chore: merge litellm_internal_staging into litellm_lit_4738_table_pagination

per_user_usage.tsx conflicted with the server pagination that already landed on staging (default 50 rows, stale-response guard, tag and page-size resets). Took the staging version and dropped this PR's now-redundant 25-row test for it Claude-Session: https://claude.ai/code/session_01HkaXiD6gssHnx3kqu1rR8C
2026-09-09 22:31:41 +00:00 · 2026-09-05 10:08:11 -07:00 · 2026-09-05 10:08:11 -07:00 · d885104125
commit d885104125
parent 7783efc3b1 7bfbdf39a0
545 changed files with 33373 additions and 4731 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@ -575,7 +575,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -v -x \
+                -v \
                --junitxml=test-results/junit.xml \
                --durations=5 \
                -k \"langfuse\""
@ -630,7 +630,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -v -x \
+                -v \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -737,7 +737,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -v -x \
+                -v \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -782,7 +782,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -v -x \
+                -v \
                --junitxml=test-results/junit.xml \
                --durations=5 \
                -k \"assistants\""
@ -909,7 +909,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x -s \
+                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5"
@ -999,7 +999,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x -s \
+                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -1054,7 +1054,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -v -x \
+                -v \
                --junitxml=test-results/junit.xml \
                --durations=5 \
                -n 8 \
@ -1090,7 +1090,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x \
+                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -1134,7 +1134,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x \
+                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -1178,7 +1178,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x -s \
+                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -1222,7 +1222,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x -s \
+                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -1267,7 +1267,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x \
+                -vv \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5 \
@ -1312,7 +1312,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -v -x \
+                -v \
                --junitxml=test-results/junit.xml \
                --durations=5 \
                -n 4"
@ -1391,7 +1391,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x -s \
+                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5"
@ -1444,7 +1444,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x -s \
+                -vv -s \
                --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml \
                --junitxml=test-results/junit.xml \
                --durations=5 -n 2 \
@ -1705,7 +1705,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -v -x \
+                -v \
                --junitxml=test-results/junit-2.xml \
                --durations=5"
          no_output_timeout: 15m
@ -1794,7 +1794,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -s -v -x \
+                -s -v \
                --junitxml=test-results/junit.xml \
                -n 4 \
                --durations=5"
@ -2012,7 +2012,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -v -x \
+                -v \
                --junitxml=test-results/junit-2.xml \
                --durations=5"
          no_output_timeout: 15m
@ -2092,7 +2092,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x \
+                -vv \
                --junitxml=test-results/junit.xml \
                --durations=5"
          no_output_timeout: 15m
@ -2195,7 +2195,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x \
+                -vv \
                --junitxml=test-results/junit.xml \
                --durations=5"
          no_output_timeout: 15m
@ -2266,7 +2266,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x \
+                -vv \
                --junitxml=test-results/junit.xml \
                --durations=5"
          no_output_timeout: 15m
@ -2350,7 +2350,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x \
+                -vv \
                --junitxml=test-results/junit-2.xml \
                --durations=5"
          no_output_timeout: 15m
@ -2446,7 +2446,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -v -x \
+                -v \
                --junitxml=test-results/junit.xml \
                --durations=5"
          no_output_timeout: 15m
@ -2516,7 +2516,7 @@ jobs:
            echo "$TEST_FILES" | circleci tests run \
              --verbose \
              --command="tr ' ' '\\n' | awk '/\\.py/ {print; next} {sub(/\\.[A-Z][^.]*$/, \"\"); gsub(/\\./, \"/\"); print \$0 \".py\"}' | xargs uv run --no-sync python -m pytest \
-                -vv -x -s \
+                -vv -s \
                --junitxml=test-results/junit.xml \
                --durations=5"
          no_output_timeout: 15m
--- a/.github/workflows/_test-unit-base.yml
+++ b/.github/workflows/_test-unit-base.yml
@ -57,9 +57,15 @@ permissions:

 jobs:
  run:
-    name: Run tests
+    name: ${{ matrix.python-version == '3.12' && 'Run tests' || format('Run tests (Python {0})', matrix.python-version) }}
    runs-on: ubuntu-latest
    timeout-minutes: ${{ inputs.job-timeout-minutes }}
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
    permissions:
      contents: read
      pull-requests: read
@ -82,7 +88,7 @@ jobs:
        timeout-minutes: 3
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
-          python-version: "3.12"
+          python-version: ${{ matrix.python-version }}

      - name: Set up uv
        if: steps.changes.outputs.decision != 'skip'
@ -96,12 +102,10 @@ jobs:
        timeout-minutes: 5
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          path: ${{ env.UV_CACHE_DIR }}
+          key: ${{ runner.os }}-uv-downloads-py${{ matrix.python-version }}-${{ hashFiles('uv.lock') }}
          restore-keys: |
-            ${{ runner.os }}-uv-
+            ${{ runner.os }}-uv-downloads-py${{ matrix.python-version }}-

      - name: Cache the Rust build
        if: steps.changes.outputs.decision != 'skip'
@ -112,7 +116,8 @@ jobs:
        if: steps.changes.outputs.decision != 'skip'
        timeout-minutes: 8
        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml
+          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra mongodb
+          uv run --no-sync python -c 'import os, sys; print(sys.version); assert f"{sys.version_info.major}.{sys.version_info.minor}" == os.environ["UV_PYTHON"]'

      - name: Cache Prisma binaries
        if: steps.changes.outputs.decision != 'skip'
@ -134,13 +139,7 @@ jobs:
          WORKERS: ${{ inputs.workers }}
          RERUNS: ${{ inputs.reruns }}
          DIST: ${{ inputs.dist }}
-          # coverage.py's sys.monitoring backend (PEP 669), the cheapest core it has.
-          # It is only the default from Python 3.14, and these shards run 3.12, so it
-          # has to be asked for. Coverage refuses it when branch measurement is on
-          # (`branch_right_left` needs > 3.14.0a5) and falls back to the slow core with
-          # a `no-sysmon` warning, so turning on `branch = true` here means giving this
-          # back until the runners move to 3.14.
-          COVERAGE_CORE: sysmon
+          COVERAGE_CORE: ${{ contains(fromJSON('["3.10", "3.11"]'), matrix.python-version) && 'ctrace' || 'sysmon' }}
        run: |
          if [ "${WORKERS}" = "0" ]; then
            uv run --no-sync pytest ${TEST_PATH:?} \
@ -167,7 +166,7 @@ jobs:
          fi

      - name: Save coverage report
-        if: always() && steps.changes.outputs.decision != 'skip'
+        if: always() && matrix.python-version == '3.12' && steps.changes.outputs.decision != 'skip'
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
--- a/basedpyright-code-budget.json
+++ b/basedpyright-code-budget.json
@ -1,9 +1,9 @@
 {
  "reportAny": {
-    "limit": 14074
+    "limit": 13429
  },
  "reportArgumentType": {
-    "limit": 2206
+    "limit": 2198
  },
  "reportAssignmentType": {
    "limit": 319
@ -18,13 +18,13 @@
    "limit": 40
  },
  "reportDeprecated": {
-    "limit": 211
+    "limit": 209
  },
  "reportDuplicateImport": {
    "limit": 19
  },
  "reportExplicitAny": {
-    "limit": 4124
+    "limit": 3369
  },
  "reportFunctionMemberAccess": {
    "limit": 7
@ -45,19 +45,19 @@
    "limit": 24
  },
  "reportInvalidTypeForm": {
-    "limit": 34
+    "limit": 30
  },
  "reportInvalidTypeVarUse": {
-    "limit": 2
+    "limit": 1
  },
  "reportMatchNotExhaustive": {
    "limit": 0
  },
  "reportMissingParameterType": {
-    "limit": 5601
+    "limit": 5570
  },
  "reportMissingTypeArgument": {
-    "limit": 15285
+    "limit": 15281
  },
  "reportMissingTypeStubs": {
    "limit": 40
@ -90,31 +90,31 @@
    "limit": 8
  },
  "reportReturnType": {
-    "limit": 181
+    "limit": 180
  },
  "reportTypedDictNotRequiredAccess": {
-    "limit": 24
+    "limit": 22
  },
  "reportUndefinedVariable": {
    "limit": 0
  },
  "reportUnknownArgumentType": {
-    "limit": 44360
+    "limit": 44358
  },
  "reportUnknownLambdaType": {
    "limit": 109
  },
  "reportUnknownMemberType": {
-    "limit": 38311
+    "limit": 38283
  },
  "reportUnknownParameterType": {
-    "limit": 19624
+    "limit": 19584
  },
  "reportUnknownVariableType": {
-    "limit": 29847
+    "limit": 29829
  },
  "reportUnnecessaryCast": {
-    "limit": 111
+    "limit": 110
  },
  "reportUnnecessaryComparison": {
    "limit": 687
@ -123,7 +123,7 @@
    "limit": 4
  },
  "reportUnnecessaryIsInstance": {
-    "limit": 819
+    "limit": 816
  },
  "reportUntypedBaseClass": {
    "limit": 0
--- a/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py
+++ b/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py
@ -161,6 +161,7 @@ class CheckBatchCost:
        metadata: dict[str, object] = {
            "user_api_key_user_id": job.created_by,
            "user_api_key": api_key,
+            "user_api_key_hash": api_key,
            "user_api_key_team_id": team_id,
            **(await self._get_user_info(batch_id, job.created_by)),
        }
--- a/enterprise/litellm_enterprise/proxy/hooks/managed_files.py
+++ b/enterprise/litellm_enterprise/proxy/hooks/managed_files.py
@ -46,6 +46,7 @@ from litellm.proxy._types import (
    UserAPIKeyAuth,
 )
 from litellm.proxy.openai_files_endpoints.common_utils import (
+    BATCH_CREATE_HIDDEN_PARAM,
    FILE_LIST_CONTINUATION_CHUNK_SIZE,
    MAX_FILE_LIST_LIMIT,
    _is_base64_encoded_unified_file_id,
@ -1321,7 +1322,7 @@ class _PROXY_LiteLLMManagedFiles(CustomLogger, BaseFileEndpoints):
            ## Check if unified_file_id is in the response
            unified_file_id = response._hidden_params.get("unified_file_id")  # managed file id
            unified_batch_id = response._hidden_params.get("unified_batch_id")  # managed batch id
-            is_batch_create: Final = unified_file_id is not None
+            is_batch_create: Final = response._hidden_params.get(BATCH_CREATE_HIDDEN_PARAM) is True
            model_id = cast(Optional[str], response._hidden_params.get("model_id"))
            model_name = cast(Optional[str], response._hidden_params.get("model_name"))

@ -1410,10 +1411,7 @@ class _PROXY_LiteLLMManagedFiles(CustomLogger, BaseFileEndpoints):
                    litellm_parent_otel_span=user_api_key_dict.parent_otel_span,
                )

-            # Only record batch creation metric on actual create (not retrieve/cancel).
-            # unified_file_id in _hidden_params is only set by the create_batch endpoint.
-            original_unified_file_id = response._hidden_params.get("unified_file_id")
-            if original_unified_file_id:
+            if is_batch_create:
                prom_logger = self._get_prometheus_logger()
                if prom_logger:
                    batch_provider = ""
--- a/enterprise/litellm_enterprise/proxy/hooks/managed_vector_stores.py
+++ b/enterprise/litellm_enterprise/proxy/hooks/managed_vector_stores.py
@ -16,6 +16,7 @@ from litellm.llms.base_llm.managed_resources.utils import (
    is_base64_encoded_unified_id,
 )
 from litellm.proxy._types import UserAPIKeyAuth
+from litellm.types.utils import LLMResponseTypes
 from litellm.types.vector_stores import (
    VectorStoreCreateOptionalRequestParams,
    VectorStoreCreateResponse,
@ -24,6 +25,7 @@ from litellm.types.vector_stores import (
 if TYPE_CHECKING:
    from opentelemetry.trace import Span as _Span

+    from litellm.caching.caching import DualCache
    from litellm.proxy.utils import InternalUsageCache as _InternalUsageCache
    from litellm.proxy.utils import PrismaClient as _PrismaClient

@ -156,7 +158,7 @@ class _PROXY_LiteLLMManagedVectorStores(

        # Create vector store for each model
        # Convert TypedDict to Dict[str, Any] for base class compatibility
-        request_data_dict: Dict[str, Any] = dict(create_request)
+        request_data_dict: Dict[str, object] = dict(create_request)
        responses = await self.create_resource_for_each_model(
            llm_router=llm_router,
            request_data=request_data_dict,
@ -209,7 +211,7 @@ class _PROXY_LiteLLMManagedVectorStores(
        limit: Optional[int] = None,
        after: Optional[str] = None,
        order: Optional[str] = None,
-    ) -> Dict[str, Any]:
+    ) -> Dict[str, object]:
        """
        List vector stores created by a user.
        
@ -301,7 +303,7 @@ class _PROXY_LiteLLMManagedVectorStores(
    async def async_pre_call_hook(
        self,
        user_api_key_dict: UserAPIKeyAuth,
-        cache: Any,
+        cache: "DualCache",
        data: Dict,
        call_type: str,
    ) -> Union[Exception, str, Dict, None]:
@ -403,8 +405,8 @@ class _PROXY_LiteLLMManagedVectorStores(
        self,
        data: Dict,
        user_api_key_dict: UserAPIKeyAuth,
-        response: Any,
-    ) -> Any:
+        response: LLMResponseTypes,
+    ) -> LLMResponseTypes:
        """
        Post-call hook to transform responses.
        
--- a/helm/litellm/templates/migrations-job.yaml
+++ b/helm/litellm/templates/migrations-job.yaml
@ -77,4 +77,16 @@ spec:
      volumes:
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- with .Values.migrationJob.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.migrationJob.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.migrationJob.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}
--- a/helm/litellm/tests/migration_job_tests.yaml
+++ b/helm/litellm/tests/migration_job_tests.yaml
@ -1,4 +1,4 @@
-suite: test migrations Job ServiceAccount resolution and pod hardening
+suite: test migrations Job ServiceAccount resolution, pod hardening, and scheduling
 templates:
  - migrations-job.yaml
 values:
@ -188,3 +188,69 @@ tests:
    asserts:
      - notExists:
          path: spec.activeDeadlineSeconds
+
+  - it: renders no scheduling fields by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.nodeSelector
+      - isNull:
+          path: spec.template.spec.tolerations
+      - isNull:
+          path: spec.template.spec.affinity
+
+  - it: renders nodeSelector, tolerations, and affinity from the migrationJob values
+    set:
+      migrationJob.nodeSelector:
+        intent: no-csi-nodes
+      migrationJob.tolerations:
+        - key: intent
+          operator: Equal
+          value: no-csi-nodes
+          effect: NoSchedule
+      migrationJob.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: intent
+                    operator: In
+                    values:
+                      - no-csi-nodes
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            intent: no-csi-nodes
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: intent
+              operator: Equal
+              value: no-csi-nodes
+              effect: NoSchedule
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: intent
+                        operator: In
+                        values:
+                          - no-csi-nodes
+
+  - it: does not inherit the gateway's scheduling values
+    set:
+      gateway.nodeSelector:
+        intent: no-csi-nodes
+      gateway.tolerations:
+        - key: intent
+          operator: Equal
+          value: no-csi-nodes
+          effect: NoSchedule
+    asserts:
+      - isNull:
+          path: spec.template.spec.nodeSelector
+      - isNull:
+          path: spec.template.spec.tolerations
--- a/helm/litellm/values.yaml
+++ b/helm/litellm/values.yaml
@ -152,6 +152,13 @@ migrationJob:
  # the writable scratch space a read-only root filesystem needs.
  volumes: []
  volumeMounts: []
+  # Scheduling for the Job pod, same shape as gateway.nodeSelector /
+  # gateway.tolerations / gateway.affinity. The Job does not inherit the other
+  # components' scheduling values: a migration usually needs a larger node
+  # than the gateway, so pin it here explicitly.
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
  image:
    repository: ghcr.io/berriai/litellm-migrations
    tag: ""              # defaults to .Chart.AppVersion
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260901000001_add_guardrail_usage_units_cost/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260901000001_add_guardrail_usage_units_cost/migration.sql
@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_DailyGuardrailUsageUnits" ADD COLUMN IF NOT EXISTS "cost" DOUBLE PRECISION;
+ALTER TABLE "LiteLLM_DailyGuardrailUsageUnits" ADD COLUMN IF NOT EXISTS "untracked_units" BIGINT NOT NULL DEFAULT 0;
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260904000000_shadow_eval_model_scope/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260904000000_shadow_eval_model_scope/migration.sql
@ -0,0 +1 @@
+ALTER TABLE "LiteLLM_ShadowEvalJob" ADD COLUMN IF NOT EXISTS "models" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];
--- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
+++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
@ -5,6 +5,7 @@ datasource client {

 generator client {
  provider = "prisma-client-py"
+  recursive_type_depth = -1
  binaryTargets = ["native", "debian-openssl-1.1.x", "debian-openssl-3.0.x", "linux-musl", "linux-musl-openssl-3.0.x"]
 }

@ -1123,6 +1124,8 @@ model LiteLLM_DailyGuardrailUsageUnits {
  api_key      String   // hashed virtual key; empty string when unknown
  usage_unit   String   // provider counter name, e.g. Bedrock's contentPolicyUnits
  units        BigInt   @default(0)
+  cost         Float?   // USD for the priced share of units; null only on rows written before this column existed
+  untracked_units BigInt @default(0) // units recorded with no known price, the share cost leaves out
  created_at   DateTime @default(now())
  updated_at   DateTime @updatedAt

@ -1533,6 +1536,7 @@ model LiteLLM_ShadowEvalJob {
  target_id         String   // hashed virtual key, team_id, or user_id whose traffic this leg shadows
  router_name       String   // first (often only) auto-router under evaluation; router_names is the full set
  router_names      String[] @default([]) // all routers this job runs as shadow arms; empty on legacy rows, whose set is (router_name)
+  models            String[] @default([]) // model groups the sampled traffic is narrowed to; empty samples every model
  direction         String   @default("forward") // forward | reverse
  baseline_model    String?  // reverse only: the fixed model the router is judged against
  judge_model       String
--- a/litellm-rust/AGENTS.md
+++ b/litellm-rust/AGENTS.md
@ -1,17 +1,18 @@
 # AGENTS.md

-litellm-rust has four crates. A crate is a layer or shared foundation, not a route. Routes (ocr, realtime, chat) and providers (mistral, openai) are modules inside the layers.
+litellm-rust has five crates. A crate is a layer or shared foundation, not a route. Routes (ocr, realtime, chat) and providers (mistral, openai) are modules inside the layers.

 ## Crates

 | Crate | Role |
 |-------|------|
 | litellm-core | The LiteLLM SDK in Rust. One public entrypoint per top-level call (`messages::messages()`), owning types, transforms, provider resolution, auth, and the provider HTTP call. Call it, get a typed response. |
+| litellm-config | Config-loading boundary. Returns resolved core deployment data and optionally delegates loading to Python. |
 | litellm-ai-gateway | The axum server (behind the `server` feature) plus the WebSocket hosts. Translates HTTP/WS to core entrypoints; owns no provider logic and no handlers. |
 | litellm-python-interop | Domain-neutral PyO3 foundation for GIL handling and typed Python/Serde conversion. |
 | litellm-python-bridge | PyO3 cdylib exposing LiteLLM Rust APIs to the Python SDK. Owns API registration, domain wiring, and Python exception mapping. |

-Dependency direction is acyclic: `litellm-python-bridge` depends on the domain layers and `litellm-python-interop`; the interop foundation depends on no LiteLLM domain crate.
+Dependency direction is acyclic: `litellm-config` depends on `litellm-core`, the gateway depends on both, and `litellm-python-bridge` depends on the domain layers and `litellm-python-interop`. The interop foundation depends on no LiteLLM domain crate.

 ## Where a route lives

--- a/litellm-rust/CLAUDE.md
+++ b/litellm-rust/CLAUDE.md
@ -24,6 +24,7 @@ the base when behavior is genuinely different, and say so explicitly in the PR.
 ## Crates (see AGENTS.md)

 `litellm-core` **is** the LiteLLM SDK in Rust: it makes the LLM call.
+`litellm-config` is the config-loading boundary and returns resolved core types.
 `litellm-ai-gateway` is an HTTP/WebSocket server in front of it, and
 `litellm-python-bridge` exposes it to the Python SDK. `litellm-python-interop`
 holds domain-neutral PyO3 primitives shared by Python-facing Rust code. A crate
--- a/litellm-rust/Cargo.lock
+++ b/litellm-rust/Cargo.lock
@ -1412,8 +1412,8 @@ dependencies = [
 "base64",
 "futures-channel",
 "futures-util",
+ "litellm-config",
 "litellm-core",
- "pyo3",
 "reqwest",
 "serde",
 "serde_json",
@ -1425,6 +1425,16 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "litellm-config"
+version = "0.1.0"
+dependencies = [
+ "litellm-core",
+ "pyo3",
+ "serde_json",
+ "thiserror 2.0.19",
+]
+
 [[package]]
 name = "litellm-core"
 version = "0.1.0"
--- a/litellm-rust/Cargo.toml
+++ b/litellm-rust/Cargo.toml
@ -1,6 +1,7 @@
 [workspace]
 members = [
    "crates/core",
+    "crates/config",
    "crates/ai-gateway",
    "crates/python-interop",
    "crates/python-bridge",
@ -17,6 +18,7 @@ repository = "https://github.com/BerriAI/litellm"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", default-features = false, features = ["registry", "std"] }
 litellm-core = { path = "crates/core" }
+litellm-config = { path = "crates/config" }
 litellm-ai-gateway = { path = "crates/ai-gateway", default-features = false }
 litellm-python-interop = { path = "crates/python-interop" }
 axum = "0.7"
--- a/litellm-rust/README.md
+++ b/litellm-rust/README.md
@ -25,11 +25,12 @@ coverage and production evidence.
 | Crate | Role |
 |-------|------|
 | litellm-core | The SDK. Per-route entrypoints (`messages::messages()`), types, provider transforms (modules under `providers/`), provider resolution, auth, the provider HTTP call, and the router. |
+| litellm-config | Config-loading boundary. Returns resolved deployments and optionally delegates loading to Python. |
 | litellm-ai-gateway | The axum server (behind the `server` feature) and WebSocket hosts. Translates HTTP/WS to core entrypoints; no provider handlers. |
 | litellm-python-interop | Domain-neutral PyO3 foundation for GIL handling and typed Python/Serde conversion. |
 | litellm-python-bridge | PyO3 cdylib exposing LiteLLM Rust APIs to the Python SDK. Owns API registration, domain wiring, and Python exception mapping. |

-Dependency direction is acyclic: `litellm-python-bridge` depends on the domain layers and `litellm-python-interop`; the interop foundation depends on no LiteLLM domain crate.
+Dependency direction is acyclic: config depends on core, the gateway depends on config and core, and the Python bridge depends on the domain layers and Python interop.

