Merge branch 'litellm_internal_staging' into feature/ovalix-extended-guardrail

Resolves conflicts in the ovalix guardrail hook, where upstream's lint enforcement (LIT010 Final on locals, LIT011 frozen parameters, redundant !s conversion flags) landed on the same files this branch rewrote. Keeps this branch's logic and applies the new conventions to it: Final annotations on module constants and function-scope locals, no parameter rebinding, and untrusted payload parameters declared as object so the defensive isinstance narrowing is meaningful rather than redundant.
2026-09-07 08:26:10 +00:00 · 2026-08-13 15:08:34 +03:00 · 2026-08-13 15:08:34 +03:00 · da9e61431b
commit da9e61431b
parent e9e1fc6bcb 09889e1986
3452 changed files with 179017 additions and 80958 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@ -88,6 +88,59 @@ commands:
            rm -f /tmp/uv-install.sh
            echo 'export PATH="$HOME/.local/bin:$PATH"' >> "$BASH_ENV"
            export PATH="$HOME/.local/bin:$PATH"
+  install_node:
+    description: "Install the Node.js version pinned in ui/litellm-dashboard/.nvmrc (24.19.0, which bundles npm 11.17.0) with checksum verification, and prepend it to PATH. Run this on any executor whose image does not already ship that version, or `npm ci` in ui/litellm-dashboard fails EBADENGINE against the engines floor. Installs into /opt/node rather than over /usr/local on purpose: cimg/python:*-browsers ships its own node there, and unpacking the tarball on top of it leaves npm 11.17 files merged with the image's npm 11.9 tree, which reports the new version and then exits 1 on `npm ci` with no error text at all. Requires checkout, which the .nvmrc drift check reads."
+    steps:
+      - run:
+          name: Install Node.js 24.19.0
+          command: |
+            NODE_VERSION="24.19.0"
+            NODE_TARBALL="node-v${NODE_VERSION}-linux-x64.tar.xz"
+            NODE_EXPECTED_SHA="14b342e71204f811bde6153be8e04b62aef63c236fef92b55f9c83154b409647"
+            NVMRC_VERSION="$(tr -d '[:space:]' < ui/litellm-dashboard/.nvmrc)"
+            if [ "$NVMRC_VERSION" != "$NODE_VERSION" ]; then
+              echo "install_node: ui/litellm-dashboard/.nvmrc pins ${NVMRC_VERSION} but this command pins ${NODE_VERSION}; update NODE_VERSION and NODE_EXPECTED_SHA together" >&2
+              exit 1
+            fi
+            curl -sSLf -o "/tmp/${NODE_TARBALL}" "https://nodejs.org/dist/v${NODE_VERSION}/${NODE_TARBALL}"
+            echo "${NODE_EXPECTED_SHA}  /tmp/${NODE_TARBALL}" | sha256sum -c -
+            sudo mkdir -p /opt/node
+            sudo tar -xJf "/tmp/${NODE_TARBALL}" -C /opt/node --strip-components=1
+            rm -f "/tmp/${NODE_TARBALL}"
+            echo 'export PATH="/opt/node/bin:$PATH"' >> "$BASH_ENV"
+            export PATH="/opt/node/bin:$PATH"
+            node --version
+            npm --version
+  install_rust:
+    description: "Install pinned rustup (1.28.2) and Rust toolchain (1.97.1) with checksum verification. Adds ~/.cargo/bin to PATH. Run this before any `uv sync` or `uv build` of the workspace: the root package builds litellm-rust through maturin, and on an image without cargo maturin fetches an unpinned rustup and a floating toolchain by itself."
+    steps:
+      - run:
+          name: Install Rust (rustup 1.28.2, toolchain 1.97.1)
+          command: |
+            case "$(uname -m)" in
+              x86_64)
+                RUSTUP_TRIPLE=x86_64-unknown-linux-gnu
+                RUSTUP_SHA256=20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c
+                ;;
+              aarch64)
+                RUSTUP_TRIPLE=aarch64-unknown-linux-gnu
+                RUSTUP_SHA256=e3853c5a252fca15252d07cb23a1bdd9377a8c6f3efa01531109281ae47f841c
+                ;;
+              *)
+                echo "install_rust: unsupported architecture $(uname -m)" >&2
+                exit 1
+                ;;
+            esac
+            curl -sSLf -o /tmp/rustup-init \
+              "https://static.rust-lang.org/rustup/archive/1.28.2/${RUSTUP_TRIPLE}/rustup-init"
+            echo "${RUSTUP_SHA256}  /tmp/rustup-init" | sha256sum -c -
+            chmod +x /tmp/rustup-init
+            /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain 1.97.1
+            rm -f /tmp/rustup-init
+            echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> "$BASH_ENV"
+            export PATH="$HOME/.cargo/bin:$PATH"
+            rustc --version
+            cargo --version
  start_postgres:
    description: "Start a postgres-db container on port 5432 and wait until it accepts connections."
    parameters:
@ -163,6 +216,26 @@ commands:
            done
            echo "fake OpenAI endpoint did not become ready" >&2
            exit 1
+  start_cost_center_service:
+    description: "Start the stand-in cost center validation service (tests/store_model_in_db_tests/cost_center_service.py) on host port 9414 and wait until healthy. The proxy's team-metadata validator (team_metadata_validator_e2e.py, impl 'http') reaches it via TEAM_METADATA_VALIDATION_SERVICE_URL=http://host.docker.internal:9414/validate. Run after uv deps are synced."
+    steps:
+      - run:
+          name: Start cost center validation service
+          background: true
+          command: |
+            uv run --no-sync python tests/store_model_in_db_tests/cost_center_service.py --host 0.0.0.0 --port 9414
+      - run:
+          name: Wait for cost center validation service
+          command: |
+            for i in $(seq 1 30); do
+              if curl -sf http://localhost:9414/health >/dev/null 2>&1; then
+                echo "cost center validation service is up"
+                exit 0
+              fi
+              sleep 1
+            done
+            echo "cost center validation service did not become ready" >&2
+            exit 1
  setup_litellm_enterprise_pip:
    steps:
      - run:
@ -178,6 +251,7 @@ commands:
      - checkout
      - setup_google_dns
      - install_uv
+      - install_rust
      - restore_cache:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
@ -292,6 +366,7 @@ jobs:
      - checkout
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Build the wheel
          environment:
@ -324,6 +399,7 @@ jobs:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -397,6 +473,7 @@ jobs:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -471,6 +548,7 @@ jobs:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -522,6 +600,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -588,6 +667,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -628,6 +708,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -669,6 +750,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -702,6 +784,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - restore_cache:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
@ -752,6 +835,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - restore_cache:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
@ -803,6 +887,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -836,6 +921,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - restore_cache:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
@ -882,6 +968,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -928,6 +1015,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -970,6 +1058,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1016,6 +1105,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1063,6 +1153,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - restore_cache:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
@ -1103,6 +1194,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1148,6 +1240,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1192,6 +1285,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1224,6 +1318,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1267,6 +1362,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1311,6 +1407,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1355,6 +1452,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1386,6 +1484,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1432,6 +1531,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1477,6 +1577,7 @@ jobs:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1527,6 +1628,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1551,6 +1653,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1577,6 +1680,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1678,6 +1782,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1773,6 +1878,7 @@ jobs:
          at: ~/project
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1861,6 +1967,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -1944,6 +2051,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -2076,6 +2184,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -2162,6 +2271,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -2258,12 +2368,14 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
            uv sync --frozen --all-groups --all-extras --python 3.12
      - start_postgres
      - start_fake_openai_endpoint
+      - start_cost_center_service
      - attach_workspace:
          at: ~/project
      - run:
@ -2283,11 +2395,13 @@ jobs:
              -e STORE_MODEL_IN_DB="True" \
              -e LITELLM_MASTER_KEY="sk-1234" \
              -e FAKE_OPENAI_API_BASE=http://host.docker.internal:8190 \
+              -e TEAM_METADATA_VALIDATION_SERVICE_URL=http://host.docker.internal:9414/validate \
              -e LITELLM_LICENSE=$LITELLM_LICENSE \
              -e LITELLM_LOG=ERROR \
              --add-host host.docker.internal:host-gateway \
              --name my-app \
              -v $(pwd)/litellm/proxy/example_config_yaml/store_model_db_config.yaml:/app/config.yaml \
+              -v $(pwd)/litellm/proxy/example_config_yaml/team_metadata_validator_e2e.py:/app/team_metadata_validator_e2e.py \
              litellm-docker-database:ci \
              --config /app/config.yaml \
              --port 4000
@ -2333,6 +2447,7 @@ jobs:
      - setup_google_dns
      # Remove Docker CLI installation since it's already available in machine executor
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -2414,6 +2529,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -2499,20 +2615,9 @@ jobs:
            bundle exec rspec
          no_output_timeout: 30m
      # Install Node.js directly from nodejs.org with SHA256 verification,
-      # instead of piping NodeSource's setup_18.x apt-repo installer into
+      # instead of piping NodeSource's setup_24.x apt-repo installer into
      # sudo bash (which runs a mutable upstream script unattended).
-      - run:
-          name: Install Node.js 18.20.8
-          command: |
-            NODE_VERSION="18.20.8"
-            NODE_TARBALL="node-v${NODE_VERSION}-linux-x64.tar.xz"
-            NODE_EXPECTED_SHA="5467ee62d6af1411d46b6a10e3fb5cacc92734dbcef465fea14e7b90993001c9"
-            curl -sSLf -o "/tmp/${NODE_TARBALL}" "https://nodejs.org/dist/v${NODE_VERSION}/${NODE_TARBALL}"
-            echo "${NODE_EXPECTED_SHA}  /tmp/${NODE_TARBALL}" | sha256sum -c -
-            sudo tar -xJf "/tmp/${NODE_TARBALL}" -C /usr/local --strip-components=1
-            rm -f "/tmp/${NODE_TARBALL}"
-            node --version
-            npm --version
+      - install_node

      - run:
          name: Install Node.js test dependencies
@ -2553,6 +2658,7 @@ jobs:
      - skip_if_unrelated_changes
      - setup_google_dns
      - install_uv
+      - install_rust
      - run:
          name: Install Dependencies
          command: |
@ -2640,7 +2746,7 @@ jobs:

  ui_build:
    docker:
-      - image: cimg/node:20.19@sha256:35e64883e8d21bc345b0a7b04c35ee46442c127607ed1d8d7d37d8a1ed76db81
+      - image: cimg/node:24.19@sha256:8966565f07189a67d64d6808a2b127f31dafae566508e3547f55640e1070bfad
        auth:
          username: ${DOCKERHUB_USERNAME}
          password: ${DOCKERHUB_PASSWORD}
@ -2684,7 +2790,7 @@ jobs:

  ui_unit_tests:
    docker:
-      - image: cimg/node:20.19@sha256:35e64883e8d21bc345b0a7b04c35ee46442c127607ed1d8d7d37d8a1ed76db81
+      - image: cimg/node:24.19@sha256:8966565f07189a67d64d6808a2b127f31dafae566508e3547f55640e1070bfad
        auth:
          username: ${DOCKERHUB_USERNAME}
          password: ${DOCKERHUB_PASSWORD}
@ -2742,7 +2848,9 @@ jobs:
      - skip_if_unrelated_changes:
          category: client
      - setup_google_dns
+      - install_node
      - install_uv
+      - install_rust
      - restore_cache:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
@ -2757,7 +2865,7 @@ jobs:
            - ~/.cache/uv
      - restore_cache:
          keys:
-            - ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
+            - ui-e2e-node-deps-v4-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
      - run:
          name: Install Node dependencies and Playwright
          # The cimg/python:3.12-browsers image already ships the Chromium system
@ -2772,7 +2880,7 @@ jobs:
            npm ci
            npx playwright install chromium
      - save_cache:
-          key: ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
+          key: ui-e2e-node-deps-v4-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
          paths:
            - ui/litellm-dashboard/node_modules
            - tests/e2e/ui/node_modules
@ -2884,7 +2992,9 @@ jobs:
      - skip_if_unrelated_changes:
          category: client
      - setup_google_dns
+      - install_node
      - install_uv
+      - install_rust
      - restore_cache:
          keys:
            - v1-uv-cache-{{ checksum "uv.lock" }}
@ -2899,7 +3009,7 @@ jobs:
            - ~/.cache/uv
      - restore_cache:
          keys:
-            - ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
+            - ui-e2e-node-deps-v4-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
      - run:
          name: Install Node dependencies and Playwright
          command: |
@ -2909,7 +3019,7 @@ jobs:
            npm ci
            npx playwright install chromium
      - save_cache:
-          key: ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
+          key: ui-e2e-node-deps-v4-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
          paths:
            - ui/litellm-dashboard/node_modules
            - tests/e2e/ui/node_modules
--- a/.flake8
+++ b/.flake8
@ -1,46 +0,0 @@
-[flake8]
-ignore =
-    # The following ignores can be removed when formatting using black
-    W191,W291,W292,W293,W391,W504
-    E101,E111,E114,E116,E117,E121,E122,E123,E124,E125,E126,E127,E128,E129,E131,
-    E201,E202,E221,E222,E225,E226,E231,E241,E251,E252,E261,E265,E271,E272,E275,
-    E301,E302,E303,E305,E306,
-    # line break before binary operator
-    W503,
-    # inline comment should start with '# '
-    E262,
-    # too many leading '#' for block comment
-    E266,
-    # multiple imports on one line
-    E401,
-    # module level import not at top of file
-    E402,
-    # Line too long (82 > 79 characters)
-    E501,
-    # comparison to None should be 'if cond is None:'
-    E711,
-    # comparison to True should be 'if cond is True:' or 'if cond:'
-    E712,
-    # do not compare types, for exact checks use `is` / `is not`, for instance checks use `isinstance()`
-    E721,
-    # do not use bare 'except'
-    E722,
-    # x is imported but unused
-    F401,
-    # 'from . import *' used; unable to detect undefined names
-    F403,
-    # x may be undefined, or defined from star imports:
-    F405,
-    # f-string is missing placeholders
-    F541,
-    # dictionary key '' repeated with different values
-    F601,
-    # redefinition of unused x from line 123
-    F811,
-    # undefined name x
-    F821,
-    # local variable x is assigned to but never used
-    F841,
-
-# https://black.readthedocs.io/en/stable/guides/using_black_with_other_tools.html#flake8
-extend-ignore = E203
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@ -17,3 +17,24 @@

 # style: unify ruff format width on 120 (#31518)
 48b5a5a0cc5a694a11219416ee0b6eb6e620e74e
+
+# refactor(imports): move collections.abc names out of typing (#35495)
+397e8e4918777e4e60a7f5e88699e0a9a7dabb3d
+
+# refactor(lint): apply every safe ruff autofix and zero 28 strict-rule budgets (#35495)
+b604e2b20c6db2099085a2f0e59b7e99e87eed6f
+
+# refactor(logging): drop redundant !s conversion flags from f-strings (#35546)
+7b2d3440cba3160277470f7a0180098ae9b87864
+
+# perf: build log messages lazily so filtered-out log records cost nothing (#35703)
+c9887a1f94bc1e7e4bdfe64d640f0509a0bc19dd
+
+# feat(lint): enforce Final on locals and freeze function parameters (#35807)
+2708620d6a599cc73c1950a942d26ac26a7ed3d4
+
+# chore(lint): remove litellm/types from the ruff lint exclusion (#35926)
+4e32a8bf6a1e1af1e04b67c759841ccef44b2235
+
+# chore(lint): strip inert type: ignore comments and zero LIT009/LIT010/LIT011 headroom (#35928)
+338e411103ad5d7003e97f34f04fa36bca542dbe
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@ -23,30 +23,56 @@ body:
      label: What happened?
      description: Also tell us, what did you expect to happen?
      placeholder: Tell us what you see!
-      value: "A bug happened!"
    validations:
      required: true
  - type: textarea
-    id: steps-to-reproduce
+    id: user-flow
    attributes:
-      label: Steps to Reproduce
-      description: Please provide a numbered list of the exact steps to reproduce this bug (include a curl/python snippet to reproduce it). Number each step (1., 2., 3., ...) in the order you performed them.
+      label: User Flow
+      description: |
+        Two ordered lists, "Before a (hypothetical) fix" and "After a (hypothetical) fix", walking the same end user through the same task, written strictly from that user's seat. Every rule below applies.
+
+        - Describe the real application and the routes its users actually hit, not a generic scenario
+        - Lead each list with one plain sentence saying where the flow fails (before) or would succeed (after), then number the steps
+        - Every step is something the user does or observes: the HTTP method and full URL they hit, what they sent, and what visibly came back (status code, error text, the shape of an ID). UI steps name the page URL and what is on screen
+        - No LiteLLM internals: never name functions, files, DB tables, config classes, hooks, callbacks, or code paths. "The upload hands back an ID that looks like OpenAI's own `file-abc123` instead of the scrambled one the gateway returned" is right, "no managed-file row was registered" is wrong
+        - Keep the two lists step-for-step identical until they diverge, so the broken step is obvious
+        - If the bug has a security or authorization consequence, end each list with what another user can do that they shouldn't be able to, and what they could no longer do after a fix
      placeholder: |
-        1. config.yaml file/ .env file/ etc.
-        2. Run the following code...
-        3. Observe the error...
-      value: |
-        1. 
-        2. 
-        3. 
+        Before a (hypothetical) fix: a developer whose app streams chat completions gets no token counts back, so their cost dashboard reads zero
+
+        1. They send POST https://litellm-domain/v1/chat/completions with "stream": true and no stream_options
+        2. The last SSE chunk arrives with "usage": null, so their app records 0 prompt and 0 completion tokens
+        3. They open https://litellm-domain/ui/?page=logs and see the request logged at $0 spend
+
+        After a (hypothetical) fix: the same request comes back with real token counts, so the dashboard shows real spend
+
+        1. The proxy admin sets always_include_stream_usage: true and restarts the proxy
+        2. The developer sends the same POST https://litellm-domain/v1/chat/completions with "stream": true and no stream_options
+        3. The last SSE chunk now carries a usage object with real prompt and completion token counts
+        4. https://litellm-domain/ui/?page=logs shows that request at non-zero spend
    validations:
      required: true
  - type: textarea
-    id: logs
+    id: proof-of-bug
    attributes:
-      label: Relevant log output
-      description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
-      render: shell
+      label: Proof the bug occurs
+      description: |
+        The commands (e.g., curl) and their full output, screenshots, or a screen recording demonstrating that the bug happens. Every rule below applies.
+
+        - The proof must be completely e2e with no mocks, against a live proxy you ran yourself (e.g., `litellm --config config.yaml --detailed_debug` on localhost:4000), hitting real LLM provider APIs, costing real $ if needed, where the bug involves a provider call. `pytest` commands are not enough
+        - Show exactly what the end user sees or does, matching the User Flow above step for step
+        - Start with the config.yaml (or SDK setup) and any env vars the proxy ran with, then the exact version or commit hash the proof was captured at, so a maintainer can stand up the same proxy before running your commands. Keep the real values for env vars that aren't sensitive, they are often the reason the bug happens, and redact only the secrets: never paste a real API key, virtual key, database URL, or other credential, here or anywhere else in the issue
+        - If the bug applies to more than one of the LLM endpoints (/v1/responses, /v1/chat/completions, /v1/messages), include proof for every one of them, not just one
+        - For UI bugs: include screenshots and the page URLs you were on. Scrub keys and tokens out of screenshots too (for example, the virtual key is briefly shown in the panel right after you create a virtual key)
+      placeholder: |
+        Config / setup the proxy ran with:
+
+        Version or commit:
+
+        Commands and their full output:
+    validations:
+      required: true
  - type: dropdown
    id: component
    attributes:
--- a/.github/ISSUE_TEMPLATE/feature_request.yml
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@ -24,10 +24,53 @@ body:
    validations:
      required: true
  - type: textarea
-    id: motivation
+    id: user-flow
    attributes:
-      label: Motivation, pitch
-      description: Please outline the motivation for the proposal. Is your feature request related to a specific problem? e.g., "I'm working on X and would like Y to be possible". If this is related to another GitHub issue, please link here too.
+      label: User Flow
+      description: |
+        Two ordered lists, "Before this feature (today)" and "After this feature (ideal user flow)", walking the same end user through the same task, written strictly from that user's seat. Every rule below applies.
+
+        - Describe the real application and the routes its users actually hit, not a generic scenario. Link any related GitHub issue or provider API docs
+        - Lead each list with one plain sentence saying where the flow dead-ends today and what it would let them do instead, then number the steps
+        - Every step is something the user does or observes: the HTTP method and full URL they hit, what they sent, and what visibly came back (status code, error text, the shape of an ID). UI steps name the page URL and what is on screen
+        - No LiteLLM internals: never name functions, files, DB tables, config classes, hooks, callbacks, or code paths. Ask for the behavior you need, not the implementation you imagine
+        - Keep the two lists step-for-step identical until they diverge, so the missing capability is obvious
+        - "Before this feature" is also where you show the workaround you're living with, which is what tells us how badly this is needed
+      placeholder: |
+        Before this feature (today): a developer batching nightly summaries has no way to mark those calls as low priority, so they compete with live traffic for the same rate limit
+
+        1. They send POST https://litellm-domain/v1/chat/completions for 500 documents in a loop
+        2. Around document 120 they start getting 429s naming the rpm limit, and their user-facing chat app starts getting them too
+        3. Their workaround is a hand-rolled sleep between calls, which stretches the batch to 3 hours and still collides at peak
+
+        After this feature (ideal user flow): the same batch runs as background work that yields to live traffic
+
+        1. The developer sends the same POST with "service_tier": "flex"
+        2. Batch calls queue behind interactive ones instead of 429ing, and the response comes back with the tier it was served at
+        3. The live chat app keeps returning 200s throughout the batch
+        4. https://litellm-domain/ui/?page=logs shows the batch requests tagged with that tier
+    validations:
+      required: true
+  - type: textarea
+    id: how-far-you-got
+    attributes:
+      label: How far you got
+      description: |
+        Run as many steps of the "After this feature (ideal user flow)" list as you can against a live proxy you ran yourself (e.g., `litellm --config config.yaml --detailed_debug` on localhost:4000), then paste the commands (e.g., curl) and their full output, ending at the step that dead-ends. Every rule below applies.
+
+        - Say plainly what stopped you there, in user terms: the option you passed came back ignored, the response 400'd naming an unsupported field, there is no button on the page for it. This is what proves the feature is genuinely missing rather than undocumented
+        - No mocks. Where the flow involves a provider call, hit the real provider API, even if it costs real $. `pytest` commands are not enough
+        - Include the config.yaml (or SDK setup) and env vars the proxy ran with, plus the version or commit you were on. Keep the real values for env vars that aren't sensitive, and redact only the secrets: never paste a real API key, virtual key, database URL, or other credential, here or anywhere else in the issue
+        - If the provider already supports this, link their API docs and paste a direct call to them succeeding, so we can see the shape LiteLLM should be sending
+        - For UI asks: include screenshots of the page you got stuck on and its URL. Scrub keys and tokens out of screenshots too (for example, the virtual key is briefly shown in the panel right after you create a virtual key)
+      placeholder: |
+        Config / setup the proxy ran with:
+
+        Version or commit:
+
+        Commands and their full output, up to the step that dead-ends:
+
+        What stopped me there:
    validations:
      required: true
  - type: dropdown
--- a/.github/actions/cache-prisma-binaries/action.yml
+++ b/.github/actions/cache-prisma-binaries/action.yml
@ -0,0 +1,40 @@
+name: "Cache Prisma binaries"
+description: >-
+  Cache the Prisma CLI and engine binaries that `prisma generate` downloads, so
+  only the first job on a given prisma-client-py version pays for the download.
+
+  prisma-client-py shells out to `npm install prisma@<version>` whenever its
+  binary cache directory has no CLI entrypoint, which pulls ~85 MB of query and
+  schema engines over the network. That normally takes a few seconds, but it is
+  unbounded: one shard of a proxy-db run took 5m18s on that single step versus
+  3.8s on its eleven siblings, which pushed the job past its timeout and got a
+  fully passing test run cancelled.
+
+  Callers must not set PRISMA_BINARY_CACHE_DIR. The prisma-client-py default
+  (~/.cache/prisma-python/binaries/<prisma-version>/<engine-version>) is already
+  keyed by both versions, so a cache entry can never be served to a run that
+  expects different binaries.
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve prisma-client-py version
+      id: version
+      shell: bash
+      run: |
+        version="$(grep -A1 '^name = "prisma"$' uv.lock | sed -n 's/^version = "\(.*\)"$/\1/p' | head -1)"
+        if [ -z "${version}" ]; then
+          echo "could not resolve the prisma package version from uv.lock" >&2
+          exit 1
+        fi
+        echo "version=${version}" >> "$GITHUB_OUTPUT"
+
+    - name: Restore Prisma binaries
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        # ~/.cache/prisma-python holds the npm install tree prisma-client-py
+        # drives; ~/.cache/prisma is where @prisma/engines stages its downloads.
+        path: |
+          ~/.cache/prisma-python
+          ~/.cache/prisma
+        key: ${{ runner.os }}-prisma-binaries-${{ steps.version.outputs.version }}
--- a/.github/ci-coverage-allowlist.yml
+++ b/.github/ci-coverage-allowlist.yml
@ -0,0 +1,152 @@
+description: >-
+  Paths deliberately outside CI coverage, each with the reason it is exempt.
+  assert_ci_coverage.py fails when a test file or Dockerfile is neither invoked
+  by a job nor listed here, so every entry below is a decision on the record.
+
+test_paths:
+  - reason: >-
+      The end-to-end suite runs against a deployed proxy from its own in-cluster rig rather than
+      from a pull request; it needs a live gateway and provider credentials no PR job holds
+    paths:
+      - tests/e2e
+  - reason: >-
+      The documentation and code-quality workflows execute four files in this directory by name as
+      scripts and pytest never collects the directory, so these six run nowhere; listed individually
+      so a seventh cannot inherit the exemption
+    paths:
+      - tests/documentation_tests/test_exception_types.py
+      - tests/documentation_tests/test_general_setting_keys.py
+      - tests/documentation_tests/test_optional_params.py
+      - tests/documentation_tests/test_readme_providers.py
+      - tests/documentation_tests/test_requests_lib_usage.py
+      - tests/documentation_tests/test_standard_logging_payload.py
+  - reason: >-
+      Sibling files here are executed by name from the code-quality workflow; this one is referenced
+      by no job
+    paths:
+      - tests/code_coverage_tests/test_aio_http_image_conversion.py
+  - reason: >-
+      A second mirror of the package tree living beside tests/test_litellm, which is the mirror the
+      repo convention names; only test_no_hardcoded_secrets.py is invoked, from the linting
+      workflow, and whether this directory should exist at all is unresolved
+    paths:
+      - tests/litellm/a2a_protocol/providers/pydantic_ai_agents/test_pydantic_ai_agent_headers.py
+      - tests/litellm/a2a_protocol/providers/pydantic_ai_agents/test_pydantic_ai_agent_transformation.py
+      - tests/litellm/integrations/helicone/test_helicone_gemini.py
+      - tests/litellm/litellm_core_utils/test_json_schema_validation.py
+      - tests/litellm/llms/anthropic/test_anthropic_reasoning_effort.py
+      - tests/litellm/llms/anthropic/test_anthropic_schema_filter.py
+      - tests/litellm/llms/azure/test_azure_embedding.py
+      - tests/litellm/llms/bedrock/embed/test_embedding.py
+      - tests/litellm/llms/bedrock/test_nova_imported_models.py
+      - tests/litellm/llms/deepseek/chat/test_deepseek_chat_transformation.py
+      - tests/litellm/llms/gradient_ai/chat/test_gradient_ai_chat_transformation.py
+      - tests/litellm/llms/oci/chat/test_oci_chat_transformation.py
+      - tests/litellm/llms/openai_like/test_abliteration_provider.py
+      - tests/litellm/llms/openai_like/test_assemblyai_provider.py
+      - tests/litellm/llms/openai_like/test_empiriolabs_provider.py
+      - tests/litellm/llms/vertex_ai/agent_engine/test_transformation.py
+      - tests/litellm/llms/vertex_ai/gemini/test_transformation.py
+      - tests/litellm/llms/vertex_ai/text_to_speech/test_transformation.py
+      - tests/litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
+      - tests/litellm/proxy/agent_endpoints/test_agent_rbac.py
+      - tests/litellm/proxy/common_utils/test_rbac_utils.py
+      - tests/litellm/proxy/management_endpoints/test_common_utils.py
+      - tests/litellm/proxy/management_endpoints/test_cost_estimate_endpoint.py
+      - tests/litellm/proxy/test_claude_code_marketplace.py
+      - tests/litellm/proxy/test_init_litellm_callbacks.py
+      - tests/litellm/proxy/test_prisma_engine_watchdog.py
+      - tests/litellm/proxy/vector_store_endpoints/test_vector_store_rbac.py
+      - tests/litellm/test_bedrock_extended_beta_models.py
+      - tests/litellm/test_bedrock_nemotron_super.py
+      - tests/litellm/test_proxy_auth.py
+      - tests/litellm/test_router_retry_backoff_headers.py
+      - tests/litellm/test_sambanova_model_metadata.py
+      - tests/litellm/test_stream_chunk_builder_images.py
+  - reason: >-
+      Legacy proxy suite superseded by the proxy shards; no job invokes it and whether it still
+      describes supported behaviour is unresolved
+    paths:
+      - tests/old_proxy_tests/tests/test_anthropic_context_caching.py
+      - tests/old_proxy_tests/tests/test_anthropic_sdk.py
+      - tests/old_proxy_tests/tests/test_async.py
+      - tests/old_proxy_tests/tests/test_gemini_context_caching.py
+      - tests/old_proxy_tests/tests/test_langchain_embedding.py
+      - tests/old_proxy_tests/tests/test_langchain_request.py
+      - tests/old_proxy_tests/tests/test_llamaindex.py
+      - tests/old_proxy_tests/tests/test_mistral_sdk.py
+      - tests/old_proxy_tests/tests/test_openai_embedding.py
+      - tests/old_proxy_tests/tests/test_openai_exception_request.py
+      - tests/old_proxy_tests/tests/test_openai_request.py
+      - tests/old_proxy_tests/tests/test_openai_request_with_traceparent.py
+      - tests/old_proxy_tests/tests/test_openai_simple_embedding.py
+      - tests/old_proxy_tests/tests/test_openai_tts_request.py
+      - tests/old_proxy_tests/tests/test_pass_through_langfuse.py
+      - tests/old_proxy_tests/tests/test_q.py
+      - tests/old_proxy_tests/tests/test_simple_traceparent_openai.py
+      - tests/old_proxy_tests/tests/test_vertex_sdk_forward_headers.py
+      - tests/old_proxy_tests/tests/test_vtx_embedding.py
+      - tests/old_proxy_tests/tests/test_vtx_sdk_embedding.py
+  - reason: >-
+      No job invokes this suite and its files mix pure transformation tests with ones driving live
+      vendor vector stores, so assigning them needs a per-file decision
+    paths:
+      - tests/vector_store_tests/rag/test_rag_bedrock.py
+      - tests/vector_store_tests/rag/test_rag_openai.py
+      - tests/vector_store_tests/rag/test_rag_s3_vectors.py
+      - tests/vector_store_tests/rag/test_rag_vertex_ai.py
+      - tests/vector_store_tests/test_azure_ai_vector_store.py
+      - tests/vector_store_tests/test_azure_vector_store.py
+      - tests/vector_store_tests/test_bedrock_vector_store.py
+      - tests/vector_store_tests/test_gemini_vector_store.py
+      - tests/vector_store_tests/test_milvus_vector_store.py
+      - tests/vector_store_tests/test_openai_vector_store.py
+      - tests/vector_store_tests/test_ragflow_vector_store.py
+      - tests/vector_store_tests/test_s3_vectors_vector_store.py
+      - tests/vector_store_tests/test_vertex_ai_search_api_vector_store.py
+      - tests/vector_store_tests/test_vertex_ai_vector_store.py
+  - reason: >-
+      Throughput and memory-growth measurements whose runtime and variance make them unsuitable for
+      a per-pull-request job
+    paths:
+      - tests/load_tests/test_datadog_load_test.py
+      - tests/load_tests/test_langsmith_load_test.py
+      - tests/load_tests/test_linear_memory_growth.py
+      - tests/load_tests/test_memory_usage.py
+      - tests/load_tests/test_otel_load_test.py
+      - tests/load_tests/test_vertex_embeddings_load_test.py
+      - tests/load_tests/test_vertex_load_tests.py
+  - reason: >-
+      Third-party integration tests that skip themselves without OCI configuration or sandbox
+      credentials, neither of which a pull request job holds
+    paths:
+      - tests/integration/sandbox/test_e2b_sandbox.py
+      - tests/integration/test_oci_integration.py
+      - tests/integration/test_oci_proxy_integration.py
+  - reason: >-
+      Two prompt-factory tests sitting at the top level of tests/ instead of under the
+      tests/test_litellm mirror the shards enumerate; they need moving rather than a shard entry
+    paths:
+      - tests/litellm_core_utils/test_anthropic_dedup_factory.py
+      - tests/litellm_core_utils/test_bedrock_converse_dedup_factory.py
+  - reason: >-
+      A unit test for the proxy-extras package that no job invokes, while the package's other tests
+      live under tests/proxy_migration_tests
+    paths:
+      - tests/litellm-proxy-extras/test_litellm_proxy_extras_utils.py
+
+dockerfiles:
+  - reason: >-
+      The dashboard container is a static Next.js export served by nginx, and the dashboard build
+      and lint workflows already exercise that output, so building the image adds no signal about it
+    paths:
+      - ui/Dockerfile
+  - reason: >-
+      The Rust gateway ships as its own chart and package with a separate release pipeline, so its
+      image is not part of this repo's Python image set
+    paths:
+      - litellm-rust/crates/ai-gateway/Dockerfile
+  - reason: >-
+      An example image under cookbook/ that is documentation rather than a shipped artifact
+    paths:
+      - cookbook/litellm-ollama-docker-image/Dockerfile
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@ -13,6 +13,33 @@ How it solves it:
 - <blah>
 - ...

