing);let el=(0,g.useRender)();return a.default.createElement(w.Provider,{value:J},a.default.createElement(h.OpenClosedProvider,{value:en},el({ourProps:ea,theirProps:I,defaultTag:k,features:M,visible:"visible"===V,name:"Transition.Child"})))}),E=(0,g.forwardRefWithAs)(function(e,t){let r=null!==(0,a.useContext)(b),n=null!==(0,h.useOpenClosed)();return a.default.createElement(a.default.Fragment,null,!r&&n?a.default.createElement(S,{ref:t,...e}):a.default.createElement(j,{ref:t,...e}))}),N=Object.assign(S,{Child:E,Root:S});e.s(["Transition",()=>N],854056)},206929,e=>{"use strict";var t=e.i(290571),r=e.i(757440),a=e.i(271645),n=e.i(446428),l=e.i(444755),s=e.i(673706),i=e.i(103471),o=e.i(495470),u=e.i(854056),d=e.i(888288);let c=(0,s.makeClassName)("Select"),m=a.default.forwardRef((e,s)=>{let{defaultValue:m="",value:h,onValueChange:f,placeholder:p="Select...",disabled:g=!1,icon:v,enableClear:b=!1,required:x,children:w,name:y,error:C=!1,errorMessage:k,className:M,id:S}=e,j=(0,t.__rest)(e,["defaultValue","value","onValueChange","placeholder","disabled","icon","enableClear","required","children","name","error","errorMessage","className","id"]),E=(0,a.useRef)(null),N=a.Children.toArray(w),[T,$]=(0,d.default)(m,h),O=(0,a.useMemo)(()=>{let e=a.default.Children.toArray(w).filter(a.isValidElement);return(0,i.constructValueToNameMapping)(e)},[w]);return a.default.createElement("div",{className:(0,l.tremorTwMerge)("w-full min-w-[10rem] text-tremor-default",M)},a.default.createElement("div",{className:"relative"},a.default.createElement("select",{title:"select-hidden",required:x,className:(0,l.tremorTwMerge)("h-full w-full absolute left-0 top-0 -z-10 opacity-0"),value:T,onChange:e=>{e.preventDefault()},name:y,disabled:g,id:S,onFocus:()=>{let e=E.current;e&&e.focus()}},a.default.createElement("option",{className:"hidden",value:"",disabled:!0,hidden:!0},p),N.map(e=>{let t=e.props.value,r=e.props.children;return a.default.createElement("option",{className:"hidden",key:t,value:t},r)})),a.default.createElement(o.Listbox,Object.assign({as:"div",ref:s,defaultValue:T,value:T,onChange:e=>{null==f||f(e),$(e)},disabled:g,id:S},j),({value:e})=>{var t;return a.default.createElement(a.default.Fragment,null,a.default.createElement(o.ListboxButton,{ref:E,className:(0,l.tremorTwMerge)("w-full outline-none text-left whitespace-nowrap truncate rounded-tremor-default focus:ring-2 transition duration-100 border pr-8 py-2","border-tremor-border shadow-tremor-input focus:border-tremor-brand-subtle focus:ring-tremor-brand-muted","dark:border-dark-tremor-border dark:shadow-dark-tremor-input dark:focus:border-dark-tremor-brand-subtle dark:focus:ring-dark-tremor-brand-muted",v?"pl-10":"pl-3",(0,i.getSelectButtonColors)((0,i.hasValue)(e),g,C))},v&&a.default.createElement("span",{className:(0,l.tremorTwMerge)("absolute inset-y-0 left-0 flex items-center ml-px pl-2.5")},a.default.createElement(v,{className:(0,l.tremorTwMerge)(c("Icon"),"flex-none h-5 w-5","text-tremor-content-subtle","dark:text-dark-tremor-content-subtle")})),a.default.createElement("span",{className:"w-[90%] block truncate"},e&&null!=(t=O.get(e))?t:p),a.default.createElement("span",{className:(0,l.tremorTwMerge)("absolute inset-y-0 right-0 flex items-center mr-3")},a.default.createElement(r.default,{className:(0,l.tremorTwMerge)(c("arrowDownIcon"),"flex-none h-5 w-5","text-tremor-content-subtle","dark:text-dark-tremor-content-subtle")}))),b&&T?a.default.createElement("button",{type:"button",className:(0,l.tremorTwMerge)("absolute inset-y-0 right-0 flex items-center mr-8"),onClick:e=>{e.preventDefault(),$(""),null==f||f("")}},a.default.createElement(n.default,{className:(0,l.tremorTwMerge)(c("clearIcon"),"flex-none h-4 w-4","text-tremor-content-subtle","dark:text-dark-tremor-content-subtle")})):null,a.default.createElement(u.Transition,{enter:"transition ease duration-100 transform",enterFrom:"opacity-0 -translate-y-4",enterTo:"opacity-100 translate-y-0",leave:"transition ease duration-100 transform",leaveFrom:"opacity-100 translate-y-0",leaveTo:"opacity-0 -translate-y-4"},a.default.createElement(o.ListboxOptions,{anchor:"bottom start",className:(0,l.tremorTwMerge)("z-10 w-[var(--button-width)] divide-y overflow-y-auto outline-none rounded-tremor-default max-h-[228px] border [--anchor-gap:4px]","bg-tremor-background border-tremor-border divide-tremor-border shadow-tremor-dropdown","dark:bg-dark-tremor-background dark:border-dark-tremor-border dark:divide-dark-tremor-border dark:shadow-dark-tremor-dropdown")},w)))})),C&&k?a.default.createElement("p",{className:(0,l.tremorTwMerge)("errorMessage","text-sm text-rose-500 mt-1")},k):null)});m.displayName="Select",e.s(["Select",()=>m],206929)},160818,e=>{"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M854.4 800.9c.2-.3.5-.6.7-.9C920.6 722.1 960 621.7 960 