 ## Layout

@ -38,6 +39,7 @@ crates/
  core/           The SDK: route modules + provider transforms.
    src/messages/   mod.rs (entrypoint), types, transformation, prepare, handler, client
    src/providers/anthropic/messages/transformation.rs
+  config/         Config loading and resolved deployments.
  ai-gateway/     Axum server + WebSocket hosts; calls core entrypoints.
  python-interop/ Domain-neutral PyO3 conversion and GIL primitives.
  python-bridge/  PyO3 API adapter for Python LiteLLM.
--- a/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md
+++ b/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md
@ -45,7 +45,7 @@ Rules for adding or changing an LLM provider/route in `litellm-rust`. `messages`

 22. A Python -> Rust bridge keeps the Python side minimal: the Python interface only marshals inputs and calls the Rust interface, with no transform, handler, or business logic. Aim for well under 100 lines of interface code per route; if the Python grows past that, the logic belongs in Rust.
 23. Do not bloat `litellm/main.py`. A route's provider dispatch lives in a thin dispatch class under `litellm/llms/<provider>/<route>/` that calls the Rust bridge; `main.py` only instantiates it and calls its sync/async method.
-24. Do not add new feature flags unless explicitly requested. Reuse the existing litellm rust rollout mechanism (`use_litellm_rust`); never introduce a per-route env flag such as `LITELLM_USE_RUST_<ROUTE>`.
+24. Do not add new feature flags unless explicitly requested. Reuse the existing LiteLLM Rust rollout mechanism (`litellm.rust`); never introduce a per-route env flag such as `LITELLM_USE_RUST_<ROUTE>`.

 ## Checks before push

--- a/litellm-rust/crates/ai-gateway/AGENTS.md
+++ b/litellm-rust/crates/ai-gateway/AGENTS.md
@ -9,19 +9,15 @@ such as `litellm_core::messages::messages`. No provider handler lives here.
 src/
  main.rs            # entrypoint: build AppState (router + master key), bind, serve
  state.rs           # AppState — shared Arc<Router> + master_key
-  gil.rs             # GIL-activity tracker (records Python acquisitions)
  auth/              # authentication as an axum extractor — added to handler args
    mod.rs           #   RequireMasterKey: FromRequestParts, single master key (LITELLM_MASTER_KEY)
  routes/            # one module per route, all matching the same template
    AGENTS.md        #   ← the route template (read this before adding a route)
    mod.rs           #   app(): merges every module's router()
    health.rs        #   simple route (one file): router() + liveness/readiness
-    gil.rs           #   simple route (one file): router() + GET /health/gil
    realtime/        #   route with logic → axum surface + a no-axum service:
      mod.rs         #     router() + handler + WS<->events adapter (the axum surface)
      service.rs     #     business logic (select deployment, call provider) — no axum, testable
-  python/            # Python interop (feature: python-config) — load-time only
-    mod.rs, config.rs, AGENTS.md
 ```

 ## Rules
@ -53,5 +49,6 @@ proxy in a later phase. Health routes don't add the extractor (unauthenticated).

 ## Python interop

-Anything that calls into Python lives in `python/` and is **load-time only** — see
-`python/AGENTS.md`. The realtime data path never takes the GIL.
+Python-backed loading lives in `litellm-config` and is **load-time only**. The
+gateway's `python-config` feature forwards to that crate. The realtime data path
+never takes the GIL.
--- a/litellm-rust/crates/ai-gateway/ARCHITECTURE.md
+++ b/litellm-rust/crates/ai-gateway/ARCHITECTURE.md
@ -9,4 +9,6 @@ flowchart LR
  C[client] <--> G[Rust ai-gateway<br/>LLM inference]
  G <--> O[OpenAI realtime]
  G -. spend tracking callback .-> P[litellm proxy]
+  F[litellm-config<br/>load-time only] --> G
+  F -. Python backend .-> P
 ```
--- a/litellm-rust/crates/ai-gateway/Cargo.toml
+++ b/litellm-rust/crates/ai-gateway/Cargo.toml
@ -16,6 +16,7 @@ required-features = ["server"]
 [dependencies]
 tracing.workspace = true
 litellm-core = { workspace = true, features = ["bedrock-auth"] }
+litellm-config.workspace = true
 # reqwest (rustls + json) is used by io/ocr and ships realtime logs to the
 # Python proxy callbacks API.
 reqwest.workspace = true
@ -31,7 +32,6 @@ subtle = { workspace = true, optional = true }
 # sha2 hashes the master key into user_api_key_hash (matches the proxy's
 # SHA-256 hash_token) so the plaintext credential never enters a log payload.
 sha2 = { workspace = true, optional = true }
-pyo3 = { workspace = true, features = ["auto-initialize"], optional = true }
 tower = { version = "0.5.3", features = ["util"], optional = true }

 [features]
@ -39,7 +39,7 @@ default = []
 server = ["dep:axum", "dep:subtle", "dep:sha2"]
 # Build the gateway's config from the proxy YAML via an embedded Python
 # interpreter (links libpython; requires `litellm` importable at runtime).
-python-config = ["dep:pyo3"]
+python-config = ["litellm-config/python"]
 trace-parity = ["server", "dep:tower", "litellm-core/observability"]

 [dev-dependencies]
--- a/litellm-rust/crates/ai-gateway/README.md
+++ b/litellm-rust/crates/ai-gateway/README.md
@ -6,25 +6,30 @@ dials OpenAI upstream, and splices the two sockets frame-by-frame.

 ## Crates

-`litellm-rust` has four crates. A crate is a layer or shared foundation, not a route:
+`litellm-rust` has five crates. A crate is a layer or shared foundation, not a route:

 | Crate | Role |
 |-------|------|
 | litellm-core | The LiteLLM SDK in Rust — per-route entrypoints (`messages::messages()`) that resolve the provider, transform, and make the call; plus types, provider transforms, and the router. |
+| litellm-config | Config-loading boundary. Returns resolved deployments and optionally delegates loading to Python. |
 | litellm-ai-gateway | The Axum server (behind the `server` feature) and WebSocket hosts. Translates HTTP/WS to core entrypoints; no provider handlers. |
 | litellm-python-interop | Domain-neutral PyO3 foundation for GIL handling and typed Python/Serde conversion. |
 | litellm-python-bridge | PyO3 cdylib exposing LiteLLM Rust APIs to the Python SDK. |

-Dependency direction is acyclic: `litellm-python-bridge` depends on the domain layers and `litellm-python-interop`; the interop foundation depends on no LiteLLM domain crate.
+Dependency direction is acyclic: config depends on core, the gateway depends on config and core, and the Python bridge depends on the domain layers and Python interop.

 - **Client endpoint:** `wss://<host>/v1/realtime?model=<model>` (WebSocket)
 - **Auth:** `Authorization: Bearer $LITELLM_MASTER_KEY` (fails closed if unset)
- **Health:** `GET /health/readiness`, `GET /health/liveness`, `GET /health/gil`
+- **Health:** `GET /health/readiness`, `GET /health/liveness`
 - **Request logs:** POSTed to a LiteLLM proxy at `/v1/rust_control_plane/logs` (see [Request logging](#request-logging))

 > **Realtime serving is pure Rust.** Python is used at **load time only** — to
 > read the config once at boot. The realtime hot path never touches Python.

+The former `/health/gil` route and its acquisition counter were removed. They
+only observed the single startup config load and did not prove that every GIL
+acquisition was instrumented
+
 ## Configuration (config.yaml)

 The gateway loads its `model_list` from a **config.yaml**, the same as the
@ -43,9 +48,10 @@ model_list:
 LITELLM_CONFIG_PATH=./config.yaml ./litellm-ai-gateway
 ```

-At boot the gateway calls into `litellm.proxy.read_model_list`, which reuses the
-**real proxy config reader** (`ProxyConfig.get_config`). That means everything
-the proxy supports in config.yaml works here too:
+At boot `litellm-config` calls into `litellm.proxy.read_model_list` and returns
+resolved deployments to the gateway, which constructs the router. The Python
+backend still reuses the **real proxy config reader** (`ProxyConfig.get_config`),
+so everything the proxy supports in config.yaml works here too:

 - `include:` to merge in other config files,
 - `os.environ/VAR` secret references (resolved via the secret manager, never
@ -82,8 +88,8 @@ stand-in built from the environment:
 |---|---|---|
 | `OPENAI_REALTIME_MODEL` | `gpt-realtime` | The single deployment's model name (also the `?model=` clients pass). |

-This mode links no libpython and needs no config file, but it only supports one
-hard-coded OpenAI deployment. **config.yaml is the recommended path** — use the
+The default workspace build links no libpython and needs no config file. This
+fallback mode only supports one hard-coded OpenAI deployment. **config.yaml is the recommended path** — use the
 stand-in only for the leanest possible build.

 ## Request logging
--- a/litellm-rust/crates/ai-gateway/config.yaml
+++ b/litellm-rust/crates/ai-gateway/config.yaml
@ -1,8 +1,8 @@
 # Sample realtime config for the LiteLLM Rust AI Gateway.
 #
-# The gateway loads this model_list at boot via the embedded python config
-# reader (litellm.proxy.read_model_list), which reuses the proxy's own reader —
-# so include:, os.environ/ secrets, and DB-stored models all work here too.
+# litellm-config resolves this model_list at boot through the Python config
+# reader (litellm.proxy.read_model_list), then the gateway builds its router.
+# Includes, environment secrets, and database-stored models still work.
 #
 # Secrets are referenced (never inlined) via os.environ/. A real deploy can
 # override this file (e.g. mount a Render secret file at LITELLM_CONFIG_PATH).
--- a/litellm-rust/crates/ai-gateway/src/gil.rs
+++ b/litellm-rust/crates/ai-gateway/src/gil.rs
@ -1,58 +0,0 @@
-//! GIL-activity tracking.
-//!
-//! Every acquisition of the Python GIL is recorded here so the `/health/gil`
-//! endpoint can report whether Python was touched recently. The design goal is
-//! that the GIL is acquired **only at load time** (config read) and never on the
-//! realtime hot path — polling this endpoint during traffic should show the
-//! count holding steady and `acquired_last_30s` falling to `false`.
-
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::{SystemTime, UNIX_EPOCH};
-
-/// Window (seconds) for the "recently acquired" signal.
-pub const RECENT_WINDOW_SECS: u64 = 30;
-
-static GIL_ACQUISITIONS: AtomicU64 = AtomicU64::new(0);
-/// Unix seconds of the last acquisition; `0` means "never".
-static LAST_GIL_UNIX_SECS: AtomicU64 = AtomicU64::new(0);
-
-fn now_unix_secs() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|d| d.as_secs())
-        .unwrap_or(0)
-}
-
-/// Record that the GIL was just acquired. Call immediately before taking the GIL.
-///
-/// Only invoked under the `python-config` feature; without it the gateway never
-/// touches Python, so the recorder is unused (and the endpoint reports zero).
-#[cfg_attr(not(feature = "python-config"), allow(dead_code))]
-pub fn record_acquisition() {
-    GIL_ACQUISITIONS.fetch_add(1, Ordering::Relaxed);
-    LAST_GIL_UNIX_SECS.store(now_unix_secs(), Ordering::Relaxed);
-}
-
-/// Point-in-time view of GIL activity.
-pub struct GilSnapshot {
-    pub total_acquisitions: u64,
-    pub seconds_since_last: Option<u64>,
-    pub acquired_last_30s: bool,
-}
-
-/// Read the current GIL-activity snapshot.
-pub fn snapshot() -> GilSnapshot {
-    let total = GIL_ACQUISITIONS.load(Ordering::Relaxed);
-    let last = LAST_GIL_UNIX_SECS.load(Ordering::Relaxed);
-    let seconds_since_last = if last == 0 {
-        None
-    } else {
-        Some(now_unix_secs().saturating_sub(last))
-    };
-    let acquired_last_30s = seconds_since_last.is_some_and(|secs| secs <= RECENT_WINDOW_SECS);
-    GilSnapshot {
-        total_acquisitions: total,
-        seconds_since_last,
-        acquired_last_30s,
-    }
-}
--- a/litellm-rust/crates/ai-gateway/src/lib.rs
+++ b/litellm-rust/crates/ai-gateway/src/lib.rs
@ -10,18 +10,13 @@
 //! - [`io`]: compatibility exports and realtime WebSocket splice helpers.
 //! - The server modules ([`auth`], [`routes`], [`state`]) and anything pulling
 //!   `axum` are gated behind the `server` feature, which the `litellm-ai-gateway`
-//!   binary turns on. The `python-config` feature additionally pulls in [`python`]
-//!   for the load-time config reader.
+//!   binary turns on.

 pub mod audio_transcription;
 mod client;
 pub mod io;
 pub mod ocr;

-/// GIL-activity tracking. Pure (atomics only); shared by the `server` routes and
-/// the `python-config` reader, so it is available without either feature.
-pub mod gil;
-
 #[cfg(feature = "server")]
 pub mod auth;
 #[cfg(feature = "server")]
@ -35,6 +30,3 @@ mod constants;
 pub mod integrations;
 #[cfg(feature = "server")]
 mod realtime;
-
-#[cfg(feature = "python-config")]
-pub mod python;
--- a/litellm-rust/crates/ai-gateway/src/main.rs
+++ b/litellm-rust/crates/ai-gateway/src/main.rs
@ -14,12 +14,12 @@ use std::sync::Arc;
 use litellm_ai_gateway::io::realtime_pool::{PoolConfig, RealtimePool, upstream_key};
 use litellm_ai_gateway::routes;
 use litellm_ai_gateway::state::AppState;
+#[cfg(feature = "python-config")]
+use litellm_config::load_model_list;
 use litellm_core::router::{Deployment, LiteLLMParams, Router};

 use litellm_ai_gateway::integrations::custom_logger::CustomLogger;
 use litellm_ai_gateway::integrations::litellm_python_proxy_api::LiteLLMPythonProxyAPILogger;
-#[cfg(feature = "python-config")]
-use litellm_ai_gateway::python;

 /// Bind to localhost by default so the gateway is not a public, unauthenticated
 /// provider proxy out of the box. Override with `HOST` (e.g. `0.0.0.0`).
@ -124,10 +124,10 @@ fn resolve_port() -> u16 {
 fn build_router() -> Router {
    #[cfg(feature = "python-config")]
    if let Ok(config_path) = std::env::var("LITELLM_CONFIG_PATH") {
-        match python::config::load_router_from_config(&config_path) {
-            Ok(router) => {
+        match load_model_list(std::path::Path::new(&config_path)) {
+            Ok(deployments) => {
                eprintln!("loaded model_list from {config_path} via python config reader");
-                return router;
+                return Router::new(deployments);
            }
            Err(err) => {
                eprintln!("config load failed ({err}); falling back to env deployment");
--- a/litellm-rust/crates/ai-gateway/src/python/AGENTS.md
+++ b/litellm-rust/crates/ai-gateway/src/python/AGENTS.md
@ -1,27 +0,0 @@
-# ai-gateway/src/python — Python interop (load-time only)
-
-Functions here embed the Python interpreter (pyo3) and take the GIL to call into
-`litellm` (e.g. read the proxy `model_list`). Compiled only under the
-`python-config` feature.
-
-## Hard rule: non-hot-path functions only
-
-Everything in this folder MUST run **at most once per process lifetime — at
-startup / load time** (config read, warm-up). NEVER call into Python on the
-request path:
-
- No GIL acquisition per request, per connection, or per realtime event.
- No Python call inside a route handler, the router's hot path, or any loop that
-  scales with traffic.
-
-**Why:** the GIL serializes execution and would cap throughput; the realtime data
-path must stay pure Rust. Every acquisition is recorded by `crate::gil` — poll
-`GET /health/gil`, and `total_acquisitions` MUST stay flat under load.
-
-## How to add one
-
-Resolve whatever Python-derived data you need **once at boot** and hand the rest
-of the gateway an owned, plain-Rust value (e.g. build a `Router` from the
-resolved `model_list`). Record the acquisition via `crate::gil::record_acquisition()`
-immediately before taking the GIL. If a function would need to run per request,
-it does not belong here — move the work to Rust, or pre-resolve it at startup.
--- a/litellm-rust/crates/ai-gateway/src/python/config.rs
+++ b/litellm-rust/crates/ai-gateway/src/python/config.rs
@ -1,37 +0,0 @@
-//! Build the router by calling the Python proxy config reader (load time only).
-//!
-//! Embeds the interpreter via pyo3 and calls
-//! `litellm.proxy.read_model_list.read_model_list`, which reuses the proxy's
-//! `os.environ/` + secret-manager resolution. The GIL is taken **once at boot**
-//! (and recorded in [`crate::gil`]); the realtime hot path never touches Python.
-//!
-//! Compiled only under the `python-config` feature.
-use litellm_core::error::Error;
-use litellm_core::router::{Deployment, Router};
-use pyo3::prelude::*;
-
-use crate::gil;
-
-/// Load the router's `model_list` from `config_path` via the Python reader.
-pub fn load_router_from_config(config_path: &str) -> Result<Router, Error> {
-    gil::record_acquisition();
-    Python::attach(|py| {
-        let model_list = py
-            .import("litellm.proxy.read_model_list")
-            .and_then(|module| module.getattr("read_model_list"))
-            .and_then(|reader| reader.call1((config_path,)))
-            .map_err(|err| Error::Routing(format!("read_model_list failed: {err}")))?;
-
-        let model_list_json: String = py
-            .import("json")
-            .and_then(|json| json.getattr("dumps"))
-            .and_then(|dumps| dumps.call1((model_list,)))
-            .and_then(|encoded| encoded.extract())
-            .map_err(|err| Error::Routing(format!("serializing model_list failed: {err}")))?;
-
-        let deployments: Vec<Deployment> = serde_json::from_str(&model_list_json)
-            .map_err(|err| Error::Routing(format!("parsing model_list failed: {err}")))?;
-
-        Ok(Router::new(deployments))
-    })
-}
--- a/litellm-rust/crates/ai-gateway/src/python/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/python/mod.rs
@ -1,4 +0,0 @@
-//! Python interop for the gateway. See `AGENTS.md`: **load-time / non-hot-path
-//! only.** Compiled only under the `python-config` feature.
-
-pub mod config;
--- a/litellm-rust/crates/ai-gateway/src/routes/AGENTS.md
+++ b/litellm-rust/crates/ai-gateway/src/routes/AGENTS.md
@ -13,7 +13,7 @@ private). This is the norm — don't split until it hurts.
 pub fn router() -> Router<AppState> { Router::new().route(PATH, get(handle)) }
 async fn handle(...) -> impl IntoResponse { ... }
 ```
-`health.rs` and `gil.rs` are examples.
+`health.rs` is the example.

 ## Split out `service` when there's real logic
 When a route has business logic worth testing without axum, put it in a sibling
--- a/litellm-rust/crates/ai-gateway/src/routes/gil.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/gil.rs
@ -1,30 +0,0 @@
-//! `GET /health/gil` — poll to confirm Python is only touched at load time.
-//! Simple-route template: a `router()` plus its handler, in one file.
-
-use axum::routing::get;
-use axum::{Json, Router};
-use serde::Serialize;
-
-use crate::gil;
-use crate::state::AppState;
-
-/// This route's contribution to the app router.
-pub fn router() -> Router<AppState> {
-    Router::new().route("/health/gil", get(status))
-}
-
-#[derive(Debug, Serialize)]
-struct GilStatusResponse {
-    gil_acquired_last_30s: bool,
-    total_acquisitions: u64,
-    seconds_since_last: Option<u64>,
-}
-
-async fn status() -> Json<GilStatusResponse> {
-    let snapshot = gil::snapshot();
-    Json(GilStatusResponse {
-        gil_acquired_last_30s: snapshot.acquired_last_30s,
-        total_acquisitions: snapshot.total_acquisitions,
-        seconds_since_last: snapshot.seconds_since_last,
-    })
-}
--- a/litellm-rust/crates/ai-gateway/src/routes/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/mod.rs
@ -2,10 +2,9 @@
 //!
 //! **Template:** every route module exposes `pub fn router() -> Router<AppState>`
 //! that mounts its own paths; [`app`] merges them. A trivial route is a single
-//! file (`health.rs`, `gil.rs`); a non-trivial one is a folder (`realtime/`) with
+//! file (`health.rs`); a non-trivial one is a folder (`realtime/`) with
 //! `handler` (entry) + `service` (logic) + `transport` (adapters). See AGENTS.md.