+## User Flow
+
+<!-- Two ordered lists, Before and After, walking the same end user through the same task, written strictly from that user's seat
+     Read the linked issue, ticket, or customer thread first so the flow reflects the real application and the routes its users actually hit; don't invent a generic scenario
+     Lead each list with one plain sentence saying where the flow fails (Before) or succeeds (After), then number the steps
+     Every step is something the user does or observes: the HTTP method and full URL they hit, what they sent, and what visibly came back (status code, error text, the shape of an ID). UI steps name the page URL and what is on screen
+     No LiteLLM internals: never name functions, files, DB tables, config classes, hooks, callbacks, or code paths. "The upload hands back an ID that looks like OpenAI's own `file-abc123` instead of the scrambled one the gateway returned" is right, "no managed-file row was registered" is wrong
+     Keep the two lists step-for-step identical until they diverge, so the changed step is obvious
+     If the bug had a security or authorization consequence, end each list with what another user could or could no longer do
+     Regenerate this section whenever new commits change the PR's behavior, so it never describes an older revision
+
+Example:
+
+Before: a developer whose app streams chat completions gets no token counts back, so their cost dashboard reads zero
+
+1. They send POST https://litellm-domain/v1/chat/completions with `"stream": true` and no `stream_options`
+2. The last SSE chunk arrives with `"usage": null`, so their app records 0 prompt and 0 completion tokens
+3. They open https://litellm-domain/ui/?page=logs and see the request logged at $0 spend
+
+After: the same request comes back with real token counts, so the dashboard shows real spend
+
+1. The proxy admin sets `always_include_stream_usage: true` and restarts the proxy
+2. The developer sends the same POST https://litellm-domain/v1/chat/completions with `"stream": true` and no `stream_options`
+3. The last SSE chunk now carries a `usage` object with real prompt and completion token counts
+4. https://litellm-domain/ui/?page=logs shows that request at non-zero spend
+-->
+
 ## Relevant issues

 <!-- e.g., "Fixes #000" -->
@ -56,7 +83,11 @@ If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slac
 🚄 Infrastructure
 ✅ Test

-## Changes
+## Caveats (if any)
+
+<!-- Short bullet points, just like the TLDR: one line per bullet, roughly 10 words max
+     Call out known limitations, follow-up work, or anything a reviewer should watch out for
+     Leave this section empty if there are none -->

 ## QA runbook

--- a/.github/scripts/assert_ci_coverage.py
+++ b/.github/scripts/assert_ci_coverage.py
@ -0,0 +1,262 @@
+from __future__ import annotations
+
+import pathlib
+import re
+import sys
+from collections.abc import Iterable, Mapping, Sequence
+from dataclasses import dataclass
+
+import yaml
+
+REPO_ROOT = pathlib.Path(__file__).resolve().parents[2]
+WORKFLOW_DIR = REPO_ROOT / ".github" / "workflows"
+CIRCLECI_CONFIG = REPO_ROOT / ".circleci" / "config.yml"
+ALLOWLIST_FILE = REPO_ROOT / ".github" / "ci-coverage-allowlist.yml"
+TESTS_ROOT = REPO_ROOT / "tests"
+
+ALLOWLIST_KEYS = frozenset({"description", "test_paths", "dockerfiles"})
+PATH_FILTER_KEYS = frozenset({"paths", "paths-ignore"})
+TEST_PATH_KEYS = frozenset({"test-path", "test-paths"})
+DOCKERFILE_INPUT_KEYS = frozenset({"file", "dockerfile"})
+TEST_RUNNER_RE = re.compile(r"\bpytest\b|\bcircleci tests\b|\bhelm unittest\b|\bplaywright test\b|\bpython[0-9.]*\s")
+IMAGE_BUILD_RE = re.compile(r"\bdocker\s+(?:buildx\s+)?build\b")
+TEST_TOKEN_RE = re.compile(r"tests/[A-Za-z0-9_./*?-]+")
+DOCKERFILE_TOKEN_RE = re.compile(r"[A-Za-z0-9_./-]*Dockerfile[A-Za-z0-9_.-]*")
+COMMENT_RE = re.compile(r"^\s*#.*$", re.MULTILINE)
+GLOB_CHARS = frozenset("*?")
+
+
+@dataclass(frozen=True, slots=True)
+class AllowEntry:
+    paths: tuple[str, ...]
+    reason: str
+
+
+@dataclass(frozen=True, slots=True)
+class Allowlist:
+    test_paths: tuple[AllowEntry, ...]
+    dockerfiles: tuple[AllowEntry, ...]
+
+    def covers_test(self, relative_path: str) -> bool:
+        return any(_token_covers(path, relative_path) for entry in self.test_paths for path in entry.paths)
+
+    def covers_dockerfile(self, relative_path: str) -> bool:
+        return any(relative_path == path for entry in self.dockerfiles for path in entry.paths)
+
+
+@dataclass(frozen=True, slots=True)
+class Scalar:
+    key: str
+    value: str
+
+
+@dataclass(frozen=True, slots=True)
+class Finding:
+    subject: str
+    detail: str
+
+
+def _scalars(node: object, key: str) -> tuple[Scalar, ...]:
+    if isinstance(node, str):
+        return (Scalar(key=key, value=node),)
+    if isinstance(node, Mapping):
+        return tuple(
+            scalar
+            for child_key, value in node.items()
+            if child_key not in PATH_FILTER_KEYS
+            for scalar in _scalars(value, str(child_key))
+        )
+    if isinstance(node, Sequence):
+        return tuple(scalar for item in node for scalar in _scalars(item, key))
+    return ()
+
+
+def _config_files() -> tuple[pathlib.Path, ...]:
+    workflows = tuple(sorted(path for path in WORKFLOW_DIR.iterdir() if path.suffix in (".yml", ".yaml")))
+    circleci = (CIRCLECI_CONFIG,) if CIRCLECI_CONFIG.is_file() else ()
+    return workflows + circleci
+
+
+def _all_scalars() -> tuple[Scalar, ...]:
+    return tuple(
+        scalar
+        for path in _config_files()
+        for scalar in _scalars(yaml.safe_load(path.read_text(encoding="utf-8")), path.name)
+    )
+
+
+def _uncommented(value: str) -> str:
+    return COMMENT_RE.sub("", value)
+
+
+def _invoked_test_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
+    return frozenset(
+        match.group(0).rstrip("/")
+        for scalar in scalars
+        if scalar.key in TEST_PATH_KEYS or TEST_RUNNER_RE.search(scalar.value)
+        for match in TEST_TOKEN_RE.finditer(_uncommented(scalar.value))
+    )
+
+
+def _built_dockerfile_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
+    return frozenset(
+        match.group(0)
+        for scalar in scalars
+        if scalar.key in DOCKERFILE_INPUT_KEYS or IMAGE_BUILD_RE.search(scalar.value)
+        for match in DOCKERFILE_TOKEN_RE.finditer(_uncommented(scalar.value))
+    )
+
+
+def _glob_to_regex(token: str) -> re.Pattern[str]:
+    parts = re.split(r"(\*\*/|\*\*|\*|\?)", token)
+    translated = "".join(
+        {"**/": r"(?:.*/)?", "**": r".*", "*": r"[^/]*", "?": r"[^/]"}.get(part, re.escape(part)) for part in parts
+    )
+    return re.compile(rf"{translated}(?:/.*)?$")
+
+
+def _token_covers(token: str, relative_path: str) -> bool:
+    if GLOB_CHARS & set(token):
+        return _glob_to_regex(token).match(relative_path) is not None
+    return relative_path == token or relative_path.startswith(f"{token}/")
+
+
+def _test_files() -> tuple[str, ...]:
+    return tuple(
+        sorted(
+            path.relative_to(REPO_ROOT).as_posix()
+            for path in TESTS_ROOT.rglob("test_*.py")
+            if path.is_file() and "node_modules" not in path.parts
+        )
+    )
+
+
+def _dockerfiles() -> tuple[str, ...]:
+    return tuple(
+        sorted(
+            path.relative_to(REPO_ROOT).as_posix()
+            for path in REPO_ROOT.rglob("Dockerfile*")
+            if path.is_file()
+            and ".git" not in path.parts
+            and "node_modules" not in path.parts
+            and not path.name.endswith(".dockerignore")
+        )
+    )
+
+
+def _uncovered_tests(allowlist: Allowlist, tokens: frozenset[str]) -> tuple[Finding, ...]:
+    uncovered = tuple(
+        relative_path
+        for relative_path in _test_files()
+        if not any(_token_covers(token, relative_path) for token in tokens) and not allowlist.covers_test(relative_path)
+    )
+    directories = tuple(dict.fromkeys(path.rsplit("/", 1)[0] for path in uncovered))
+    return tuple(
+        Finding(
+            subject=directory,
+            detail=_describe(tuple(p for p in uncovered if p.rsplit("/", 1)[0] == directory)),
+        )
+        for directory in directories
+    )
+
+
+def _describe(paths: tuple[str, ...]) -> str:
+    names = ", ".join(path.rsplit("/", 1)[1] for path in paths[:3])
+    suffix = f", +{len(paths) - 3} more" if len(paths) > 3 else ""
+    return f"{len(paths)} test file(s) invoked by no job: {names}{suffix}"
+
+
+def _uncovered_dockerfiles(allowlist: Allowlist, tokens: frozenset[str]) -> tuple[Finding, ...]:
+    return tuple(
+        Finding(subject=relative_path, detail="built by no job")
+        for relative_path in _dockerfiles()
+        if relative_path not in tokens and not allowlist.covers_dockerfile(relative_path)
+    )
+
+
+def _parse_entry(item: object, section: str) -> AllowEntry:
+    if not isinstance(item, dict):
+        raise SystemExit(f"{ALLOWLIST_FILE.name}: '{section}' entries must be mappings")
+    paths = item.get("paths")
+    reason = item.get("reason")
+    if (
+        not isinstance(paths, list)
+        or not paths
+        or not all(isinstance(path, str) for path in paths)
+        or not isinstance(reason, str)
+        or not reason.strip()
+    ):
+        raise SystemExit(
+            f"{ALLOWLIST_FILE.name}: every '{section}' entry needs a non-empty 'paths' "
+            "list of strings and a non-empty 'reason'"
+        )
+    return AllowEntry(paths=tuple(paths), reason=reason)
+
+
+def _parse_entries(raw: object, section: str) -> tuple[AllowEntry, ...]:
+    if not isinstance(raw, list):
+        raise SystemExit(f"{ALLOWLIST_FILE.name}: '{section}' must be a list")
+    return tuple(_parse_entry(item, section) for item in raw)
+
+
+def _load_allowlist() -> Allowlist:
+    if not ALLOWLIST_FILE.is_file():
+        return Allowlist(test_paths=(), dockerfiles=())
+    raw = yaml.safe_load(ALLOWLIST_FILE.read_text(encoding="utf-8")) or {}
+    if not isinstance(raw, dict):
+        raise SystemExit(f"{ALLOWLIST_FILE.name}: top level must be a mapping")
+    unknown = sorted(str(key) for key in raw if key not in ALLOWLIST_KEYS)
+    if unknown:
+        raise SystemExit(
+            f"{ALLOWLIST_FILE.name}: unknown top-level key(s) {unknown}; expected only {sorted(ALLOWLIST_KEYS)}"
+        )
+    return Allowlist(
+        test_paths=_parse_entries(raw.get("test_paths", []), "test_paths"),
+        dockerfiles=_parse_entries(raw.get("dockerfiles", []), "dockerfiles"),
+    )
+
+
+def _write(message: str) -> None:
+    sys.stdout.write(f"{message}\n")
+
+
+def _report(title: str, findings: tuple[Finding, ...], remedy: str) -> None:
+    _write(f"ERROR: {title}")
+    for finding in findings:
+        _write(f"  - {finding.subject}: {finding.detail}")
+    _write("")
+    _write(remedy)
+    _write("")
+
+
+def main() -> int:
+    allowlist = _load_allowlist()
+    scalars = _all_scalars()
+
+    test_findings = _uncovered_tests(allowlist, _invoked_test_tokens(scalars))
+    dockerfile_findings = _uncovered_dockerfiles(allowlist, _built_dockerfile_tokens(scalars))
+
+    if test_findings:
+        _report(
+            "test files that no CI job invokes",
+            test_findings,
+            "Add each to a job's test path, or list it in .github/ci-coverage-allowlist.yml with a reason.",
+        )
+    if dockerfile_findings:
+        _report(
+            "Dockerfiles that no CI job builds",
+            dockerfile_findings,
+            "Build each in a workflow, or list it in .github/ci-coverage-allowlist.yml with a reason.",
+        )
+    if test_findings or dockerfile_findings:
+        return 1
+
+    _write(
+        f"OK: {len(_test_files())} test files and {len(_dockerfiles())} Dockerfiles are each "
+        "invoked by at least one job or carry an explicit allowlist entry."
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
--- a/.github/scripts/triage_with_llm.py
+++ b/.github/scripts/triage_with_llm.py
@ -582,7 +582,9 @@ def build_issue_prompt(*, title: str, body: str) -> str:
                  Commands whose external dependencies (LLM provider, DB,
                  network) are mocked or stubbed do NOT count.
              Prose-only "steps to reproduce" with no run output, video, or
-              screenshot do NOT satisfy (1).
+              screenshot do NOT satisfy (1). An unfilled template scaffold
+              (bare headings such as "Version or commit:" with nothing under
+              them, empty numbered lists) counts as absent, not as evidence.
          (2) Expected vs. actual behavior (`has_expected_vs_actual`).

        FAIL the bug report if either (1) or (2) is missing. Do not bias
@ -595,6 +597,13 @@ def build_issue_prompt(*, title: str, body: str) -> str:
            that it does not today).
          - Motivation / use case with a concrete example (config, API call,
            UI flow, or scenario showing what's blocked today).
+          - END-TO-END EVIDENCE OF THE DEAD-END (set
+            `has_dead_end_evidence=true` only when this is present): a video,
+            a screenshot, or the exact command(s) actually run paired with
+            their real output, showing the point where the flow stops today.
+            Mocked or stubbed dependencies do NOT count, and an unfilled
+            template scaffold (bare headings, empty numbered lists) counts as
+            absent.

        For an issue that is neither a bug report nor a feature request (a
        question, support request, or discussion), PASS as long as it has a
@ -608,6 +617,7 @@ def build_issue_prompt(*, title: str, body: str) -> str:
          "has_repro": boolean,
          "has_expected_vs_actual": boolean,
          "has_motivation_example": boolean,
+          "has_dead_end_evidence": boolean,
          "missing": ["plain-english strings naming what is missing"],
          "explanation": "1-2 sentence reasoning for the team to skim"
        }}
@ -705,6 +715,10 @@ _ISSUE_BUG_LABELS: tuple[tuple[str, str], ...] = (
 )
 _ISSUE_FEATURE_LABELS: tuple[tuple[str, str], ...] = (
    ("has_motivation_example", "Motivation and concrete example"),
+    (
+        "has_dead_end_evidence",
+        "End-to-end evidence of the dead-end (video, screenshot, or command + real output)",
+    ),
 )


@ -836,8 +850,11 @@ def format_issue_close_comment(verdict: dict) -> str:
        "video, a screenshot, or the exact commands you ran with their real output / "
        "traceback) plus expected vs. actual behavior. Written steps with no run output, "
        "video, or screenshot don't count, and mocked or stubbed runs don't count.\n"
-        "   - For **feature requests**: a concrete description of what should change, plus a "
-        "use case and example (config / API call / UI flow).\n"
+        "   - For **feature requests**: a concrete description of what should change, a "
+        "use case and example (config / API call / UI flow), plus end-to-end evidence of "
+        "the dead-end (a video, a screenshot, or the exact commands you ran with their "
+        "real output showing where the flow stops today). Mocked or stubbed runs don't "
+        "count.\n"
        "2. Comment `@agent-shin reconsider`. I'll re-run triage and reopen the issue if it "
        "now meets the bar. (GitHub doesn't let external authors reopen an issue a maintainer "
        "or bot closed, so the comment-based reconsider is the reliable path.)\n"
@ -943,8 +960,10 @@ def format_grace_warning_issue_comment(verdict: dict) -> str:
        "screenshot, or the exact commands you ran with their real output / traceback) plus "
        "expected vs. actual behavior. Written steps with no run output don't count, and "
        "mocked or stubbed runs don't count.\n"
-        "- For **feature requests**: a concrete description of what should change, plus a use "
-        "case and example (config / API call / UI flow).\n"
+        "- For **feature requests**: a concrete description of what should change, a use "
+        "case and example (config / API call / UI flow), plus end-to-end evidence of the "
+        "dead-end (a video, a screenshot, or the exact commands you ran with their real "
+        "output showing where the flow stops today). Mocked or stubbed runs don't count.\n"
        "\n"
        "**If the issue does get auto-closed in 2 hours**, comment `@agent-shin reconsider` "
        "and I'll re-evaluate. If it now meets the bar, I'll reopen the issue.\n"
--- a/.github/workflows/_test-unit-base.yml
+++ b/.github/workflows/_test-unit-base.yml
@ -18,10 +18,25 @@ on:
        type: number
        default: 2
      timeout-minutes:
-        description: "Job timeout in minutes"
+        description: >-
+          Timeout for the test step alone. Setup (checkout, dependency install,
+          Prisma client generation) gets its own allowance on top, so a slow
+          runner or a cold binary download can never cancel passing tests.
        required: false
        type: number
        default: 20
+      job-timeout-minutes:
+        description: >-
+          Backstop for the whole job. Keep it >= `timeout-minutes` plus 35: 30 for
+          the per-step ceilings on the setup steps below, and 5 for the runner
+          overhead the job clock charges but no step owns (job init, step
+          transitions, post-job cleanup). That headroom is what makes the test
+          budget a floor rather than a hope, since setup cannot overrun into it
+          without failing its own step first. GitHub expressions have no
+          arithmetic, so the sum is passed in rather than computed.
+        required: false
+        type: number
+        default: 55
      max-failures:
        description: "Stop after this many failures"
        required: false
@ -44,30 +59,35 @@ jobs:
  run:
    name: Run tests
    runs-on: ubuntu-latest
-    timeout-minutes: ${{ inputs.timeout-minutes }}
+    timeout-minutes: ${{ inputs.job-timeout-minutes }}
    outputs:
      decision: ${{ steps.changes.outputs.decision }}

    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        timeout-minutes: 3
        with:
          persist-credentials: false

      - name: Detect backend-relevant changes
        id: changes
+        timeout-minutes: 2
        uses: ./.github/actions/detect-backend-changes

      - name: Set up Python
+        timeout-minutes: 3
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"

      - name: Set up uv
+        timeout-minutes: 3
        uses: ./.github/actions/setup-uv-with-retries
        with:
          version: "0.10.9"

      - name: Cache uv dependencies
+        timeout-minutes: 5
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
@ -79,18 +99,24 @@ jobs:

      - name: Install dependencies
        if: steps.changes.outputs.decision != 'skip'
+        timeout-minutes: 8
        run: |
          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml

+      - name: Cache Prisma binaries
+        if: steps.changes.outputs.decision != 'skip'
+        timeout-minutes: 3
+        uses: ./.github/actions/cache-prisma-binaries
+
      - name: Generate Prisma client
        if: steps.changes.outputs.decision != 'skip'
-        env:
-          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        timeout-minutes: 3
        run: |
          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

      - name: Run tests
        if: steps.changes.outputs.decision != 'skip'
+        timeout-minutes: ${{ inputs.timeout-minutes }}
        env:
          TEST_PATH: ${{ inputs.test-path }}
          MAX_FAILURES: ${{ inputs.max-failures }}
@ -154,6 +180,19 @@ jobs:
          merge-multiple: true

      - name: Upload to Codecov
+        id: codecov-upload
+        continue-on-error: true
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          flags: ${{ inputs.artifact-name }}
+          fail_ci_if_error: false
+
+      - name: Upload to Codecov (retry)
+        if: steps.codecov-upload.outcome == 'failure'
+        continue-on-error: true
        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
        with:
          use_oidc: true
--- a/.github/workflows/check-schema-sync.yml
+++ b/.github/workflows/check-schema-sync.yml
@ -10,6 +10,10 @@ on:
 permissions:
  contents: read

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  check-sync:
    name: Verify schema.prisma copies match root
--- a/.github/workflows/check-ui-api-types.yml
+++ b/.github/workflows/check-ui-api-types.yml
@ -2,18 +2,19 @@ name: Check UI API Types Sync

 on:
  pull_request:
-    paths:
-      - "litellm/proxy/**"
-      - "litellm/types/**"
-      - "ui/litellm-dashboard/src/lib/http/schema.d.ts"
-      - "ui/litellm-dashboard/scripts/gen-api-types.mjs"
-      - "ui/litellm-dashboard/package.json"
-      - "ui/litellm-dashboard/package-lock.json"
-      - ".github/workflows/check-ui-api-types.yml"
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_staging
+      - "litellm_**"

 permissions:
  contents: read

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
  check-sync:
    name: Verify schema.d.ts matches the proxy OpenAPI spec
@ -24,18 +25,39 @@ jobs:
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          persist-credentials: false
+          fetch-depth: 2
+
+      - name: Detect changes that can affect the generated types
+        id: changes
+        run: |
+          set -euo pipefail
+          if ! base="$(git rev-parse --verify --quiet HEAD^2 >/dev/null && git rev-parse HEAD^1)"; then
+            echo "Not a pull request merge commit, running the full check."
+            echo "relevant=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          files="$(git diff --name-only "$base" HEAD)"
+          if grep -Eq '^(litellm/(proxy|types)/|ui/litellm-dashboard/(src/lib/http/schema\.d\.ts|scripts/gen-api-types\.mjs|package(-lock)?\.json)$|\.github/workflows/check-ui-api-types\.yml$)' <<< "$files"; then
+            echo "relevant=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No proxy, types or generator changes in this pull request, nothing to verify."
+            echo "relevant=false" >> "$GITHUB_OUTPUT"
+          fi

      - name: Set up Python
+        if: steps.changes.outputs.relevant == 'true'
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"

      - name: Set up uv
+        if: steps.changes.outputs.relevant == 'true'
        uses: ./.github/actions/setup-uv-with-retries
        with:
          version: "0.10.9"

      - name: Cache uv dependencies
+        if: steps.changes.outputs.relevant == 'true'
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
@ -46,31 +68,39 @@ jobs:
            ${{ runner.os }}-uv-

      - name: Install backend dependencies
+        if: steps.changes.outputs.relevant == 'true'
        run: .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router

+      - name: Cache Prisma binaries
+        if: steps.changes.outputs.relevant == 'true'
+        uses: ./.github/actions/cache-prisma-binaries
+
      - name: Generate Prisma client
-        env:
-          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        if: steps.changes.outputs.relevant == 'true'
        run: uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

      - name: Set up Node.js
+        if: steps.changes.outputs.relevant == 'true'
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
-          node-version: "20"
+          node-version-file: ui/litellm-dashboard/.nvmrc
          cache: "npm"
          cache-dependency-path: ui/litellm-dashboard/package-lock.json

      - name: Install dashboard dependencies
+        if: steps.changes.outputs.relevant == 'true'
        working-directory: ui/litellm-dashboard
        run: npm ci

      - name: Regenerate types from the live spec
+        if: steps.changes.outputs.relevant == 'true'
        working-directory: ui/litellm-dashboard
        env:
          LITELLM_PYTHON: "uv run --no-sync python"
        run: npm run gen:api

      - name: Fail if types are stale
+        if: steps.changes.outputs.relevant == 'true'
        run: |
          if ! git diff --exit-code -- ui/litellm-dashboard/src/lib/http/schema.d.ts; then
            echo "::error file=ui/litellm-dashboard/src/lib/http/schema.d.ts::Generated API types are out of sync with the proxy OpenAPI spec."
--- a/.github/workflows/ci-coverage.yml
+++ b/.github/workflows/ci-coverage.yml
@ -0,0 +1,42 @@
+name: "CI Coverage"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_staging
+      - "litellm_**"
+  push:
+    branches:
+      - main
+      - litellm_internal_staging
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  assert-ci-coverage:
+    name: assert-ci-coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Assert every test file and Dockerfile is invoked by a job
+        run: |
+          python -m pip install "pyyaml==6.0.3"
+          python .github/scripts/assert_ci_coverage.py
--- a/.github/workflows/conventional-commits.yml
+++ b/.github/workflows/conventional-commits.yml
@ -14,6 +14,10 @@ on:
 permissions:
  pull-requests: read

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  lint-pr-title:
    name: Validate PR title
--- a/.github/workflows/create_daily_oss_agent_shin_branch.yml
+++ b/.github/workflows/create_daily_oss_agent_shin_branch.yml
@ -13,35 +13,16 @@ jobs:
      contents: write

    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
      - name: Create daily oss-agent-shin branch
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
-          # Configure Git user
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          # Generate branch name with MM_DD_YYYY format
          BRANCH_NAME="litellm_oss_agent_shin_$(date +'%m_%d_%Y')"
          echo "Creating branch: $BRANCH_NAME"
-
-          # Fetch all branches
-          git fetch --all
-
-          # Check if the branch already exists
-          if git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
+          if gh api "repos/${{ github.repository }}/git/ref/heads/$BRANCH_NAME" --silent 2>/dev/null; then
            echo "Branch $BRANCH_NAME already exists. Skipping creation."
-          else
-            echo "Creating new branch: $BRANCH_NAME"
-            # Create the new branch from main
-            git checkout -b $BRANCH_NAME origin/main
-            # Push the new branch
-            git push origin $BRANCH_NAME
-            echo "Successfully created and pushed branch: $BRANCH_NAME"
+            exit 0
          fi
+          MAIN_SHA=$(gh api "repos/${{ github.repository }}/git/ref/heads/main" --jq '.object.sha')
+          gh api "repos/${{ github.repository }}/git/refs" -f ref="refs/heads/$BRANCH_NAME" -f sha="$MAIN_SHA" --silent
+          echo "Successfully created branch: $BRANCH_NAME at $MAIN_SHA"
--- a/.github/workflows/create_daily_staging_branch.yml
+++ b/.github/workflows/create_daily_staging_branch.yml
@ -13,38 +13,19 @@ jobs:
      contents: write

    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
      - name: Create daily staging branch
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
-          # Configure Git user
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          # Generate branch name with MM_DD_YYYY format
          BRANCH_NAME="litellm_oss_staging_$(date +'%m_%d_%Y')"
          echo "Creating branch: $BRANCH_NAME"
-
-          # Fetch all branches
-          git fetch --all
-
-          # Check if the branch already exists
-          if git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
+          if gh api "repos/${{ github.repository }}/git/ref/heads/$BRANCH_NAME" --silent 2>/dev/null; then
            echo "Branch $BRANCH_NAME already exists. Skipping creation."
-          else
-            echo "Creating new branch: $BRANCH_NAME"
-            # Create the new branch from main
-            git checkout -b $BRANCH_NAME origin/main
-            # Push the new branch
-            git push origin $BRANCH_NAME
-            echo "Successfully created and pushed branch: $BRANCH_NAME"
+            exit 0
          fi
+          MAIN_SHA=$(gh api "repos/${{ github.repository }}/git/ref/heads/main" --jq '.object.sha')
+          gh api "repos/${{ github.repository }}/git/refs" -f ref="refs/heads/$BRANCH_NAME" -f sha="$MAIN_SHA" --silent
+          echo "Successfully created branch: $BRANCH_NAME at $MAIN_SHA"

  create-internal-dev-branch:
    if: github.repository == 'BerriAI/litellm'
@ -53,35 +34,16 @@ jobs:
      contents: write

    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
      - name: Create internal dev branch
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
-          # Configure Git user
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          # Generate branch name with MM_DD_YYYY format
          BRANCH_NAME="litellm_internal_dev_$(date +'%m_%d_%Y')"
          echo "Creating branch: $BRANCH_NAME"
-
-          # Fetch all branches
-          git fetch --all
-
-          # Check if the branch already exists
-          if git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
+          if gh api "repos/${{ github.repository }}/git/ref/heads/$BRANCH_NAME" --silent 2>/dev/null; then
            echo "Branch $BRANCH_NAME already exists. Skipping creation."
-          else
-            echo "Creating new branch: $BRANCH_NAME"
-            # Create the new branch from main
-            git checkout -b $BRANCH_NAME origin/main
-            # Push the new branch
-            git push origin $BRANCH_NAME
-            echo "Successfully created and pushed branch: $BRANCH_NAME"
+            exit 0
          fi
+          MAIN_SHA=$(gh api "repos/${{ github.repository }}/git/ref/heads/main" --jq '.object.sha')
+          gh api "repos/${{ github.repository }}/git/refs" -f ref="refs/heads/$BRANCH_NAME" -f sha="$MAIN_SHA" --silent
+          echo "Successfully created branch: $BRANCH_NAME at $MAIN_SHA"
--- a/.github/workflows/guard-fork-dependencies.yml
+++ b/.github/workflows/guard-fork-dependencies.yml
@ -15,6 +15,10 @@ on:

 permissions: {}

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  guard:
    name: Block fork dependency changes
--- a/.github/workflows/helm_unit_test.yml
+++ b/.github/workflows/helm_unit_test.yml
@ -9,6 +9,10 @@ on:
 permissions:
  contents: read

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  unit-test:
    runs-on: ubuntu-latest
@ -23,21 +27,28 @@ jobs:
        with:
          version: "3.11.1"

+      - name: Download and verify Helm Unit Test Plugin
+        run: |
+          curl -fsSLo "$RUNNER_TEMP/helm-unittest.tgz" https://github.com/helm-unittest/helm-unittest/releases/download/v0.8.2/helm-unittest-linux-amd64-0.8.2.tgz
+          echo "56ab3091e6fa52a7c92ee951def9bed957f295d9ce98483aed404e748d7b3a94  $RUNNER_TEMP/helm-unittest.tgz" | sha256sum -c -
+
      - name: Install Helm Unit Test Plugin
        run: |
-          helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.4.4
-      - name: Verify Helm Unit Test Plugin integrity
-        run: |
-          EXPECTED_SHA="e251ba198448629678ff2168e1a469249d998155"
          PLUGIN_DIR="$(helm env HELM_PLUGINS)/helm-unittest"
-          ACTUAL_SHA="$(git -C "$PLUGIN_DIR" rev-parse HEAD)"
-          if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then
-            echo "::error::Helm unittest plugin checksum mismatch! Expected $EXPECTED_SHA but got $ACTUAL_SHA"
-            exit 1
-          fi
-          echo "Helm unittest plugin integrity verified: $ACTUAL_SHA"
+          mkdir -p "$PLUGIN_DIR"
+          tar -xzf "$RUNNER_TEMP/helm-unittest.tgz" -C "$PLUGIN_DIR"
+          helm plugin list

      - name: Run unit tests
        run: |
-          helm unittest -f 'tests/*.yaml' helm/litellm-helm
-          helm unittest -f 'tests/*.yaml' helm/litellm
+          for chart in helm/litellm-helm helm/litellm; do
+            declared="$(grep -h '^suite:' "$chart"/tests/*.yaml | wc -l | tr -d '[:space:]')"
+            output="$(mktemp)"
+            helm unittest -f 'tests/*.yaml' "$chart" | tee "$output"
+            executed="$(sed -n 's/^Test Suites:.*[[:space:]]\([0-9][0-9]*\) total$/\1/p' "$output")"
+            if [ "$declared" != "$executed" ]; then
+              echo "::error::$chart declares $declared test suites but helm-unittest ran $executed. Suites are being skipped silently, so their assertions never execute."
+              exit 1
+            fi
+            echo "$chart: all $declared declared test suites ran"
+          done
--- a/.github/workflows/image-scan.yml
+++ b/.github/workflows/image-scan.yml
@ -8,10 +8,17 @@ on:
      - litellm_oss_branch
      - "litellm_**"
    paths:
+      - Dockerfile
      - docker/Dockerfile.non_root
      - migrations/Dockerfile
      - migrations/run.py
-      - tests/proxy_migration_tests/test_offline_image_migration.py
+      - gateway/Dockerfile
+      - gateway/main.py
+      - backend/Dockerfile
+      - backend/main.py
+      - docker/component_entrypoint.sh
+      - litellm-proxy-extras/**
+      - tests/proxy_migration_tests/**
      - uv.lock
      - ui/litellm-dashboard/package-lock.json
      - .github/workflows/image-scan.yml
@ -86,6 +93,35 @@ jobs:
            --fail-on high \
            --output table

+  runtime-image:
+    name: runtime-image
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build runtime image
+        run: docker build -f Dockerfile -t litellm-runtime-scan:${{ github.sha }} .
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify offline migration as a non-root uid
+        env:
+          LITELLM_IMAGE: litellm-runtime-scan:${{ github.sha }}
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py -v
+
  migrations-image:
    name: migrations-image
    runs-on: ubuntu-latest
@ -116,3 +152,63 @@ jobs:
        run: |
          python -m pip install "pytest==9.0.3"
          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py -v
+
+  gateway-image:
+    name: gateway-image
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build gateway image
+        run: docker build -f gateway/Dockerfile -t litellm-gateway-scan:${{ github.sha }} .
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify the gateway serves offline as a non-root uid
+        env:
+          LITELLM_IMAGE: litellm-gateway-scan:${{ github.sha }}
+          LITELLM_COMPONENT_PORT: "4000"
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest tests/proxy_migration_tests/test_component_image_serves_offline.py -v
+
+  backend-image:
+    name: backend-image
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build backend image
+        run: docker build -f backend/Dockerfile -t litellm-backend-scan:${{ github.sha }} .
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify the backend serves offline as a non-root uid
+        env:
+          LITELLM_IMAGE: litellm-backend-scan:${{ github.sha }}
+          LITELLM_COMPONENT_PORT: "4001"
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest tests/proxy_migration_tests/test_component_image_serves_offline.py -v
--- a/.github/workflows/mutation-test.yml
+++ b/.github/workflows/mutation-test.yml
@ -57,9 +57,10 @@ jobs:
        run: |
          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml

+      - name: Cache Prisma binaries
+        uses: ./.github/actions/cache-prisma-binaries
+
      - name: Generate Prisma client
-        env:
-          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
        run: |
          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

--- a/.github/workflows/publish-basedpyright-base-counts.yml
+++ b/.github/workflows/publish-basedpyright-base-counts.yml
@ -0,0 +1,63 @@
+name: Publish basedpyright base counts
+
+# Every commit on litellm_internal_staging is some branch's future merge-base.
+# Publishing its per-rule basedpyright counts as an artifact lets
+# scripts/type_check_gate.py download them in seconds instead of paying a
+# 60-110s second basedpyright pass on every fresh worktree or moved merge-base.
+# No concurrency group on purpose: runs must never cancel each other, because
+# every sha's artifact matters (any of them can become a merge-base).
+
+on:
+  push:
+    branches:
+      - litellm_internal_staging
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Ref to compute and publish base counts for"
+        required: false
+        default: litellm_internal_staging
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          clean: true
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Cache Prisma binaries
+        uses: ./.github/actions/cache-prisma-binaries
+
+      # The gate provisions its own measurement env (.venv-typecheck: a frozen
+      # uv sync of its canonical dependency groups plus a generated Prisma
+      # client), so no install step here can drift from what local runs measure.
+      - name: Emit basedpyright counts for HEAD
+        run: |
+          python scripts/type_check_gate.py --emit-counts-dir "$RUNNER_TEMP/basedpyright-counts"
+          counts_file=$(ls "$RUNNER_TEMP"/basedpyright-counts/basedpyright-counts-*.json)
+          echo "COUNTS_ARTIFACT_NAME=$(basename "$counts_file" .json)" >> "$GITHUB_ENV"
+
+      - name: Upload counts artifact
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: ${{ env.COUNTS_ARTIFACT_NAME }}
+          path: ${{ runner.temp }}/basedpyright-counts/
+          if-no-files-found: error
--- a/.github/workflows/test-code-quality.yml
+++ b/.github/workflows/test-code-quality.yml
@ -65,6 +65,12 @@ jobs:
      - name: check_provider_folders_documented
        run: uv run --no-sync python ./tests/code_coverage_tests/check_provider_folders_documented.py

+      - name: check_prisma_binary_cache
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_prisma_binary_cache.py
+
+      - name: check_workflow_startup_safety
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_workflow_startup_safety.py
+
      - name: router_code_coverage
        run: uv run --no-sync python ./tests/code_coverage_tests/router_code_coverage.py

--- a/.github/workflows/test-linting.yml
+++ b/.github/workflows/test-linting.yml
@ -11,10 +11,20 @@ on:
 permissions:
  contents: read

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 15
+    # actions: read lets scripts/type_check_gate.py download the base-counts
+    # artifact published by publish-basedpyright-base-counts.yml instead of
+    # re-running basedpyright over the merge-base tree.
+    permissions:
+      contents: read
+      actions: read

    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
@ -23,10 +33,22 @@ jobs:
        # Any-discipline) would otherwise blame on this branch.
        with:
          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
+          fetch-depth: 1
          clean: true
          persist-credentials: false

+      - name: Fetch gate base (merge-base with target branch)
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
+          MERGE_BASE=$(retry gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
+          test -n "$MERGE_BASE"
+          retry git fetch --no-tags --depth=1 origin "$MERGE_BASE"
+          echo "GATE_BASE_SHA=$MERGE_BASE" >> "$GITHUB_ENV"
+
      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
@ -50,20 +72,19 @@ jobs:
        run: |
          uv sync --frozen --group proxy-dev --group e2e-dev

+      - name: Cache Prisma binaries
+        uses: ./.github/actions/cache-prisma-binaries
+
      # basedpyright resolves Prisma's generated client (litellm/proxy/schema.prisma)
      # only after `prisma generate` writes prisma/client.py et al. Without this the
      # DB wrappers typed against the generated client would degrade to Unknown.
      - name: Generate Prisma client
-        env:
-          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
        run: |
          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

      - name: Check ruff format
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
-          git diff --name-only --diff-filter=ACMR "$BASE_SHA"...HEAD -- 'litellm/**/*.py' | grep -v '^litellm/enterprise/' > "$RUNNER_TEMP/ruff_format_files.txt" || true
+          git diff --name-only --diff-filter=ACMR "$GATE_BASE_SHA" HEAD -- 'litellm/**/*.py' | grep -v '^litellm/enterprise/' > "$RUNNER_TEMP/ruff_format_files.txt" || true
          if [ ! -s "$RUNNER_TEMP/ruff_format_files.txt" ]; then
            echo "No changed litellm Python files to check with ruff format."
            exit 0
@ -86,16 +107,12 @@ jobs:
          cd ..