512s-39.4-210.1-104.8-288c-.2-.3-.5-.5-.7-.8-1.1-1.3-2.1-2.5-3.2-3.7-.4-.5-.8-.9-1.2-1.4l-4.1-4.7-.1-.1c-1.5-1.7-3.1-3.4-4.6-5.1l-.1-.1c-3.2-3.4-6.4-6.8-9.7-10.1l-.1-.1-4.8-4.8-.3-.3c-1.5-1.5-3-2.9-4.5-4.3-.5-.5-1-1-1.6-1.5-1-1-2-1.9-3-2.8-.3-.3-.7-.6-1-1C736.4 109.2 629.5 64 512 64s-224.4 45.2-304.3 119.2c-.3.3-.7.6-1 1-1 .9-2 1.9-3 2.9-.5.5-1 1-1.6 1.5-1.5 1.4-3 2.9-4.5 4.3l-.3.3-4.8 4.8-.1.1c-3.3 3.3-6.5 6.7-9.7 10.1l-.1.1c-1.6 1.7-3.1 3.4-4.6 5.1l-.1.1c-1.4 1.5-2.8 3.1-4.1 4.7-.4.5-.8.9-1.2 1.4-1.1 1.2-2.1 2.5-3.2 3.7-.2.3-.5.5-.7.8C103.4 301.9 64 402.3 64 512s39.4 210.1 104.8 288c.2.3.5.6.7.9l3.1 3.7c.4.5.8.9 1.2 1.4l4.1 4.7c0 .1.1.1.1.2 1.5 1.7 3 3.4 4.6 5l.1.1c3.2 3.4 6.4 6.8 9.6 10.1l.1.1c1.6 1.6 3.1 3.2 4.7 4.7l.3.3c3.3 3.3 6.7 6.5 10.1 9.6 80.1 74 187 119.2 304.5 119.2s224.4-45.2 304.3-119.2a300 300 0 0010-9.6l.3-.3c1.6-1.6 3.2-3.1 4.7-4.7l.1-.1c3.3-3.3 6.5-6.7 9.6-10.1l.1-.1c1.5-1.7 3.1-3.3 4.6-5 0-.1.1-.1.1-.2 1.4-1.5 2.8-3.1 4.1-4.7.4-.5.8-.9 1.2-1.4a99 99 0 003.3-3.7zm4.1-142.6c-13.8 32.6-32 62.8-54.2 90.2a444.07 444.07 0 00-81.5-55.9c11.6-46.9 18.8-98.4 20.7-152.6H887c-3 40.9-12.6 80.6-28.5 118.3zM887 484H743.5c-1.9-54.2-9.1-105.7-20.7-152.6 29.3-15.6 56.6-34.4 81.5-55.9A373.86 373.86 0 01887 484zM658.3 165.5c39.7 16.8 75.8 40 107.6 69.2a394.72 394.72 0 01-59.4 41.8c-15.7-45-35.8-84.1-59.2-115.4 3.7 1.4 7.4 2.9 11 4.4zm-90.6 700.6c-9.2 7.2-18.4 12.7-27.7 16.4V697a389.1 389.1 0 01115.7 26.2c-8.3 24.6-17.9 47.3-29 67.8-17.4 32.4-37.8 58.3-59 75.1zm59-633.1c11 20.6 20.7 43.3 29 67.8A389.1 389.1 0 01540 327V141.6c9.2 3.7 18.5 9.1 27.7 16.4 21.2 16.7 41.6 42.6 59 75zM540 640.9V540h147.5c-1.6 44.2-7.1 87.1-16.3 127.8l-.3 1.2A445.02 445.02 0 00540 640.9zm0-156.9V383.1c45.8-2.8 89.8-12.5 130.9-28.1l.3 1.2c9.2 40.7 14.7 83.5 16.3 127.8H540zm-56 56v100.9c-45.8 2.8-89.8 12.5-130.9 28.1l-.3-1.2c-9.2-40.7-14.7-83.5-16.3-127.8H484zm-147.5-56c1.6-44.2 7.1-87.1 16.3-127.8l.3-1.2c41.1 15.6 85 25.3 130.9 28.1V484H336.5zM484 697v185.4c-9.2-3.7-18.5-9.1-27.7-16.4-21.2-16.7-41.7-42.7-59.1-75.1-11-20.6-20.7-43.3-29-67.8 37.2-14.6 75.9-23.3 115.8-26.1zm0-370a389.1 389.1 0 01-115.7-26.2c8.3-24.6 17.9-47.3 29-67.8 17.4-32.4 37.8-58.4 59.1-75.1 9.2-7.2 18.4-12.7 27.7-16.4V327zM365.7 165.5c3.7-1.5 7.3-3 11-4.4-23.4 31.3-43.5 70.4-59.2 115.4-21-12-40.9-26-59.4-41.8 31.8-29.2 67.9-52.4 107.6-69.2zM165.5 365.7c13.8-32.6 32-62.8 54.2-90.2 24.9 21.5 52.2 40.3 81.5 55.9-11.6 46.9-18.8 98.4-20.7 152.6H137c3-40.9 12.6-80.6 28.5-118.3zM137 540h143.5c1.9 54.2 9.1 105.7 20.7 152.6a444.07 444.07 0 00-81.5 55.9A373.86 373.86 0 01137 540zm228.7 318.5c-39.7-16.8-75.8-40-107.6-69.2 18.5-15.8 38.4-29.7 59.4-41.8 15.7 45 35.8 84.1 59.2 115.4-3.7-1.4-7.4-2.9-11-4.4zm292.6 0c-3.7 1.5-7.3 3-11 4.4 23.4-31.3 43.5-70.4 59.2-115.4 21 12 40.9 26 59.4 41.8a373.81 373.81 0 01-107.6 69.2z"}}]},name:"global",theme:"outlined"};var n=e.i(9583),l=r.forwardRef(function(e,l){return r.createElement(n.default,(0,t.default)({},e,{ref:l,icon:a}))});e.s(["GlobalOutlined",0,l],160818)},822315,(e,t,r)=>{e.e,t.exports=function(){"use strict";var e="millisecond",t="second",r="minute",a="hour",n="week",l="month",s="quarter",i="year",o="date",u="Invalid Date",d=/^(\d{4})[-/]?(\d{1,2})?[-/]?(\d{0,2})[Tt\s]*(\d{1,2})?:?(\d{1,2})?:?(\d{1,2})?[.:]?(\d+)?$/,c=/\[([^\]]+)]|Y{1,4}|M{1,4}|D{1,2}|d{1,4}|H{1,2}|h{1,2}|a|A|m{1,2}|s{1,2}|Z{1,2}|SSS/g,m=function(e,t,r){var a=String(e);return!a||a.length>=t?e:""+Array(t+1-a.length).join(r)+e},h="en",f={};f[h]={name:"en",weekdays:"Sunday_Monday_Tuesday_Wednesday_Thursday_Friday_Saturday".split("_"),months:"January_February_March_April_May_June_July_August_September_October_November_December".split("_"),ordinal:function(e){var t=["th","st","nd","rd"],r=e%100;return"["+e+(t[(r-20)%10]||t[r]||t[0])+"]"}};var p="$isDayjsObject",g=function(e){return e instanceof w||!(!e||!e[p])},v=function e(t,r,a){var n;if(!t)return h;if("string"==typeof t){var l=t.toLowerCase();f[l]&&(n=l),r&&(f[l]=r,n=l);var s=t.split("-");if(!n&&s.length>1)return e(s[0])}else{var i=t.name;f[i]=t,n=i}return!a&&n&&(h=n),n||!a&&h},b=function(e,t){if(g(e))return e.clone();var r="object"==typeof t?t:{};return r.date=e,r.args=arguments,new w(r)},x={s:m,z:function(e){var t=-e.utcOffset(),r=Math.abs(t);return(t<=0?"+":"-")+m(Math.floor(r/60),2,"0")+":"+m(r%60,2,"0")},m:function e(t,r){if(t.date(){"use strict";e.i(247167);var t=e.i(931067),r=e.i(271645);let a={icon:{tag:"svg",attrs:{viewBox:"64 64 896 896",focusable:"false"},children:[{tag:"path",attrs:{d:"M909.1 209.3l-56.4 44.1C775.8 155.1 656.2 92 521.9 92 290 92 102.3 279.5 102 511.5 101.7 743.7 289.8 932 521.9 932c181.3 0 335.8-115 394.6-276.1 1.5-4.2-.7-8.9-4.9-10.3l-56.7-19.5a8 8 0 00-10.1 4.8c-1.8 5-3.8 10-5.9 14.9-17.3 41-42.1 77.8-73.7 109.4A344.77 344.77 0 01655.9 829c-42.3 17.9-87.4 27-133.8 27-46.5 0-91.5-9.1-133.8-27A341.5 341.5 0 01279 755.2a342.16 342.16 0 01-73.7-109.4c-17.9-42.4-27-87.4-27-133.9s9.1-91.5 27-133.9c17.3-41 42.1-77.8 73.7-109.4 31.6-31.6 68.4-56.4 109.3-73.8 42.3-17.9 87.4-27 133.8-27 46.5 0 91.5 9.1 133.8 27a341.5 341.5 0 01109.3 73.8c9.9 