Merge remote-tracking branch 'origin/main' into litellm_e2e_cost_calculation_scripted_provider

.circleci/config.yml

@@ -257,7 +257,7 @@ commands:
       - install_rust
       - restore_cache:
           keys:
-            - v1-uv-cache-{{ checksum "uv.lock" }}
+            - v3-integration-uv-cache-{{ checksum "uv.lock" }}
       - run:
           name: Install Dependencies
           command: |
@@ -266,7 +266,7 @@ commands:
       - save_cache:
           paths:
             - ~/.cache/uv
-          key: v1-uv-cache-{{ checksum "uv.lock" }}
+          key: v3-integration-uv-cache-{{ checksum "uv.lock" }}
 
 jobs:
   # Add Windows testing job
@@ -2955,6 +2955,32 @@ jobs:
     working_directory: ~/project
     steps:
       - setup_litellm_test_deps
+      - when:
+          condition:
+            equal: [browser, << parameters.suite >>]
+          steps:
+            - install_node
+            - restore_cache:
+                keys:
+                  - integration-ui-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
+            - run:
+                name: Install locked browser dependencies
+                command: |
+                  cd ui/litellm-dashboard
+                  npm ci
+                  cd ../../tests/e2e/ui
+                  npm ci
+                  sudo env PATH="$PATH" DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=l \
+                    timeout --signal=TERM --kill-after=20s 6m node node_modules/@playwright/test/cli.js install-deps chromium
+                  timeout --signal=TERM --kill-after=20s 3m node node_modules/@playwright/test/cli.js install chromium
+            - save_cache:
+                key: integration-ui-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
+                paths:
+                  - ~/.npm
+                  - ~/.cache/ms-playwright
+            - run:
+                name: Build the candidate dashboard
+                command: cd ui/litellm-dashboard && NEXT_TELEMETRY_DISABLED=1 npm run build
       - start_postgres:
           image: postgres:16@sha256:e17e86066e5ef83e0952a9347f5c792b7ece00972e2aa787a6986f471b3dd3d5
       - start_redis
@@ -2983,7 +3009,7 @@ workflows:
           name: integration-<< matrix.suite >>
           matrix:
             parameters:
-              suite: [management, accounting, providers]
+              suite: [management, accounting, database, providers, extensions, sdk, browser]
           filters:
             branches:
               only:

.circleci/scripts/classify_changes.sh

@@ -1,12 +1,14 @@
 #!/usr/bin/env bash
 set -uo pipefail
 
-category="${1:?usage: classify_changes.sh <backend|client|ui|provider-harness>}"
+category="${1:?usage: classify_changes.sh <backend|client|ui|provider-harness|cost-map-only>}"
 
 has_client=false
 has_backend=false
 has_ci=false
 has_provider_harness=false
+has_cost_map=false
+outside_cost_map_set=false
 while IFS= read -r file || [ -n "$file" ]; do
   [ -n "$file" ] || continue
   case "$file" in
@@ -20,9 +22,18 @@ while IFS= read -r file || [ -n "$file" ]; do
     .github/* | .circleci/*) has_ci=true; has_backend=true ;;
     *) has_backend=true ;;
   esac
+  case "$file" in
+    model_prices_and_context_window.json | litellm/model_prices_and_context_window_backup.json | model_prices_and_context_window.schema.json)
+      has_cost_map=true ;;
+    tests/test_litellm/* | tests/proxy_unit_tests/*) : ;;
+    *) outside_cost_map_set=true ;;
+  esac
 done
 
 case "$category" in
+  cost-map-only)
+    { [ "$has_cost_map" = true ] && [ "$outside_cost_map_set" = false ]; } && echo run || echo skip
+    ;;
   provider-harness)
     [ "$has_provider_harness" = true ] && echo run || echo skip
     ;;

.circleci/scripts/run_integration.sh

@@ -1,6 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+if [ "${GITHUB_ACTIONS:-}" = true ]; then
+  echo "Integration contracts are owned by CircleCI" >&2
+  exit 1
+fi
+
 suite="${1:?integration suite required}"
 results="test-results/integration-${suite}"
 mkdir -p "$results"
@@ -65,7 +70,13 @@ export INTEGRATION_PROXY_URL=http://127.0.0.1:4000
 export INTEGRATION_PEER_URL=""
 export INTEGRATION_UPSTREAM_URL=http://127.0.0.1:8190
 export INTEGRATION_MASTER_KEY="$LITELLM_MASTER_KEY"
-export INTEGRATION_SEED="$((16#$(git rev-parse --short=8 HEAD)))"
+export LITELLM_UI_PATH="$PWD/litellm/proxy/_experimental/out"
+if [ "$suite" = browser ]; then
+  export LITELLM_UI_PATH="$PWD/ui/litellm-dashboard/out"
+  test -f "$LITELLM_UI_PATH/index.html"
+fi
+export INTEGRATION_SEED="$(.venv/bin/python -c 'import hashlib,os; print(int(hashlib.sha256((os.environ.get("CIRCLE_SHA1", "local") + os.environ.get("CIRCLE_WORKFLOW_ID", "local")).encode()).hexdigest()[:8],16))')"
+export INTEGRATION_ORDER_SEED="$INTEGRATION_SEED"
 
 uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma > "$results/prisma-generate.log" 2>&1
 
@@ -102,7 +113,7 @@ start_proxy() {
   local log_name="$2"
   setsid env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" INTEGRATION_RUN_ID="$integration_identity" \
     DATABASE_URL="$DATABASE_URL" REDIS_HOST="$REDIS_HOST" REDIS_PORT="$REDIS_PORT" \
-    LITELLM_MASTER_KEY="$LITELLM_MASTER_KEY" LITELLM_SALT_KEY="$LITELLM_SALT_KEY" \
+    LITELLM_MASTER_KEY="$LITELLM_MASTER_KEY" LITELLM_SALT_KEY="$LITELLM_SALT_KEY" LITELLM_UI_PATH="$LITELLM_UI_PATH" PROXY_BASE_URL="http://127.0.0.1:$port" \
     LITELLM_MODE=PRODUCTION LITELLM_LOCAL_MODEL_COST_MAP=True STORE_MODEL_IN_DB=True \
     AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 \
     .venv/bin/python -m integration._support.proxy --config tests/integration/proxy_config.yaml \
@@ -131,6 +142,19 @@ if [ "$suite" = providers ]; then
     --junitxml="$results/replay-controls.xml"
 fi
 
+if [ "$suite" = browser ]; then
+  export E2E_UI_BASE_URL="$INTEGRATION_PROXY_URL" E2E_UI_ARTIFACT_DIR="$PWD/$results"
+  export INTEGRATION_PYTHON="$PWD/.venv/bin/python"
+  timeout --signal=TERM --kill-after=20s 3m env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" \
+    INTEGRATION_RUN_ID="$integration_identity" DATABASE_URL="$DATABASE_URL" \
+    INTEGRATION_UPSTREAM_URL="$INTEGRATION_UPSTREAM_URL" INTEGRATION_PYTHON="$INTEGRATION_PYTHON" \
+    E2E_UI_BASE_URL="$E2E_UI_BASE_URL" E2E_UI_ARTIFACT_DIR="$E2E_UI_ARTIFACT_DIR" \
+    LITELLM_MASTER_KEY="$LITELLM_MASTER_KEY" CI=true \
+    node tests/e2e/ui/node_modules/@playwright/test/cli.js test --config tests/e2e/ui/integration.config.ts
+  .venv/bin/python .circleci/scripts/verify_integration_browser.py "$results/browser-results.json"
+  exit 0
+fi
+
 timeout --signal=TERM --kill-after=20s 11m env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" \
   INTEGRATION_RUN_ID="$integration_identity" \
   DATABASE_URL="$DATABASE_URL" REDIS_HOST="$REDIS_HOST" REDIS_PORT="$REDIS_PORT" \
@@ -138,5 +162,6 @@ timeout --signal=TERM --kill-after=20s 11m env -i PATH="$PATH" HOME="$HOME" PYTH
   INTEGRATION_UPSTREAM_URL="$INTEGRATION_UPSTREAM_URL" \
   INTEGRATION_MASTER_KEY="$INTEGRATION_MASTER_KEY" LITELLM_MODE=PRODUCTION \
   INTEGRATION_SEED="$INTEGRATION_SEED" \
+  INTEGRATION_ORDER_SEED="$INTEGRATION_ORDER_SEED" \
   LITELLM_LOCAL_MODEL_COST_MAP=True AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 \
   .venv/bin/python tests/integration/run.py "$suite" --results "$results"

.circleci/scripts/verify_integration_browser.py

@@ -0,0 +1,60 @@
+import json
+import sys
+from pathlib import Path
+from typing import Final
+
+from pydantic import TypeAdapter
+from typing_extensions import NotRequired, ReadOnly, TypedDict
+
+
+class BrowserAttempt(TypedDict):
+    status: ReadOnly[str]
+    retry: ReadOnly[int]
+
+
+class BrowserTest(TypedDict):
+    results: ReadOnly[list[BrowserAttempt]]
+
+
+class BrowserSpec(TypedDict):
+    file: ReadOnly[str]
+    title: ReadOnly[str]
+    tests: ReadOnly[list[BrowserTest]]
+
+
+class BrowserSuite(TypedDict):
+    specs: NotRequired[ReadOnly[list[BrowserSpec]]]
+    suites: NotRequired[ReadOnly[list["BrowserSuite"]]]
+
+
+def main() -> None:
+    result: Final = json.loads(Path(sys.argv[1]).read_text())
+    assert not result.get("errors"), result.get("errors")
+    expected: Final = json.loads(
+        (Path(__file__).resolve().parents[2] / "tests/integration/contracts.json").read_text()
+    )["browser"]
+    assert expected and result["stats"]["expected"] == len(expected)
+    assert all(result["stats"][name] == 0 for name in ("unexpected", "flaky", "skipped"))
+
+    def cases(suite: BrowserSuite) -> tuple[BrowserSpec, ...]:
+        return tuple(suite.get("specs", ())) + tuple(spec for child in suite.get("suites", ()) for spec in cases(child))
+
+    suites: Final = TypeAdapter(list[BrowserSuite]).validate_python(result["suites"], strict=True)
+    specs: Final = tuple(spec for suite in suites for spec in cases(suite))
+    repository: Final = Path(__file__).resolve().parents[2]
+    report_root: Final = Path(result["config"]["rootDir"])
+    assert report_root.is_absolute(), "Playwright rootDir must be explicit"
+    observed: Final = tuple(
+        str((report_root / spec["file"]).resolve().relative_to(repository)) + "::" + spec["title"] for spec in specs
+    )
+    assert sorted(observed) == sorted(expected)
+    for spec in specs:
+        tests: Final = spec["tests"]
+        assert len(tests) == 1 and len(tests[0]["results"]) == 1
+        assert tests[0]["results"][0]["status"] == "passed" and tests[0]["results"][0]["retry"] == 0
+
+    sys.stdout.write("One canonical browser contract passed once without skips or retries\n")
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/assert_ci_coverage.py

@@ -505,6 +505,7 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
         return frozenset(), ()
     entries: Final = json.loads(manifest.read_text())
     paths: Final = frozenset(node.split("::", 1)[0] for node in entries["tests"])
+    browser_paths: Final = frozenset(node.split("::", 1)[0] for node in entries.get("browser", {}))
     circle_path: Final = repo_root / ".circleci/config.yml"
     circle: Final = yaml.safe_load(circle_path.read_text()) if circle_path.exists() else {}
     steps: Final = circle.get("jobs", {}).get("integration_contracts", {}).get("steps", ())
@@ -523,7 +524,7 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
         .get("suite", (job["integration_contracts"].get("suite"),))
         if isinstance(suite, str)
     )
-    required: Final = frozenset(
+    required: Final = (frozenset({"browser"}) if browser_paths else frozenset()) | frozenset(
         group
         for group, folders in entries["groups"].items()
         if any(any(path.startswith(f"tests/integration/{folder}/") for folder in folders) for path in paths)
@@ -551,6 +552,40 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
         for path in paths
         if not (repo_root / path).is_file()
     )
+    browser_commands: Final = tuple(
+        scalar.value
+        for path in (repo_root / ".github/workflows").glob("*.y*ml")
+        for scalar in _scalars(yaml.safe_load(path.read_text()), path.name)
+        if scalar.key in {"run", "command"}
+    )
+    browser_findings: Final = tuple(
+        Finding(path, "browser integration contract is explicitly selected by GitHub Actions")
+        for path in browser_paths
+        if any(
+            path in command
+            or pathlib.Path(path).name in command
+            or "integrationCritical" in command
+            or "integration.config.ts" in command
+            or ("run_integration.sh" in command and "browser" in command)
+            for command in browser_commands
+        )
+    ) + tuple(
+        Finding(path, "canonical browser integration file is missing")
+        for path in browser_paths
+        if not (repo_root / path).is_file()
+    )
+    default_browser: Final = repo_root / "tests/e2e/ui/playwright.config.ts"
+    exclusion_findings: Final = (
+        (
+            Finding(
+                str(default_browser.relative_to(repo_root)),
+                "default Playwright selection must exclude integrationCritical",
+            ),
+        )
+        if browser_paths
+        and (not default_browser.exists() or "**/integrationCritical/**" not in default_browser.read_text())
+        else ()
+    )
     group_findings: Final = tuple(
         Finding(group, "canonical integration group is not scheduled by CircleCI")
         for group in sorted(required - scheduled)
@@ -559,7 +594,7 @@ def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozens
         return frozenset(), findings + (
             Finding(str(manifest.relative_to(repo_root)), "dedicated CircleCI runner is missing"),
         )
-    return paths, findings + group_findings
+    return paths | browser_paths, findings + group_findings + browser_findings + exclusion_findings
 
 
 def main() -> int:

.github/scripts/auto_merge_price_sync.py

@@ -0,0 +1,393 @@
+"""Auto-merge the provider-info-sync bot's cost-map pull requests.
+
+Evaluates every gate (author allowlist, cost-map-only diff, required and
+non-required checks, human reviews) and merges with a merge commit when
+all of them hold. Every hold reason is logged; the process exits 0 on hold
+and 1 only on API or programming errors.
+``DRY_RUN=1`` prints the verdict without calling the merge endpoint.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.request
+from collections.abc import Callable, Mapping, Sequence
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Final
+
+REPO_ROOT: Final = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+CLASSIFY_SCRIPT: Final = os.path.join(REPO_ROOT, ".circleci", "scripts", "classify_changes.sh")
+API_ROOT: Final = "https://api.github.com"
+CHANGED_FILE_CEILING: Final = 3000
+OK_CHECK_CONCLUSIONS: Final = frozenset({"success", "skipped", "neutral"})
+
+
+@dataclass(frozen=True, slots=True)
+class PullRequest:
+    number: int
+    title: str
+    author_login: str
+    state: str
+    draft: bool
+    mergeable: bool | None
+    mergeable_state: str
+    head_sha: str
+
+
+@dataclass(frozen=True, slots=True)
+class CheckRun:
+    name: str
+    status: str
+    conclusion: str | None
+
+
+@dataclass(frozen=True, slots=True)
+class CommitStatus:
+    context: str
+    state: str
+
+
+@dataclass(frozen=True, slots=True)
+class Review:
+    author_login: str
+    state: str
+    body: str
+    commit_id: str
+    submitted_at: datetime
+
+
+@dataclass(frozen=True, slots=True)
+class Verdict:
+    merge: bool
+    reasons: tuple[str, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class EvaluationInputs:
+    pr: PullRequest
+    changed_files: tuple[str, ...]
+    required_contexts: frozenset[str]
+    check_runs: tuple[CheckRun, ...]
+    statuses: tuple[CommitStatus, ...]
+    reviews: tuple[Review, ...]
+    self_check_name: str
+    author_allowlist: frozenset[str]
+
+
+def _is_bot_login(login: str) -> bool:
+    return login.lower().endswith("[bot]")
+
+
+def _classify(changed_files: Sequence[str]) -> str:
+    result: Final = subprocess.run(
+        ["bash", CLASSIFY_SCRIPT, "cost-map-only"],
+        input="\n".join(changed_files),
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        return "error"
+    return result.stdout.strip()
+
+
+def evaluate(
+    inputs: EvaluationInputs,
+    *,
+    classify: Callable[[Sequence[str]], str] = _classify,
+) -> Verdict:
+    pr: Final = inputs.pr
+    reasons: list[str] = []
+
+    if pr.author_login.lower() not in {login.lower() for login in inputs.author_allowlist}:
+        reasons.append(f"author {pr.author_login!r} not in allowlist")
+    if pr.state != "open":
+        reasons.append("pr not open")
+    if pr.draft:
+        reasons.append("pr is a draft")
+    if pr.mergeable is None:
+        reasons.append("mergeability unknown")
+    elif not pr.mergeable:
+        reasons.append("pr not mergeable")
+    if pr.mergeable_state == "dirty":
+        reasons.append("pr has merge conflicts")
+
+    if len(inputs.changed_files) > CHANGED_FILE_CEILING:
+        reasons.append(f"changed file count {len(inputs.changed_files)} over {CHANGED_FILE_CEILING} ceiling")
+    else:
+        decision: Final = classify(inputs.changed_files)
+        if decision != "run":
+            reasons.append("changed files outside the cost-map-only set")
+
+    green_runs: Final = frozenset(run.name for run in inputs.check_runs if run.conclusion in OK_CHECK_CONCLUSIONS)
+    green_statuses: Final = frozenset(status.context for status in inputs.statuses if status.state == "success")
+    for context in sorted(inputs.required_contexts):
+        if context not in green_runs and context not in green_statuses:
+            reasons.append(f"required check {context!r} not green")
+    for run in inputs.check_runs:
+        if run.name == inputs.self_check_name:
+            continue
+        if run.status != "completed" or run.conclusion not in OK_CHECK_CONCLUSIONS:
+            reasons.append(f"check run {run.name!r} is {run.status}/{run.conclusion}")
+    for status in inputs.statuses:
+        if status.state != "success":
+            reasons.append(f"commit status {status.context!r} is {status.state}")
+
+    latest_state_by_reviewer: Final[dict[str, str]] = {}
+    for review in sorted(inputs.reviews, key=lambda review: review.submitted_at):
+        if _is_bot_login(review.author_login):
+            continue
+        latest_state_by_reviewer[review.author_login] = review.state
+    for reviewer, state in latest_state_by_reviewer.items():
+        if state == "CHANGES_REQUESTED":
+            reasons.append(f"changes requested by {reviewer}")
+
+    return Verdict(merge=not reasons, reasons=tuple(reasons))
+
+
+def _request(token: str, method: str, path: str, body: Mapping[str, object] | None = None) -> object:
+    url: Final = path if path.startswith("http") else f"{API_ROOT}{path}"
+    data: Final = None if body is None else json.dumps(body).encode("utf-8")
+    request: Final = urllib.request.Request(
+        url,
+        data=data,
+        method=method,
+        headers={
+            "Accept": "application/vnd.github+json",
+            "Authorization": f"Bearer {token}",
+            "X-GitHub-Api-Version": "2022-11-28",
+        },
+    )
+    with urllib.request.urlopen(request) as response:
+        return json.loads(response.read().decode("utf-8"))
+
+
+def _request_allow_fail(
+    token: str, method: str, path: str, body: Mapping[str, object] | None = None
+) -> tuple[int, object | None]:
+    url: Final = path if path.startswith("http") else f"{API_ROOT}{path}"
+    data: Final = None if body is None else json.dumps(body).encode("utf-8")
+    request: Final = urllib.request.Request(
+        url,
+        data=data,
+        method=method,
+        headers={
+            "Accept": "application/vnd.github+json",
+            "Authorization": f"Bearer {token}",
+            "X-GitHub-Api-Version": "2022-11-28",
+        },
+    )
+    try:
+        with urllib.request.urlopen(request) as response:
+            return response.status, json.loads(response.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        return exc.code, None
+
+
+def _items(payload: object, key: str | None = None) -> tuple[object, ...]:
+    source: Final = payload.get(key) if key and isinstance(payload, Mapping) else payload
+    if not isinstance(source, list):
+        return ()
+    return tuple(source)
+
+
+def _paginate(token: str, path: str, key: str | None = None) -> list[object]:
+    separator: Final = "&" if "?" in path else "?"
+    results: list[object] = []
+    for page in range(1, 10_000):
+        batch: Final = _items(_request(token, "GET", f"{path}{separator}per_page=100&page={page}"), key)
+        results.extend(batch)
+        if len(batch) < 100:
+            return results
+    return results
+
+
+def _text(value: object) -> str:
+    return value if isinstance(value, str) else ""
+
+
+def _int(value: object) -> int:
+    return value if isinstance(value, int) else 0
+
+
+def _bool(value: object) -> bool:
+    return value is True
+
+
+def _nested(value: object, *keys: str) -> object:
+    current: object = value
+    for key in keys:
+        if not isinstance(current, Mapping):
+            return None
+        current = current.get(key)
+    return current
+
+
+def _parse_time(value: object) -> datetime:
+    text: Final = _text(value)
+    if not text:
+        return datetime.min.replace(tzinfo=timezone.utc)
+    return datetime.fromisoformat(text.replace("Z", "+00:00"))
+
+
+def _load_pr(token: str, repo: str, number: int) -> PullRequest:
+    data: Final = _request(token, "GET", f"/repos/{repo}/pulls/{number}")
+    if not isinstance(data, Mapping):
+        raise RuntimeError(f"unexpected pull payload for #{number}")
+    return PullRequest(
+        number=number,
+        title=_text(data.get("title")),
+        author_login=_text(_nested(data, "user", "login")),
+        state=_text(data.get("state")),
+        draft=_bool(data.get("draft")),
+        mergeable=data.get("mergeable") if isinstance(data.get("mergeable"), bool) else None,
+        mergeable_state=_text(data.get("mergeable_state")),
+        head_sha=_text(_nested(data, "head", "sha")),
+    )
+
+
+def _list_candidate_prs(token: str, repo: str, base: str, allowlist: frozenset[str]) -> list[int]:
+    candidates: Final = _paginate(token, f"/repos/{repo}/pulls?state=open&base={base}")
+    return [
+        _int(item.get("number"))
+        for item in candidates
+        if isinstance(item, Mapping) and _text(_nested(item, "user", "login")).lower() in allowlist
+    ]
+
+
+def _changed_files(token: str, repo: str, number: int) -> tuple[str, ...]:
+    files: Final = _paginate(token, f"/repos/{repo}/pulls/{number}/files")
+    return tuple(_text(item.get("filename")) for item in files if isinstance(item, Mapping))
+
+
+def _required_contexts(token: str, repo: str, base: str) -> frozenset[str]:
+    payload: Final = _request(token, "GET", f"/repos/{repo}/rules/branches/{base}")
+    contexts: set[str] = set()
+    for rule in _items(payload):
+        if not isinstance(rule, Mapping) or rule.get("type") != "required_status_checks":
+            continue
+        checks: Final = _nested(rule, "parameters", "required_status_checks")
+        for check in _items(checks):
+            if isinstance(check, Mapping):
+                context: Final = _text(check.get("context"))
+                if context:
+                    contexts.add(context)
+    return frozenset(contexts)
+
+
+def _check_runs(token: str, repo: str, sha: str) -> tuple[CheckRun, ...]:
+    runs: Final = _paginate(token, f"/repos/{repo}/commits/{sha}/check-runs", key="check_runs")
+    return tuple(
+        CheckRun(
+            name=_text(item.get("name")),
+            status=_text(item.get("status")),
+            conclusion=item.get("conclusion") if isinstance(item.get("conclusion"), str) else None,
+        )
+        for item in runs
+        if isinstance(item, Mapping)
+    )
+
+
+def _statuses(token: str, repo: str, sha: str) -> tuple[CommitStatus, ...]:
+    payload: Final = _request(token, "GET", f"/repos/{repo}/commits/{sha}/status")
+    return tuple(
+        CommitStatus(context=_text(item.get("context")), state=_text(item.get("state")))
+        for item in _items(payload, "statuses")
+        if isinstance(item, Mapping)
+    )
+
+
+def _reviews(token: str, repo: str, number: int) -> tuple[Review, ...]:
+    reviews: Final = _paginate(token, f"/repos/{repo}/pulls/{number}/reviews")
+    return tuple(
+        Review(
+            author_login=_text(_nested(item, "user", "login")),
+            state=_text(item.get("state")),
+            body=_text(item.get("body")),
+            commit_id=_text(item.get("commit_id")),
+            submitted_at=_parse_time(item.get("submitted_at")),
+        )
+        for item in reviews
+        if isinstance(item, Mapping)
+    )
+
+
+def _mergeable_or_refetch(token: str, repo: str, pr: PullRequest) -> PullRequest:
+    if pr.mergeable is not None:
+        return pr
+    time.sleep(5)
+    return _load_pr(token, repo, pr.number)
+
+
+def _gather_inputs(
+    token: str,
+    repo: str,
+    number: int,
+    base: str,
+    self_check_name: str,
+    allowlist: frozenset[str],
+) -> EvaluationInputs:
+    pr: Final = _mergeable_or_refetch(token, repo, _load_pr(token, repo, number))
+    return EvaluationInputs(
+        pr=pr,
+        changed_files=_changed_files(token, repo, number),
+        required_contexts=_required_contexts(token, repo, base),
+        check_runs=_check_runs(token, repo, pr.head_sha),
+        statuses=_statuses(token, repo, pr.head_sha),
+        reviews=_reviews(token, repo, number),
+        self_check_name=self_check_name,
+        author_allowlist=allowlist,
+    )
+
+
+def merge_request_body(pr: PullRequest) -> dict[str, str]:
+    return {"merge_method": "merge", "commit_title": f"{pr.title} (#{pr.number})", "sha": pr.head_sha}
+
+
+def _merge(token: str, repo: str, pr: PullRequest) -> None:
+    status, _ = _request_allow_fail(token, "PUT", f"/repos/{repo}/pulls/{pr.number}/merge", merge_request_body(pr))
+    if status in (200, 405, 409):
+        print(f"auto-merge-price-sync: PR #{pr.number} merge call returned {status}")
+        return
+    raise RuntimeError(f"merge call for PR #{pr.number} returned {status}")
+
+
+def main() -> int:
+    token: Final = os.environ.get("GH_TOKEN", "")
+    repo: Final = os.environ.get("REPO", "")
+    base: Final = os.environ.get("BASE_BRANCH", "main")
+    dry_run: Final = os.environ.get("DRY_RUN", "") != ""
+    self_check_name: Final = os.environ.get("SELF_CHECK_NAME", "auto-merge-price-sync")
+    allowlist: Final = frozenset(login.lower() for login in os.environ.get("PR_AUTHOR_ALLOWLIST", "").split() if login)
+    if not token:
+        print("auto-merge-price-sync: app credentials not configured")
+        return 0
+    if not repo:
+        print("auto-merge-price-sync: REPO not set", file=sys.stderr)
+        return 1
+
+    pr_number_env: Final = os.environ.get("PR_NUMBER", "")
+    candidates: Final = [int(pr_number_env)] if pr_number_env else _list_candidate_prs(token, repo, base, allowlist)
+    for number in candidates:
+        inputs: Final = _gather_inputs(token, repo, number, base, self_check_name, allowlist)
+        verdict: Final = evaluate(inputs)
+        for reason in verdict.reasons:
+            print(f"auto-merge-price-sync: PR #{number} hold: {reason}")
+        if not verdict.merge:
+            continue
+        print(f"auto-merge-price-sync: PR #{number} all gates green")
+        if dry_run:
+            print(f"auto-merge-price-sync: DRY_RUN merge suppressed for PR #{number}")
+            continue
+        _merge(token, repo, inputs.pr)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/workflows/auto-merge-price-sync.yml