      - name: Check strict-rule budget (delta vs base)
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
-          uv run --no-sync python scripts/ruff_strict_gate.py --base "$BASE_SHA"
+          uv run --no-sync python scripts/ruff_strict_gate.py --base "$GATE_BASE_SHA"

      - name: Check type-discipline budget (mutable collections / casts / type guards / kwargs / unexplained suppressions, delta vs base)
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
-          uv run --no-sync python scripts/type_discipline_gate.py --base "$BASE_SHA"
+          uv run --no-sync python scripts/type_discipline_gate.py --base "$GATE_BASE_SHA"

      - name: Print OpenAI version
        run: |
@ -103,16 +120,13 @@ jobs:

      - name: Check basedpyright budget (delta vs base)
        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          NODE_OPTIONS: --max-old-space-size=12288
+          GH_TOKEN: ${{ github.token }}
        run: |
-          (uv run --no-sync basedpyright --outputjson || true) | uv run --no-sync python scripts/type_check_gate.py --base "$BASE_SHA"
+          uv run --no-sync python scripts/type_check_gate.py --base "$GATE_BASE_SHA"

      - name: Check tests/e2e basedpyright (zero errors)
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
-          if git diff --name-only --diff-filter=ACMRD "$BASE_SHA"...HEAD -- 'tests/e2e/**/*.py' | grep -q .; then
+          if git diff --name-only --diff-filter=ACMRD "$GATE_BASE_SHA" HEAD -- 'tests/e2e/**/*.py' | grep -q .; then
            uv run --no-sync basedpyright tests/e2e
          else
            echo "No changed tests/e2e Python files; skipping."
@ -141,9 +155,16 @@ jobs:
    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
-          fetch-depth: 0
+          fetch-depth: 1
          persist-credentials: false

+      - name: Fetch ratchet base
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
+          retry git fetch --no-tags --depth=1 origin "$BASE_SHA"
+
      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
@ -164,7 +185,7 @@ jobs:
    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
-          fetch-depth: 0
+          fetch-depth: 1
          persist-credentials: false

      - name: Set up Python
@ -179,13 +200,15 @@ jobs:

      - name: Run secret scan test
        run: |
-          uv run --frozen --with 'pytest==9.0.2' pytest tests/litellm/test_no_hardcoded_secrets.py -v
+          uv run --no-project --with 'pytest==9.0.2' pytest tests/litellm/test_no_hardcoded_secrets.py -v

      - name: Run ggshield secret scan
        env:
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
        run: |
          if [ -n "$GITGUARDIAN_API_KEY" ]; then
+            retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
+            retry git fetch --no-tags --unshallow origin
            uv tool run --from 'ggshield==1.48.0' ggshield secret scan repo .
          else
            echo "GITGUARDIAN_API_KEY not set, skipping ggshield scan"
--- a/.github/workflows/test-litellm-ui-build.yml
+++ b/.github/workflows/test-litellm-ui-build.yml
@ -10,6 +10,10 @@ on:
      - litellm_oss_staging
      - "litellm_**"

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  build-ui:
    runs-on: ubuntu-latest
@ -27,7 +31,7 @@ jobs:
      - name: Setup Node.js
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
-          node-version: "20"
+          node-version-file: ui/litellm-dashboard/.nvmrc
          cache: "npm"
          cache-dependency-path: ui/litellm-dashboard/package-lock.json

--- a/.github/workflows/test-litellm-ui-lint.yml
+++ b/.github/workflows/test-litellm-ui-lint.yml
@ -10,6 +10,10 @@ on:
      - litellm_oss_staging
      - "litellm_**"

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  frontend-lint:
    runs-on: ubuntu-latest
@ -22,12 +26,13 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
-          fetch-depth: 0
+          fetch-depth: 1
          persist-credentials: false

      - name: Collect changed files
        id: changed
        env:
+          GH_TOKEN: ${{ github.token }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
@ -37,7 +42,9 @@ jobs:
          # landed since, so a PR that touches no UI file still gets linted
          # against hundreds of other people's files. Diff the PR head against its
          # own merge base instead, which is exactly what this PR changed.
-          merge_base=$(git merge-base "$BASE_SHA" "$HEAD_SHA")
+          merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
+          test -n "$merge_base"
+          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
          : > "$RUNNER_TEMP/prettier_files.txt"
          : > "$RUNNER_TEMP/eslint_files.txt"
          while IFS= read -r f; do
@ -61,7 +68,7 @@ jobs:
        if: steps.changed.outputs.has_files == 'true'
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
-          node-version: "20"
+          node-version-file: ui/litellm-dashboard/.nvmrc
          cache: "npm"
          cache-dependency-path: ui/litellm-dashboard/package-lock.json

--- a/.github/workflows/test-litellm-ui-unit.yml
+++ b/.github/workflows/test-litellm-ui-unit.yml
@ -29,27 +29,45 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
-          fetch-depth: 0
+          fetch-depth: 1
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
-          node-version: "20"
+          node-version-file: ui/litellm-dashboard/.nvmrc
          cache: "npm"
          cache-dependency-path: ui/litellm-dashboard/package-lock.json

      - name: Install dependencies
        run: npm ci

+      - name: Run UI type tests (Vitest)
+        env:
+          CI: "true"
+        run: npm run test:types
+
      - name: Run UI unit tests (Vitest)
        env:
          CI: "true"
+          GH_TOKEN: ${{ github.token }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          if [ -n "$BASE_SHA" ]; then
-            echo "Pull request: running only tests related to changes since $BASE_SHA"
-            npm run test -- --run --changed "$BASE_SHA" --passWithNoTests \
+            merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
+            test -n "$merge_base"
+            git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
+            changed_files=()
+            while IFS= read -r f; do
+              changed_files+=("$f")
+            done < <(git diff --name-only --relative "$merge_base" "$HEAD_SHA" -- .)
+            if [ ${#changed_files[@]} -eq 0 ]; then
+              echo "No UI files changed in this PR; skipping unit tests."
+              exit 0
+            fi
+            echo "Pull request: running tests related to ${#changed_files[@]} changed UI files"
+            npm run test -- related "${changed_files[@]}" --run --passWithNoTests \
              --pool forks --poolOptions.forks.maxForks=14
          else
            echo "Push to $GITHUB_REF_NAME: running the full suite"
--- a/.github/workflows/test-mcp.yml
+++ b/.github/workflows/test-mcp.yml
@ -11,6 +11,10 @@ on:
 permissions:
  contents: read

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  test:
    runs-on: ubuntu-latest
--- a/.github/workflows/test-model-map.yaml
+++ b/.github/workflows/test-model-map.yaml
@ -11,6 +11,10 @@ on:
 permissions:
  contents: read

+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  validate-model-prices-json:
    runs-on: ubuntu-latest
--- a/.github/workflows/test-terraform-modules.yml
+++ b/.github/workflows/test-terraform-modules.yml
@ -0,0 +1,54 @@
+name: Terraform Modules
+
+on:
+  push:
+    paths:
+      - "terraform/litellm/aws/**"
+      - ".github/workflows/test-terraform-modules.yml"
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_staging
+      - "litellm_**"
+    paths:
+      - "terraform/litellm/aws/**"
+      - ".github/workflows/test-terraform-modules.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  aws-module:
+    name: fmt, validate, test (aws)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: terraform/litellm/aws
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        with:
+          terraform_version: 1.13.3
+          terraform_wrapper: false
+
+      - name: fmt
+        run: terraform fmt -recursive -check -diff
+
+      - name: init
+        run: terraform init -backend=false -input=false
+
+      - name: validate
+        run: terraform validate
+
+      # Plan-only, mock_provider-backed: no AWS credentials, no API calls.
+      - name: test
+        run: terraform test
--- a/.github/workflows/test-terraform-provider.yml
+++ b/.github/workflows/test-terraform-provider.yml
@ -92,9 +92,10 @@ jobs:
        run: |
          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router

+      - name: Cache Prisma binaries
+        uses: ./.github/actions/cache-prisma-binaries
+
      - name: Generate Prisma client
-        env:
-          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
        run: |
          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

--- a/.github/workflows/test-unit-documentation.yml
+++ b/.github/workflows/test-unit-documentation.yml
@ -65,10 +65,12 @@ jobs:
        run: |
          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router

+      - name: Cache Prisma binaries
+        if: steps.changes.outputs.decision != 'skip'
+        uses: ./.github/actions/cache-prisma-binaries
+
      - name: Generate Prisma client
        if: steps.changes.outputs.decision != 'skip'
-        env:
-          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
        run: |
          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

--- a/.github/workflows/test-unit-misc.yml
+++ b/.github/workflows/test-unit-misc.yml
@ -40,7 +40,11 @@ jobs:
        tests/test_litellm/interactions
        tests/test_litellm/ocr
        tests/test_litellm/passthrough
+        tests/test_litellm/rag
+        tests/test_litellm/realtime_api
+        tests/test_litellm/rerank_api
        tests/test_litellm/sandbox
+        tests/test_litellm/test_router
        tests/test_litellm/vector_stores
        tests/test_litellm/videos
        tests/test_litellm/test_*.py
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@ -28,6 +28,10 @@ concurrency:
 #     Most of a shard's time is pytest plugin load + xdist worker imports +
 #     pytest-cov instrumentation, not the tests themselves. Keeping per-shard
 #     work low and matching worker count to runner cores is what controls it.
+#   * `timeout` bounds the pytest step only. Checkout, dependency install, and
+#     Prisma client generation draw on a separate allowance in the base
+#     workflow, so slow setup shows up as a slow job rather than as a
+#     cancelled shard whose tests were passing.
 #   * workers: 4 matches the 4-core ubuntu-latest runner. -n 8 on 4 cores
 #     oversubscribes 2x and workers fight for CPU during their cold-start
 #     imports (measured ~441% CPU for -n 8 locally, i.e. ~55% effective).
@ -131,8 +135,6 @@ jobs:
            test-path: >-
              tests/proxy_unit_tests/test_proxy_server.py
              tests/proxy_unit_tests/test_proxy_server_keys.py
-              tests/proxy_unit_tests/test_proxy_server_caching.py
-              tests/proxy_unit_tests/test_proxy_server_langfuse.py
              tests/proxy_unit_tests/test_proxy_server_spend.py
              tests/proxy_unit_tests/test_aproxy_startup.py
            workers: 4
--- a/.github/workflows/test-unit-proxy-endpoints.yml
+++ b/.github/workflows/test-unit-proxy-endpoints.yml
@ -29,19 +29,24 @@ jobs:
    uses: ./.github/workflows/_test-unit-base.yml
    with:
      test-path: >-
+        tests/test_litellm/proxy/analytics_endpoints
        tests/test_litellm/proxy/management_endpoints
+        tests/test_litellm/proxy/memory
        tests/test_litellm/proxy/guardrails
        tests/test_litellm/proxy/management_helpers
        tests/test_litellm/proxy/anthropic_endpoints
        tests/test_litellm/proxy/google_endpoints
        tests/test_litellm/proxy/openai_files_endpoint
        tests/test_litellm/proxy/batches_endpoints
+        tests/test_litellm/proxy/fine_tuning_endpoints
+        tests/test_litellm/proxy/vector_store_files_endpoints
        tests/test_litellm/proxy/video_endpoints
        tests/test_litellm/proxy/response_api_endpoints
        tests/test_litellm/proxy/image_endpoints
        tests/test_litellm/proxy/vector_store_endpoints
        tests/test_litellm/proxy/agent_endpoints
        tests/test_litellm/proxy/a2a
+        tests/test_litellm/proxy/credential_endpoints
        tests/test_litellm/proxy/discovery_endpoints
        tests/test_litellm/proxy/health_endpoints
        tests/test_litellm/proxy/shutdown
@ -71,4 +76,5 @@ jobs:
      workers: 4
      reruns: 2
      timeout-minutes: 60
+      job-timeout-minutes: 95
      artifact-name: proxy-server
--- a/.github/workflows/test-unit-proxy-infra.yml
+++ b/.github/workflows/test-unit-proxy-infra.yml
@ -33,6 +33,8 @@ jobs:
        tests/test_litellm/proxy/_experimental
        tests/test_litellm/proxy/experimental
        tests/test_litellm/proxy/common_utils
+        tests/test_litellm/proxy/enterprise_billing
+        tests/test_litellm/proxy/types_utils
        tests/test_litellm/proxy/logging_endpoints
        tests/test_litellm/proxy/test_*.py
      workers: 2
--- a/.github/workflows/test-unit-proxy-legacy.yml
+++ b/.github/workflows/test-unit-proxy-legacy.yml
@ -82,10 +82,12 @@ jobs:
        run: |
          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router

+      - name: Cache Prisma binaries
+        if: steps.changes.outputs.decision != 'skip'
+        uses: ./.github/actions/cache-prisma-binaries
+
      - name: Generate Prisma client
        if: steps.changes.outputs.decision != 'skip'
-        env:
-          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
        run: |
          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

--- a/.github/workflows/weekly_load_anomaly.yml
+++ b/.github/workflows/weekly_load_anomaly.yml
@ -51,9 +51,10 @@ jobs:
        run: |
          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra proxy

+      - name: Cache Prisma binaries
+        uses: ./.github/actions/cache-prisma-binaries
+
      - name: Generate Prisma client
-        env:
-          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
        run: |
          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

--- a/.gitignore
+++ b/.gitignore
@ -1,5 +1,6 @@
 .python-version
 .venv
+.venv-typecheck
 .venv_policy_test
 .env
 .claude
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -1,4 +1,12 @@
-Do not write any comments (existing comments can stay) unless explicitly asked to in a user (not system) prompt
+Do not write comments unless they are any of:
+- absolutely necessary to explain some very complex business logic (in which case, keep it concise and clear)
+- used as an input for tools to read and act on. For example:
+  - entries in `.git-blame-ignore-revs` saying which commit is excluded from git blame
+  - a lint or type checker suppression like `# mutable-ok` or `# pyright: ignore[reportArgumentType]  # <reason>` when introducing a truly unavoidable violation
+- a TODO or FIXME
+  - Not great to have those, but if it's unavoidable, make sure to include a strong, concise reason for why it's there or, better yet, link to a GitHub issue for the follow-up work
+
+Explanation: The point of this rule is to keep out AI slop comments. AI writes way too many and way too verbose comments. Code comments are, in a way, a violation of DRY code. You must update logic in two locations to change the code, and "hard to change" is literally the definition of tech debt. We should instead aim to write code that is intuitive and clear, even at a glance, to the reader, being both easy to maintain and high performance

 Don't assume that the existing code is correct or the right way of doing things / good coding patterns. In fact, there are a lot of bad coding practices, overly complex code, code smells, etc. If something doesn't look right, speak up. Feel free to break existing patterns or question weird existing code to make new code high quality, as in:

@ -9,7 +17,7 @@ Don't assume that the existing code is correct or the right way of doing things
 - easy to maintain/change
 - modern

-In that order of importance
+In descending order of importance

 When adding new features, add meaningful tests. Don't add tests that don't check anything substantial and is there just to make the code coverage pass. Yes, code coverage is important, but I'd rather have no signal whether the code is working than tests that don't fail when code is broken. The goal is to have tests that would fail before the feature was added/if the code was mutated in a way that breaks the feature and succeed only when the feature is fully working. I should run mutation testing and see > 90% kill rate

@ -21,7 +29,9 @@ End-to-end tests belong in `tests/e2e/` and must follow the harness conventions

 When creating PRs, don't set base to `main`. `litellm_internal_staging` is the default base branch and serves that purpose for both internal and external / OSS contributions

-When writing a PR body, treat the comments and imperative instructions inside @.github/pull_request_template.md as rules to follow, not just layout. Agent harnesses may strip HTML comments from copies of that file injected into context, so read .github/pull_request_template.md from disk before writing a PR body to make sure you see every comment rule
+When writing a PR body, treat the comments and imperative instructions inside .github/pull_request_template.md as rules to follow, not just layout. Agent harnesses may strip HTML comments from copies of that file injected into context, so read .github/pull_request_template.md from disk before writing a PR body to make sure you see every comment rule
+
+Same applies for filing bug reports and feature requests, with .github/ISSUE_TEMPLATE/bug_report.yml and .github/ISSUE_TEMPLATE/feature_request.yml, respectively

 If you're resolving a linear ticket, in the "## Linear ticket" section of the PR, say "Resolves LIT-1234", replacing "LIT-1234" with the actual ticket id that you're resolving. If you don't have the ticket id, don't make one up or search for it. Just leave the section blank

@ -29,7 +39,7 @@ Never use `pytest` commands or the like as "Screenshots / Proof of Fix". We pref

 If you ever make public-facing PR descriptions, comments, issues, commit messages, etc., always follow these guidelines to sound less AI-y:
 - don't use emojis
- don't use "—". Instead, reach for ";", ".", etc.
+- don't use "—". Instead, reach for ",", ".", conjunction words, ":", ";", etc. in descending order of preference: vary among them, weighted toward the front of the list, and skip "," where it would cause a comma splice or the sentence is getting long. Overusing any one of them, ";" especially, also feels AI-y. A word cap does not penalize you for adding more sentences: when writing under tight word budgets, prefer a period split or a conjunction over ";", and keep to at most one ";" per message
 - don't use the pattern "It's not X, it's Y", "You're not X, you're Y", etc.
 - don't use bulleted or numbered lists unless it would be nonsensical not to. Instead, prefer prose
 - don't add a trailing "." at the end of paragraphs (just like this file). That means every paragraph, not just the last one (of the markdown file, PR description, GitHub comment, etc.). Rule of thumb: if you're adding new line(s) before the next sentence, don't add a "."
@ -39,15 +49,13 @@ Don't hesitate to use values in .env to get needed API keys and other secrets, a

 Python max line length is 120, not 88

-On a fresh worktree or clone, run `make bootstrap` before anything else. It provisions everything tests, `make pre-commit`, and a local proxy need
-
-Run tests before you commit. Also, run `make pre-commit` right before each commit, which generates types (as needed) and formats/lints your code. Any errors found must be fixed. It only runs when there are staged frontend and/or backend changes and calculates violations, generates types, etc. based on the worktree, so stage what you need or stash/delete unwanted files in litellm/ or ui/ (where backend and frontend lint run, respectively) before running it. If it fails because dashboard api types are stale, it already regenerated them for you. You just need to stage the schema.d.ts, re-run `make pre-commit` to confirm it passes, and commit
-
 When you fix violations gated by `ruff-strict-budget.json`, `type-discipline-budget.json`, or `basedpyright-code-budget.json`, run `make lint-budget-update` and commit the lowered limits so the ceilings ratchet down instead of leaving stale headroom. It measures the working tree, so it must contain exactly the fixes you're committing

+`make check` (f.k.a. `make pre-commit`, which still works identically as an alias) saves its complete output to a log file in .git (overwriting previous logs) and prints that path as its first and last output lines. To inspect a run, read or grep that log instead of re-running the multi-minute checks just to see a different slice
+
 If you're trying to create a new function that relies on untyped stuff, instead of adding more Any's and pushing `reportAny` / `reportExplicitAny` closer to their basedpyright ceilings, just validate it in the caller with Pydantic (a model or `TypeAdapter` that returns the typed thing or raises will do) and then pass the now typed variable in

-If you get an LIT001 or LIT002 fail, refactor the code to follow functional programming best practices rather than introducing mutable data structures. For example, build values in one shot with comprehensions or generators wrapped in `tuple()` / `frozenset()` instead of seeding an empty `list`/`dict`/`set` and mutating it over time. Ideally `# mutable-ok` is never used; reach for it only as a genuine last resort when an immutable rewrite is truly impossible, and always pair it with a real reason
+If you get an LIT001 or LIT002 fail, refactor the code to follow functional programming best practices rather than introducing mutable data structures. For example, build values in one shot with comprehensions or generators wrapped in `tuple()` / `MappingProxyType()` / `frozenset()` instead of seeding an empty `list`/`dict`/`set` and mutating it over time. Ideally, `# mutable-ok` is never used; reach for it only as a genuine last resort when an immutable rewrite is truly impossible, and always pair it with a real reason

 Every lint or type suppression must name the exact rule inside brackets and carry a reason comment, e.g. `# pyright: ignore[reportArgumentType]  # stubs lack async overload` or `# noqa: TID251  # <reason>`. `# type: ignore` is banned (LIT009): pyrightconfig.json sets `enableTypeIgnoreComments` to false, so it silently does nothing

@ -61,7 +69,7 @@ Do not add `Co-Authored-By: Claude` or any Claude attribution to commit messages

 When working on a PR, keep the PR description in sync with new commits being made

-Replies/rebuttals to AI PR review bots must be 15-25 word human-readable replies
+All GitHub comments must be human-readable and 15-25 words max

 Monkeypatching attributes of a class to do testing is an anti-pattern. Prefer dependency-injecting things into classes. That way, at unit test time, you can pass a mocked dependency in

@ -74,7 +82,8 @@ Follow these coding conventions for new/updated code (a three-line fix in a lega
 - Composition over inheritance
 - Never-nester: early returns over deep nesting
 - Don't throw; model failures as values (One function (e.g., raise_public) maps error union to existing public exception contracts via exhaustive match + assert_never)
- No mutation; don't reassign variables, global or local. Instead of mutable lists and dicts, prefer tuples, frozen dataclasses (with slots=True), etc.
+- No mutation; don't reassign variables, global or local. Instead of mutable lists and dicts, prefer tuples, frozen dataclasses (with slots=True), `MappingProxyType`, etc.
+  - Annotate every variable with `: Final` (LIT010). Unpacking and walrus targets cannot carry the annotation, so they are implicitly final. Don't rebind them. Never rebind or mutate function parameters (LIT011); `self`/`cls` attribute stores are the exception. If rebinding or in-place mutation is truly unavoidable, suppress with `# rebind-ok: <reason>` explaining why
 - Use dependency injection
 - Fully typed; no `Any` or coarse types like `dict[str, Any]` or just `dict`. Every function parameter must be strongly typed
 - Use tagged unions + match
--- a/5
+++ b/5
@ -7,7 +7,7 @@ ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:42df77a9974d6ec8b17
 ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:42df77a9974d6ec8b17a5ee8bc23b532600a44d705acef2409e0933c1251b45f
 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
 # Pinned by digest like the other base images; bump explicitly on Node upgrades.
-ARG UI_BUILD_IMAGE=node:20.18-alpine3.20@sha256:3488b10bf958af7125a176419d2d8a9937d895bf124012aae811651988d2ffe6
+ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43

 FROM $UV_IMAGE AS uvbin

@ -134,7 +134,8 @@ RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
    find /app/.venv -type d -path "*/tornado/test" -delete && \
    chmod -R a+rX /opt/prisma && \
    test -x /opt/prisma/binaries/node_modules/.bin/prisma && \
-    test -f /opt/prisma/binaries/node_modules/prisma/build/index.js
+    test -f /opt/prisma/binaries/node_modules/prisma/build/index.js && \
+    python -c "from prisma.client import BINARY_PATHS; paths = list(BINARY_PATHS.query_engine.values()); assert paths and all(p.startswith('/opt/prisma/') for p in paths), paths"

 EXPOSE 4000/tcp

--- a/39
+++ b/39
@ -8,7 +8,7 @@
 	lint-basedpyright lint-e2e-basedpyright lint-basedpyright-budget-update lint-type-discipline lint-type-discipline-budget-update \
 	lint-ruff-budget lint-ruff-budget-update lint-budget-update lint-gate \
 	install-dev install-proxy-dev install-test-deps install-hooks \
-	install-helm-unittest check-circular-imports check-import-safety pre-commit \
+	install-helm-unittest check-circular-imports check-import-safety check pre-commit \
 	lint-install lint-fetch-base bootstrap

 # Default target
@ -22,7 +22,8 @@ help:
 	@echo "  make install-test-deps  - Install the full local test environment"
 	@echo "  make install-helm-unittest - Install helm unittest plugin"
 	@echo "  make install-hooks      - Install git hooks (Conventional Commits + Branches)"
-	@echo "  make pre-commit         - Run CI-equivalent lint on staged files (run before committing)"
+	@echo "  make check              - Run CI-equivalent lint on staged files, or on the diff vs the base branch when nothing is staged"
+	@echo "  make pre-commit         - Legacy alias for make check"
 	@echo "  make format             - Apply ruff format code formatting"
 	@echo "  make format-check       - Check ruff format code formatting (matches CI)"
 	@echo "  make lint               - Run all linting (Ruff, basedpyright, format check, circular imports, import safety)"
@ -75,7 +76,7 @@ install-dev:
 bootstrap:
 	$(UV) sync --inexact --frozen --extra proxy --group proxy-dev --group e2e-dev
 	$(UV_RUN) python scripts/prisma_generate_if_needed.py
-	cd ui/litellm-dashboard && npm install --no-audit --no-fund
+	cd ui/litellm-dashboard && ../../scripts/with_dashboard_node.sh npm install --no-audit --no-fund
 	@main_root=$$(git worktree list --porcelain | head -1 | sed 's/^worktree //'); \
 	if [ "$$main_root" != "$$(git rev-parse --show-toplevel)" ] && [ -f "$$main_root/.env" ] && [ ! -f .env ]; then \
 		cp "$$main_root/.env" .env && echo "bootstrap: copied .env from $$main_root"; \
@ -99,7 +100,10 @@ install-test-deps: install-proxy-dev
 	$(UV_RUN) prisma generate --schema litellm/proxy/schema.prisma

 install-helm-unittest:
-	helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.4.4 || echo "ignore error if plugin exists"
+	@helm plugin list | grep -qE '^unittest[[:space:]]+0\.8\.2([[:space:]]|$$)' || { \
+		helm plugin uninstall unittest >/dev/null 2>&1 || true; \
+		helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.8.2; \
+	}

 # Install git hooks that enforce Conventional Commits and Conventional Branches.
 # Opt-in: not chained into install-dev.
@ -121,10 +125,10 @@ lint-fetch-base:
 	git fetch origin litellm_internal_staging

 # Mirror test-linting.yml's lint job environment: the proxy-dev group plus a generated
-# Prisma client, so basedpyright resolves the same modules CI does (without the generated
-# client the DB wrappers typed against it degrade to Unknown, drifting the budget from
-# CI's). --inexact tops up the venv instead of pruning the proxy extras gen:api and the
-# running proxy need.
+# Prisma client, so `basedpyright tests/e2e` resolves the same modules CI does. The
+# budget gate itself no longer measures here (scripts/type_check_gate.py provisions its
+# own .venv-typecheck). --inexact tops up the venv instead of pruning the proxy extras
+# gen:api and the running proxy need.
 lint-install:
 	$(UV) sync --inexact --frozen --group proxy-dev --group e2e-dev
 	$(UV_RUN) python scripts/prisma_generate_if_needed.py
@ -176,10 +180,8 @@ lint-ruff-FULL-dev: install-dev
 	if [ -n "$$files" ]; then echo "$$files" | xargs $(UV_RUN) ruff check; \
 	else echo "No changed .py files to check."; fi

-lint-basedpyright lint-basedpyright-budget-update: export NODE_OPTIONS := --max-old-space-size=12288
-
 lint-basedpyright: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
-	($(UV_RUN) basedpyright --outputjson || true) | $(UV_RUN) python scripts/type_check_gate.py --base origin/litellm_internal_staging
+	$(UV_RUN) python scripts/type_check_gate.py --base origin/litellm_internal_staging

 lint-e2e-basedpyright: $(LINT_E2E_DEP_INSTALL)
 	$(UV_RUN) basedpyright tests/e2e
@ -192,7 +194,7 @@ lint-type-discipline: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
 # --update lowers each limit by what this branch fixed since its branch point, so
 # it needs the base ref fetched to resolve the merge-base.
 lint-basedpyright-budget-update: install-dev lint-fetch-base
-	($(UV_RUN) basedpyright --outputjson || true) | $(UV_RUN) python scripts/type_check_gate.py --update
+	$(UV_RUN) python scripts/type_check_gate.py --update

 lint-format: format-check

@ -235,13 +237,20 @@ lint-checks: lint-format-check-changed lint-ruff lint-gate lint-type-discipline
 # Faster linting for local development (only checks changed code)
 lint-dev: lint-format-changed check-circular-imports check-import-safety

-# Run the gating CI checks against your staged files right before committing. Mirrors
+# Run the gating CI checks against your changes. Scopes to staged files when anything
+# is staged (warning about changed files left unstaged); with nothing staged it falls
+# back to the working tree's diff against the merge base with the base branch, so a
+# fresh merge commit or an unstaged working tree still gets checked. Mirrors
 # test-linting.yml (Python), test-litellm-ui-build.yml's frontend-lint (dashboard), and
-# check-ui-api-types.yml (API-type drift), skipping any whose files you didn't stage.
+# check-ui-api-types.yml (API-type drift), skipping any whose files aren't in scope.
 # Not auto-installed as a git hook so it never slows an unrelated human commit.
-pre-commit: bootstrap
+check: bootstrap
 	./scripts/pre_commit_lint.sh

+pre-commit:
+	@echo "make pre-commit is a legacy alias; use make check" >&2
+	@$(MAKE) check
+
 # Testing targets
 test: install-test-deps
 	$(UV_RUN) pytest tests/
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@ -59,9 +59,9 @@ RUN --mount=type=cache,target=/root/.cache/uv \
        --extra semantic-router \
        --python python3

-RUN mkdir -p /home/nonroot && \
-    HOME=/home/nonroot prisma generate --schema=./schema.prisma && \
-    chown -R nonroot:nonroot /home/nonroot/.cache
+RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
+    npm_config_cache=/root/.npm \
+    prisma generate --schema=./schema.prisma