9.9 19.2 20.4 27.8 31.4l-60.2 47a8 8 0 003 14.1l175.6 43c5 1.2 9.9-2.6 9.9-7.7l.8-180.9c-.1-6.6-7.8-10.3-13-6.2z"}}]},name:"reload",theme:"outlined"};var n=e.i(9583),l=r.forwardRef(function(e,l){return r.createElement(n.default,(0,t.default)({},e,{ref:l,icon:a}))});e.s(["ReloadOutlined",0,l],91979)},625901,e=>{"use strict";var t=e.i(266027),r=e.i(621482),a=e.i(243652),n=e.i(764205),l=e.i(135214);let s=(0,a.createQueryKeys)("models"),i=(0,a.createQueryKeys)("modelHub"),o=(0,a.createQueryKeys)("allProxyModels");(0,a.createQueryKeys)("selectedTeamModels");let u=(0,a.createQueryKeys)("infiniteModels");e.s(["useAllProxyModels",0,()=>{let{accessToken:e,userId:r,userRole:a}=(0,l.default)();return(0,t.useQuery)({queryKey:o.list({}),queryFn:async()=>await (0,n.modelAvailableCall)(e,r,a,!0,null,!0,!1,"expand"),enabled:!!(e&&r&&a)})},"useInfiniteModelInfo",0,(e=50,t)=>{let{accessToken:a,userId:s,userRole:i}=(0,l.default)();return(0,r.useInfiniteQuery)({queryKey:u.list({filters:{...s&&{userId:s},...i&&{userRole:i},size:e,...t&&{search:t}}}),queryFn:async({pageParam:r})=>await (0,n.modelInfoCall)(a,s,i,r,e,t),initialPageParam:1,getNextPageParam:e=>{if(e.current_page{let{accessToken:e}=(0,l.default)();return(0,t.useQuery)({queryKey:i.list({}),queryFn:async()=>await (0,n.modelHubCall)(e),enabled:!!e})},"useModelsInfo",0,(e=1,r=50,a,i,o,u,d)=>{let{accessToken:c,userId:m,userRole:h}=(0,l.default)();return(0,t.useQuery)({queryKey:s.list({filters:{...m&&{userId:m},...h&&{userRole:h},page:e,size:r,...a&&{search:a},...i&&{modelId:i},...o&&{teamId:o},...u&&{sortBy:u},...d&&{sortOrder:d}}}),queryFn:async()=>await (0,n.modelInfoCall)(c,m,h,e,r,a,i,o,u,d),enabled:!!(c&&m&&h)})}])},969550,e=>{"use strict";var t=e.i(843476),r=e.i(271645);let a=r.forwardRef(function(e,t){return r.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:t},e),r.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M3 4a1 1 0 011-1h16a1 1 0 011 1v2.586a1 1 0 01-.293.707l-6.414 6.414a1 1 0 00-.293.707V17l-4 4v-6.586a1 1 0 00-.293-.707L3.293 7.293A1 1 0 013 6.586V4z"}))});var n=e.i(464571),l=e.i(311451),s=e.i(199133),i=e.i(374009);e.s(["default",0,({options:e,onApplyFilters:o,onResetFilters:u,initialValues:d={},buttonLabel:c="Filters"})=>{let[m,h]=(0,r.useState)(!1),[f,p]=(0,r.useState)(d),[g,v]=(0,r.useState)({}),[b,x]=(0,r.useState)({}),[w,y]=(0,r.useState)({}),[C,k]=(0,r.useState)({}),M=(0,r.useCallback)((0,i.default)(async(e,t)=>{if(t.isSearchable&&t.searchFn){x(e=>({...e,[t.name]:!0}));try{let r=await t.searchFn(e);v(e=>({...e,[t.name]:r}))}catch(e){console.error("Error searching:",e),v(e=>({...e,[t.name]:[]}))}finally{x(e=>({...e,[t.name]:!1}))}}},300),[]),S=(0,r.useCallback)(async e=>{if(e.isSearchable&&e.searchFn&&!C[e.name]){x(t=>({...t,[e.name]:!0})),k(t=>({...t,[e.name]:!0}));try{let t=await e.searchFn("");v(r=>({...r,[e.name]:t}))}catch(t){console.error("Error loading initial options:",t),v(t=>({...t,[e.name]:[]}))}finally{x(t=>({...t,[e.name]:!1}))}}},[C]);(0,r.useEffect)(()=>{m&&e.forEach(e=>{e.isSearchable&&!C[e.name]&&S(e)})},[m,e,S,C]);let j=(e,t)=>{let r={...f,[e]:t};p(r),o(r)};return(0,t.jsxs)("div",{className:"w-full",children:[(0,t.jsxs)("div",{className:"flex items-center gap-2 mb-6",children:[(0,t.jsx)(n.Button,{icon:(0,t.jsx)(a,{className:"h-4 w-4"}),onClick:()=>h(!m),className:"flex items-center gap-2",children:c}),(0,t.jsx)(n.Button,{onClick:()=>{let t={};e.forEach(e=>{t[e.name]=""}),p(t),u()},children:"Reset Filters"})]}),m&&(0,t.jsx)("div",{className:"grid grid-cols-3 gap-x-6 gap-y-4 mb-6",children:["Team ID","Status","Organization ID","Key Alias","User ID","End User","Error Code","Error Message","Key Hash","Model","Public model / search tool"].map(r=>{let a,n=e.find(e=>e.label===r||e.name===r);return n?(0,t.jsxs)("div",{className:"flex flex-col gap-2",children:[(0,t.jsx)("label",{className:"text-sm text-gray-600",children:n.label||n.name}),n.isSearchable?(0,t.jsx)(s.Select,{showSearch:!0,className:"w-full",placeholder:`Search ${n.label||n.name}...`,value:f[n.name]||void 0,onChange:e=>j(n.name,e),onOpenChange:e=>{e&&n.isSearchable&&!C[n.name]&&S(n)},onSearch:e=>{y(t=>({...t,[n.name]:e})),n.searchFn&&M(e,n)},filterOption:!1,loading:b[n.name],options:g[n.name]||[],allowClear:!0,notFoundContent:b[n.name]?"Loading...":"No results found"}):n.options?(0,t.jsx)(s.Select,{className:"w-full",placeholder:`Select ${n.label||n.name}...`,value:f[n.name]||void 0,onChange:e=>j(n.name,e),allowClear:!0,children:n.options.map(e=>(0,t.jsx)(s.Select.Option,{value:e.value,children:e.label},e.value))}):n.customComponent?(a=n.customComponent,(0,t.jsx)(a,{value:f[n.name]||void 0,onChange:e=>j(n.name,e??""),placeholder:`Select ${n.label||n.name}...`,allFilters:f})):(0,t.jsx)(l.Input,{className:"w-full",placeholder:`Enter ${n.label||n.name}...