-pub mod gil;
 pub mod health;
 pub mod messages;
 pub mod realtime;
@ -19,7 +18,6 @@ use crate::state::AppState;
 pub fn app(state: AppState) -> Router {
    Router::new()
        .merge(health::router())
-        .merge(gil::router())
        .merge(messages::router())
        .merge(realtime::router())
        .merge(responses::router())
--- a/litellm-rust/crates/config/Cargo.toml
+++ b/litellm-rust/crates/config/Cargo.toml
@ -0,0 +1,16 @@
+[package]
+name = "litellm-config"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+litellm-core.workspace = true
+pyo3 = { workspace = true, features = ["auto-initialize"], optional = true }
+serde_json.workspace = true
+thiserror.workspace = true
+
+[features]
+default = []
+python = ["dep:pyo3"]
--- a/litellm-rust/crates/config/src/error.rs
+++ b/litellm-rust/crates/config/src/error.rs
@ -0,0 +1,11 @@
+use thiserror::Error as ThisError;
+
+#[derive(Debug, ThisError)]
+pub enum Error {
+    #[error("read_model_list failed: {0}")]
+    PythonLoading(String),
+    #[error("serializing model_list failed: {0}")]
+    Serialization(String),
+    #[error("parsing model_list failed: {0}")]
+    ModelListParsing(#[source] serde_json::Error),
+}
--- a/litellm-rust/crates/config/src/lib.rs
+++ b/litellm-rust/crates/config/src/lib.rs
@ -0,0 +1,7 @@
+mod error;
+#[cfg(feature = "python")]
+mod python;
+
+pub use error::Error;
+#[cfg(feature = "python")]
+pub use python::load_model_list;
--- a/litellm-rust/crates/config/src/python.rs
+++ b/litellm-rust/crates/config/src/python.rs
@ -0,0 +1,76 @@
+use std::path::Path;
+
+use litellm_core::router::Deployment;
+use pyo3::prelude::*;
+
+use crate::Error;
+
+pub fn load_model_list(config_path: &Path) -> Result<Vec<Deployment>, Error> {
+    Python::attach(|python| {
+        let model_list = python
+            .import("litellm.proxy.read_model_list")
+            .and_then(|module| module.getattr("read_model_list"))
+            .and_then(|reader| reader.call1((config_path.to_string_lossy().as_ref(),)))
+            .map_err(|error| Error::PythonLoading(error.to_string()))?;
+
+        let model_list_json = python
+            .import("json")
+            .and_then(|json| json.getattr("dumps"))
+            .and_then(|dumps| dumps.call1((model_list,)))
+            .and_then(|encoded| encoded.extract::<String>())
+            .map_err(|error| Error::Serialization(error.to_string()))?;
+
+        parse_model_list(&model_list_json)
+    })
+}
+
+fn parse_model_list(model_list_json: &str) -> Result<Vec<Deployment>, Error> {
+    serde_json::from_str(model_list_json).map_err(Error::ModelListParsing)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_resolved_model_list() {
+        let deployments = parse_model_list(
+            r#"[
+                {
+                    "model_name": "realtime",
+                    "litellm_params": {
+                        "model": "openai/gpt-realtime",
+                        "api_key": "resolved-secret",
+                        "api_base": "https://api.example.test/v1"
+                    }
+                },
+                {
+                    "model_name": "without-optional-values",
+                    "litellm_params": {"model": "openai/gpt-4.1"}
+                }
+            ]"#,
+        )
+        .expect("resolved model list should parse");
+
+        assert_eq!(deployments.len(), 2);
+        assert_eq!(deployments[0].model_name, "realtime");
+        assert_eq!(
+            deployments[0].litellm_params.api_key.as_deref(),
+            Some("resolved-secret")
+        );
+        assert_eq!(
+            deployments[0].litellm_params.api_base.as_deref(),
+            Some("https://api.example.test/v1")
+        );
+        assert_eq!(deployments[1].litellm_params.api_key, None);
+        assert_eq!(deployments[1].litellm_params.api_base, None);
+    }
+
+    #[test]
+    fn malformed_model_list_returns_parsing_error() {
+        let error = parse_model_list(r#"[{"model_name":"missing-params"}]"#)
+            .expect_err("missing litellm_params should fail");
+
+        assert!(matches!(error, Error::ModelListParsing(_)));
+    }
+}
--- a/litellm-rust/crates/core/tests/workspace_crate_allowlist.rs
+++ b/litellm-rust/crates/core/tests/workspace_crate_allowlist.rs
@ -1,6 +1,7 @@
-//! Enforcement: the litellm-rust workspace has exactly four crates.
+//! Enforcement: the litellm-rust workspace has exactly five crates.
 //!
-//! `core` (the Rust SDK), `ai-gateway` (the HTTP/WebSocket host),
+//! `core` (the Rust SDK), `config` (the config-loading boundary),
+//! `ai-gateway` (the HTTP/WebSocket host),
 //! `python-interop` (domain-neutral PyO3 primitives), and `python-bridge` (the
 //! PyO3 cdylib). Adding or removing a crate must be a
 //! deliberate act: this test fails until the allowlist here is updated, forcing
@ -19,13 +20,20 @@ use std::path::{Path, PathBuf};
 /// workspace legitimately gains or loses a crate.
 const EXPECTED_MEMBERS: &[&str] = &[
    "crates/core",
+    "crates/config",
    "crates/ai-gateway",
    "crates/python-interop",
    "crates/python-bridge",
 ];

 /// The crate subdirectory names that must exist under `crates/`.
-const EXPECTED_CRATE_DIRS: &[&str] = &["core", "ai-gateway", "python-interop", "python-bridge"];
+const EXPECTED_CRATE_DIRS: &[&str] = &[
+    "core",
+    "config",
+    "ai-gateway",
+    "python-interop",
+    "python-bridge",
+];

 const MISMATCH: &str = "litellm-rust crate set changed — update this allowlist AND litellm-rust/AGENTS.md, and justify the crate per the rule (crate = layer needing independent compilation / its own deps / a separate artifact).";

--- a/litellm/init.py
+++ b/litellm/init.py
@ -1421,7 +1421,7 @@ from .skills.main import (
 )
 from .containers.main import *
 from .ocr.main import *
-from .rust_bridge import use_litellm_rust
+from .rust_bridge import rust
 from .rag.main import *
 from .sandbox.main import *
 from .search.main import *
--- a/litellm/_redis_credential_provider.py
+++ b/litellm/_redis_credential_provider.py
@ -1,7 +1,7 @@
 import asyncio
 import threading
 import time
-from typing import Any, Final
+from typing import Final, Protocol

 from redis.credentials import CredentialProvider

@ -18,6 +18,19 @@ _token_cache: Final[dict[str, tuple[str, float]]] = {}
 _token_cache_lock: Final = threading.Lock()


+class AzureAccessToken(Protocol):
+    """The ``azure.core.credentials.AccessToken`` shape this module reads."""
+
+    @property
+    def token(self) -> str: ...
+
+
+class AzureCredential(Protocol):
+    """The ``azure-identity`` credential surface this module calls."""
+
+    def get_token(self, *scopes: str) -> AzureAccessToken: ...
+
+
 def _generate_gcp_iam_access_token(service_account: str) -> str:
    """
    Generate GCP IAM access token for Redis authentication.
@ -115,7 +128,7 @@ class AzureADCredentialProvider(CredentialProvider):
    fail authentication after the initial token expired (~1 hour TTL).
    """

-    def __init__(self, credential: Any, username: str | None = None) -> None:
+    def __init__(self, credential: AzureCredential, username: str | None = None) -> None:
        self._credential = credential
        self._username = username

--- a/litellm/_service_logger.py
+++ b/litellm/_service_logger.py
@ -1,7 +1,7 @@
 import asyncio
 from collections.abc import Callable, Coroutine
 from datetime import datetime, timedelta
-from typing import TYPE_CHECKING, Any, Final
+from typing import TYPE_CHECKING, Any, Final, Protocol

 import litellm
 from litellm._logging import verbose_logger
@ -25,7 +25,30 @@ else:
    UserAPIKeyAuth = Any


-def _get_otel_v2_class() -> type | None:
+class _ServiceSpanLogger(Protocol):
+    """The OTel logger surface this module drives: the two service-span hooks it calls."""
+
+    async def async_service_success_hook(
+        self,
+        payload: ServiceLoggerPayload,
+        parent_otel_span: Span | None = None,
+        start_time: datetime | float | None = None,
+        end_time: datetime | float | None = None,
+        event_metadata: dict | None = None,
+    ) -> None: ...
+
+    async def async_service_failure_hook(
+        self,
+        payload: ServiceLoggerPayload,
+        error: str | None = "",
+        parent_otel_span: Span | None = None,
+        start_time: datetime | float | None = None,
+        end_time: datetime | float | None = None,
+        event_metadata: dict | None = None,
+    ) -> None: ...
+
+
+def _get_otel_v2_class() -> type[_ServiceSpanLogger] | None:
    """Return the ``OpenTelemetryV2`` class, or ``None`` if the OTel SDK is absent.

    Imported lazily: ``litellm.integrations.otel.logger`` imports the OpenTelemetry
@ -55,7 +78,7 @@ class ServiceLogging(CustomLogger):
        if "prometheus_system" in litellm.service_callback:
            self.prometheusServicesLogger = PrometheusServicesLogger()

-    def _resolve_otel_service_logger(self, callback: Any) -> Any | None:
+    def _resolve_otel_service_logger(self, callback: object) -> _ServiceSpanLogger | None:
        """Resolve the OTel logger (legacy or V2) to emit a service span on.

        Returns the logger instance whose ``async_service_*_hook`` should fire for
@ -70,18 +93,21 @@ class ServiceLogging(CustomLogger):
        """
        otel_v2_cls: Final = _get_otel_v2_class()

-        def _is_otel_logger(obj: Any) -> bool:
+        def _as_otel_logger(obj: object) -> _ServiceSpanLogger | None:
            if isinstance(obj, OpenTelemetry):
-                return True
-            return otel_v2_cls is not None and isinstance(obj, otel_v2_cls)
+                return obj
+            if otel_v2_cls is not None and isinstance(obj, otel_v2_cls):
+                return obj
+            return None

-        if _is_otel_logger(callback):
-            return callback
+        resolved_callback: Final = _as_otel_logger(callback)
+        if resolved_callback is not None:
+            return resolved_callback
        if callback == "otel":
            from litellm.proxy.proxy_server import open_telemetry_logger

-            if open_telemetry_logger is not None and _is_otel_logger(open_telemetry_logger):
-                return open_telemetry_logger
+            if open_telemetry_logger is not None:
+                return _as_otel_logger(open_telemetry_logger)
        return None

    @staticmethod
--- a/litellm/a2a_protocol/card_resolver.py
+++ b/litellm/a2a_protocol/card_resolver.py
@ -4,6 +4,7 @@ Custom A2A Card Resolver for LiteLLM.
 Extends the A2A SDK's card resolver to support multiple well-known paths.
 """

+from collections.abc import Mapping
 from types import MappingProxyType
 from typing import TYPE_CHECKING, Any, Final

@ -152,7 +153,7 @@ class LiteLLMA2ACardResolver(_A2ACardResolver):
    async def get_agent_card(
        self,
        relative_card_path: str | None = None,
-        http_kwargs: dict[str, Any] | None = None,
+        http_kwargs: Mapping[str, object] | None = None,
    ) -> "AgentCard":
        """
        Fetch the agent card, trying multiple well-known paths.
--- a/litellm/a2a_protocol/providers/bedrock_agentcore/handler.py
+++ b/litellm/a2a_protocol/providers/bedrock_agentcore/handler.py
@ -6,8 +6,8 @@ completion bridge that would otherwise strip the envelope.
 """

 import json
-from collections.abc import AsyncIterator
-from typing import Any, Final, cast
+from collections.abc import AsyncIterator, Mapping
+from typing import Any, Final

 from litellm._logging import verbose_logger
 from litellm.a2a_protocol.providers.bedrock_agentcore.transformation import (
@ -28,7 +28,7 @@ class BedrockAgentCoreA2AHandler:
    @staticmethod
    async def handle_non_streaming(
        request_id: str,
-        params: dict[str, Any],
+        params: Mapping[str, object],
        litellm_params: dict[str, Any],
        agent_extra_headers: dict[str, str] | None = None,
    ) -> dict[str, Any]:
@ -56,7 +56,7 @@ class BedrockAgentCoreA2AHandler:
        verbose_logger.info("BedrockAgentCore A2A: Sending non-streaming request to %s", url)

        client: Final = get_async_httpx_client(
-            llm_provider=cast(Any, httpxSpecialProvider.A2AProvider),
+            llm_provider=httpxSpecialProvider.A2AProvider,
        )
        response: Final = await client.post(
            url,
@ -74,7 +74,7 @@ class BedrockAgentCoreA2AHandler:
    @staticmethod
    async def handle_streaming(
        request_id: str,
-        params: dict[str, Any],
+        params: Mapping[str, object],
        litellm_params: dict[str, Any],
        agent_extra_headers: dict[str, str] | None = None,
    ) -> AsyncIterator[dict[str, Any]]:
@ -103,7 +103,7 @@ class BedrockAgentCoreA2AHandler:
        verbose_logger.info("BedrockAgentCore A2A: Sending streaming request to %s", url)

        client: Final = get_async_httpx_client(
-            llm_provider=cast(Any, httpxSpecialProvider.A2AProvider),
+            llm_provider=httpxSpecialProvider.A2AProvider,
        )
        response: Final = await client.post(
            url,
--- a/litellm/a2a_protocol/providers/bedrock_agentcore/transformation.py
+++ b/litellm/a2a_protocol/providers/bedrock_agentcore/transformation.py
@ -7,7 +7,7 @@ and signs requests via AmazonAgentCoreConfig (SigV4 or JWT).

 import json
 from collections.abc import AsyncIterator, Mapping
-from typing import Any, Final
+from typing import Any, Final, Protocol

 from litellm._logging import verbose_logger
 from litellm.a2a_protocol.litellm_completion_bridge.handler import (
@ -47,6 +47,12 @@ _RESERVED_PREFIX_HEADERS: Final[tuple[str, ...]] = (
 )


+class _SSELineSource(Protocol):
+    """Minimal streaming-response surface used to read SSE lines."""
+
+    def aiter_lines(self) -> AsyncIterator[str]: ...
+
+
 def _filter_reserved_headers(
    agent_extra_headers: Mapping[str, str] | None,
 ) -> dict[str, str] | None:
@ -114,7 +120,7 @@ class BedrockAgentCoreA2ATransformation:
    @staticmethod
    def get_url_and_signed_request(
        request_id: str,
-        params: dict[str, Any],
+        params: Mapping[str, object],
        litellm_params: dict[str, Any],
        method: str = "message/send",
        stream: bool = False,
@ -213,7 +219,7 @@ class BedrockAgentCoreA2ATransformation:
        return url, signed_headers, signed_body

    @staticmethod
-    async def parse_sse_events(response: Any) -> AsyncIterator[dict[str, Any]]:
+    async def parse_sse_events(response: _SSELineSource) -> AsyncIterator[dict[str, Any]]:
        """
        Parse SSE events from an httpx streaming response.

--- a/litellm/a2a_protocol/providers/watsonx_orchestrate/transformation.py
+++ b/litellm/a2a_protocol/providers/watsonx_orchestrate/transformation.py
@ -8,7 +8,7 @@ WXO uses a REST API (not A2A/JSON-RPC) with an async-poll execution model:
 """

 import asyncio
-from collections.abc import AsyncIterator
+from collections.abc import AsyncIterator, Mapping
 from typing import Any, Final
 from uuid import uuid4

@ -51,9 +51,9 @@ class WatsonxOrchestrateTransformation:
        wxo_agent_id: str,
        text: str,
        thread_id: str | None = None,
-    ) -> dict[str, Any]:
+    ) -> dict[str, object]:
        """Build the WXO POST /v1/orchestrate/runs request body."""
-        body: Final[dict[str, Any]] = {
+        body: Final[dict[str, object]] = {
            "agent_id": wxo_agent_id,
            "message": {
                "role": "user",
@ -70,7 +70,7 @@ class WatsonxOrchestrateTransformation:
        return body

    @staticmethod
-    def extract_text_from_wxo_result(result: Any) -> str:
+    def extract_text_from_wxo_result(result: object) -> str:
        """
        Extract response text from a WXO run result.

@ -103,7 +103,7 @@ class WatsonxOrchestrateTransformation:
        return ""

    @staticmethod
-    def extract_text_from_a2a_message_response(a2a_response: dict[str, Any]) -> str:
+    def extract_text_from_a2a_message_response(a2a_response: Mapping[str, object]) -> str:
        result: Final = a2a_response.get("result")
        if not isinstance(result, dict):
            verbose_logger.warning("WXO: A2A response missing result object")
@ -119,7 +119,7 @@ class WatsonxOrchestrateTransformation:
        return ""

    @staticmethod
-    def build_a2a_message_response(request_id: str, text: str) -> dict[str, Any]:
+    def build_a2a_message_response(request_id: str, text: str) -> dict[str, object]:
        """
        Build a standard A2A non-streaming SendMessageResponse (kind=message).
        """
@ -140,7 +140,7 @@ class WatsonxOrchestrateTransformation:
        request_id: str,
        chunk_size: int = 50,
        delay_ms: int = 10,
-    ) -> AsyncIterator[dict[str, Any]]:
+    ) -> AsyncIterator[dict[str, object]]:
        """
        Emit standard A2A streaming events from a completed text response.

--- a/litellm/a2a_protocol/streaming_iterator.py
+++ b/litellm/a2a_protocol/streaming_iterator.py
@ -148,9 +148,9 @@ class A2AStreamingIterator:
        except Exception as e:
            verbose_logger.debug("Error in A2A streaming completion handler: %s", e)

-    def _build_logging_result(self, usage: litellm.Usage) -> dict[str, Any]:
+    def _build_logging_result(self, usage: litellm.Usage) -> dict[str, object]:
        """Build a result dict for logging."""
-        result: Final[dict[str, Any]] = {
+        result: Final[dict[str, object]] = {
            "id": getattr(self.request, "id", "unknown"),
            "jsonrpc": "2.0",
            "usage": (usage.model_dump() if hasattr(usage, "model_dump") else dict(usage)),
--- a/litellm/a2a_protocol/utils.py
+++ b/litellm/a2a_protocol/utils.py
@ -48,7 +48,7 @@ class A2ARequestUtils:
        return " ".join(text_parts)

    @staticmethod
-    def extract_text_from_response(response_dict: dict[str, Any]) -> str:
+    def extract_text_from_response(response_dict: Mapping[str, object]) -> str:
        """
        Extract text content from A2A response result.

@ -111,7 +111,7 @@ class A2ARequestUtils:
    @staticmethod
    def calculate_usage_from_request_response(
        request: "SendMessageRequest | SendStreamingMessageRequest",
-        response_dict: dict[str, Any],
+        response_dict: Mapping[str, object],
    ) -> tuple[int, int, int]:
        """
        Calculate token usage from A2A request and response.
@ -170,5 +170,5 @@ def extract_text_from_a2a_message(message: Any) -> str:
    return A2ARequestUtils.extract_text_from_message(message)


-def extract_text_from_a2a_response(response_dict: dict[str, Any]) -> str:
+def extract_text_from_a2a_response(response_dict: Mapping[str, object]) -> str:
    return A2ARequestUtils.extract_text_from_response(response_dict)
--- a/litellm/assistants/utils.py
+++ b/litellm/assistants/utils.py
@ -1,3 +1,4 @@
+from collections.abc import Mapping, Sequence
 from typing import Final

 import litellm
@ -10,20 +11,22 @@ def get_optional_params_add_message(
    role: str | None,
    content: str | list[MessageContentTextObject | MessageContentImageFileObject | MessageContentImageURLObject] | None,
    attachments: list[Attachment] | None,
-    metadata: dict | None,
+    metadata: Mapping[str, object] | None,
    custom_llm_provider: str,
-    **kwargs,
-):
+    **kwargs: object,
+) -> dict[str, object]:
    """
    Azure doesn't support 'attachments' for creating a message

    Reference - https://learn.microsoft.com/en-us/azure/ai-services/openai/assistants-reference-messages?tabs=python#create-message
    """
-    passed_params: Final = locals()
-    custom_llm_provider = passed_params.pop("custom_llm_provider")
-    special_params: Final = passed_params.pop("kwargs")
-    for k, v in special_params.items():
-        passed_params[k] = v
+    passed_params: Final[Mapping[str, object]] = {
+        "role": role,
+        "content": content,
+        "attachments": attachments,
+        "metadata": metadata,
+        **kwargs,
+    }

    default_params: Final = {
        "role": None,
@ -33,10 +36,10 @@ def get_optional_params_add_message(
    }

    non_default_params = {k: v for k, v in passed_params.items() if (k in default_params and v != default_params[k])}
-    optional_params = {}
+    optional_params: dict[str, object] = {}

    ## raise exception if non-default value passed for non-openai/azure embedding calls
-    def _check_valid_arg(supported_params):
+    def _check_valid_arg(supported_params: Sequence[str]) -> Mapping[str, object] | None:
        if len(non_default_params.keys()) > 0:
            keys: Final = list(non_default_params.keys())
            for k in keys:
@ -71,14 +74,18 @@ def get_optional_params_image_gen(
    style: str | None = None,
    user: str | None = None,
    custom_llm_provider: str | None = None,
-    **kwargs,
-):
+    **kwargs: object,
+) -> dict[str, object]:
    # retrieve all parameters passed to the function
-    passed_params: Final = locals()
-    custom_llm_provider = passed_params.pop("custom_llm_provider")
-    special_params: Final = passed_params.pop("kwargs")
-    for k, v in special_params.items():
-        passed_params[k] = v
+    passed_params: Final[Mapping[str, object]] = {
+        "n": n,
+        "quality": quality,
+        "response_format": response_format,
+        "size": size,
+        "style": style,
+        "user": user,
+        **kwargs,
+    }

    default_params: Final = {
        "n": None,
@ -90,10 +97,10 @@ def get_optional_params_image_gen(
    }

    non_default_params = {k: v for k, v in passed_params.items() if (k in default_params and v != default_params[k])}
-    optional_params = {}
+    optional_params: dict[str, object] = {}

    ## raise exception if non-default value passed for non-openai/azure embedding calls
-    def _check_valid_arg(supported_params):
+    def _check_valid_arg(supported_params: Sequence[str]) -> Mapping[str, object] | None:
        if len(non_default_params.keys()) > 0:
            keys: Final = list(non_default_params.keys())
            for k in keys:
--- a/litellm/batches/batch_utils.py
+++ b/litellm/batches/batch_utils.py
@ -160,7 +160,7 @@ def _classify_output_line_stats(


 def _safe_output_line_stats(
-    entry: Mapping[str, Any],
+    entry: Mapping[str, object],
    custom_llm_provider: Literal["openai", "azure", "vertex_ai", "hosted_vllm", "anthropic", "bedrock"],
    model_name: str | None,
    model_info: ModelInfo | None,
@ -182,7 +182,7 @@ def _safe_output_line_stats(


 def _compute_output_line_stats(
-    entry: Mapping[str, Any],
+    entry: Mapping[str, object],
    custom_llm_provider: Literal["openai", "azure", "vertex_ai", "hosted_vllm", "anthropic", "bedrock"],
    model_name: str | None,
    model_info: ModelInfo | None,
@ -213,7 +213,7 @@ def _compute_output_line_stats(


 def _output_line_cost(
-    response_body: Mapping[str, Any],
+    response_body: Mapping[str, object],
    usage: Usage,
    custom_llm_provider: Literal["openai", "azure", "vertex_ai", "hosted_vllm", "anthropic", "bedrock"],
    model_name: str | None,
@ -556,7 +556,7 @@ def _iter_batch_output_entries(file_content: bytes) -> Iterator[dict]:

 def _parse_batch_output_line(line: bytes) -> dict | None:
    try:
-        parsed: Final = json.loads(line)
+        parsed: Final[object] = json.loads(line)
    except ValueError as e:
        verbose_logger.warning("skipping malformed batch output line: %s", str(e))
        return None
@ -601,7 +601,7 @@ def _count_entry_tokens(
    return 0