 RUN sed -i 's/\r$//' docker/component_entrypoint.sh && chmod +x docker/component_entrypoint.sh

@ -83,13 +83,16 @@ ENV HOME=/home/nonroot \
    PATH="/app/.venv/bin:${PATH}" \
    PYTHONPATH="/app" \
    PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1
+    PYTHONUNBUFFERED=1 \
+    PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries

 COPY --from=builder --chown=nonroot:nonroot /app /app
-COPY --from=builder --chown=nonroot:nonroot /home/nonroot/.cache /home/nonroot/.cache
+COPY --from=builder /opt/prisma /opt/prisma

 RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
-    find /app/.venv -type d -path "*/tornado/test" -delete
+    find /app/.venv -type d -path "*/tornado/test" -delete && \
+    chmod -R a+rX /opt/prisma && \
+    python -c "from prisma.client import BINARY_PATHS; paths = list(BINARY_PATHS.query_engine.values()); assert paths and all(p.startswith('/opt/prisma/') for p in paths), paths"

 USER nonroot

--- a/backend/routes/allowlist.py
+++ b/backend/routes/allowlist.py
@ -44,6 +44,7 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
    "/router/",
    "/router_settings",
    "/adaptive_router/",
+    "/auto_router/",
    "/fallback",
    "/fallbacks",
    "/cache_settings",
@ -81,6 +82,9 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
    "/user_agent",
    "/usage/",
    "/daily/",
+    # Deployment-wide gateway request counts. Scoped to the analytics read rather
+    # than all of /gateway/, which stays free for data-plane routes.
+    "/gateway/daily/",
    # CloudZero cost-export admin (init / settings / export / dry-run / delete)
    "/cloudzero/",
    # Caching admin
--- a/basedpyright-code-budget.json
+++ b/basedpyright-code-budget.json
@ -1,66 +1,66 @@
 {
  "reportAny": {
-    "limit": 29813
+    "limit": 23914
  },
  "reportArgumentType": {
-    "limit": 2645
+    "limit": 2580
  },
  "reportAssignmentType": {
-    "limit": 329
+    "limit": 323
  },
  "reportAttributeAccessIssue": {
-    "limit": 516
+    "limit": 488
  },
  "reportCallIssue": {
-    "limit": 123
+    "limit": 114
  },
  "reportConstantRedefinition": {
-    "limit": 59
+    "limit": 40
  },
  "reportDeprecated": {
-    "limit": 325
+    "limit": 213
  },
  "reportDuplicateImport": {
-    "limit": 42
+    "limit": 19
  },
  "reportExplicitAny": {
-    "limit": 9473
+    "limit": 7573
  },
  "reportFunctionMemberAccess": {
-    "limit": 11
+    "limit": 7
  },
  "reportGeneralTypeIssues": {
-    "limit": 227
+    "limit": 157
  },
  "reportIncompatibleMethodOverride": {
-    "limit": 77
+    "limit": 56
  },
  "reportIncompatibleVariableOverride": {
-    "limit": 12
+    "limit": 8
  },
  "reportInconsistentOverload": {
-    "limit": 18
+    "limit": 12
  },
  "reportIndexIssue": {
-    "limit": 37
+    "limit": 35
  },
  "reportInvalidTypeForm": {
    "limit": 35
  },
  "reportInvalidTypeVarUse": {
-    "limit": 5
+    "limit": 2
  },
  "reportMatchNotExhaustive": {
    "limit": 0
  },
  "reportMissingParameterType": {
-    "limit": 5855
+    "limit": 5719
  },
  "reportMissingTypeArgument": {
-    "limit": 15852
+    "limit": 15657
  },
  "reportMissingTypeStubs": {
-    "limit": 41
+    "limit": 40
  },
  "reportOperatorIssue": {
    "limit": 0
@ -72,7 +72,7 @@
    "limit": 0
  },
  "reportOptionalMemberAccess": {
-    "limit": 1079
+    "limit": 1069
  },
  "reportOptionalOperand": {
    "limit": 0
@ -81,66 +81,66 @@
    "limit": 0
  },
  "reportPossiblyUnboundVariable": {
-    "limit": 77
+    "limit": 56
  },
  "reportPrivateUsage": {
-    "limit": 2437
+    "limit": 1824
  },
  "reportRedeclaration": {
-    "limit": 12
+    "limit": 8
  },
  "reportReturnType": {
-    "limit": 219
+    "limit": 213
  },
  "reportTypedDictNotRequiredAccess": {
-    "limit": 27
+    "limit": 26
  },
  "reportUndefinedVariable": {
    "limit": 0
  },
  "reportUnknownArgumentType": {
-    "limit": 45324
+    "limit": 44832
  },
  "reportUnknownLambdaType": {
    "limit": 113
  },
  "reportUnknownMemberType": {
-    "limit": 40452
+    "limit": 39269
  },
  "reportUnknownParameterType": {
-    "limit": 20309
+    "limit": 19988
  },
  "reportUnknownVariableType": {
-    "limit": 31978
+    "limit": 30923
  },
  "reportUnnecessaryCast": {
-    "limit": 177
+    "limit": 118
  },
  "reportUnnecessaryComparison": {
-    "limit": 1021
+    "limit": 699
  },
  "reportUnnecessaryContains": {
-    "limit": 7
+    "limit": 5
  },
  "reportUnnecessaryIsInstance": {
-    "limit": 1204
+    "limit": 853
  },
  "reportUntypedBaseClass": {
-    "limit": 165
+    "limit": 0
  },
  "reportUntypedFunctionDecorator": {
-    "limit": 33
+    "limit": 27
  },
  "reportUnusedClass": {
-    "limit": 33
+    "limit": 23
  },
  "reportUnusedFunction": {
-    "limit": 204
+    "limit": 139
  },
  "reportUnusedImport": {
-    "limit": 1003
+    "limit": 545
  },
  "reportUnusedVariable": {
-    "limit": 1297
+    "limit": 146
  }
 }
--- a/docker/Dockerfile.database
+++ b/docker/Dockerfile.database
@ -7,7 +7,7 @@ ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:42df77a9974d6ec8b17
 ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:42df77a9974d6ec8b17a5ee8bc23b532600a44d705acef2409e0933c1251b45f
 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
 # Pinned by digest like the other base images; bump explicitly on Node upgrades.
-ARG UI_BUILD_IMAGE=node:20.18-alpine3.20@sha256:3488b10bf958af7125a176419d2d8a9937d895bf124012aae811651988d2ffe6
+ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43

 FROM $UV_IMAGE AS uvbin

@ -133,7 +133,8 @@ RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
    find /app/.venv -type d -path "*/tornado/test" -delete && \
    chmod -R a+rX /opt/prisma && \
    test -x /opt/prisma/binaries/node_modules/.bin/prisma && \
-    test -f /opt/prisma/binaries/node_modules/prisma/build/index.js
+    test -f /opt/prisma/binaries/node_modules/prisma/build/index.js && \
+    python -c "from prisma.client import BINARY_PATHS; paths = list(BINARY_PATHS.query_engine.values()); assert paths and all(p.startswith('/opt/prisma/') for p in paths), paths"

 EXPOSE 4000/tcp

--- a/docker/Dockerfile.non_root
+++ b/docker/Dockerfile.non_root
@ -6,7 +6,7 @@ ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:42df77a9974d6ec8b
 ARG PROXY_EXTRAS_SOURCE=published
 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
 # Pinned by digest like the other base images; bump explicitly on Node upgrades.
-ARG UI_BUILD_IMAGE=node:20.18-alpine3.20@sha256:3488b10bf958af7125a176419d2d8a9937d895bf124012aae811651988d2ffe6
+ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43

 FROM $UV_IMAGE AS uvbin

@ -185,7 +185,8 @@ RUN mkdir -p /nonexistent /app/.cache /var/lib/litellm/assets /var/lib/litellm/u
    chmod -R a+rX /opt/prisma && \
    test -x /opt/prisma/binaries/node_modules/.bin/prisma && \
    test -f /opt/prisma/binaries/node_modules/prisma/build/index.js && \
-    ls /opt/prisma/binaries/node_modules/@prisma/engines/query-engine-* >/dev/null 2>&1
+    ls /opt/prisma/binaries/node_modules/@prisma/engines/query-engine-* >/dev/null 2>&1 && \
+    python -c "from prisma.client import BINARY_PATHS; paths = list(BINARY_PATHS.query_engine.values()); assert paths and all(p.startswith('/opt/prisma/') for p in paths), paths"

 USER 65534

--- a/docker/build_admin_ui.sh
+++ b/docker/build_admin_ui.sh
@ -54,8 +54,9 @@ else
 fi || { echo "nvm checksum verification failed"; exit 1; }
 bash "$NVM_SCRIPT"
 source ~/.nvm/nvm.sh
-nvm install v18.17.0
-nvm use v18.17.0
+NODE_VERSION="$(cat ui/litellm-dashboard/.nvmrc)"
+nvm install "v${NODE_VERSION}"
+nvm use "v${NODE_VERSION}"


 # cd in to /ui/litellm-dashboard
--- a/docker/build_from_pip/Dockerfile.build_from_pip
+++ b/docker/build_from_pip/Dockerfile.build_from_pip
@ -47,7 +47,13 @@ RUN uv venv --python python && \
      "prisma==0.11.0" \
      "openai==2.24.0"

-RUN prisma generate --schema=./schema.prisma
+RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
+    npm_config_cache=/root/.npm \
+    prisma generate --schema=./schema.prisma && \
+    chmod -R a+rX /opt/prisma && \
+    python -c "import sys; from prisma.client import BINARY_PATHS; bad = sorted(p for group in BINARY_PATHS.model_dump().values() for p in group.values() if not p.startswith('/opt/prisma/')); sys.exit('prisma engines baked outside /opt/prisma: %r' % bad) if bad else None"
+
+ENV PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries

 EXPOSE 4000/tcp

--- a/enterprise/litellm_enterprise/enterprise_callbacks/init.py
+++ b/enterprise/litellm_enterprise/enterprise_callbacks/init.py
--- a/enterprise/litellm_enterprise/enterprise_callbacks/pagerduty/init.py
+++ b/enterprise/litellm_enterprise/enterprise_callbacks/pagerduty/init.py
--- a/enterprise/litellm_enterprise/enterprise_callbacks/send_emails/init.py
+++ b/enterprise/litellm_enterprise/enterprise_callbacks/send_emails/init.py
--- a/enterprise/litellm_enterprise/enterprise_callbacks/send_emails/base_email.py
+++ b/enterprise/litellm_enterprise/enterprise_callbacks/send_emails/base_email.py
@ -99,6 +99,7 @@ class BaseEmailLogger(CustomLogger):
        email_html_content = USER_INVITATION_EMAIL_TEMPLATE.format(
            email_logo_url=email_params.logo_url,
            recipient_email=email_params.recipient_email,
+            invitation_link=email_params.base_url,
            base_url=email_params.base_url,
            email_support_contact=email_params.support_contact,
            email_footer=email_params.signature,
@ -826,10 +827,15 @@ class BaseEmailLogger(CustomLogger):
        """
        # Early validation
        if not user_id:
-            verbose_proxy_logger.debug("No user_id provided for invitation link")
+            verbose_proxy_logger.warning(
+                "No user_id provided for invitation link. Email will link to base URL instead of onboarding page"
+            )
            return base_url

        if not await self._is_prisma_client_available():
+            verbose_proxy_logger.warning(
+                "Prisma client not available. Email will link to base URL instead of onboarding page"
+            )
            return base_url

        # Wait for any concurrent invitation creation to complete
@ -839,11 +845,15 @@ class BaseEmailLogger(CustomLogger):
        invitation = await self._get_or_create_invitation(user_id)
        if not invitation:
            verbose_proxy_logger.warning(
-                f"Failed to get/create invitation for user_id: {user_id}"
+                f"Failed to get/create invitation for user_id: {user_id}. Email will link to base URL instead of onboarding page"
            )
            return base_url

-        return self._construct_invitation_link(invitation.id, base_url)
+        invitation_link = self._construct_invitation_link(invitation.id, base_url)
+        verbose_proxy_logger.info(
+            f"Successfully created invitation link for user_id: {user_id}"
+        )
+        return invitation_link

    async def _is_prisma_client_available(self) -> bool:
        """Check if Prisma client is available"""
@ -921,7 +931,9 @@ class BaseEmailLogger(CustomLogger):

        # http://localhost:4000/ui/onboarding?invitation_id=7a096b3a-37c6-440f-9dd1-ba22e8043f6b
        """
-        return f"{base_url}/ui/onboarding?invitation_id={invitation_id}"
+        base_url = base_url.rstrip("/")
+        invitation_link = f"{base_url}/ui/onboarding?invitation_id={invitation_id}"
+        return invitation_link

    async def send_email(
        self,
--- a/enterprise/litellm_enterprise/integrations/init.py
+++ b/enterprise/litellm_enterprise/integrations/init.py
--- a/enterprise/litellm_enterprise/litellm_core_utils/init.py
+++ b/enterprise/litellm_enterprise/litellm_core_utils/init.py
--- a/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py
+++ b/enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py
@ -3,7 +3,7 @@ Polls LiteLLM_ManagedObjectTable to check if the batch job is complete, and if t
 """

 from datetime import datetime, timedelta, timezone
-from typing import TYPE_CHECKING, List, Optional, Tuple
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple

 from litellm._logging import verbose_proxy_logger
 from litellm._uuid import uuid
@ -43,11 +43,15 @@ class CheckBatchCost:
        # the guaranteed-failing primary query on every subsequent cycle.
        self._has_batch_processed_column: bool = True

-    async def _get_user_info(self, batch_id, user_id) -> dict:
+    async def _get_user_info(self, batch_id: str, user_id: Optional[str]) -> Dict[str, Any]:
        """
        Look up user email and key alias by user_id for enriching the S3 callback metadata.
        Returns a dict with user_api_key_user_email and user_api_key_alias (both may be None).
+        Returns an empty dict when user_id is None: batches created by a team or service
+        account key carry no user id, and find_unique(where={"user_id": None}) raises.
        """
+        if not user_id:
+            return {}
        try:
            user_row = await self.prisma_client.db.litellm_usertable.find_unique(
                where={"user_id": user_id}
@ -62,6 +66,66 @@ class CheckBatchCost:
            verbose_proxy_logger.error(f"CheckBatchCost: could not look up user {user_id} for batch {batch_id}: {e}")
            return {}

+    async def _get_key_alias(self, batch_id: str, api_key: str | None) -> str | None:
+        """Resolve the creating virtual key's alias from its hashed token."""
+        if not api_key:
+            return None
+        try:
+            key_row = await self.prisma_client.db.litellm_verificationtoken.find_unique(
+                where={"token": api_key}
+            )
+            return getattr(key_row, "key_alias", None) if key_row is not None else None
+        except Exception as e:
+            verbose_proxy_logger.error(f"CheckBatchCost: could not look up key alias for batch {batch_id}: {e}")
+            return None
+
+    async def _get_team_alias(self, team_id: str | None) -> str | None:
+        """Resolve a team's alias from its id."""
+        if not team_id:
+            return None
+        try:
+            team_row = await self.prisma_client.db.litellm_teamtable.find_unique(
+                where={"team_id": team_id}
+            )
+            return getattr(team_row, "team_alias", None) if team_row is not None else None
+        except Exception as e:
+            verbose_proxy_logger.error(f"CheckBatchCost: could not look up team alias for team {team_id}: {e}")
+            return None
+
+    async def _build_creator_attribution_metadata(
+        self, job: "LiteLLM_ManagedObjectTable", batch_id: str
+    ) -> Dict[str, Any]:
+        """
+        Rebuild the spend-tracking metadata for the key, team, and tags that created the
+        batch so the batch-cost spend log is attributed the same way a non-batch request
+        is. Rows created before api_key and request_tags were persisted carry only
+        created_by and team_id, and fall back to those. A named creating key owns
+        user_api_key_alias; when it has no alias, or the key has since been rotated or
+        deleted, the field keeps the creating user's alias that _get_user_info filled in,
+        because a resolvable name is more useful on the spend row than a null.
+        """
+        api_key = getattr(job, "api_key", None)
+        team_id = getattr(job, "team_id", None)
+        request_tags = getattr(job, "request_tags", None)
+
+        metadata: Dict[str, Any] = {
+            "user_api_key_user_id": job.created_by,
+            "user_api_key": api_key,
+            "user_api_key_team_id": team_id,
+            **(await self._get_user_info(batch_id, job.created_by)),
+        }
+
+        key_alias = await self._get_key_alias(batch_id, api_key)
+        if key_alias is not None:
+            metadata["user_api_key_alias"] = key_alias
+        team_alias = await self._get_team_alias(team_id)
+        if team_alias is not None:
+            metadata["user_api_key_team_alias"] = team_alias
+        if isinstance(request_tags, list) and request_tags:
+            metadata["tags"] = [tag for tag in request_tags if isinstance(tag, str)]
+
+        return metadata
+
    async def _cleanup_stale_managed_objects(self) -> None:
        """
        Mark managed objects older than MANAGED_OBJECT_STALENESS_CUTOFF_DAYS days
@ -296,17 +360,13 @@ class CheckBatchCost:
        underlying provider model (e.g. ``gpt-5.5``), which no key is allowed to call.
        """
        from litellm.proxy.openai_files_endpoints.common_utils import (
-            convert_b64_uid_to_unified_uid,
-            get_models_from_unified_file_id,
+            resolve_managed_output_file_model_name,
        )

-        input_file_id = cls._get_input_file_id(job)
-        target_model_names = (
-            get_models_from_unified_file_id(convert_b64_uid_to_unified_uid(input_file_id)) if input_file_id else []
+        return resolve_managed_output_file_model_name(
+            unified_input_file_id=cls._get_input_file_id(job),
+            fallback_model_name=deployment_info.model_name or None,
        )
-        if target_model_names:
-            return ",".join(target_model_names)
-        return deployment_info.model_name or None

    @staticmethod
    def _get_input_file_id(job: "LiteLLM_ManagedObjectTable") -> Optional[str]:
@ -489,9 +549,6 @@ class CheckBatchCost:
            function_id=str(uuid.uuid4()),
        )

-        creator_user_id = job.created_by
-        user_info = await self._get_user_info(batch_id, job.created_by)
-
        logging_obj.update_environment_variables(
            litellm_params={
                # set the user-agent header so that S3 callback consumers can easily identify CheckBatchCost callbacks
@ -500,10 +557,7 @@ class CheckBatchCost:
                        "user-agent": CHECK_BATCH_COST_USER_AGENT,
                    }
                },
-                "metadata": {
-                    "user_api_key_user_id": creator_user_id,
-                    **user_info,
-                },
+                "metadata": await self._build_creator_attribution_metadata(job, batch_id),
            },
            optional_params={},
        )
@ -660,6 +714,20 @@ class CheckBatchCost:

            elif response.status in ("failed", "expired", "cancelled"):
                try:
+                    from litellm.proxy.openai_files_endpoints.common_utils import (
+                        _is_base64_encoded_unified_file_id,
+                        ensure_batch_response_managed_file_ids,
+                    )
+
+                    response.id = job.unified_object_id
+                    await ensure_batch_response_managed_file_ids(
+                        response=response,
+                        managed_files_obj=self.proxy_logging_obj.get_proxy_hook("managed_files"),
+                        prisma_client=self.prisma_client,
+                        verbose_proxy_logger=verbose_proxy_logger,
+                        db_batch_object=job,
+                        unified_batch_id=_is_base64_encoded_unified_file_id(job.unified_object_id),
+                    )
                    update_data = {
                        "status": response.status,
                        "file_object": response.model_dump_json(),
--- a/enterprise/litellm_enterprise/proxy/common_utils/check_responses_cost.py
+++ b/enterprise/litellm_enterprise/proxy/common_utils/check_responses_cost.py
@ -1,10 +1,10 @@
 """
 Polls LiteLLM_ManagedObjectTable to check if the response is complete.
-Cost tracking is handled automatically by litellm.aget_responses().
+Cost tracking is handled automatically by the get-responses call.
 """

 from datetime import datetime, timedelta, timezone
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Dict, Optional, cast

 import litellm
 from litellm._logging import verbose_proxy_logger
@ -13,11 +13,15 @@ from litellm.constants import (
    MAX_OBJECTS_PER_POLL_CYCLE,
    STALE_OBJECT_CLEANUP_BATCH_SIZE,
 )
+from litellm.responses.utils import ResponsesAPIRequestUtils
+from litellm.types.llms.openai import ResponsesAPIResponse

 if TYPE_CHECKING:
    from litellm.proxy.utils import PrismaClient, ProxyLogging
    from litellm.router import Router

+TERMINAL_RESPONSE_STATUSES = frozenset({"completed", "failed", "cancelled", "incomplete"})
+

 class CheckResponsesCost:
    def __init__(
@ -33,6 +37,28 @@ class CheckResponsesCost:
        self.prisma_client: PrismaClient = prisma_client
        self.llm_router: Router = llm_router

+    async def _get_response(
+        self,
+        response_id: str,
+        litellm_metadata: Dict[str, str],
+    ) -> ResponsesAPIResponse:
+        """Fetch the upstream response, using deployment credentials when available.
+
+        LiteLLM-encoded response IDs carry the ``model_id`` of the deployment that
+        served the original request, so routing through ``llm_router`` applies that
+        deployment's ``api_base`` / ``api_key`` / ``api_version``, exactly like
+        ``GET /v1/responses/{id}`` does. ``litellm.aget_responses`` on its own only
+        sees provider env vars, so it fails for every deployment whose credentials
+        live in the config; the row then never leaves ``queued``.
+        """
+        model_id: Optional[str] = ResponsesAPIRequestUtils.get_model_id_from_response_id(response_id)
+        if model_id is None or self.llm_router.get_deployment(model_id=model_id) is None:
+            return await litellm.aget_responses(response_id=response_id, litellm_metadata=litellm_metadata)
+        router_response = await self.llm_router.aget_responses(
+            response_id=response_id, litellm_metadata=litellm_metadata
+        )
+        return cast(ResponsesAPIResponse, router_response)
+
    async def _expire_stale_rows(
        self, cutoff: datetime, batch_size: int
    ) -> int:
@ -87,8 +113,8 @@ class CheckResponsesCost:
        Check if background responses are complete and track their cost.
        - Get all status="queued" or "in_progress" and file_purpose="response" jobs
        - Query the provider to check if response is complete
-        - Cost is automatically tracked by litellm.aget_responses()
-        - Mark completed/failed/cancelled responses as complete in the database
+        - Cost is automatically tracked by the get-responses call
+        - Mark responses in a terminal state as complete in the database
        """
        try:
            await self._cleanup_stale_managed_objects()
@ -134,7 +160,7 @@ class CheckResponsesCost:
                    litellm_metadata["model"] = model_name
                    litellm_metadata["model_group"] = model_name  # Use same value for model_group
                
-                response = await litellm.aget_responses(
+                response = await self._get_response(
                    response_id=responses_id_security,
                    litellm_metadata=litellm_metadata,
                )
@ -144,21 +170,14 @@ class CheckResponsesCost:
                )
                
            except Exception as e:
-                verbose_proxy_logger.info(
+                verbose_proxy_logger.warning(
                    f"Skipping job {unified_object_id} due to error: {e}"
                )
                continue

-            # Check if response is in a terminal state
-            if response.status == "completed":
+            if response.status in TERMINAL_RESPONSE_STATUSES:
                verbose_proxy_logger.info(
-                    f"Response {unified_object_id} is complete. Cost automatically tracked by aget_responses."
-                )
-                completed_jobs.append(job)
-                
-            elif response.status in ["failed", "cancelled"]:
-                verbose_proxy_logger.info(
-                    f"Response {unified_object_id} has status {response.status}, marking as complete"
+                    f"Response {unified_object_id} has terminal status {response.status}, marking as complete"
                )
                completed_jobs.append(job)

--- a/enterprise/litellm_enterprise/proxy/hooks/init.py
+++ b/enterprise/litellm_enterprise/proxy/hooks/init.py
--- a/enterprise/litellm_enterprise/proxy/hooks/managed_files.py
+++ b/enterprise/litellm_enterprise/proxy/hooks/managed_files.py
--- a/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py
+++ b/enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py
@ -19,6 +19,7 @@ from fastapi import APIRouter, Depends, HTTPException, Request
 from litellm._logging import verbose_proxy_logger
 from litellm._uuid import uuid
 from litellm.proxy._types import *
+from litellm.proxy.auth.auth_checks import delete_cached_project_object
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
 from litellm.proxy.management_endpoints.common_utils import _set_object_metadata_field
 from litellm.proxy.management_helpers.utils import (
@ -514,6 +515,7 @@ async def update_project(
        litellm_proxy_admin_name,
        premium_user,
        prisma_client,
+        user_api_key_cache,
    )

    try:
@ -672,6 +674,11 @@ async def update_project(
            include={"litellm_budget_table": True, "object_permission": True},
        )

+        await delete_cached_project_object(
+            project_id=data.project_id,
+            user_api_key_cache=user_api_key_cache,
+        )
+
        return updated_project
    except Exception as e:
        verbose_proxy_logger.exception(
@ -710,7 +717,7 @@ async def delete_project(
    }'
    ```
    """
-    from litellm.proxy.proxy_server import premium_user, prisma_client
+    from litellm.proxy.proxy_server import premium_user, prisma_client, user_api_key_cache

    try:
        if not premium_user:
@ -773,6 +780,11 @@ async def delete_project(
                prisma_models.LiteLLM_ProjectTable | None
            ) = await prisma_client.db.litellm_projecttable.delete(where={"project_id": project_id})

+            await delete_cached_project_object(
+                project_id=project_id,
+                user_api_key_cache=user_api_key_cache,
+            )
+
            deleted_projects.append(deleted_project)

        return deleted_projects
@ -831,7 +843,7 @@ async def project_info(
            )

        # Check if user has access to this project (admin or team member)
-        is_admin = user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN
+        is_admin = user_api_key_has_admin_view(user_api_key_dict)
        is_team_member = False

        if project.team_id and user_api_key_dict.user_id:
@ -886,7 +898,7 @@ async def list_projects(
            )

        # If proxy admin, get all projects
-        if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN:
+        if user_api_key_has_admin_view(user_api_key_dict):
            projects: Sequence[
                prisma_models.LiteLLM_ProjectTable
            ] = await prisma_client.db.litellm_projecttable.find_many(
--- a/enterprise/litellm_enterprise/proxy/vector_stores/init.py
+++ b/enterprise/litellm_enterprise/proxy/vector_stores/init.py
--- a/enterprise/litellm_enterprise/py.typed
+++ b/enterprise/litellm_enterprise/py.typed
--- a/enterprise/litellm_enterprise/types/init.py
+++ b/enterprise/litellm_enterprise/types/init.py
--- a/enterprise/litellm_enterprise/types/enterprise_callbacks/init.py
+++ b/enterprise/litellm_enterprise/types/enterprise_callbacks/init.py
--- a/enterprise/litellm_enterprise/types/proxy/init.py
+++ b/enterprise/litellm_enterprise/types/proxy/init.py
--- a/enterprise/pyproject.toml
+++ b/enterprise/pyproject.toml
@ -1,6 +1,6 @@
 [project]
 name = "litellm-enterprise"
-version = "0.1.53"
+version = "0.1.55"
 description = "Package for LiteLLM Enterprise features"
 readme = "README.md"
 requires-python = ">=3.9"
@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""

 [tool.commitizen]
-version = "0.1.53"
+version = "0.1.55"
 version_files = [
    "pyproject.toml:^version",
    "../pyproject.toml:litellm-enterprise==",
--- a/gateway/Dockerfile
+++ b/gateway/Dockerfile
@ -61,9 +61,9 @@ RUN --mount=type=cache,target=/root/.cache/uv \
        --extra bedrock-realtime \
        --python python3

-RUN mkdir -p /home/nonroot && \
-    HOME=/home/nonroot prisma generate --schema=./schema.prisma && \
-    chown -R nonroot:nonroot /home/nonroot/.cache
+RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
+    npm_config_cache=/root/.npm \
+    prisma generate --schema=./schema.prisma

 RUN sed -i 's/\r$//' docker/component_entrypoint.sh && chmod +x docker/component_entrypoint.sh

@ -85,13 +85,16 @@ ENV HOME=/home/nonroot \
    PATH="/app/.venv/bin:${PATH}" \
    PYTHONPATH="/app" \
    PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1
+    PYTHONUNBUFFERED=1 \
+    PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries

 COPY --from=builder --chown=nonroot:nonroot /app /app
-COPY --from=builder --chown=nonroot:nonroot /home/nonroot/.cache /home/nonroot/.cache
+COPY --from=builder /opt/prisma /opt/prisma

 RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
-    find /app/.venv -type d -path "*/tornado/test" -delete
+    find /app/.venv -type d -path "*/tornado/test" -delete && \
+    chmod -R a+rX /opt/prisma && \
+    python -c "from prisma.client import BINARY_PATHS; paths = list(BINARY_PATHS.query_engine.values()); assert paths and all(p.startswith('/opt/prisma/') for p in paths), paths"

 USER nonroot

--- a/helm/litellm-helm/README.md
+++ b/helm/litellm-helm/README.md
@ -39,7 +39,7 @@ If `db.useStackgresOperator` is used (not yet implemented):
 | `livenessProbe.*`           | Liveness probe settings for the LiteLLM container (`path`, `periodSeconds`, `timeoutSeconds`, thresholds, and initial delay).                                                                                                                  | See `values.yaml`         |
 | `readinessProbe.*`          | Readiness probe settings for the LiteLLM container (`path`, `periodSeconds`, `timeoutSeconds`, thresholds, and initial delay).                                                                                                                 | See `values.yaml`         |
 | `startupProbe.*`            | Startup probe settings for the LiteLLM container (`path`, `periodSeconds`, `timeoutSeconds`, thresholds, and initial delay).                                                                                                                   | See `values.yaml`         |
-| `resources.*`               | CPU/memory requests and limits for the LiteLLM container.                                                                                                                                                                                       | `{}`                      |
+| `resources.*`               | CPU/memory requests and limits for the LiteLLM container. Unset by default; production deployments should set 1 CPU and 4Gi of memory per worker.                                                                                             | `{}`                      |
 | `service.loadBalancerClass` | Optional LoadBalancer implementation class (only used when `service.type` is `LoadBalancer`)                                                                                                                                                  | `""`                      |
 | `ingress.labels`            | Additional labels for the Ingress resource                                                                                                                                                                                                    | `{}`                      |
 | `ingress.*`                 | See [values.yaml](./values.yaml) for example settings                                                                                                                                                                                         | N/A                       |
--- a/helm/litellm-helm/templates/migrations-job.yaml
+++ b/helm/litellm-helm/templates/migrations-job.yaml
@ -105,6 +105,10 @@ spec:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      restartPolicy: OnFailure
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
--- a/helm/litellm-helm/tests/migrations-job_tests.yaml
+++ b/helm/litellm-helm/tests/migrations-job_tests.yaml
@ -290,3 +290,27 @@ tests:
          value:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
+  - it: should schedule onto the same nodes as the gateway
+    template: migrations-job.yaml
+    set:
+      migrationJob:
+        enabled: true
+      nodeSelector:
+        karpenter.sh/nodepool: litellm-e2e
+      tolerations:
+        - key: workload
+          operator: Equal
+          value: litellm-e2e
+          effect: NoSchedule
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            karpenter.sh/nodepool: litellm-e2e
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: workload
+              operator: Equal
+              value: litellm-e2e
+              effect: NoSchedule
--- a/helm/litellm-helm/values.yaml
+++ b/helm/litellm-helm/values.yaml
@ -181,16 +181,19 @@ proxy_config:

 resources:
  {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
+  # Unset by default so the chart installs on small clusters such as Minikube, and so an
+  # upgrade never leaves a running pod Pending. Production deployments should set these.
+  # A proxy at DB-connected steady state needs about 1 CPU and 4Gi of memory per worker;
+  # sizing below that gets the pod OOMKilled once traffic and DB connections ramp up.
+  # Scale both figures with --num_workers, then uncomment the lines below and remove the
+  # curly braces after 'resources:'. See "Recommended Machine Specifications" in
+  # https://docs.litellm.ai/docs/proxy/prod.
  # requests:
-  #   cpu: 100m
-  #   memory: 128Mi
+  #   cpu: "1"
+  #   memory: 4Gi
+  # limits:
+  #   cpu: "1"
+  #   memory: 4Gi

 autoscaling:
  enabled: false
@ -432,9 +435,9 @@ migrationJob:
  annotations: {}
  ttlSecondsAfterFinished: 120
  resources: {}
-  #  requests:
-  #    cpu: 100m
-  #    memory: 100Mi
+  #  Unset by default. This job runs the database migration and exits, so it does not
+  #  need the steady-state headroom the proxy does; size it from your own migration
+  #  runs rather than from the proxy figures above.
  extraContainers: []
  extraInitContainers: []