@@ -0,0 +1,61 @@
+name: auto-merge-price-sync
+
+on:
+  issue_comment:
+    types: [created, edited]
+  check_suite:
+    types: [completed]
+  status: {}
+  schedule:
+    - cron: "*/30 * * * *"
+  workflow_dispatch:
+    inputs:
+      pr-number:
+        description: "Evaluate only this PR number (empty = scan all open sync-bot PRs)"
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+  pull-requests: read
+  checks: read
+  statuses: read
+
+concurrency:
+  group: auto-merge-price-sync
+  cancel-in-progress: false
+
+jobs:
+  auto-merge-price-sync:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      PROVIDER_INFO_SYNC_APP_ID: ${{ secrets.PROVIDER_INFO_SYNC_APP_ID }}
+      PROVIDER_INFO_SYNC_APP_PRIVATE_KEY: ${{ secrets.PROVIDER_INFO_SYNC_APP_PRIVATE_KEY }}
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Mint app token
+        id: app-token
+        if: ${{ env.PROVIDER_INFO_SYNC_APP_ID != '' && env.PROVIDER_INFO_SYNC_APP_PRIVATE_KEY != '' }}
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.PROVIDER_INFO_SYNC_APP_ID }}
+          private-key: ${{ secrets.PROVIDER_INFO_SYNC_APP_PRIVATE_KEY }}
+
+      - name: Auto-merge eligible sync PRs
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ (github.event.issue.pull_request && github.event.issue.number) || github.event.inputs.pr-number || '' }}
+          BASE_BRANCH: main
+          PR_AUTHOR_ALLOWLIST: "berriai-litellm-provider-info-sync[bot]"
+          SELF_CHECK_NAME: auto-merge-price-sync
+        run: python3 .github/scripts/auto_merge_price_sync.py

.github/workflows/test-unit-proxy-db.yml

@@ -94,7 +94,6 @@ jobs:
               tests/proxy_unit_tests/test_jwt_key_mapping.py
               tests/proxy_unit_tests/test_proxy_custom_auth.py
               tests/proxy_unit_tests/test_key_generate_dynamodb.py
-              tests/proxy_unit_tests/test_deployed_proxy_keygen.py
             workers: 4
             dist: loadscope
             timeout: 15
@@ -110,8 +109,6 @@ jobs:
           - test-group: proxy-server-core
             test-path: >-
               tests/proxy_unit_tests/test_proxy_server.py
-              tests/proxy_unit_tests/test_proxy_server_keys.py
-              tests/proxy_unit_tests/test_proxy_server_spend.py
               tests/proxy_unit_tests/test_aproxy_startup.py
             workers: 4
             dist: loadscope
@@ -120,7 +117,6 @@ jobs:
             test-path: >-
               tests/proxy_unit_tests/test_proxy_config_unit_test.py
               tests/proxy_unit_tests/test_proxy_routes.py
-              tests/proxy_unit_tests/test_proxy_gunicorn.py
               tests/proxy_unit_tests/test_server_root_path.py
               tests/proxy_unit_tests/test_proxy_pass_user_config.py
               tests/proxy_unit_tests/test_proxy_token_counter.py
@@ -198,7 +194,6 @@ jobs:
               tests/proxy_unit_tests/test_realtime_cache.py
               tests/proxy_unit_tests/test_proxy_exception_mapping.py
               tests/proxy_unit_tests/test_custom_tokenizer_bug.py
-              tests/proxy_unit_tests/test_model_response_typing
             workers: 4
             dist: loadscope
             timeout: 15

.github/workflows/test-unit.yml

@@ -100,6 +100,7 @@ jobs:
               tests/test_litellm/secret_managers
               tests/test_litellm/a2a_protocol
               tests/test_litellm/anthropic_interface
+              tests/test_litellm/chat_completions
               tests/test_litellm/completion_extras
               tests/test_litellm/compression
               tests/test_litellm/containers
@@ -109,6 +110,7 @@ jobs:
               tests/test_litellm/repositories
               tests/test_litellm/images
               tests/test_litellm/interactions
+              tests/test_litellm/messages
               tests/test_litellm/ocr
               tests/test_litellm/passthrough
               tests/test_litellm/rag
@@ -211,7 +213,6 @@ jobs:
             test-path: >-
               tests/local_testing/test_cache_preset_key.py
               tests/local_testing/test_caching_handler.py
-              tests/local_testing/test_prompt_caching.py
               tests/local_testing/test_responses_stream_cache_keys.py
               tests/local_testing/test_unit_test_caching.py
             workers: 2

cookbook/litellm_proxy_server/cli_token_usage.py

@@ -3,7 +3,7 @@
 Example: Using CLI token with LiteLLM SDK
 
 This example shows how to use the CLI authentication token
-in your Python scripts after running `litellm-proxy login`.
+in your Python scripts after running `lite login`.
 """
 
 from textwrap import indent
@@ -22,7 +22,7 @@ def main():
     api_key = litellm.get_litellm_gateway_api_key()
 
     if not api_key:
-        print("❌ No CLI token found. Please run 'litellm-proxy login' first.")
+        print("❌ No CLI token found. Please run 'lite login' first.")
         return
 
     print("✅ Found CLI token.")
@@ -58,6 +58,6 @@ if __name__ == "__main__":
     main()
 
     print("\n💡 Tips:")
-    print("1. Run 'litellm-proxy login' to authenticate first")
+    print("1. Run 'lite login' to authenticate first")
     print("2. Replace 'https://your-proxy.com' with your actual proxy URL")
     print("3. The token is stored in your OS keychain, or in ~/.litellm/token.json when there is none")

cookbook/litellm_proxy_server/grafana_dashboard/dashboard_1/grafana_dashboard.json

@@ -1,614 +0,0 @@
-{
-    "annotations": {
-      "list": [
-        {
-          "builtIn": 1,
-          "datasource": {
-            "type": "grafana",
-            "uid": "-- Grafana --"
-          },
-          "enable": true,
-          "hide": true,
-          "iconColor": "rgba(0, 211, 255, 1)",
-          "name": "Annotations & Alerts",
-          "target": {
-            "limit": 100,
-            "matchAny": false,
-            "tags": [],
-            "type": "dashboard"
-          },
-          "type": "dashboard"
-        }
-      ]
-    },
-    "description": "",
-    "editable": true,
-    "fiscalYearStartMonth": 0,
-    "graphTooltip": 0,
-    "id": 2039,
-    "links": [],
-    "liveNow": false,
-    "panels": [
-      {
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${DS_PROMETHEUS}"
-        },
-        "fieldConfig": {
-          "defaults": {
-            "color": {
-              "mode": "palette-classic"
-            },
-            "custom": {
-              "axisCenteredZero": false,
-              "axisColorMode": "text",
-              "axisLabel": "",
-              "axisPlacement": "auto",
-              "barAlignment": 0,
-              "drawStyle": "line",
-              "fillOpacity": 0,
-              "gradientMode": "none",
-              "hideFrom": {
-                "legend": false,
-                "tooltip": false,
-                "viz": false
-              },
-              "lineInterpolation": "linear",
-              "lineWidth": 1,
-              "pointSize": 5,
-              "scaleDistribution": {
-                "type": "linear"
-              },
-              "showPoints": "auto",
-              "spanNulls": false,
-              "stacking": {
-                "group": "A",
-                "mode": "none"
-              },
-              "thresholdsStyle": {
-                "mode": "off"
-              }
-            },
-            "mappings": [],
-            "thresholds": {
-              "mode": "absolute",
-              "steps": [
-                {
-                  "color": "green",
-                  "value": null
-                },
-                {
-                  "color": "red",
-                  "value": 80
-                }
-              ]
-            },
-            "unit": "s"
-          },
-          "overrides": []
-        },
-        "gridPos": {
-          "h": 8,
-          "w": 12,
-          "x": 0,
-          "y": 0
-        },
-        "id": 10,
-        "options": {
-          "legend": {
-            "calcs": [],
-            "displayMode": "list",
-            "placement": "bottom",
-            "showLegend": true
-          },
-          "tooltip": {
-            "mode": "single",
-            "sort": "none"
-          }
-        },
-        "targets": [
-          {
-            "datasource": {
-              "type": "prometheus",
-              "uid": "${DS_PROMETHEUS}"
-            },
-            "editorMode": "code",
-            "expr": "histogram_quantile(0.99, sum(rate(litellm_self_latency_bucket{self=\"self\"}[1m])) by (le))",
-            "legendFormat": "Time to first token",
-            "range": true,
-            "refId": "A"
-          }
-        ],
-        "title": "Time to first token (latency)",
-        "type": "timeseries"
-      },
-      {
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${DS_PROMETHEUS}"
-        },
-        "fieldConfig": {
-          "defaults": {
-            "color": {
-              "mode": "palette-classic"
-            },
-            "custom": {
-              "axisCenteredZero": false,
-              "axisColorMode": "text",
-              "axisLabel": "",
-              "axisPlacement": "auto",
-              "barAlignment": 0,
-              "drawStyle": "line",
-              "fillOpacity": 0,
-              "gradientMode": "none",
-              "hideFrom": {
-                "legend": false,
-                "tooltip": false,
-                "viz": false
-              },
-              "lineInterpolation": "linear",
-              "lineWidth": 1,
-              "pointSize": 5,
-              "scaleDistribution": {
-                "type": "linear"
-              },
-              "showPoints": "auto",
-              "spanNulls": false,
-              "stacking": {
-                "group": "A",
-                "mode": "none"
-              },
-              "thresholdsStyle": {
-                "mode": "off"
-              }
-            },
-            "mappings": [],
-            "thresholds": {
-              "mode": "absolute",
-              "steps": [
-                {
-                  "color": "green",
-                  "value": null
-                },
-                {
-                  "color": "red",
-                  "value": 80
-                }
-              ]
-            },
-            "unit": "currencyUSD"
-          },
-          "overrides": [
-            {
-              "matcher": {
-                "id": "byName",
-                "options": "7e4b0627fd32efdd2313c846325575808aadcf2839f0fde90723aab9ab73c78f"
-              },
-              "properties": [
-                {
-                  "id": "displayName",
-                  "value": "Translata"
-                }
-              ]
-            }
-          ]
-        },
-        "gridPos": {
-          "h": 8,
-          "w": 12,
-          "x": 0,
-          "y": 8
-        },
-        "id": 11,
-        "options": {
-          "legend": {
-            "calcs": [],
-            "displayMode": "list",
-            "placement": "bottom",
-            "showLegend": true
-          },
-          "tooltip": {
-            "mode": "single",
-            "sort": "none"
-          }
-        },
-        "targets": [
-          {
-            "datasource": {
-              "type": "prometheus",
-              "uid": "${DS_PROMETHEUS}"
-            },
-            "editorMode": "code",
-            "expr": "sum(increase(litellm_spend_metric_total[30d])) by (hashed_api_key)",
-            "legendFormat": "{{team}}",
-            "range": true,
-            "refId": "A"
-          }
-        ],
-        "title": "Spend by team",
-        "transformations": [],
-        "type": "timeseries"
-      },
-      {
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${DS_PROMETHEUS}"
-        },
-        "fieldConfig": {
-          "defaults": {
-            "color": {
-              "mode": "palette-classic"
-            },
-            "custom": {
-              "axisCenteredZero": false,
-              "axisColorMode": "text",
-              "axisLabel": "",
-              "axisPlacement": "auto",
-              "barAlignment": 0,
-              "drawStyle": "line",
-              "fillOpacity": 0,
-              "gradientMode": "none",
-              "hideFrom": {
-                "legend": false,
-                "tooltip": false,
-                "viz": false
-              },
-              "lineInterpolation": "linear",
-              "lineWidth": 1,
-              "pointSize": 5,
-              "scaleDistribution": {
-                "type": "linear"
-              },
-              "showPoints": "auto",
-              "spanNulls": false,
-              "stacking": {
-                "group": "A",
-                "mode": "none"
-              },
-              "thresholdsStyle": {
-                "mode": "off"
-              }
-            },
-            "mappings": [],
-            "thresholds": {
-              "mode": "absolute",
-              "steps": [
-                {
-                  "color": "green",
-                  "value": null
-                },
-                {
-                  "color": "red",
-                  "value": 80
-                }
-              ]
-            }
-          },
-          "overrides": []
-        },
-        "gridPos": {
-          "h": 9,
-          "w": 12,
-          "x": 0,
-          "y": 16
-        },
-        "id": 2,
-        "options": {
-          "legend": {
-            "calcs": [],
-            "displayMode": "list",
-            "placement": "bottom",
-            "showLegend": true
-          },
-          "tooltip": {
-            "mode": "single",
-            "sort": "none"
-          }
-        },
-        "targets": [
-          {
-            "datasource": {
-              "type": "prometheus",
-              "uid": "${DS_PROMETHEUS}"
-            },
-            "editorMode": "code",
-            "expr": "sum by (model) (increase(litellm_requests_metric_total[5m]))",
-            "legendFormat": "{{model}}",
-            "range": true,
-            "refId": "A"
-          }
-        ],
-        "title": "Requests by model",
-        "type": "timeseries"
-      },
-      {
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${DS_PROMETHEUS}"
-        },
-        "fieldConfig": {
-          "defaults": {
-            "color": {
-              "mode": "thresholds"
-            },
-            "mappings": [],
-            "noValue": "0",
-            "thresholds": {
-              "mode": "absolute",
-              "steps": [
-                {
-                  "color": "green",
-                  "value": null
-                },
-                {
-                  "color": "red",
-                  "value": 80
-                }
-              ]
-            }
-          },
-          "overrides": []
-        },
-        "gridPos": {
-          "h": 7,
-          "w": 3,
-          "x": 0,
-          "y": 25
-        },
-        "id": 8,
-        "options": {
-          "colorMode": "value",
-          "graphMode": "area",
-          "justifyMode": "auto",
-          "orientation": "auto",
-          "reduceOptions": {
-            "calcs": [
-              "lastNotNull"
-            ],
-            "fields": "",
-            "values": false
-          },
-          "textMode": "auto"
-        },
-        "pluginVersion": "9.4.17",
-        "targets": [
-          {
-            "datasource": {
-              "type": "prometheus",
-              "uid": "${DS_PROMETHEUS}"
-            },
-            "editorMode": "code",
-            "expr": "sum(increase(litellm_llm_api_failed_requests_metric_total[1h]))",
-            "legendFormat": "__auto",
-            "range": true,
-            "refId": "A"
-          }
-        ],
-        "title": "Faild Requests",
-        "type": "stat"
-      },
-      {
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${DS_PROMETHEUS}"
-        },
-        "fieldConfig": {
-          "defaults": {
-            "color": {
-              "mode": "palette-classic"
-            },
-            "custom": {
-              "axisCenteredZero": false,
-              "axisColorMode": "text",
-              "axisLabel": "",
-              "axisPlacement": "auto",
-              "barAlignment": 0,
-              "drawStyle": "line",
-              "fillOpacity": 0,
-              "gradientMode": "none",
-              "hideFrom": {
-                "legend": false,
-                "tooltip": false,
-                "viz": false
-              },
-              "lineInterpolation": "linear",
-              "lineWidth": 1,
-              "pointSize": 5,
-              "scaleDistribution": {
-                "type": "linear"
-              },
-              "showPoints": "auto",
-              "spanNulls": false,
-              "stacking": {
-                "group": "A",
-                "mode": "none"
-              },
-              "thresholdsStyle": {
-                "mode": "off"
-              }
-            },
-            "mappings": [],
-            "thresholds": {
-              "mode": "absolute",
-              "steps": [
-                {
-                  "color": "green",
-                  "value": null
-                },
-                {
-                  "color": "red",
-                  "value": 80
-                }
-              ]
-            },
-            "unit": "currencyUSD"
-          },
-          "overrides": []
-        },
-        "gridPos": {
-          "h": 7,
-          "w": 3,
-          "x": 3,
-          "y": 25
-        },
-        "id": 6,
-        "options": {
-          "legend": {
-            "calcs": [],
-            "displayMode": "list",
-            "placement": "bottom",
-            "showLegend": true
-          },
-          "tooltip": {
-            "mode": "single",
-            "sort": "none"
-          }
-        },
-        "targets": [
-          {
-            "datasource": {
-              "type": "prometheus",
-              "uid": "${DS_PROMETHEUS}"
-            },
-            "editorMode": "code",
-            "expr": "sum(increase(litellm_spend_metric_total[30d])) by (model)",
-            "legendFormat": "{{model}}",
-            "range": true,
-            "refId": "A"
-          }
-        ],
-        "title": "Spend",
-        "type": "timeseries"
-      },
-      {
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${DS_PROMETHEUS}"
-        },
-        "fieldConfig": {
-          "defaults": {
-            "color": {
-              "mode": "palette-classic"
-            },
-            "custom": {
-              "axisCenteredZero": false,
-              "axisColorMode": "text",
-              "axisLabel": "",
-              "axisPlacement": "auto",
-              "barAlignment": 0,
-              "drawStyle": "line",
-              "fillOpacity": 0,
-              "gradientMode": "none",
-              "hideFrom": {
-                "legend": false,
-                "tooltip": false,
-                "viz": false
-              },
-              "lineInterpolation": "linear",
-              "lineWidth": 1,
-              "pointSize": 5,
-              "scaleDistribution": {
-                "type": "linear"
-              },
-              "showPoints": "auto",
-              "spanNulls": false,
-              "stacking": {
-                "group": "A",
-                "mode": "none"
-              },
-              "thresholdsStyle": {
-                "mode": "off"
-              }
-            },
-            "mappings": [],
-            "thresholds": {
-              "mode": "absolute",
-              "steps": [
-                {
-                  "color": "green",
-                  "value": null
-                },
-                {
-                  "color": "red",
-                  "value": 80
-                }
-              ]
-            }
-          },
-          "overrides": []
-        },
-        "gridPos": {
-          "h": 7,
-          "w": 6,
-          "x": 6,
-          "y": 25
-        },
-        "id": 4,
-        "options": {
-          "legend": {
-            "calcs": [],
-            "displayMode": "list",
-            "placement": "bottom",
-            "showLegend": true
-          },
-          "tooltip": {
-            "mode": "single",
-            "sort": "none"
-          }
-        },
-        "targets": [
-          {
-            "datasource": {
-              "type": "prometheus",
-              "uid": "${DS_PROMETHEUS}"
-            },
-            "editorMode": "code",
-            "expr": "sum(increase(litellm_total_tokens_total[5m])) by (model)",
-            "legendFormat": "__auto",
-            "range": true,
-            "refId": "A"
-          }
-        ],
-        "title": "Tokens",
-        "type": "timeseries"
-      }
-    ],
-    "refresh": "1m",
-    "revision": 1,
-    "schemaVersion": 38,
-    "style": "dark",
-    "tags": [],
-    "templating": {
-      "list": [
-        {
-          "current": {
-            "selected": false,
-            "text": "prometheus",
-            "value": "edx8memhpd9tsa"
-          },
-          "hide": 0,
-          "includeAll": false,
-          "label": "datasource",
-          "multi": false,
-          "name": "DS_PROMETHEUS",
-          "options": [],
-          "query": "prometheus",
-          "queryValue": "",
-          "refresh": 1,
-          "regex": "",
-          "skipUrlSync": false,
-          "type": "datasource"
-        }
-      ]
-    },
-    "time": {
-      "from": "now-1h",
-      "to": "now"
-    },
-    "timepicker": {},
-    "timezone": "",
-    "title": "LLM Proxy",
-    "uid": "rgRrHxESz",
-    "version": 15,
-    "weekStart": ""
-  }

cookbook/litellm_proxy_server/grafana_dashboard/dashboard_1/readme.md

@@ -1,6 +0,0 @@
-## This folder contains the `json` for creating the following Grafana Dashboard
-
-### Pre-Requisites
-- Setup LiteLLM Proxy Prometheus Metrics https://docs.litellm.ai/docs/proxy/prometheus 
-
-![1716623265684](https://github.com/BerriAI/litellm/assets/29436595/0e12c57e-4a2d-4850-bd4f-e4294f87a814)

cookbook/litellm_proxy_server/grafana_dashboard/dashboard_all_metrics/readme.md

@@ -0,0 +1,11 @@
+# LiteLLM All Prometheus Metrics dashboard
+
+Every `litellm_*` metric family the proxy can expose on `/metrics` (134 families across 95 panels), grouped into rows: proxy traffic, latency, spend and tokens, cache, LLM API deployments, key and team rate limits, budgets, guardrails, MCP, managed files and batches, users and teams, the Redis circuit breaker, the spend log cleanup job, and the `prometheus_system` service callback metrics (per-service latency, request and failure rates, spend update queue sizes). Panel titles are the metric names so you can grep the JSON for the metric you care about
+
+Import `grafana_dashboard.json` from **Dashboards > New > Import** and pick your Prometheus data source when prompted (the `DS_PROMETHEUS` variable). Counters are plotted as `rate()` over `$__rate_interval`, histograms as p50 / p95 / p99, gauges as the raw value grouped by the most useful label. Every query names the metric exactly as the proxy emits it (counters carry the `_total` suffix the Prometheus client adds), and `tests/test_litellm/integrations/test_prometheus_metric_name_consistency.py` fails if a metric is renamed without updating this dashboard
+
+The first eleven rows need only `callbacks: ["prometheus"]`. The last three rows and the `litellm_admission_*` panels are emitted by other subsystems and stay empty until those are on: the service callback row needs `service_callback: ["prometheus_system"]` in `litellm_settings`, the circuit breaker row needs a Redis cache, the cleanup row needs spend log retention, and admission control needs its middleware enabled. Within the base rows, many panels only fill in once the matching feature is in use: budgets need keys, teams, users or orgs with `max_budget` set, cache panels need caching on, guardrail and MCP panels need those features configured, deployment health needs the router with more than one deployment or a failure to record, and `litellm_in_flight_requests` needs traffic at scrape time. An empty panel for a feature you do not use is expected
+
+## Pre-requisites
+
+Prometheus metrics on the proxy: https://docs.litellm.ai/docs/proxy/prometheus

cookbook/litellm_proxy_server/grafana_dashboard/dashboard_v2/grafana_dashboard.json

@@ -476,7 +476,7 @@
               "uid": "${DS_PROMETHEUS}"
             },
             "editorMode": "code",
-            "expr": "topk(5, sort(litellm_remaining_requests))",
+            "expr": "topk(5, sort(litellm_remaining_requests_metric))",
             "legendFormat": "__auto",
             "range": true,
             "refId": "A"
@@ -573,7 +573,7 @@
               "uid": "${DS_PROMETHEUS}"
             },
             "editorMode": "code",
-            "expr": "topk(5, sort(litellm_remaining_tokens))",
+            "expr": "topk(5, sort(litellm_remaining_tokens_metric))",
             "legendFormat": "__auto",
             "range": true,
             "refId": "A"

cookbook/litellm_proxy_server/grafana_dashboard/readme.md

@@ -6,8 +6,14 @@ This folder contains the `json` for creating Grafana Dashboards
 
 Charts the `gen_ai.*` metrics from the OpenTelemetry v2 integration: spend, tokens, request rate, and latency percentiles by model. Separate from the dashboards below, which chart the `litellm_*` Prometheus metrics.
 