`,value:f[n.name]||"",onChange:e=>j(n.name,e.target.value),allowClear:!0})]},n.name):null})})]})}],969550)},633627,e=>{"use strict";var t=e.i(764205);let r=(e,t,r,a)=>{for(let n of e){let e=n?.key_alias;e&&"string"==typeof e&&t.add(e.trim());let l=n?.organization_id??n?.org_id;l&&"string"==typeof l&&r.add(l.trim());let s=n?.user_id;if(s&&"string"==typeof s){let e=n?.user?.user_email||s;a.set(s,e)}}},a=async(e,a)=>{if(!e||!a)return{keyAliases:[],organizationIds:[],userIds:[]};try{let n=new Set,l=new Set,s=new Map,i=await (0,t.keyListCall)(e,null,a,null,null,null,1,100,null,null,"user",null),o=i?.keys||[],u=i?.total_pages??1;r(o,n,l,s);let d=Math.min(u,10)-1;if(d>0){let i=Array.from({length:d},(r,n)=>(0,t.keyListCall)(e,null,a,null,null,null,n+2,100,null,null,"user",null));for(let e of(await Promise.allSettled(i)))"fulfilled"===e.status&&r(e.value?.keys||[],n,l,s)}return{keyAliases:Array.from(n).sort(),organizationIds:Array.from(l).sort(),userIds:Array.from(s.entries()).map(([e,t])=>({id:e,email:t}))}}catch(e){return console.error("Error fetching team filter options:",e),{keyAliases:[],organizationIds:[],userIds:[]}}},n=async(e,r)=>{if(!e)return[];try{let a=[],n=1,l=!0;for(;l;){let s=await (0,t.teamListCall)(e,r||null,null);a=[...a,...s],n{if(!e)return[];try{let r=[],a=1,n=!0;for(;n;){let l=await (0,t.organizationListCall)(e);r=[...r,...l],a{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M8 5H6a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2v-1M8 5a2 2 0 002 2h2a2 2 0 002-2M8 5a2 2 0 012-2h2a2 2 0 012 2m0 0h2a2 2 0 012 2v3m2 4H10m0 0l3-3m-3 3l3 3"}))});e.s(["ClipboardCopyIcon",0,r],551332)},434626,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"}))});e.s(["ExternalLinkIcon",0,r],434626)},902555,e=>{"use strict";var t=e.i(843476),r=e.i(591935),a=e.i(122577),n=e.i(278587),l=e.i(68155),s=e.i(360820),i=e.i(871943),o=e.i(434626),u=e.i(551332),d=e.i(592968),c=e.i(115504),m=e.i(752978);function h({icon:e,onClick:r,className:a,disabled:n,dataTestId:l}){return n?(0,t.jsx)(m.Icon,{icon:e,size:"sm",className:"opacity-50 cursor-not-allowed","data-testid":l}):(0,t.jsx)(m.Icon,{icon:e,size:"sm",onClick:r,className:(0,c.cx)("cursor-pointer",a),"data-testid":l})}let f={Edit:{icon:r.PencilAltIcon,className:"hover:text-blue-600"},Delete:{icon:l.TrashIcon,className:"hover:text-red-600"},Test:{icon:a.PlayIcon,className:"hover:text-blue-600"},Regenerate:{icon:n.RefreshIcon,className:"hover:text-green-600"},Up:{icon:s.ChevronUpIcon,className:"hover:text-blue-600"},Down:{icon:i.ChevronDownIcon,className:"hover:text-blue-600"},Open:{icon:o.ExternalLinkIcon,className:"hover:text-green-600"},Copy:{icon:u.ClipboardCopyIcon,className:"hover:text-blue-600"}};function p({onClick:e,tooltipText:r,disabled:a=!1,disabledTooltipText:n,dataTestId:l,variant:s}){let{icon:i,className:o}=f[s];return(0,t.jsx)(d.Tooltip,{title:a?n:r,children:(0,t.jsx)("span",{children:(0,t.jsx)(h,{icon:i,onClick:e,className:o,disabled:a,dataTestId:l})})})}e.s(["default",()=>p],902555)},122577,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M14.752 11.168l-3.197-2.132A1 1 0 0010 9.87v4.263a1 1 0 001.555.832l3.197-2.132a1 1 0 000-1.664z"}),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M21 12a9 9 0 11-18 0 9 9 0 0118 0z"}))});e.s(["PlayIcon",0,r],122577)},68155,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"}))});e.s(["TrashIcon",0,r],68155)},871943,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M19 9l-7 7-7-7"}))});e.s(["ChevronDownIcon",0,r],871943)},360820,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M5 15l7-7 7 7"}))});e.s(["ChevronUpIcon",0,r],360820)},278587,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"}))});e.s(["RefreshIcon",0,r],278587)},207670,e=>{"use strict";function t(){for(var e,t,r=0,a="",n=arguments.length;rt,"default",0,t])},728889,e=>{"use strict";var t=e.i(290571),r=e.i(271645),a=e.i(829087),n=e.i(480731),l=e.i(444755),s=e.i(673706),i=e.i(95779);let o={xs:{paddingX:"px-1.5",paddingY:"py-1.5"},sm:{paddingX:"px-1.5",paddingY:"py-1.5"},md:{paddingX:"px-2",paddingY:"py-2"},lg:{paddingX:"px-2",paddingY:"py-2"},xl:{paddingX:"px-2.5",paddingY:"py-2.5"}},u={xs:{height:"h-3",width:"w-3"},sm:{height:"h-5",width:"w-5"},md:{height:"h-5",width:"w-5"},lg:{height:"h-7",width:"w-7"},xl:{height:"h-9",width:"w-9"}},d={simple:{rounded:"",border:"",ring:"",shadow:""},light:{rounded:"rounded-tremor-default",border:"",ring:"",shadow:""},shadow:{rounded:"rounded-tremor-default",border:"border",ring:"",shadow:"shadow-tremor-card dark:shadow-dark-tremor-card"},solid:{rounded:"rounded-tremor-default",border:"border-2",ring:"ring-1",shadow:""},outlined:{rounded:"rounded-tremor-default",border:"border",ring:"ring-2",shadow:""}},c=(0,s.makeClassName)("Icon"),m=r.default.forwardRef((e,m)=>{let{icon:h,variant:f="simple",tooltip:p,size:g=n.Sizes.SM,color:v,className:b}=e,x=(0,t.__rest)(e,["icon","variant","tooltip","size","color","className"]),w=((e,t)=>{switch(e){case"simple":return{textColor:t?(0,s.getColorClassNames)(t,i.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:"",borderColor:"",ringColor:""};case"light":return{textColor:t?