--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260713010000_add_ptu_columns_to_daily_team_spend/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260713010000_add_ptu_columns_to_daily_team_spend/migration.sql
@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_DailyTeamSpend" ADD COLUMN IF NOT EXISTS "ptu_flat_cost" DOUBLE PRECISION NOT NULL DEFAULT 0.0;
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260729000000_add_reload_tracking_to_litellm_config/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260729000000_add_reload_tracking_to_litellm_config/migration.sql
@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_Config" ADD COLUMN IF NOT EXISTS "last_run_at" TIMESTAMP(3),
+ADD COLUMN IF NOT EXISTS "reload_revision" BIGINT NOT NULL DEFAULT 0;
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260730000000_add_api_key_and_request_tags_to_managed_object_table/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260730000000_add_api_key_and_request_tags_to_managed_object_table/migration.sql
@ -0,0 +1,5 @@
+-- Add api_key and request_tags columns to LiteLLM_ManagedObjectTable
+-- Captured at batch-create time so CheckBatchCost can attribute batch-cost spend
+-- back to the creating virtual key (and its tags) even when created_by is null.
+ALTER TABLE "LiteLLM_ManagedObjectTable" ADD COLUMN IF NOT EXISTS "api_key" TEXT;
+ALTER TABLE "LiteLLM_ManagedObjectTable" ADD COLUMN IF NOT EXISTS "request_tags" JSONB DEFAULT '[]';
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260731000000_add_autorouter_savings_spend/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260731000000_add_autorouter_savings_spend/migration.sql
@ -0,0 +1,17 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_DailyUserSpend" ADD COLUMN IF NOT EXISTS "autorouter_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0;
+
+-- AlterTable
+ALTER TABLE "LiteLLM_DailyOrganizationSpend" ADD COLUMN IF NOT EXISTS "autorouter_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0;
+
+-- AlterTable
+ALTER TABLE "LiteLLM_DailyEndUserSpend" ADD COLUMN IF NOT EXISTS "autorouter_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0;
+
+-- AlterTable
+ALTER TABLE "LiteLLM_DailyAgentSpend" ADD COLUMN IF NOT EXISTS "autorouter_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0;
+
+-- AlterTable
+ALTER TABLE "LiteLLM_DailyTeamSpend" ADD COLUMN IF NOT EXISTS "autorouter_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0;
+
+-- AlterTable
+ALTER TABLE "LiteLLM_DailyTagSpend" ADD COLUMN IF NOT EXISTS "autorouter_savings_spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0;
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260803000000_add_daily_gateway_requests/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260803000000_add_daily_gateway_requests/migration.sql
@ -0,0 +1,15 @@
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_DailyGatewayRequests" (
+    "date" TEXT NOT NULL,
+    "category" TEXT NOT NULL,
+    "route" TEXT NOT NULL,
+    "successful_requests" BIGINT NOT NULL DEFAULT 0,
+    "failed_requests" BIGINT NOT NULL DEFAULT 0,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "LiteLLM_DailyGatewayRequests_pkey" PRIMARY KEY ("date","category","route")
+);
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "LiteLLM_DailyGatewayRequests_date_idx" ON "LiteLLM_DailyGatewayRequests"("date");
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260805000000_add_autorouter_session_rollup/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260805000000_add_autorouter_session_rollup/migration.sql
@ -0,0 +1,31 @@
+CREATE TABLE IF NOT EXISTS "LiteLLM_AutoRouterSession" (
+    "api_key" TEXT NOT NULL,
+    "session_id" TEXT NOT NULL,
+    "router_name" TEXT NOT NULL,
+    "router_type" TEXT NOT NULL,
+    "first_turn_at" TIMESTAMP(3) NOT NULL,
+    "last_turn_at" TIMESTAMP(3) NOT NULL,
+    "last_model" TEXT NOT NULL,
+    "models" JSONB NOT NULL DEFAULT '{}',
+    "turns" INTEGER NOT NULL DEFAULT 0,
+    "unordered_turns" INTEGER NOT NULL DEFAULT 0,
+    "covered_turns" INTEGER NOT NULL DEFAULT 0,
+    "cache_hits" INTEGER NOT NULL DEFAULT 0,
+    "same_model_turns" INTEGER NOT NULL DEFAULT 0,
+    "same_model_hits" INTEGER NOT NULL DEFAULT 0,
+    "first_visit_turns" INTEGER NOT NULL DEFAULT 0,
+    "first_visit_hits" INTEGER NOT NULL DEFAULT 0,
+    "return_turns" INTEGER NOT NULL DEFAULT 0,
+    "return_hits" INTEGER NOT NULL DEFAULT 0,
+    "return_expired_misses" INTEGER NOT NULL DEFAULT 0,
+    "return_within_ttl_misses" INTEGER NOT NULL DEFAULT 0,
+    "ttl_5m_turns" INTEGER NOT NULL DEFAULT 0,
+    "ttl_1h_turns" INTEGER NOT NULL DEFAULT 0,
+    "total_tokens" BIGINT NOT NULL DEFAULT 0,
+    "spend" DOUBLE PRECISION NOT NULL DEFAULT 0,
+    "saved_spend" DOUBLE PRECISION NOT NULL DEFAULT 0,
+
+    CONSTRAINT "LiteLLM_AutoRouterSession_pkey" PRIMARY KEY ("api_key", "session_id", "router_name")
+);
+
+CREATE INDEX IF NOT EXISTS "idx_autorouter_session_last_turn" ON "LiteLLM_AutoRouterSession"("last_turn_at");
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260807000000_add_autorouter_session_tier_turns/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260807000000_add_autorouter_session_tier_turns/migration.sql
@ -0,0 +1 @@
+ALTER TABLE "LiteLLM_AutoRouterSession" ADD COLUMN IF NOT EXISTS "tier_turns" JSONB NOT NULL DEFAULT '{}';
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260810000000_add_verificationtoken_settings_updated_at/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260810000000_add_verificationtoken_settings_updated_at/migration.sql
@ -0,0 +1,5 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_VerificationToken" ADD COLUMN IF NOT EXISTS "settings_updated_at" TIMESTAMP(3);
+
+-- AlterTable
+ALTER TABLE "LiteLLM_DeletedVerificationToken" ADD COLUMN IF NOT EXISTS "settings_updated_at" TIMESTAMP(3);
--- a/litellm-proxy-extras/litellm_proxy_extras/prisma_toolchain.py
+++ b/litellm-proxy-extras/litellm_proxy_extras/prisma_toolchain.py
@ -0,0 +1,181 @@
+"""Prepare the Node toolchain the Prisma CLI needs, separately from migrations.
+
+The Prisma CLI is a Node program. The first invocation inside a fresh
+container installs a private Node runtime and npm-installs the CLI itself,
+which can take minutes on a cold or slow machine. Sharing one timeout between
+that one-time bootstrap and the migration commands makes a slow bootstrap
+indistinguishable from a slow migration, so the bootstrap gets killed long
+before it can finish.
+
+A killed bootstrap does not correct itself. The installer leaves its cache
+directory behind, and Prisma decides whether to install by testing that
+directory for existence alone, so every later attempt skips the install and
+then fails on a Node binary that was never written. Deleting a cache directory
+that exists without a Node binary is what turns a killed bootstrap back into a
+recoverable one.
+
+Both budgets are overridable so an operator can widen them without a release:
+``LITELLM_PRISMA_BOOTSTRAP_TIMEOUT`` for the toolchain install and
+``LITELLM_PRISMA_COMMAND_TIMEOUT`` for every individual Prisma command.
+"""
+
+import math
+import os
+import shutil
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Optional
+
+from litellm_proxy_extras._logging import logger
+
+try:
+    from prisma import config as prisma_config
+except ImportError:
+    prisma_config = None
+
+PRISMA_COMMAND_TIMEOUT_ENV_VAR = "LITELLM_PRISMA_COMMAND_TIMEOUT"
+PRISMA_BOOTSTRAP_TIMEOUT_ENV_VAR = "LITELLM_PRISMA_BOOTSTRAP_TIMEOUT"
+NODEENV_CACHE_DIR_ENV_VAR = "PRISMA_NODEENV_CACHE_DIR"
+
+DEFAULT_PRISMA_COMMAND_TIMEOUT = 60.0
+DEFAULT_PRISMA_BOOTSTRAP_TIMEOUT = 600.0
+
+BOOTSTRAP_ARG = "--version"
+
+
+@dataclass(frozen=True)
+class ToolchainBootstrap:
+    """Outcome of preparing the Prisma toolchain."""
+
+    healed_incomplete_cache: bool
+    ready: bool
+
+
+def _timeout_from_env(env_var: str, default: float) -> float:
+    raw = os.getenv(env_var)
+    if raw is None:
+        return default
+    try:
+        seconds = float(raw)
+    except ValueError:
+        logger.warning(
+            "%s=%r is not a number, falling back to %ss", env_var, raw, default
+        )
+        return default
+    if not math.isfinite(seconds) or seconds <= 0:
+        logger.warning(
+            "%s=%r is not a finite positive number, falling back to %ss",
+            env_var,
+            raw,
+            default,
+        )
+        return default
+    return seconds
+
+
+def prisma_command_timeout() -> float:
+    """Seconds any single Prisma command may run for."""
+    return _timeout_from_env(
+        PRISMA_COMMAND_TIMEOUT_ENV_VAR, DEFAULT_PRISMA_COMMAND_TIMEOUT
+    )
+
+
+def prisma_bootstrap_timeout() -> float:
+    """Seconds the one-time Node toolchain install may run for."""
+    return _timeout_from_env(
+        PRISMA_BOOTSTRAP_TIMEOUT_ENV_VAR, DEFAULT_PRISMA_BOOTSTRAP_TIMEOUT
+    )
+
+
+def nodeenv_cache_dir() -> Optional[Path]:
+    """Where Prisma installs its private Node runtime, or None if unknowable."""
+    override = os.getenv(NODEENV_CACHE_DIR_ENV_VAR)
+    if override:
+        return Path(override).absolute()
+    if prisma_config is not None:
+        try:
+            return Path(prisma_config.nodeenv_cache_dir).absolute()
+        except (OSError, ValueError) as e:
+            logger.warning("Could not read the Prisma nodeenv cache dir: %s", e)
+    try:
+        return Path.home() / ".cache" / "prisma-python" / "nodeenv"
+    except RuntimeError:
+        logger.warning(
+            "No resolvable home directory, cannot locate the Prisma nodeenv cache"
+        )
+        return None
+
+
+def node_binary_path(cache_dir: Path) -> Path:
+    """Path the Node binary occupies once the toolchain is fully installed."""
+    if os.name == "nt":
+        return cache_dir / "Scripts" / "node.exe"
+    return cache_dir / "bin" / "node"
+
+
+def heal_incomplete_nodeenv_cache() -> bool:
+    """Delete a nodeenv cache directory left without a Node binary.
+
+    Returns True when a half-installed toolchain was removed, so the next
+    Prisma invocation reinstalls it instead of failing on a missing binary.
+    """
+    cache_dir = nodeenv_cache_dir()
+    if cache_dir is None:
+        return False
+    try:
+        if not cache_dir.is_dir() or node_binary_path(cache_dir).exists():
+            return False
+    except OSError as e:
+        logger.warning("Could not inspect the Node toolchain at %s: %s", cache_dir, e)
+        return False
+    logger.warning(
+        "Node toolchain at %s has no %s, so a previous install was interrupted. "
+        "Removing it so it can be reinstalled.",
+        cache_dir,
+        node_binary_path(cache_dir).name,
+    )
+    try:
+        shutil.rmtree(cache_dir)
+    except OSError as e:
+        logger.warning("Could not remove %s: %s", cache_dir, e)
+        return False
+    return True
+
+
+def ensure_prisma_toolchain(
+    prisma_command: str, prisma_env: dict[str, str]
+) -> ToolchainBootstrap:
+    """Install whatever the Prisma CLI needs to run, under its own timeout.
+
+    Never raises. A toolchain that cannot be prepared is reported so the
+    caller can go on and let the real Prisma command produce the real error.
+    """
+    healed = heal_incomplete_nodeenv_cache()
+    timeout = prisma_bootstrap_timeout()
+    logger.info("Preparing the Prisma CLI toolchain (timeout %ss)", timeout)
+    try:
+        subprocess.run(
+            [prisma_command, BOOTSTRAP_ARG],
+            timeout=timeout,
+            check=True,
+            capture_output=True,
+            text=True,
+            env=prisma_env,
+        )
+    except subprocess.TimeoutExpired:
+        logger.warning(
+            "Preparing the Prisma CLI toolchain timed out after %ss. Raise %s "
+            "if this machine needs longer to install it.",
+            timeout,
+            PRISMA_BOOTSTRAP_TIMEOUT_ENV_VAR,
+        )
+        return ToolchainBootstrap(healed_incomplete_cache=healed, ready=False)
+    except subprocess.CalledProcessError as e:
+        logger.warning("Preparing the Prisma CLI toolchain failed: %s", e.stderr)
+        return ToolchainBootstrap(healed_incomplete_cache=healed, ready=False)
+    except OSError as e:
+        logger.warning("Could not run the Prisma CLI: %s", e)
+        return ToolchainBootstrap(healed_incomplete_cache=healed, ready=False)
+    logger.info("Prisma CLI toolchain ready")
+    return ToolchainBootstrap(healed_incomplete_cache=healed, ready=True)
--- a/litellm-proxy-extras/litellm_proxy_extras/py.typed
+++ b/litellm-proxy-extras/litellm_proxy_extras/py.typed
--- a/litellm-proxy-extras/litellm_proxy_extras/replica_identity.py
+++ b/litellm-proxy-extras/litellm_proxy_extras/replica_identity.py
@ -16,6 +16,7 @@ import tempfile
 from pathlib import Path

 from litellm_proxy_extras._logging import logger
+from litellm_proxy_extras.prisma_toolchain import prisma_command_timeout

 REPLICA_IDENTITY_FULL_ENV_VAR = "LITELLM_SET_REPLICA_IDENTITY_FULL"

@ -75,7 +76,7 @@ def apply_replica_identity_full(
                    "--schema",
                    schema_path,
                ],
-                timeout=60,
+                timeout=prisma_command_timeout(),
                check=True,
                capture_output=True,
                text=True,
--- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
+++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
@ -30,7 +30,7 @@ model LiteLLM_BudgetTable {
  end_users LiteLLM_EndUserTable[] // multiple end-users can have the same budget
  tags LiteLLM_TagTable[] // multiple tags can have the same budget
  team_membership LiteLLM_TeamMembership[] // budgets of Users within a Team 
-  organization_membership LiteLLM_OrganizationMembership[] // budgets of Users within a Organization 
+  organization_membership LiteLLM_OrganizationMembership[] // budgets of Users within a Organization
 }

 // Models on proxy
@ -452,6 +452,7 @@ model LiteLLM_VerificationToken {
    created_by String?
    updated_at      DateTime?               @default(now()) @updatedAt @map("updated_at")
    updated_by String?
+    settings_updated_at DateTime?             @map("settings_updated_at")
    last_active     DateTime?  // When this key was last used
    rotation_count   Int?       @default(0) // Number of times key has been rotated
    auto_rotate      Boolean?   @default(false) // Whether this key should be auto-rotated
@ -548,6 +549,7 @@ model LiteLLM_DeletedVerificationToken {
    created_by              String?   // Original creator
    updated_at              DateTime? // Last update timestamp before deletion
    updated_by              String?   // Last user who updated before deletion
+    settings_updated_at       DateTime? // Last configuration change before deletion
    last_active             DateTime? // When this key was last used before deletion
    rotation_count          Int?      @default(0)
    auto_rotate             Boolean?  @default(false)
@ -601,6 +603,8 @@ model LiteLLM_TagTable {
 model LiteLLM_Config {
  param_name String @id
  param_value Json?
+  last_run_at DateTime?
+  reload_revision BigInt @default(0)
 }

 // View spend, model, api_key per request
@ -748,6 +752,7 @@ model LiteLLM_DailyUserSpend {
  compression_saved_tokens    BigInt      @default(0)
  compression_savings_spend    Float       @default(0.0)
  prompt_caching_savings_spend Float       @default(0.0)
+  autorouter_savings_spend     Float       @default(0.0)
  spend               Float    @default(0.0)
  api_requests        BigInt      @default(0)
  successful_requests BigInt      @default(0)
@ -782,6 +787,7 @@ model LiteLLM_DailyOrganizationSpend {
  compression_saved_tokens    BigInt      @default(0)
  compression_savings_spend    Float       @default(0.0)
  prompt_caching_savings_spend Float       @default(0.0)
+  autorouter_savings_spend     Float       @default(0.0)
  spend               Float    @default(0.0)
  api_requests        BigInt      @default(0)
  successful_requests BigInt      @default(0)
@ -816,6 +822,7 @@ model LiteLLM_DailyEndUserSpend {
  compression_saved_tokens    BigInt      @default(0)
  compression_savings_spend    Float       @default(0.0)
  prompt_caching_savings_spend Float       @default(0.0)
+  autorouter_savings_spend     Float       @default(0.0)
  spend               Float    @default(0.0)
  api_requests        BigInt      @default(0)
  successful_requests BigInt      @default(0)
@ -849,6 +856,7 @@ model LiteLLM_DailyAgentSpend {
  compression_saved_tokens    BigInt      @default(0)
  compression_savings_spend    Float       @default(0.0)
  prompt_caching_savings_spend Float       @default(0.0)
+  autorouter_savings_spend     Float       @default(0.0)
  spend               Float    @default(0.0)
  api_requests        BigInt      @default(0)
  successful_requests BigInt      @default(0)
@ -882,10 +890,12 @@ model LiteLLM_DailyTeamSpend {
  compression_saved_tokens    BigInt      @default(0)
  compression_savings_spend    Float       @default(0.0)
  prompt_caching_savings_spend Float       @default(0.0)
+  autorouter_savings_spend     Float       @default(0.0)
  spend               Float    @default(0.0)
  api_requests        BigInt      @default(0)
  successful_requests BigInt      @default(0)
  failed_requests     BigInt      @default(0)
+  ptu_flat_cost       Float    @default(0.0)
  created_at          DateTime @default(now())
  updated_at          DateTime @updatedAt

@ -917,6 +927,7 @@ model LiteLLM_DailyTagSpend {
  compression_saved_tokens    BigInt      @default(0)
  compression_savings_spend    Float       @default(0.0)
  prompt_caching_savings_spend Float       @default(0.0)
+  autorouter_savings_spend     Float       @default(0.0)
  spend               Float    @default(0.0)
  api_requests        BigInt      @default(0)
  successful_requests BigInt      @default(0)
@ -977,6 +988,8 @@ model LiteLLM_ManagedObjectTable { // for batches or finetuning jobs which use t
  created_at DateTime @default(now())
  created_by String?
  team_id String?
+  api_key String?
+  request_tags Json? @default("[]")
  updated_at DateTime @updatedAt
  updated_by String?

@ -1110,6 +1123,26 @@ model LiteLLM_DailyToolSpend {
  @@id([date, tool_name])
 }

+// Gateway request counts recorded at the ASGI edge by
+// BillableRequestMetricsMiddleware. This is the source of truth for SGR
+// (successful gateway requests): it counts what the proxy actually answered,
+// independent of whether the request reached litellm's logging callbacks.
+// The key carries no deployment or caller dimension. Every part of it is
+// chosen by the proxy and drawn from a closed set, so the table is bounded by
+// (days x categories x routes) rather than by anything a caller can vary.
+model LiteLLM_DailyGatewayRequests {
+  date                String
+  category            String
+  route               String
+  successful_requests BigInt   @default(0)
+  failed_requests     BigInt   @default(0)
+  created_at          DateTime @default(now())
+  updated_at          DateTime @updatedAt
+
+  @@id([date, category, route])
+  @@index([date])
+}
+
 // Prompt table for storing prompt configurations
 model LiteLLM_PromptTable {
  id String @id @default(uuid())
@ -1385,6 +1418,38 @@ model LiteLLM_AdaptiveRouterSession {
  @@index([last_activity_at], map: "idx_adaptive_router_session_activity")
 }

+model LiteLLM_AutoRouterSession {
+  api_key               String
+  session_id            String
+  router_name           String
+  router_type           String
+  first_turn_at         DateTime
+  last_turn_at          DateTime
+  last_model            String
+  models                Json     @default("{}")
+  turns                 Int      @default(0)
+  unordered_turns       Int      @default(0)
+  covered_turns         Int      @default(0)
+  cache_hits            Int      @default(0)
+  same_model_turns      Int      @default(0)
+  same_model_hits       Int      @default(0)
+  first_visit_turns     Int      @default(0)
+  first_visit_hits      Int      @default(0)
+  return_turns          Int      @default(0)
+  return_hits           Int      @default(0)
+  return_expired_misses Int      @default(0)
+  return_within_ttl_misses  Int      @default(0)
+  ttl_5m_turns          Int      @default(0)
+  ttl_1h_turns          Int      @default(0)
+  total_tokens          BigInt   @default(0)
+  spend                 Float    @default(0)
+  saved_spend           Float    @default(0)
+  tier_turns            Json     @default("{}")
+
+  @@id([api_key, session_id, router_name])
+  @@index([last_turn_at], map: "idx_autorouter_session_last_turn")
+}
+
 // ---------------------------------------------------------------------------
 // Workflow Run Tracking
 //
--- a/litellm-proxy-extras/litellm_proxy_extras/utils.py
+++ b/litellm-proxy-extras/litellm_proxy_extras/utils.py
@ -14,6 +14,10 @@ from litellm_proxy_extras.replica_identity import (
    REPLICA_IDENTITY_FULL_ENV_VAR,
    apply_replica_identity_full,
 )
+from litellm_proxy_extras.prisma_toolchain import (
+    ensure_prisma_toolchain,
+    prisma_command_timeout,
+)


 def str_to_bool(value: Optional[str]) -> bool:
@ -142,7 +146,7 @@ class ProxyExtrasDBManager:
                ],
                stdout=open(migration_file, "w"),
                check=True,
-                timeout=30,
+                timeout=prisma_command_timeout(),
                env=prisma_env,
            )

@ -157,7 +161,7 @@ class ProxyExtrasDBManager:
                    "0_init",
                ],
                check=True,
-                timeout=30,
+                timeout=prisma_command_timeout(),
                env=prisma_env,
            )

@ -193,7 +197,7 @@ class ProxyExtrasDBManager:
                "--rolled-back",
                migration_name,
            ],
-            timeout=60,
+            timeout=prisma_command_timeout(),
            check=True,
            capture_output=True,
            env=prisma_env,
@ -205,7 +209,7 @@ class ProxyExtrasDBManager:
        prisma_env = _get_prisma_env()
        subprocess.run(
            [_get_prisma_command(), "migrate", "resolve", "--applied", migration_name],
-            timeout=60,
+            timeout=prisma_command_timeout(),
            check=True,
            capture_output=True,
            env=prisma_env,
@ -303,7 +307,7 @@ class ProxyExtrasDBManager:
                        "--script",
                    ],
                    check=True,
-                    timeout=60,
+                    timeout=prisma_command_timeout(),
                    stdout=f,
                    env=_get_prisma_env(),
                )
@ -335,7 +339,7 @@ class ProxyExtrasDBManager:
                            "--schema",
                            schema_path,
                        ],
-                        timeout=60,
+                        timeout=prisma_command_timeout(),
                        check=True,
                        capture_output=True,
                        text=True,
@ -364,7 +368,7 @@ class ProxyExtrasDBManager:
                    "--schema",
                    schema_path,
                ],
-                timeout=60,
+                timeout=prisma_command_timeout(),
                check=True,
                capture_output=True,
                text=True,
@ -393,7 +397,7 @@ class ProxyExtrasDBManager:
                        "--applied",
                        migration_name,
                    ],
-                    timeout=60,
+                    timeout=prisma_command_timeout(),
                    check=True,
                    capture_output=True,
                    text=True,
@ -530,7 +534,7 @@ class ProxyExtrasDBManager:
            try:
                subprocess.run(
                    [_get_prisma_command(), "db", "push", "--accept-data-loss"],
-                    timeout=60,
+                    timeout=prisma_command_timeout(),
                    check=True,
                    env=_get_prisma_env(),
                )
@ -555,7 +559,7 @@ class ProxyExtrasDBManager:
                try:
                    result = subprocess.run(
                        [_get_prisma_command(), "migrate", "deploy"],
-                        timeout=60,
+                        timeout=prisma_command_timeout(),
                        check=True,
                        capture_output=True,
                        text=True,
@ -731,6 +735,9 @@ class ProxyExtrasDBManager:
        Returns:
            bool: True if setup was successful, False otherwise
        """
+        ensure_prisma_toolchain(
+            prisma_command=_get_prisma_command(), prisma_env=_get_prisma_env()
+        )
        migrated = ProxyExtrasDBManager._run_migrations(
            use_migrate=use_migrate, use_v2_resolver=use_v2_resolver
        )
@ -757,7 +764,7 @@ class ProxyExtrasDBManager:
                        # Set migrations directory for Prisma
                        result = subprocess.run(
                            [_get_prisma_command(), "migrate", "deploy"],
-                            timeout=60,
+                            timeout=prisma_command_timeout(),
                            check=True,
                            capture_output=True,
                            text=True,
@ -840,7 +847,7 @@ class ProxyExtrasDBManager:
                                            "--rolled-back",
                                            failed_migration,
                                        ],
-                                        timeout=60,
+                                        timeout=prisma_command_timeout(),
                                        check=True,
                                        capture_output=True,
                                        text=True,
@ -968,7 +975,7 @@ class ProxyExtrasDBManager:
                    # Use prisma db push with increased timeout
                    subprocess.run(
                        [_get_prisma_command(), "db", "push", "--accept-data-loss"],
-                        timeout=60,
+                        timeout=prisma_command_timeout(),
                        check=True,
                    )
                    return True
--- a/litellm-proxy-extras/pyproject.toml
+++ b/litellm-proxy-extras/pyproject.toml
@ -1,6 +1,6 @@
 [project]
 name = "litellm-proxy-extras"
-version = "0.4.81"
+version = "0.4.85"
 description = "Additional files for the LiteLLM Proxy. Reduces the size of the main litellm package."
 readme = "README.md"
 requires-python = ">=3.9"
@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""

 [tool.commitizen]
-version = "0.4.81"
+version = "0.4.85"
 version_files = [
    "pyproject.toml:^version",
    "../pyproject.toml:litellm-proxy-extras==",
--- a/litellm/init.py
+++ b/litellm/init.py
@ -27,18 +27,19 @@ if os.getenv("LITELLM_MODE", "DEV") == "DEV":
    _dotenv.load_dotenv(override=_dev_env_hot_reload_enabled())

 from typing import (
-    Callable,
-    List,
-    Optional,
-    Dict,
-    Union,
    Any,
-    Literal,
+    Callable,
+    Dict,
+    Final,
    get_args,
-    TYPE_CHECKING,
-    Tuple,
+    List,
+    Literal,
+    Optional,
    overload,
+    Tuple,
    Type,
+    TYPE_CHECKING,
+    Union,
 )
 from litellm.types.integrations.datadog import DatadogInitParams
 from litellm.types.integrations.newrelic import NewRelicInitParams
@ -196,6 +197,7 @@ standard_logging_payload_excluded_fields: Optional[List[str]] = (
    None  # Fields to exclude from StandardLoggingPayload before callbacks receive it
 )
 log_raw_request_response: bool = False
+request_correlation_in_logs: bool = False
 redact_messages_in_exceptions: Optional[bool] = False
 redact_user_api_key_info: Optional[bool] = False
 # When True (default — preserves historical behavior), the Router appends
@ -243,6 +245,8 @@ use_chat_completions_url_for_anthropic_messages: bool = bool(
 # Or via `litellm_settings.strip_anthropic_total_tokens: true` in
 # config.yaml.
 strip_anthropic_total_tokens: bool = False
+anthropic_sse_ping_interval_seconds: float = 15.0
+sse_keepalive_ping_interval_seconds: float | None = None
 route_all_chat_openai_to_responses: bool = (
    os.getenv("LITELLM_ROUTE_ALL_CHAT_OPENAI_TO_RESPONSES", "false").lower() == "true"
 )  # When True, routes all OpenAI /chat/completions requests through the Responses API bridge
@ -264,6 +268,7 @@ databricks_key: Optional[str] = None
 openai_like_key: Optional[str] = None
 azure_key: Optional[str] = None
 anthropic_key: Optional[str] = None
+autorouter_savings_baseline_model: Optional[str] = None
 replicate_key: Optional[str] = None
 bytez_key: Optional[str] = None
 gdc_key: Optional[str] = None
@ -680,12 +685,12 @@ def is_bedrock_pricing_only_model(key: str) -> bool:
        bool: True if the key matches the Bedrock pattern, False otherwise.
    """
    # Regex to match 'bedrock/<region>/<model>'
-    bedrock_pattern = re.compile(r"^bedrock/[a-zA-Z0-9_-]+/.+$")
+    bedrock_pattern: Final = re.compile(r"^bedrock/[a-zA-Z0-9_-]+/.+$")

    if "month-commitment" in key:
        return True

-    is_match = bedrock_pattern.match(key)
+    is_match: Final = bedrock_pattern.match(key)
    return is_match is not None


@ -702,9 +707,8 @@ def is_openai_finetune_model(key: str) -> bool:
    return key.startswith("ft:") and not key.count(":") > 1


-def add_known_models(model_cost_map: Optional[Dict] = None):
-    _map = model_cost_map if model_cost_map is not None else model_cost
-    for key, value in _map.items():
+def _populate_provider_model_sets(model_cost_map: Dict) -> None:
+    for key, value in model_cost_map.items():
        if value.get("litellm_provider") == "openai" and not is_openai_finetune_model(key):
            open_ai_chat_completion_models.add(key)
        elif value.get("litellm_provider") == "text-completion-openai":
@ -947,7 +951,16 @@ def add_known_models(model_cost_map: Optional[Dict] = None):
            bedrock_mantle_models.add(key)


-add_known_models()
+def add_known_models(model_cost_map: Optional[Dict] = None):
+    """Fold `model_cost_map` (defaults to `litellm.model_cost`) into the per-provider model sets,
+    then refresh `models_by_provider` from those sets so the additions reach wildcard expansion.
+    The refresh updates the dict in place, so references captured before a reload stay live.
+    """
+    _populate_provider_model_sets(model_cost_map if model_cost_map is not None else model_cost)
+    models_by_provider.update(_build_models_by_provider())
+
+
+_populate_provider_model_sets(model_cost)
 # known openai compatible endpoints - we'll eventually move this list to the model_prices_and_context_window.json dictionary

 # this is maintained for Exception Mapping
@ -1069,112 +1082,116 @@ model_list_set = set(model_list)
 # provider_list is lazy-loaded via __getattr__ to avoid importing LlmProviders at import time


-models_by_provider: dict = {
-    "openai": open_ai_chat_completion_models | open_ai_text_completion_models,
-    "text-completion-openai": open_ai_text_completion_models,
-    "cohere": cohere_models | cohere_chat_models,
-    "cohere_chat": cohere_chat_models,
-    "anthropic": anthropic_models,
-    "replicate": replicate_models,
-    "huggingface": huggingface_models,
-    "together_ai": together_ai_models,
-    "baseten": baseten_models,
-    "openrouter": openrouter_models,
-    "vercel_ai_gateway": vercel_ai_gateway_models,
-    "datarobot": datarobot_models,
-    "vertex_ai": vertex_chat_models
-    | vertex_text_models
-    | vertex_anthropic_models
-    | vertex_vision_models
-    | vertex_language_models
-    | vertex_deepseek_models
-    | vertex_minimax_models
-    | vertex_moonshot_models
-    | vertex_zai_models,
-    "ai21": ai21_models,
-    "bedrock": bedrock_models | bedrock_converse_models,
-    "petals": petals_models,
-    "ollama": ollama_models,
-    "ollama_chat": ollama_models,
-    "deepinfra": deepinfra_models,
-    "perplexity": perplexity_models,
-    "maritalk": maritalk_models,
-    "watsonx": watsonx_models,
-    "gemini": gemini_models,
-    "fireworks_ai": fireworks_ai_models | fireworks_ai_embedding_models,
-    "aleph_alpha": aleph_alpha_models,
-    "text-completion-codestral": text_completion_codestral_models,
-    "text-completion-inception": text_completion_inception_models,
-    "xai": xai_models,
-    "zai": zai_models,
-    "fal_ai": fal_ai_models,
-    "deepseek": deepseek_models,
-    "tencent": tencent_models,
-    "runwayml": runwayml_models,
-    "mistral": mistral_chat_models,
-    "azure_ai": azure_ai_models,
-    "voyage": voyage_models,
-    "infinity": infinity_models,
-    "databricks": databricks_models,
-    "cloudflare": cloudflare_models,
-    "codestral": codestral_models,
-    "nlp_cloud": nlp_cloud_models,
-    "friendliai": friendliai_models,
-    "palm": palm_models,
-    "groq": groq_models,
-    "azure": azure_models | azure_text_models,
-    "azure_anthropic": azure_anthropic_models,
-    "azure_text": azure_text_models,
-    "anyscale": anyscale_models,
-    "cerebras": cerebras_models,
-    "galadriel": galadriel_models,
-    "nvidia_nim": nvidia_nim_models,
-    "nvidia_riva": nvidia_riva_models,
-    "soniox": soniox_models,
-    "sambanova": sambanova_models | sambanova_embedding_models,
-    "novita": novita_models,
-    "nebius": nebius_models | nebius_embedding_models,
-    "aiml": aiml_models,
-    "assemblyai": assemblyai_models,
-    "jina_ai": jina_ai_models,
-    "snowflake": snowflake_models,
-    "gradient_ai": gradient_ai_models,
-    "meta_llama": llama_models,
-    "nscale": nscale_models,
-    "featherless_ai": featherless_ai_models,
-    "deepgram": deepgram_models,
-    "elevenlabs": elevenlabs_models,
-    "heroku": heroku_models,
-    "dashscope": dashscope_models,
-    "modelscope": modelscope_models,
-    "moonshot": moonshot_models,
-    "publicai": publicai_models,
-    "darkbloom": darkbloom_models,
-    "v0": v0_models,
-    "morph": morph_models,
-    "lambda_ai": lambda_ai_models,
-    "inception": inception_models,
-    "hyperbolic": hyperbolic_models,
-    "black_forest_labs": black_forest_labs_models,
-    "recraft": recraft_models,
-    "cometapi": cometapi_models,
-    "oci": oci_models,
-    "volcengine": volcengine_models,
-    "wandb": wandb_models,
-    "ovhcloud": ovhcloud_models | ovhcloud_embedding_models,
-    "lemonade": lemonade_models,
-    "clarifai": clarifai_models,
-    "amazon_nova": amazon_nova_models,
-    "stability": stability_models,
-    "github_copilot": github_copilot_models,
-    "chatgpt": chatgpt_models,
-    "minimax": minimax_models,
-    "aws_polly": aws_polly_models,
-    "gigachat": gigachat_models,
-    "llamagate": llamagate_models,
-    "reducto": reducto_models,
-    "bedrock_mantle": bedrock_mantle_models,
-}
+def _build_models_by_provider() -> dict:
+    return {
+        "openai": open_ai_chat_completion_models | open_ai_text_completion_models,
+        "text-completion-openai": open_ai_text_completion_models,
+        "cohere": cohere_models | cohere_chat_models,
+        "cohere_chat": cohere_chat_models,
+        "anthropic": anthropic_models,
+        "replicate": replicate_models,
+        "huggingface": huggingface_models,
+        "together_ai": together_ai_models,
+        "baseten": baseten_models,
+        "openrouter": openrouter_models,
+        "vercel_ai_gateway": vercel_ai_gateway_models,
+        "datarobot": datarobot_models,
+        "vertex_ai": vertex_chat_models
+        | vertex_text_models
+        | vertex_anthropic_models
+        | vertex_vision_models
+        | vertex_language_models
+        | vertex_deepseek_models
+        | vertex_minimax_models
+        | vertex_moonshot_models
+        | vertex_zai_models,
+        "ai21": ai21_models,
+        "bedrock": bedrock_models | bedrock_converse_models,
+        "petals": petals_models,
+        "ollama": ollama_models,
+        "ollama_chat": ollama_models,
+        "deepinfra": deepinfra_models,
+        "perplexity": perplexity_models,
+        "maritalk": maritalk_models,
+        "watsonx": watsonx_models,
+        "gemini": gemini_models,
+        "fireworks_ai": fireworks_ai_models | fireworks_ai_embedding_models,
+        "aleph_alpha": aleph_alpha_models,
+        "text-completion-codestral": text_completion_codestral_models,
+        "text-completion-inception": text_completion_inception_models,
+        "xai": xai_models,
+        "zai": zai_models,
+        "fal_ai": fal_ai_models,
+        "deepseek": deepseek_models,
+        "tencent": tencent_models,
+        "runwayml": runwayml_models,
+        "mistral": mistral_chat_models,
+        "azure_ai": azure_ai_models,
+        "voyage": voyage_models,
+        "infinity": infinity_models,
+        "databricks": databricks_models,
+        "cloudflare": cloudflare_models,
+        "codestral": codestral_models,
+        "nlp_cloud": nlp_cloud_models,
+        "friendliai": friendliai_models,
+        "palm": palm_models,
+        "groq": groq_models,
+        "azure": azure_models | azure_text_models,
+        "azure_anthropic": azure_anthropic_models,
+        "azure_text": azure_text_models,
+        "anyscale": anyscale_models,
+        "cerebras": cerebras_models,
+        "galadriel": galadriel_models,
+        "nvidia_nim": nvidia_nim_models,
+        "nvidia_riva": nvidia_riva_models,
+        "soniox": soniox_models,
+        "sambanova": sambanova_models | sambanova_embedding_models,
+        "novita": novita_models,
+        "nebius": nebius_models | nebius_embedding_models,
+        "aiml": aiml_models,
+        "assemblyai": assemblyai_models,
+        "jina_ai": jina_ai_models,
+        "snowflake": snowflake_models,
+        "gradient_ai": gradient_ai_models,
+        "meta_llama": llama_models,
+        "nscale": nscale_models,
+        "featherless_ai": featherless_ai_models,
+        "deepgram": deepgram_models,
+        "elevenlabs": elevenlabs_models,
+        "heroku": heroku_models,
+        "dashscope": dashscope_models,
+        "modelscope": modelscope_models,
+        "moonshot": moonshot_models,
+        "publicai": publicai_models,
+        "darkbloom": darkbloom_models,
+        "v0": v0_models,
+        "morph": morph_models,
+        "lambda_ai": lambda_ai_models,
+        "inception": inception_models,
+        "hyperbolic": hyperbolic_models,
+        "black_forest_labs": black_forest_labs_models,
+        "recraft": recraft_models,
+        "cometapi": cometapi_models,
+        "oci": oci_models,
+        "volcengine": volcengine_models,
+        "wandb": wandb_models,
+        "ovhcloud": ovhcloud_models | ovhcloud_embedding_models,
+        "lemonade": lemonade_models,
+        "clarifai": clarifai_models,
+        "amazon_nova": amazon_nova_models,
+        "stability": stability_models,
+        "github_copilot": github_copilot_models,
+        "chatgpt": chatgpt_models,
+        "minimax": minimax_models,
+        "aws_polly": aws_polly_models,
+        "gigachat": gigachat_models,
+        "llamagate": llamagate_models,
+        "reducto": reducto_models,
+        "bedrock_mantle": bedrock_mantle_models,
+    }
+
+
+models_by_provider: dict = _build_models_by_provider()