+## [LiteLLM All Prometheus Metrics dashboard](./dashboard_all_metrics)
+
+Every `litellm_*` Prometheus metric family the proxy can emit (134 families, 95 panels) grouped by theme: traffic, latency, spend and tokens, cache, deployments, rate limits, budgets, guardrails, MCP, managed files and batches, users and teams, plus the Redis circuit breaker, spend log cleanup and `prometheus_system` service metrics. Start here if you want everything on one screen; see its [readme](./dashboard_all_metrics/readme.md) for import steps and which panels need a feature enabled before they show data
+
 ## [LiteLLM v2 Dashboard](./dashboard_v2)
 
+A compact view of proxy request rate, failures, latency and the top remaining-request / remaining-token gauges per model group
+
 <img width="1316" alt="grafana_1" src="https://github.com/user-attachments/assets/d0df802d-0cb9-4906-a679-941c547789ab">
 <img width="1289" alt="grafana_2" src="https://github.com/user-attachments/assets/b11f755f-e113-42ab-b21d-83f91f451a28">
 <img width="1323" alt="grafana_3" src="https://github.com/user-attachments/assets/cb29ffdb-477d-4be1-a5cd-c3f7f2cb21c5">

db_scripts/partition_spend_logs.sql

@@ -53,6 +53,8 @@ ALTER INDEX IF EXISTS "LiteLLM_SpendLogs_end_user_idx"
     RENAME TO "LiteLLM_SpendLogs_legacy_end_user_idx";
 ALTER INDEX IF EXISTS "LiteLLM_SpendLogs_session_id_idx"
     RENAME TO "LiteLLM_SpendLogs_legacy_session_id_idx";
+ALTER INDEX IF EXISTS "LiteLLM_SpendLogs_api_key_startTime_idx"
+    RENAME TO "LiteLLM_SpendLogs_legacy_api_key_startTime_idx";
 
 CREATE TABLE "LiteLLM_SpendLogs" (
     LIKE "LiteLLM_SpendLogs_legacy" INCLUDING DEFAULTS INCLUDING GENERATED
@@ -78,6 +80,9 @@ CREATE INDEX IF NOT EXISTS "LiteLLM_SpendLogs_end_user_idx"
 CREATE INDEX IF NOT EXISTS "LiteLLM_SpendLogs_session_id_idx"
     ON "LiteLLM_SpendLogs" ("session_id");
 
+CREATE INDEX IF NOT EXISTS "LiteLLM_SpendLogs_api_key_startTime_idx"
+    ON "LiteLLM_SpendLogs" ("api_key", "startTime");
+
 -- Safety net: any row whose startTime has no explicit partition lands here so
 -- writes never fail. The cleanup job never drops the DEFAULT partition.
 CREATE TABLE IF NOT EXISTS "LiteLLM_SpendLogs_pdefault"

db_scripts/unpartition_spend_logs.sql

@@ -40,6 +40,8 @@ ALTER INDEX IF EXISTS "LiteLLM_SpendLogs_end_user_idx"
     RENAME TO "LiteLLM_SpendLogs_partitioned_end_user_idx";
 ALTER INDEX IF EXISTS "LiteLLM_SpendLogs_session_id_idx"
     RENAME TO "LiteLLM_SpendLogs_partitioned_session_id_idx";
+ALTER INDEX IF EXISTS "LiteLLM_SpendLogs_api_key_startTime_idx"
+    RENAME TO "LiteLLM_SpendLogs_partitioned_api_key_startTime_idx";
 
 CREATE TABLE "LiteLLM_SpendLogs" (
     LIKE "LiteLLM_SpendLogs_partitioned" INCLUDING DEFAULTS INCLUDING GENERATED
@@ -60,6 +62,9 @@ CREATE INDEX IF NOT EXISTS "LiteLLM_SpendLogs_end_user_idx"
 CREATE INDEX IF NOT EXISTS "LiteLLM_SpendLogs_session_id_idx"
     ON "LiteLLM_SpendLogs" ("session_id");
 
+CREATE INDEX IF NOT EXISTS "LiteLLM_SpendLogs_api_key_startTime_idx"
+    ON "LiteLLM_SpendLogs" ("api_key", "startTime");
+
 INSERT INTO "LiteLLM_SpendLogs"
 SELECT * FROM "LiteLLM_SpendLogs_partitioned"
 ON CONFLICT ("request_id") DO NOTHING;

gateway/routes/allowlist.py

@@ -96,6 +96,7 @@ GATEWAY_PATH_PREFIXES: tuple[str, ...] = (
     "/langfuse/",
     "/vllm/",
     "/mistral/",
+    "/typesafe/",
     "/nvidia_nim/",
     "/groq/",
     "/voyage/",

litellm-proxy-extras/litellm_proxy_extras/migrations/20260823000000_add_spend_logs_api_key_starttime_index/migration.sql

@@ -0,0 +1,2 @@
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "LiteLLM_SpendLogs_api_key_startTime_idx" ON "LiteLLM_SpendLogs"("api_key", "startTime");

litellm-proxy-extras/litellm_proxy_extras/migrations/20260917055603_add_policy_attachment_priority/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE "LiteLLM_PolicyAttachmentTable" ADD COLUMN IF NOT EXISTS "priority" INTEGER;

litellm-proxy-extras/litellm_proxy_extras/schema.prisma

@@ -678,6 +678,7 @@ model LiteLLM_SpendLogs {
   @@index([end_user])
   @@index([session_id])
   @@index([litellm_call_id])
+  @@index([api_key, startTime])
 }
 
 model LiteLLM_BudgetWindowSpend {
@@ -1378,6 +1379,7 @@ model LiteLLM_PolicyAttachmentTable {
   keys             String[]  @default([])  // Key aliases or patterns
   models           String[]  @default([])  // Model names or patterns
   tags             String[]  @default([])  // Tag patterns (e.g., ["healthcare", "prod-*"])
+  priority         Int?                    // Explicit execution order
   created_at       DateTime  @default(now())
   created_by       String?
   updated_at       DateTime  @default(now()) @updatedAt

litellm-proxy-extras/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "litellm-proxy-extras"
-version = "0.4.98"
+version = "0.4.99"
 description = "Additional files for the LiteLLM Proxy. Reduces the size of the main litellm package."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""
 
 [tool.commitizen]
-version = "0.4.98"
+version = "0.4.99"
 version_files = [
     "pyproject.toml:^version",
     "../pyproject.toml:litellm-proxy-extras==",

litellm-rust/Cargo.lock

@@ -70,6 +70,12 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "arcstr"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03918c3dbd7701a85c6b9887732e2921175f26c350b4563841d0958c21d57e6d"
+
 [[package]]
 name = "async-compression"
 version = "0.4.46"
@@ -262,6 +268,17 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "aws-smithy-eventstream"
+version = "0.61.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a9381123ab62d20c13082b151f30f962a3b112b727345394536dfa39a482944"
+dependencies = [
+ "aws-smithy-types",
+ "bytes",
+ "crc32fast",
+]
+
 [[package]]
 name = "aws-smithy-http"
 version = "0.64.0"
@@ -931,8 +948,18 @@ version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
 dependencies = [
- "darling_core",
- "darling_macro",
+ "darling_core 0.20.11",
+ "darling_macro 0.20.11",
+]
+
+[[package]]
+name = "darling"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+dependencies = [
+ "darling_core 0.21.3",
+ "darling_macro 0.21.3",
 ]
 
 [[package]]
@@ -949,13 +976,38 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "darling_core"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "darling_macro"
 version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
- "darling_core",
+ "darling_core 0.20.11",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+dependencies = [
+ "darling_core 0.21.3",
  "quote",
  "syn 2.0.119",
 ]
@@ -1005,7 +1057,7 @@ version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
 dependencies = [
- "darling",
+ "darling 0.20.11",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
@@ -1346,7 +1398,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http 0.2.12",
- "indexmap",
+ "indexmap 2.14.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -1365,7 +1417,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "http 1.4.2",
- "indexmap",
+ "indexmap 2.14.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -1383,6 +1435,12 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
 [[package]]
 name = "hashbrown"
 version = "0.17.1"
@@ -1719,6 +1777,17 @@ dependencies = [
  "icu_properties",
 ]
 
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -1726,7 +1795,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown",
+ "hashbrown 0.17.1",
  "serde",
  "serde_core",
 ]
@@ -1837,6 +1906,12 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
 [[package]]
 name = "litellm-auth"
 version = "0.1.0"
@@ -1915,10 +1990,119 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "litellm-cache-redis"
+version = "0.1.0"
+dependencies = [
+ "litellm-cache",
+ "redis",
+ "redis-test",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "litellm-callbacks"
+version = "0.1.0"
+dependencies = [
+ "rstest",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "litellm-callbacks-legacy"
+version = "0.1.0"
+dependencies = [
+ "litellm-callbacks",
+ "litellm-host-python",
+ "pyo3",
+ "rstest",
+ "serde_json",
+]
+
 [[package]]
 name = "litellm-core"
 version = "0.1.0"
 dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-util",
+ "litellm-auth",
+ "litellm-auth-aws",
+ "litellm-callbacks",
+ "litellm-core-utils",
+ "litellm-llms",
+ "litellm-types",
+ "mime_guess",
+ "moka",
+ "rand 0.8.7",
+ "reqwest 0.12.28",
+ "rstest",
+ "rstest_reuse",
+ "rustls 0.23.42",
+ "rustls-native-certs",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "strum",
+ "subtle",
+ "thiserror 2.0.19",
+ "time",
+ "tokio",
+ "tokio-tungstenite",
+ "url",
+ "veil",
+]
+
+[[package]]
+name = "litellm-core-utils"
+version = "0.1.0"
+dependencies = [
+ "litellm-types",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_with",
+ "thiserror 2.0.19",
+ "url",
+]
+
+[[package]]
+name = "litellm-framing"
+version = "0.1.0"
+dependencies = [
+ "aws-smithy-eventstream",
+ "aws-smithy-types",
+ "bytes",
+ "futures-util",
+ "rstest",
+ "sse-stream",
+ "thiserror 2.0.19",
+ "tokio",
+]
+
+[[package]]
+name = "litellm-host-python"
+version = "0.1.0"
+dependencies = [
+ "futures-util",
+ "litellm-callbacks",
+ "pyo3",
+ "pyo3-async-runtimes",
+ "pythonize",
+ "rstest",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "litellm-llms"
+version = "0.1.0"
+dependencies = [
+ "aws-smithy-eventstream",
+ "aws-smithy-types",
  "base64 0.22.1",
  "bytes",
  "data-url",
@@ -1927,24 +2111,20 @@ dependencies = [
  "litellm-auth-aws",
  "litellm-auth-azure",
  "litellm-auth-gcp",
- "mime_guess",
- "moka",
- "rand 0.8.7",
+ "litellm-callbacks",
+ "litellm-core-utils",
+ "litellm-framing",
+ "litellm-types",
  "reqwest 0.12.28",
  "rstest",
- "rustls 0.23.42",
- "rustls-native-certs",
  "serde",
  "serde_json",
  "serde_path_to_error",
- "sha2 0.10.9",
- "strum",
- "subtle",
+ "serde_with",
  "thiserror 2.0.19",
+ "time",
  "tokio",
- "tokio-tungstenite",
  "url",
- "veil",
 ]
 
 [[package]]
@@ -1955,36 +2135,27 @@ dependencies = [
  "criterion",
  "futures-util",
  "litellm-auth",
+ "litellm-callbacks-legacy",
  "litellm-core",
- "litellm-python-interop",
+ "litellm-host-python",
+ "litellm-llms",
  "litellm-token-counter",
+ "litellm-types",
  "pyo3",
  "pyo3-async-runtimes",
  "rstest",
- "serde",
  "serde_json",
  "tokio",
  "tokio-tungstenite",
 ]
 
-[[package]]
-name = "litellm-python-interop"
-version = "0.1.0"
-dependencies = [
- "pyo3",
- "pythonize",
- "rstest",
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "litellm-token-counter"
 version = "0.1.0"
 dependencies = [
  "base64 0.22.1",
  "criterion",
- "indexmap",
+ "indexmap 2.14.0",
  "itoa",
  "rand 0.8.7",
  "rstest",
@@ -1996,6 +2167,14 @@ dependencies = [
  "unicode-normalization-alignments",
 ]
 
+[[package]]
+name = "litellm-types"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "litemap"
 version = "0.8.2"
@@ -2140,6 +2319,16 @@ dependencies = [
  "minimal-lexical",
 ]
 
+[[package]]
+name = "num-bigint"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-conv"
 version = "0.2.2"
@@ -2656,6 +2845,36 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "redis"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acbc41a996f7652b2ddd9dfd98cc4ff602cfd742ae35382f07f608405ab50ed"
+dependencies = [
+ "arcstr",
+ "combine",
+ "itoa",
+ "num-bigint",
+ "percent-encoding",
+ "ryu",
+ "sha1_smol",
+ "socket2 0.6.5",
+ "url",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "redis-test"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "804d36862e4323b69f96440cbb13c9894fc90176abdeaf91264e21d5d77f6aca"
+dependencies = [
+ "rand 0.9.5",
+ "redis",
+ "socket2 0.6.5",
+ "tempfile",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -2665,6 +2884,26 @@ dependencies = [
  "bitflags",
 ]
 
+[[package]]
+name = "ref-cast"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.0",
+]
+
 [[package]]
 name = "regex"
 version = "1.13.1"
@@ -2831,6 +3070,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "rstest_reuse"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3a8fb4672e840a587a66fc577a5491375df51ddb88f2a2c2a792598c326fe14"
+dependencies = [
+ "quote",
+ "rand 0.8.7",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "rustc-hash"
 version = "2.1.3"
@@ -2846,6 +3096,19 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rustix"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "rustls"
 version = "0.21.12"
@@ -2974,6 +3237,30 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -3055,6 +3342,7 @@ version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
+ "indexmap 2.14.0",
  "itoa",
  "memchr",
  "serde",
@@ -3085,6 +3373,37 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_with"
+version = "3.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fa237f2807440d238e0364a218270b98f767a00d3dada77b1c53ae88940e2e7"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.14.0",
+ "schemars 0.9.0",
+ "schemars 1.2.2",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52a8e3ca0ca629121f70ab50f95249e5a6f925cc0f6ffe8256c45b728875706c"
+dependencies = [
+ "darling 0.21.3",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.7"
@@ -3096,6 +3415,12 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha1_smol"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -3200,6 +3525,19 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "sse-stream"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c25ac7aff0abd1dbc474536e40416e1102c7dd9bfba0b9861c6d357f835dcfb4"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "http-body 1.1.0",
+ "http-body-util",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -3299,6 +3637,19 @@ version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -3528,7 +3879,7 @@ version = "0.25.13+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
 dependencies = [
- "indexmap",
+ "indexmap 2.14.0",
  "toml_datetime",
  "toml_parser",
  "winnow",
@@ -4182,6 +4533,12 @@ version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
 
+[[package]]
+name = "xxhash-rust"
+version = "0.8.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aee1b19627c7c60102ab80d3a9cbe18de90bfe03bfa6c3715447681f0e8c8af6"
+
 [[package]]
 name = "yoke"
 version = "0.8.3"

litellm-rust/Cargo.toml

@@ -9,26 +9,35 @@ license = "MIT"
 repository = "https://github.com/BerriAI/litellm"
 
 [workspace.dependencies]
-bytes = "1"
 litellm-core = { path = "crates/core" }
+litellm-callbacks = { path = "crates/callbacks" }
+litellm-callbacks-legacy = { path = "crates/callbacks-legacy" }
+litellm-framing = { path = "crates/framer" }
 litellm-auth = { path = "crates/auth" }
 litellm-auth-aws = { path = "crates/auth-aws" }
 litellm-auth-azure = { path = "crates/auth-azure" }
 litellm-auth-gcp = { path = "crates/auth-gcp" }
+litellm-llms = { path = "crates/llms" }
+litellm-types = { path = "crates/types" }
+litellm-core-utils = { path = "crates/core-utils" }
 litellm-cache = { path = "crates/cache" }
 litellm-cache-memory = { path = "crates/cache-memory" }
 litellm-token-counter = { path = "crates/token-counter" }
-litellm-python-interop = { path = "crates/python-interop" }
+litellm-host-python = { path = "crates/host-python" }
+
+bytes = "1"
 pyo3 = "0.29.2"
 pyo3-async-runtimes = { version = "0.29.0", features = ["tokio-runtime"] }
 pythonize = "0.29.0"
 rand = "0.8"
 reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "multipart", "rustls-tls", "http2", "stream"] }
 rstest = "0.26.1"
+rstest_reuse = "0.7.0"
 rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
 rustls-native-certs = "0.8"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0", features = ["float_roundtrip"] }
+serde_with = { version = "=3.16.1", default-features = false, features = ["std", "macros"] }
 sha2 = "0.10"
 subtle = "2"
 thiserror = "2.0"
@@ -39,6 +48,7 @@ base64 = "0.22"
 moka = { version = "0.12.16", features = ["future"] }
 strum = { version = "0.28.0", features = ["derive"] }
 url = "2.5.8"
+time = { version = "0.3.53", features = ["parsing"] }
 criterion = "0.8.2"
 veil = "0.3.0"
 

litellm-rust/crates/auth-azure/src/resolve.rs

@@ -657,4 +657,49 @@ mod tests {
 
         assert!(matches!(error, Error::CredentialChain(errors) if errors.len() == 2));
     }
+
+    #[derive(Debug)]
+    struct CallerToken(&'static str);
+
+    impl litellm_auth::TokenProvider for CallerToken {
+        fn acquire(&self) -> litellm_auth::TokenFuture<'_> {
+            Box::pin(async move {
+                Ok(ResolvedCredential::AccessToken {
+                    token: SecretValue::new(self.0),
+                    expires_on: None,
+                })
+            })
+        }
+    }
+
+    fn caller_inputs(token: &'static str) -> AzureAuthInputs {
+        let params = json!({"azure_ad_token": "static-token"});
+        AzureAuthInputs {
+            azure_ad_token_provider: Some(litellm_auth::TokenProviderHandle::new(Arc::new(
+                CallerToken(token),
+            ))),
+            ..AzureAuthInputs::from_optional_params(params.as_object().unwrap()).unwrap()
+        }
+    }
+
+    #[tokio::test]
+    async fn caller_token_is_chosen_over_supplied_static_token() {
+        let credential = AzureAuthService::default()
+            .get_azure_ad_token(&caller_inputs("caller-token"), &|_| None)
+            .await
+            .unwrap()
+            .unwrap();
+
+        assert_eq!(credential.value().secret().expose(), "caller-token");
+    }
+
+    #[tokio::test]
+    async fn empty_caller_token_is_rejected() {
+        let error = AzureAuthService::default()
+            .get_azure_ad_token(&caller_inputs(""), &|_| None)
+            .await
+            .unwrap_err();
+
+        assert!(matches!(error, Error::EmptyAzureToken));
+    }
 }

litellm-rust/crates/auth/src/credential.rs

@@ -9,21 +9,6 @@ use crate::Error;
 
 use super::{ResolvedCredential, SecretValue, TokenProviderHandle};
 
-pub fn credential_index(requested: &str, names: &[String]) -> Option<usize> {
-    names.iter().position(|name| name == requested)
-}
-
-pub fn credential_default_fields<'a>(
-    supplied: &[String],
-    credential_fields: &'a [String],
-) -> Vec<&'a str> {
-    credential_fields
-        .iter()
-        .filter(|name| !supplied.contains(name))
-        .map(String::as_str)
-        .collect()
-}
-
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum CredentialFileRef {
     Path(PathBuf),

litellm-rust/crates/auth/src/lib.rs

@@ -47,7 +47,6 @@ impl<T> Sourced<T> {
 pub use credential::{
     CredentialFileRef, CredentialLookup, CredentialLookupFuture, CredentialPlan,
     CredentialPlanResolution, CredentialRef, CredentialResolver, CredentialResolverHandle,
-    credential_default_fields, credential_index,
 };
 pub use error::Error;
 pub use http::{CredentialPlacement, RequestAuth};

litellm-rust/crates/cache-redis/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "litellm-cache-redis"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+litellm-cache.workspace = true
+redis = "1.7.0"
+serde_json.workspace = true
+tokio.workspace = true
+
+[dev-dependencies]
+redis-test = "1.0.4"