-def _count_prompt_or_input_tokens(model: str, value: Any) -> int:
+def _count_prompt_or_input_tokens(model: str, value: object) -> int:
    """Token-count a ``prompt`` / ``input`` field that the OpenAI batch
    schema allows in four shapes:

@ -680,7 +680,7 @@ def _get_anthropic_result_from_batch_results_line(batch_results_line: Mapping[st

 def _get_response_from_batch_job_output_file(
    batch_job_output_file: Mapping[str, Any], custom_llm_provider: str = "openai"
-) -> Mapping[str, Any]:
+) -> Mapping[str, object]:
    """
    Get the response from the batch job output file
    """
--- a/litellm/caching/caching_handler.py
+++ b/litellm/caching/caching_handler.py
@ -672,7 +672,7 @@ class LLMCachingHandler:
    def _async_log_cache_hit_on_callbacks(
        self,
        logging_obj: LiteLLMLoggingObj,
-        cached_result: Any,
+        cached_result: object,
        start_time: datetime.datetime,
        end_time: datetime.datetime,
        cache_hit: bool,
@ -1184,7 +1184,7 @@ class LLMCachingHandler:
        logging_obj: LiteLLMLoggingObj,
        model: str,
        kwargs: dict[str, Any],
-        cached_result: Any,
+        cached_result: object,
        is_async: bool,
        is_embedding: bool = False,
        custom_llm_provider: str | None = None,
--- a/litellm/caching/dual_cache.py
+++ b/litellm/caching/dual_cache.py
@ -257,7 +257,7 @@ class DualCache(BaseCache):
        self,
        current_time: float,
        keys: list[str],
-        result: Sequence[Any],
+        result: Sequence[object],
    ) -> tuple[list[str], dict[str, float | None]]:
        """
        Atomically choose keys to fetch from Redis and reserve their access time.
--- a/litellm/caching/redis_semantic_cache.py
+++ b/litellm/caching/redis_semantic_cache.py
@ -116,7 +116,7 @@ class RedisSemanticCache(BaseCache):
                password = password or os.environ["REDIS_PASSWORD"]
            except KeyError as e:
                # Raise a more informative exception if any of the required keys are missing
-                missing_var: Final = e.args[0]
+                missing_var: Final[object] = e.args[0]
                raise ValueError(
                    f"Missing required Redis configuration: {missing_var}. Provide {missing_var} or redis_url."
                ) from e
@ -273,7 +273,7 @@ class RedisSemanticCache(BaseCache):
        return prompt or None

    @classmethod
-    def _collect_responses_input_text(cls, value: Any, prompt_parts: list[str]) -> None:
+    def _collect_responses_input_text(cls, value: object, prompt_parts: list[str]) -> None:
        value = cls._coerce_response_input_value(value)
        if value is None:
            return
@ -334,7 +334,7 @@ class RedisSemanticCache(BaseCache):
            resolve_embedding_max_input_tokens(self.embedding_max_input_tokens, self.embedding_model, router),
        )

-    def _get_embedding(self, prompt: str, metadata: dict[str, Any] | None = None) -> list[float]:
+    def _get_embedding(self, prompt: str, metadata: dict[str, object] | None = None) -> list[float]:
        """
        Routes through the proxy Router when the embedding model is a Router
        deployment so per-deployment auth (e.g. Bedrock aws_role_name) applies,
@ -425,7 +425,7 @@ class RedisSemanticCache(BaseCache):

            prompt_embedding: Final = self._get_embedding(prompt, metadata=kwargs.get("metadata"))

-            store_kwargs: Final[dict[str, Any]] = {
+            store_kwargs: Final[dict[str, object]] = {
                "vector": prompt_embedding,
                "filters": self._get_cache_filters(key),
            }
@ -504,7 +504,7 @@ class RedisSemanticCache(BaseCache):
            print_verbose(f"Error retrieving from Redis semantic cache: {e}")
            kwargs.setdefault("metadata", {})["semantic-similarity"] = 0.0

-    async def _get_async_embedding(self, prompt: str, metadata: dict[str, Any] | None = None) -> list[float]:
+    async def _get_async_embedding(self, prompt: str, metadata: dict[str, object] | None = None) -> list[float]:
        """
        Asynchronously generate an embedding for the given prompt.

@ -571,7 +571,7 @@ class RedisSemanticCache(BaseCache):
            # Generate embedding for the value (response) to cache
            prompt_embedding: Final = await self._get_async_embedding(prompt, metadata=kwargs.get("metadata"))

-            store_kwargs: Final[dict[str, Any]] = {
+            store_kwargs: Final[dict[str, object]] = {
                "vector": prompt_embedding,
                "filters": self._get_cache_filters(key),
            }
@ -665,7 +665,7 @@ class RedisSemanticCache(BaseCache):
        aindex: Final = await self.llmcache._get_async_index()
        return await aindex.info()

-    async def async_set_cache_pipeline(self, cache_list: list[tuple[str, Any]], **kwargs: object) -> None:
+    async def async_set_cache_pipeline(self, cache_list: list[tuple[str, object]], **kwargs: object) -> None:
        """
        Asynchronously store multiple values in the semantic cache.

--- a/litellm/compression/compress.py
+++ b/litellm/compression/compress.py
@ -66,7 +66,7 @@ def _build_retrieval_tools(keys: list[str], call_type: str) -> list[dict]:
    return cast(list[dict], anthropic_tools)


-def _content_to_text(content: Any) -> str:
+def _content_to_text(content: object) -> str:
    """
    Convert OpenAI/Anthropic message content blocks to plain text.

@ -78,7 +78,7 @@ def _content_to_text(content: Any) -> str:
    Implemented iteratively (stack-based) to avoid unbounded recursion.
    """
    parts: Final[list[str]] = []
-    stack: Final[list[Any]] = [content]
+    stack: Final[list[object]] = [content]
    while stack:
        item = stack.pop()
        if isinstance(item, str):
@ -111,7 +111,7 @@ def _normalize_messages_for_compression(
            f"Unsupported call_type={call_type!r} for compression. Expected one of: {sorted(_SUPPORTED_CALL_TYPES)}."
        )

-    original_messages: Final[list[dict[str, Any]]] = [dict(m) for m in messages]
+    original_messages: Final[list[dict[str, object]]] = [dict(m) for m in messages]

    normalized_messages: Final[list[dict]] = []
    for msg in original_messages:
@ -132,7 +132,7 @@ def _extract_last_user_message(messages: list[dict]) -> str:
    return ""


-def _extract_tool_use_ids(content: Any) -> list[str]:
+def _extract_tool_use_ids(content: object) -> list[str]:
    if not isinstance(content, list):
        return []
    tool_use_ids: Final[list[str]] = []
@ -147,7 +147,7 @@ def _extract_tool_use_ids(content: Any) -> list[str]:
    return tool_use_ids


-def _extract_tool_result_ids(content: Any) -> set[str]:
+def _extract_tool_result_ids(content: object) -> set[str]:
    if not isinstance(content, list):
        return set()
    tool_result_ids: Final[set[str]] = set()
@ -337,7 +337,7 @@ def compress(
    compression_trigger: int = 200_000,
    compression_target: int | None = None,
    embedding_model: str | None = None,
-    embedding_model_params: dict[str, Any] | None = None,
+    embedding_model_params: Mapping[str, object] | None = None,
    compression_cache: DualCache | None = None,
 ) -> CompressedResult:
    """
--- a/litellm/compression/scoring/embedding_scorer.py
+++ b/litellm/compression/scoring/embedding_scorer.py
@ -5,6 +5,7 @@ Computes cosine similarity between the query embedding and each message embeddin
 """

 import math
+from collections.abc import Mapping
 from typing import Any, Final

 from litellm.caching.dual_cache import DualCache
@ -49,7 +50,7 @@ def embedding_score_messages(
    messages: list[dict],
    model: str,
    cache: DualCache | None = None,
-    embedding_model_params: dict[str, Any] | None = None,
+    embedding_model_params: Mapping[str, object] | None = None,
 ) -> list[float]:
    """
    Score each message's semantic similarity to the query using embeddings.
--- a/litellm/constants.py
+++ b/litellm/constants.py
@ -40,7 +40,7 @@ ROUTER_SETTINGS_MANAGED_OUTSIDE_CONFIG: Final[frozenset[str]] = frozenset(
        "router_general_settings",
        "ignore_invalid_deployments",
        "fallback_access_check",
-        "heuristic_v2_router_limit",
+        "auto_router_capability_limit",
    }
 )
 DEFAULT_BATCH_SIZE: Final = int(os.getenv("DEFAULT_BATCH_SIZE", 512))
--- a/litellm/containers/endpoint_factory.py
+++ b/litellm/containers/endpoint_factory.py
@ -11,7 +11,7 @@ import json
 from collections.abc import Callable
 from functools import partial
 from pathlib import Path
-from typing import Any, Final, Literal
+from typing import Final, Literal

 import litellm
 from litellm.constants import request_timeout as DEFAULT_REQUEST_TIMEOUT
@ -56,9 +56,9 @@ def create_sync_endpoint_function(endpoint_config: dict) -> Callable:
    def endpoint_func(
        timeout: int = 600,
        custom_llm_provider: Literal["openai", "azure", "azure_text"] = "openai",
-        extra_headers: dict[str, Any] | None = None,
-        extra_query: dict[str, Any] | None = None,
-        extra_body: dict[str, Any] | None = None,
+        extra_headers: dict[str, object] | None = None,
+        extra_query: dict[str, object] | None = None,
+        extra_body: dict[str, object] | None = None,
        **kwargs,
    ):
        local_vars: Final = locals()
@ -145,9 +145,9 @@ def create_async_endpoint_function(
    async def async_endpoint_func(
        timeout: int = 600,
        custom_llm_provider: Literal["openai", "azure", "azure_text"] = "openai",
-        extra_headers: dict[str, Any] | None = None,
-        extra_query: dict[str, Any] | None = None,
-        extra_body: dict[str, Any] | None = None,
+        extra_headers: dict[str, object] | None = None,
+        extra_query: dict[str, object] | None = None,
+        extra_body: dict[str, object] | None = None,
        **kwargs,
    ):
        local_vars: Final = locals()
--- a/litellm/exceptions.py
+++ b/litellm/exceptions.py
@ -85,7 +85,7 @@ _RATE_LIMIT_CATEGORY_VALUES: Final = frozenset(c.value for c in RateLimitErrorCa
 _RATE_LIMIT_TYPE_VALUES: Final = frozenset(t.value for t in RateLimitType)


-def validate_rate_limit_category(value: Any) -> str | None:
+def validate_rate_limit_category(value: object) -> str | None:
    """Return ``value`` only if it matches a known :class:`RateLimitErrorCategory`.

    Used at duck-typed read sites (StandardLoggingPayload extraction, Prometheus
@ -100,7 +100,7 @@ def validate_rate_limit_category(value: Any) -> str | None:
    return None


-def validate_rate_limit_type(value: Any) -> str | None:
+def validate_rate_limit_type(value: object) -> str | None:
    """Return ``value`` only if it matches a known :class:`RateLimitType`.

    See :func:`validate_rate_limit_category` for the rationale.
--- a/litellm/experimental_mcp_client/client.py
+++ b/litellm/experimental_mcp_client/client.py
@ -6,17 +6,35 @@ import asyncio
 import base64
 import os
 from collections.abc import Awaitable, Callable, Generator
+from contextlib import AbstractAsyncContextManager
 from datetime import timedelta
 from functools import partial
 from importlib import metadata
-from typing import Any, Final, TypeVar
+from typing import Any, Final, Protocol, TypeAlias, TypeVar

 import httpx
+from anyio.streams.memory import MemoryObjectReceiveStream, MemoryObjectSendStream
 from mcp import ClientSession, McpError, ReadResourceResult, Resource, StdioServerParameters
 from mcp.client.sse import sse_client
 from mcp.client.stdio import stdio_client
+from mcp.shared.message import SessionMessage
+from typing_extensions import Unpack

-streamable_http_client: Any | None = None
+_TransportStreams: TypeAlias = tuple[
+    MemoryObjectReceiveStream[SessionMessage | Exception],
+    MemoryObjectSendStream[SessionMessage],
+    Unpack[tuple[object, ...]],
+]
+_TransportContext: TypeAlias = AbstractAsyncContextManager[_TransportStreams]
+
+
+class _StreamableHttpClientFactory(Protocol):
+    """The ``streamable_http_client`` entry point this module calls on the installed MCP SDK."""
+
+    def __call__(self, *, url: str, http_client: httpx.AsyncClient | None) -> _TransportContext: ...
+
+
+streamable_http_client: _StreamableHttpClientFactory | None = None
 try:
    import mcp.client.streamable_http as streamable_http_module

@ -216,10 +234,12 @@ class MCPSigV4Auth(httpx.Auth):
        aws_region_name: str,
    ):
        """Call STS AssumeRole and return temporary credentials."""
+        import time
+
        import boto3
        from botocore.credentials import Credentials

-        session_name: Final = aws_session_name or f"litellm-mcp-{int(__import__('time').time())}"
+        session_name: Final = aws_session_name or f"litellm-mcp-{int(time.time())}"
        sts_kwargs: Final[dict] = {"region_name": aws_region_name}
        if aws_access_key_id and aws_secret_access_key:
            sts_kwargs["aws_access_key_id"] = aws_access_key_id
@ -315,7 +335,7 @@ class MCPClient:

    def _create_transport_context(
        self,
-    ) -> tuple[Any, httpx.AsyncClient | None]:
+    ) -> tuple[_TransportContext, httpx.AsyncClient | None]:
        """
        Create the appropriate transport context based on transport type.
        Returns:
@ -408,7 +428,7 @@ class MCPClient:

    async def _execute_session_operation(
        self,
-        transport_ctx: Any,
+        transport_ctx: _TransportContext,
        operation: Callable[[ClientSession], Awaitable[TSessionResult]],
    ) -> TSessionResult:
        """
--- a/litellm/files/main.py
+++ b/litellm/files/main.py
@ -14,6 +14,7 @@ from functools import partial
 from typing import Any, Final, Literal, cast

 import httpx
+from openai import AsyncOpenAI, OpenAI

 # Type aliases for provider parameters
 FileCreateProvider = Literal[
@ -431,7 +432,7 @@ async def afile_delete(
    extra_headers: dict[str, str] | None = None,
    extra_body: dict[str, str] | None = None,
    **kwargs,
-) -> Coroutine[Any, Any, FileObject]:
+) -> Coroutine[object, object, FileObject]:
    """
    Async: Delete file

@ -1002,8 +1003,8 @@ def file_content_streaming(
    timeout: float | httpx.Timeout,
    logging_obj: LiteLLMLoggingObj | None,
    _is_async: bool,
-    client: Any | None,
-) -> FileContentStreamingResult | Coroutine[Any, Any, FileContentStreamingResult]:
+    client: OpenAI | AsyncOpenAI | None,
+) -> FileContentStreamingResult | Coroutine[object, object, FileContentStreamingResult]:
    if logging_obj is not None:
        logging_obj.model = model or ""
        logging_obj.model_call_details["model"] = model or ""
@ -1028,8 +1029,8 @@ def file_content_streaming(
            headers=response.headers,
        )

-    response: FileContentStreamingResult | Coroutine[Any, Any, FileContentStreamingResult] = FileContentStreamingResult(
-        stream_iterator=iter(()), headers={}
+    response: FileContentStreamingResult | Coroutine[object, object, FileContentStreamingResult] = (
+        FileContentStreamingResult(stream_iterator=iter(()), headers={})
    )
    if custom_llm_provider in OPENAI_COMPATIBLE_BATCH_AND_FILES_PROVIDERS:
        openai_creds: Final = get_openai_credentials(
--- a/litellm/fine_tuning/main.py
+++ b/litellm/fine_tuning/main.py
@ -11,7 +11,7 @@ https://platform.openai.com/docs/api-reference/fine-tuning
 import asyncio
 import contextvars
 import os
-from collections.abc import Coroutine
+from collections.abc import Coroutine, Mapping
 from functools import partial
 from typing import Any, Final, Literal

@ -37,8 +37,8 @@ vertex_fine_tuning_apis_instance: Final = VertexFineTuningAPI()

 def _prepare_azure_extra_body(
    extra_body: dict[str, Any] | None,
-    kwargs: dict[str, Any],
-    azure_specific_hyperparams: dict[str, Any],
+    kwargs: Mapping[str, object],
+    azure_specific_hyperparams: Mapping[str, object],
 ) -> dict[str, Any]:
    """
    Prepare extra_body for Azure fine-tuning API by combining Azure-specific parameters.
@ -138,7 +138,7 @@ def _build_fine_tuning_job_data(model, training_file, hyperparameters, suffix, v


 def _resolve_fine_tuning_timeout(
-    timeout: Any,
+    timeout: float | str | httpx.Timeout | None,
    custom_llm_provider: str,
 ) -> float | httpx.Timeout:
    """Normalise a raw timeout value to a float (seconds) or httpx.Timeout for fine-tuning calls."""
@ -163,7 +163,7 @@ def create_fine_tuning_job(
    extra_headers: dict[str, str] | None = None,
    extra_body: dict[str, str] | None = None,
    **kwargs,
-) -> LiteLLMFineTuningJob | Coroutine[Any, Any, LiteLLMFineTuningJob]:
+) -> LiteLLMFineTuningJob | Coroutine[object, object, LiteLLMFineTuningJob]:
    """
    Creates a fine-tuning job which begins the process of creating a new model from a given dataset.

@ -375,7 +375,7 @@ def cancel_fine_tuning_job(
    extra_headers: dict[str, str] | None = None,
    extra_body: dict[str, str] | None = None,
    **kwargs,
-) -> LiteLLMFineTuningJob | Coroutine[Any, Any, LiteLLMFineTuningJob]:
+) -> LiteLLMFineTuningJob | Coroutine[object, object, LiteLLMFineTuningJob]:
    """
    Immediately cancel a fine-tune job.

@ -682,7 +682,7 @@ def retrieve_fine_tuning_job(
    extra_headers: dict[str, str] | None = None,
    extra_body: dict[str, str] | None = None,
    **kwargs,
-) -> LiteLLMFineTuningJob | Coroutine[Any, Any, LiteLLMFineTuningJob]:
+) -> LiteLLMFineTuningJob | Coroutine[object, object, LiteLLMFineTuningJob]:
    """
    Get info about a fine-tuning job.
    """
--- a/litellm/images/utils.py
+++ b/litellm/images/utils.py
@ -1,3 +1,4 @@
+from collections.abc import Mapping
 from io import BufferedReader, BytesIO
 from typing import Any, Final, cast, get_type_hints

@ -61,7 +62,7 @@ class ImageEditRequestUtils:

    @staticmethod
    def get_requested_image_edit_optional_param(
-        params: dict[str, Any],
+        params: Mapping[str, object],
    ) -> ImageEditOptionalRequestParams:
        """
        Filter parameters to only include those defined in ImageEditOptionalRequestParams.
--- a/litellm/integrations/arize/_utils.py
+++ b/litellm/integrations/arize/_utils.py
@ -2,7 +2,7 @@ import json
 from collections.abc import Mapping
 from typing import TYPE_CHECKING, Any, Final

-from typing_extensions import override
+from typing_extensions import ReadOnly, TypedDict, override

 from litellm._logging import verbose_logger
 from litellm.integrations.opentelemetry_utils.base_otel_llm_obs_attributes import (
@ -492,12 +492,12 @@ def _sanitize_optional_params(optional_params: dict | None) -> dict:
    return optional_params


-def _set_metadata_attributes(span: "Span", metadata: Any | None, span_attrs) -> None:
+def _set_metadata_attributes(span: "Span", metadata: object | None, span_attrs) -> None:
    if metadata is not None:
        safe_set_attribute(span, span_attrs.METADATA, safe_dumps(metadata))


-def _extract_metadata_tools(metadata: Any | None) -> list | None:
+def _extract_metadata_tools(metadata: object | None) -> list | None:
    if not isinstance(metadata, dict):
        return None
    llm_obj: Final = metadata.get("llm")
@ -670,7 +670,22 @@ def _get_tool_calls(message) -> list | None:
    return tool_calls if isinstance(tool_calls, list) and tool_calls else None


-def _normalize_tool_call(raw_tc) -> dict[str, Any] | None:
+class _NormalizedToolCallFunction(TypedDict):
+    """The ``function`` sub-object of a normalized tool call."""
+
+    name: ReadOnly[object]
+    arguments: ReadOnly[object]
+
+
+class _NormalizedToolCall(TypedDict):
+    """A tool call reduced to the stable shape the OpenInference emitters read."""
+
+    id: ReadOnly[object]
+    type: ReadOnly[object]
+    function: ReadOnly[_NormalizedToolCallFunction]
+
+
+def _normalize_tool_call(raw_tc) -> _NormalizedToolCall | None:
    """Normalize a single tool_call (dict or Pydantic) into a stable shape:

        {"id": str|None, "type": str, "function": {"name": str|None, "arguments": str|None}}
--- a/litellm/integrations/cloudzero/database.py
+++ b/litellm/integrations/cloudzero/database.py
@ -94,8 +94,18 @@ class LiteLLMDatabase:

        try:
            db_response: Final = await client.db.query_raw(query, *params)
-            # Convert the response to polars DataFrame with full schema inference
-            # This prevents schema mismatch errors when data types vary across rows
-            return pl.DataFrame(db_response, infer_schema_length=None)
+            from litellm.proxy.spend_tracking.key_metadata_recovery import (
+                fill_missing_api_key_aliases,
+            )
+
+            usage_rows: Final = (
+                db_response.to_dicts()
+                if isinstance(db_response, pl.DataFrame)
+                else db_response
+                if isinstance(db_response, list)
+                else []
+            )
+            recovered_rows: Final = await fill_missing_api_key_aliases(client, usage_rows)
+            return pl.DataFrame([dict(row) for row in recovered_rows], infer_schema_length=None)
        except Exception as e:
            raise Exception(f"Error retrieving usage data: {e}")
--- a/litellm/integrations/datadog/datadog_cost_management.py
+++ b/litellm/integrations/datadog/datadog_cost_management.py
@ -1,6 +1,7 @@
 import asyncio
 import os
 import time
+from collections.abc import Mapping
 from datetime import datetime
 from typing import Any, Final, cast

@ -181,7 +182,7 @@ class DatadogCostManagementLogger(CustomBatchLogger):