 # mapping for those models which have larger equivalents
 longer_context_model_fallback_dict: dict = {
@ -1267,8 +1284,8 @@ from .llms.xai.common_utils import XAIModelInfo
 from litellm.types.utils import LlmProviders

 ## Lazy loading this is not straightforward, will leave it here for now.
-from .main import *  # type: ignore
-from .compression import compress  # type: ignore[no-redef]
+from .main import *
+from .compression import compress

 # Skills API
 from .skills.main import (
@ -1339,7 +1356,7 @@ from .assistants.main import *
 from .batches.main import *
 from .images.main import *
 from .videos.main import *
-from .batch_completion.main import *  # type: ignore
+from .batch_completion.main import *
 from .rerank_api.main import *
 from .llms.anthropic.experimental_pass_through.messages.handler import *
 from .responses.main import *
@ -2052,7 +2069,7 @@ if TYPE_CHECKING:
    supports_reasoning: Callable[..., bool]
    acreate: Callable[..., Any]
    get_max_tokens: Callable[..., int]
-    get_model_info: Callable[..., _ModelInfoType]  # type: ignore[no-redef]
+    get_model_info: Callable[..., _ModelInfoType]
    register_prompt_template: Callable[..., None]
    validate_environment: Callable[..., dict]
    check_valid_key: Callable[..., bool]
@ -2139,18 +2156,18 @@ def __getattr__(name: str) -> Any:
    # Use cached registry from _lazy_imports instead of importing tuples every time
    from ._lazy_imports import _get_lazy_import_registry

-    registry = _get_lazy_import_registry()
+    registry: Final = _get_lazy_import_registry()

    # Check if name is in registry and call the cached handler function
    if name in registry:
-        handler_func = registry[name]
+        handler_func: Final = registry[name]
        return handler_func(name)

    # Lazy load encoding from main.py to avoid heavy tiktoken import
    if name == "encoding":
-        from ._lazy_imports import _get_litellm_globals
+        from ._lazy_imports import get_litellm_globals

-        _globals = _get_litellm_globals()
+        _globals = get_litellm_globals()
        # Check if already cached
        if "encoding" not in _globals:
            from .main import encoding as _encoding
@ -2160,9 +2177,9 @@ def __getattr__(name: str) -> Any:

    # Lazy load bedrock_tool_name_mappings instance
    if name == "bedrock_tool_name_mappings":
-        from ._lazy_imports import _get_litellm_globals
+        from ._lazy_imports import get_litellm_globals

-        _globals = _get_litellm_globals()
+        _globals = get_litellm_globals()
        # Check if already cached
        if "bedrock_tool_name_mappings" not in _globals:
            from .llms.bedrock.chat.invoke_handler import (
@ -2174,9 +2191,9 @@ def __getattr__(name: str) -> Any:

    # Lazy load AzureOpenAIError exception class
    if name == "AzureOpenAIError":
-        from ._lazy_imports import _get_litellm_globals
+        from ._lazy_imports import get_litellm_globals

-        _globals = _get_litellm_globals()
+        _globals = get_litellm_globals()
        # Check if already cached
        if "AzureOpenAIError" not in _globals:
            from .llms.azure.common_utils import AzureOpenAIError as _AzureOpenAIError
@ -2186,9 +2203,9 @@ def __getattr__(name: str) -> Any:

    # Lazy load openaiOSeriesConfig instance
    if name == "openaiOSeriesConfig":
-        from ._lazy_imports import _get_litellm_globals
+        from ._lazy_imports import get_litellm_globals

-        _globals = _get_litellm_globals()
+        _globals = get_litellm_globals()
        if "openaiOSeriesConfig" not in _globals:
            # Import the config class and instantiate it
            config_class = __getattr__("OpenAIOSeriesConfig")
@ -2196,7 +2213,7 @@ def __getattr__(name: str) -> Any:
        return _globals["openaiOSeriesConfig"]

    # Lazy load other config instances
-    _config_instances = {
+    _config_instances: Final = {
        "openAIGPTConfig": "OpenAIGPTConfig",
        "openAIGPTAudioConfig": "OpenAIGPTAudioConfig",
        "openAIGPT5Config": "OpenAIGPT5Config",
@ -2204,9 +2221,9 @@ def __getattr__(name: str) -> Any:
        "nvidiaNimEmbeddingConfig": "NvidiaNimEmbeddingConfig",
    }
    if name in _config_instances:
-        from ._lazy_imports import _get_litellm_globals
+        from ._lazy_imports import get_litellm_globals

-        _globals = _get_litellm_globals()
+        _globals = get_litellm_globals()
        if name not in _globals:
            # Import the config class and instantiate it
            config_class = __getattr__(_config_instances[name])
@ -2219,9 +2236,9 @@ def __getattr__(name: str) -> Any:

    # Lazy load provider_list
    if name == "provider_list":
-        from ._lazy_imports import _get_litellm_globals
+        from ._lazy_imports import get_litellm_globals

-        _globals = _get_litellm_globals()
+        _globals = get_litellm_globals()
        # Check if already cached
        if "provider_list" not in _globals:
            # LlmProviders is eagerly imported above, so we can import it directly
@ -2232,33 +2249,33 @@ def __getattr__(name: str) -> Any:

    # Lazy load priority_reservation_settings instance
    if name == "priority_reservation_settings":
-        from ._lazy_imports import _get_litellm_globals
+        from ._lazy_imports import get_litellm_globals

-        _globals = _get_litellm_globals()
+        _globals = get_litellm_globals()
        # Check if already cached
        if "priority_reservation_settings" not in _globals:
            # Import the class and instantiate it
-            PriorityReservationSettings = __getattr__("PriorityReservationSettings")
+            PriorityReservationSettings: Final = __getattr__("PriorityReservationSettings")
            _globals["priority_reservation_settings"] = PriorityReservationSettings()
        return _globals["priority_reservation_settings"]

    # Lazy load logging_callback_manager instance
    if name == "logging_callback_manager":
-        from ._lazy_imports import _get_litellm_globals
+        from ._lazy_imports import get_litellm_globals

-        _globals = _get_litellm_globals()
+        _globals = get_litellm_globals()
        # Check if already cached
        if "logging_callback_manager" not in _globals:
            # Import the class and instantiate it
-            LoggingCallbackManager = __getattr__("LoggingCallbackManager")
+            LoggingCallbackManager: Final = __getattr__("LoggingCallbackManager")
            _globals["logging_callback_manager"] = LoggingCallbackManager()
        return _globals["logging_callback_manager"]

    # Lazy load _service_logger module
    if name == "_service_logger":
-        from ._lazy_imports import _get_litellm_globals
+        from ._lazy_imports import get_litellm_globals

-        _globals = _get_litellm_globals()
+        _globals = get_litellm_globals()
        # Check if already cached
        if "_service_logger" not in _globals:
            # Import the module lazily
--- a/litellm/_internal_context.py
+++ b/litellm/_internal_context.py
@ -7,7 +7,8 @@ asyncio task and cannot be injected via HTTP request bodies.
 """

 from contextvars import ContextVar
+from typing import Final

 # When True, suppresses async logging and billing for internal sub-calls
 # (e.g., emulated file-search steps that make nested LLM calls).
-is_internal_call: ContextVar[bool] = ContextVar("is_internal_call", default=False)
+is_internal_call: Final[ContextVar[bool]] = ContextVar("is_internal_call", default=False)
--- a/litellm/_lazy_imports.py
+++ b/litellm/_lazy_imports.py
@ -18,11 +18,12 @@ until they're actually needed.
 import importlib
 import sys
 from collections.abc import Callable
-from typing import Any, cast
+from typing import Any, Final, cast

 # Import all the data structures that define what can be lazy-loaded
 # These are just lists of names and maps of where to find them
 from ._lazy_imports_registry import (
+    # Import maps
    _BEDROCK_TYPES_IMPORT_MAP,
    _CACHING_IMPORT_MAP,
    _COST_CALCULATOR_IMPORT_MAP,
@ -33,12 +34,11 @@ from ._lazy_imports_registry import (
    _TOKEN_COUNTER_IMPORT_MAP,
    _TYPES_IMPORT_MAP,
    _TYPES_UTILS_IMPORT_MAP,
-    # Import maps
    _UTILS_IMPORT_MAP,
    _UTILS_MODULE_IMPORT_MAP,
+    # Name tuples
    BEDROCK_TYPES_NAMES,
    CACHING_NAMES,
-    # Name tuples
    COST_CALCULATOR_NAMES,
    DOTPROMPT_NAMES,
    HTTP_HANDLER_NAMES,
@ -54,7 +54,7 @@ from ._lazy_imports_registry import (
 )


-def _get_litellm_globals() -> dict:
+def get_litellm_globals() -> dict:
    """
    Get the globals dictionary of the litellm module.

@ -233,7 +233,7 @@ def _generic_lazy_import(name: str, import_map: dict[str, tuple[str, str]], cate
        raise AttributeError(f"{category} lazy import: unknown attribute {name!r}")

    # Step 2: Get the cache (where we store imported things)
-    _globals = _get_litellm_globals()
+    _globals: Final = get_litellm_globals()

    # Step 3: If we've already imported it, just return the cached version
    if name in _globals:
@ -255,7 +255,7 @@ def _generic_lazy_import(name: str, import_map: dict[str, tuple[str, str]], cate

    # Step 6: Get the actual attribute from the module
    # Example: getattr(utils_module, "ModelResponse") returns the ModelResponse class
-    value = getattr(module, attr_name)
+    value: Final = getattr(module, attr_name)

    # Step 7: Cache it so we don't have to import again next time
    _globals[name] = value
@ -332,14 +332,14 @@ def _lazy_import_utils_module(name: str) -> Any:
    Handler for utils module lazy imports.

    This uses a custom implementation because utils module needs to use
-    _get_utils_globals() instead of _get_litellm_globals() for caching.
+    _get_utils_globals() instead of get_litellm_globals() for caching.
    """
    # Check if this attribute exists in our map
    if name not in _UTILS_MODULE_IMPORT_MAP:
        raise AttributeError(f"Utils module lazy import: unknown attribute {name!r}")

    # Get the cache (where we store imported things) - use utils globals
-    _globals = _get_utils_globals()
+    _globals: Final = _get_utils_globals()

    # If we've already imported it, just return the cached version
    if name in _globals:
@ -355,7 +355,7 @@ def _lazy_import_utils_module(name: str) -> Any:
        module = importlib.import_module(module_path)

    # Get the actual attribute from the module
-    value = getattr(module, attr_name)
+    value: Final = getattr(module, attr_name)

    # Cache it so we don't have to import again next time
    _globals[name] = value
@ -379,15 +379,15 @@ def _lazy_import_llm_client_cache(name: str) -> Any:
    - "in_memory_llm_clients_cache" is a singleton instance of that class
    So we need custom logic to handle both cases.
    """
-    _globals = _get_litellm_globals()
+    _globals: Final = get_litellm_globals()

    # If already cached, return it
    if name in _globals:
        return _globals[name]

    # Import the class
-    module = importlib.import_module("litellm.caching.llm_caching_handler")
-    LLMClientCache = getattr(module, "LLMClientCache")
+    module: Final = importlib.import_module("litellm.caching.llm_caching_handler")
+    LLMClientCache: Final = getattr(module, "LLMClientCache")

    # If they want the class itself, return it
    if name == "LLMClientCache":
@ -396,7 +396,7 @@ def _lazy_import_llm_client_cache(name: str) -> Any:

    # If they want the singleton instance, create it (only once)
    if name == "in_memory_llm_clients_cache":
-        instance = LLMClientCache()
+        instance: Final = LLMClientCache()
        _globals["in_memory_llm_clients_cache"] = instance
        return instance

@ -412,7 +412,7 @@ def _lazy_import_http_handlers(name: str) -> Any:
    - They need configuration (timeout, etc.) from the module globals
    - They use factory functions instead of direct instantiation
    """
-    _globals = _get_litellm_globals()
+    _globals: Final = get_litellm_globals()

    if name == "module_level_aclient":
        # Create an async HTTP client using the factory function
@ -420,11 +420,11 @@ def _lazy_import_http_handlers(name: str) -> Any:

        # Get timeout from module config (if set)
        timeout = _globals.get("request_timeout")
-        params = {"timeout": timeout, "client_alias": "module level aclient"}
+        params: Final = {"timeout": timeout, "client_alias": "module level aclient"}

        # Create the client instance
-        provider_id = cast(Any, "litellm_module_level_client")
-        async_client = get_async_httpx_client(
+        provider_id: Final = cast(Any, "litellm_module_level_client")
+        async_client: Final = get_async_httpx_client(
            llm_provider=provider_id,
            params=params,
        )
@ -438,7 +438,7 @@ def _lazy_import_http_handlers(name: str) -> Any:
        from litellm.llms.custom_httpx.http_handler import HTTPHandler

        timeout = _globals.get("request_timeout")
-        sync_client = HTTPHandler(timeout=timeout)
+        sync_client: Final = HTTPHandler(timeout=timeout)

        # Cache it
        _globals["module_level_client"] = sync_client
--- a/litellm/_lazy_imports_registry.py
+++ b/litellm/_lazy_imports_registry.py
@ -5,21 +5,23 @@ This module contains all the name tuples and import maps used by the lazy import
 Separated from the handler functions for better organization.
 """

+from typing import Final
+
 # Cost calculator names that support lazy loading via _lazy_import_cost_calculator
-COST_CALCULATOR_NAMES = (
+COST_CALCULATOR_NAMES: Final = (
    "completion_cost",
    "cost_per_token",
    "response_cost_calculator",
 )

 # Litellm logging names that support lazy loading via _lazy_import_litellm_logging
-LITELLM_LOGGING_NAMES = (
+LITELLM_LOGGING_NAMES: Final = (
    "Logging",
    "modify_integration",
 )

 # Utils names that support lazy loading via _lazy_import_utils
-UTILS_NAMES = (
+UTILS_NAMES: Final = (
    "exception_type",
    "get_optional_params",
    "get_response_string",
@ -66,20 +68,20 @@ UTILS_NAMES = (
 )

 # Token counter names that support lazy loading via _lazy_import_token_counter
-TOKEN_COUNTER_NAMES = ("get_modified_max_tokens",)
+TOKEN_COUNTER_NAMES: Final = ("get_modified_max_tokens",)

 # LLM client cache names that support lazy loading via _lazy_import_llm_client_cache
-LLM_CLIENT_CACHE_NAMES = (
+LLM_CLIENT_CACHE_NAMES: Final = (
    "LLMClientCache",
    "in_memory_llm_clients_cache",
 )

 # Bedrock type names that support lazy loading via _lazy_import_bedrock_types
-BEDROCK_TYPES_NAMES = ("COHERE_EMBEDDING_INPUT_TYPES",)
+BEDROCK_TYPES_NAMES: Final = ("COHERE_EMBEDDING_INPUT_TYPES",)

 # Common types from litellm.types.utils that support lazy loading via
 # _lazy_import_types_utils
-TYPES_UTILS_NAMES = (
+TYPES_UTILS_NAMES: Final = (
    "ImageObject",
    "BudgetConfig",
    "all_litellm_params",
@ -92,7 +94,7 @@ TYPES_UTILS_NAMES = (
 )

 # Caching / cache classes that support lazy loading via _lazy_import_caching
-CACHING_NAMES = (
+CACHING_NAMES: Final = (
    "Cache",
    "DualCache",
    "RedisCache",
@ -100,20 +102,20 @@ CACHING_NAMES = (
 )

 # HTTP handler names that support lazy loading via _lazy_import_http_handlers
-HTTP_HANDLER_NAMES = (
+HTTP_HANDLER_NAMES: Final = (
    "module_level_aclient",
    "module_level_client",
 )

 # Dotprompt integration names that support lazy loading via _lazy_import_dotprompt
-DOTPROMPT_NAMES = (
+DOTPROMPT_NAMES: Final = (
    "global_prompt_manager",
    "global_prompt_directory",
    "set_global_prompt_directory",
 )

 # LLM config classes that support lazy loading via _lazy_import_llm_configs
-LLM_CONFIG_NAMES = (
+LLM_CONFIG_NAMES: Final = (
    "AmazonConverseConfig",
    "OpenAILikeChatConfig",
    "GaladrielChatConfig",
@ -328,7 +330,7 @@ LLM_CONFIG_NAMES = (
 )

 # Types that support lazy loading via _lazy_import_types
-TYPES_NAMES = (
+TYPES_NAMES: Final = (
    "GuardrailItem",
    "DefaultTeamSSOParams",
    "LiteLLM_UpperboundKeyGenerateParams",
@ -344,14 +346,14 @@ TYPES_NAMES = (
 )

 # LLM provider logic names that support lazy loading via _lazy_import_llm_provider_logic
-LLM_PROVIDER_LOGIC_NAMES = (
+LLM_PROVIDER_LOGIC_NAMES: Final = (
    "get_llm_provider",
    "remove_index_from_tool_calls",
 )

 # Utils module names that support lazy loading via _lazy_import_utils_module
 # These are attributes accessed from litellm.utils module
-UTILS_MODULE_NAMES = (
+UTILS_MODULE_NAMES: Final = (
    "encoding",
    "BaseVectorStore",
    "CredentialAccessor",
@ -423,7 +425,7 @@ UTILS_MODULE_NAMES = (
 )

 # Import maps for registry pattern - reduces repetition
-_UTILS_IMPORT_MAP = {
+_UTILS_IMPORT_MAP: Final = {
    "exception_type": (".utils", "exception_type"),
    "get_optional_params": (".utils", "get_optional_params"),
    "get_response_string": (".utils", "get_response_string"),
@ -478,13 +480,13 @@ _UTILS_IMPORT_MAP = {
    ),
 }

-_COST_CALCULATOR_IMPORT_MAP = {
+_COST_CALCULATOR_IMPORT_MAP: Final = {
    "completion_cost": (".cost_calculator", "completion_cost"),
    "cost_per_token": (".cost_calculator", "cost_per_token"),
    "response_cost_calculator": (".cost_calculator", "response_cost_calculator"),
 }

-_TYPES_UTILS_IMPORT_MAP = {
+_TYPES_UTILS_IMPORT_MAP: Final = {
    "ImageObject": (".types.utils", "ImageObject"),
    "BudgetConfig": (".types.utils", "BudgetConfig"),
    "all_litellm_params": (".types.utils", "all_litellm_params"),
@ -496,28 +498,28 @@ _TYPES_UTILS_IMPORT_MAP = {
    "GenericStreamingChunk": (".types.utils", "GenericStreamingChunk"),
 }

-_TOKEN_COUNTER_IMPORT_MAP = {
+_TOKEN_COUNTER_IMPORT_MAP: Final = {
    "get_modified_max_tokens": (
        "litellm.litellm_core_utils.token_counter",
        "get_modified_max_tokens",
    ),
 }

-_BEDROCK_TYPES_IMPORT_MAP = {
+_BEDROCK_TYPES_IMPORT_MAP: Final = {
    "COHERE_EMBEDDING_INPUT_TYPES": (
        "litellm.types.llms.bedrock",
        "COHERE_EMBEDDING_INPUT_TYPES",
    ),
 }

-_CACHING_IMPORT_MAP = {
+_CACHING_IMPORT_MAP: Final = {
    "Cache": ("litellm.caching.caching", "Cache"),
    "DualCache": ("litellm.caching.caching", "DualCache"),
    "RedisCache": ("litellm.caching.caching", "RedisCache"),
    "InMemoryCache": ("litellm.caching.caching", "InMemoryCache"),
 }

-_LITELLM_LOGGING_IMPORT_MAP = {
+_LITELLM_LOGGING_IMPORT_MAP: Final = {
    "Logging": ("litellm.litellm_core_utils.litellm_logging", "Logging"),
    "modify_integration": (
        "litellm.litellm_core_utils.litellm_logging",
@ -525,7 +527,7 @@ _LITELLM_LOGGING_IMPORT_MAP = {
    ),
 }

-_DOTPROMPT_IMPORT_MAP = {
+_DOTPROMPT_IMPORT_MAP: Final = {
    "global_prompt_manager": (
        "litellm.integrations.dotprompt",
        "global_prompt_manager",
@ -540,7 +542,7 @@ _DOTPROMPT_IMPORT_MAP = {
    ),
 }

-_TYPES_IMPORT_MAP = {
+_TYPES_IMPORT_MAP: Final = {
    "GuardrailItem": ("litellm.types.guardrails", "GuardrailItem"),
    "DefaultTeamSSOParams": (
        "litellm.types.proxy.management_endpoints.ui_sso",
@ -569,7 +571,7 @@ _TYPES_IMPORT_MAP = {
    ),
 }

-_LLM_PROVIDER_LOGIC_IMPORT_MAP = {
+_LLM_PROVIDER_LOGIC_IMPORT_MAP: Final = {
    "get_llm_provider": (
        "litellm.litellm_core_utils.get_llm_provider_logic",
        "get_llm_provider",
@ -580,7 +582,7 @@ _LLM_PROVIDER_LOGIC_IMPORT_MAP = {
    ),
 }

-_LLM_CONFIGS_IMPORT_MAP = {
+_LLM_CONFIGS_IMPORT_MAP: Final = {
    "AmazonConverseConfig": (
        ".llms.bedrock.chat.converse_transformation",
        "AmazonConverseConfig",
@ -1215,7 +1217,7 @@ _LLM_CONFIGS_IMPORT_MAP = {
 }

 # Import map for utils module lazy imports
-_UTILS_MODULE_IMPORT_MAP = {
+_UTILS_MODULE_IMPORT_MAP: Final = {
    "encoding": ("litellm.main", "encoding"),
    "BaseVectorStore": (
        "litellm.integrations.vector_store_integrations.base_vector_store",
@ -1459,32 +1461,30 @@ _UTILS_MODULE_IMPORT_MAP = {

 # Export all name tuples and import maps for use in _lazy_imports.py
 __all__ = [
-    # Name tuples
-    "COST_CALCULATOR_NAMES",
-    "LITELLM_LOGGING_NAMES",
-    "UTILS_NAMES",
-    "TOKEN_COUNTER_NAMES",
-    "LLM_CLIENT_CACHE_NAMES",
    "BEDROCK_TYPES_NAMES",
-    "TYPES_UTILS_NAMES",
    "CACHING_NAMES",
-    "HTTP_HANDLER_NAMES",
+    "COST_CALCULATOR_NAMES",
    "DOTPROMPT_NAMES",
+    "HTTP_HANDLER_NAMES",
+    "LITELLM_LOGGING_NAMES",
+    "LLM_CLIENT_CACHE_NAMES",
    "LLM_CONFIG_NAMES",
-    "TYPES_NAMES",
    "LLM_PROVIDER_LOGIC_NAMES",
+    "TOKEN_COUNTER_NAMES",
+    "TYPES_NAMES",
+    "TYPES_UTILS_NAMES",
    "UTILS_MODULE_NAMES",
-    # Import maps
-    "_UTILS_IMPORT_MAP",
-    "_COST_CALCULATOR_IMPORT_MAP",
-    "_TYPES_UTILS_IMPORT_MAP",
-    "_TOKEN_COUNTER_IMPORT_MAP",
+    "UTILS_NAMES",
    "_BEDROCK_TYPES_IMPORT_MAP",
    "_CACHING_IMPORT_MAP",
-    "_LITELLM_LOGGING_IMPORT_MAP",
+    "_COST_CALCULATOR_IMPORT_MAP",
    "_DOTPROMPT_IMPORT_MAP",
-    "_TYPES_IMPORT_MAP",
+    "_LITELLM_LOGGING_IMPORT_MAP",
    "_LLM_CONFIGS_IMPORT_MAP",
    "_LLM_PROVIDER_LOGIC_IMPORT_MAP",
+    "_TOKEN_COUNTER_IMPORT_MAP",
+    "_TYPES_IMPORT_MAP",
+    "_TYPES_UTILS_IMPORT_MAP",
+    "_UTILS_IMPORT_MAP",
    "_UTILS_MODULE_IMPORT_MAP",
 ]
--- a/litellm/_logging.py
+++ b/litellm/_logging.py
@ -1,23 +1,56 @@
 import ast
+import contextvars
 import logging
 import os
 import sys
 from datetime import datetime
 from logging import Formatter
-from typing import Any
+from typing import Any, Final

+import litellm
 from litellm.litellm_core_utils.safe_json_dumps import safe_dumps
 from litellm.litellm_core_utils.safe_json_loads import safe_json_loads
 from litellm.litellm_core_utils.secret_redaction import redact_string

 set_verbose = False

+session_id_var: Final[contextvars.ContextVar[str]] = contextvars.ContextVar("session_id", default="")
+trace_id_var: Final[contextvars.ContextVar[str]] = contextvars.ContextVar("trace_id", default="")
+
+_MAX_CORRELATION_ID_LENGTH: Final = 256
+
+
+def _sanitize_correlation_id(value: str) -> str:
+    """Strip control characters, bound length, and redact credential-shaped
+    content before a caller-controlled trace_id/session_id (e.g.
+    litellm_session_id, x-litellm-trace-id) is stamped into log lines.
+
+    Without the first two, a caller could embed \\r/\\n or terminal escape
+    sequences to forge fake log entries, or submit an oversized value repeated
+    across every log line for the request. Without the redaction, a caller
+    could smuggle a real credential (e.g. an sk-... key) through this field:
+    CorrelationContextFilter stamps trace_id/session_id onto the record after
+    SecretRedactionFilter has already run, so those two fields never otherwise
+    pass through credential redaction.
+    """
+    stripped: Final = "".join(ch for ch in value if ch.isprintable())
+    return _redact_string(stripped[:_MAX_CORRELATION_ID_LENGTH])
+
+
+def set_session_id(session_id: str) -> "contextvars.Token[str]":
+    return session_id_var.set(_sanitize_correlation_id(session_id))
+
+
+def set_trace_id(trace_id: str) -> "contextvars.Token[str]":
+    return trace_id_var.set(_sanitize_correlation_id(trace_id))
+
+
 if set_verbose is True:
    logging.warning(
        "`litellm.set_verbose` is deprecated. Please set `os.environ['LITELLM_LOG'] = 'DEBUG'` for debug logs."
    )

-_ENABLE_SECRET_REDACTION = os.getenv("LITELLM_DISABLE_REDACT_SECRETS", "").lower() != "true"
+_ENABLE_SECRET_REDACTION: Final = os.getenv("LITELLM_DISABLE_REDACT_SECRETS", "").lower() != "true"


 def _redact_string(value: str) -> str:
@ -74,16 +107,39 @@ class SecretRedactionFilter(logging.Filter):
        return True


-_secret_filter = SecretRedactionFilter()
+_secret_filter: Final = SecretRedactionFilter()
+
+
+class CorrelationContextFilter(logging.Filter):
+    """Stamps each log record with the current request's trace_id and session_id from contextvars.
+
+    Works in tandem with JsonFormatter: the formatter's record.__dict__ loop picks up these
+    attributes as first-class JSON fields without any formatter-level code.
+    """
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        if not litellm.request_correlation_in_logs:
+            return True
+        trace_id: Final = trace_id_var.get()
+        if trace_id:
+            record.trace_id = trace_id  # rebind-ok: stamping the LogRecord is the Filter interface's contract
+        session_id: Final = session_id_var.get()
+        if session_id:
+            record.session_id = session_id  # rebind-ok: stamping the LogRecord is the Filter interface's contract
+        return True
+
+
+_correlation_filter: Final = CorrelationContextFilter()


 json_logs = bool(os.getenv("JSON_LOGS", False))
 # Create a handler for the logger (you may need to adapt this based on your needs)
-log_level = os.getenv("LITELLM_LOG", "DEBUG")
-numeric_level: str = getattr(logging, log_level.upper())
-handler = logging.StreamHandler()
+log_level: Final = os.getenv("LITELLM_LOG", "DEBUG")
+numeric_level: Final[str] = getattr(logging, log_level.upper())
+handler: Final = logging.StreamHandler()
 handler.setLevel(numeric_level)
 handler.addFilter(_secret_filter)
+handler.addFilter(_correlation_filter)


 def _try_parse_json_message(message: str) -> dict[str, Any] | None:
@ -94,10 +150,10 @@ def _try_parse_json_message(message: str) -> dict[str, Any] | None:
    """
    if not message or not isinstance(message, str):
        return None
-    msg_stripped = message.strip()
+    msg_stripped: Final = message.strip()
    if not (msg_stripped.startswith("{") or msg_stripped.startswith("[")):
        return None
-    parsed = safe_json_loads(message, default=None)
+    parsed: Final = safe_json_loads(message, default=None)
    if parsed is None or not isinstance(parsed, dict):
        return None
    return parsed
@ -144,7 +200,12 @@ def _get_standard_record_attrs() -> frozenset:
    return frozenset(logging.LogRecord("", 0, "", 0, "", (), None).__dict__.keys())


-_STANDARD_RECORD_ATTRS = _get_standard_record_attrs()
+_STANDARD_RECORD_ATTRS: Final = _get_standard_record_attrs()
+
+# CorrelationContextFilter is the only legitimate source for these two JSON fields;
+# see JsonFormatter.format() for why they're excluded from the generic message-content
+# and extra-attribute promotion paths.
+_RESERVED_CORRELATION_FIELDS: Final = frozenset(("trace_id", "session_id"))


 class JsonFormatter(Formatter):
@ -153,24 +214,29 @@ class JsonFormatter(Formatter):

    def formatTime(self, record, datefmt=None):
        # Use datetime to format the timestamp in ISO 8601 format
-        dt = datetime.fromtimestamp(record.created)
+        dt: Final = datetime.fromtimestamp(record.created)
        return dt.isoformat()

    def format(self, record):
-        message_str = record.getMessage()
-        json_record: dict[str, Any] = {
+        message_str: Final = record.getMessage()
+        json_record: Final[dict[str, Any]] = {
            "message": message_str,
            "level": record.levelname,
            "timestamp": self.formatTime(record),
        }