litellm-rust/crates/cache-redis/src/cache.rs

@@ -0,0 +1,315 @@
+use std::sync::{Arc, Mutex, MutexGuard};
+use std::time::Duration;
+
+use litellm_cache::{
+    BaseCache, CacheConnectionResult, CacheConnectionStatus, CacheEntry, CacheFuture, CacheKwargs,
+    Error,
+};
+use redis::Commands;
+
+const DEFAULT_TTL: Duration = Duration::from_secs(600);
+const KEY_PREFIX: &str = "litellm-cache:";
+
+pub struct RedisCache<C = redis::Connection> {
+    connection: Arc<Mutex<C>>,
+    default_ttl: Duration,
+}
+
+impl RedisCache<redis::Connection> {
+    pub fn new(url: &str, default_ttl: Option<Duration>) -> Result<Self, Error> {
+        let client = redis::Client::open(url).map_err(|_| Error::Unavailable)?;
+        let connection = client.get_connection().map_err(|_| Error::Unavailable)?;
+        Ok(Self::with_connection(connection, default_ttl))
+    }
+}
+
+impl<C> RedisCache<C>
+where
+    C: redis::ConnectionLike + Send + 'static,
+{
+    fn with_connection(connection: C, default_ttl: Option<Duration>) -> Self {
+        Self {
+            connection: Arc::new(Mutex::new(connection)),
+            default_ttl: default_ttl.unwrap_or(DEFAULT_TTL),
+        }
+    }
+
+    fn connection(&self) -> Result<MutexGuard<'_, C>, Error> {
+        self.connection.lock().map_err(|_| Error::Unavailable)
+    }
+
+    fn namespaced_key(key: &str) -> String {
+        format!("{KEY_PREFIX}{key}")
+    }
+
+    fn namespaced_pattern() -> &'static str {
+        const PATTERN: &str = "litellm-cache:*";
+        PATTERN
+    }
+
+    fn encode(value: &CacheEntry) -> Result<Vec<u8>, Error> {
+        serde_json::to_vec(value).map_err(|_| Error::InvalidEntry)
+    }
+
+    fn decode(value: Vec<u8>) -> Result<CacheEntry, Error> {
+        serde_json::from_slice(&value).map_err(|_| Error::InvalidEntry)
+    }
+
+    fn ttl_seconds(ttl: Duration) -> u64 {
+        ttl.as_secs()
+            .saturating_add(u64::from(ttl.subsec_nanos() > 0))
+            .max(1)
+    }
+
+    fn run_blocking<T, F>(connection: Arc<Mutex<C>>, operation: F) -> CacheFuture<'static, T>
+    where
+        T: Send + 'static,
+        F: FnOnce(&mut C) -> Result<T, Error> + Send + 'static,
+    {
+        Box::pin(async move {
+            tokio::task::spawn_blocking(move || {
+                let mut connection = connection.lock().map_err(|_| Error::Unavailable)?;
+                operation(&mut connection)
+            })
+            .await
+            .map_err(|_| Error::Unavailable)?
+        })
+    }
+}
+
+impl<C> BaseCache for RedisCache<C>
+where
+    C: redis::ConnectionLike + Send + 'static,
+{
+    type Value = CacheEntry;
+
+    fn default_ttl(&self) -> Duration {
+        self.default_ttl
+    }
+
+    fn set_cache(&self, key: &str, value: Self::Value, kwargs: CacheKwargs) -> Result<(), Error> {
+        let payload = Self::encode(&value)?;
+        let ttl = Self::ttl_seconds(self.get_ttl(&kwargs));
+        self.connection()?
+            .set_ex::<_, _, ()>(Self::namespaced_key(key), payload, ttl)
+            .map_err(|_| Error::Unavailable)
+    }
+
+    fn get_cache(&self, key: &str, _: &CacheKwargs) -> Result<Option<Self::Value>, Error> {
+        self.connection()?
+            .get::<_, Option<Vec<u8>>>(Self::namespaced_key(key))
+            .map_err(|_| Error::Unavailable)?
+            .map(Self::decode)
+            .transpose()
+    }
+
+    fn delete_cache(&self, key: &str) -> Result<(), Error> {
+        self.connection()?
+            .del::<_, ()>(Self::namespaced_key(key))
+            .map_err(|_| Error::Unavailable)
+    }
+
+    fn flush_cache(&self) -> Result<(), Error> {
+        let mut connection = self.connection()?;
+        let keys = connection
+            .scan_match(Self::namespaced_pattern())
+            .map_err(|_| Error::Unavailable)?
+            .collect::<redis::RedisResult<Vec<String>>>()
+            .map_err(|_| Error::Unavailable)?;
+        if keys.is_empty() {
+            return Ok(());
+        }
+        connection
+            .del::<_, usize>(keys)
+            .map(|_| ())
+            .map_err(|_| Error::Unavailable)
+    }
+
+    fn async_set_cache<'a>(
+        &'a self,
+        key: &'a str,
+        value: Self::Value,
+        kwargs: CacheKwargs,
+    ) -> CacheFuture<'a, ()> {
+        let payload = Self::encode(&value);
+        let key = Self::namespaced_key(key);
+        let ttl = Self::ttl_seconds(self.get_ttl(&kwargs));
+        Self::run_blocking(Arc::clone(&self.connection), move |connection| {
+            connection
+                .set_ex::<_, _, ()>(key, payload?, ttl)
+                .map_err(|_| Error::Unavailable)
+        })
+    }
+
+    fn async_get_cache<'a>(
+        &'a self,
+        key: &'a str,
+        _: &'a CacheKwargs,
+    ) -> CacheFuture<'a, Option<Self::Value>> {
+        let key = Self::namespaced_key(key);
+        Box::pin(async move {
+            Self::run_blocking(Arc::clone(&self.connection), move |connection| {
+                connection
+                    .get::<_, Option<Vec<u8>>>(key)
+                    .map_err(|_| Error::Unavailable)
+            })
+            .await?
+            .map(Self::decode)
+            .transpose()
+        })
+    }
+
+    fn async_set_cache_pipeline<'a>(
+        &'a self,
+        cache_list: Vec<(String, Self::Value)>,
+        kwargs: CacheKwargs,
+    ) -> CacheFuture<'a, ()> {
+        let entries = cache_list
+            .into_iter()
+            .map(|(key, value)| {
+                Self::encode(&value).map(|payload| (Self::namespaced_key(&key), payload))
+            })
+            .collect::<Result<Vec<_>, _>>();
+        let ttl = Self::ttl_seconds(self.get_ttl(&kwargs));
+        Self::run_blocking(Arc::clone(&self.connection), move |connection| {
+            for (key, payload) in entries? {
+                connection
+                    .set_ex::<_, _, ()>(key, payload, ttl)
+                    .map_err(|_| Error::Unavailable)?;
+            }
+            Ok(())
+        })
+    }
+
+    fn async_delete_cache<'a>(&'a self, key: &'a str) -> CacheFuture<'a, ()> {
+        let key = Self::namespaced_key(key);
+        Self::run_blocking(Arc::clone(&self.connection), move |connection| {
+            connection.del::<_, ()>(key).map_err(|_| Error::Unavailable)
+        })
+    }
+
+    fn disconnect(&self) -> CacheFuture<'_, ()> {
+        Box::pin(async { Ok(()) })
+    }
+
+    fn test_connection(&self) -> CacheFuture<'_, CacheConnectionResult> {
+        Box::pin(async move {
+            Self::run_blocking(Arc::clone(&self.connection), |connection| {
+                redis::cmd("PING")
+                    .query::<String>(connection)
+                    .map_err(|_| Error::Unavailable)
+            })
+            .await?;
+            Ok(CacheConnectionResult {
+                status: CacheConnectionStatus::Success,
+                message: "Redis cache connection test successful".into(),
+                error: None,
+            })
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::RedisCache;
+    use litellm_cache::{BaseCache, CacheEntry, CacheKwargs};
+    use redis_test::{MockCmd, MockRedisConnection};
+    use serde_json::json;
+    use std::time::Duration;
+
+    fn entry() -> CacheEntry {
+        CacheEntry {
+            timestamp: 123.0,
+            response: json!({"choices": [{"text": "cached"}]}),
+        }
+    }
+
+    #[test]
+    fn cache_entries_round_trip_through_json() {
+        let entry = entry();
+        let encoded = RedisCache::<redis::Connection>::encode(&entry).unwrap();
+        assert_eq!(
+            RedisCache::<redis::Connection>::decode(encoded).unwrap(),
+            entry
+        );
+    }
+
+    #[test]
+    fn invalid_json_is_rejected() {
+        assert!(RedisCache::<redis::Connection>::decode(b"not json".to_vec()).is_err());
+    }
+
+    #[test]
+    fn ttl_seconds_rounds_up_and_keeps_expiration_positive() {
+        assert_eq!(
+            RedisCache::<redis::Connection>::ttl_seconds(Duration::ZERO),
+            1
+        );
+        assert_eq!(
+            RedisCache::<redis::Connection>::ttl_seconds(Duration::from_millis(1500)),
+            2
+        );
+        assert_eq!(
+            RedisCache::<redis::Connection>::ttl_seconds(Duration::from_secs(15)),
+            15
+        );
+    }
+
+    #[test]
+    fn redis_commands_round_trip_entries_and_delete_only_namespaced_keys() {
+        let value = entry();
+        let payload = RedisCache::<redis::Connection>::encode(&value).unwrap();
+        let connection = MockRedisConnection::new([
+            MockCmd::new(
+                redis::cmd("SETEX")
+                    .arg("litellm-cache:key")
+                    .arg(600)
+                    .arg(payload.clone()),
+                Ok("OK"),
+            ),
+            MockCmd::new(redis::cmd("GET").arg("litellm-cache:key"), Ok(payload)),
+            MockCmd::new(redis::cmd("DEL").arg("litellm-cache:key"), Ok(1u32)),
+        ])
+        .assert_all_commands_consumed();
+        let cache = RedisCache::with_connection(connection, None);
+
+        cache
+            .set_cache("key", value.clone(), CacheKwargs::default())
+            .unwrap();
+        assert_eq!(
+            cache.get_cache("key", &CacheKwargs::default()).unwrap(),
+            Some(value)
+        );
+        cache.delete_cache("key").unwrap();
+    }
+
+    #[test]
+    fn flush_scans_and_deletes_only_cache_keys() {
+        let connection = MockRedisConnection::new([
+            MockCmd::new(
+                redis::cmd("SCAN")
+                    .cursor_arg(0)
+                    .arg("MATCH")
+                    .arg("litellm-cache:*"),
+                Ok(redis_test::redis_value!(["0", ["litellm-cache:key"]])),
+            ),
+            MockCmd::new(redis::cmd("DEL").arg("litellm-cache:key"), Ok(1u32)),
+        ])
+        .assert_all_commands_consumed();
+        let cache = RedisCache::with_connection(connection, None);
+
+        cache.flush_cache().unwrap();
+    }
+
+    #[tokio::test]
+    async fn test_connection_runs_ping_off_executor() {
+        let connection = MockRedisConnection::new([MockCmd::new(redis::cmd("PING"), Ok("PONG"))])
+            .assert_all_commands_consumed();
+        let cache = RedisCache::with_connection(connection, None);
+
+        assert_eq!(
+            cache.test_connection().await.unwrap().status,
+            litellm_cache::CacheConnectionStatus::Success
+        );
+    }
+}

litellm-rust/crates/cache-redis/src/lib.rs

@@ -0,0 +1,3 @@
+mod cache;
+
+pub use cache::RedisCache;

litellm-rust/crates/cache-redis/tests/cache.rs

@@ -0,0 +1,6 @@
+use litellm_cache_redis::RedisCache;
+
+#[test]
+fn constructor_rejects_invalid_urls() {
+    assert!(RedisCache::new("not a redis url", None).is_err());
+}

litellm-rust/crates/callbacks-legacy/AGENTS.md

@@ -0,0 +1,17 @@
+- Target invariants, not completion claims
+- Keep this crate the legacy `@client` wrapper as the native call sees it, and nothing else: the `Logging` contract (`function_setup`, the deployment hooks, `pre_call`/`post_call`, the sync and async success and failure fan-out, the deferred proxy release, the argument sharing those callbacks rely on) plus the kwargs rewrites the wrapper makes on the way in (credential-name inheritance, the budget and retry-count limits)
+  - The driver in `litellm-host-python`, the routes and core see one `CallbackAdapter`; they never learn which Python objects consume a call
+  - `PublicCall` is the caller's call as `Logging` sees it: the positional arguments, the keyword view as the legacy path rewrites it (setup, deployment hook, prepare) and the bound request object whose attributes back keywords the caller omitted; routes hand it over through `run_legacy_call` and keep no copy
+- `setup` decides once who owns the `Logging` instance and returns it as `CallSetup.bridge_owned`; `PythonLogger` carries it and nothing on the instance records it
+  - A logger the caller passed as `litellm_logging_obj` is caller-owned and observed in full, because the caller reads it after the call; the proxy is the live case
+  - A logger `function_setup` built for this call is bridge-owned, so each fan-out phase is skipped when `callbacks_needed` finds no registry, dynamic callback, `logger_fn` or debug switch for it; cost, timing and response metadata still run
+- Callbacks receive the caller's own objects and may mutate them; this crate alone carries that obligation
+  - Retain complete boundary arguments, opaque unknown values, aliases, omitted/default distinctions and deliberate copies; preserve the established deployment-hook kwargs view
+  - Re-alias every `passthrough_fields` body key to the caller's object before `pre_call`; a keyword wins over the request attribute even when it is an explicit `None`
+  - Retain independently captured body/header roots from `pre_call` to `post_call`; in-place mutation reaches the wire, envelope field replacement is visible to later callbacks only
+  - A later kind of callback host (WASM, in-process Rust) has none of these obligations, so they stay out of `litellm-callbacks`, `litellm-host-python` and the bridge; the only facts that cross from the route are the prepared keyword view and `RequestContext.passthrough_fields`
+- Success and failure handlers receive the exact selected public response or exception; logging projections, redaction and snapshots keep their own copy contracts
+  - Ordinary failure-handler errors cannot suppress the other eligible family or replace the mapped provider error; a cancellation ends the call with no further dispatch
+  - Dispatch errors never replay provider work or trigger the opposite outcome; the proxy's acceptance or rejection releases deferred success at most once
+  - Delivery follows the registry, not the callable's type: direct, awaited, executor-submitted, logging-worker and deferred paths stay distinct
+- Traverse every retained Python edge; `close` is idempotent and restores the correlation context once

litellm-rust/crates/callbacks-legacy/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "litellm-callbacks-legacy"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+autotests = false
+
+[dependencies]
+litellm-callbacks.workspace = true
+litellm-host-python.workspace = true
+pyo3.workspace = true
+
+[dev-dependencies]
+rstest.workspace = true
+serde_json.workspace = true

litellm-rust/crates/callbacks-legacy/src/adapter.rs

@@ -0,0 +1,385 @@
+//! The legacy `Logging` contract as one adapter: every event and interception the driver
+//! raises is answered with the same `Logging` calls, in the same order, as the Python
+//! `@client` path makes them.
+
+use litellm_callbacks::event::{CallEvent, FailureOrigin, RequestContext, Timing, WireRequest};
+use litellm_host_python::{
+    AdapterStep, CallbackAdapter, PublicValue, from_py, missing_state, to_py,
+};
+use pyo3::{
+    exceptions::{PyBaseException, PyException},
+    gc::{PyTraverseError, PyVisit},
+    prelude::*,
+    types::PyDict,
+};
+
+use crate::{
+    DeploymentHooks, LegacyCallbacks, PublicCall, PythonLogger,
+    deferred::{PendingLogging, PendingSuccess},
+    finalize, is_internal_call, prepare, setup,
+};
+
+/// What the legacy contract needs to know about the route it is logging.
+#[derive(Clone, Copy, Debug)]
+pub struct LegacySurface {
+    pub call_type: &'static str,
+    /// What `Logging.pre_call` is told the input was.
+    pub input_description: &'static str,
+}
+
+enum Pending {
+    DeploymentPreCall,
+    DeploymentPostCall,
+    DeploymentFailure,
+    AsyncFailure,
+}
+
+pub struct LegacyLogging {
+    surface: LegacySurface,
+    call: PublicCall,
+    logger: Option<PythonLogger>,
+    start: Py<PyAny>,
+    end: Option<Py<PyAny>>,
+    response: Option<Py<PyAny>>,
+    error: Option<Py<PyBaseException>>,
+    body: Option<Py<PyDict>>,
+    headers: Option<Py<PyDict>>,
+    asynchronous: bool,
+    internal: bool,
+    pending: Option<Pending>,
+}
+
+fn datetime(py: Python<'_>, epoch_seconds: f64) -> PyResult<Py<PyAny>> {
+    py.import("datetime")?
+        .getattr("datetime")?
+        .call_method1("fromtimestamp", (epoch_seconds,))
+        .map(Bound::unbind)
+}
+
+fn is_cancellation(py: Python<'_>, error: &PyErr) -> bool {
+    !error.is_instance_of::<PyException>(py)
+}
+
+impl LegacyLogging {
+    pub fn new(
+        py: Python<'_>,
+        surface: LegacySurface,
+        call: PublicCall,
+        asynchronous: bool,
+    ) -> Self {
+        Self {
+            surface,
+            call,
+            logger: None,
+            start: py.None(),
+            end: None,
+            response: None,
+            error: None,
+            body: None,
+            headers: None,
+            asynchronous,
+            internal: false,
+            pending: None,
+        }
+    }
+
+    /// Deployment hooks are awaited, and Python's synchronous `@client` wrapper never
+    /// runs them.
+    fn deployment_hooks(&self, py: Python<'_>) -> PyResult<bool> {
+        Ok(self.asynchronous && DeploymentHooks::needed(py)?)
+    }
+
+    fn logger(&self) -> PyResult<&PythonLogger> {
+        self.logger.as_ref().ok_or_else(|| {
+            pyo3::exceptions::PyRuntimeError::new_err("call logging is not initialized")
+        })
+    }
+
+    fn prepare(&mut self, py: Python<'_>) -> PyResult<AdapterStep> {
+        let prepared = prepare(py, self.call.kwargs().bind(py), self.logger()?)?.unbind();
+        self.call.set_kwargs(prepared);
+        Ok(AdapterStep::Arguments(self.call.kwargs().clone_ref(py)))
+    }
+
+    fn finalize(&mut self, py: Python<'_>) -> PyResult<AdapterStep> {
+        finalize(
+            py,
+            &self.response,
+            self.logger()?,
+            self.call.kwargs(),
+            &self.start,
+            &self.end,
+        )?;
+        self.response
+            .as_ref()
+            .map(|response| AdapterStep::Response(response.clone_ref(py)))
+            .ok_or_else(missing_state)
+    }
+
+    fn dispatch_success(&self, py: Python<'_>) -> PyResult<()> {
+        match self.try_dispatch_success(py) {
+            Err(error) if error.is_instance_of::<PyException>(py) => {
+                error.write_unraisable(py, self.logger.as_ref().map(|logger| logger.object(py)));
+                Ok(())
+            }
+            result => result,
+        }
+    }
+
+    fn try_dispatch_success(&self, py: Python<'_>) -> PyResult<()> {
+        let logger = self.logger()?;
+        let pending = || PendingSuccess {
+            logger: logger.clone_ref(py),
+            response: self.response.as_ref().map(|value| value.clone_ref(py)),
+            start: self.start.clone_ref(py),
+            end: self.end.as_ref().map(|value| value.clone_ref(py)),
+        };
+        if !self.asynchronous {
+            return pending().sync(py);
+        }
+        if !self.internal
+            && self
+                .call
+                .kwargs()
+                .bind(py)
+                .get_item("fallbacks")?
+                .is_none_or(|value| value.is_none())
+        {
+            if !logger.callbacks_needed(py, "async_success")? {
+                logger.success_bookkeeping(py, &self.response, &self.start, &self.end, true)?;
+            } else if logger.defers_async_logging(py) {
+                let pending = Py::new(
+                    py,
+                    PendingLogging {
+                        pending: Some(pending()),
+                    },
+                )?;
+                logger.defer_success(py, pending.bind(py).as_any())?;
+            } else {
+                pending().asynchronous(py)?;
+            }
+        }
+        logger.sync_success_for_async_call(py, &self.response, &self.start, &self.end)
+    }
+
+    /// The sync failure handler, then the async one for async calls. Ordinary handler
+    /// errors never replace the selected failure or suppress the other family; a
+    /// cancellation does end the call.
+    fn dispatch_failure(&mut self, py: Python<'_>) -> PyResult<AdapterStep> {
+        let (Some(logger), Some(error)) = (&self.logger, &self.error) else {
+            return Ok(AdapterStep::Done);
+        };
+        if self.asynchronous && self.internal {
+            return Ok(AdapterStep::Done);
+        }
+        if let Err(failure) = logger.failure(py, error, &self.start, &self.end, false)
+            && is_cancellation(py, &failure)
+        {
+            return Err(failure);
+        }
+        if !self.asynchronous {
+            return Ok(AdapterStep::Done);
+        }
+        match logger.failure(py, error, &self.start, &self.end, true) {
+            Ok(Some(awaitable)) => {
+                self.pending = Some(Pending::AsyncFailure);
+                Ok(AdapterStep::Await(awaitable))
+            }
+            Ok(None) => Ok(AdapterStep::Done),
+            Err(failure) if is_cancellation(py, &failure) => Err(failure),
+            Err(_) => Ok(AdapterStep::Done),
+        }
+    }
+}
+
+impl CallbackAdapter for LegacyLogging {
+    fn begin(
+        &mut self,
+        py: Python<'_>,
+        arguments: Py<PyDict>,
+        started_at: f64,
+    ) -> PyResult<AdapterStep> {
+        self.call.set_kwargs(arguments);
+        self.start = datetime(py, started_at)?;
+        self.internal = is_internal_call(py)?;
+        let result = setup(
+            py,
+            self.surface.call_type,
+            self.call.args(),
+            self.call.kwargs(),
+            &self.start,
+            self.asynchronous,
+        )?;
+        self.logger = Some(result.logger()?);
+        self.call.set_kwargs(result.kwargs()?);
+        if self.deployment_hooks(py)? {
+            self.pending = Some(Pending::DeploymentPreCall);
+            return Ok(AdapterStep::Await(DeploymentHooks::before_call(
+                py,
+                self.call.kwargs(),
+                self.surface.call_type,
+            )?));
+        }
+        self.prepare(py)
+    }
+
+    fn before_send(
+        &mut self,
+        py: Python<'_>,
+        wire: Box<WireRequest>,
+        context: &RequestContext,
+    ) -> PyResult<AdapterStep> {
+        let logger = self.logger()?;
+        logger.update_from_kwargs(py, self.call.kwargs(), &wire, context)?;
+        if !logger.callbacks_needed(py, "payload")? {
+            logger.record_api_call_start(py)?;
+            return Ok(AdapterStep::Wire(wire));
+        }
+        let body = to_py(py, &wire.body)?
+            .into_bound(py)
+            .cast_into::<PyDict>()?;
+        for name in context.passthrough_fields.iter() {
+            if let Some(value) = self.call.lookup(py, name)? {
+                body.set_item(name, value)?;
+            }
+        }
+        let headers = PyDict::new(py);
+        for (name, value) in &wire.headers {
+            headers.set_item(name, value)?;
+        }
+        self.body = Some(body.clone().unbind());
+        self.headers = Some(headers.clone().unbind());
+        let api_key = self.call.lookup(py, "api_key")?;
+        self.logger()?.pre_call(
+            py,
+            self.surface.input_description,
+            api_key.as_ref(),
+            &body,
+            &headers,
+            &wire.url,
+        )?;
+        let headers = headers
+            .iter()
+            .map(|(name, value)| Ok((name.extract::<String>()?, value.extract::<String>()?)))
+            .collect::<PyResult<Vec<_>>>()?;
+        Ok(AdapterStep::Wire(Box::new(WireRequest {
+            body: from_py(&body)?,
+            headers,
+            ..*wire
+        })))
+    }
+
+    fn after_success(
+        &mut self,
+        py: Python<'_>,
+        response: Py<PyAny>,
+        timing: Timing,
+    ) -> PyResult<AdapterStep> {
+        self.end = Some(datetime(py, timing.end_time)?);
+        self.response = Some(response);
+        if self.deployment_hooks(py)? {
+            self.pending = Some(Pending::DeploymentPostCall);
+            return Ok(AdapterStep::Await(DeploymentHooks::after_success(
+                py,
+                self.call.kwargs(),
+                &self.response,
+                self.surface.call_type,
+            )?));
+        }
+        self.finalize(py)
+    }
+
+    fn emit(
+        &mut self,
+        py: Python<'_>,
+        event: &CallEvent,
+        public: Option<PublicValue<'_>>,
+    ) -> PyResult<AdapterStep> {
+        match (event, public) {
+            (CallEvent::ResponseReceived { raw }, _) => {
+                let logger = self.logger()?;
+                if logger.callbacks_needed(py, "payload")? {
+                    logger.post_call(py, &raw.body, self.body.as_ref(), self.headers.as_ref())?;
+                }
+                Ok(AdapterStep::Done)
+            }
+            (CallEvent::Succeeded { timing }, Some(PublicValue::Response(response))) => {
+                self.end = Some(datetime(py, timing.end_time)?);
+                self.response = Some(response.clone_ref(py));
+                self.dispatch_success(py)?;
+                Ok(AdapterStep::Done)
+            }
+            (CallEvent::Failed { timing, origin }, Some(PublicValue::Error(error))) => {
+                self.end = Some(datetime(py, timing.end_time)?);
+                self.error = Some(error.clone_ref(py).into_value(py));
+                if *origin == FailureOrigin::Call
+                    && self.logger.is_some()
+                    && self.deployment_hooks(py)?
+                {
+                    let error = self.error.as_ref().ok_or_else(missing_state)?;
+                    self.pending = Some(Pending::DeploymentFailure);
+                    return Ok(AdapterStep::Await(DeploymentHooks::after_failure(
+                        py,
+                        self.call.kwargs(),
+                        error,
+                        self.surface.call_type,
+                    )?));
+                }
+                self.dispatch_failure(py)
+            }
+            _ => Err(missing_state()),
+        }
+    }
+
+    fn resume(&mut self, py: Python<'_>, result: PyResult<Py<PyAny>>) -> PyResult<AdapterStep> {
+        match self.pending.take().ok_or_else(missing_state)? {
+            Pending::DeploymentPreCall => {
+                self.call
+                    .set_kwargs(result?.into_bound(py).cast_into::<PyDict>()?.unbind());
+                self.prepare(py)
+            }
+            Pending::DeploymentPostCall => {
+                self.response = Some(result?);
+                self.finalize(py)
+            }
+            Pending::DeploymentFailure => self.dispatch_failure(py),
+            Pending::AsyncFailure => match result {
+                Err(failure) if is_cancellation(py, &failure) => Err(failure),
+                _ => Ok(AdapterStep::Done),
+            },
+        }
+    }
+
+    fn close(&mut self, py: Python<'_>) {
+        if let Some(logger) = self.logger.take()
+            && let Err(error) = logger.restore_context(py)
+        {
+            error.write_unraisable(py, None);
+        }
+        self.body = None;
+        self.headers = None;
+    }
+
+    fn traverse(&self, visit: &PyVisit<'_>) -> Result<(), PyTraverseError> {
+        self.call.traverse(visit)?;
+        if let Some(logger) = &self.logger {
+            logger.traverse(visit)?;
+        }
+        visit.call(&self.start)?;
+        visit.call(&self.end)?;
+        visit.call(&self.response)?;
+        visit.call(&self.error)?;
+        visit.call(&self.body)?;
+        visit.call(&self.headers)
+    }
+}
+
+#[cfg(test)]
+#[path = "../tests/deployment_hooks.rs"]
+mod deployment_hooks_tests;
+#[cfg(test)]
+#[path = "../tests/payload.rs"]
+mod payload_tests;
+#[cfg(test)]
+#[path = "../tests/terminal.rs"]
+mod terminal_tests;