        # cast because StandardLoggingMetadata is a TypedDict; we iterate it
        # as a generic mapping below.
-        metadata: Final[dict[str, Any]] = cast(dict[str, Any], log.get("metadata") or {})
+        metadata: Final[Mapping[str, object]] = cast(dict[str, Any], log.get("metadata") or {})

        # Backwards-compat: team/user/model_group preserved regardless of allowlist.
        if metadata.get("user_api_key_alias"):
@ -233,7 +234,7 @@ class DatadogCostManagementLogger(CustomBatchLogger):
        tags[key] = normalize_datadog_tag_value(value)

    @staticmethod
-    def _add_tag(tags: dict[str, str], key: str, value: Any) -> None:
+    def _add_tag(tags: dict[str, str], key: str, value: object) -> None:
        if value:
            tags[key] = str(value)

--- a/litellm/integrations/datadog/datadog_llm_obs.py
+++ b/litellm/integrations/datadog/datadog_llm_obs.py
@ -19,7 +19,7 @@ import httpx
 import litellm
 from litellm._logging import verbose_logger
 from litellm._uuid import uuid
-from litellm.constants import REDACTED_BY_LITELLM
+from litellm.constants import REDACTED_BY_LITELLM, REDACTED_BY_LITELM_STRING
 from litellm.integrations.custom_batch_logger import CustomBatchLogger
 from litellm.integrations.datadog.datadog_handler import (
    get_datadog_base_url_from_env,
@ -46,9 +46,10 @@ from litellm.llms.custom_httpx.http_handler import (
 from litellm.proxy.spend_tracking.savings import extract_cache_creation_tokens, extract_cache_read_tokens
 from litellm.types.integrations.datadog_llm_obs import *
 from litellm.types.utils import (
+    AUDIT_GUARDRAIL_FIELDS,
+    PROMPT_CARRYING_GUARDRAIL_FIELDS,
    PROMPT_QUOTING_ROUTING_DECISION_FIELDS,
    CallTypes,
-    StandardLoggingGuardrailInformation,
    StandardLoggingPayload,
    StandardLoggingPayloadErrorInformation,
 )
@ -60,6 +61,8 @@ _SAFE_REDACTED_MESSAGE_ROLES: Final = frozenset(
    {"agent", "assistant", "developer", "function", "model", "system", "tool", "user"}
 )

+_CLASSIFIED_GUARDRAIL_FIELDS: Final = AUDIT_GUARDRAIL_FIELDS | PROMPT_CARRYING_GUARDRAIL_FIELDS
+
 _PROMPT_CARRYING_METADATA_FIELDS: Final = frozenset(
    {
        "routing_decision",
@ -108,6 +111,49 @@ def _router_span_fields(
    )


+def _guardrail_entries(guardrail_information: object) -> tuple[Mapping[str, object], ...]:
+    """The guardrail records as a sequence, whatever shape the payload carries.
+
+    `guardrail_information` is typed as a list, but a guardrail that writes the metadata key itself
+    can leave a single record there; Prometheus normalizes the same shape at
+    `_guardrail_overhead_seconds`.
+    """
+    if isinstance(guardrail_information, Mapping):
+        return (guardrail_information,)
+    if isinstance(guardrail_information, (list, tuple)):
+        return tuple(entry for entry in guardrail_information if isinstance(entry, Mapping))
+    return ()
+
+
+def _guardrail_entry_without_prompt_carriers(entry: Mapping[str, object]) -> Mapping[str, object]:
+    """One guardrail record kept as its audit fields, with the prompt-quoting ones marked redacted.
+
+    Built as an allow-list rather than a deny-list: a key neither set classifies is dropped, so a
+    guardrail that records its own extra detail cannot put the caller's prompt on a redacted span.
+    """
+    return {  # mutable-ok: a fresh record built per entry, handed straight to the span serializer
+        field: REDACTED_BY_LITELM_STRING if field in PROMPT_CARRYING_GUARDRAIL_FIELDS else value
+        for field, value in entry.items()
+        if field in _CLASSIFIED_GUARDRAIL_FIELDS
+    }
+
+
+def _guardrail_information_without_prompt_carriers(
+    guardrail_information: object,
+) -> tuple[Mapping[str, object], ...] | None:
+    """The guardrail records reduced to what a redacted span may carry.
+
+    Redaction removes the prompt, not the record that a guardrail ran: the name, mode, status,
+    timings and masked-entity counts are what an operator reads to answer whether a guardrail
+    caught anything on a request, and none of them reproduce the prompt. Field-level rather than
+    dropping the list, which is what `_sanitize_guardrail_information_for_spend_logs` already does
+    for spend logs.
+    """
+    if guardrail_information is None:
+        return None
+    return tuple(_guardrail_entry_without_prompt_carriers(entry) for entry in _guardrail_entries(guardrail_information))
+
+
 def _metadata_without_prompt_carriers(standard_logging_metadata: Mapping[str, Any]) -> Mapping[str, Any]:
    """The metadata minus the records that quote prompts, tool arguments, tool results, or retrieved text."""
    return MappingProxyType(
@ -872,7 +918,9 @@ class DataDogLLMObsLogger(CustomBatchLogger):
            "cache_key": standard_logging_payload.get("cache_key", "unknown"),
            "saved_cache_cost": standard_logging_payload.get("saved_cache_cost", 0),
            "guardrail_information": (
-                None if redact_prompt_text else standard_logging_payload.get("guardrail_information", None)
+                _guardrail_information_without_prompt_carriers(standard_logging_payload.get("guardrail_information"))
+                if redact_prompt_text
+                else standard_logging_payload.get("guardrail_information", None)
            ),
            "is_streamed_request": self._get_stream_value_from_payload(standard_logging_payload),
            "latency_metrics": dict(self._get_latency_metrics(standard_logging_payload)),
@ -904,14 +952,12 @@ class DataDogLLMObsLogger(CustomBatchLogger):
            latency_metrics["litellm_overhead_time_ms"] = litellm_overhead_ms

        # Guardrail overhead latency
-        guardrail_info: Final[list[StandardLoggingGuardrailInformation] | None] = standard_logging_payload.get(
-            "guardrail_information"
-        )
-        if guardrail_info is not None:
+        guardrail_info: Final = _guardrail_entries(standard_logging_payload.get("guardrail_information"))
+        if guardrail_info:
            total_duration = 0.0
            for info in guardrail_info:
-                _guardrail_duration_seconds: float | None = info.get("duration")
-                if _guardrail_duration_seconds is not None:
+                _guardrail_duration_seconds = info.get("duration")
+                if isinstance(_guardrail_duration_seconds, (int, float, str)):
                    total_duration += float(_guardrail_duration_seconds)

            if total_duration > 0:
--- a/litellm/integrations/dotprompt/dotprompt_manager.py
+++ b/litellm/integrations/dotprompt/dotprompt_manager.py
@ -4,6 +4,7 @@ Builds on top of PromptManagementBase to provide .prompt file support.
 """

 import json
+from collections.abc import Mapping
 from typing import TYPE_CHECKING, Any, Final

 from litellm.integrations.custom_prompt_management import CustomPromptManagement
@ -347,14 +348,14 @@ class DotpromptManager(CustomPromptManagement):
        metadata: Final = json_data.get("metadata", {})
        self.prompt_manager.add_prompt(prompt_id, content, metadata)

-    def load_prompts_from_json(self, prompts_data: dict[str, dict[str, Any]]) -> None:
+    def load_prompts_from_json(self, prompts_data: dict[str, dict[str, object]]) -> None:
        """Load multiple prompts from JSON data."""
        self.prompt_manager.load_prompts_from_json_data(prompts_data)

-    def get_prompts_as_json(self) -> dict[str, dict[str, Any]]:
+    def get_prompts_as_json(self) -> dict[str, dict[str, object]]:
        """Get all prompts in JSON format."""
        return self.prompt_manager.get_all_prompts_as_json()

-    def convert_prompt_file_to_json(self, file_path: str) -> dict[str, Any]:
+    def convert_prompt_file_to_json(self, file_path: str) -> Mapping[str, object]:
        """Convert a .prompt file to JSON format."""
        return self.prompt_manager.prompt_file_to_json(file_path)
--- a/litellm/integrations/focus/database.py
+++ b/litellm/integrations/focus/database.py
@ -96,7 +96,19 @@ class FocusLiteLLMDatabase:

        try:
            db_response: Final = await client.db.query_raw(query, *query_params)
-            return pl.DataFrame(db_response, infer_schema_length=None)
+            from litellm.proxy.spend_tracking.key_metadata_recovery import (
+                fill_missing_api_key_aliases,
+            )
+
+            usage_rows: Final = (
+                db_response.to_dicts()
+                if isinstance(db_response, pl.DataFrame)
+                else db_response
+                if isinstance(db_response, list)
+                else []
+            )
+            recovered_rows: Final = await fill_missing_api_key_aliases(client, usage_rows)
+            return pl.DataFrame([dict(row) for row in recovered_rows], infer_schema_length=None)
        except Exception as exc:
            raise RuntimeError(f"Error retrieving usage data: {exc}") from exc

--- a/litellm/integrations/focus/destinations/s3_destination.py
+++ b/litellm/integrations/focus/destinations/s3_destination.py
@ -3,14 +3,26 @@
 from __future__ import annotations

 import asyncio
+from collections.abc import Mapping
 from datetime import timezone
-from typing import Any, Final
+from typing import Final, TypedDict

 import boto3
+from typing_extensions import ReadOnly

 from .base import FocusDestination, FocusTimeWindow


+class _S3ClientKwargs(TypedDict, total=False):
+    """Optional boto3 client arguments the destination config may supply."""
+
+    region_name: ReadOnly[str]
+    endpoint_url: ReadOnly[str]
+    aws_access_key_id: ReadOnly[str]
+    aws_secret_access_key: ReadOnly[str]
+    aws_session_token: ReadOnly[str]
+
+
 class FocusS3Destination(FocusDestination):
    """Handles uploading serialized exports to S3 buckets."""

@ -18,7 +30,7 @@ class FocusS3Destination(FocusDestination):
        self,
        *,
        prefix: str,
-        config: dict[str, Any] | None = None,
+        config: Mapping[str, str] | None = None,
    ) -> None:
        config = config or {}
        bucket_name: Final = config.get("bucket_name")
@ -47,25 +59,23 @@ class FocusS3Destination(FocusDestination):
        key_prefix: Final = "/".join(filter(None, parts))
        return f"{key_prefix}/{filename}" if key_prefix else filename

+    def _client_kwargs(self) -> _S3ClientKwargs:
+        """Collect the boto3 client arguments the destination config provides."""
+        region: Final = self.config.get("region_name")
+        endpoint: Final = self.config.get("endpoint_url")
+        key_id: Final = self.config.get("aws_access_key_id")
+        secret: Final = self.config.get("aws_secret_access_key")
+        token: Final = self.config.get("aws_session_token")
+        return {
+            **(_S3ClientKwargs(region_name=region) if region else _S3ClientKwargs()),
+            **(_S3ClientKwargs(endpoint_url=endpoint) if endpoint else _S3ClientKwargs()),
+            **(_S3ClientKwargs(aws_access_key_id=key_id) if key_id else _S3ClientKwargs()),
+            **(_S3ClientKwargs(aws_secret_access_key=secret) if secret else _S3ClientKwargs()),
+            **(_S3ClientKwargs(aws_session_token=token) if token else _S3ClientKwargs()),
+        }
+
    def _upload(self, content: bytes, object_key: str) -> None:
-        client_kwargs: Final[dict[str, Any]] = {}
-        region_name: Final = self.config.get("region_name")
-        if region_name:
-            client_kwargs["region_name"] = region_name
-        endpoint_url: Final = self.config.get("endpoint_url")
-        if endpoint_url:
-            client_kwargs["endpoint_url"] = endpoint_url
-
-        session_kwargs: Final[dict[str, Any]] = {}
-        for key in (
-            "aws_access_key_id",
-            "aws_secret_access_key",
-            "aws_session_token",
-        ):
-            if self.config.get(key):
-                session_kwargs[key] = self.config[key]
-
-        s3_client: Final = boto3.client("s3", **client_kwargs, **session_kwargs)
+        s3_client: Final = boto3.client("s3", **self._client_kwargs())
        s3_client.put_object(
            Bucket=self.bucket_name,
            Key=object_key,
--- a/litellm/integrations/focus/focus_logger.py
+++ b/litellm/integrations/focus/focus_logger.py
@ -102,7 +102,7 @@ class FocusLogger(CustomLogger):
            # No time bounds → export all available data
            await self._export_all(limit=limit)

-    async def dry_run_export_usage_data(self, limit: int | None = DEFAULT_DRY_RUN_LIMIT) -> dict[str, Any]:
+    async def dry_run_export_usage_data(self, limit: int | None = DEFAULT_DRY_RUN_LIMIT) -> dict[str, object]:
        """Return transformed data without uploading."""
        engine: Final = self._ensure_engine()
        return await engine.dry_run_export_usage_data(limit=limit)
@ -153,7 +153,7 @@ class FocusLogger(CustomLogger):
            **trigger_kwargs,
        )

-    def _build_scheduler_trigger(self) -> dict[str, Any]:
+    def _build_scheduler_trigger(self) -> dict[str, str | int]:
        """Return scheduler configuration for the selected frequency."""
        if self.frequency == "interval":
            seconds: Final = self.interval_seconds or 60
--- a/litellm/integrations/generic_prompt_management/generic_prompt_manager.py
+++ b/litellm/integrations/generic_prompt_management/generic_prompt_manager.py
@ -4,6 +4,7 @@ Fetches prompts from any API that implements the /beta/litellm_prompt_management
 """

 import json
+from collections.abc import Mapping
 from typing import TYPE_CHECKING, Any, Final

 import httpx
@ -349,7 +350,7 @@ class GenericPromptManager(CustomPromptManagement):
    def _apply_variables(
        self,
        prompt_client: PromptManagementClient,
-        variables: dict[str, Any],
+        variables: Mapping[str, object],
    ) -> PromptManagementClient:
        """
        Apply variables to the prompt template.
--- a/litellm/integrations/humanloop.py
+++ b/litellm/integrations/humanloop.py
@ -4,7 +4,7 @@ Humanloop integration
 https://humanloop.com/
 """

-from typing import Any, Final, cast
+from typing import Final, cast

 import httpx
 from typing_extensions import TypedDict
@ -24,7 +24,7 @@ class PromptManagementClient(TypedDict):
    prompt_id: str
    prompt_template: list[AllMessageValues]
    model: str | None
-    optional_params: dict[str, Any] | None
+    optional_params: dict[str, object] | None


 class HumanLoopPromptManager(DualCache):
@ -36,7 +36,7 @@ class HumanLoopPromptManager(DualCache):
        return cast(PromptManagementClient | None, self.get_cache(key=humanloop_prompt_id))

    def _compile_prompt_helper(
-        self, prompt_template: list[AllMessageValues], prompt_variables: dict[str, Any]
+        self, prompt_template: list[AllMessageValues], prompt_variables: dict[str, object]
    ) -> list[AllMessageValues]:
        """
        Helper function to compile the prompt by substituting variables in the template.
--- a/litellm/integrations/newrelic/newrelic.py
+++ b/litellm/integrations/newrelic/newrelic.py
@ -47,6 +47,8 @@ import os
 import threading
 import time
 import uuid
+from collections.abc import Mapping, Sequence
+from datetime import datetime
 from typing import Any, Final

 import litellm
@ -408,8 +410,8 @@ class NewRelicLogger(CustomLogger):
    def _get_duration(
        self,
        kwargs: dict,
-        start_time: Any,
-        end_time: Any,
+        start_time: datetime | float | None,
+        end_time: datetime | float | None,
        standard_logging_object: StandardLoggingPayload | None = None,
    ) -> float | None:
        """
@ -438,7 +440,7 @@ class NewRelicLogger(CustomLogger):
        self,
        kwargs: dict,
        standard_logging_object: StandardLoggingPayload | None = None,
-    ) -> dict[str, Any]:
+    ) -> dict[str, object]:
        """
        Extract request parameters like temperature and max_tokens, preferring
        StandardLoggingPayload.model_parameters.
@ -450,7 +452,7 @@ class NewRelicLogger(CustomLogger):
        else:
            source_params = kwargs.get("optional_params") or {}

-        params: Final = {}
+        params: Final[dict[str, object]] = {}

        temperature: Final = source_params.get("temperature")
        if temperature is not None:
@ -502,7 +504,7 @@ class NewRelicLogger(CustomLogger):
        response_model: str,
        vendor: str,
        standard_logging_object: StandardLoggingPayload | None = None,
-    ) -> list[dict[str, Any]]:
+    ) -> Sequence[Mapping[str, object]]:
        """
        Extract all messages (request + response) with sequence numbers and timestamps.

@ -512,7 +514,7 @@ class NewRelicLogger(CustomLogger):
        Adds timestamps from StandardLoggingPayload (preferred) or kwargs if available
        (converted to epoch milliseconds).
        """
-        messages: Final = []
+        messages: Final[list[dict[str, object]]] = []
        sequence = 0

        # Extract timestamps, preferring StandardLoggingPayload
@ -544,7 +546,7 @@ class NewRelicLogger(CustomLogger):
        else:
            request_messages = kwargs.get("messages") or []
        for msg in request_messages:
-            message_data = {
+            message_data: dict[str, object] = {
                "role": msg.get("role") or "user",
                "sequence": sequence,
                "response.model": response_model,
@ -599,11 +601,11 @@ class NewRelicLogger(CustomLogger):
        num_messages: int,
        usage: dict[str, int],
        duration: float | None = None,
-        request_params: dict[str, Any] | None = None,
+        request_params: Mapping[str, object] | None = None,
    ):
        """Record LlmChatCompletionSummary event to New Relic."""
        try:
-            event_data: Final = {
+            event_data: Final[dict[str, object]] = {
                "id": request_id,
                "request_id": request_id,
                "request.model": request_model,
@ -647,7 +649,7 @@ class NewRelicLogger(CustomLogger):
        request_id: str,
        llm_response_id: str,
        trace_id: str | None,
-        messages: list[dict[str, Any]],
+        messages: Sequence[Mapping[str, object]],
    ):
        """Record LlmChatCompletionMessage events to New Relic.

@ -666,7 +668,7 @@ class NewRelicLogger(CustomLogger):

            for message in messages:
                sequence = message["sequence"]
-                event_data = {
+                event_data: dict[str, object] = {
                    "id": f"{llm_response_id}-{sequence}",
                    "request_id": request_id,
                    "completion_id": request_id,
--- a/litellm/integrations/opentelemetry.py
+++ b/litellm/integrations/opentelemetry.py
@ -1,7 +1,7 @@
 import os
 import threading
 from collections import OrderedDict
-from collections.abc import Callable, Mapping
+from collections.abc import Callable, Iterable, Mapping
 from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass, field
 from datetime import datetime
@ -166,7 +166,7 @@ class OTELMetricAttributeFilter:
    exclude_list: list[str] | None = None


-def _build_metric_attribute_filter(value: Any) -> OTELMetricAttributeFilter:
+def _build_metric_attribute_filter(value: object) -> OTELMetricAttributeFilter:
    if isinstance(value, OTELMetricAttributeFilter):
        return value
    if not isinstance(value, dict):
@ -205,7 +205,7 @@ def _resolve_metric_attribute_filter(
    )


-def _normalize_team_metadata_keys(value: Any) -> list[str]:
+def _normalize_team_metadata_keys(value: str | Iterable[object] | None) -> list[str]:
    """Coerce a team-metadata allowlist from a list or comma-separated string.

    config.yaml passes a YAML list; an env var passes a comma-separated string.
@ -1569,7 +1569,7 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
            self.safe_set_attribute(span=span, key=RESPONSE_SERVICE_TIER_ATTRIBUTE, value=served_tier)

    @staticmethod
-    def _team_metadata_json(value: Any, allowed_keys: list[str]) -> str | None:
+    def _team_metadata_json(value: object, allowed_keys: list[str]) -> str | None:
        """JSON-serialize only the allowlisted sub-keys of a team's metadata.

        Returns ``None`` when nothing is allowlisted or no allowlisted key is
@ -3524,7 +3524,7 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
            kwargs={"standard_logging_object": {"error_information": error_information}},
        )

-    def set_preprocessing_duration_attribute(self, span: Span | None, container: Any) -> None:
+    def set_preprocessing_duration_attribute(self, span: Span | None, container: object) -> None:
        """
        Set ``litellm.preprocessing.duration_ms`` (proxy-receive -> first
        provider handoff) on the proxy SERVER span. ``litellm_received_at``
--- a/litellm/integrations/opentelemetry_utils/gen_ai_semconv.py
+++ b/litellm/integrations/opentelemetry_utils/gen_ai_semconv.py
@ -117,7 +117,7 @@ class OTELGenAISemconvMixin:
    if TYPE_CHECKING:
        config: "OpenTelemetryConfig"

-        def safe_set_attribute(self, span: Span, key: str, value: Any) -> None: ...
+        def safe_set_attribute(self, span: Span, key: str, value: object) -> None: ...

        def _capture_in_event(self) -> bool: ...

@ -195,13 +195,13 @@ class OTELGenAISemconvMixin:
            if value:
                self.safe_set_attribute(span=span, key=semconv_key, value=value)

-    def _build_inference_details_attrs(self, kwargs: dict, response_obj: dict, provider: str) -> dict[str, Any]:
+    def _build_inference_details_attrs(self, kwargs: dict, response_obj: dict, provider: str) -> dict[str, str]:
        """Build the attribute payload for the inference-details event.

        Always includes provider/operation; input/output messages are added
        only when content capture is enabled and non-empty. Mixin-internal.
        """
-        attrs: Final[dict[str, Any]] = {
+        attrs: Final[dict[str, str]] = {
            "event_name": _INFERENCE_DETAILS_EVENT_NAME,
            "gen_ai.provider.name": provider,
            "gen_ai.operation.name": self._gen_ai_operation_name(kwargs),
--- a/litellm/integrations/opik/opik_payload_builder/payload_builders.py
+++ b/litellm/integrations/opik/opik_payload_builder/payload_builders.py
@ -15,8 +15,8 @@ def build_trace_payload(
    response_obj: dict[str, Any],
    start_time: datetime,
    end_time: datetime,
-    input_data: Any,
-    output_data: Any,
+    input_data: object,
+    output_data: object,
    metadata: dict[str, object],
    tags: list[str],
    thread_id: str | None,
@ -45,8 +45,8 @@ def build_span_payload(
    response_obj: dict[str, Any],
    start_time: datetime,
    end_time: datetime,
-    input_data: Any,
-    output_data: Any,
+    input_data: object,
+    output_data: object,
    metadata: dict[str, object],
    tags: list[str],
    usage: dict[str, int],
--- a/litellm/integrations/otel/README.md
+++ b/litellm/integrations/otel/README.md
@ -35,6 +35,15 @@ span orphaned into its own trace). The anchor — a contextvar inherited by thos
 child tasks — gives a stable parent in both cases. DB/service spans keep ambient
 parenting so an auth DB lookup still nests under `auth`.