-        # Parse embedded JSON or Python dict repr in message so sub-fields become first-class properties
+        # Parse embedded JSON or Python dict repr in message so sub-fields become first-class properties.
+        # trace_id/session_id are excluded here unconditionally (not just "if not already
+        # set") - CorrelationContextFilter is the only legitimate source for these two
+        # fields, and a message that merely happens to parse as JSON/dict (e.g. a proxy
+        # log line dumping raw request headers) must never be able to claim them, even on
+        # a record the filter hasn't stamped yet (no correlation context active for it).
        parsed = _try_parse_json_message(message_str)
        if parsed is None:
            parsed = _try_parse_embedded_python_dict(message_str)
        if parsed is not None:
            for key, value in parsed.items():
-                if key not in json_record:
+                if key not in json_record and key not in _RESERVED_CORRELATION_FIELDS:
                    json_record[key] = value

        # Include extra attributes passed via logger.debug("msg", extra={...})
@ -178,6 +244,18 @@ class JsonFormatter(Formatter):
            if key not in _STANDARD_RECORD_ATTRS and key not in json_record:
                json_record[key] = value

+        # trace_id/session_id are reserved: CorrelationContextFilter is the only
+        # legitimate source for these two fields. Without this, a message string
+        # that happens to parse as JSON/dict (e.g. a proxy log line dumping raw
+        # request headers) with a "trace_id"/"session_id" key would have already
+        # claimed the key at the parsed-message step above, and the extra-attributes
+        # loop's "key not in json_record" guard would then skip the real value -
+        # letting a caller-supplied header spoof another request's correlation ids.
+        for reserved_key in _RESERVED_CORRELATION_FIELDS:
+            value = getattr(record, reserved_key, None)
+            if value:
+                json_record[reserved_key] = value
+
        # Set component/logger only if not already supplied via extra={...}
        if "component" not in json_record:
            json_record["component"] = record.name
@ -190,16 +268,38 @@ class JsonFormatter(Formatter):
        return safe_dumps(json_record)


+class CorrelationPlainFormatter(logging.Formatter):
+    """Appends trace_id/session_id to plain-text log lines stamped by CorrelationContextFilter.
+
+    Mirrors JsonFormatter's handling of these two fields so request_correlation_in_logs
+    behaves the same whether or not json_logs is enabled.
+    """
+
+    def format(self, record: logging.LogRecord) -> str:
+        formatted: Final = super().format(record)
+        trace_id: Final = getattr(record, "trace_id", None)
+        session_id: Final = getattr(record, "session_id", None)
+        if not trace_id and not session_id:
+            return formatted
+        parts: Final = tuple(
+            p
+            for p in (f"trace_id={trace_id}" if trace_id else None, f"session_id={session_id}" if session_id else None)
+            if p
+        )
+        return f"{formatted} [{' '.join(parts)}]"
+
+
 # Function to set up exception handlers for JSON logging
 def _setup_json_exception_handlers(formatter):
    # Create a handler with JSON formatting for exceptions
-    error_handler = logging.StreamHandler()
+    error_handler: Final = logging.StreamHandler()
    error_handler.setFormatter(formatter)
    error_handler.addFilter(_secret_filter)
+    error_handler.addFilter(_correlation_filter)

    # Setup excepthook for uncaught exceptions
    def json_excepthook(exc_type, exc_value, exc_traceback):
-        record = logging.LogRecord(
+        record: Final = logging.LogRecord(
            name="LiteLLM",
            level=logging.ERROR,
            pathname="",
@ -217,10 +317,10 @@ def _setup_json_exception_handlers(formatter):
        import asyncio

        def async_json_exception_handler(loop, context):
-            exception = context.get("exception")
+            exception: Final = context.get("exception")
            if exception:
-                exc_type = type(exception)
-                record = logging.LogRecord(
+                exc_type: Final = type(exception)
+                record: Final = logging.LogRecord(
                    name="LiteLLM",
                    level=logging.ERROR,
                    pathname="",
@ -243,7 +343,7 @@ if json_logs:
    handler.setFormatter(JsonFormatter())
    _setup_json_exception_handlers(JsonFormatter())
 else:
-    formatter = logging.Formatter(
+    formatter: Final = CorrelationPlainFormatter(
        "\033[92m%(asctime)s - %(name)s:%(levelname)s\033[0m: %(filename)s:%(lineno)s - %(message)s",
        datefmt="%H:%M:%S",
    )
@ -263,20 +363,54 @@ verbose_logger.addHandler(handler)
 def _suppress_loggers():
    """Suppress noisy loggers at INFO level"""
    # Suppress httpx request logging at INFO level
-    httpx_logger = logging.getLogger("httpx")
+    httpx_logger: Final = logging.getLogger("httpx")
    httpx_logger.setLevel(logging.WARNING)

    # Suppress APScheduler logging at INFO level
-    apscheduler_executors_logger = logging.getLogger("apscheduler.executors.default")
+    apscheduler_executors_logger: Final = logging.getLogger("apscheduler.executors.default")
    apscheduler_executors_logger.setLevel(logging.WARNING)
-    apscheduler_scheduler_logger = logging.getLogger("apscheduler.scheduler")
+    apscheduler_scheduler_logger: Final = logging.getLogger("apscheduler.scheduler")
    apscheduler_scheduler_logger.setLevel(logging.WARNING)


+_REDACTED_THIRD_PARTY_LOGGERS: Final[tuple[str, ...]] = (
+    "apscheduler.executors.default",
+    "apscheduler.scheduler",
+    "asyncio",
+    "backoff",
+    "httpx",
+    "uvicorn.error",
+)
+
+
+def _redact_third_party_loggers() -> None:
+    """Extend secret redaction to records litellm does not emit directly.
+
+    litellm's own loggers are covered by the filter on their shared handler, but a
+    litellm value can also reach a log record through a dependency that logs on its
+    own logger. Those records never pass through a litellm handler.
+
+    The filter is attached to each emitting logger rather than to the root logger or
+    to root's handlers. `Logger.handle` applies the emitting logger's filters before
+    any handler runs, so redaction happens once, at the earliest point in the
+    record's life, and covers every downstream handler regardless of who owns it.
+    The alternatives do not hold: `callHandlers` consults ancestors for handlers but
+    never for filters, so a filter on the root logger never sees these records at
+    all, and a filter on a root handler only covers that one handler, leaving
+    handlers registered earlier or on the emitting logger itself untouched.
+
+    Each name is the exact logger a dependency emits on; a parent name would not
+    cover its children, for the same reason the root logger does not.
+    """
+    for name in _REDACTED_THIRD_PARTY_LOGGERS:
+        logging.getLogger(name).addFilter(_secret_filter)
+
+
 # Call the suppression function
 _suppress_loggers()
+_redact_third_party_loggers()

-ALL_LOGGERS = [
+ALL_LOGGERS: Final = [
    logging.getLogger(),
    verbose_logger,
    verbose_router_logger,
@ -293,11 +427,11 @@ def _get_loggers_to_initialize():
    """
    import litellm

-    loggers = list(ALL_LOGGERS)
+    loggers: Final = list(ALL_LOGGERS)

    # Add langfuse logger if langfuse is being used as a callback
-    langfuse_callbacks = {"langfuse", "langfuse_otel"}
-    all_callbacks = set(litellm.success_callback + litellm.failure_callback)
+    langfuse_callbacks: Final = {"langfuse", "langfuse_otel"}
+    all_callbacks: Final = set(litellm.success_callback + litellm.failure_callback)
    if langfuse_callbacks & all_callbacks:
        loggers.append(logging.getLogger("langfuse"))

@ -312,6 +446,7 @@ def _initialize_loggers_with_handler(handler: logging.Handler):
    - Prevents bubbling to parent/root (critical to prevent duplicate JSON logs)
    """
    handler.addFilter(_secret_filter)
+    handler.addFilter(_correlation_filter)
    for lg in _get_loggers_to_initialize():
        lg.handlers.clear()  # remove any existing handlers
        lg.addHandler(handler)  # add JSON formatter handler
@ -325,12 +460,12 @@ def _get_uvicorn_json_log_config():
    This ensures that uvicorn's access logs, error logs, and all application logs
    are formatted as JSON when json_logs is enabled.
    """
-    json_formatter_class = "litellm._logging.JsonFormatter"
+    json_formatter_class: Final = "litellm._logging.JsonFormatter"

    # Use the module-level log_level variable for consistency
-    uvicorn_log_level = log_level.upper()
+    uvicorn_log_level: Final = log_level.upper()

-    log_config = {
+    log_config: Final = {
        "version": 1,
        "disable_existing_loggers": False,
        "formatters": {
@ -384,7 +519,7 @@ def _turn_on_json():

    - Adds a JSON formatter to all loggers
    """
-    handler = logging.StreamHandler()
+    handler: Final = logging.StreamHandler()
    handler.setFormatter(JsonFormatter())
    _initialize_loggers_with_handler(handler)
    # Set up exception handlers
--- a/litellm/_redis.py
+++ b/litellm/_redis.py
@ -13,9 +13,10 @@ import json
 # s/o [@Frank Colson](https://www.linkedin.com/in/frank-colson-422b9b183/) for this redis implementation
 import os
 from collections.abc import Callable
+from typing import Final

-import redis  # type: ignore
-import redis.asyncio as async_redis  # type: ignore
+import redis
+import redis.asyncio as async_redis

 from litellm import get_secret, get_secret_str
 from litellm._redis_credential_provider import (
@ -32,20 +33,20 @@ from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker

 from ._logging import verbose_logger

-AZURE_REDIS_SCOPE = "https://redis.azure.com/.default"
+AZURE_REDIS_SCOPE: Final = "https://redis.azure.com/.default"


 def _get_redis_kwargs():
-    arg_spec = inspect.getfullargspec(redis.Redis)
+    arg_spec: Final = inspect.getfullargspec(redis.Redis)

    # Only allow primitive arguments
-    exclude_args = {
+    exclude_args: Final = {
        "self",
        "connection_pool",
        "retry",
    }

-    include_args = {
+    include_args: Final = {
        "url",
        "redis_connect_func",
        "gcp_service_account",
@ -56,7 +57,7 @@ def _get_redis_kwargs():
        "azure_client_secret",
    }

-    available_args = {x for x in arg_spec.args if x not in exclude_args} | include_args
+    available_args: Final = {x for x in arg_spec.args if x not in exclude_args} | include_args

    return available_args

@ -92,9 +93,9 @@ def _get_redis_url_kwargs(client: type | None = None) -> tuple[str, ...]:
    """
    if client is None:
        client = redis.Redis
-    connection_cls = async_redis.Connection if client is async_redis.Redis else redis.Connection
+    connection_cls: Final = async_redis.Connection if client is async_redis.Redis else redis.Connection

-    exclude_args = frozenset(
+    exclude_args: Final = frozenset(
        {
            "self",
            "connection_pool",
@ -103,7 +104,7 @@ def _get_redis_url_kwargs(client: type | None = None) -> tuple[str, ...]:
    )

    # Only allow primitive arguments
-    include_args = ("url", "max_connections")
+    include_args: Final = ("url", "max_connections")

    return tuple(x for x in _init_arg_names(connection_cls) if x not in exclude_args) + include_args

@ -111,10 +112,10 @@ def _get_redis_url_kwargs(client: type | None = None) -> tuple[str, ...]:
 def _get_redis_cluster_kwargs(client=None):
    if client is None:
        client = redis.Redis.from_url
-    arg_spec = inspect.getfullargspec(redis.RedisCluster)
+    arg_spec: Final = inspect.getfullargspec(redis.RedisCluster)

    # Only allow primitive arguments
-    exclude_args = {"self", "connection_pool", "retry", "host", "port", "startup_nodes"}
+    exclude_args: Final = {"self", "connection_pool", "retry", "host", "port", "startup_nodes"}

    available_args = {x for x in arg_spec.args if x not in exclude_args}
    available_args |= {
@ -142,17 +143,17 @@ def _get_redis_cluster_kwargs(client=None):


 def _get_redis_env_kwarg_mapping():
-    PREFIX = "REDIS_"
+    PREFIX: Final = "REDIS_"

    return {f"{PREFIX}{x.upper()}": x for x in _get_redis_kwargs()}


 def _redis_kwargs_from_environment():
-    mapping = _get_redis_env_kwarg_mapping()
+    mapping: Final = _get_redis_env_kwarg_mapping()

-    return_dict = {}
+    return_dict: Final = {}
    for k, v in mapping.items():
-        value = get_secret(k, default_value=None)  # type: ignore
+        value = get_secret(k, default_value=None)
        if value is not None:
            return_dict[v] = value
    return return_dict
@ -183,7 +184,7 @@ def create_gcp_iam_redis_connect_func(

        self._parser.on_connect(self)

-        auth_args = (_generate_gcp_iam_access_token(service_account),)
+        auth_args: Final = (_generate_gcp_iam_access_token(service_account),)
        self.send_command("AUTH", *auth_args, check_health=False)

        try:
@ -224,9 +225,9 @@ def _build_azure_credential(
            "azure-identity is required for Azure AD Redis authentication. Install it with: pip install azure-identity"
        )

-    _client_id = azure_client_id or os.environ.get("AZURE_CLIENT_ID")
-    _tenant_id = azure_tenant_id or os.environ.get("AZURE_TENANT_ID")
-    _client_secret = azure_client_secret or os.environ.get("AZURE_CLIENT_SECRET")
+    _client_id: Final = azure_client_id or os.environ.get("AZURE_CLIENT_ID")
+    _tenant_id: Final = azure_tenant_id or os.environ.get("AZURE_TENANT_ID")
+    _client_secret: Final = azure_client_secret or os.environ.get("AZURE_CLIENT_SECRET")

    if _client_id and _tenant_id and _client_secret:
        return ClientSecretCredential(
@ -253,12 +254,12 @@ def _generate_azure_ad_redis_token(
    (``AzureADCredentialProvider``) keep the credential alive across
    connections so the Azure SDK's internal cache + silent refresh apply.
    """
-    credential = _build_azure_credential(
+    credential: Final = _build_azure_credential(
        azure_client_id=azure_client_id,
        azure_tenant_id=azure_tenant_id,
        azure_client_secret=azure_client_secret,
    )
-    token = credential.get_token(AZURE_REDIS_SCOPE)
+    token: Final = credential.get_token(AZURE_REDIS_SCOPE)
    return token.token


@ -274,7 +275,7 @@ def create_azure_ad_redis_connect_func(
    closure) and reused across connections — the Azure SDK handles token caching
    and silent renewal internally. Only ``get_token`` is called per connection.
    """
-    credential = _build_azure_credential(
+    credential: Final = _build_azure_credential(
        azure_client_id=azure_client_id,
        azure_tenant_id=azure_tenant_id,
        azure_client_secret=azure_client_secret,
@ -290,11 +291,11 @@ def create_azure_ad_redis_connect_func(

        self._parser.on_connect(self)

-        access_token = credential.get_token(AZURE_REDIS_SCOPE).token
+        access_token: Final = credential.get_token(AZURE_REDIS_SCOPE).token

        # Only include username when explicitly set — sending AUTH "" <token>
        # is invalid for most ACL-configured Azure Redis instances.
-        username = os.environ.get("REDIS_USERNAME", "")
+        username: Final = os.environ.get("REDIS_USERNAME", "")
        if username:
            auth_args = (username, access_token)
        else:
@ -316,7 +317,7 @@ def create_azure_ad_redis_connect_func(
    # AzureADCredentialProvider for refresh-aware token retrieval. The raw
    # client_id/tenant_id/secret are intentionally NOT exposed here — the
    # credential closure already holds them.
-    ad_connect._azure_credential = credential  # type: ignore[attr-defined]
+    ad_connect._azure_credential = credential
    return ad_connect


@ -350,26 +351,26 @@ def _get_redis_client_logic(**env_overrides):
    for k, v in env_overrides.items():
        if isinstance(v, str) and v.startswith("os.environ/"):
            v = v.replace("os.environ/", "")
-            value = get_secret(v)  # type: ignore
+            value = get_secret(v)
            env_overrides[k] = value

-    environment_kwargs = _redis_kwargs_from_environment()
+    environment_kwargs: Final = _redis_kwargs_from_environment()

    # An explicitly configured connection target outranks REDIS_URL from the
    # environment. Without this, the url branch below strips the caller's
    # host/port/password and silently connects to whatever REDIS_URL names.
-    caller_named_a_target = any(
+    caller_named_a_target: Final = any(
        env_overrides.get(key) is not None for key in ("host", "startup_nodes", "sentinel_nodes")
    )
    if caller_named_a_target and env_overrides.get("url") is None:
        environment_kwargs.pop("url", None)

-    redis_kwargs = {
+    redis_kwargs: Final = {
        **environment_kwargs,
        **env_overrides,
    }

-    _startup_nodes: str | list | None = redis_kwargs.get("startup_nodes", None) or get_secret(  # type: ignore
+    _startup_nodes: Final[str | list | None] = redis_kwargs.get("startup_nodes", None) or get_secret(
        "REDIS_CLUSTER_NODES"
    )

@ -380,30 +381,28 @@ def _get_redis_client_logic(**env_overrides):
    elif _startup_nodes is None:
        redis_kwargs.pop("startup_nodes", None)

-    _sentinel_nodes: str | list | None = redis_kwargs.get("sentinel_nodes", None) or get_secret(  # type: ignore
+    _sentinel_nodes: Final[str | list | None] = redis_kwargs.get("sentinel_nodes", None) or get_secret(
        "REDIS_SENTINEL_NODES"
    )

    if _sentinel_nodes is not None and isinstance(_sentinel_nodes, str):
        redis_kwargs["sentinel_nodes"] = json.loads(_sentinel_nodes)

-    _sentinel_password: str | None = redis_kwargs.get("sentinel_password", None) or get_secret_str(
+    _sentinel_password: Final[str | None] = redis_kwargs.get("sentinel_password", None) or get_secret_str(
        "REDIS_SENTINEL_PASSWORD"
    )

    if _sentinel_password is not None:
        redis_kwargs["sentinel_password"] = _sentinel_password

-    _service_name: str | None = redis_kwargs.get("service_name", None) or get_secret(  # type: ignore
-        "REDIS_SERVICE_NAME"
-    )
+    _service_name: Final[str | None] = redis_kwargs.get("service_name", None) or get_secret("REDIS_SERVICE_NAME")

    if _service_name is not None:
        redis_kwargs["service_name"] = _service_name

    # Handle GCP IAM authentication
-    _gcp_service_account = redis_kwargs.get("gcp_service_account") or get_secret_str("REDIS_GCP_SERVICE_ACCOUNT")
-    _gcp_ssl_ca_certs = redis_kwargs.get("gcp_ssl_ca_certs") or get_secret_str("REDIS_GCP_SSL_CA_CERTS")
+    _gcp_service_account: Final = redis_kwargs.get("gcp_service_account") or get_secret_str("REDIS_GCP_SERVICE_ACCOUNT")
+    _gcp_ssl_ca_certs: Final = redis_kwargs.get("gcp_ssl_ca_certs") or get_secret_str("REDIS_GCP_SSL_CA_CERTS")

    if _gcp_service_account is not None:
        verbose_logger.debug("Setting up GCP IAM authentication for Redis with service account.")
@ -411,7 +410,7 @@ def _get_redis_client_logic(**env_overrides):
            service_account=_gcp_service_account, ssl_ca_certs=_gcp_ssl_ca_certs
        )
        # Store GCP service account in redis_connect_func for async cluster access
-        redis_kwargs["redis_connect_func"]._gcp_service_account = _gcp_service_account  # type: ignore[attr-defined]
+        redis_kwargs["redis_connect_func"]._gcp_service_account = _gcp_service_account

        # Remove GCP-specific kwargs that shouldn't be passed to Redis client
        redis_kwargs.pop("gcp_service_account", None)
@ -422,9 +421,9 @@ def _get_redis_client_logic(**env_overrides):
            redis_kwargs["ssl_ca_certs"] = _gcp_ssl_ca_certs

    # Handle Azure AD authentication (after GCP IAM block)
-    _azure_redis_ad_token = redis_kwargs.get("azure_redis_ad_token") or get_secret("REDIS_AZURE_AD_TOKEN")
+    _azure_redis_ad_token: Final = redis_kwargs.get("azure_redis_ad_token") or get_secret("REDIS_AZURE_AD_TOKEN")

-    _azure_ad_enabled = _azure_redis_ad_token is not None and str(_azure_redis_ad_token).lower() == "true"
+    _azure_ad_enabled: Final = _azure_redis_ad_token is not None and str(_azure_redis_ad_token).lower() == "true"

    if _azure_ad_enabled and _gcp_service_account is not None:
        verbose_logger.warning(
@ -433,9 +432,9 @@ def _get_redis_client_logic(**env_overrides):
        )

    if _azure_ad_enabled and _gcp_service_account is None:
-        _azure_client_id = redis_kwargs.get("azure_client_id") or get_secret_str("AZURE_CLIENT_ID")
-        _azure_tenant_id = redis_kwargs.get("azure_tenant_id") or get_secret_str("AZURE_TENANT_ID")
-        _azure_client_secret = redis_kwargs.get("azure_client_secret") or get_secret_str("AZURE_CLIENT_SECRET")
+        _azure_client_id: Final = redis_kwargs.get("azure_client_id") or get_secret_str("AZURE_CLIENT_ID")
+        _azure_tenant_id: Final = redis_kwargs.get("azure_tenant_id") or get_secret_str("AZURE_TENANT_ID")
+        _azure_client_secret: Final = redis_kwargs.get("azure_client_secret") or get_secret_str("AZURE_CLIENT_SECRET")

        verbose_logger.debug("Setting up Azure AD authentication for Redis.")
        redis_kwargs["redis_connect_func"] = create_azure_ad_redis_connect_func(
@ -448,7 +447,7 @@ def _get_redis_client_logic(**env_overrides):
        # `create_azure_ad_redis_connect_func`; the raw client_id/tenant_id/secret
        # are intentionally NOT exposed on the function to avoid leaking
        # credentials via inspection or logging.
-        redis_kwargs["redis_connect_func"]._azure_redis_ad_token = True  # type: ignore[attr-defined]
+        redis_kwargs["redis_connect_func"]._azure_redis_ad_token = True

    # Always remove Azure-specific kwargs that shouldn't be passed to Redis client
    redis_kwargs.pop("azure_redis_ad_token", None)
@ -480,7 +479,7 @@ def _get_redis_client_logic(**env_overrides):


 def init_redis_cluster(redis_kwargs) -> redis.RedisCluster:
-    _redis_cluster_nodes_in_env: str | None = get_secret("REDIS_CLUSTER_NODES")  # type: ignore
+    _redis_cluster_nodes_in_env: Final[str | None] = get_secret("REDIS_CLUSTER_NODES")
    if _redis_cluster_nodes_in_env is not None:
        try:
            redis_kwargs["startup_nodes"] = json.loads(_redis_cluster_nodes_in_env)
@ -492,24 +491,24 @@ def init_redis_cluster(redis_kwargs) -> redis.RedisCluster:
    verbose_logger.debug("init_redis_cluster: startup nodes are being initialized.")
    from redis.cluster import ClusterNode

-    args = _get_redis_cluster_kwargs()
-    cluster_kwargs = {}
+    args: Final = _get_redis_cluster_kwargs()
+    cluster_kwargs: Final = {}
    for arg in redis_kwargs:
        if arg in args:
            cluster_kwargs[arg] = redis_kwargs[arg]

-    new_startup_nodes: list[ClusterNode] = []
+    new_startup_nodes: Final[list[ClusterNode]] = []

    for item in redis_kwargs["startup_nodes"]:
        new_startup_nodes.append(ClusterNode(**item))

    cluster_kwargs.pop("startup_nodes", None)
-    return redis.RedisCluster(startup_nodes=new_startup_nodes, **cluster_kwargs)  # type: ignore
+    return redis.RedisCluster(startup_nodes=new_startup_nodes, **cluster_kwargs)


 def _get_redis_sentinel_connection_kwargs(redis_kwargs: dict) -> dict:
-    connection_kwargs = {}
-    args = _get_redis_kwargs()
+    connection_kwargs: Final = {}
+    args: Final = _get_redis_kwargs()
    for arg in redis_kwargs:
        if arg in args:
            connection_kwargs[arg] = redis_kwargs[arg]
@ -518,12 +517,12 @@ def _get_redis_sentinel_connection_kwargs(redis_kwargs: dict) -> dict:


 def _init_redis_sentinel(redis_kwargs) -> redis.Redis:
-    sentinel_nodes = redis_kwargs.get("sentinel_nodes")
-    sentinel_password = redis_kwargs.get("sentinel_password")
-    service_name = redis_kwargs.get("service_name")
-    connection_kwargs = _get_redis_sentinel_connection_kwargs(redis_kwargs)
+    sentinel_nodes: Final = redis_kwargs.get("sentinel_nodes")
+    sentinel_password: Final = redis_kwargs.get("sentinel_password")
+    service_name: Final = redis_kwargs.get("service_name")
+    connection_kwargs: Final = _get_redis_sentinel_connection_kwargs(redis_kwargs)
    connection_kwargs.setdefault("socket_timeout", REDIS_SOCKET_TIMEOUT)
-    sentinel_kwargs = dict(connection_kwargs)
+    sentinel_kwargs: Final = dict(connection_kwargs)
    sentinel_kwargs["password"] = sentinel_password

    if not sentinel_nodes or not service_name:
@ -532,7 +531,7 @@ def _init_redis_sentinel(redis_kwargs) -> redis.Redis:
    verbose_logger.debug("init_redis_sentinel: sentinel nodes are being initialized.")

    # Set up the Sentinel client
-    sentinel = redis.Sentinel(
+    sentinel: Final = redis.Sentinel(
        sentinel_nodes,
        sentinel_kwargs=sentinel_kwargs,
    )
@ -543,12 +542,12 @@ def _init_redis_sentinel(redis_kwargs) -> redis.Redis:


 def _init_async_redis_sentinel(redis_kwargs) -> async_redis.Redis:
-    sentinel_nodes = redis_kwargs.get("sentinel_nodes")
-    sentinel_password = redis_kwargs.get("sentinel_password")
-    service_name = redis_kwargs.get("service_name")
-    connection_kwargs = _get_redis_sentinel_connection_kwargs(redis_kwargs)
+    sentinel_nodes: Final = redis_kwargs.get("sentinel_nodes")
+    sentinel_password: Final = redis_kwargs.get("sentinel_password")
+    service_name: Final = redis_kwargs.get("service_name")
+    connection_kwargs: Final = _get_redis_sentinel_connection_kwargs(redis_kwargs)
    connection_kwargs.setdefault("socket_timeout", REDIS_SOCKET_TIMEOUT)
-    sentinel_kwargs = dict(connection_kwargs)
+    sentinel_kwargs: Final = dict(connection_kwargs)
    sentinel_kwargs["password"] = sentinel_password

    if not sentinel_nodes or not service_name:
@ -557,7 +556,7 @@ def _init_async_redis_sentinel(redis_kwargs) -> async_redis.Redis:
    verbose_logger.debug("init_redis_sentinel: sentinel nodes are being initialized.")

    # Set up the Sentinel client
-    sentinel = async_redis.Sentinel(
+    sentinel: Final = async_redis.Sentinel(
        sentinel_nodes,
        sentinel_kwargs=sentinel_kwargs,
    )
@ -568,14 +567,14 @@ def _init_async_redis_sentinel(redis_kwargs) -> async_redis.Redis:


 def get_redis_client(**env_overrides):
-    redis_kwargs = _get_redis_client_logic(**env_overrides)
+    redis_kwargs: Final = _get_redis_client_logic(**env_overrides)

    if "startup_nodes" in redis_kwargs:
        return init_redis_cluster(redis_kwargs)

    if "url" in redis_kwargs and redis_kwargs["url"] is not None:
-        args = _get_redis_url_kwargs()
-        url_kwargs = {}
+        args: Final = _get_redis_url_kwargs()
+        url_kwargs: Final = {}
        for arg in redis_kwargs:
            if arg in args:
                url_kwargs[arg] = redis_kwargs[arg]
@ -593,13 +592,13 @@ def get_redis_async_client(
    connection_pool: async_redis.BlockingConnectionPool | None = None,
    **env_overrides,
 ) -> async_redis.Redis | async_redis.RedisCluster:
-    redis_kwargs = _get_redis_client_logic(**env_overrides)
+    redis_kwargs: Final = _get_redis_client_logic(**env_overrides)

    if "startup_nodes" in redis_kwargs:
        from redis.cluster import ClusterNode

        args = _get_redis_cluster_kwargs()
-        cluster_kwargs = {}
+        cluster_kwargs: Final = {}
        for arg in redis_kwargs:
            if arg in args:
                cluster_kwargs[arg] = redis_kwargs[arg]
@ -621,7 +620,7 @@ def get_redis_async_client(
                username=os.environ.get("REDIS_USERNAME") or None,
            )

-        new_startup_nodes: list[ClusterNode] = []
+        new_startup_nodes: Final[list[ClusterNode]] = []

        for item in redis_kwargs["startup_nodes"]:
            new_startup_nodes.append(ClusterNode(**item))
@ -635,9 +634,9 @@ def get_redis_async_client(
        cluster_kwargs.setdefault("socket_keepalive", True)

        # Create async RedisCluster with IAM token as password if available
-        cluster_client = async_redis.RedisCluster(
+        cluster_client: Final = async_redis.RedisCluster(
            startup_nodes=new_startup_nodes,
-            **cluster_kwargs,  # type: ignore
+            **cluster_kwargs,
        )

        return cluster_client
@ -646,12 +645,14 @@ def get_redis_async_client(
        if connection_pool is not None:
            return async_redis.Redis(connection_pool=connection_pool)
        args = _get_redis_url_kwargs(client=async_redis.Redis)
-        url_kwargs = {}
+        url_kwargs: Final = {}
        for arg in redis_kwargs:
            if arg in args:
                url_kwargs[arg] = redis_kwargs[arg]
            else:
-                verbose_logger.debug(f"REDIS: ignoring argument: {arg}. Not an allowed async_redis.Redis.from_url arg.")
+                verbose_logger.debug(
+                    "REDIS: ignoring argument: %s. Not an allowed async_redis.Redis.from_url arg.", arg
+                )
        return async_redis.Redis.from_url(**url_kwargs)

    # Check for Redis Sentinel
@ -684,15 +685,15 @@ def get_redis_async_client(
 def get_redis_connection_pool(
    **env_overrides,
 ) -> async_redis.BlockingConnectionPool | None:
-    redis_kwargs = _get_redis_client_logic(**env_overrides)
+    redis_kwargs: Final = _get_redis_client_logic(**env_overrides)
    verbose_logger.debug("get_redis_connection_pool: redis_kwargs", redis_kwargs)

    if "startup_nodes" in redis_kwargs:
        return None

    if "url" in redis_kwargs and redis_kwargs["url"] is not None:
-        allowed_args = _get_redis_url_kwargs(client=async_redis.Redis)
-        pool_kwargs = {k: v for k, v in redis_kwargs.items() if k in allowed_args and k != "max_connections"}
+        allowed_args: Final = _get_redis_url_kwargs(client=async_redis.Redis)
+        pool_kwargs: Final = {k: v for k, v in redis_kwargs.items() if k in allowed_args and k != "max_connections"}
        pool_kwargs["timeout"] = REDIS_CONNECTION_POOL_TIMEOUT
        pool_kwargs["url"] = redis_kwargs["url"]
        if "max_connections" in redis_kwargs:
@ -708,7 +709,7 @@ def get_redis_connection_pool(
    # Wrap GCP / Azure AD auth in a CredentialProvider so pool-managed
    # connections re-fetch tokens via the SDK's internal cache + silent refresh
    # rather than reusing a single token captured at pool creation.
-    redis_connect_func = redis_kwargs.pop("redis_connect_func", None)
+    redis_connect_func: Final = redis_kwargs.pop("redis_connect_func", None)
    if redis_connect_func and hasattr(redis_connect_func, "_azure_credential"):
        redis_kwargs["credential_provider"] = AzureADCredentialProvider(
            redis_connect_func._azure_credential,
@ -735,7 +736,7 @@ def _pretty_print_redis_config(redis_kwargs: dict) -> None:
        if not verbose_logger.isEnabledFor(logging.DEBUG):
            return

-        console = Console()
+        console: Final = Console()

        # Initialize the sensitive data masker
        masker = SensitiveDataMasker()
@ -744,10 +745,10 @@ def _pretty_print_redis_config(redis_kwargs: dict) -> None:
        masked_redis_kwargs = masker.mask_dict(redis_kwargs)

        # Create main panel title
-        title = Text("Redis Configuration", style="bold blue")
+        title: Final = Text("Redis Configuration", style="bold blue")

        # Create configuration table
-        config_table = Table(
+        config_table: Final = Table(
            title="🔧 Redis Connection Parameters",
            show_header=True,
            header_style="bold magenta",
@ -784,7 +785,7 @@ def _pretty_print_redis_config(redis_kwargs: dict) -> None:
            connection_type = "Redis (URL-based)"

        # Create connection type info
-        info_table = Table(
+        info_table: Final = Table(
            title="📊 Connection Info",
            show_header=True,
            header_style="bold green",
@ -805,6 +806,6 @@ def _pretty_print_redis_config(redis_kwargs: dict) -> None:
        # Fallback to simple logging if rich is not available
        masker = SensitiveDataMasker()
        masked_redis_kwargs = masker.mask_dict(redis_kwargs)
-        verbose_logger.info(f"Redis configuration: {masked_redis_kwargs}")
+        verbose_logger.info("Redis configuration: %s", masked_redis_kwargs)
    except Exception as e:
-        verbose_logger.error(f"Error pretty printing Redis configuration: {e}")
+        verbose_logger.error("Error pretty printing Redis configuration: %s", e)
--- a/litellm/_redis_credential_provider.py
+++ b/litellm/_redis_credential_provider.py
@ -1,21 +1,21 @@
 import asyncio
 import threading
 import time
-from typing import Any
+from typing import Any, Final

-from redis.credentials import CredentialProvider  # type: ignore[attr-defined]
+from redis.credentials import CredentialProvider