litellm-rust/crates/callbacks-legacy/src/call.rs

@@ -0,0 +1,179 @@
+//! The caller's public call as the legacy `Logging` contract sees it. Legacy callbacks
+//! receive these exact objects and may mutate them, so the call keeps them for its whole
+//! lifetime. No other callback host has that obligation, which is why nothing outside
+//! this crate holds them.
+
+use litellm_callbacks::{machine::Machine, route::Route};
+use litellm_host_python::{RouteHost, run_call};
+use pyo3::{
+    gc::{PyTraverseError, PyVisit},
+    prelude::*,
+    types::{PyDict, PyTuple},
+};
+
+use crate::{LegacyLogging, LegacySurface};
+
+pub struct PublicCall {
+    args: Py<PyTuple>,
+    kwargs: Py<PyDict>,
+    request: Py<PyAny>,
+}
+
+impl PublicCall {
+    /// Copies the keyword arguments once, so the legacy path's rewrites never reach the
+    /// caller's own dict while every value keeps its identity.
+    pub fn capture(
+        request: &Bound<'_, PyAny>,
+        args: &Bound<'_, PyTuple>,
+        kwargs: &Bound<'_, PyDict>,
+    ) -> PyResult<Self> {
+        Ok(Self {
+            args: args.clone().unbind(),
+            kwargs: kwargs.copy()?.unbind(),
+            request: request.clone().unbind(),
+        })
+    }
+
+    pub(crate) fn args(&self) -> &Py<PyTuple> {
+        &self.args
+    }
+
+    /// The keyword view the legacy path currently reads: the caller's copy until
+    /// `function_setup`, then each rewrite (setup, deployment hook, prepare) in turn.
+    pub(crate) fn kwargs(&self) -> &Py<PyDict> {
+        &self.kwargs
+    }
+
+    pub(crate) fn set_kwargs(&mut self, kwargs: Py<PyDict>) {
+        self.kwargs = kwargs;
+    }
+
+    pub(crate) fn lookup<'py>(
+        &self,
+        py: Python<'py>,
+        name: &str,
+    ) -> PyResult<Option<Bound<'py, PyAny>>> {
+        lookup(self.kwargs.bind(py), self.request.bind(py), name)
+    }
+
+    pub(crate) fn traverse(&self, visit: &PyVisit<'_>) -> Result<(), PyTraverseError> {
+        visit.call(&self.args)?;
+        visit.call(&self.kwargs)?;
+        visit.call(&self.request)
+    }
+}
+
+/// The caller's own object for a public argument, as every legacy reader resolves it: the
+/// keyword if given, even an explicit `None`, else the bound request's attribute. A route
+/// host projecting from the prepared keyword view uses the same rule, so the callbacks
+/// and the provider see one object per argument.
+pub fn lookup<'py>(
+    kwargs: &Bound<'py, PyDict>,
+    request: &Bound<'py, PyAny>,
+    name: &str,
+) -> PyResult<Option<Bound<'py, PyAny>>> {
+    if let Some(value) = kwargs.get_item(name)? {
+        return Ok(Some(value));
+    }
+    request.getattr_opt(name)
+}
+
+/// Runs one native call under the legacy `Logging` contract: the route host projects from
+/// the keyword view the contract prepares, and the contract observes the call.
+pub fn run_legacy_call<H, M>(
+    py: Python<'_>,
+    surface: LegacySurface,
+    call: PublicCall,
+    machine: M,
+    route: H,
+    asynchronous: bool,
+) -> PyResult<Py<PyAny>>
+where
+    H: RouteHost + 'static,
+    M: Machine<Route = H::Route, Complete = <H::Route as Route>::Response> + 'static,
+{
+    let arguments = call.kwargs.clone_ref(py);
+    run_call(
+        py,
+        machine,
+        route,
+        Box::new(LegacyLogging::new(py, surface, call, asynchronous)),
+        arguments,
+        asynchronous,
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn capture<'py>(py: Python<'py>, source: &std::ffi::CStr) -> (PublicCall, Bound<'py, PyDict>) {
+        let locals = PyDict::new(py);
+        py.run(source, Some(&locals), Some(&locals)).unwrap();
+        let request = locals.get_item("request").unwrap().unwrap();
+        let kwargs = locals
+            .get_item("kwargs")
+            .unwrap()
+            .unwrap()
+            .cast_into::<PyDict>()
+            .unwrap();
+        let call = PublicCall::capture(&request, &PyTuple::empty(py), &kwargs).unwrap();
+        (call, locals)
+    }
+
+    #[test]
+    fn lookup_prefers_the_keyword_even_when_none_and_falls_back_to_the_request() {
+        Python::initialize();
+        Python::attach(|py| {
+            let (call, locals) = capture(
+                py,
+                c"
+key = object()
+document = {'type': 'document_url'}
+class Request:
+    api_key = 'from-request'
+    api_base = 'from-request'
+    document = document
+request = Request()
+kwargs = {'api_key': key, 'api_base': None}
+",
+            );
+            let key = locals.get_item("key").unwrap().unwrap();
+            let document = locals.get_item("document").unwrap().unwrap();
+            assert!(call.lookup(py, "api_key").unwrap().unwrap().is(&key));
+            assert!(call.lookup(py, "api_base").unwrap().unwrap().is_none());
+            assert!(call.lookup(py, "document").unwrap().unwrap().is(&document));
+            assert!(call.lookup(py, "model").unwrap().is_none());
+        });
+    }
+
+    #[test]
+    fn capture_copies_the_keyword_dict_without_copying_its_values() {
+        Python::initialize();
+        Python::attach(|py| {
+            let (call, locals) = capture(
+                py,
+                c"
+pages = [0]
+class Request:
+    pass
+request = Request()
+kwargs = {'pages': pages}
+",
+            );
+            let caller = locals
+                .get_item("kwargs")
+                .unwrap()
+                .unwrap()
+                .cast_into::<PyDict>()
+                .unwrap();
+            call.kwargs()
+                .bind(py)
+                .set_item("litellm_call_id", "call")
+                .unwrap();
+            assert!(!caller.contains("litellm_call_id").unwrap());
+            let pages = locals.get_item("pages").unwrap().unwrap();
+            assert!(call.lookup(py, "pages").unwrap().unwrap().is(&pages));
+        });
+    }
+}

litellm-rust/crates/callbacks-legacy/src/callbacks.rs

@@ -0,0 +1,404 @@
+//! Callback fan-out over litellm's `Logging` object: which callbacks are registered,
+//! the deferred and worker-submitted success paths, and the sync-callbacks-for-async-calls
+//! duplication. All of it expires with the legacy callback contract.
+
+use litellm_callbacks::event::{RequestContext, WireRequest};
+use litellm_host_python::to_py;
+use pyo3::{exceptions::PyBaseException, prelude::*, types::PyDict};
+
+use crate::logger::PythonLogger;
+
+pub trait LegacyCallbacks {
+    fn callbacks_needed(&self, py: Python<'_>, phase: &str) -> PyResult<bool>;
+
+    /// `Logging.update_from_kwargs`: what the logger is told about the request it is
+    /// about to see, with consumed credentials redacted.
+    fn update_from_kwargs(
+        &self,
+        py: Python<'_>,
+        kwargs: &Py<PyDict>,
+        wire: &WireRequest,
+        context: &RequestContext,
+    ) -> PyResult<()>;
+
+    fn record_api_call_start(&self, py: Python<'_>) -> PyResult<()>;
+
+    /// `Logging.pre_call`, or its payload-free shortcut when no input callback listens.
+    fn pre_call(
+        &self,
+        py: Python<'_>,
+        input: &str,
+        api_key: Option<&Bound<'_, PyAny>>,
+        body: &Bound<'_, PyDict>,
+        headers: &Bound<'_, PyDict>,
+        url: &str,
+    ) -> PyResult<()>;
+
+    /// `Logging.post_call`, or its payload-free shortcut when no input callback listens.
+    fn post_call(
+        &self,
+        py: Python<'_>,
+        original_response: &str,
+        body: Option<&Py<PyDict>>,
+        headers: Option<&Py<PyDict>>,
+    ) -> PyResult<()>;
+
+    fn defers_async_logging(&self, py: Python<'_>) -> bool;
+
+    fn defer_success(&self, py: Python<'_>, pending: &Bound<'_, PyAny>) -> PyResult<()>;
+
+    fn sync_success_for_async_call(
+        &self,
+        py: Python<'_>,
+        response: &Option<Py<PyAny>>,
+        start: &Py<PyAny>,
+        end: &Option<Py<PyAny>>,
+    ) -> PyResult<()>;
+
+    fn failure(
+        &self,
+        py: Python<'_>,
+        error: &Py<PyBaseException>,
+        start: &Py<PyAny>,
+        end: &Option<Py<PyAny>>,
+        asynchronous: bool,
+    ) -> PyResult<Option<Py<PyAny>>>;
+
+    fn submit_success(
+        &self,
+        py: Python<'_>,
+        response: &Option<Py<PyAny>>,
+        start: &Py<PyAny>,
+        end: &Option<Py<PyAny>>,
+    ) -> PyResult<()>;
+
+    fn enqueue_success(
+        &self,
+        py: Python<'_>,
+        response: &Option<Py<PyAny>>,
+        start: &Py<PyAny>,
+        end: &Option<Py<PyAny>>,
+    ) -> PyResult<()>;
+}
+
+impl LegacyCallbacks for PythonLogger {
+    fn callbacks_needed(&self, py: Python<'_>, phase: &str) -> PyResult<bool> {
+        if !self.bridge_owned() {
+            return Ok(true);
+        }
+        py.import("litellm.rust_bridge.legacy_callbacks")?
+            .getattr("callbacks_needed")?
+            .call1((self.object(py), phase))?
+            .extract()
+    }
+
+    fn update_from_kwargs(
+        &self,
+        py: Python<'_>,
+        kwargs: &Py<PyDict>,
+        wire: &WireRequest,
+        context: &RequestContext,
+    ) -> PyResult<()> {
+        let secret_fields: Vec<&str> = context.secret_fields.iter().map(String::as_str).collect();
+        let update = PyDict::new(py);
+        update.set_item("kwargs", redact(py, kwargs.bind(py), &secret_fields)?)?;
+        update.set_item("model", &context.model)?;
+        update.set_item(
+            "optional_params",
+            redact(
+                py,
+                &to_py(py, &context.optional_params)?
+                    .into_bound(py)
+                    .cast_into::<PyDict>()?,
+                &secret_fields,
+            )?,
+        )?;
+        let params = PyDict::new(py);
+        params.set_item(
+            "litellm_call_id",
+            kwargs.bind(py).get_item("litellm_call_id")?,
+        )?;
+        params.set_item("api_base", &wire.url)?;
+        for name in ["logger_fn", "litellm_request_debug"] {
+            if let Some(value) = kwargs.bind(py).get_item(name)? {
+                params.set_item(name, value)?;
+            }
+        }
+        for name in custom_pricing_fields(py)? {
+            if let Some(value) = kwargs.bind(py).get_item(&name)?
+                && !value.is_none()
+            {
+                params.set_item(name, value)?;
+            }
+        }
+        update.set_item("litellm_params", params)?;
+        update.set_item("custom_llm_provider", &context.custom_llm_provider)?;
+        self.object(py)
+            .call_method("update_from_kwargs", (), Some(&update))?;
+        Ok(())
+    }
+
+    fn record_api_call_start(&self, py: Python<'_>) -> PyResult<()> {
+        self.object(py).call_method0("record_api_call_start_time")?;
+        Ok(())
+    }
+
+    fn pre_call(
+        &self,
+        py: Python<'_>,
+        input: &str,
+        api_key: Option<&Bound<'_, PyAny>>,
+        body: &Bound<'_, PyDict>,
+        headers: &Bound<'_, PyDict>,
+        url: &str,
+    ) -> PyResult<()> {
+        let additional = PyDict::new(py);
+        additional.set_item("complete_input_dict", body)?;
+        additional.set_item("headers", headers)?;
+        additional.set_item("api_base", url)?;
+        let kwargs = PyDict::new(py);
+        kwargs.set_item("input", input)?;
+        kwargs.set_item("api_key", api_key)?;
+        kwargs.set_item("additional_args", &additional)?;
+        if self.callbacks_needed(py, "input")? {
+            self.object(py).call_method("pre_call", (), Some(&kwargs))?;
+        } else {
+            self.object(py)
+                .call_method("_pre_call", (), Some(&kwargs))?;
+            self.record_api_call_start(py)?;
+        }
+        Ok(())
+    }
+
+    fn post_call(
+        &self,
+        py: Python<'_>,
+        original_response: &str,
+        body: Option<&Py<PyDict>>,
+        headers: Option<&Py<PyDict>>,
+    ) -> PyResult<()> {
+        let additional = PyDict::new(py);
+        additional.set_item("complete_input_dict", body)?;
+        additional.set_item("headers", headers)?;
+        if self.callbacks_needed(py, "input")? {
+            let kwargs = PyDict::new(py);
+            kwargs.set_item("original_response", original_response)?;
+            kwargs.set_item("additional_args", &additional)?;
+            self.object(py)
+                .call_method("post_call", (), Some(&kwargs))?;
+        } else {
+            let response = py
+                .import("json")?
+                .call_method1("dumps", (original_response,))?;
+            self.object(py).call_method1(
+                "record_post_call",
+                (response, py.None(), py.None(), additional),
+            )?;
+        }
+        Ok(())
+    }
+    fn defers_async_logging(&self, py: Python<'_>) -> bool {
+        self.object(py)
+            .getattr("_defer_async_logging")
+            .is_ok_and(|value| value.is_truthy().unwrap_or(false))
+    }
+
+    fn defer_success(&self, py: Python<'_>, pending: &Bound<'_, PyAny>) -> PyResult<()> {
+        self.object(py).setattr("_native_pending_logging", pending)
+    }
+
+    fn sync_success_for_async_call(
+        &self,
+        py: Python<'_>,
+        response: &Option<Py<PyAny>>,
+        start: &Py<PyAny>,
+        end: &Option<Py<PyAny>>,
+    ) -> PyResult<()> {
+        if !self.callbacks_needed(py, "sync_success_async")? {
+            return Ok(());
+        }
+        self.object(py).call_method1(
+            "handle_sync_success_callbacks_for_async_calls",
+            (response, start, end),
+        )?;
+        Ok(())
+    }
+
+    fn failure(
+        &self,
+        py: Python<'_>,
+        error: &Py<PyBaseException>,
+        start: &Py<PyAny>,
+        end: &Option<Py<PyAny>>,
+        asynchronous: bool,
+    ) -> PyResult<Option<Py<PyAny>>> {
+        if !self.callbacks_needed(
+            py,
+            if asynchronous {
+                "async_failure"
+            } else {
+                "sync_failure"
+            },
+        )? {
+            py.import("litellm.rust_bridge.legacy_callbacks")?
+                .getattr("failure_bookkeeping")?
+                .call1((self.object(py), error, start, end, asynchronous))?;
+            return Ok(None);
+        }
+        let trace = py
+            .import("traceback")?
+            .getattr("format_exception")?
+            .call1((error,))?;
+        let trace = pyo3::types::PyString::new(py, "").call_method1("join", (trace,))?;
+        let value = self.object(py).call_method1(
+            if asynchronous {
+                "async_failure_handler"
+            } else {
+                "failure_handler"
+            },
+            (error, trace, start, end),
+        )?;
+        Ok(asynchronous.then(|| value.unbind()))
+    }
+    fn submit_success(
+        &self,
+        py: Python<'_>,
+        response: &Option<Py<PyAny>>,
+        start: &Py<PyAny>,
+        end: &Option<Py<PyAny>>,
+    ) -> PyResult<()> {
+        if !self.callbacks_needed(py, "sync_success")? {
+            return self.success_bookkeeping(py, response, start, end, false);
+        }
+        let context = py.import("contextvars")?.call_method0("copy_context")?;
+        py.import("litellm.litellm_core_utils.litellm_logging")?
+            .getattr("executor")?
+            .call_method1(
+                "submit",
+                (
+                    context.getattr("run")?,
+                    self.object(py).getattr("success_handler")?,
+                    response,
+                    start,
+                    end,
+                ),
+            )?;
+        Ok(())
+    }
+
+    fn enqueue_success(
+        &self,
+        py: Python<'_>,
+        response: &Option<Py<PyAny>>,
+        start: &Py<PyAny>,
+        end: &Option<Py<PyAny>>,
+    ) -> PyResult<()> {
+        if !self.callbacks_needed(py, "async_success")? {
+            return self.success_bookkeeping(py, response, start, end, true);
+        }
+        let context = py.import("contextvars")?.call_method0("copy_context")?;
+        let worker = py
+            .import("litellm.litellm_core_utils.logging_worker")?
+            .getattr("GLOBAL_LOGGING_WORKER")?
+            .getattr("ensure_initialized_and_enqueue")?;
+        let coroutine = self
+            .object(py)
+            .call_method1("async_success_handler", (response, start, end))?;
+        let enqueue = context.call_method1("run", (worker, &coroutine));
+        if enqueue.is_err()
+            && let Err(error) = coroutine.call_method0("close")
+        {
+            error.write_unraisable(py, Some(&coroutine));
+        }
+        enqueue.map(|_| ())
+    }
+}
+
+fn custom_pricing_fields(py: Python<'_>) -> PyResult<Vec<String>> {
+    py.import("litellm.types.utils")?
+        .getattr("CustomPricingLiteLLMParams")?
+        .getattr("model_fields")?
+        .cast_into::<PyDict>()?
+        .keys()
+        .iter()
+        .map(|name| name.extract::<String>())
+        .collect()
+}
+
+fn redact(
+    py: Python<'_>,
+    params: &Bound<'_, PyDict>,
+    secret_fields: &[&str],
+) -> PyResult<Py<PyDict>> {
+    let redacted = PyDict::new(py);
+    for (name, value) in params {
+        let name = name.extract::<String>()?;
+        if name == "proxy_server_request" {
+            continue;
+        }
+        if secret_fields.contains(&name.as_str()) {
+            redacted.set_item(name, "****")?;
+        } else {
+            redacted.set_item(name, value)?;
+        }
+    }
+    Ok(redacted.unbind())
+}
+
+/// Proxy-internal calls skip the legacy success fan-out.
+pub fn is_internal_call(py: Python<'_>) -> PyResult<bool> {
+    py.import("litellm._internal_context")?
+        .getattr("is_internal_call")?
+        .call_method0("get")?
+        .extract()
+}
+
+#[cfg(test)]
+mod tests {
+    use pyo3::types::PyDict;
+
+    use super::*;
+
+    fn logger_whose_registries_need_no_input(py: Python<'_>, bridge_owned: bool) -> PythonLogger {
+        let locals = PyDict::new(py);
+        py.run(
+            c"
+import sys
+import types
+for name in ('litellm', 'litellm.rust_bridge', 'litellm.rust_bridge.legacy_callbacks'):
+    sys.modules.setdefault(name, types.ModuleType(name))
+legacy = sys.modules['litellm.rust_bridge.legacy_callbacks']
+legacy.callbacks_needed = lambda logger, phase: logger.needed.get(phase, True)
+class Logger:
+    needed = {'input': False}
+logger = Logger()
+",
+            Some(&locals),
+            Some(&locals),
+        )
+        .unwrap();
+        PythonLogger::new(
+            locals.get_item("logger").unwrap().unwrap().unbind(),
+            bridge_owned,
+        )
+    }
+
+    #[test]
+    fn a_caller_owned_logger_is_observed_in_full() {
+        Python::initialize();
+        Python::attach(|py| {
+            let logger = logger_whose_registries_need_no_input(py, false);
+            assert!(logger.callbacks_needed(py, "input").unwrap());
+        });
+    }
+
+    #[test]
+    fn a_bridge_owned_logger_is_elided_where_no_registry_needs_it() {
+        Python::initialize();
+        Python::attach(|py| {
+            let logger = logger_whose_registries_need_no_input(py, true);
+            assert!(!logger.callbacks_needed(py, "input").unwrap());
+            assert!(logger.callbacks_needed(py, "payload").unwrap());
+        });
+    }
+}

litellm-rust/crates/callbacks-legacy/src/deferred.rs

@@ -0,0 +1,67 @@
+//! The proxy's deferred success release: the async success handler is queued only once
+//! the proxy accepts the response, and at most once.
+
+use pyo3::{exceptions::PyException, prelude::*};
+
+use crate::{LegacyCallbacks, PythonLogger};
+
+pub(crate) struct PendingSuccess {
+    pub(crate) logger: PythonLogger,
+    pub(crate) response: Option<Py<PyAny>>,
+    pub(crate) start: Py<PyAny>,
+    pub(crate) end: Option<Py<PyAny>>,
+}
+
+impl PendingSuccess {
+    pub(crate) fn sync(&self, py: Python<'_>) -> PyResult<()> {
+        self.logger
+            .submit_success(py, &self.response, &self.start, &self.end)
+    }
+
+    pub(crate) fn asynchronous(&self, py: Python<'_>) -> PyResult<()> {
+        self.logger
+            .enqueue_success(py, &self.response, &self.start, &self.end)
+    }
+}
+
+#[pyclass]
+pub(crate) struct PendingLogging {
+    pub(crate) pending: Option<PendingSuccess>,
+}
+
+#[pymethods]
+impl PendingLogging {
+    fn release(slf: &Bound<'_, Self>, py: Python<'_>, success: bool) -> PyResult<()> {
+        let pending = slf.borrow_mut().pending.take();
+        if let Some(pending) = pending
+            && success
+        {
+            match pending.asynchronous(py) {
+                Err(error) if error.is_instance_of::<PyException>(py) => {
+                    error.write_unraisable(py, Some(pending.logger.object(py)));
+                }
+                result => return result,
+            }
+        }
+        Ok(())
+    }
+
+    fn __traverse__(&self, visit: pyo3::gc::PyVisit<'_>) -> Result<(), pyo3::gc::PyTraverseError> {
+        if let Some(pending) = &self.pending {
+            pending.logger.traverse(&visit)?;
+            visit.call(&pending.response)?;
+            visit.call(&pending.start)?;
+            visit.call(&pending.end)?;
+        }
+        Ok(())
+    }
+
+    fn __clear__(slf: &Bound<'_, Self>) {
+        let pending = slf.borrow_mut().pending.take();
+        drop(pending);
+    }
+}
+
+#[cfg(test)]
+#[path = "../tests/deferred.rs"]
+mod tests;

litellm-rust/crates/callbacks-legacy/src/lib.rs

@@ -0,0 +1,27 @@
+//! The legacy `@client` wrapper as the native call sees it: litellm's `Logging` object, the
+//! sync and async callback registries it fans out to, the deployment hooks, the deferred
+//! proxy release, and the kwargs rewrites the wrapper makes on the way in (credential-name
+//! inheritance, budget and retry-count limits). All of it sits behind one
+//! [`CallbackAdapter`](litellm_host_python::CallbackAdapter), so the driver, the routes and
+//! core never learn which Python object is on the other end.
+//!
+//! Legacy callbacks receive the caller's own objects and may mutate them. [`PublicCall`]
+//! is where those objects live, and [`run_legacy_call`] is how a route hands them over
+//! without keeping a copy.
+
+mod adapter;
+mod call;
+mod callbacks;
+mod deferred;
+mod logger;
+mod preparation;
+#[cfg(test)]
+#[path = "../tests/support.rs"]
+mod test_support;
+
+pub(crate) use adapter::LegacyLogging;
+pub use adapter::LegacySurface;
+pub use call::{PublicCall, lookup, run_legacy_call};
+pub(crate) use callbacks::{LegacyCallbacks, is_internal_call};
+pub(crate) use logger::{DeploymentHooks, PythonLogger, finalize, setup};
+pub(crate) use preparation::prepare;