+The anchor is also what `litellm.request.route` is read from: `request_root_http_route`
+returns the server span's own `http.route`, so the LLM call span cannot disagree with
+its parent about which endpoint served the request. That means the route template on a
+normal route and the literal path on a passthrough prefix, because the passthrough hook
+rewrote the attribute; an MCP call anchors the same server span, so it reports the
+`/mcp` mount point. Attributes stay readable after a span ends, so the async close
+callback reads the same value. Where no server span was anchored at all, the route the
+proxy recorded at auth (`metadata.user_api_key_request_route`) is the backstop.
+
 **Which service calls become spans (`spans.span_role_for_service`).** LiteLLM's
 service-logging layer instruments many internal functions, but only some are
 traceable units of work:
--- a/litellm/integrations/otel/logger.py
+++ b/litellm/integrations/otel/logger.py
@ -49,6 +49,7 @@ from litellm.integrations.otel.model.utils import to_ns
 from litellm.integrations.otel.plumbing.context import (
    is_recordable_span,
    mcp_message_transport_span,
+    request_root_http_route,
    request_root_span,
    resolve_mcp_span_context,
    resolve_parent_context,
@ -541,6 +542,7 @@ class OpenTelemetryV2(CustomLogger):
            payload,
            capture_content=self.config.capture_span_content,
            time_to_first_chunk_seconds=call.time_to_first_chunk_seconds,
+            request_route=request_root_http_route(),
        )
        end_time_ns: Final = to_ns(end_time)
        if carrier is not None and carrier.span is not None:
--- a/litellm/integrations/otel/mappers/genai.py
+++ b/litellm/integrations/otel/mappers/genai.py
@ -89,6 +89,7 @@ class GenAIMapper:
        f"{LiteLLM.COST_PREFIX}margin_percent": lambda d: d.cost.margin_percent,
        f"{LiteLLM.COST_PREFIX}margin_total_amount": lambda d: d.cost.margin_total_amount,
        LiteLLM.REQUEST_STREAMING: lambda d: d.is_streaming,
+        LiteLLM.REQUEST_ROUTE: lambda d: d.request_route,
    }

    _TOOL_ATTRS: dict[str, Callable[[ToolDefinition], AttrValue | None]] = {
--- a/litellm/integrations/otel/model/metadata.py
+++ b/litellm/integrations/otel/model/metadata.py
@ -64,6 +64,7 @@ class RequestIdentity:
    # completes (routing has picked a deployment), so it's absent from the
    # auth-time seed and filled only from the payload.
    provider_model: str | None = None
+    request_route: str | None = None
    metadata: Mapping[str, str] = field(default_factory=dict)

    @classmethod
@ -87,6 +88,7 @@ class RequestIdentity:
            key_hash=as_str(raw_meta.get("user_api_key_hash")),
            end_user=as_str(payload.get("end_user")) or as_str(raw_meta.get("user_api_key_end_user_id")),
            provider_model=resolve_provider_model(payload),
+            request_route=as_str(raw_meta.get("user_api_key_request_route")),
            metadata=metadata,
        )

--- a/litellm/integrations/otel/model/payloads.py
+++ b/litellm/integrations/otel/model/payloads.py
@ -386,6 +386,7 @@ class LLMCallSpanData:
    # keeps routes the convention folds into one operation distinguishable.
    output_type: GenAIOutputType | None = None
    call_type: str | None = None
+    request_route: str | None = None

    @classmethod
    def from_standard_logging_payload(
@ -393,6 +394,7 @@ class LLMCallSpanData:
        payload: StandardLoggingPayload,
        capture_content: bool = False,
        time_to_first_chunk_seconds: float | None = None,
+        request_route: str | None = None,
    ) -> LLMCallSpanData:
        params: Final = cast(Mapping[str, object], payload.get("model_parameters") or {})
        # The single parse of the request's metadata — the request-vs-provider
@ -433,6 +435,7 @@ class LLMCallSpanData:
            time_to_first_chunk_seconds=time_to_first_chunk_seconds,
            output_type=resolve_output_type(call_type),
            call_type=call_type or None,
+            request_route=request_route or context.identity.request_route,
        )


--- a/litellm/integrations/otel/model/semconv.py
+++ b/litellm/integrations/otel/model/semconv.py
@ -295,6 +295,7 @@ class LiteLLM:
    # ``litellm_params.model``), distinct from the user-facing ``gen_ai.request.model``.
    PROVIDER_MODEL: Final = "litellm.provider.model"
    REQUEST_STREAMING: Final = "litellm.request.streaming"
+    REQUEST_ROUTE: Final = "litellm.request.route"
    TOOLS_DECLARED: Final = "litellm.request.tools.declared"
    GUARDRAIL_NAME: Final = "litellm.guardrail.name"
    GUARDRAIL_MODE: Final = "litellm.guardrail.mode"
--- a/litellm/integrations/otel/plumbing/context.py
+++ b/litellm/integrations/otel/plumbing/context.py
@ -6,6 +6,7 @@ from typing import Final

 from opentelemetry import baggage
 from opentelemetry.context import Context, get_current
+from opentelemetry.sdk.trace import ReadableSpan
 from opentelemetry.trace import (
    Link,
    NonRecordingSpan,
@ -18,6 +19,8 @@ from opentelemetry.trace.propagation.tracecontext import (
    TraceContextTextMapPropagator,
 )

+from litellm.integrations.otel.model.semconv import HTTP
+
 _PROPAGATOR: Final = TraceContextTextMapPropagator()

 # The request's root span — the FastAPI-owned SERVER span — captured ONCE when the
@ -55,6 +58,25 @@ def request_root_span() -> "Span | None":
    return span if is_recordable_span(span) else None


+def request_root_http_route() -> str | None:
+    """``http.route`` exactly as the request's root SERVER span reports it.
+
+    Read off the span rather than re-derived, so the LLM call span cannot disagree
+    with its own parent about which endpoint served the request: the template the
+    instrumentation matched, or the literal path where
+    ``mount._passthrough_span_name_hook`` rewrote it, are already in the attribute.
+    An MCP call anchors that same server span, so it reports the ``/mcp`` mount
+    point the instrumentation matched. Attributes stay readable after a span ends,
+    so this answers just as well from the async logging callback.
+
+    None when no server span is anchored, which is the SDK path and any deployment
+    where the FastAPI instrumentation did not mount.
+    """
+    span: Final = request_root_span()
+    route: Final = span.attributes.get(HTTP.ROUTE) if isinstance(span, ReadableSpan) and span.attributes else None
+    return route if isinstance(route, str) and route else None
+
+
 # The W3C trace-context carrier (``traceparent``/``tracestate``/``baggage``) the
 # MCP client propagated in the current request's ``params._meta``. The MCP gateway
 # sets it per message so the MCP span can record the client's span as a span
--- a/litellm/integrations/prometheus.py
+++ b/litellm/integrations/prometheus.py
@ -10,7 +10,7 @@ import sys
 from collections.abc import Awaitable, Callable, Mapping, Sequence
 from dataclasses import replace
 from datetime import datetime, timedelta
-from typing import TYPE_CHECKING, Any, Final, Literal, Protocol, TypeVar, cast
+from typing import TYPE_CHECKING, Any, Final, Literal, Protocol, TypeAlias, TypeVar, cast

 from pydantic import BaseModel

@ -142,6 +142,9 @@ class _ExcludedLabelMetric:
        return self._metric.labels(*kept_values) if kept_values else self._metric


+_MetricLike: TypeAlias = "NoOpMetric | _ExcludedLabelMetric | MetricWrapperBase"
+
+
 def _get_budget_metrics_per_request_timeout() -> float:
    raw: Final = os.getenv("PROMETHEUS_BUDGET_METRICS_PER_REQUEST_TIMEOUT")
    if raw is None:
@ -1652,7 +1655,7 @@ class PrometheusLogger(CustomLogger):

        cache_creation_detail_tokens: Final = PrometheusLogger._resolve_cache_write_tokens(prompt_details)

-        detail_metrics: Final[list[tuple[Any, DEFINED_PROMETHEUS_METRICS, object]]] = [
+        detail_metrics: Final[list[tuple[_MetricLike, DEFINED_PROMETHEUS_METRICS, object]]] = [
            (
                self.litellm_input_cached_tokens_metric,
                "litellm_input_cached_tokens_metric",
@ -1705,7 +1708,7 @@ class PrometheusLogger(CustomLogger):
        if not isinstance(usage_object, dict):
            return

-        media_metrics: Final[list[tuple[Any, DEFINED_PROMETHEUS_METRICS, object]]] = [
+        media_metrics: Final[list[tuple[_MetricLike, DEFINED_PROMETHEUS_METRICS, object]]] = [
            (
                self.litellm_video_duration_seconds_metric,
                "litellm_video_duration_seconds_metric",
@ -1727,7 +1730,7 @@ class PrometheusLogger(CustomLogger):

    def _inc_sparse_usage_counters(
        self,
-        counters_with_values: Sequence[tuple[Any, DEFINED_PROMETHEUS_METRICS, object]],
+        counters_with_values: Sequence[tuple[_MetricLike, DEFINED_PROMETHEUS_METRICS, object]],
        enum_values: UserAPIKeyLabelValues,
        label_context: PrometheusLabelFactoryContext | None = None,
    ) -> None:
@ -2607,7 +2610,7 @@ class PrometheusLogger(CustomLogger):
        for all successful requests (both streaming and non-streaming).
        """

-    def _safe_get(self, obj: Any, key: str, default: object = None) -> Any:
+    def _safe_get(self, obj: object, key: str, default: object = None) -> Any:
        """Get value from dict or Pydantic model."""
        if obj is None:
            return default
@ -2623,7 +2626,7 @@ class PrometheusLogger(CustomLogger):
        """
        standard_logging_payload: Final = request_kwargs.get("standard_logging_object", {}) or {}
        _litellm_params: Final = request_kwargs.get("litellm_params", {}) or {}
-        _metadata_raw: Final = self._safe_get(standard_logging_payload, "metadata") or {}
+        _metadata_raw: Final[object] = self._safe_get(standard_logging_payload, "metadata") or {}
        if isinstance(_metadata_raw, dict):
            _metadata = _metadata_raw
        else:
@ -4215,8 +4218,8 @@ class PrometheusLogger(CustomLogger):

    def _safe_duration_seconds(
        self,
-        start_time: Any,
-        end_time: Any,
+        start_time: object,
+        end_time: object,
    ) -> float | None:
        """
        Compute the duration in seconds between two objects.
--- a/litellm/integrations/shadow_eval_logger.py
+++ b/litellm/integrations/shadow_eval_logger.py
@ -37,6 +37,7 @@ from litellm.litellm_core_utils.llm_judge import (
 )
 from litellm.litellm_core_utils.redact_messages import should_redact_message_logging
 from litellm.llms.base_llm.base_utils import type_to_response_format_param
+from litellm.router_utils.common_utils import resolve_model_group_alias
 from litellm.types.management_endpoints.auto_router_endpoints import ShadowEvalDirection
 from litellm.types.utils import SHADOW_EVAL_JUDGE_CALL_ORIGIN, SHADOW_EVAL_ROUTER_CALL_ORIGIN

@ -60,9 +61,9 @@ _MAX_CONCURRENT_SHADOW_TASKS: Final = 16
 _MAX_JUDGE_RESPONSE_CHARS: Final = 8_000
 _MAX_JUDGE_PROMPT_CHARS: Final = 24_000

-# The judge answers with a small JSON object; a tighter budget truncates the JSON
-# mid-object and the attempt is lost to an error row.
-JUDGE_MAX_OUTPUT_TOKENS: Final = 1500
+# Covers the judge's reasoning tokens as well as its small JSON answer: a judge deployment
+# carrying an elevated reasoning_effort spends a tight cap before it ever answers.
+JUDGE_MAX_OUTPUT_TOKENS: Final = 4096

 _MAX_ERROR_CHARS: Final = 500

@ -165,28 +166,91 @@ def _chat_request_from_responses(
    )


-def _chat_final_text(response_obj: object) -> str:
-    """The assistant's text, or empty when the turn carries tool calls: only text-final
-    turns produce a judgeable A/B comparison."""
+def _chat_choice(response_obj: object) -> object | None:
+    """The response's first choice, from a payload mapping or a duck-typed ModelResponse."""
    try:
-        message: Final = (
-            response_obj["choices"][0]["message"]
-            if isinstance(response_obj, Mapping)
-            else response_obj.choices[0].message  # pyright: ignore[reportAttributeAccessIssue]  # duck-typed ModelResponse
-        )
+        if isinstance(response_obj, Mapping):
+            return response_obj["choices"][0]
+        return response_obj.choices[0]  # pyright: ignore[reportAttributeAccessIssue]  # duck-typed ModelResponse
    except (AttributeError, KeyError, IndexError, TypeError):
+        return None
+
+
+def _field_reader(obj: object) -> Callable[[str], object]:
+    return obj.get if isinstance(obj, Mapping) else lambda key: getattr(obj, key, None)
+
+
+def _chat_message_reader(response_obj: object) -> Callable[[str], object] | None:
+    """Field access over the assistant message of a chat response, or None for a payload
+    with no readable message."""
+    choice: Final = _chat_choice(response_obj)
+    if choice is None:
+        return None
+    message: Final = _field_reader(choice)("message")
+    return _field_reader(message) if message is not None else None
+
+
+def _chat_final_text(response_obj: object) -> str:
+    """The turn's judgeable text: prose, or every tool call serialized alongside it as
+    `[tool call] name(arguments)` when the assistant chose to act instead of, or as well
+    as, answering directly. A tool call is a real turn, not a gap, so this is what both
+    the real arm's sampling decision and the shadow arm's reply compare against."""
+    read: Final = _chat_message_reader(response_obj)
+    if read is None:
        return ""
-    read: Final = message.get if isinstance(message, Mapping) else lambda key: getattr(message, key, None)
-    if read("tool_calls") or read("function_call"):
-        return ""
-    return extract_text_from_content(read("content"))
+    prose: Final = extract_text_from_content(read("content"))
+    if not (read("tool_calls") or read("function_call")):
+        return prose
+    serialized: Final = _serialize_tool_calls(read)
+    return f"{prose} {serialized}".strip() if prose else serialized
+
+
+def _chat_finish_reason(response_obj: object) -> str:
+    choice: Final = _chat_choice(response_obj)
+    raw: Final = _field_reader(choice)("finish_reason") if choice is not None else None
+    return str(raw) if raw else "unknown"
+
+
+_RESPONSES_TOOL_CALL_TYPES: Final = frozenset(("function_call", "custom_tool_call"))
+
+
+def _tool_calls_list(read: Callable[[str], object]) -> tuple[object, ...]:
+    calls: Final = read("tool_calls")
+    listed: Final = tuple(calls) if isinstance(calls, Sequence) and not isinstance(calls, str) else ()
+    single: Final = read("function_call")
+    return listed if listed else ((single,) if single is not None else ())
+
+
+def _tool_call_invocation(call: object) -> str:
+    """One tool call as `name(arguments)`. Custom tool calls name themselves and carry their
+    arguments under `custom` rather than `function`."""
+    read_call: Final = _field_reader(call)
+    payload: Final = read_call("function") or read_call("custom") or call
+    read_payload: Final = _field_reader(payload)
+    name: Final = read_payload("name")
+    arguments: Final = read_payload("arguments") or read_payload("input") or ""
+    return f"{name or 'unnamed'}({arguments})"
+
+
+def _serialize_tool_calls(read: Callable[[str], object]) -> str:
+    """Every tool call in a reply as text a judge built for prose can still read."""
+    return ", ".join(f"[tool call] {_tool_call_invocation(call)}" for call in _tool_calls_list(read))
+
+
+def _shadow_empty_reply_error(response_obj: object, routed_model: str) -> str:
+    """Why a shadow reply yielded no judgeable text at all: no prose, and no tool call to
+    serialize either. The stable sentence comes first and every varying part after the
+    semicolon, so grouping rows by error still yields one row per cause."""
+    detail: Final = f"finish_reason={_chat_finish_reason(response_obj)}, model={routed_model or 'unknown'}"
+    return f"shadow router returned an empty response; {detail}"


 def _responses_final_text(response_obj: object) -> str:
-    """The turn's aggregated output text, or empty when the turn carries tool calls. A
-    dict-shaped payload is validated into the owner type first, because ``output_text``
-    is a derived property rather than a serialized field, so it never exists on a dict;
-    a dict the owner type rejects is unjudgeable and skipped."""
+    """The turn's judgeable text: the aggregated output plus any tool call serialized
+    alongside it, the same way the chat surface renders one. A dict-shaped payload is
+    validated into the owner type first, because ``output_text`` is a derived property
+    rather than a serialized field, so it never exists on a dict; a dict the owner type
+    rejects is unjudgeable and skipped."""
    from litellm.types.llms.openai import ResponsesAPIResponse

    try:
@ -199,11 +263,16 @@ def _responses_final_text(response_obj: object) -> str:
    if not isinstance(output, Sequence):
        return ""
    items: Final = tuple(item.model_dump() if isinstance(item, BaseModel) else item for item in output)
-    if any(
-        not isinstance(item, Mapping) or item.get("type") in ("function_call", "custom_tool_call") for item in items
-    ):
+    if any(not isinstance(item, Mapping) for item in items):
        return ""
-    return str(getattr(response, "output_text", "") or "")
+    calls: Final = tuple(
+        item for item in items if isinstance(item, Mapping) and item.get("type") in _RESPONSES_TOOL_CALL_TYPES
+    )
+    prose: Final = str(getattr(response, "output_text", "") or "")
+    if not calls:
+        return prose
+    serialized: Final = ", ".join(f"[tool call] {_tool_call_invocation(call)}" for call in calls)
+    return f"{prose} {serialized}".strip() if prose else serialized


 class _SurfaceOps:
@ -273,8 +342,8 @@ def _judgeable_sample(
    response_obj: object,
 ) -> tuple[tuple[Mapping[str, object], ...], Mapping[str, object], str] | None:
    """The normalized chat conversation, the forwardable generation params, and the
-    judgeable final text; None when this request's shapes cannot be sampled (tool-final
-    turn, empty text, or a shape the owner transformations reject)."""
+    judgeable final text; None when this request's shapes cannot be sampled (no text and no
+    tool call to serialize, or a shape the owner transformations reject)."""
    try:
        request: Final = ops.chat_request(kwargs, model_parameters)
        items: Final = _MESSAGE_ITEMS_ADAPTER.validate_python(request.get("messages"))
@ -307,6 +376,11 @@ PAIRWISE_JUDGE_SYSTEM_PROMPT: Final = """You are an impartial quality judge comp

 The responses are labeled A and B in random order. You do not know which system produced which.

+A response may be prose, or a tool call shown as `[tool call] name(arguments)` if the
+assistant chose to act instead of answering directly. A tool call is not a defect: judge
+whether calling that tool was the right response to the conversation, the same as you
+would judge prose.
+
 Criteria: correctness, completeness, clarity, conciseness.