 # Azure AD scope for Redis Cache for Azure.
-AZURE_REDIS_SCOPE = "https://redis.azure.com/.default"
+AZURE_REDIS_SCOPE: Final = "https://redis.azure.com/.default"

 # GCP IAM tokens are valid for 1 hour. Cache for 55 minutes to refresh before expiry.
-_GCP_IAM_TOKEN_TTL_SECONDS = 3300
+_GCP_IAM_TOKEN_TTL_SECONDS: Final = 3300

 # Module-level cache shared across all GCPIAMCredentialProvider instances for the
 # same service account, so multiple Redis connections on the same pod share one token.
 # Keyed by service_account → (token, expiry_monotonic_timestamp).
-_token_cache: dict[str, tuple[str, float]] = {}
-_token_cache_lock = threading.Lock()
+_token_cache: Final[dict[str, tuple[str, float]]] = {}
+_token_cache_lock: Final = threading.Lock()


 def _generate_gcp_iam_access_token(service_account: str) -> str:
@ -36,12 +36,12 @@ def _generate_gcp_iam_access_token(service_account: str) -> str:
            "Install it with: pip install google-cloud-iam"
        )

-    client = iam_credentials_v1.IAMCredentialsClient()
-    request = iam_credentials_v1.GenerateAccessTokenRequest(
+    client: Final = iam_credentials_v1.IAMCredentialsClient()
+    request: Final = iam_credentials_v1.GenerateAccessTokenRequest(
        name=service_account,
        scope=["https://www.googleapis.com/auth/cloud-platform"],
    )
-    response = client.generate_access_token(request=request)
+    response: Final = client.generate_access_token(request=request)
    return str(response.access_token)


@ -96,11 +96,11 @@ class GCPIAMCredentialProvider(CredentialProvider):
        self._gcp_service_account = gcp_service_account

    def get_credentials(self) -> tuple[str]:
-        token = _get_cached_gcp_iam_token(self._gcp_service_account)
+        token: Final = _get_cached_gcp_iam_token(self._gcp_service_account)
        return (token,)

    async def get_credentials_async(self) -> tuple[str]:
-        token = await asyncio.to_thread(_get_cached_gcp_iam_token, self._gcp_service_account)
+        token: Final = await asyncio.to_thread(_get_cached_gcp_iam_token, self._gcp_service_account)
        return (token,)


@ -120,13 +120,13 @@ class AzureADCredentialProvider(CredentialProvider):
        self._username = username

    def get_credentials(self) -> tuple[str] | tuple[str, str]:
-        token = self._credential.get_token(AZURE_REDIS_SCOPE).token
+        token: Final = self._credential.get_token(AZURE_REDIS_SCOPE).token
        if self._username:
            return (self._username, token)
        return (token,)

    async def get_credentials_async(self) -> tuple[str] | tuple[str, str]:
-        token_obj = await asyncio.to_thread(self._credential.get_token, AZURE_REDIS_SCOPE)
+        token_obj: Final = await asyncio.to_thread(self._credential.get_token, AZURE_REDIS_SCOPE)
        if self._username:
            return (self._username, token_obj.token)
        return (token_obj.token,)
--- a/litellm/_service_logger.py
+++ b/litellm/_service_logger.py
@ -1,6 +1,6 @@
 import asyncio
 from datetime import datetime, timedelta
-from typing import TYPE_CHECKING, Any, Union
+from typing import TYPE_CHECKING, Any, Final

 import litellm
 from litellm._logging import verbose_logger
@ -16,7 +16,7 @@ if TYPE_CHECKING:

    from litellm.proxy._types import UserAPIKeyAuth

-    Span = Union[_Span, Any]
+    Span = _Span | Any
    OTELClass = OpenTelemetry
 else:
    Span = Any
@ -67,7 +67,7 @@ class ServiceLogging(CustomLogger):
        whether the callback is the logger instance itself or the ``"otel"`` string
        (which routes to the proxy's registered ``open_telemetry_logger``).
        """
-        otel_v2_cls = _get_otel_v2_class()
+        otel_v2_cls: Final = _get_otel_v2_class()

        def _is_otel_logger(obj: Any) -> bool:
            if isinstance(obj, OpenTelemetry):
@ -101,7 +101,7 @@ class ServiceLogging(CustomLogger):

        try:
            # Try to get the current event loop
-            loop = asyncio.get_event_loop()
+            loop: Final = asyncio.get_event_loop()
            # Check if the loop is running
            if loop.is_running():
                # If we're in a running loop, create a task
@ -163,7 +163,7 @@ class ServiceLogging(CustomLogger):
        if self.mock_testing:
            self.mock_testing_async_success_hook += 1

-        payload = ServiceLoggerPayload(
+        payload: Final = ServiceLoggerPayload(
            is_error=False,
            error=None,
            service=service,
@ -178,7 +178,7 @@ class ServiceLogging(CustomLogger):
        # (the V2 logger self-registers its instance even when the string is
        # present, unlike V1). Without this guard each such reference emits its own
        # span, so a single DB call shows up as duplicate ``postgres ...`` spans.
-        emitted_otel_logger_ids: set = set()
+        emitted_otel_logger_ids: Final[set] = set()
        for callback in litellm.service_callback:
            if callback == "prometheus_system":
                await self.init_prometheus_services_logger_if_none()
@ -267,7 +267,7 @@ class ServiceLogging(CustomLogger):
        elif isinstance(error, str):
            error_message = error

-        payload = ServiceLoggerPayload(
+        payload: Final = ServiceLoggerPayload(
            is_error=True,
            error=error_message,
            service=service,
@ -278,7 +278,7 @@ class ServiceLogging(CustomLogger):

        # Dedupe OTel loggers per event — see ``async_service_success_hook`` for why
        # the same logger can be referenced twice in ``service_callback``.
-        emitted_otel_logger_ids: set = set()
+        emitted_otel_logger_ids: Final[set] = set()
        for callback in litellm.service_callback:
            if callback == "prometheus_system":
                await self.init_prometheus_services_logger_if_none()
--- a/litellm/_uuid.py
+++ b/litellm/_uuid.py
@ -4,7 +4,7 @@ Internal unified UUID helper.
 Always uses fastuuid for performance.
 """

-import fastuuid as _uuid  # type: ignore
+import fastuuid as _uuid

 # Expose a module-like alias so callers can use: uuid.uuid4()
 uuid = _uuid
--- a/litellm/a2a_protocol/init.py
+++ b/litellm/a2a_protocol/init.py
@ -55,19 +55,15 @@ from litellm.a2a_protocol.main import (
 from litellm.types.agents import LiteLLMSendMessageResponse

 __all__ = [
-    # Client
-    "A2AClient",
-    # Functions
-    "asend_message",
-    "send_message",
-    "asend_message_streaming",
-    "aget_agent_card",
-    "create_a2a_client",
-    # Response types
-    "LiteLLMSendMessageResponse",
-    # Exceptions
-    "A2AError",
-    "A2AConnectionError",
    "A2AAgentCardError",
+    "A2AClient",
+    "A2AConnectionError",
+    "A2AError",
    "A2ALocalhostURLError",
+    "LiteLLMSendMessageResponse",
+    "aget_agent_card",
+    "asend_message",
+    "asend_message_streaming",
+    "create_a2a_client",
+    "send_message",
 ]
--- a/litellm/a2a_protocol/card_resolver.py
+++ b/litellm/a2a_protocol/card_resolver.py
@ -4,7 +4,7 @@ Custom A2A Card Resolver for LiteLLM.
 Extends the A2A SDK's card resolver to support multiple well-known paths.
 """

-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Final

 from litellm._logging import verbose_logger
 from litellm.constants import LOCALHOST_URL_PATTERNS
@ -18,8 +18,8 @@ AGENT_CARD_WELL_KNOWN_PATH: str = "/.well-known/agent-card.json"
 PREV_AGENT_CARD_WELL_KNOWN_PATH: str = "/.well-known/agent.json"

 try:
-    from a2a.client import A2ACardResolver as _A2ACardResolver  # type: ignore[no-redef]
-    from a2a.utils.constants import (  # type: ignore[no-redef]
+    from a2a.client import A2ACardResolver as _A2ACardResolver
+    from a2a.utils.constants import (
        AGENT_CARD_WELL_KNOWN_PATH,
        PREV_AGENT_CARD_WELL_KNOWN_PATH,
    )
@ -43,18 +43,18 @@ def is_localhost_or_internal_url(url: str | None) -> bool:
    if not url:
        return False

-    url_lower = url.lower()
+    url_lower: Final = url.lower()

    return any(pattern in url_lower for pattern in LOCALHOST_URL_PATTERNS)


 def get_agent_card_url(agent_card: "AgentCard") -> str | None:
    """Return the agent endpoint URL from the resolved SDK card."""
-    url = getattr(agent_card, "url", None)
+    url: Final = getattr(agent_card, "url", None)
    if url:
        return url

-    interfaces = getattr(agent_card, "supported_interfaces", None)
+    interfaces: Final = getattr(agent_card, "supported_interfaces", None)
    if interfaces:
        return getattr(interfaces[0], "url", None)
    return None
@ -62,11 +62,11 @@ def get_agent_card_url(agent_card: "AgentCard") -> str | None:

 def set_agent_card_url(agent_card: "AgentCard", url: str) -> None:
    """Set the agent endpoint URL on the resolved SDK card."""
-    normalized = url.rstrip("/") + "/"
+    normalized: Final = url.rstrip("/") + "/"
    if hasattr(agent_card, "url"):
        agent_card.url = normalized

-    interfaces = getattr(agent_card, "supported_interfaces", None)
+    interfaces: Final = getattr(agent_card, "supported_interfaces", None)
    if interfaces:
        interfaces[0].url = normalized

@ -86,23 +86,23 @@ def fix_agent_card_url(agent_card: "AgentCard", base_url: str) -> "AgentCard":
    Returns:
        The agent card with the URL fixed if necessary
    """
-    card_url = getattr(agent_card, "url", None)
+    card_url: Final = getattr(agent_card, "url", None)

    if card_url and is_localhost_or_internal_url(card_url):
        # Normalize base_url to ensure it ends with /
-        fixed_url = base_url.rstrip("/") + "/"
+        fixed_url: Final = base_url.rstrip("/") + "/"
        agent_card.url = fixed_url

-    interfaces = getattr(agent_card, "supported_interfaces", None)
+    interfaces: Final = getattr(agent_card, "supported_interfaces", None)
    if interfaces:
-        interface_url = getattr(interfaces[0], "url", None)
+        interface_url: Final = getattr(interfaces[0], "url", None)
        if interface_url and is_localhost_or_internal_url(interface_url):
            interfaces[0].url = base_url.rstrip("/") + "/"

    return agent_card


-class LiteLLMA2ACardResolver(_A2ACardResolver):  # type: ignore[misc]
+class LiteLLMA2ACardResolver(_A2ACardResolver):
    """
    Custom A2A card resolver that supports multiple well-known paths.

@ -140,7 +140,7 @@ class LiteLLMA2ACardResolver(_A2ACardResolver):  # type: ignore[misc]
            )

        # Try both well-known paths
-        paths = [
+        paths: Final = [
            AGENT_CARD_WELL_KNOWN_PATH,
            PREV_AGENT_CARD_WELL_KNOWN_PATH,
        ]
@ -148,13 +148,13 @@ class LiteLLMA2ACardResolver(_A2ACardResolver):  # type: ignore[misc]
        last_error = None
        for path in paths:
            try:
-                verbose_logger.debug(f"Attempting to fetch agent card from {self.base_url}{path}")
+                verbose_logger.debug("Attempting to fetch agent card from %s%s", self.base_url, path)
                return await super().get_agent_card(
                    relative_card_path=path,
                    http_kwargs=http_kwargs,
                )
            except Exception as e:
-                verbose_logger.debug(f"Failed to fetch agent card from {self.base_url}{path}: {e}")
+                verbose_logger.debug("Failed to fetch agent card from %s%s: %s", self.base_url, path, e)
                last_error = e
                continue

--- a/litellm/a2a_protocol/client.py
+++ b/litellm/a2a_protocol/client.py
@ -5,7 +5,7 @@ Provides a class-based interface for A2A agent invocation.
 """

 from collections.abc import AsyncIterator
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Final

 from litellm.types.agents import LiteLLMSendMessageResponse

@ -92,7 +92,7 @@ class A2AClient:
        """Send a message to the A2A agent."""
        from litellm.a2a_protocol.main import asend_message

-        a2a_client = await self._get_client()
+        a2a_client: Final = await self._get_client()
        return await asend_message(a2a_client=a2a_client, request=request)

    async def send_message_streaming(
@ -101,6 +101,6 @@ class A2AClient:
        """Send a streaming message to the A2A agent."""
        from litellm.a2a_protocol.main import asend_message_streaming

-        a2a_client = await self._get_client()
+        a2a_client: Final = await self._get_client()
        async for chunk in asend_message_streaming(a2a_client=a2a_client, request=request):
            yield chunk
--- a/litellm/a2a_protocol/cost_calculator.py
+++ b/litellm/a2a_protocol/cost_calculator.py
@ -5,7 +5,7 @@ Supports dynamic cost parameters that allow platform owners
 to define custom costs per agent query or per token.
 """

-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Final

 if TYPE_CHECKING:
    from litellm.litellm_core_utils.litellm_logging import (
@ -42,23 +42,23 @@ class A2ACostCalculator:
        if litellm_logging_obj is None:
            return 0.0

-        model_call_details = litellm_logging_obj.model_call_details
+        model_call_details: Final = litellm_logging_obj.model_call_details

        # Check if user set a custom response cost (backward compatibility)
-        response_cost = model_call_details.get("response_cost", None)
+        response_cost: Final = model_call_details.get("response_cost", None)
        if response_cost is not None:
            return float(response_cost)

        # Get litellm_params for cost parameters
-        litellm_params = model_call_details.get("litellm_params", {}) or {}
+        litellm_params: Final = model_call_details.get("litellm_params", {}) or {}

        # Check for cost_per_query (fixed cost per query)
        if litellm_params.get("cost_per_query") is not None:
            return float(litellm_params["cost_per_query"])

        # Check for token-based pricing
-        input_cost_per_token = litellm_params.get("input_cost_per_token")
-        output_cost_per_token = litellm_params.get("output_cost_per_token")
+        input_cost_per_token: Final = litellm_params.get("input_cost_per_token")
+        output_cost_per_token: Final = litellm_params.get("output_cost_per_token")

        if input_cost_per_token is not None or output_cost_per_token is not None:
            return A2ACostCalculator._calculate_token_based_cost(
@ -88,16 +88,16 @@ class A2ACostCalculator:
            float: The calculated cost
        """
        # Get usage from model_call_details
-        usage = model_call_details.get("usage")
+        usage: Final = model_call_details.get("usage")
        if usage is None:
            return 0.0

        # Get token counts
-        prompt_tokens = getattr(usage, "prompt_tokens", 0) or 0
-        completion_tokens = getattr(usage, "completion_tokens", 0) or 0
+        prompt_tokens: Final = getattr(usage, "prompt_tokens", 0) or 0
+        completion_tokens: Final = getattr(usage, "completion_tokens", 0) or 0

        # Calculate costs
-        input_cost = prompt_tokens * (float(input_cost_per_token) if input_cost_per_token else 0.0)
-        output_cost = completion_tokens * (float(output_cost_per_token) if output_cost_per_token else 0.0)
+        input_cost: Final = prompt_tokens * (float(input_cost_per_token) if input_cost_per_token else 0.0)
+        output_cost: Final = completion_tokens * (float(output_cost_per_token) if output_cost_per_token else 0.0)

        return input_cost + output_cost
--- a/litellm/a2a_protocol/exception_mapping_utils.py
+++ b/litellm/a2a_protocol/exception_mapping_utils.py
@ -4,7 +4,7 @@ A2A Protocol Exception Mapping Utils.
 Maps A2A SDK exceptions to LiteLLM A2A exception types.
 """

-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Final

 from litellm._logging import verbose_logger
 from litellm.a2a_protocol.card_resolver import (
@ -29,9 +29,9 @@ try:
    A2A_SDK_AVAILABLE = True
 except ImportError:
    A2A_SDK_AVAILABLE = False
-    Client = None  # type: ignore[misc, assignment]
-    ClientConfig = None  # type: ignore[misc, assignment]
-    create_client = None  # type: ignore[misc, assignment]
+    Client = None
+    ClientConfig = None
+    create_client = None


 class A2AExceptionCheckers:
@ -53,7 +53,7 @@ class A2AExceptionCheckers:
        if not isinstance(error_str, str):
            return False

-        error_str_lower = error_str.lower()
+        error_str_lower: Final = error_str.lower()
        return any(pattern in error_str_lower for pattern in CONNECTION_ERROR_PATTERNS)

    @staticmethod
@ -83,8 +83,8 @@ class A2AExceptionCheckers:
        if not isinstance(error_str, str):
            return False

-        error_str_lower = error_str.lower()
-        agent_card_patterns = [
+        error_str_lower: Final = error_str.lower()
+        agent_card_patterns: Final = [
            "agent card",
            "agent-card",
            ".well-known",
@ -118,7 +118,7 @@ def map_a2a_exception(
        A2AAgentCardError: If the error is related to agent card issues
        A2AError: For other A2A-related errors
    """
-    error_str = str(original_exception)
+    error_str: Final = str(original_exception)

    # Check for localhost URL connection error (special case - retryable)
    if (
@ -190,33 +190,38 @@ async def handle_a2a_localhost_retry(
            "rewrite, so the upstream URL cannot be corrected."
        )

-    request_type = "streaming " if is_streaming else ""
+    request_type: Final = "streaming " if is_streaming else ""
    verbose_logger.warning(
-        f"A2A {request_type}request to '{error.localhost_url}' failed: {error.original_error}. "
-        f"Agent card contains localhost/internal URL. "
-        f"Retrying with base_url '{error.base_url}'."
+        "A2A %srequest to '%s' failed: %s. Agent card contains localhost/internal URL. Retrying with base_url '%s'.",
+        request_type,
+        error.localhost_url,
+        error.original_error,
+        error.base_url,
    )

    # Fix the agent card URL
    set_agent_card_url(agent_card, error.base_url)

-    # Reuse the httpx client LiteLLM attached at creation. It carries this agent's
-    # trace-id and auth headers, so a fresh client would drop them. Only clients built
-    # by ``create_a2a_client`` have it; an externally-supplied client cannot be retried.
-    httpx_client = getattr(a2a_client, "_litellm_httpx_client", None)
+    # Reuse the httpx client and call context LiteLLM attached at creation, since the
+    # context carries this agent's trace-id/auth headers. Only clients built by
+    # ``create_a2a_client`` have them; an externally-supplied client cannot be retried.
+    httpx_client: Final = getattr(a2a_client, "_litellm_httpx_client", None)
    if httpx_client is None:
        raise RuntimeError(
            "Cannot retry A2A localhost URL fix: the client was not created by "
            "create_a2a_client, so no LiteLLM httpx client is attached."
        )

-    new_client = await create_client(  # pyright: ignore[reportOptionalCall]
+    new_client: Final = await create_client(  # pyright: ignore[reportOptionalCall]
        agent_card,
        client_config=ClientConfig(  # pyright: ignore[reportOptionalCall]
            httpx_client=httpx_client,
            streaming=is_streaming,
        ),
    )
-    new_client._litellm_httpx_client = httpx_client  # type: ignore[attr-defined]
-    new_client._litellm_agent_card = agent_card  # type: ignore[attr-defined]
+    new_client._litellm_httpx_client = httpx_client
+    new_client._litellm_call_context = getattr(  # pyright: ignore[reportAttributeAccessIssue]  # LiteLLM-owned stash
+        a2a_client, "_litellm_call_context", None
+    )
+    new_client._litellm_agent_card = agent_card
    return new_client
--- a/litellm/a2a_protocol/litellm_completion_bridge/handler.py
+++ b/litellm/a2a_protocol/litellm_completion_bridge/handler.py
@ -10,8 +10,8 @@ A2A Streaming Events (in order):
 4. Status update (kind: "status-update") - Final status "completed" with final=true
 """

-from collections.abc import AsyncIterator
-from typing import Any
+from collections.abc import AsyncIterator, Mapping
+from typing import Any, Final

 import litellm
 from litellm._logging import verbose_logger
@ -21,14 +21,16 @@ from litellm.a2a_protocol.litellm_completion_bridge.transformation import (
 )
 from litellm.a2a_protocol.providers.config_manager import A2AProviderConfigManager
 from litellm.interactions.agents.utils import merge_agent_headers
+from litellm.litellm_core_utils.streaming_handler import CustomStreamWrapper
+from litellm.types.utils import ModelResponse

 # litellm_params key carrying the authenticated principal (hashed virtual key) so
 # A2A provider configs can scope provider-side state (e.g. LangFlow session memory)
 # per key instead of trusting the client-supplied A2A contextId.
-A2A_USER_API_KEY_HASH_PARAM = "litellm_a2a_user_api_key_hash"
+A2A_USER_API_KEY_HASH_PARAM: Final = "litellm_a2a_user_api_key_hash"

 # Agent metadata fields stored in litellm_params that are not valid litellm.acompletion() kwargs
-_AGENT_ONLY_PARAMS = frozenset(
+_AGENT_ONLY_PARAMS: Final = frozenset(
    {
        "is_public",
        "agent_name",
@ -45,56 +47,23 @@ class A2ACompletionBridgeHandler:
    """

    @staticmethod
-    async def handle_non_streaming(
-        request_id: str,
+    def _build_completion_params(
        params: dict[str, Any],
-        litellm_params: dict[str, Any],
-        api_base: str | None = None,
-        agent_extra_headers: dict[str, str] | None = None,
+        litellm_params: Mapping[str, Any],
+        api_base: str | None,
+        agent_extra_headers: Mapping[str, str] | None,
        *,
-        _skip_a2a_provider_routing: bool = False,
-    ) -> dict[str, Any]:
-        """
-        Handle non-streaming A2A request via litellm.acompletion.
-
-        Args:
-            request_id: A2A JSON-RPC request ID
-            params: A2A MessageSendParams containing the message
-            litellm_params: Agent's litellm_params (custom_llm_provider, model, etc.)
-            api_base: API base URL from agent_card_params
-            agent_extra_headers: Per-request headers (from x-a2a-{agent}-* rewrite and
-                admin extra_headers) to forward on the upstream HTTP call.
-
-        Returns:
-            A2A SendMessageResponse dict
-        """
-        custom_llm_provider = litellm_params.get("custom_llm_provider")
-        if not _skip_a2a_provider_routing:
-            a2a_provider_config = A2AProviderConfigManager.get_provider_config(
-                custom_llm_provider=custom_llm_provider,
-                model=litellm_params.get("model"),
-            )
-
-            if a2a_provider_config is not None:
-                verbose_logger.info(f"A2A: Using provider config for {custom_llm_provider}")
-
-                return await a2a_provider_config.handle_non_streaming(
-                    request_id=request_id,
-                    params=params,
-                    api_base=api_base,
-                    litellm_params=litellm_params,
-                    agent_extra_headers=agent_extra_headers,
-                )
-
+        stream: bool,
+    ) -> Mapping[str, Any]:
        # Extract message from params
-        message = params.get("message", {})
+        message: Final = params.get("message", {})

        # Transform A2A message to OpenAI format
-        openai_messages = A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(message)
+        openai_messages: Final = A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(message)

        # Get completion params
-        custom_llm_provider = litellm_params.get("custom_llm_provider")
-        model = litellm_params.get("model", "agent")
+        custom_llm_provider: Final = litellm_params.get("custom_llm_provider")
+        model: Final = litellm_params.get("model", "agent")

        # Build full model string if provider specified
        # Skip prepending if model already starts with the provider prefix
@ -103,17 +72,20 @@ class A2ACompletionBridgeHandler:
        else:
            full_model = model

-        verbose_logger.info(f"A2A completion bridge: model={full_model}, api_base={api_base}")
+        if stream:
+            verbose_logger.info("A2A completion bridge streaming: model=%s, api_base=%s", full_model, api_base)
+        else:
+            verbose_logger.info("A2A completion bridge: model=%s, api_base=%s", full_model, api_base)

        # Build completion params dict
-        completion_params: dict[str, Any] = {
+        completion_params: Final[dict[str, Any]] = {
            "model": full_model,
            "messages": openai_messages,
            "api_base": api_base,
-            "stream": False,
+            "stream": stream,
        }
        # Add litellm_params (contains api_key, client_id, client_secret, tenant_id, etc.)
-        litellm_params_to_add = {
+        litellm_params_to_add: Final = {
            k: v
            for k, v in litellm_params.items()
            if k not in ("model", "custom_llm_provider") and k not in _AGENT_ONLY_PARAMS
@ -134,16 +106,72 @@ class A2ACompletionBridgeHandler:
                static_headers=completion_params.get("extra_headers"),
            )

+        return completion_params
+
+    @staticmethod
+    async def _acompletion(completion_params: Mapping[str, Any]) -> ModelResponse | CustomStreamWrapper:
+        return await litellm.acompletion(**completion_params)
+
+    @staticmethod
+    async def handle_non_streaming(
+        request_id: str,
+        params: dict[str, Any],
+        litellm_params: dict[str, Any],
+        api_base: str | None = None,
+        agent_extra_headers: dict[str, str] | None = None,
+        *,
+        _skip_a2a_provider_routing: bool = False,
+    ) -> dict[str, object]:
+        """
+        Handle non-streaming A2A request via litellm.acompletion.
+
+        Args:
+            request_id: A2A JSON-RPC request ID
+            params: A2A MessageSendParams containing the message
+            litellm_params: Agent's litellm_params (custom_llm_provider, model, etc.)
+            api_base: API base URL from agent_card_params
+            agent_extra_headers: Per-request headers (from x-a2a-{agent}-* rewrite and
+                admin extra_headers) to forward on the upstream HTTP call.
+
+        Returns:
+            A2A SendMessageResponse dict
+        """
+        custom_llm_provider: Final = litellm_params.get("custom_llm_provider")
+        if not _skip_a2a_provider_routing:
+            a2a_provider_config: Final = A2AProviderConfigManager.get_provider_config(
+                custom_llm_provider=custom_llm_provider,
+                model=litellm_params.get("model"),
+            )
+
+            if a2a_provider_config is not None:
+                verbose_logger.info("A2A: Using provider config for %s", custom_llm_provider)
+
+                return await a2a_provider_config.handle_non_streaming(
+                    request_id=request_id,
+                    params=params,
+                    api_base=api_base,
+                    litellm_params=litellm_params,
+                    agent_extra_headers=agent_extra_headers,
+                )
+
+        completion_params: Final = A2ACompletionBridgeHandler._build_completion_params(
+            params=params,
+            litellm_params=litellm_params,
+            api_base=api_base,
+            agent_extra_headers=agent_extra_headers,
+            stream=False,
+        )
+
        # Call litellm.acompletion
-        response = await litellm.acompletion(**completion_params)
+        response: Final = await A2ACompletionBridgeHandler._acompletion(completion_params)

        # Transform response to A2A format
-        a2a_response = A2ACompletionBridgeTransformation.openai_response_to_a2a_response(
+        a2a_response: Final = A2ACompletionBridgeTransformation.openai_response_to_a2a_response(
            response=response,
            request_id=request_id,
        )

-        verbose_logger.info(f"A2A completion bridge completed: request_id={request_id}")
+        verbose_logger.info("A2A completion bridge completed: request_id=%s", request_id)

        return a2a_response

@ -156,7 +184,7 @@ class A2ACompletionBridgeHandler:
        agent_extra_headers: dict[str, str] | None = None,
        *,
        _skip_a2a_provider_routing: bool = False,
-    ) -> AsyncIterator[dict[str, Any]]:
+    ) -> AsyncIterator[dict[str, object]]:
        """
        Handle streaming A2A request via litellm.acompletion with stream=True.

@ -177,15 +205,15 @@ class A2ACompletionBridgeHandler:
        Yields:
            A2A streaming response events
        """
-        custom_llm_provider = litellm_params.get("custom_llm_provider")
+        custom_llm_provider: Final = litellm_params.get("custom_llm_provider")
        if not _skip_a2a_provider_routing:
-            a2a_provider_config = A2AProviderConfigManager.get_provider_config(
+            a2a_provider_config: Final = A2AProviderConfigManager.get_provider_config(
                custom_llm_provider=custom_llm_provider,
                model=litellm_params.get("model"),
            )

            if a2a_provider_config is not None:
-                verbose_logger.info(f"A2A: Using provider config for {custom_llm_provider} (streaming)")
+                verbose_logger.info("A2A: Using provider config for %s (streaming)", custom_llm_provider)

                async for chunk in a2a_provider_config.handle_streaming(
                    request_id=request_id,
@ -198,66 +226,26 @@ class A2ACompletionBridgeHandler:

                return

-        # Extract message from params
-        message = params.get("message", {})
-
        # Create streaming context
-        ctx = A2AStreamingContext(
+        ctx: Final = A2AStreamingContext(
            request_id=request_id,
-            input_message=message,
+            input_message=params.get("message", {}),
        )

-        # Transform A2A message to OpenAI format
-        openai_messages = A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(message)
-
-        # Get completion params
-        custom_llm_provider = litellm_params.get("custom_llm_provider")
-        model = litellm_params.get("model", "agent")
-
-        # Build full model string if provider specified
-        # Skip prepending if model already starts with the provider prefix
-        if custom_llm_provider and not model.startswith(f"{custom_llm_provider}/"):
-            full_model = f"{custom_llm_provider}/{model}"
-        else:
-            full_model = model
-
-        verbose_logger.info(f"A2A completion bridge streaming: model={full_model}, api_base={api_base}")
-
-        # Build completion params dict
-        completion_params: dict[str, Any] = {
-            "model": full_model,
-            "messages": openai_messages,
-            "api_base": api_base,
-            "stream": True,
-        }
-        # Add litellm_params (contains api_key, client_id, client_secret, tenant_id, etc.)
-        litellm_params_to_add = {
-            k: v
-            for k, v in litellm_params.items()
-            if k not in ("model", "custom_llm_provider") and k not in _AGENT_ONLY_PARAMS
-        }
-        completion_params.update(litellm_params_to_add)
-        # Apply forward metadata AFTER the litellm_params merge so the helper
-        # sees any agent-owner-configured ``extra_body.metadata`` and can keep
-        # those keys authoritative over the client-supplied A2A metadata.
-        A2ACompletionBridgeTransformation.apply_forward_metadata_to_completion_params(
-            completion_params=completion_params,
-            a2a_message=message,
+        completion_params: Final = A2ACompletionBridgeHandler._build_completion_params(
            params=params,
+            litellm_params=litellm_params,
+            api_base=api_base,
+            agent_extra_headers=agent_extra_headers,
+            stream=True,
        )

-        if agent_extra_headers:
-            completion_params["extra_headers"] = merge_agent_headers(
-                dynamic_headers=agent_extra_headers,
-                static_headers=completion_params.get("extra_headers"),
-            )
-
        # 1. Emit initial task event (kind: "task", status: "submitted")
-        task_event = A2ACompletionBridgeTransformation.create_task_event(ctx)
+        task_event: Final = A2ACompletionBridgeTransformation.create_task_event(ctx)
        yield task_event

        # 2. Emit status update (kind: "status-update", status: "working")
-        working_event = A2ACompletionBridgeTransformation.create_status_update_event(
+        working_event: Final = A2ACompletionBridgeTransformation.create_status_update_event(
            ctx=ctx,
            state="working",
            final=False,
@ -266,12 +254,12 @@ class A2ACompletionBridgeHandler:
        yield working_event

        # Call litellm.acompletion with streaming
-        response = await litellm.acompletion(**completion_params)
+        response: Final = await A2ACompletionBridgeHandler._acompletion(completion_params)

        # 3. Accumulate content and emit artifact update
        accumulated_text = ""
        chunk_count = 0
-        async for chunk in response:  # type: ignore[union-attr]
+        async for chunk in response:
            chunk_count += 1

            # Extract delta content
@ -286,21 +274,23 @@ class A2ACompletionBridgeHandler:

        # Emit artifact update with accumulated content
        if accumulated_text:
-            artifact_event = A2ACompletionBridgeTransformation.create_artifact_update_event(
+            artifact_event: Final = A2ACompletionBridgeTransformation.create_artifact_update_event(
                ctx=ctx,
                text=accumulated_text,
            )
            yield artifact_event

        # 4. Emit final status update (kind: "status-update", status: "completed", final: true)
-        completed_event = A2ACompletionBridgeTransformation.create_status_update_event(
+        completed_event: Final = A2ACompletionBridgeTransformation.create_status_update_event(
            ctx=ctx,
            state="completed",
            final=True,
        )
        yield completed_event

-        verbose_logger.info(f"A2A completion bridge streaming completed: request_id={request_id}, chunks={chunk_count}")
+        verbose_logger.info(
+            "A2A completion bridge streaming completed: request_id=%s, chunks=%s", request_id, chunk_count
+        )


 # Convenience functions that delegate to the class methods
@ -310,7 +300,7 @@ async def handle_a2a_completion(
    litellm_params: dict[str, Any],
    api_base: str | None = None,
    agent_extra_headers: dict[str, str] | None = None,
-) -> dict[str, Any]:
+) -> dict[str, object]:
    """Convenience function for non-streaming A2A completion."""
    return await A2ACompletionBridgeHandler.handle_non_streaming(
        request_id=request_id,
@ -327,7 +317,7 @@ async def handle_a2a_completion_streaming(
    litellm_params: dict[str, Any],
    api_base: str | None = None,
    agent_extra_headers: dict[str, str] | None = None,
-) -> AsyncIterator[dict[str, Any]]:
+) -> AsyncIterator[dict[str, object]]:
    """Convenience function for streaming A2A completion."""
    async for chunk in A2ACompletionBridgeHandler.handle_streaming(
        request_id=request_id,
--- a/Show more
+++ b/Show more
				`@ -0,0 +1 @@`
				`ALTER TABLE "LiteLLM_AutoRouterSession" ADD COLUMN IF NOT EXISTS "tier_turns" JSONB NOT NULL DEFAULT '{}';`