litellm-rust/crates/callbacks-legacy/src/logger.rs

@@ -0,0 +1,236 @@
+use pyo3::{
+    exceptions::PyBaseException,
+    gc::{PyTraverseError, PyVisit},
+    prelude::*,
+    types::{PyDict, PyTuple},
+};
+
+/// The `Logging` instance one call fans out through, and who owns it. A logger the caller
+/// handed in is observed in full, because the caller reads it after the call; one this
+/// crate built through `function_setup` is elided wherever no registry needs it.
+pub struct PythonLogger {
+    object: Py<PyAny>,
+    bridge_owned: bool,
+}
+
+impl PythonLogger {
+    pub(crate) fn new(object: Py<PyAny>, bridge_owned: bool) -> Self {
+        Self {
+            object,
+            bridge_owned,
+        }
+    }
+
+    pub(crate) fn object<'py>(&self, py: Python<'py>) -> &Bound<'py, PyAny> {
+        self.object.bind(py)
+    }
+
+    pub(crate) fn bridge_owned(&self) -> bool {
+        self.bridge_owned
+    }
+
+    pub fn clone_ref(&self, py: Python<'_>) -> Self {
+        Self {
+            object: self.object.clone_ref(py),
+            bridge_owned: self.bridge_owned,
+        }
+    }
+
+    pub fn traverse(&self, visit: &PyVisit<'_>) -> Result<(), PyTraverseError> {
+        visit.call(&self.object)
+    }
+
+    pub fn success_bookkeeping(
+        &self,
+        py: Python<'_>,
+        response: &Option<Py<PyAny>>,
+        start: &Py<PyAny>,
+        end: &Option<Py<PyAny>>,
+        asynchronous: bool,
+    ) -> PyResult<()> {
+        py.import("litellm.rust_bridge.legacy_callbacks")?
+            .getattr("success_bookkeeping")?
+            .call1((self.object(py), response, start, end, asynchronous))?;
+        Ok(())
+    }
+
+    pub fn restore_context(&self, py: Python<'_>) -> PyResult<()> {
+        py.import("litellm.utils")?
+            .getattr("_restore_correlation_context_if_supported")?
+            .call1((self.object(py),))?;
+        Ok(())
+    }
+}
+
+/// A bare Python object was not obtained from `setup`, so it is caller-owned.
+impl FromPyObject<'_, '_> for PythonLogger {
+    type Error = PyErr;
+
+    fn extract(object: Borrowed<'_, '_, PyAny>) -> PyResult<Self> {
+        Ok(Self::new(object.to_owned().unbind(), false))
+    }
+}
+
+pub struct SetupResult<'py>(Bound<'py, PyAny>);
+
+impl SetupResult<'_> {
+    pub fn logger(&self) -> PyResult<PythonLogger> {
+        let object = self.0.getattr("logger")?.unbind();
+        let bridge_owned = self.0.getattr("bridge_owned")?.extract()?;
+        Ok(PythonLogger::new(object, bridge_owned))
+    }
+
+    pub fn kwargs(&self) -> PyResult<Py<PyDict>> {
+        Ok(self.0.getattr("kwargs")?.extract()?)
+    }
+}
+
+pub fn setup<'py>(
+    py: Python<'py>,
+    call_type: &str,
+    args: &Py<PyTuple>,
+    kwargs: &Py<PyDict>,
+    start: &Py<PyAny>,
+    asynchronous: bool,
+) -> PyResult<SetupResult<'py>> {
+    py.import("litellm.rust_bridge.legacy_callbacks")?
+        .getattr("setup")?
+        .call1((call_type, args, kwargs, start, asynchronous))
+        .map(SetupResult)
+}
+
+pub fn finalize(
+    py: Python<'_>,
+    response: &Option<Py<PyAny>>,
+    logger: &PythonLogger,
+    kwargs: &Py<PyDict>,
+    start: &Py<PyAny>,
+    end: &Option<Py<PyAny>>,
+) -> PyResult<()> {
+    py.import("litellm.rust_bridge.legacy_callbacks")?
+        .getattr("finalize")?
+        .call1((response, logger.object(py), kwargs, start, end))?;
+    Ok(())
+}
+
+pub struct DeploymentHooks;
+
+impl DeploymentHooks {
+    pub fn needed(py: Python<'_>) -> PyResult<bool> {
+        py.import("litellm.rust_bridge.legacy_callbacks")?
+            .getattr("deployment_callbacks_needed")?
+            .call0()?
+            .extract()
+    }
+
+    pub fn before_call(
+        py: Python<'_>,
+        kwargs: &Py<PyDict>,
+        call_type: &str,
+    ) -> PyResult<Py<PyAny>> {
+        py.import("litellm.utils")?
+            .getattr("async_pre_call_deployment_hook")?
+            .call1((kwargs, call_type))
+            .map(Bound::unbind)
+    }
+
+    pub fn after_success(
+        py: Python<'_>,
+        kwargs: &Py<PyDict>,
+        response: &Option<Py<PyAny>>,
+        call_type: &str,
+    ) -> PyResult<Py<PyAny>> {
+        py.import("litellm.utils")?
+            .getattr("async_post_call_success_deployment_hook")?
+            .call1((kwargs, response, call_type))
+            .map(Bound::unbind)
+    }
+
+    pub fn after_failure(
+        py: Python<'_>,
+        kwargs: &Py<PyDict>,
+        error: &Py<PyBaseException>,
+        call_type: &str,
+    ) -> PyResult<Py<PyAny>> {
+        py.import("litellm.utils")?
+            .getattr("async_post_call_failure_deployment_hook")?
+            .call1((kwargs, error, call_type))
+            .map(Bound::unbind)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use pyo3::exceptions::PyTypeError;
+
+    use super::*;
+
+    #[test]
+    fn setup_fields_are_checked_lazily() {
+        Python::initialize();
+        Python::attach(|py| {
+            let locals = PyDict::new(py);
+            py.run(
+                pyo3::ffi::c_str!(
+                    r#"
+reads = []
+class Logger:
+    def __getattribute__(self, name):
+        reads.append(name)
+        raise AssertionError('logger methods must remain lazy')
+logger = Logger()
+class Setup:
+    @property
+    def logger(self):
+        reads.append('logger')
+        return logger
+    @property
+    def bridge_owned(self):
+        reads.append('bridge_owned')
+        return True
+    @property
+    def kwargs(self):
+        reads.append('kwargs')
+        return []
+result = Setup()
+"#
+                ),
+                Some(&locals),
+                Some(&locals),
+            )
+            .unwrap();
+            let result = SetupResult(locals.get_item("result").unwrap().unwrap());
+            let logger = result.logger().unwrap();
+            assert!(
+                logger
+                    .object(py)
+                    .is(locals.get_item("logger").unwrap().unwrap())
+            );
+            assert!(logger.bridge_owned());
+            assert!(
+                result
+                    .kwargs()
+                    .unwrap_err()
+                    .is_instance_of::<PyTypeError>(py)
+            );
+            assert_eq!(
+                locals
+                    .get_item("reads")
+                    .unwrap()
+                    .unwrap()
+                    .extract::<Vec<String>>()
+                    .unwrap(),
+                ["logger", "bridge_owned", "kwargs"]
+            );
+        });
+    }
+
+    #[test]
+    fn a_logger_extracted_from_a_bare_object_is_caller_owned() {
+        Python::initialize();
+        Python::attach(|py| {
+            let logger: PythonLogger = py.None().into_bound(py).extract().unwrap();
+            assert!(!logger.bridge_owned());
+        });
+    }
+}

litellm-rust/crates/callbacks-legacy/src/preparation.rs

@@ -1,6 +1,7 @@
-use litellm_auth::{credential_default_fields, credential_index};
-use pyo3::prelude::*;
-use pyo3::types::{PyDict, PyList};
+use pyo3::{
+    prelude::*,
+    types::{PyDict, PyList},
+};
 
 struct CredentialEntry<'py>(Bound<'py, PyAny>);
 
@@ -14,16 +15,16 @@ impl<'py> CredentialEntry<'py> {
     }
 }
 
-pub(super) fn prepare<'py>(
+pub fn prepare<'py>(
     py: Python<'py>,
     kwargs: &Bound<'py, PyDict>,
-    logger: &super::PythonLogger,
+    logger: &crate::PythonLogger,
 ) -> PyResult<Bound<'py, PyDict>> {
     let arguments = kwargs.copy()?;
     arguments.set_item("litellm_logging_obj", logger.object(py))?;
     let litellm = py.import("litellm")?;
     inherit_credentials(py, &litellm, &arguments)?;
-    py.import("litellm.rust_bridge.lifecycle")?
+    py.import("litellm.rust_bridge.legacy_callbacks")?
         .getattr("check_limits")?
         .call1((&arguments,))?;
     Ok(arguments)
@@ -49,7 +50,7 @@ fn inherit_credentials(
         .iter()
         .map(|credential| CredentialEntry(credential).name())
         .collect::<PyResult<Vec<_>>>()?;
-    let Some(index) = credential_index(&requested, &names) else {
+    let Some(index) = names.iter().position(|name| *name == requested) else {
         py.import("litellm._logging")?.getattr("verbose_logger")?.call_method1(
             "warning",
             ("litellm_credential_name=%s matched none of the %d loaded credentials; the request runs without it", requested, names.len()),
@@ -60,9 +61,9 @@ fn inherit_credentials(
     let values = selected.values()?;
     let supplied: Vec<String> = arguments.keys().extract()?;
     let fields: Vec<String> = values.keys().extract()?;
-    for name in credential_default_fields(&supplied, &fields) {
-        if let Some(value) = values.get_item(name)? {
-            arguments.set_item(name, value)?;
+    for name in fields.iter().filter(|name| !supplied.contains(name)) {
+        if let Some(value) = values.get_item(name.as_str())? {
+            arguments.set_item(name.as_str(), value)?;
         }
     }
     Ok(())

litellm-rust/crates/callbacks-legacy/tests/deferred.rs

@@ -0,0 +1,162 @@
+use std::ffi::CStr;
+
+use pyo3::prelude::*;
+use pyo3::types::PyDict;
+use rstest::rstest;
+
+use super::{PendingLogging, PendingSuccess};
+use crate::PythonLogger;
+use crate::test_support::{local, namespace, run};
+
+/// A deferred success for the namespace's `logger` and `response`, bound as `pending`.
+fn defer<'py>(py: Python<'py>, script: &CStr) -> Bound<'py, PyDict> {
+    let locals = namespace(py, c"response = object()");
+    run(py, &locals, script);
+    let pending = Py::new(
+        py,
+        PendingLogging {
+            pending: Some(PendingSuccess {
+                logger: PythonLogger::new(local(&locals, "logger").unbind(), true),
+                response: Some(local(&locals, "response").unbind()),
+                start: py.None(),
+                end: Some(py.None()),
+            }),
+        },
+    )
+    .unwrap();
+    locals.set_item("pending", pending).unwrap();
+    locals
+}
+
+#[test]
+fn release_enqueues_the_success_once_in_the_releasing_context() {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = defer(
+            py,
+            c"
+from contextvars import ContextVar
+
+marker = ContextVar('marker', default='unset')
+observed = []
+
+def on_enqueue(coroutine):
+    observed.append(marker.get())
+    pending.release(True)
+
+logger.on_enqueue = on_enqueue
+",
+        );
+        run(
+            py,
+            &locals,
+            c"
+marker.set('release')
+pending.release(True)
+pending.release(True)
+assert observed == ['release'], observed
+assert logger.names() == ['async_success_handler', 'enqueued'], logger.calls
+assert logger.calls[0][1] is response
+",
+        );
+    });
+}
+
+#[test]
+fn a_blocked_release_drops_the_success_for_good() {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = defer(py, c"");
+        run(
+            py,
+            &locals,
+            c"
+pending.release(False)
+pending.release(True)
+assert logger.calls == [], logger.calls
+",
+        );
+    });
+}
+
+#[test]
+fn a_release_after_the_async_callbacks_went_away_only_keeps_the_books() {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = defer(py, c"logger.needed = {'async_success': False}");
+        run(
+            py,
+            &locals,
+            c"
+pending.release(True)
+assert logger.calls == [('success_bookkeeping', True)], logger.calls
+",
+        );
+    });
+}
+
+#[rstest]
+#[case::ordinary_error(c"RuntimeError('queue full')", false)]
+#[case::cancellation(c"asyncio.CancelledError()", true)]
+fn a_failed_enqueue_closes_the_coroutine_and_is_never_replayed(
+    #[case] failure: &CStr,
+    #[case] propagates: bool,
+) {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = defer(
+            py,
+            c"
+import asyncio
+
+def on_enqueue(coroutine):
+    raise failure
+
+logger.on_enqueue = on_enqueue
+",
+        );
+        locals
+            .set_item("failure", py.eval(failure, None, Some(&locals)).unwrap())
+            .unwrap();
+        let released = local(&locals, "pending").call_method1("release", (true,));
+        match released {
+            Ok(_) => assert!(!propagates),
+            Err(error) => {
+                assert!(propagates);
+                assert!(error.value(py).is(local(&locals, "failure")));
+            }
+        }
+        locals.set_item("propagates", propagates).unwrap();
+        run(
+            py,
+            &locals,
+            c"
+pending.release(True)
+assert logger.names() == ['async_success_handler', 'enqueued', 'closed'], logger.calls
+assert unraisable_from(logger) == ([] if propagates else [failure])
+",
+        );
+    });
+}
+
+#[test]
+fn an_unreleased_success_does_not_keep_its_logger_alive() {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = defer(py, c"");
+        run(
+            py,
+            &locals,
+            c"
+import gc
+import weakref
+
+logger.pending = pending
+reference = weakref.ref(logger)
+del logger, pending
+gc.collect()
+assert reference() is None
+",
+        );
+    });
+}

litellm-rust/crates/callbacks-legacy/tests/deployment_hooks.rs

@@ -0,0 +1,246 @@
+use std::ffi::CStr;
+
+use litellm_callbacks::event::{CallEvent, FailureOrigin, Timing};
+use litellm_host_python::{AdapterStep, CallbackAdapter, PublicValue};
+use pyo3::exceptions::asyncio::CancelledError;
+use pyo3::prelude::*;
+use pyo3::types::PyDict;
+use rstest::rstest;
+
+use super::LegacyLogging;
+use crate::test_support::{legacy_call, local, namespace, run};
+
+const CALL: &CStr = c"
+document = {'type': 'document_url', 'document_url': 'data:application/pdf;base64,YWJj'}
+kwargs = {'logger': logger, 'document': document}
+";
+
+const TIMING: Timing = Timing {
+    start_time: 0.0,
+    end_time: 1.0,
+};
+
+fn begin<'py>(
+    py: Python<'py>,
+    locals: &Bound<'py, PyDict>,
+    asynchronous: bool,
+) -> (LegacyLogging, AdapterStep) {
+    let mut logging = legacy_call(py, locals, asynchronous);
+    let kwargs = local(locals, "kwargs")
+        .cast_into::<PyDict>()
+        .unwrap()
+        .unbind();
+    let step = logging.begin(py, kwargs, 0.0).unwrap();
+    (logging, step)
+}
+
+fn arguments<'py>(py: Python<'py>, step: AdapterStep) -> Bound<'py, PyDict> {
+    let AdapterStep::Arguments(arguments) = step else {
+        panic!("expected the prepared arguments");
+    };
+    arguments.into_bound(py)
+}
+
+fn awaits_deployment_hook(step: &AdapterStep) -> bool {
+    matches!(step, AdapterStep::Await(_))
+}
+
+#[rstest]
+#[case::synchronous(false)]
+#[case::asynchronous(true)]
+fn deployment_pre_call_hook_runs_only_for_asynchronous_calls(#[case] asynchronous: bool) {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(py, CALL);
+        let (_, step) = begin(py, &locals, asynchronous);
+        assert_eq!(awaits_deployment_hook(&step), asynchronous);
+        let names: Vec<String> = local(&locals, "logger")
+            .call_method0("names")
+            .unwrap()
+            .extract()
+            .unwrap();
+        assert_eq!(names.contains(&"pre_hook".to_string()), asynchronous);
+    });
+}
+
+#[test]
+fn kwargs_returned_by_the_pre_call_hook_are_what_the_call_prepares() {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(
+            py,
+            c"
+document = {'type': 'document_url', 'document_url': 'data:application/pdf;base64,YWJj'}
+replacement = {'type': 'document_url', 'document_url': 'data:application/pdf;base64,ZWRpdGVk'}
+kwargs = {'logger': logger, 'document': document}
+replaced_kwargs = {'logger': logger, 'document': replacement, 'pages': [0]}
+",
+        );
+        let (mut logging, step) = begin(py, &locals, true);
+        assert!(awaits_deployment_hook(&step));
+        let step = logging
+            .resume(py, Ok(local(&locals, "replaced_kwargs").unbind()))
+            .unwrap();
+        locals.set_item("prepared", arguments(py, step)).unwrap();
+        run(
+            py,
+            &locals,
+            c"
+assert prepared['document'] is replacement
+assert prepared['pages'] is replaced_kwargs['pages']
+assert prepared['litellm_logging_obj'] is logger
+assert 'litellm_logging_obj' not in replaced_kwargs
+[checked] = [value for name, value in logger.calls if name == 'check_limits']
+assert checked is prepared
+",
+        );
+    });
+}
+
+#[test]
+fn response_returned_by_the_post_call_hook_is_finalized_and_returned() {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(
+            py,
+            c"
+kwargs = {'logger': logger}
+response = object()
+replacement = object()
+logger.hooks = {'pre': lambda kwargs: kwargs}
+",
+        );
+        let (mut logging, _) = begin(py, &locals, true);
+        logging
+            .resume(py, Ok(local(&locals, "kwargs").unbind()))
+            .unwrap();
+        let step = logging
+            .after_success(py, local(&locals, "response").unbind(), TIMING)
+            .unwrap();
+        assert!(awaits_deployment_hook(&step));
+        let step = logging
+            .resume(py, Ok(local(&locals, "replacement").unbind()))
+            .unwrap();
+        let AdapterStep::Response(returned) = step else {
+            panic!("expected the finalized response");
+        };
+        assert!(returned.bind(py).is(local(&locals, "replacement")));
+        run(
+            py,
+            &locals,
+            c"
+[finalized] = [value for name, value in logger.calls if name == 'finalize']
+assert finalized is replacement
+",
+        );
+    });
+}
+
+#[rstest]
+#[case::pre_call(false)]
+#[case::post_call(true)]
+fn cancelling_a_deployment_hook_ends_the_call_with_that_cancellation(#[case] post_call: bool) {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(py, c"kwargs = {'logger': logger}\nresponse = object()");
+        let (mut logging, _) = begin(py, &locals, true);
+        if post_call {
+            logging
+                .resume(py, Ok(local(&locals, "kwargs").unbind()))
+                .unwrap();
+            logging
+                .after_success(py, local(&locals, "response").unbind(), TIMING)
+                .unwrap();
+        }
+        let cancellation = CancelledError::new_err("cancelled");
+        let cancelled = cancellation.value(py).clone();
+        let error = logging.resume(py, Err(cancellation)).err().unwrap();
+        assert!(error.value(py).is(&cancelled));
+        let names: Vec<String> = local(&locals, "logger")
+            .call_method0("names")
+            .unwrap()
+            .extract()
+            .unwrap();
+        assert!(!names.iter().any(|name| name.contains("handler")));
+    });
+}
+
+#[rstest]
+#[case::hook_completed(false)]
+#[case::hook_cancelled(true)]
+fn failure_callbacks_run_after_the_failure_hook_however_it_ends(#[case] cancelled: bool) {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(
+            py,
+            c"kwargs = {'logger': logger}\nfailure = ValueError('provider')",
+        );
+        let (mut logging, _) = begin(py, &locals, true);
+        logging
+            .resume(py, Ok(local(&locals, "kwargs").unbind()))
+            .unwrap();
+        let failure = PyErr::from_value(local(&locals, "failure"));
+        let failed = CallEvent::Failed {
+            timing: TIMING,
+            origin: FailureOrigin::Call,
+        };
+        let step = logging
+            .emit(py, &failed, Some(PublicValue::Error(&failure)))
+            .unwrap();
+        assert!(awaits_deployment_hook(&step));
+        let hook_result = if cancelled {
+            Err(CancelledError::new_err("cancelled"))
+        } else {
+            Ok(py.None())
+        };
+        assert!(matches!(
+            logging.resume(py, hook_result).unwrap(),
+            AdapterStep::Await(_)
+        ));
+        run(
+            py,
+            &locals,
+            c"
+assert logger.names()[-3:] == ['failure_hook', 'failure_handler', 'async_failure_handler'], logger.calls
+assert all(value is failure for name, value in logger.calls if name.endswith('_handler'))
+",
+        );
+    });
+}
+
+#[rstest]
+#[case::synchronous(false)]
+#[case::asynchronous(true)]
+fn a_limit_rejected_before_the_call_surfaces_as_the_callers_error(#[case] asynchronous: bool) {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(
+            py,
+            c"
+class BudgetExceeded(Exception):
+    pass
+
+rejection = BudgetExceeded('over budget')
+
+class LimitedLogger(StubLogger):
+    def check_limits(self, arguments):
+        raise rejection
+
+logger = LimitedLogger()
+logger.hooks = {'pre': lambda kwargs: kwargs}
+kwargs = {'logger': logger}
+",
+        );
+        let mut logging = legacy_call(py, &locals, asynchronous);
+        let kwargs = local(&locals, "kwargs")
+            .cast_into::<PyDict>()
+            .unwrap()
+            .unbind();
+        let result = logging.begin(py, kwargs, 0.0).and_then(|step| match step {
+            AdapterStep::Await(_) => logging.resume(py, Ok(local(&locals, "kwargs").unbind())),
+            step => Ok(step),
+        });
+        let error = result.err().unwrap();
+        assert!(error.value(py).is(local(&locals, "rejection")));
+    });
+}