 Return ONLY valid JSON in this exact format, no other text:
@ -345,6 +419,20 @@ def _failure_detail(e: BaseException) -> str:
    return f"{type(e).__name__}{location}: {e}"


+def _judge_reply_shape(response: object) -> str:
+    """How an unparseable judge reply was shaped. The parser's own message cannot separate a
+    judge that answered with nothing from one truncated mid-object, and those want opposite
+    fixes. Shape only, never the reply text: the judge quotes the sampled turns it compares,
+    and no attempt row carries sampled content today."""
+    read: Final = _chat_message_reader(response)
+    if read is None:
+        return "unreadable judge reply"
+    content: Final = read("content")
+    served: Final = str(_field_reader(response)("model") or "unknown")
+    body: Final = f"{len(str(content))} chars" if content else "no content"
+    return f"finish_reason={_chat_finish_reason(response)}, content={body}, model={served}"
+
+
 def _call_cost(response: object) -> float:
    """Price one eval-arm call with the figure the spend pipeline bills: the router client
    stamps _hidden_params.response_cost from the deployment's own pricing, which the public
@ -376,14 +464,37 @@ def _unmask_preference(raw_preference: str, real_is_a: bool) -> str:
    return "tie"


-def _judge_user_prompt(conversation: str, response_a: str, response_b: str) -> str:
+_MAX_JUDGE_TOOL_DEFS_CHARS: Final = 2_000
+
+
+def _tool_definitions_text(tools: object) -> str:
+    """The tools available to both arms, name and description only: enough for the judge
+    to tell whether the chosen tool, and not some other one, was the right call, without
+    forwarding parameter schemas it does not need to score that."""
+    if not isinstance(tools, Sequence) or isinstance(tools, str):
+        return ""
+    entries: Final = tuple(
+        _field_reader(t)("function") or _field_reader(t)("custom") or t for t in tools if not isinstance(t, str)
+    )
+    lines: Final = tuple(
+        f"- {_field_reader(e)('name') or 'unnamed'}: {_field_reader(e)('description') or 'no description'}"
+        for e in entries
+    )
+    if not lines:
+        return ""
+    return ("Tools available to both responses:\n" + "\n".join(lines))[:_MAX_JUDGE_TOOL_DEFS_CHARS]
+
+
+def _judge_user_prompt(conversation: str, response_a: str, response_b: str, tool_definitions: str = "") -> str:
    """The judge prompt under one total character budget: each response is capped, and
-    the conversation tail gets whatever budget the responses left over."""
+    the conversation tail gets whatever budget the responses and tool definitions left
+    over."""
    a: Final = response_a[:_MAX_JUDGE_RESPONSE_CHARS]
    b: Final = response_b[:_MAX_JUDGE_RESPONSE_CHARS]
-    conversation_budget: Final = _MAX_JUDGE_PROMPT_CHARS - len(a) - len(b)
+    prefix: Final = f"{tool_definitions}\n\n" if tool_definitions else ""
+    conversation_budget: Final = _MAX_JUDGE_PROMPT_CHARS - len(a) - len(b) - len(prefix)
    return (
-        f"Conversation:\n{conversation[-conversation_budget:]}\n\n"
+        f"{prefix}Conversation:\n{conversation[-conversation_budget:]}\n\n"
        f"Response A:\n{a}\n\n"
        f"Response B:\n{b}\n\n"
        "Which response is better?"
@ -554,6 +665,7 @@ class ActiveShadowEvalJob(BaseModel):
    id: str
    router_name: str
    router_names: tuple[str, ...] = ()
+    models: frozenset[str] = frozenset()
    direction: ShadowEvalDirection = "forward"
    baseline_model: str | None = None
    shadow_percentage: float
@ -596,6 +708,21 @@ class ActiveShadowEvalJob(BaseModel):
        return self.baseline_model or arm_router


+def _canonical_group(router: "Router | None", model_group: str) -> str:
+    """A model group in the one spelling both a job's scope and a request's model compare
+    under: an alias resolves to its target so the two never fail to match on spelling."""
+    return (
+        resolve_model_group_alias(router.model_group_alias, model_group) if router is not None else None
+    ) or model_group
+
+
+def _scope_admits(router: "Router | None", job: "ActiveShadowEvalJob", model_group: str) -> bool:
+    """Whether the request's group is in the job's model scope. Both sides resolve through
+    the router's alias map at match time, so a re-pointed alias applies to the next request
+    rather than after the jobs cache rolls."""
+    return not job.models or any(_canonical_group(router, name) == model_group for name in job.models)
+
+
 def _as_active_job(record: object, attempts: int, spend: float) -> ActiveShadowEvalJob | None:
    """The sampling path's view of one job row, or None for a row it cannot sample: an
    unknown direction, or a reverse job with no baseline model to duplicate against.
@ -618,7 +745,8 @@ class ShadowEvalLogger(CustomLogger):
    A job targets a virtual key, a team, or a user; a request qualifies for a job when
    any of its resolved identities (key hash, team id, user id) matches the job's
    target, so team and user jobs cover JWT-authenticated traffic, which carries no
-    key hash at all."""
+    key hash at all. A job scoped to model groups further requires the request's
+    requested group to be one of them."""

    def __init__(
        self,
@ -705,19 +833,24 @@ class ShadowEvalLogger(CustomLogger):
        active_jobs: Sequence[ActiveShadowEvalJob],
        request_metadata: Mapping[str, object],
        request_id: str,
+        model_group: str,
    ) -> tuple[ActiveShadowEvalJob, ...]:
        """The jobs that sample this request. A key can hold one job per direction, and a
        request routed by one job's router while bypassing the other's qualifies for both;
        each is separately budgeted, so both fire. An admitting job that loses the sampling
-        dice is counted, so results can weigh judged rows against the traffic they stand for."""
+        dice is counted, so results can weigh judged rows against the traffic they stand for.
+        A request outside a job's direction or model scope is not that job's traffic and
+        goes uncounted, so the funnel stays a fraction of the traffic the job admits."""
        eligible: list[ActiveShadowEvalJob] = []  # mutable-ok: bucketed per-job admission
        now: Final = datetime.now(timezone.utc)
+        router: Final = self._router_provider()
        for job in active_jobs:
            if (
                now >= job.ends_at
                or job.attempts + self._job_starts.get(job.id, 0) >= job.max_turns
                or (job.max_budget is not None and job.spend >= job.max_budget)
                or not _direction_admits(request_metadata, job)
+                or not _scope_admits(router, job, model_group)
            ):
                continue
            if not _sample_hits(request_id, job.id, job.shadow_percentage):
@ -772,6 +905,7 @@ class ShadowEvalLogger(CustomLogger):
                tuple(job for target in targets for job in active_jobs.get(target, ())),
                request_metadata,
                request_id,
+                _canonical_group(self._router_provider(), str(payload.get("model_group") or "")),
            )
            if not eligible:
                return
@ -942,6 +1076,7 @@ class ShadowEvalLogger(CustomLogger):
                messages=messages,
                real_text=real_text,
                shadow_text=shadow.text,
+                tools=shadow_params.get("tools"),
                parent_metadata=parent_metadata,
            )
            if isinstance(verdict, _CallFailure):
@ -1080,15 +1215,18 @@ class ShadowEvalLogger(CustomLogger):
                classifier_cost=_decision_classifier_cost(shadow_metadata),
            )
        text: Final = _chat_final_text(response)
+        routed_model: Final = str(
+            getattr(response, "model", None) or _routing_decision(shadow_metadata).get("routed_model") or ""
+        )
        if not text:
            return _CallFailure(
-                "shadow router returned an empty response",
+                _shadow_empty_reply_error(response, routed_model),
                cost=_call_cost(response),
                classifier_cost=_decision_classifier_cost(shadow_metadata),
            )
        return _ShadowResponse(
            text=text,
-            model=str(getattr(response, "model", None) or _routing_decision(shadow_metadata).get("routed_model") or ""),
+            model=routed_model,
            tier=_routed_tier(shadow_metadata),
            cost=_call_cost(response),
            classifier_cost=_decision_classifier_cost(shadow_metadata),
@ -1100,9 +1238,12 @@ class ShadowEvalLogger(CustomLogger):
        messages: Sequence[Mapping[str, object]],
        real_text: str,
        shadow_text: str,
+        tools: object,
        parent_metadata: Mapping[str, object],
    ) -> "_JudgeVerdict | _CallFailure":
-        """Blind pairwise judge with A/B labels randomized to cancel position bias."""
+        """Blind pairwise judge with A/B labels randomized to cancel position bias. Both
+        arms were offered the same tools, so the judge is shown their definitions too: a
+        tool call is only assessable against what else was available to call instead."""
        real_is_a: Final = random.random() < 0.5
        response_a: Final = real_text if real_is_a else shadow_text
        response_b: Final = shadow_text if real_is_a else real_text
@ -1117,7 +1258,7 @@ class ShadowEvalLogger(CustomLogger):
            {"role": "system", "content": PAIRWISE_JUDGE_SYSTEM_PROMPT},  # mutable-ok: SDK message
            {
                "role": "user",
-                "content": _judge_user_prompt(conversation, response_a, response_b),
+                "content": _judge_user_prompt(conversation, response_a, response_b, _tool_definitions_text(tools)),
            },  # mutable-ok: SDK message
        ]
        try:
@ -1139,7 +1280,9 @@ class ShadowEvalLogger(CustomLogger):
            verdict: Final = PairwiseVerdict.model_validate(parse_json_verdict(raw))
        except Exception as e:  # noqa: BLE001  # malformed verdicts become error rows
            verbose_logger.debug("shadow_eval: unparseable judge verdict: %s", e)
-            return _CallFailure(f"unparseable judge verdict: {e}", cost=_call_cost(response))
+            return _CallFailure(
+                f"unparseable judge verdict: {e}; {_judge_reply_shape(response)}", cost=_call_cost(response)
+            )
        return _JudgeVerdict(
            preference=_unmask_preference(verdict.preference, real_is_a),
            confidence=max(0.0, min(1.0, verdict.confidence)),
--- a/litellm/integrations/weave/weave_otel.py
+++ b/litellm/integrations/weave/weave_otel.py
@ -3,6 +3,7 @@ from __future__ import annotations
 import base64
 import json
 import os
+from collections.abc import Mapping
 from typing import TYPE_CHECKING, Any, Final

 from opentelemetry.trace import Status, StatusCode
@ -59,7 +60,7 @@ class WeaveLLMObsOTELAttributes(BaseLLMObsOTELAttributes):
        safe_set_attribute(span, OpenInferenceSpanAttributes.INPUT_VALUE, json.dumps(prompt))


-def _set_weave_specific_attributes(span: Span, kwargs: dict[str, Any], response_obj: Any):
+def _set_weave_specific_attributes(span: Span, kwargs: Mapping[str, Any], response_obj: Any):
    """
    Sets Weave-specific metadata attributes onto the OTEL span.

@ -169,7 +170,7 @@ def get_weave_otel_config() -> WeaveOtelConfig:
    )


-def set_weave_otel_attributes(span: Span, kwargs: dict[str, Any], response_obj: Any):
+def set_weave_otel_attributes(span: Span, kwargs: Mapping[str, object], response_obj: object):
    """
    Sets OpenTelemetry span attributes for Weave observability.
    Uses the same attribute setting logic as other OTEL integrations for consistency.
--- a/litellm/integrations/websearch_interception/tools.py
+++ b/litellm/integrations/websearch_interception/tools.py
@ -6,12 +6,13 @@ Native provider tools (like Anthropic's web_search_20250305) are converted
 to this format for consistent interception and execution.
 """

+from collections.abc import Mapping
 from typing import Any, Final

 from litellm.constants import LITELLM_WEB_SEARCH_TOOL_NAME


-def get_litellm_web_search_tool() -> dict[str, Any]:
+def get_litellm_web_search_tool() -> dict[str, object]:
    """
    Get the standard LiteLLM web search tool definition.

@ -49,7 +50,7 @@ def get_litellm_web_search_tool() -> dict[str, Any]:
    }


-def get_litellm_web_search_tool_openai() -> dict[str, Any]:
+def get_litellm_web_search_tool_openai() -> dict[str, object]:
    """
    Get the standard LiteLLM web search tool definition in OpenAI format.

@ -82,7 +83,7 @@ def get_litellm_web_search_tool_openai() -> dict[str, Any]:
    }


-def get_litellm_web_search_tool_responses() -> dict[str, Any]:
+def get_litellm_web_search_tool_responses() -> dict[str, object]:
    """
    Get the standard LiteLLM web search tool definition in Responses API format.

@ -114,7 +115,7 @@ def get_litellm_web_search_tool_responses() -> dict[str, Any]:
    }


-def is_web_search_tool_responses(tool: dict[str, Any]) -> bool:
+def is_web_search_tool_responses(tool: Mapping[str, object]) -> bool:
    """
    Check if a tool is a web search tool for the Responses API.

@ -195,7 +196,7 @@ def is_web_search_tool_chat_completion(tool: dict[str, Any]) -> bool:
    return False


-def is_anthropic_native_web_search_tool(tool: dict[str, Any]) -> bool:
+def is_anthropic_native_web_search_tool(tool: Mapping[str, object]) -> bool:
    """
    Check if a tool is an Anthropic-native ``web_search_*`` tool.

--- a/litellm/integrations/websearch_interception/transformation.py
+++ b/litellm/integrations/websearch_interception/transformation.py
@ -24,7 +24,7 @@ class WebSearchTransformation:

    @staticmethod
    def transform_request(
-        response: Any,
+        response: object,
        stream: bool,
        response_format: str = "anthropic",
    ) -> tuple[bool, list[dict]]:
@ -66,7 +66,7 @@ class WebSearchTransformation:

    @staticmethod
    def _detect_from_responses_response(
-        response: Any,
+        response: object,
    ) -> tuple[bool, list[dict]]:
        """Parse a Responses API response for ``litellm_web_search`` function calls.

@ -399,7 +399,7 @@ class WebSearchTransformation:
    def build_web_search_tool_result_block(
        tool_use_id: str,
        search_response: SearchResponse | None,
-    ) -> dict[str, Any]:
+    ) -> dict[str, object]:
        """
        Build an Anthropic-native ``web_search_tool_result`` content block.

@ -433,7 +433,7 @@ class WebSearchTransformation:
                emitted with an empty result list (signals "search ran, no
                results" rather than "search did not run").
        """
-        items: Final[list[dict[str, Any]]] = []
+        items: Final[list[dict[str, object]]] = []
        if search_response is not None:
            results: Final = getattr(search_response, "results", None) or []
            for r in results:
--- a/litellm/interactions/agents/http_handler.py
+++ b/litellm/interactions/agents/http_handler.py
@ -6,7 +6,7 @@ Extends InteractionsHTTPHandler so that the shared HTTP infrastructure
 duplicated. BaseAgentsAPIConfig stays as pure transform code.
 """

-from collections.abc import Coroutine
+from collections.abc import Coroutine, Mapping
 from typing import Any, Final

 import httpx
@ -39,11 +39,11 @@ class AgentsHTTPHandler(InteractionsHTTPHandler):
        litellm_params: GenericLiteLLMParams,
        logging_obj: LiteLLMLoggingObj,
        extra_headers: dict[str, Any] | None = None,
-        extra_body: dict[str, Any] | None = None,
+        extra_body: Mapping[str, object] | None = None,
        timeout: float | httpx.Timeout | None = None,
        client: HTTPHandler | None = None,
        _is_async: bool = False,
-    ) -> AgentCreateResponse | Coroutine[Any, Any, AgentCreateResponse]:
+    ) -> AgentCreateResponse | Coroutine[object, object, AgentCreateResponse]:
        if _is_async:
            return self.async_create_agent(
                agents_api_config=agents_api_config,
@ -94,7 +94,7 @@ class AgentsHTTPHandler(InteractionsHTTPHandler):
        litellm_params: GenericLiteLLMParams,
        logging_obj: LiteLLMLoggingObj,
        extra_headers: dict[str, Any] | None = None,
-        extra_body: dict[str, Any] | None = None,
+        extra_body: Mapping[str, object] | None = None,
        timeout: float | httpx.Timeout | None = None,
        client: AsyncHTTPHandler | None = None,
    ) -> AgentCreateResponse:
@ -145,7 +145,7 @@ class AgentsHTTPHandler(InteractionsHTTPHandler):
        timeout: float | httpx.Timeout | None = None,
        client: HTTPHandler | None = None,
        _is_async: bool = False,
-    ) -> AgentListResponse | Coroutine[Any, Any, AgentListResponse]:
+    ) -> AgentListResponse | Coroutine[object, object, AgentListResponse]:
        if _is_async:
            return self.async_list_agents(
                agents_api_config=agents_api_config,
@ -220,7 +220,7 @@ class AgentsHTTPHandler(InteractionsHTTPHandler):
        timeout: float | httpx.Timeout | None = None,
        client: HTTPHandler | None = None,
        _is_async: bool = False,
-    ) -> AgentCreateResponse | Coroutine[Any, Any, AgentCreateResponse]:
+    ) -> AgentCreateResponse | Coroutine[object, object, AgentCreateResponse]:
        if _is_async:
            return self.async_get_agent(
                agents_api_config=agents_api_config,
@ -299,7 +299,7 @@ class AgentsHTTPHandler(InteractionsHTTPHandler):
        timeout: float | httpx.Timeout | None = None,
        client: HTTPHandler | None = None,
        _is_async: bool = False,
-    ) -> AgentDeleteResult | Coroutine[Any, Any, AgentDeleteResult]:
+    ) -> AgentDeleteResult | Coroutine[object, object, AgentDeleteResult]:
        if _is_async:
            return self.async_delete_agent(
                agents_api_config=agents_api_config,
@ -378,7 +378,7 @@ class AgentsHTTPHandler(InteractionsHTTPHandler):
        timeout: float | httpx.Timeout | None = None,
        client: HTTPHandler | None = None,
        _is_async: bool = False,
-    ) -> AgentVersionsResponse | Coroutine[Any, Any, AgentVersionsResponse]:
+    ) -> AgentVersionsResponse | Coroutine[object, object, AgentVersionsResponse]:
        if _is_async:
            return self.async_list_agent_versions(
                agents_api_config=agents_api_config,
--- a/litellm/interactions/agents/main.py
+++ b/litellm/interactions/agents/main.py
@ -30,7 +30,7 @@ Usage:

 import asyncio
 import contextvars
-from collections.abc import Coroutine
+from collections.abc import Coroutine, Mapping
 from functools import partial
 from typing import Any, Final

@ -75,7 +75,7 @@ def _make_logging_obj(
    model: str,
    custom_llm_provider: str,
    call_type: str,
-    optional_params: dict[str, Any],
+    optional_params: dict[str, object],
 ) -> LiteLLMLoggingObj:
    litellm_logging_obj: Final[LiteLLMLoggingObj] = kwargs.get("litellm_logging_obj")
    litellm_call_id: Final[str | None] = kwargs.get("litellm_call_id", None)
@ -102,7 +102,7 @@ async def acreate(
    base_environment: InteractionEnvironment | None = None,
    custom_llm_provider: str | None = None,
    extra_headers: dict[str, Any] | None = None,
-    extra_body: dict[str, Any] | None = None,
+    extra_body: Mapping[str, object] | None = None,
    timeout: float | httpx.Timeout | None = None,
    **kwargs,
 ) -> AgentCreateResponse:
@ -146,10 +146,10 @@ def create(
    base_environment: InteractionEnvironment | None = None,
    custom_llm_provider: str | None = None,
    extra_headers: dict[str, Any] | None = None,
-    extra_body: dict[str, Any] | None = None,
+    extra_body: Mapping[str, object] | None = None,
    timeout: float | httpx.Timeout | None = None,
    **kwargs,
-) -> AgentCreateResponse | Coroutine[Any, Any, AgentCreateResponse]:
+) -> AgentCreateResponse | Coroutine[object, object, AgentCreateResponse]:
    """
    Sync: Create a managed agent on the provider side.

@ -244,7 +244,7 @@ def list(
    extra_headers: dict[str, Any] | None = None,
    timeout: float | httpx.Timeout | None = None,
    **kwargs,
-) -> AgentListResponse | Coroutine[Any, Any, AgentListResponse]:
+) -> AgentListResponse | Coroutine[object, object, AgentListResponse]:
    """Sync: List all agents on the provider side."""
    local_vars: Final = locals()
    custom_llm_provider = custom_llm_provider or kwargs.get("custom_llm_provider") or "gemini"
@ -320,7 +320,7 @@ def get(
    extra_headers: dict[str, Any] | None = None,
    timeout: float | httpx.Timeout | None = None,
    **kwargs,
-) -> AgentCreateResponse | Coroutine[Any, Any, AgentCreateResponse]:
+) -> AgentCreateResponse | Coroutine[object, object, AgentCreateResponse]:
    """Sync: Get a specific agent by name."""
    local_vars: Final = locals()
    custom_llm_provider = custom_llm_provider or kwargs.get("custom_llm_provider") or "gemini"
@ -397,7 +397,7 @@ def delete(
    extra_headers: dict[str, Any] | None = None,
    timeout: float | httpx.Timeout | None = None,
    **kwargs,
-) -> AgentDeleteResult | Coroutine[Any, Any, AgentDeleteResult]:
+) -> AgentDeleteResult | Coroutine[object, object, AgentDeleteResult]:
    """Sync: Delete a specific agent by name."""
    local_vars: Final = locals()
    custom_llm_provider = custom_llm_provider or kwargs.get("custom_llm_provider") or "gemini"
@ -474,7 +474,7 @@ def list_versions(
    extra_headers: dict[str, Any] | None = None,
    timeout: float | httpx.Timeout | None = None,
    **kwargs,
-) -> AgentVersionsResponse | Coroutine[Any, Any, AgentVersionsResponse]:
+) -> AgentVersionsResponse | Coroutine[object, object, AgentVersionsResponse]:
    """Sync: List versions of a specific agent."""
    local_vars: Final = locals()
    custom_llm_provider = custom_llm_provider or kwargs.get("custom_llm_provider") or "gemini"
--- a/litellm/interactions/http_handler.py
+++ b/litellm/interactions/http_handler.py
@ -4,7 +4,7 @@ HTTP Handler for Interactions API requests.
 This module handles the HTTP communication for the Google Interactions API.
 """

-from collections.abc import AsyncIterator, Coroutine, Iterator
+from collections.abc import AsyncIterator, Coroutine, Iterator, Mapping
 from typing import Any, Final

 import httpx
@ -96,8 +96,8 @@ class InteractionsHTTPHandler(_BaseHTTPHandler):
        model: str | None = None,
        agent: str | None = None,
        input: InteractionInput | None = None,
-        extra_headers: dict[str, Any] | None = None,
-        extra_body: dict[str, Any] | None = None,
+        extra_headers: dict[str, str] | None = None,
+        extra_body: Mapping[str, object] | None = None,
        timeout: float | httpx.Timeout | None = None,
        client: HTTPHandler | None = None,
        _is_async: bool = False,
@ -105,7 +105,7 @@ class InteractionsHTTPHandler(_BaseHTTPHandler):
    ) -> (
        InteractionsAPIResponse
        | Iterator[InteractionsAPIStreamingResponse]
-        | Coroutine[Any, Any, InteractionsAPIResponse | AsyncIterator[InteractionsAPIStreamingResponse]]
+        | Coroutine[object, object, InteractionsAPIResponse | AsyncIterator[InteractionsAPIStreamingResponse]]
    ):
        """
        Create a new interaction (synchronous or async based on _is_async flag).
@ -211,8 +211,8 @@ class InteractionsHTTPHandler(_BaseHTTPHandler):
        model: str | None = None,
        agent: str | None = None,
        input: InteractionInput | None = None,
-        extra_headers: dict[str, Any] | None = None,
-        extra_body: dict[str, Any] | None = None,
+        extra_headers: dict[str, str] | None = None,
+        extra_body: Mapping[str, object] | None = None,
        timeout: float | httpx.Timeout | None = None,
        client: AsyncHTTPHandler | None = None,
        stream: bool | None = None,
@ -345,11 +345,11 @@ class InteractionsHTTPHandler(_BaseHTTPHandler):
        custom_llm_provider: str,
        litellm_params: GenericLiteLLMParams,
        logging_obj: LiteLLMLoggingObj,
-        extra_headers: dict[str, Any] | None = None,
+        extra_headers: dict[str, str] | None = None,
        timeout: float | httpx.Timeout | None = None,
        client: HTTPHandler | None = None,
        _is_async: bool = False,
-    ) -> InteractionsAPIResponse | Coroutine[Any, Any, InteractionsAPIResponse]:
+    ) -> InteractionsAPIResponse | Coroutine[object, object, InteractionsAPIResponse]:
        """Get an interaction by ID."""
        if _is_async:
            return self.async_get_interaction(
@ -407,7 +407,7 @@ class InteractionsHTTPHandler(_BaseHTTPHandler):
        custom_llm_provider: str,
        litellm_params: GenericLiteLLMParams,
        logging_obj: LiteLLMLoggingObj,
-        extra_headers: dict[str, Any] | None = None,
+        extra_headers: dict[str, str] | None = None,
        timeout: float | httpx.Timeout | None = None,
        client: AsyncHTTPHandler | None = None,
    ) -> InteractionsAPIResponse:
@ -464,11 +464,11 @@ class InteractionsHTTPHandler(_BaseHTTPHandler):
        custom_llm_provider: str,
        litellm_params: GenericLiteLLMParams,
        logging_obj: LiteLLMLoggingObj,
-        extra_headers: dict[str, Any] | None = None,
+        extra_headers: dict[str, str] | None = None,
        timeout: float | httpx.Timeout | None = None,
        client: HTTPHandler | None = None,
        _is_async: bool = False,
-    ) -> DeleteInteractionResult | Coroutine[Any, Any, DeleteInteractionResult]:
+    ) -> DeleteInteractionResult | Coroutine[object, object, DeleteInteractionResult]:
        """Delete an interaction by ID."""
        if _is_async:
            return self.async_delete_interaction(
@ -527,7 +527,7 @@ class InteractionsHTTPHandler(_BaseHTTPHandler):
        custom_llm_provider: str,
        litellm_params: GenericLiteLLMParams,
        logging_obj: LiteLLMLoggingObj,
-        extra_headers: dict[str, Any] | None = None,
+        extra_headers: dict[str, str] | None = None,
        timeout: float | httpx.Timeout | None = None,
        client: AsyncHTTPHandler | None = None,
    ) -> DeleteInteractionResult:
@ -585,11 +585,11 @@ class InteractionsHTTPHandler(_BaseHTTPHandler):
        custom_llm_provider: str,
        litellm_params: GenericLiteLLMParams,
        logging_obj: LiteLLMLoggingObj,
-        extra_headers: dict[str, Any] | None = None,
+        extra_headers: dict[str, str] | None = None,
        timeout: float | httpx.Timeout | None = None,
        client: HTTPHandler | None = None,
        _is_async: bool = False,
-    ) -> CancelInteractionResult | Coroutine[Any, Any, CancelInteractionResult]:
+    ) -> CancelInteractionResult | Coroutine[object, object, CancelInteractionResult]:
        """Cancel an interaction by ID."""
        if _is_async:
            return self.async_cancel_interaction(
@ -648,7 +648,7 @@ class InteractionsHTTPHandler(_BaseHTTPHandler):
        custom_llm_provider: str,
        litellm_params: GenericLiteLLMParams,
        logging_obj: LiteLLMLoggingObj,
-        extra_headers: dict[str, Any] | None = None,
+        extra_headers: dict[str, str] | None = None,
        timeout: float | httpx.Timeout | None = None,
        client: AsyncHTTPHandler | None = None,
    ) -> CancelInteractionResult:
--- a/litellm/interactions/litellm_responses_transformation/transformation.py
+++ b/litellm/interactions/litellm_responses_transformation/transformation.py
@ -34,8 +34,8 @@ class LiteLLMResponsesInteractionsConfig:
        model: str,
        input: InteractionInput | None,
        optional_params: InteractionsAPIOptionalRequestParams,
-        **kwargs,
-    ) -> dict[str, Any]:
+        **kwargs: object,
+    ) -> dict[str, object]:
        """
        Transform an Interactions API request to a Responses API request.