(0,s.getColorClassNames)(t,i.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,l.tremorTwMerge)((0,s.getColorClassNames)(t,i.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand-muted dark:bg-dark-tremor-brand-muted",borderColor:"",ringColor:""};case"shadow":return{textColor:t?(0,s.getColorClassNames)(t,i.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,l.tremorTwMerge)((0,s.getColorClassNames)(t,i.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:"border-tremor-border dark:border-dark-tremor-border",ringColor:""};case"solid":return{textColor:t?(0,s.getColorClassNames)(t,i.colorPalette.text).textColor:"text-tremor-brand-inverted dark:text-dark-tremor-brand-inverted",bgColor:t?(0,l.tremorTwMerge)((0,s.getColorClassNames)(t,i.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-brand dark:bg-dark-tremor-brand",borderColor:"border-tremor-brand-inverted dark:border-dark-tremor-brand-inverted",ringColor:"ring-tremor-ring dark:ring-dark-tremor-ring"};case"outlined":return{textColor:t?(0,s.getColorClassNames)(t,i.colorPalette.text).textColor:"text-tremor-brand dark:text-dark-tremor-brand",bgColor:t?(0,l.tremorTwMerge)((0,s.getColorClassNames)(t,i.colorPalette.background).bgColor,"bg-opacity-20"):"bg-tremor-background dark:bg-dark-tremor-background",borderColor:t?(0,s.getColorClassNames)(t,i.colorPalette.ring).borderColor:"border-tremor-brand-subtle dark:border-dark-tremor-brand-subtle",ringColor:t?(0,l.tremorTwMerge)((0,s.getColorClassNames)(t,i.colorPalette.ring).ringColor,"ring-opacity-40"):"ring-tremor-brand-muted dark:ring-dark-tremor-brand-muted"}}})(f,v),{tooltipProps:y,getReferenceProps:C}=(0,a.useTooltip)();return r.default.createElement("span",Object.assign({ref:(0,s.mergeRefs)([m,y.refs.setReference]),className:(0,l.tremorTwMerge)(c("root"),"inline-flex shrink-0 items-center justify-center",w.bgColor,w.textColor,w.borderColor,w.ringColor,d[f].rounded,d[f].border,d[f].shadow,d[f].ring,o[g].paddingX,o[g].paddingY,b)},C,x),r.default.createElement(a.default,Object.assign({text:p},y)),r.default.createElement(h,{className:(0,l.tremorTwMerge)(c("icon"),"shrink-0",u[g].height,u[g].width)}))});m.displayName="Icon",e.s(["default",()=>m],728889)},752978,e=>{"use strict";var t=e.i(728889);e.s(["Icon",()=>t.default])},591935,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"}))});e.s(["PencilAltIcon",0,r],591935)},907308,e=>{"use strict";var t=e.i(843476),r=e.i(271645),a=e.i(212931),n=e.i(808613),l=e.i(464571),s=e.i(199133),i=e.i(592968),o=e.i(213205),u=e.i(374009),d=e.i(764205);e.s(["default",0,({isVisible:e,onCancel:c,onSubmit:m,accessToken:h,title:f="Add Team Member",roles:p=[{label:"admin",value:"admin",description:"Admin role. Can create team keys, add members, and manage settings."},{label:"user",value:"user",description:"User role. Can view team info, but not manage it."}],defaultRole:g="user",teamId:v})=>{let[b]=n.Form.useForm(),[x,w]=(0,r.useState)([]),[y,C]=(0,r.useState)(!1),[k,M]=(0,r.useState)("user_email"),[S,j]=(0,r.useState)(!1),E=async(e,t)=>{if(!e)return void w([]);C(!0);try{let r=new URLSearchParams;if(r.append(t,e),v&&r.append("team_id",v),null==h)return;let a=(await (0,d.userFilterUICall)(h,r)).map(e=>({label:"user_email"===t?`${e.user_email}`:`${e.user_id}`,value:"user_email"===t?e.user_email:e.user_id,user:e}));w(a)}catch(e){console.error("Error fetching users:",e)}finally{C(!1)}},N=(0,r.useCallback)((0,u.default)((e,t)=>E(e,t),300),[]),T=(e,t)=>{M(t),N(e,t)},$=(e,t)=>{let r=t.user;b.setFieldsValue({user_email:r.user_email,user_id:r.user_id,role:b.getFieldValue("role")})},O=async e=>{j(!0);try{await m(e)}finally{j(!1)}};return(0,t.jsx)(a.Modal,{title:f,open:e,onCancel:()=>{b.resetFields(),w([]),c()},footer:null,width:800,maskClosable:!S,children:(0,t.jsxs)(n.Form,{form:b,onFinish:O,labelCol:{span:8},wrapperCol:{span:16},labelAlign:"left",initialValues:{role:g},children:[(0,t.jsx)(n.Form.Item,{label:"Email",name:"user_email",className:"mb-4",children:(0,t.jsx)(s.Select,{showSearch:!0,className:"w-full",placeholder:"Search by email",filterOption:!1,onSearch:e=>T(e,"user_email"),onSelect:(e,t)=>$(e,t),options:"user_email"===k?x:[],loading:y,allowClear:!0,"data-testid":"member-email-search"})}),(0,t.jsx)("div",{className:"text-center mb-4",children:"OR"}),(0,t.jsx)(n.Form.Item,{label:"User ID",name:"user_id",className:"mb-4",children:(0,t.jsx)(s.Select,{showSearch:!0,className:"w-full",placeholder:"Search by user ID",filterOption:!1,onSearch:e=>T(e,"user_id"),onSelect:(e,t)=>$(e,t),options:"user_id"===k?x:[],loading:y,allowClear:!0})}),(0,t.jsx)(n.Form.Item,{label:"Member Role",name:"role",className:"mb-4",children:(0,t.jsx)(s.Select,{defaultValue:g,children:p.map(e=>(0,t.jsx)(s.Select.Option,{value:e.value,children:(0,t.jsxs)(i.Tooltip,{title:e.description,children:[(0,t.jsx)("span",{className:"font-medium",children:e.label}),(0,t.jsxs)("span",{className:"ml-2 text-gray-500 