litellm-rust/crates/callbacks-legacy/tests/payload.rs

@@ -0,0 +1,365 @@
+use std::ffi::CStr;
+
+use litellm_callbacks::event::{CallEvent, Passthrough, RawResponse, RequestContext, WireRequest};
+use litellm_host_python::{AdapterStep, CallbackAdapter};
+use pyo3::prelude::*;
+use rstest::rstest;
+use serde_json::{Value, json};
+
+use super::LegacyLogging;
+use crate::PythonLogger;
+use crate::test_support::{legacy_call, local, namespace, run};
+
+/// The payload phases of `Logging` on top of `StubLogger`, with `pre_call` handing the
+/// payload to the case's `on_pre_call`.
+const PAYLOAD_LOGGER: &CStr = c"
+class Request:
+    pass
+
+class PayloadLogger(StubLogger):
+    def update_from_kwargs(self, **update):
+        self.update = update
+
+    def pre_call(self, input, api_key, additional_args):
+        self.record('pre_call', None)
+        self.pre = additional_args
+        on_pre_call(additional_args)
+
+    def _pre_call(self, input, api_key, additional_args):
+        self.record('_pre_call', None)
+
+    def record_api_call_start_time(self):
+        self.record('record_api_call_start_time', None)
+
+    def post_call(self, original_response, additional_args):
+        self.record('post_call', None)
+        self.post = (original_response, additional_args)
+
+    def record_post_call(self, response, *rest):
+        self.record('record_post_call', response)
+
+request = Request()
+kwargs = {}
+logger = PayloadLogger()
+on_pre_call = lambda additional_args: None
+check = lambda: None
+";
+
+const DOCUMENT: &str = "data:application/pdf;base64,YWJj";
+const EDITED: &str = "data:application/pdf;base64,ZWRpdGVk";
+
+fn document(source: &str) -> Value {
+    json!({"type": "document_url", "document_url": source})
+}
+
+fn before_send(script: &CStr, caller: Value, body: Value) -> WireRequest {
+    before_send_with_secrets(script, caller, body, &[])
+}
+
+/// Runs `before_send` over `body` for a caller whose route-side view is `caller`, with the
+/// Python objects `script` binds, then delivers the provider's raw response the way the
+/// driver does and runs the script's `check()`.
+fn before_send_with_secrets(
+    script: &CStr,
+    caller: Value,
+    body: Value,
+    secret_fields: &[&str],
+) -> WireRequest {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(py, PAYLOAD_LOGGER);
+        run(py, &locals, script);
+        let mut logging = LegacyLogging {
+            logger: Some(PythonLogger::new(local(&locals, "logger").unbind(), true)),
+            ..legacy_call(py, &locals, false)
+        };
+        let context = RequestContext {
+            model: "model".into(),
+            custom_llm_provider: "provider".into(),
+            optional_params: caller.clone(),
+            passthrough_fields: Passthrough::unchanged(caller.as_object().unwrap(), &body),
+            secret_fields: secret_fields.iter().map(|name| name.to_string()).collect(),
+        };
+        let wire = WireRequest {
+            url: "https://provider.invalid/ocr".into(),
+            headers: vec![("x-route".into(), "route".into())],
+            body,
+        };
+        let step = logging.before_send(py, Box::new(wire), &context).unwrap();
+        let raw = CallEvent::ResponseReceived {
+            raw: RawResponse {
+                body: "raw response".into(),
+            },
+        };
+        assert!(matches!(
+            logging.emit(py, &raw, None).unwrap(),
+            AdapterStep::Done
+        ));
+        run(py, &locals, c"check()");
+        let AdapterStep::Wire(wire) = step else {
+            panic!("before_send did not hand back the wire request");
+        };
+        *wire
+    })
+}
+
+#[rstest]
+#[case::caller_keyword(c"
+document = {'type': 'document_url', 'document_url': 'data:application/pdf;base64,YWJj'}
+pages = [0]
+kwargs = {'document': document, 'pages': pages}
+observed = []
+on_pre_call = lambda args: observed.append(
+    (args['complete_input_dict']['document'] is document, args['complete_input_dict']['pages'] is pages)
+)
+def check():
+    assert observed == [(True, True)], observed
+")]
+#[case::request_attribute_behind_an_omitted_keyword(c"
+document = {'type': 'document_url', 'document_url': 'data:application/pdf;base64,YWJj'}
+pages = [0]
+request.document = document
+kwargs = {'pages': pages}
+observed = []
+on_pre_call = lambda args: observed.append(
+    (args['complete_input_dict']['document'] is document, args['complete_input_dict']['pages'] is pages)
+)
+def check():
+    assert observed == [(True, True)], observed
+")]
+fn passthrough_keys_reach_pre_call_as_the_callers_own_objects(#[case] script: &CStr) {
+    let body = json!({"model": "model", "document": document(DOCUMENT), "pages": [0]});
+    let wire = before_send(
+        script,
+        json!({"document": document(DOCUMENT), "pages": [0]}),
+        body.clone(),
+    );
+    assert_eq!(wire.body, body);
+}
+
+#[test]
+fn pre_call_edit_of_a_passthrough_object_reaches_the_caller_and_the_wire() {
+    let wire = before_send(
+        c"
+document = {'type': 'document_url', 'document_url': 'data:application/pdf;base64,YWJj'}
+kwargs = {'document': document}
+def on_pre_call(args):
+    args['complete_input_dict']['document']['document_url'] = 'data:application/pdf;base64,ZWRpdGVk'
+def check():
+    assert document['document_url'] == 'data:application/pdf;base64,ZWRpdGVk'
+",
+        json!({"document": document(DOCUMENT)}),
+        json!({"document": document(DOCUMENT)}),
+    );
+    assert_eq!(wire.body["document"], document(EDITED));
+}
+
+#[test]
+fn a_body_key_the_route_rewrote_is_not_the_callers_object() {
+    let wire = before_send(
+        c"
+document = {'type': 'document_url', 'document_url': 'https://example.invalid/scan.pdf'}
+kwargs = {'document': document}
+observed = []
+def on_pre_call(args):
+    observed.append(args['complete_input_dict']['document'] is document)
+    args['complete_input_dict']['document']['document_name'] = 'edited.pdf'
+def check():
+    assert observed == [False], observed
+    assert document == {'type': 'document_url', 'document_url': 'https://example.invalid/scan.pdf'}
+",
+        json!({"document": document("https://example.invalid/scan.pdf")}),
+        json!({"document": document(DOCUMENT)}),
+    );
+    assert_eq!(
+        wire.body["document"],
+        json!({"type": "document_url", "document_url": DOCUMENT, "document_name": "edited.pdf"})
+    );
+}
+
+#[rstest]
+#[case::body(
+    c"
+def on_pre_call(args):
+    args['complete_input_dict'] = {'replacement': True}
+"
+)]
+#[case::headers(
+    c"
+def on_pre_call(args):
+    args['headers'] = {'x-replacement': 'yes'}
+"
+)]
+fn rebinding_the_payload_envelope_does_not_reach_the_wire(#[case] script: &CStr) {
+    let body = json!({"document": document(DOCUMENT)});
+    let wire = before_send(script, json!({}), body.clone());
+    assert_eq!(wire.body, body);
+    assert_eq!(wire.headers, [("x-route".to_string(), "route".to_string())]);
+}
+
+#[test]
+fn pre_call_header_edit_reaches_the_wire() {
+    let wire = before_send(
+        c"
+def on_pre_call(args):
+    args['headers']['x-callback'] = 'edited'
+",
+        json!({}),
+        json!({}),
+    );
+    assert_eq!(
+        wire.headers,
+        [
+            ("x-route".to_string(), "route".to_string()),
+            ("x-callback".to_string(), "edited".to_string()),
+        ]
+    );
+}
+
+#[test]
+fn pre_call_receives_the_wire_request_and_the_logger_its_redacted_request() {
+    let body = json!({"model": "model", "document": document(DOCUMENT)});
+    before_send_with_secrets(
+        c"
+logger_fn = lambda *args: None
+kwargs = {
+    'litellm_call_id': 'call-1',
+    'client_secret': 'shh',
+    'proxy_server_request': {'body': {}},
+    'logger_fn': logger_fn,
+    'litellm_request_debug': True,
+    'ocr_cost_per_page': 0.05,
+}
+observed = []
+on_pre_call = observed.append
+def check():
+    [args] = observed
+    assert args['api_base'] == 'https://provider.invalid/ocr', args
+    assert args['complete_input_dict'] == {
+        'model': 'model',
+        'document': {'type': 'document_url', 'document_url': 'data:application/pdf;base64,YWJj'},
+    }, args
+    update = logger.update
+    assert update['model'] == 'model' and update['custom_llm_provider'] == 'provider', update
+    assert update['litellm_params']['litellm_call_id'] == 'call-1', update
+    assert update['litellm_params']['api_base'] == 'https://provider.invalid/ocr', update
+    assert update['litellm_params']['logger_fn'] is logger_fn, update
+    assert update['litellm_params']['litellm_request_debug'] is True, update
+    assert update['litellm_params']['ocr_cost_per_page'] == 0.05, update
+    assert update['kwargs']['client_secret'] == '****', update
+    assert 'proxy_server_request' not in update['kwargs'], update
+    assert update['optional_params']['client_secret'] == '****', update
+",
+        json!({"client_secret": "shh"}),
+        body,
+        &["client_secret"],
+    );
+}
+
+#[rstest]
+#[case::added_key(
+    c"
+def on_pre_call(args):
+    args['complete_input_dict']['include_image_base64'] = True
+",
+    json!({"document": document(DOCUMENT), "include_image_base64": true})
+)]
+#[case::replaced_document(
+    c"
+document = {'type': 'document_url', 'document_url': 'data:application/pdf;base64,YWJj'}
+kwargs = {'document': document}
+def on_pre_call(args):
+    args['complete_input_dict']['document'] = {
+        'type': 'document_url', 'document_url': 'data:application/pdf;base64,ZWRpdGVk'
+    }
+def check():
+    assert document['document_url'] == 'data:application/pdf;base64,YWJj', document
+",
+    json!({"document": document(EDITED)})
+)]
+#[case::retained_body_edited_after_rebinding(
+    c"
+def on_pre_call(args):
+    retained = args['complete_input_dict']
+    args['complete_input_dict'] = {'rebound': True}
+    retained['include_image_base64'] = True
+",
+    json!({"document": document(DOCUMENT), "include_image_base64": true})
+)]
+fn pre_call_body_edits_reach_the_wire(#[case] script: &CStr, #[case] expected: Value) {
+    let body = json!({"document": document(DOCUMENT)});
+    let wire = before_send(script, json!({"document": document(DOCUMENT)}), body);
+    assert_eq!(wire.body, expected);
+}
+
+#[test]
+fn retained_headers_edited_after_rebinding_reach_the_wire() {
+    let wire = before_send(
+        c"
+def on_pre_call(args):
+    retained = args['headers']
+    args['headers'] = {'x-rebound': 'rebound'}
+    retained['x-retained'] = 'sent'
+",
+        json!({}),
+        json!({}),
+    );
+    assert_eq!(
+        wire.headers,
+        [
+            ("x-route".to_string(), "route".to_string()),
+            ("x-retained".to_string(), "sent".to_string()),
+        ]
+    );
+}
+
+#[test]
+fn post_call_receives_the_raw_response_and_the_payload_dicts_pre_call_saw() {
+    before_send(
+        c"
+def check():
+    original_response, additional_args = logger.post
+    assert original_response == 'raw response', original_response
+    assert additional_args['complete_input_dict'] is logger.pre['complete_input_dict']
+    assert additional_args['headers'] is logger.pre['headers']
+",
+        json!({}),
+        json!({"document": document(DOCUMENT)}),
+    );
+}
+
+#[rstest]
+#[case::every_phase_listens(c"{}", &["pre_call", "post_call"])]
+#[case::no_input_callback(
+    c"{'input': False}",
+    &["_pre_call", "record_api_call_start_time", "record_post_call"]
+)]
+#[case::no_payload_consumer(c"{'payload': False}", &["record_api_call_start_time"])]
+fn payload_callbacks_run_only_for_the_phases_someone_listens_to(
+    #[case] needed: &CStr,
+    #[case] expected_calls: &[&str],
+) {
+    let script = std::ffi::CString::new(format!(
+        "
+logger.needed = {needed}
+def on_pre_call(args):
+    args['complete_input_dict']['include_image_base64'] = True
+def check():
+    assert logger.names() == {expected_calls:?}, logger.calls
+",
+        needed = needed.to_str().unwrap(),
+        expected_calls = expected_calls,
+    ))
+    .unwrap();
+    let body = json!({"document": document(DOCUMENT)});
+    let wire = before_send(&script, json!({}), body.clone());
+    let edited = json!({"document": document(DOCUMENT), "include_image_base64": true});
+    assert_eq!(
+        wire.body,
+        if expected_calls.contains(&"pre_call") {
+            edited
+        } else {
+            body
+        }
+    );
+}

litellm-rust/crates/callbacks-legacy/tests/support.rs

@@ -0,0 +1,188 @@
+use std::ffi::CStr;
+
+use pyo3::prelude::*;
+use pyo3::types::{PyDict, PyTuple};
+
+use crate::{LegacyLogging, LegacySurface, PublicCall};
+
+/// Stand-ins for every litellm function the legacy contract calls. Tests share one
+/// interpreter and run concurrently, so each stub is installed idempotently and forwards to
+/// the per-test `StubLogger` it is handed (directly, or as `kwargs['logger']`).
+const STUBS: &CStr = c"
+import contextvars
+import sys
+import types
+
+for name in (
+    'litellm',
+    'litellm.utils',
+    'litellm.types',
+    'litellm.types.utils',
+    'litellm._internal_context',
+    'litellm.litellm_core_utils',
+    'litellm.litellm_core_utils.logging_worker',
+    'litellm.litellm_core_utils.litellm_logging',
+    'litellm.rust_bridge',
+    'litellm.rust_bridge.legacy_callbacks',
+):
+    sys.modules.setdefault(name, types.ModuleType(name))
+
+legacy = sys.modules['litellm.rust_bridge.legacy_callbacks']
+legacy.setup = lambda call_type, args, kwargs, start, asynchronous: types.SimpleNamespace(
+    logger=kwargs['logger_factory'](kwargs) if 'logger_factory' in kwargs else kwargs['logger'],
+    kwargs=kwargs,
+    bridge_owned=True,
+)
+legacy.deployment_callbacks_needed = lambda: True
+legacy.check_limits = lambda arguments: arguments['logger'].check_limits(arguments)
+legacy.callbacks_needed = lambda logger, phase: logger.needed.get(phase, True)
+legacy.success_bookkeeping = lambda logger, response, start, end, asynchronous: logger.record(
+    'success_bookkeeping', asynchronous
+)
+legacy.failure_bookkeeping = lambda logger, error, start, end, asynchronous: logger.record(
+    'failure_bookkeeping', asynchronous
+)
+legacy.finalize = lambda response, logger, kwargs, start, end: logger.record('finalize', response)
+
+utils = sys.modules['litellm.utils']
+utils.async_pre_call_deployment_hook = lambda kwargs, call_type: kwargs['logger'].hook(
+    'pre', kwargs, call_type
+)
+utils.async_post_call_success_deployment_hook = lambda kwargs, response, call_type: kwargs[
+    'logger'
+].hook('success', response, call_type)
+utils.async_post_call_failure_deployment_hook = lambda kwargs, error, call_type: kwargs[
+    'logger'
+].hook('failure', error, call_type)
+utils._restore_correlation_context_if_supported = lambda logger: logger.record('restore', None)
+
+internal = sys.modules['litellm._internal_context']
+if not hasattr(internal, 'is_internal_call'):
+    internal.is_internal_call = contextvars.ContextVar('is_internal_call', default=False)
+
+sys.modules['litellm.types.utils'].CustomPricingLiteLLMParams = type(
+    'CustomPricingLiteLLMParams', (), {'model_fields': {'ocr_cost_per_page': None}}
+)
+
+
+unraisable = sys.modules.setdefault(
+    'litellm_test_unraisable', types.ModuleType('litellm_test_unraisable')
+)
+if not hasattr(unraisable, 'events'):
+    unraisable.events = []
+    sys.unraisablehook = lambda event: unraisable.events.append((event.object, event.exc_value))
+
+
+def unraisable_from(owner):
+    return [error for source, error in unraisable.events if source is owner]
+
+
+class Worker:
+    def ensure_initialized_and_enqueue(self, coroutine):
+        return coroutine.enqueue()
+
+
+class Executor:
+    def submit(self, run, handler, *args):
+        handler.__self__.record('submit', args)
+
+
+sys.modules['litellm.litellm_core_utils.logging_worker'].GLOBAL_LOGGING_WORKER = Worker()
+sys.modules['litellm.litellm_core_utils.litellm_logging'].executor = Executor()
+
+
+class StubCoroutine:
+    def __init__(self, logger):
+        self.logger = logger
+
+    def enqueue(self):
+        self.logger.record('enqueued', None)
+        self.logger.on_enqueue(self)
+
+    def close(self):
+        self.logger.record('closed', None)
+
+
+class StubLogger:
+    def __init__(self):
+        self.calls = []
+        self.needed = {}
+        self.hooks = {}
+        self.on_enqueue = lambda coroutine: None
+
+    def record(self, name, value):
+        self.calls.append((name, value))
+
+    def names(self):
+        return [name for name, _ in self.calls]
+
+    def hook(self, phase, value, call_type):
+        self.record(phase + '_hook', call_type)
+        return self.hooks.get(phase, lambda value: 'awaitable')(value)
+
+    def check_limits(self, arguments):
+        self.record('check_limits', arguments)
+
+    def failure_handler(self, error, trace, start, end):
+        self.record('failure_handler', error)
+
+    def async_failure_handler(self, error, trace, start, end):
+        self.record('async_failure_handler', error)
+        return 'awaitable'
+
+    def success_handler(self, response, start, end):
+        self.record('success_handler', response)
+
+    def async_success_handler(self, response, start, end):
+        self.record('async_success_handler', response)
+        return StubCoroutine(self)
+
+    def handle_sync_success_callbacks_for_async_calls(self, response, start, end):
+        self.record('sync_success_for_async_call', response)
+
+
+logger = StubLogger()
+";
+
+/// A namespace with the stubs, `StubLogger` and a fresh `logger`, after `script` ran in it.
+pub(crate) fn namespace<'py>(py: Python<'py>, script: &CStr) -> Bound<'py, PyDict> {
+    let locals = PyDict::new(py);
+    py.run(STUBS, Some(&locals), Some(&locals)).unwrap();
+    py.run(script, Some(&locals), Some(&locals)).unwrap();
+    locals
+}
+
+pub(crate) fn run(py: Python<'_>, locals: &Bound<'_, PyDict>, code: &CStr) {
+    py.run(code, Some(locals), Some(locals)).unwrap();
+}
+
+pub(crate) fn local<'py>(locals: &Bound<'py, PyDict>, name: &str) -> Bound<'py, PyAny> {
+    locals.get_item(name).unwrap().unwrap()
+}
+
+/// A legacy call over the namespace's `kwargs` (or none) and `request` (or `None`).
+pub(crate) fn legacy_call(
+    py: Python<'_>,
+    locals: &Bound<'_, PyDict>,
+    asynchronous: bool,
+) -> LegacyLogging {
+    let request = locals
+        .get_item("request")
+        .unwrap()
+        .unwrap_or_else(|| py.None().into_bound(py));
+    let kwargs = locals
+        .get_item("kwargs")
+        .unwrap()
+        .map(|kwargs| kwargs.cast_into::<PyDict>().unwrap())
+        .unwrap_or_else(|| PyDict::new(py));
+    let call = PublicCall::capture(&request, &PyTuple::empty(py), &kwargs).unwrap();
+    LegacyLogging::new(
+        py,
+        LegacySurface {
+            call_type: "test",
+            input_description: "test input",
+        },
+        call,
+        asynchronous,
+    )
+}

litellm-rust/crates/callbacks-legacy/tests/terminal.rs

@@ -0,0 +1,291 @@
+use std::ffi::CStr;
+
+use litellm_callbacks::event::{CallEvent, FailureOrigin, Timing};
+use litellm_host_python::{AdapterStep, CallbackAdapter, PublicValue};
+use pyo3::exceptions::PyRuntimeError;
+use pyo3::exceptions::asyncio::CancelledError;
+use pyo3::prelude::*;
+use pyo3::types::PyDict;
+use rstest::rstest;
+
+use super::LegacyLogging;
+use crate::PythonLogger;
+use crate::test_support::{legacy_call, local, namespace, run};
+
+const TIMING: Timing = Timing {
+    start_time: 0.0,
+    end_time: 1.0,
+};
+
+fn logged(py: Python<'_>, locals: &Bound<'_, PyDict>, asynchronous: bool) -> LegacyLogging {
+    LegacyLogging {
+        logger: Some(PythonLogger::new(local(locals, "logger").unbind(), true)),
+        ..legacy_call(py, locals, asynchronous)
+    }
+}
+
+fn succeed(py: Python<'_>, locals: &Bound<'_, PyDict>, logging: &mut LegacyLogging) -> AdapterStep {
+    let response = local(locals, "response").unbind();
+    logging
+        .emit(
+            py,
+            &CallEvent::Succeeded { timing: TIMING },
+            Some(PublicValue::Response(&response)),
+        )
+        .unwrap()
+}
+
+fn fail(py: Python<'_>, locals: &Bound<'_, PyDict>, logging: &mut LegacyLogging) -> AdapterStep {
+    let failure = PyErr::from_value(local(locals, "failure"));
+    logging
+        .emit(
+            py,
+            &CallEvent::Failed {
+                timing: TIMING,
+                origin: FailureOrigin::Host,
+            },
+            Some(PublicValue::Error(&failure)),
+        )
+        .unwrap()
+}
+
+#[rstest]
+#[case::sync_listened(false, c"", &["submit"])]
+#[case::sync_unlistened(false, c"logger.needed = {'sync_success': False}", &["success_bookkeeping"])]
+#[case::async_listened(
+    true,
+    c"",
+    &["async_success_handler", "enqueued", "sync_success_for_async_call"]
+)]
+#[case::async_unlistened(
+    true,
+    c"logger.needed = {'async_success': False, 'sync_success_async': False}",
+    &["success_bookkeeping"]
+)]
+#[case::async_deferred(true, c"logger._defer_async_logging = True", &["sync_success_for_async_call"])]
+#[case::async_with_fallbacks(true, c"kwargs = {'fallbacks': ['other']}", &["sync_success_for_async_call"])]
+fn success_reaches_only_the_callbacks_that_listen(
+    #[case] asynchronous: bool,
+    #[case] script: &CStr,
+    #[case] expected: &[&str],
+) {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(py, c"response = object()");
+        run(py, &locals, script);
+        let mut logging = logged(py, &locals, asynchronous);
+        assert!(matches!(
+            succeed(py, &locals, &mut logging),
+            AdapterStep::Done
+        ));
+        let names: Vec<String> = local(&locals, "logger")
+            .call_method0("names")
+            .unwrap()
+            .extract()
+            .unwrap();
+        assert_eq!(names, expected);
+        run(
+            py,
+            &locals,
+            c"
+assert all(value is response for name, value in logger.calls if name.endswith('_handler'))
+assert hasattr(logger, '_native_pending_logging') == getattr(logger, '_defer_async_logging', False)
+",
+        );
+    });
+}
+
+#[rstest]
+#[case::synchronous(false, &["failure_handler"])]
+#[case::asynchronous(true, &[])]
+fn internal_calls_skip_failure_callbacks_only_when_asynchronous(
+    #[case] asynchronous: bool,
+    #[case] expected: &[&str],
+) {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(py, c"failure = ValueError('provider')");
+        let mut logging = LegacyLogging {
+            internal: true,
+            ..logged(py, &locals, asynchronous)
+        };
+        assert!(matches!(fail(py, &locals, &mut logging), AdapterStep::Done));
+        let names: Vec<String> = local(&locals, "logger")
+            .call_method0("names")
+            .unwrap()
+            .extract()
+            .unwrap();
+        assert_eq!(names, expected);
+    });
+}
+
+#[test]
+fn internal_async_calls_skip_the_async_success_fan_out() {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(py, c"response = object()");
+        let mut logging = LegacyLogging {
+            internal: true,
+            ..logged(py, &locals, true)
+        };
+        succeed(py, &locals, &mut logging);
+        run(
+            py,
+            &locals,
+            c"assert logger.names() == ['sync_success_for_async_call'], logger.calls",
+        );
+    });
+}
+
+#[test]
+fn a_failing_success_callback_is_reported_without_replacing_the_response() {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(
+            py,
+            c"
+response = object()
+failure = ValueError('terminal diagnostic')
+
+class FailingLogger(StubLogger):
+    def handle_sync_success_callbacks_for_async_calls(self, *args):
+        raise failure
+
+logger = FailingLogger()
+",
+        );
+        let mut logging = logged(py, &locals, true);
+        assert!(matches!(
+            succeed(py, &locals, &mut logging),
+            AdapterStep::Done
+        ));
+        assert!(
+            logging
+                .response
+                .as_ref()
+                .unwrap()
+                .bind(py)
+                .is(local(&locals, "response"))
+        );
+        run(py, &locals, c"assert unraisable_from(logger) == [failure]");
+    });
+}
+
+#[rstest]
+#[case::sync_listened(false, c"", &["failure_handler"])]
+#[case::sync_unlistened(false, c"logger.needed = {'sync_failure': False}", &["failure_bookkeeping"])]
+#[case::async_listened(true, c"", &["failure_handler", "async_failure_handler"])]
+#[case::async_unlistened(
+    true,
+    c"logger.needed = {'sync_failure': False, 'async_failure': False}",
+    &["failure_bookkeeping", "failure_bookkeeping"]
+)]
+fn failure_reaches_only_the_callbacks_that_listen(
+    #[case] asynchronous: bool,
+    #[case] script: &CStr,
+    #[case] expected: &[&str],
+) {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(py, c"failure = ValueError('provider')");
+        run(py, &locals, script);
+        let mut logging = logged(py, &locals, asynchronous);
+        let step = fail(py, &locals, &mut logging);
+        let awaits_async_handler = expected.contains(&"async_failure_handler");
+        assert_eq!(matches!(step, AdapterStep::Await(_)), awaits_async_handler);
+        let names: Vec<String> = local(&locals, "logger")
+            .call_method0("names")
+            .unwrap()
+            .extract()
+            .unwrap();
+        assert_eq!(names, expected);
+        run(
+            py,
+            &locals,
+            c"assert all(value is failure for name, value in logger.calls if name.endswith('_handler'))",
+        );
+    });
+}
+
+#[test]
+fn a_failing_sync_failure_callback_keeps_the_error_and_still_runs_the_async_family() {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(
+            py,
+            c"
+failure = ValueError('selected')
+
+class FailingLogger(StubLogger):
+    def failure_handler(self, error, trace, start, end):
+        self.record('failure_handler', error)
+        raise RuntimeError('handler failed')
+
+logger = FailingLogger()
+",
+        );
+        let mut logging = logged(py, &locals, true);
+        assert!(matches!(
+            fail(py, &locals, &mut logging),
+            AdapterStep::Await(_)
+        ));
+        assert!(
+            logging
+                .error
+                .as_ref()
+                .unwrap()
+                .bind(py)
+                .is(local(&locals, "failure"))
+        );
+        run(
+            py,
+            &locals,
+            c"assert logger.names() == ['failure_handler', 'async_failure_handler'], logger.calls",
+        );
+    });
+}
+
+#[rstest]
+#[case::completed(None, true)]
+#[case::handler_error(Some(false), true)]
+#[case::cancelled(Some(true), false)]
+fn the_async_failure_handler_ends_the_call_unless_it_was_cancelled(
+    #[case] error: Option<bool>,
+    #[case] done: bool,
+) {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(py, c"failure = ValueError('provider')");
+        let mut logging = logged(py, &locals, true);
+        fail(py, &locals, &mut logging);
+        let result = match error {
+            None => Ok(py.None()),
+            Some(false) => Err(PyRuntimeError::new_err("handler failed")),
+            Some(true) => Err(CancelledError::new_err("cancelled")),
+        };
+        let expected = result.as_ref().err().map(|error| error.value(py).clone());
+        match logging.resume(py, result) {
+            Ok(step) => assert!(done && matches!(step, AdapterStep::Done)),
+            Err(propagated) => {
+                assert!(!done);
+                assert!(propagated.value(py).is(expected.unwrap()));
+            }
+        }
+    });
+}
+
+#[test]
+fn closing_restores_the_correlation_context_once() {
+    Python::initialize();
+    Python::attach(|py| {
+        let locals = namespace(py, c"");
+        let mut logging = logged(py, &locals, true);
+        logging.close(py);
+        logging.close(py);
+        run(
+            py,
+            &locals,
+            c"assert logger.names() == ['restore'], logger.calls",
+        );
+    });
+}

litellm-rust/crates/callbacks/Cargo.toml

@@ -1,15 +1,13 @@
 [package]
-name = "litellm-python-interop"
+name = "litellm-callbacks"
 version = "0.1.0"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
 
 [dependencies]
-pyo3.workspace = true
-pythonize.workspace = true
-serde.workspace = true
+serde_json.workspace = true
 