@ -45,7 +45,7 @@ class LiteLLMResponsesInteractionsConfig:
        - tools -> tools (similar format)
        - generation_config -> temperature, top_p, etc.
        """
-        responses_request: Final[dict[str, Any]] = {
+        responses_request: Final[dict[str, object]] = {
            "model": model,
        }

@ -201,15 +201,15 @@ class LiteLLMResponsesInteractionsConfig:
        - Extract usage
        """
        # Extract text from outputs and build both `outputs` (legacy) and `steps` (new schema).
-        outputs: Final[list[dict[str, Any]]] = []
-        steps: Final[list[dict[str, Any]]] = []
+        outputs: Final[list[dict[str, object]]] = []
+        steps: Final[list[dict[str, object]]] = []
        if hasattr(responses_response, "output") and responses_response.output:
            for output_item in responses_response.output:
                # Use getattr with None default to safely access content
                content = getattr(output_item, "content", None)
                if content is not None:
                    content_items = content if isinstance(content, list) else [content]
-                    model_output_contents: list[dict[str, Any]] = []
+                    model_output_contents: list[dict[str, object]] = []
                    for content_item in content_items:
                        # Check if content_item has text attribute
                        text = getattr(content_item, "text", None)
@ -264,7 +264,7 @@ class LiteLLMResponsesInteractionsConfig:
        # Add usage if available
        # Map Responses API usage (input_tokens, output_tokens) to Interactions API spec format
        # (total_input_tokens, total_output_tokens)
-        usage: Final = getattr(responses_response, "usage", None)
+        usage: Final[object] = getattr(responses_response, "usage", None)
        if usage:
            interactions_response_dict["usage"] = {
                "total_input_tokens": getattr(usage, "input_tokens", 0),
--- a/litellm/interactions/main.py
+++ b/litellm/interactions/main.py
@ -229,7 +229,7 @@ def create(
 ) -> (
    InteractionsAPIResponse
    | Iterator[InteractionsAPIStreamingResponse]
-    | Coroutine[Any, Any, InteractionsAPIResponse | AsyncIterator[InteractionsAPIStreamingResponse]]
+    | Coroutine[object, object, InteractionsAPIResponse | AsyncIterator[InteractionsAPIStreamingResponse]]
 ):
    """
    Sync: Create a new interaction using Google's Interactions API.
@ -406,7 +406,7 @@ def get(
    timeout: float | httpx.Timeout | None = None,
    custom_llm_provider: str | None = None,
    **kwargs,
-) -> InteractionsAPIResponse | Coroutine[Any, Any, InteractionsAPIResponse]:
+) -> InteractionsAPIResponse | Coroutine[object, object, InteractionsAPIResponse]:
    """Sync: Get an interaction by its ID."""
    local_vars: Final = locals()
    custom_llm_provider = custom_llm_provider or "gemini"
@ -510,7 +510,7 @@ def delete(
    timeout: float | httpx.Timeout | None = None,
    custom_llm_provider: str | None = None,
    **kwargs,
-) -> DeleteInteractionResult | Coroutine[Any, Any, DeleteInteractionResult]:
+) -> DeleteInteractionResult | Coroutine[object, object, DeleteInteractionResult]:
    """Sync: Delete an interaction by its ID."""
    local_vars: Final = locals()
    custom_llm_provider = custom_llm_provider or "gemini"
@ -612,7 +612,7 @@ def cancel(
    timeout: float | httpx.Timeout | None = None,
    custom_llm_provider: str | None = None,
    **kwargs,
-) -> CancelInteractionResult | Coroutine[Any, Any, CancelInteractionResult]:
+) -> CancelInteractionResult | Coroutine[object, object, CancelInteractionResult]:
    """Sync: Cancel an interaction by its ID."""
    local_vars: Final = locals()
    custom_llm_provider = custom_llm_provider or "gemini"
--- a/litellm/litellm_core_utils/core_helpers.py
+++ b/litellm/litellm_core_utils/core_helpers.py
@ -419,7 +419,7 @@ def safe_deep_copy(data):
    if litellm.safe_memory_mode is True:
        return data

-    litellm_parent_otel_span: Any | None = None
+    litellm_parent_otel_span: object | None = None
    # Step 1: Remove the litellm_parent_otel_span
    litellm_parent_otel_span = None
    if isinstance(data, dict):
@ -510,7 +510,7 @@ def independent_snapshot(
    }


-def filter_exceptions_from_params(data: Any, max_depth: int = 20) -> Any:
+def filter_exceptions_from_params(data: object, max_depth: int = 20) -> Any:
    """
    Recursively filter out Exception objects and callable objects from dicts/lists.

@ -542,7 +542,7 @@ def filter_exceptions_from_params(data: Any, max_depth: int = 20) -> Any:
        return None

    if isinstance(data, dict):
-        result: Final[dict[str, Any]] = {}
+        result: Final[dict[str, object]] = {}
        for k, v in data.items():
            # Skip exception and callable values
            if isinstance(v, Exception) or (callable(v) and not isinstance(v, type)):
@ -556,7 +556,7 @@ def filter_exceptions_from_params(data: Any, max_depth: int = 20) -> Any:
                continue
        return result
    elif isinstance(data, list):
-        result_list: Final[list[Any]] = []
+        result_list: Final[list[object]] = []
        for item in data:
            # Skip exception and callable items
            if isinstance(item, Exception) or (callable(item) and not isinstance(item, type)):
@ -624,7 +624,7 @@ def redact_nested_match_and_regex_keys(
    # Iterative traversal; `seen` guards against cyclic refs preserved by deepcopy.
    try:
        seen: Final[set] = set()
-        stack: Final[list[Any]] = [redacted]
+        stack: Final[list[object]] = [redacted]
        while stack:
            node = stack.pop()
            node_id = id(node)
--- a/litellm/litellm_core_utils/dot_notation_indexing.py
+++ b/litellm/litellm_core_utils/dot_notation_indexing.py
@ -23,12 +23,13 @@ Used by JWT Auth to get the user role from the token, and by
 additional_drop_params to remove nested fields from optional parameters.
 """

+from collections.abc import Mapping
 from typing import Any, Final, TypeVar

 T = TypeVar("T")


-def get_nested_value(data: dict[str, Any], key_path: str, default: T | None = None) -> T | None:
+def get_nested_value(data: Mapping[str, object], key_path: str, default: T | None = None) -> T | None:
    """
    Retrieves a value from a nested dictionary using dot notation.

@ -107,7 +108,7 @@ def _parse_path_segments(path: str) -> list:


 def _delete_nested_value_custom(
-    data: dict[str, Any] | list[Any],
+    data: dict[str, object] | list[object],
    segments: list,
    segment_index: int = 0,
 ) -> None:
@ -168,13 +169,15 @@ def _delete_nested_value_custom(
            if segment in data:
                next_segment: Final = segments[segment_index + 1] if segment_index + 1 < len(segments) else None

+                child: Final = data[segment]
+
                # If next segment is array notation, current field should be list
                if next_segment and (next_segment.startswith("[")):
-                    if isinstance(data[segment], list):
-                        _delete_nested_value_custom(data[segment], segments, segment_index + 1)
+                    if isinstance(child, list):
+                        _delete_nested_value_custom(child, segments, segment_index + 1)
                # Otherwise navigate into dict
-                elif isinstance(data[segment], dict):
-                    _delete_nested_value_custom(data[segment], segments, segment_index + 1)
+                elif isinstance(child, dict):
+                    _delete_nested_value_custom(child, segments, segment_index + 1)


 def delete_nested_value(
@ -182,7 +185,7 @@ def delete_nested_value(
    path: str,
    depth: int = 0,
    max_depth: int = 20,
-) -> dict[str, Any]:
+) -> dict[str, object]:
    """
    Delete a field from nested data using JSONPath notation.

--- a/litellm/litellm_core_utils/json_validation_rule.py
+++ b/litellm/litellm_core_utils/json_validation_rule.py
@ -5,10 +5,10 @@ from litellm.constants import DEFAULT_MAX_RECURSE_DEPTH


 def normalize_json_schema_types(
-    schema: dict[str, Any] | list[Any] | Any,
+    schema: object,
    depth: int = 0,
    max_depth: int = DEFAULT_MAX_RECURSE_DEPTH,
-) -> dict[str, Any] | list[Any] | Any:
+) -> object:
    """
    Normalize JSON schema types from uppercase to lowercase format.

@ -47,7 +47,7 @@ def normalize_json_schema_types(
        return [normalize_json_schema_types(item, depth + 1, max_depth) for item in schema]

    if isinstance(schema, dict):
-        normalized_schema: Final[dict[str, Any]] = {}
+        normalized_schema: Final[dict[str, object]] = {}

        for key, value in schema.items():
            if key == "type" and isinstance(value, str) and value in type_mapping:
--- a/litellm/litellm_core_utils/litellm_logging.py
+++ b/litellm/litellm_core_utils/litellm_logging.py
@ -10,7 +10,7 @@ import subprocess
 import sys
 import time
 import traceback
-from collections.abc import Callable, Iterator, Mapping, Sequence
+from collections.abc import Awaitable, Callable, Iterator, Mapping, Sequence
 from datetime import datetime as dt_object
 from functools import lru_cache
 from types import MappingProxyType, TracebackType
@ -576,6 +576,7 @@ class Logging(LiteLLMLoggingBaseClass):
        # enqueue closure here instead of firing it immediately.
        self._defer_async_logging: bool = False
        self._enqueue_deferred_logging: Callable[[], None] | None = None
+        self._on_detached_stream_failure: Callable[[Exception], Awaitable[None]] | None = None

    def set_response_timing_metrics(self, timing_metrics: Mapping[str, float]) -> None:
        """Keep ``_response_ms`` / ``litellm_overhead_time_ms`` for a result that has no ``_hidden_params``."""
@ -1819,6 +1820,7 @@ class Logging(LiteLLMLoggingBaseClass):
            and litellm_params.get(CallTypes.aanthropic_messages.value, False) is not True
            and litellm_params.get(CallTypes.agenerate_content.value, False) is not True
            and litellm_params.get(CallTypes.agenerate_content_stream.value, False) is not True
+            and litellm_params.get(CallTypes.arealtime.value, False) is not True
        )

    def _is_assembled_stream_success(self, result=None) -> bool:
@ -1894,6 +1896,11 @@ class Logging(LiteLLMLoggingBaseClass):
            **kwargs,
        )

+    def record_partial_usage_for_failure(self, usage: Usage, response_cost: float) -> None:
+        """Stash what an interrupted stream already consumed so the failure log bills it instead of zero."""
+        self.model_call_details["combined_usage_object"] = usage
+        self.model_call_details["response_cost"] = response_cost
+
    async def dispatch_failure_handlers(
        self,
        exception: Exception,
@ -3815,7 +3822,7 @@ class Logging(LiteLLMLoggingBaseClass):
    def record_streamed_anthropic_message_id(self, message_id: str) -> None:
        self.streamed_anthropic_message_id = message_id

-    def _anthropic_messages_logged_response(self, result: Any) -> ModelResponse:
+    def _anthropic_messages_logged_response(self, result: object) -> ModelResponse:
        """
        The ModelResponse a /v1/messages spend_logs row is built from.

--- a/litellm/litellm_core_utils/llm_cost_calc/guardrail_cost.py
+++ b/litellm/litellm_core_utils/llm_cost_calc/guardrail_cost.py
@ -1,8 +1,8 @@
 import math
 from collections.abc import Mapping
-from typing import Final
+from typing import Annotated, Final

-from pydantic import BaseModel, ConfigDict, TypeAdapter, ValidationError
+from pydantic import BaseModel, ConfigDict, Field, TypeAdapter, ValidationError

 import litellm
 from litellm._logging import verbose_logger
@ -30,6 +30,31 @@ class GuardrailCostEntry(BaseModel):
 _GUARDRAIL_COST_ENTRY_ADAPTER: Final[TypeAdapter[GuardrailCostEntry]] = TypeAdapter(GuardrailCostEntry)


+class GuardrailCostByUnitEntry(BaseModel):
+    """The rollup-side view of a ``guardrail_information`` entry, validated apart from
+    ``GuardrailCostEntry`` so a forged per-counter map can never zero the spend path."""
+
+    model_config = ConfigDict(extra="ignore", frozen=True)
+
+    guardrail_cost_by_unit: Mapping[str, Annotated[float, Field(ge=0, allow_inf_nan=False)] | None] | None = None
+    guardrail_cost_in_spend: bool | None = True
+
+
+_GUARDRAIL_COST_BY_UNIT_ADAPTER: Final[TypeAdapter[GuardrailCostByUnitEntry]] = TypeAdapter(GuardrailCostByUnitEntry)
+
+
+def billed_guardrail_cost_by_unit(raw: object) -> Mapping[str, float | None] | None:
+    """Per-counter USD the daily rollup may record for one raw ``guardrail_information``
+    entry; None when the entry is unpriced, report-only, or malformed, and None per
+    counter the hook had no price for."""
+    try:
+        entry: Final = _GUARDRAIL_COST_BY_UNIT_ADAPTER.validate_python(raw)
+    except ValidationError as e:
+        verbose_logger.warning("Ignoring malformed guardrail_information entry for guardrail cost rollup: %s", e)
+        return None
+    return None if entry.guardrail_cost_in_spend is False else entry.guardrail_cost_by_unit
+
+
 def _bedrock_guardrail_pricing(aws_region_name: str | None) -> GuardrailPricing | None:
    regional_key: Final = f"bedrock/{aws_region_name}/guardrails" if aws_region_name else None
    for key in (regional_key, BEDROCK_GUARDRAIL_PRICING_KEY):
@ -42,11 +67,32 @@ def _bedrock_guardrail_pricing(aws_region_name: str | None) -> GuardrailPricing
    return None


-def bedrock_guardrail_cost(usage_units: Mapping[str, int], aws_region_name: str | None) -> float:
+def _priced_units(units: int, price_per_unit: float | None) -> float | None:
+    return None if price_per_unit is None else units * price_per_unit
+
+
+def bedrock_guardrail_cost_by_unit(
+    usage_units: Mapping[str, int], aws_region_name: str | None
+) -> Mapping[str, float | None] | None:
+    """USD per counter, keyed like ``usage_units``; None when no pricing entry exists,
+    and None for a counter the entry has no price for, since only an explicit 0.0 means free."""
    pricing: Final = _bedrock_guardrail_pricing(aws_region_name)
    if pricing is None:
-        return 0.0
-    return sum(units * pricing.guardrail_cost_per_unit.get(counter, 0.0) for counter, units in usage_units.items())
+        return None
+    return {  # mutable-ok: stamped into guardrail_information, which safe_dumps only serializes as a plain dict
+        counter: _priced_units(units, pricing.guardrail_cost_per_unit.get(counter))
+        for counter, units in usage_units.items()
+    }
+
+
+def guardrail_cost_total(cost_by_unit: Mapping[str, float | None] | None) -> float:
+    """The scalar the spend path bills: unknown-priced counters count as 0 here, the
+    rollup keeps them unknown."""
+    return sum(cost for cost in cost_by_unit.values() if cost is not None) if cost_by_unit is not None else 0.0
+
+
+def bedrock_guardrail_cost(usage_units: Mapping[str, int], aws_region_name: str | None) -> float:
+    return guardrail_cost_total(bedrock_guardrail_cost_by_unit(usage_units, aws_region_name))


 AZURE_PROMPT_SHIELD_TEXT_RECORD_UNIT: Final = "text_records"
--- a/litellm/litellm_core_utils/llm_response_utils/response_metadata.py
+++ b/litellm/litellm_core_utils/llm_response_utils/response_metadata.py
@ -168,7 +168,7 @@ class ResponseMetadata:


 def update_response_metadata(
-    result: Any,
+    result: object,
    logging_obj: LiteLLMLoggingObject,
    model: str | None,
    kwargs: dict,
--- a/litellm/litellm_core_utils/logging_utils.py
+++ b/litellm/litellm_core_utils/logging_utils.py
@ -184,7 +184,7 @@ def _get_parent_otel_span_from_logging_obj(


 def convert_litellm_response_object_to_str(
-    response_obj: Any | LiteLLMModelResponse,
+    response_obj: object,
 ) -> str | None:
    """
    Get the string of the response object from LiteLLM
--- a/litellm/litellm_core_utils/prompt_templates/common_utils.py
+++ b/litellm/litellm_core_utils/prompt_templates/common_utils.py
@ -229,6 +229,45 @@ def _content_parts_contain_image(parts: Sequence[object]) -> bool:
    return False


+def anthropic_image_source_to_openai_url(image_source: Mapping[str, object]) -> str | None:
+    """Data or remote URL for an Anthropic ``source`` block, in the form chat completions expects."""
+    source_type: Final = image_source.get("type")
+    if source_type == "base64":
+        media_type: Final = image_source.get("media_type") or "image/jpeg"
+        image_data: Final = image_source.get("data") or ""
+        return f"data:{media_type};base64,{image_data}" if image_data else None
+    if source_type == "url":
+        url: Final = image_source.get("url")
+        return url if isinstance(url, str) else ""
+    return None
+
+
+def _image_part_url(part: Mapping[str, object]) -> str | None:
+    """The image URL carried by one content part, whichever of the three dialects wrote it."""
+    part_type: Final = part.get("type")
+    if part_type == "image_url":
+        image_url: Final = part.get("image_url")
+        if isinstance(image_url, str):
+            return image_url
+        return image_url.get("url") if isinstance(image_url, Mapping) else None
+    if part_type == "input_image":
+        responses_url: Final = part.get("image_url")
+        return responses_url if isinstance(responses_url, str) else None
+    if part_type == "image":
+        source: Final = part.get("source")
+        return anthropic_image_source_to_openai_url(source) if isinstance(source, Mapping) else None
+    return None
+
+
+def as_openai_image_part(part: Mapping[str, object]) -> ChatCompletionImageObject | None:
+    """One image content part rewritten into chat-completions dialect, or None when it is not one.
+
+    Rebuilt rather than forwarded so no caller-controlled key beyond the URL rides along.
+    """
+    url: Final = _image_part_url(part)
+    return {"type": "image_url", "image_url": {"url": url}} if url else None
+
+
 def request_contains_image_content(messages: Sequence[Mapping[str, object]]) -> bool:
    """Whether any message carries an image content part, across the dialects that reach
    pre-routing hooks untranslated: chat-completions ``image_url``, Responses ``input_image``,
--- a/litellm/litellm_core_utils/prompt_templates/factory.py
+++ b/litellm/litellm_core_utils/prompt_templates/factory.py
@ -1708,8 +1708,8 @@ def _find_server_tool_result(

 def convert_to_anthropic_tool_invoke(
    tool_calls: list[ChatCompletionAssistantToolCall],
-    web_search_results: list[Any] | None = None,
-    tool_results: list[Any] | None = None,
+    web_search_results: Sequence[object] | None = None,
+    tool_results: Sequence[object] | None = None,
 ) -> list[AnthropicMessagesToolUseParam | dict[str, Any]]:
    """
    OpenAI tool invokes:
@ -5349,7 +5349,7 @@ class NormalizedToolCall(TypedDict):
    arguments: dict[str, object]


-def _parse_tool_call_arguments(raw: Any, tool_name: str | None, context: str) -> dict[str, object]:
+def _parse_tool_call_arguments(raw: object, tool_name: str | None, context: str) -> dict[str, object]:
    # Anthropic's tool_use blocks already carry a parsed dict in "input";
    # chat completions and the Responses API carry a JSON string that may be
    # truncated by the model, so route those through the repair-aware parser.
--- a/Show more
+++ b/Show more
				`@ -0,0 +1 @@`
				`ALTER TABLE "LiteLLM_ShadowEvalJob" ADD COLUMN IF NOT EXISTS "models" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];`