text-sm",children:["- ",e.description]})]})},e.value))})}),(0,t.jsx)("div",{className:"text-right mt-4",children:(0,t.jsx)(l.Button,{type:"primary",htmlType:"submit",icon:(0,t.jsx)(o.UserAddOutlined,{}),loading:S,children:S?"Adding...":"Add Member"})})]})})}])},162386,e=>{"use strict";var t=e.i(843476),r=e.i(625901),a=e.i(109799),n=e.i(785242),l=e.i(738014),s=e.i(199133),i=e.i(981339),o=e.i(592968);let u={label:"All Proxy Models",value:"all-proxy-models"},d={label:"No Default Models",value:"no-default-models"},c=[u,d],m={user:({allProxyModels:e,userModels:t,options:r})=>t&&r?.includeUserModels?t:[],team:({allProxyModels:e,selectedOrganization:t,userModels:r})=>t?t.models.includes(u.value)||0===t.models.length?e:e.filter(e=>t.models.includes(e)):e??[],organization:({allProxyModels:e})=>e,global:({allProxyModels:e})=>e};e.s(["ModelSelect",0,e=>{let{teamID:h,organizationID:f,options:p,context:g,dataTestId:v,value:b=[],onChange:x,style:w}=e,{includeUserModels:y,showAllTeamModelsOption:C,showAllProxyModelsOverride:k,includeSpecialOptions:M}=p||{},{data:S,isLoading:j}=(0,r.useAllProxyModels)(),{data:E,isLoading:N}=(0,n.useTeam)(h),{data:T,isLoading:$}=(0,a.useOrganization)(f),{data:O,isLoading:_}=(0,l.useCurrentUser)(),I=e=>c.some(t=>t.value===e),L=b.some(I),A=T?.models.includes(u.value)||T?.models.length===0;if(j||N||$||_)return(0,t.jsx)(i.Skeleton.Input,{active:!0,block:!0});let{wildcard:D,regular:R}=(e=>{let t=[],r=[];for(let a of e)a.endsWith("/*")?t.push(a):r.push(a);return{wildcard:t,regular:r}})(((e,t,r)=>{let a=Array.from(new Map(e.map(e=>[e.id,e])).values()).map(e=>e.id);if(t.options?.showAllProxyModelsOverride)return a;let n=m[t.context];return n?n({allProxyModels:a,...r,options:t.options}):[]})(S?.data??[],e,{selectedTeam:E,selectedOrganization:T,userModels:O?.models}));return(0,t.jsx)(s.Select,{"data-testid":v,value:b,onChange:e=>{let t=e.filter(I);x(t.length>0?[t[t.length-1]]:e)},style:w,options:[...M?[{label:(0,t.jsx)("span",{children:"Special Options"}),title:"Special Options",options:[...k||A&&M||"global"===g?[{label:(0,t.jsx)("span",{children:"All Proxy Models"}),value:u.value,disabled:b.length>0&&b.some(e=>I(e)&&e!==u.value),key:u.value}]:[],{label:(0,t.jsx)("span",{children:"No Default Models"}),value:d.value,disabled:b.length>0&&b.some(e=>I(e)&&e!==d.value),key:d.value}]}]:[],...D.length>0?[{label:(0,t.jsx)("span",{children:"Wildcard Options"}),title:"Wildcard Options",options:D.map(e=>{let r=e.replace("/*",""),a=r.charAt(0).toUpperCase()+r.slice(1);return{label:(0,t.jsx)("span",{children:`All ${a} models`}),value:e,disabled:L}})}]:[],{label:(0,t.jsx)("span",{children:"Models"}),title:"Models",options:R.map(e=>({label:(0,t.jsx)("span",{children:e}),value:e,disabled:L}))}],mode:"multiple",placeholder:"Select Models",allowClear:!0,maxTagCount:"responsive",maxTagPlaceholder:e=>(0,t.jsx)(o.Tooltip,{styles:{root:{pointerEvents:"none"}},title:e.map(({value:e})=>e).join(", "),children:(0,t.jsxs)("span",{children:["+",e.length," more"]})})})}],162386)},276173,e=>{"use strict";var t=e.i(843476),r=e.i(599724),a=e.i(779241),n=e.i(464571),l=e.i(808613),s=e.i(212931),i=e.i(199133),o=e.i(271645),u=e.i(435451);e.s(["default",0,({visible:e,onCancel:d,onSubmit:c,initialData:m,mode:h,config:f})=>{let p,[g]=l.Form.useForm(),[v,b]=(0,o.useState)(!1);console.log("Initial Data:",m),(0,o.useEffect)(()=>{if(e)if("edit"===h&&m){let e={...m,role:m.role||f.defaultRole,max_budget_in_team:m.max_budget_in_team||null,tpm_limit:m.tpm_limit||null,rpm_limit:m.rpm_limit||null,allowed_models:m.allowed_models||[]};console.log("Setting form values:",e),g.setFieldsValue(e)}else g.resetFields(),g.setFieldsValue({role:f.defaultRole||f.roleOptions[0]?.value})},[e,m,h,g,f.defaultRole,f.roleOptions]);let x=async e=>{try{b(!0);let t=Object.entries(e).reduce((e,[t,r])=>{if("string"==typeof r){let a=r.trim();return""===a&&("max_budget_in_team"===t||"tpm_limit"===t||"rpm_limit"===t)?{...e,[t]:null}:{...e,[t]:a}}return{...e,[t]:r}},{});console.log("Submitting form data:",t),await Promise.resolve(c(t)),g.resetFields()}catch(e){console.error("Form submission error:",e)}finally{b(!1)}};return(0,t.jsx)(s.Modal,{title:f.title||("add"===h?"Add Member":"Edit Member"),open:e,width:1e3,footer:null,onCancel:d,children:(0,t.jsxs)(l.Form,{form:g,onFinish:x,labelCol:{span:8},wrapperCol:{span:16},labelAlign:"left",children:[f.showEmail&&(0,t.jsx)(l.Form.Item,{label:"Email",name:"user_email",className:"mb-4",rules:[{type:"email",message:"Please enter a valid email!"}],children:(0,t.jsx)(a.TextInput,{placeholder:"user@example.com"})}),f.showEmail&&f.showUserId&&(0,t.jsx)("div",{className:"text-center mb-4",children:(0,t.jsx)(r.Text,{children:"OR"})}),f.showUserId&&(0,t.jsx)(l.Form.Item,{label:"User ID",name:"user_id",className:"mb-4",children:(0,t.jsx)(a.TextInput,{placeholder:"user_123"})}),(0,t.jsx)(l.Form.Item,{label:(0,t.jsxs)("div",{className:"flex items-center gap-2",children:[(0,t.jsx)("span",{children:"Role"}),"edit"===h&&m&&(0,t.jsxs)("span",{className:"text-gray-500 text-sm",children:["(Current: ",(p=m.role,f.roleOptions.find(e=>e.value===p)?.label||p),")"]})]}),name:"role",className:"mb-4",rules:[{required:!0,message:"Please select a role!"}],children:(0,t.jsx)(i.Select,{children:"edit"===h&&m?[...f.roleOptions.filter(e=>e.value===m.role),...f.roleOptions.filter(e=>e.value!==m.role)].map(e=>(0,t.jsx)(i.Select.Option,{value:e.value,children:e.label},e.value)):f.roleOptions.map(e=>(0,t.jsx)(i.Select.Option,{value:e.value,children:e.label},e.value))})}),f.additionalFields?.map(e=>(0,t.jsx)(l.Form.Item,{label:e.label,name:e.name,className:"mb-4",rules:e.rules,children:(e=>{switch(e.type){case"input":return(0,t.jsx)(a.TextInput,{placeholder:e.placeholder});case"numerical":return(0,t.jsx)(u.default,{step:e.step||1,min:e.min||0,style:{width:"100%"},placeholder:e.placeholder||"Enter a numerical value"});case"select":return(0,t.jsx)(i.Select,{children:e.options?.map(e=>(0,t.jsx)(i.Select.Option,{value:e.value,children:e.label},e.value))});case"multi-select":return(0,t.jsx)(i.Select,{mode:"multiple",placeholder:e.placeholder||"Select options",options:e.options,allowClear:!0});default:return null}})(e)},e.name)),(0,t.jsxs)("div",{className:"text-right mt-6",children:[(0,t.jsx)(n.Button,{onClick:d,className:"mr-2",disabled:v,children:"Cancel"}),(0,t.jsx)(n.Button,{type:"default",htmlType:"submit",loading:v,children:"add"===h?v?"Adding...":"Add Member":v?"Saving...":"Save Changes"})]})]})})}])},294612,e=>{"use strict";var t=e.i(843476),r=e.i(100486),a=e.i(827252),n=e.i(213205),l=e.i(771674),s=e.i(464571),i=e.i(770914),o=e.i(291542),u=e.i(262218),d=e.i(592968),c=e.i(898586),m=e.i(902555);let{Text:h}=c.Typography;function f({members:e,canEdit:c,onEdit:f,onDelete:p,onAddMember:g,roleColumnTitle:v="Role",roleTooltip:b,extraColumns:x=[],showDeleteForMember:w,emptyText:y}){let C=[{title:"User Email",dataIndex:"user_email",key:"user_email",render:e=>(0,t.jsx)(h,{children:e||"-"})},{title:"User ID",dataIndex:"user_id",key:"user_id",render:e=>"default_user_id"===e?(0,t.jsx)(u.Tag,{color:"blue",children:"Default Proxy Admin"}):(0,t.jsx)(h,{children:e||"-"})},{title:b?(0,t.jsxs)(i.Space,{direction:"horizontal",children:[v,(0,t.jsx)(d.Tooltip,{title:b,children:(0,t.jsx)(a.InfoCircleOutlined,{})})]}):v,dataIndex:"role",key:"role",render:e=>(0,t.jsxs)(i.Space,{children:[e?.toLowerCase()==="admin"||e?.toLowerCase()==="org_admin"?(0,t.jsx)(r.CrownOutlined,{}):(0,t.jsx)(l.UserOutlined,{}),(0,t.jsx)(h,{style:{textTransform:"capitalize"},children:e||"-"})]})},...x,{title:"Actions",key:"actions",fixed:"right",width:120,render:(e,r)=>c?(0,t.jsxs)(i.Space,{children:[(0,t.jsx)(m.default,{variant:"Edit",tooltipText:"Edit member",dataTestId:"edit-member",onClick:()=>f(r)}),(!w||w(r))&&(0,t.jsx)(m.default,{variant:"Delete",tooltipText:"Delete member",dataTestId:"delete-member",onClick:()=>p(r)})]}):null}];return(0,t.jsxs)(i.Space,{direction:"vertical",style:{width:"100%"},children:[(0,t.jsxs)("span",{className:"inline-flex text-sm text-gray-700",children:[e.length," Member",1!==e.length?"s":""]}),(0,t.jsx)(o.Table,{columns:C,dataSource:e,rowKey:e=>e.user_id??e.user_email??JSON.stringify(e),pagination:!1,size:"small",scroll:{x:"max-content"},locale:y?{emptyText:y}:void 0}),g&&c&&(0,t.jsx)(s.Button,{icon:(0,t.jsx)(n.UserAddOutlined,{}),type:"primary",onClick:g,children:"Add Member"})]})}e.s(["default",()=>f])}]); \ No newline at end of file diff --git a/litellm/proxy/_experimental/out/_next/static/chunks/06b2ea8c776c2e9b.js b/litellm/proxy/_experimental/out/_next/static/chunks/06b2ea8c776c2e9b.js deleted file mode 100644 index fe571604a7f..00000000000 --- a/litellm/proxy/_experimental/out/_next/static/chunks/06b2ea8c776c2e9b.js +++ /dev/null @@ -1 +0,0 @@ -(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,233538,e=>{"use strict";function t(e){let t=e.parentElement,r=null;for(;t&&!(t instanceof HTMLFieldSetElement);)t instanceof HTMLLegendElement&&(r=t),t=t.parentElement;let l=(null==t?void 0:t.getAttribute("disabled"))==="";return!(l&&function(e){if(!e)return!1;let t=e.previousElementSibling;for(;null!==t;){if(t instanceof HTMLLegendElement)return!1;t=t.previousElementSibling}return!0}(r))&&l}e.s(["isDisabledReactIssue7711",()=>t])},220508,e=>{"use strict";var t=e.i(271645);let r=t.forwardRef(function(e,r){return t.createElement("svg",Object.assign({xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 24 24",strokeWidth:2,stroke:"currentColor","aria-hidden":"true",ref:r},e),t.createElement("path",{strokeLinecap:"round",strokeLinejoin:"round",d:"M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"}))});e.s(["CheckCircleIcon",0,r],220508)},503269,214520,601893,694421,140721,942803,35889,722678,e=>{"use strict";var t=e.i(271645),r=e.i(914189);function l(e,l,s){let[a,n]=(0,t.useState)(s),i=void 0!==e,o=(0,t.useRef)(i),c=(0,t.useRef)(!1),d=(0,t.useRef)(!1);return!i||o.current||c.current?i||!o.current||d.current||(d.current=!0,o.current=i,console.error("A component is changing from controlled to uncontrolled. This may be caused by the value changing from a defined value to undefined, which should not happen.")):(c.current=!0,o.current=i,console.error("A component is changing from uncontrolled to controlled. This may be caused by the value changing from undefined to a defined value, which should not happen.")),[i?e:a,(0,r.useEvent)(e=>(i||n(e),null==l?void 0:l(e)))]}function s(e){let[r]=(0,t.useState)(e);return r}e.s(["useControllable",()=>l],503269),e.s(["useDefaultValue",()=>s],214520);let a=(0,t.createContext)(void 0);function n(){return(0,t.useContext)(a)}e.s(["useDisabled",()=>n],601893);var i=e.i(174080),o=e.i(746725);function c(e={},t=null,r=[]){for(let[l,s]of Object.entries(e))!function e(t,r,l){if(Array.isArray(l))for(let[s,a]of l.entries())e(t,d(r,s.toString()),a);else l instanceof Date?t.push([r,l.toISOString()]):"boolean"==typeof l?t.push([r,l?"1":"0"]):"string"==typeof l?t.push([r,l]):"number"==typeof l?t.push([r,`${l}`]):null==l?t.push([r,""]):c(l,r,t)}(r,d(t,l),s);return r}function d(e,t){return e?e+"["+t+"]":t}function u(e){var t,r;let l=null!=(t=null==e?void 0:e.form)?t:e.closest("form");if(l){for(let t of l.elements)if(t!==e&&("INPUT"===t.tagName&&"submit"===t.type||"BUTTON"===t.tagName&&"submit"===t.type||"INPUT"===t.nodeName&&"image"===t.type))return void t.click();null==(r=l.requestSubmit)||r.call(l)}}e.s(["attemptSubmit",()=>u,"objectToFormEntries",()=>c],694421);var m=e.i(700020),f=e.i(2788);let h=(0,t.createContext)(null);function g({children:e}){let r=(0,t.useContext)(h);if(!r)return t.default.createElement(t.default.Fragment,null,e);let{target:l}=r;return l?(0,i.createPortal)(t.default.createElement(t.default.Fragment,null,e),l):null}function p({data:e,form:r,disabled:l,onReset:s,overrides:a}){let[n,i]=(0,t.useState)(null),d=(0,o.useDisposables)();return(0,t.useEffect)(()=>{if(s&&n)return d.addEventListener(n,"reset",s)},[n,r,s]),t.default.createElement(g,null,t.default.createElement(x,{setForm:i,formId:r}),c(e).map(([e,s])=>t.default.createElement(f.Hidden,{features:f.HiddenFeatures.Hidden,...(0,m.compact)({key:e,as:"input",type:"hidden",hidden:!0,readOnly:!0,form:r,disabled:l,name:e,value:s,...a})})))}function x({setForm:e,formId:r}){return(0,t.useEffect)(()=>{if(r){let t=document.getElementById(r);t&&e(t)}},[e,r]),r?null:t.default.createElement(f.Hidden,{features:f.HiddenFeatures.Hidden,as:"input",type:"hidden",hidden:!0,readOnly:!0,ref:t=>{if(!t)return;let r=t.closest("form");r&&e(r)}})}e.s(["FormFields",()=>p],140721);let b=(0,t.createContext)(void 0);function y(){return(0,t.useContext)(b)}e.s(["useProvidedId",()=>y],942803);var v=e.i(835696),j=e.i(294316);let k=(0,t.createContext)(null);function N(){var e,r;return null!=(r=null==(e=(0,t.useContext)(k))?void 0:e.value)?r:void 0}function w(){let[e,l]=(0,t.useState)([]);return[e.length>0?e.join(" "):void 0,(0,t.useMemo)(()=>function(e){let s=(0,r.useEvent)(e=>(l(t=>[...t,e]),()=>l(t=>{let r=t.slice(),l=r.indexOf(e);return -1!==l&&r.splice(l,1),r}))),a=(0,t.useMemo)(()=>({register:s,slot:e.slot,name:e.name,props:e.props,value:e.value}),[s,e.slot,e.name,e.props,e.value]);return t.default.createElement(k.Provider,{value:a},e.children)},[l])]}k.displayName="DescriptionContext";let S=Object.assign((0,m.forwardRefWithAs)(function(e,r){let l=(0,t.useId)(),s=n(),{id:a=`headlessui-description-${l}`,...i}=e,o=function e(){let r=(0,t.useContext)(k);if(null===r){let t=Error("You used a component, but it is not inside a relevant parent.");throw Error.captureStackTrace&&Error.captureStackTrace(t,e),t}return r}(),c=(0,j.useSyncRefs)(r);(0,v.useIsoMorphicEffect)(()=>o.register(a),[a,o.register]);let d=s||!1,u=(0,t.useMemo)(()=>({...o.slot,disabled:d}),[o.slot,d]),f={ref:c,...o.props,id:a};return(0,m.useRender)()({ourProps:f,theirProps:i,slot:u,defaultTag:"p",name:o.name||"Description"})}),{});e.s(["Description",()=>S,"useDescribedBy",()=>N,"useDescriptions",()=>w],35889);let C=(0,t.createContext)(null);function M(e){var r,l,s;let a=null!=(l=null==(r=(0,t.useContext)(C))?void 0:r.value)?l:void 0;return(null!=(s=null==e?void 0:e.length)?s:0)>0?[a,...e].filter(Boolean).join(" "):a}function O({inherit:e=!1}={}){let l=M(),[s,a]=(0,t.useState)([]),n=e?[l,...s].filter(Boolean):s;return[n.length>0?n.join(" "):void 0,(0,t.useMemo)(()=>function(e){let l=(0,r.useEvent)(e=>(a(t=>[...t,e]),()=>a(t=>{let r=t.slice(),l=r.indexOf(e);return -1!==l&&r.splice(l,1),r}))),s=(0,t.useMemo)(()=>({register:l,slot:e.slot,name:e.name,props:e.props,value:e.value}),[l,e.slot,e.name,e.props,e.value]);return t.default.createElement(C.Provider,{value:s},e.children)},[a])]}C.displayName="LabelContext";let E=Object.assign((0,m.forwardRefWithAs)(function(e,l){var s;let a=(0,t.useId)(),i=function e(){let r=(0,t.useContext)(C);if(null===r){let t=Error("You used a