 [dev-dependencies]
 rstest.workspace = true
-serde_json.workspace = true
+tokio = { workspace = true, features = ["macros"] }

litellm-rust/crates/callbacks/src/event.rs

@@ -0,0 +1,135 @@
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use serde_json::{Map, Value};
+
+/// Seconds since the Unix epoch, on one clock for every host.
+pub fn epoch_seconds() -> f64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|duration| duration.as_secs_f64())
+        .unwrap_or(0.0)
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Timing {
+    pub start_time: f64,
+    pub end_time: f64,
+}
+
+/// The provider request as it is about to leave, offered to the host for rewriting.
+#[derive(Clone, Debug, PartialEq)]
+pub struct WireRequest {
+    pub url: String,
+    pub headers: Vec<(String, String)>,
+    pub body: Value,
+}
+
+/// What the route knows about the request it is sending, for a host that logs it. The
+/// route owns these facts; a host reads them beside the wire request and never rewrites
+/// them.
+#[derive(Clone, Debug, PartialEq)]
+pub struct RequestContext {
+    pub model: String,
+    pub custom_llm_provider: String,
+    /// The route's parameters before the provider transformation.
+    pub optional_params: Value,
+    pub passthrough_fields: Passthrough,
+    /// Optional-param names that carry credentials and must be redacted when logged.
+    pub secret_fields: Vec<String>,
+}
+
+/// Body keys whose values are the caller's inputs, unchanged by the route. The only way to
+/// build one is to compare the two, so a route cannot name a key it rewrote.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Passthrough(Vec<String>);
+
+impl Passthrough {
+    pub fn unchanged(caller: &Map<String, Value>, body: &Value) -> Self {
+        Self(
+            caller
+                .iter()
+                .filter(|(name, value)| body.get(name.as_str()) == Some(*value))
+                .map(|(name, _)| name.clone())
+                .collect(),
+        )
+    }
+
+    pub fn iter(&self) -> impl Iterator<Item = &str> {
+        self.0.iter().map(String::as_str)
+    }
+
+    pub fn contains(&self, name: &str) -> bool {
+        self.0.iter().any(|field| field == name)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RawResponse {
+    pub body: String,
+}
+
+/// Whether a failure surfaced inside the call, including a host op the call asked for,
+/// or in a host step around it (preparing the arguments, finalizing the response).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum FailureOrigin {
+    Call,
+    Host,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub enum CallEvent {
+    ResponseReceived {
+        raw: RawResponse,
+    },
+    Succeeded {
+        timing: Timing,
+    },
+    Failed {
+        timing: Timing,
+        origin: FailureOrigin,
+    },
+}
+
+#[cfg(test)]
+mod tests {
+    use rstest::rstest;
+    use serde_json::json;
+
+    use super::*;
+
+    #[rstest]
+    #[case::unchanged_scalar(json!({"pages": [0]}), json!({"pages": [0]}), &["pages"])]
+    #[case::unchanged_explicit_null(json!({"pages": null}), json!({"pages": null}), &["pages"])]
+    #[case::unchanged_nested_object(
+        json!({"document": {"type": "document_url", "document_url": "https://a/b.pdf"}}),
+        json!({"document": {"type": "document_url", "document_url": "https://a/b.pdf"}, "model": "m"}),
+        &["document"]
+    )]
+    #[case::rewritten_value(
+        json!({"document": {"type": "document_url", "document_url": "https://a/b.pdf"}}),
+        json!({"document": {"type": "document_url", "document_url": "data:application/pdf;base64,YWJj"}}),
+        &[]
+    )]
+    #[case::dropped_nested_field(
+        json!({"document": {"type": "image_url", "image_url": "https://a/b.png", "document_name": "b.png"}}),
+        json!({"document": {"type": "image_url", "image_url": "https://a/b.png"}}),
+        &[]
+    )]
+    #[case::added_nested_field(
+        json!({"document": {"type": "image_url", "image_url": "https://a/b.png"}}),
+        json!({"document": {"type": "image_url", "image_url": "https://a/b.png", "detail": "high"}}),
+        &[]
+    )]
+    #[case::reordered_array(json!({"pages": [0, 1]}), json!({"pages": [1, 0]}), &[])]
+    #[case::consumed_by_the_route(json!({"api_key": "k", "pages": [0]}), json!({"pages": [0]}), &["pages"])]
+    #[case::added_by_the_route(json!({}), json!({"model": "m"}), &[])]
+    #[case::non_object_body(json!({"pages": [0]}), json!([{"pages": [0]}]), &[])]
+    fn passthrough_is_exactly_the_callers_unchanged_keys(
+        #[case] caller: Value,
+        #[case] body: Value,
+        #[case] expected: &[&str],
+    ) {
+        let passthrough = Passthrough::unchanged(caller.as_object().unwrap(), &body);
+        assert_eq!(passthrough.iter().collect::<Vec<_>>(), expected);
+    }
+}

litellm-rust/crates/callbacks/src/host.rs

@@ -0,0 +1,45 @@
+use std::future::Future;
+
+use crate::event::{CallEvent, RequestContext, WireRequest};
+use crate::route::Route;
+
+/// One suspension point of a native call, performed by the host.
+pub enum HostOp<R: Route> {
+    Route(R::Op),
+    BeforeSend {
+        wire: Box<WireRequest>,
+        context: Box<RequestContext>,
+    },
+    Emit(CallEvent),
+}
+
+pub enum HostResult<R: Route> {
+    Route(R::OpResult),
+    BeforeSend(Box<WireRequest>),
+    Emitted,
+}
+
+/// A host answer that is either available now or arrives once the host's own
+/// suspension (a Python awaitable, for example) resolves.
+pub enum HostStep<V, S> {
+    Ready(V),
+    Suspend(S),
+}
+
+/// An in-process host: answers route operations and observes the call without leaving
+/// the Rust runtime. Language hosts implement their own driver instead.
+pub trait Host<R: Route>: Send + Sync {
+    fn route(&self, op: R::Op) -> impl Future<Output = Result<R::OpResult, R::Error>> + Send;
+
+    fn before_send(
+        &self,
+        wire: WireRequest,
+        _context: &RequestContext,
+    ) -> impl Future<Output = Result<WireRequest, R::Error>> + Send {
+        async move { Ok(wire) }
+    }
+
+    fn emit(&self, _event: &CallEvent) -> impl Future<Output = Result<(), R::Error>> + Send {
+        async { Ok(()) }
+    }
+}

litellm-rust/crates/callbacks/src/lib.rs

@@ -0,0 +1,12 @@
+//! The contract between a native call and the host runtime that drives it.
+//!
+//! A host is whatever sits on the far side of the language boundary: CPython today,
+//! another runtime later. Core implements [`machine::Machine`] per route and never learns
+//! which host is on the other end. The machine yields [`host::HostOp`]s; a driver answers
+//! them, observes [`event::CallEvent`]s and may rewrite the wire request before it is sent.
+
+pub mod event;
+pub mod host;
+pub mod machine;
+pub mod route;
+pub mod run;

litellm-rust/crates/callbacks/src/machine.rs

@@ -0,0 +1,63 @@
+use std::future::Future;
+use std::pin::Pin;
+
+use crate::host::{HostOp, HostResult};
+use crate::route::Route;
+
+pub enum MachineStep<R: Route, C> {
+    Host(HostOp<R>),
+    Complete(C),
+}
+
+pub type Step<'a, M> = Pin<
+    Box<
+        dyn Future<
+                Output = Result<
+                    MachineStep<<M as Machine>::Route, <M as Machine>::Complete>,
+                    <<M as Machine>::Route as Route>::Error,
+                >,
+            > + Send
+            + 'a,
+    >,
+>;
+
+pub type Interrupted<'a, M> = Pin<
+    Box<
+        dyn Future<
+                Output = Result<<M as Machine>::Complete, <<M as Machine>::Route as Route>::Error>,
+            > + Send
+            + 'a,
+    >,
+>;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum HostFailure<E> {
+    Error(E),
+    Cancelled(E),
+}
+
+impl<E> HostFailure<E> {
+    pub fn into_error(self) -> E {
+        match self {
+            Self::Error(error) | Self::Cancelled(error) => error,
+        }
+    }
+}
+
+/// A resumable call. Core implements it per route; a host drives it. Every suspension
+/// point is an op the host performs and answers with a result.
+pub trait Machine: Send {
+    type Route: Route;
+    type Complete: Send + 'static;
+
+    /// `None` on the first call and whenever the previous step completed without
+    /// yielding an op; otherwise the result of the op last yielded.
+    fn resume(&mut self, result: Option<HostResult<Self::Route>>) -> Step<'_, Self>;
+
+    /// The host failed to perform the pending op, or the caller cancelled. The call
+    /// yields no further ops.
+    fn interrupt(
+        &mut self,
+        failure: HostFailure<<Self::Route as Route>::Error>,
+    ) -> Interrupted<'_, Self>;
+}

litellm-rust/crates/callbacks/src/route.rs

@@ -0,0 +1,9 @@
+/// One public call surface: what a completed call produces, how it fails, and the
+/// route-specific operations only its host can perform (request projection, file reads,
+/// token acquisition).
+pub trait Route: Send + Sync + 'static {
+    type Response: Send + 'static;
+    type Error: Clone + Send + Sync + 'static;
+    type Op: Send + 'static;
+    type OpResult: Send + 'static;
+}

litellm-rust/crates/callbacks/src/run.rs

@@ -0,0 +1,149 @@
+use crate::event::{CallEvent, FailureOrigin, Timing, epoch_seconds};
+use crate::host::{Host, HostOp, HostResult};
+use crate::machine::{HostFailure, Machine, MachineStep};
+use crate::route::Route;
+
+/// Drives a machine to completion against an in-process host and emits exactly one
+/// terminal event.
+pub async fn run<M, H>(mut machine: M, host: &H) -> Result<M::Complete, <M::Route as Route>::Error>
+where
+    M: Machine,
+    H: Host<M::Route>,
+{
+    let start_time = epoch_seconds();
+    let mut result = None;
+    let outcome = loop {
+        let step = match machine.resume(result.take()).await {
+            Ok(MachineStep::Complete(complete)) => break Ok(complete),
+            Ok(MachineStep::Host(op)) => op,
+            Err(error) => break Err(error),
+        };
+        let answer = match step {
+            HostOp::Route(op) => host.route(op).await.map(HostResult::Route),
+            HostOp::BeforeSend { wire, context } => host
+                .before_send(*wire, &context)
+                .await
+                .map(|wire| HostResult::BeforeSend(Box::new(wire))),
+            HostOp::Emit(event) => host.emit(&event).await.map(|()| HostResult::Emitted),
+        };
+        match answer {
+            Ok(answer) => result = Some(answer),
+            Err(error) => break machine.interrupt(HostFailure::Error(error)).await,
+        }
+    };
+    let timing = Timing {
+        start_time,
+        end_time: epoch_seconds(),
+    };
+    let terminal = match &outcome {
+        Ok(_) => CallEvent::Succeeded { timing },
+        Err(_) => CallEvent::Failed {
+            timing,
+            origin: FailureOrigin::Call,
+        },
+    };
+    let _ = host.emit(&terminal).await;
+    outcome
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Mutex;
+
+    use super::*;
+    use crate::machine::{Interrupted, Step};
+
+    struct Unit;
+
+    impl Route for Unit {
+        type Response = ();
+        type Error = &'static str;
+        type Op = &'static str;
+        type OpResult = ();
+    }
+
+    struct Scripted {
+        ops: Vec<&'static str>,
+        outcome: Result<(), &'static str>,
+    }
+
+    impl Machine for Scripted {
+        type Route = Unit;
+        type Complete = ();
+
+        fn resume(&mut self, _: Option<HostResult<Unit>>) -> Step<'_, Self> {
+            Box::pin(async move {
+                if !self.ops.is_empty() {
+                    return Ok(MachineStep::Host(HostOp::Route(self.ops.remove(0))));
+                }
+                self.outcome.map(MachineStep::Complete)
+            })
+        }
+
+        fn interrupt(&mut self, failure: HostFailure<&'static str>) -> Interrupted<'_, Self> {
+            Box::pin(async move { Err(failure.into_error()) })
+        }
+    }
+
+    #[derive(Default)]
+    struct Recording {
+        seen: Mutex<Vec<String>>,
+        fail: Option<&'static str>,
+    }
+
+    impl Host<Unit> for Recording {
+        async fn route(&self, op: &'static str) -> Result<(), &'static str> {
+            self.seen.lock().unwrap().push(format!("route:{op}"));
+            match self.fail {
+                Some(failing) if failing == op => Err("host failed"),
+                _ => Ok(()),
+            }
+        }
+
+        async fn emit(&self, event: &CallEvent) -> Result<(), &'static str> {
+            self.seen.lock().unwrap().push(match event {
+                CallEvent::Succeeded { .. } => "succeeded".into(),
+                CallEvent::Failed { .. } => "failed".into(),
+                other => format!("{other:?}"),
+            });
+            Ok(())
+        }
+    }
+
+    fn scripted(ops: &[&'static str], outcome: Result<(), &'static str>) -> Scripted {
+        Scripted {
+            ops: ops.to_vec(),
+            outcome,
+        }
+    }
+
+    #[tokio::test]
+    async fn forwards_every_op_then_emits_one_succeeded() {
+        let host = Recording::default();
+        let outcome = run(scripted(&["project", "send"], Ok(())), &host).await;
+        assert_eq!(outcome, Ok(()));
+        assert_eq!(
+            *host.seen.lock().unwrap(),
+            ["route:project", "route:send", "succeeded"]
+        );
+    }
+
+    #[tokio::test]
+    async fn errors_and_host_failures_each_emit_failed_once() {
+        let host = Recording::default();
+        let outcome = run(scripted(&[], Err("boom")), &host).await;
+        assert_eq!(outcome, Err("boom"));
+        assert_eq!(*host.seen.lock().unwrap(), ["failed"]);
+
+        let host = Recording {
+            fail: Some("send"),
+            ..Recording::default()
+        };
+        let outcome = run(scripted(&["project", "send", "never"], Ok(())), &host).await;
+        assert_eq!(outcome, Err("host failed"));
+        assert_eq!(
+            *host.seen.lock().unwrap(),
+            ["route:project", "route:send", "failed"]
+        );
+    }
+}

litellm-rust/crates/core-utils/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "litellm-core-utils"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+litellm-types.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+serde_path_to_error = "0.1"
+serde_with.workspace = true
+thiserror.workspace = true
+url.workspace = true

litellm-rust/crates/core-utils/src/call_arguments.rs

@@ -0,0 +1,181 @@
+use std::ops::Deref;
+
+use serde::{Deserialize, Serialize, de::DeserializeOwned};
+use serde_json::{Map, Value};
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct CallArguments(Map<String, Value>);
+
+impl CallArguments {
+    pub fn select(&self, names: &[&str]) -> Map<String, Value> {
+        self.iter()
+            .filter(|(name, _)| names.contains(&name.as_str()))
+            .map(|(name, value)| (name.clone(), value.clone()))
+            .collect()
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
+#[error("invalid argument: {path}")]
+pub struct ArgumentError {
+    pub path: String,
+}
+
+pub fn parse_options<T: DeserializeOwned>(arguments: &CallArguments) -> Result<T, ArgumentError> {
+    let deserializer = serde::de::value::MapDeserializer::new(
+        arguments.iter().map(|(name, value)| (name.as_str(), value)),
+    );
+    serde_path_to_error::deserialize(deserializer).map_err(|error| ArgumentError {
+        path: error.path().to_string(),
+    })
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct ArgumentSpec {
+    pub name: &'static str,
+    pub secret: bool,
+}
+
+pub fn compose_body<B: Serialize>(
+    arguments: &CallArguments,
+    body: &B,
+    consumed: &[&str],
+) -> Result<Value, crate::params::Error> {
+    let Value::Object(fields) =
+        serde_json::to_value(body).map_err(|_| crate::params::Error::Body)?
+    else {
+        return Err(crate::params::Error::Body);
+    };
+    let overrides = match arguments.get("extra_body") {
+        None | Some(Value::Null) => None,
+        Some(Value::Object(fields)) => Some(fields),
+        Some(_) => return Err(crate::params::Error::ExtraBody),
+    };
+    let extensions = arguments
+        .iter()
+        .filter(|(name, _)| !consumed.contains(&name.as_str()));
+    Ok(Value::Object(
+        fields
+            .into_iter()
+            .chain(
+                extensions
+                    .chain(overrides.into_iter().flatten())
+                    .filter(|(name, _)| {
+                        name.as_str() != "model"
+                            && name.as_str() != "extra_body"
+                            && !crate::params::is_control_param(name)
+                    })
+                    .map(|(name, value)| (name.clone(), value.clone())),
+            )
+            .collect(),
+    ))
+}
+
+impl Deref for CallArguments {
+    type Target = Map<String, Value>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl From<Map<String, Value>> for CallArguments {
+    fn from(values: Map<String, Value>) -> Self {
+        Self(values)
+    }
+}
+
+impl From<CallArguments> for Map<String, Value> {
+    fn from(arguments: CallArguments) -> Self {
+        arguments.0
+    }
+}
+
+impl FromIterator<(String, Value)> for CallArguments {
+    fn from_iter<T: IntoIterator<Item = (String, Value)>>(iter: T) -> Self {
+        Self(iter.into_iter().collect())
+    }
+}
+
+impl IntoIterator for CallArguments {
+    type Item = (String, Value);
+    type IntoIter = serde_json::map::IntoIter;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.0.into_iter()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    #[test]
+    fn composition_preserves_extensions_and_applies_shallow_explicit_overrides() {
+        let original = json!({
+            "known": false, "future": {"old": 1}, "null": null, "zero": 0,
+            "metadata": {"host": true}, "timeout": 30, "api_key": "secret",
+            "extra_body": {
+                "known": null, "future": {"new": [false, 0, null]},
+                "metadata": {"provider": true}, "model": "ignored", "api_key": "ignored"
+            }
+        });
+        let arguments = serde_json::from_value(original.clone()).unwrap();
+        let body = compose_body(
+            &arguments,
+            &json!({"model":"resolved", "known":false}),
+            &["known"],
+        )
+        .unwrap();
+        assert_eq!(
+            body,
+            json!({
+                "model":"resolved", "known":null, "future":{"new":[false,0,null]},
+                "null":null, "zero":0, "metadata":{"provider":true}
+            })
+        );
+        assert_eq!(serde_json::to_value(arguments).unwrap(), original);
+    }
+
+    #[test]
+    fn invalid_extra_body_is_rejected_without_coercing_it_to_empty() {
+        for value in [json!(false), json!(0), json!([]), json!("")] {
+            let arguments = serde_json::from_value(json!({"extra_body":value})).unwrap();
+            assert_eq!(
+                compose_body(&arguments, &json!({}), &[]),
+                Err(crate::params::Error::ExtraBody)
+            );
+        }
+        let arguments = serde_json::from_value(json!({"extra_body":null})).unwrap();
+        assert_eq!(
+            compose_body(&arguments, &json!({}), &[]).unwrap(),
+            json!({})
+        );
+    }
+
+    #[test]
+    fn typed_views_preserve_missing_and_explicit_null_in_the_source() {
+        #[derive(Deserialize)]
+        struct Options {
+            enabled: Option<bool>,
+        }
+        let arguments: CallArguments =
+            serde_json::from_value(json!({"enabled":null,"future":0})).unwrap();
+        assert!(
+            parse_options::<Options>(&arguments)
+                .unwrap()
+                .enabled
+                .is_none()
+        );
+        assert_eq!(arguments.get("enabled"), Some(&Value::Null));
+        assert_eq!(arguments.get("missing"), None);
+        let invalid = serde_json::from_value(json!({"enabled":0})).unwrap();
+        assert_eq!(
+            parse_options::<Options>(&invalid).err().unwrap().path,
+            "enabled"
+        );
+    }
+}

litellm-rust/crates/core-utils/src/core_helpers.rs

@@ -2,7 +2,7 @@
 
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use super::types::{ChatCompletionsUsage, PromptTokensDetails};
+use litellm_types::utils::{ChatCompletionsUsage, PromptTokensDetails};
 
 /// OpenAI finish reasons, mirroring Python's `_FINISH_REASON_MAP` for the
 /// reasons the providers on this route can emit. Python warns and falls back to
@@ -54,6 +54,17 @@ pub fn unix_now() -> u64 {
         .map_or(0, |elapsed| elapsed.as_secs())
 }
 
+pub fn json_type_name(value: &serde_json::Value) -> &'static str {
+    match value {
+        serde_json::Value::Null => "null",
+        serde_json::Value::Bool(_) => "boolean",
+        serde_json::Value::Number(_) => "number",
+        serde_json::Value::String(_) => "string",
+        serde_json::Value::Array(_) => "array",
+        serde_json::Value::Object(_) => "object",
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

litellm-rust/crates/core-utils/src/lib.rs

@@ -0,0 +1,7 @@
+pub mod call_arguments;
+pub mod core_helpers;
+pub mod get_llm_provider_logic;
+pub mod params;
+pub mod prompt_templates;
+pub mod serde_compat;
+pub mod url_utils;

litellm-rust/crates/core-utils/src/params.rs

@@ -0,0 +1,112 @@
+#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
+pub enum Error {
+    #[error("invalid request: extra_body must be an object")]
+    ExtraBody,
+    #[error("invalid request: body must be a JSON object")]
+    Body,
+}
+
+use std::ops::{Deref, DerefMut};
+
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value};
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct OpaqueParams(Map<String, Value>);
+
+pub fn is_control_param(name: &str) -> bool {
+    matches!(
+        name,
+        "api_key"
+            | "api_base"
+            | "custom_llm_provider"
+            | "extra_headers"
+            | "timeout"
+            | "timeout_seconds"
+            | "request_timeout"
+            | "max_retries"
+            | "req_format"
+            | "max_response_bytes"
+            | "azure_ad_token"
+            | "azure_ad_token_provider"
+            | "tenant_id"
+            | "client_id"
+            | "client_secret"
+            | "azure_scope"
+            | "azure_authority_host"
+            | "azure_credential"
+            | "azure_federated_token_file"
+            | "enable_azure_ad_token_refresh"
+            | "vertex_credentials"
+            | "vertex_ai_credentials"
+            | "vertex_project"
+            | "vertex_ai_project"
+            | "vertex_location"
+            | "vertex_ai_location"
+            | "aws_access_key_id"
+            | "aws_secret_access_key"
+            | "aws_session_token"
+            | "aws_region_name"
+            | "aws_session_name"
+            | "aws_profile_name"
+            | "aws_role_name"
+            | "aws_web_identity_token"
+            | "aws_sts_endpoint"
+            | "aws_external_id"
+            | "aws_bedrock_runtime_endpoint"
+    )
+}
+
+impl Deref for OpaqueParams {
+    type Target = Map<String, Value>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl DerefMut for OpaqueParams {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.0
+    }
+}
+
+impl From<Map<String, Value>> for OpaqueParams {
+    fn from(value: Map<String, Value>) -> Self {
+        Self(value)
+    }
+}
+
+impl From<OpaqueParams> for Map<String, Value> {
+    fn from(value: OpaqueParams) -> Self {
+        value.0
+    }
+}
+
+impl FromIterator<(String, Value)> for OpaqueParams {
+    fn from_iter<T: IntoIterator<Item = (String, Value)>>(iter: T) -> Self {
+        Self(iter.into_iter().collect())
+    }
+}
+
+impl IntoIterator for OpaqueParams {
+    type Item = (String, Value);
+    type IntoIter = serde_json::map::IntoIter;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.0.into_iter()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::OpaqueParams;
+
+    #[test]
+    fn outer_value_must_be_an_object() {
+        assert!(serde_json::from_value::<OpaqueParams>(json!(["value"])).is_err());
+    }
+}

litellm-rust/crates/core-utils/src/prompt_templates/factory.rs

@@ -10,9 +10,10 @@
 //! `_bedrock_converse_messages_pt` for the text-only surface this route
 //! accepts; anything richer is declined upstream by the capability gate.
 
-use crate::constants::EMPTY_TEXT_PLACEHOLDER;
+use litellm_types::llms::openai::{ChatMessage, ChatMessageContent};
 
-use super::types::{ChatMessage, ChatMessageContent};
+pub const EMPTY_TEXT_PLACEHOLDER: &str =
+    "[System: Empty message content sanitised to satisfy protocol]";
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum TurnRole {
@@ -132,9 +133,10 @@ pub fn build_conversation(messages: &[ChatMessage]) -> Conversation {
 
 #[cfg(test)]
 mod tests {
-    use super::*;
     use serde_json::json;
 
+    use super::*;
+
     fn messages(value: serde_json::Value) -> Vec<ChatMessage> {
         serde_json::from_value(value).expect("valid messages")
     }
@@ -203,8 +205,10 @@ mod tests {
             {"role": "assistant", "content": "   "},
             {"role": "user", "content": "real"}
         ])));
-        assert_eq!(conversation.turns[0].texts, vec![EMPTY_TEXT_PLACEHOLDER]);
-        assert_eq!(conversation.turns[1].texts, vec![EMPTY_TEXT_PLACEHOLDER]);
+        // Must equal `_EMPTY_TEXT_PLACEHOLDER` in litellm/litellm_core_utils/prompt_templates/factory.py
+        let placeholder = "[System: Empty message content sanitised to satisfy protocol]";
+        assert_eq!(conversation.turns[0].texts, vec![placeholder]);
+        assert_eq!(conversation.turns[1].texts, vec![placeholder]);
     }
 
     #[test]

litellm-rust/crates/core-utils/src/prompt_templates/mod.rs

@@ -0,0 +1 @@
+pub mod factory;

litellm-rust/crates/core-utils/src/serde_compat.rs

@@ -0,0 +1,152 @@
+use serde::{Deserialize, Deserializer, de::Error};
+use serde_json::Value;
+use serde_with::DeserializeAs;
+
+pub struct LaxI64;
+pub struct FiniteF64;
+
+impl<'de> DeserializeAs<'de, i64> for LaxI64 {
+    fn deserialize_as<D: Deserializer<'de>>(deserializer: D) -> Result<i64, D::Error> {
+        match Value::deserialize(deserializer)? {
+            Value::Number(number) if number.is_f64() => number.as_f64().and_then(integral_float),
+            Value::Number(number) => number.as_i64(),
+            Value::String(value) => integer_string(value.trim()),
+            Value::Bool(value) => Some(i64::from(value)),
+            _ => None,
+        }
+        .ok_or_else(|| D::Error::custom("expected an integer in the i64 range"))
+    }
+}
+
+impl<'de> DeserializeAs<'de, f64> for FiniteF64 {
+    fn deserialize_as<D: Deserializer<'de>>(deserializer: D) -> Result<f64, D::Error> {
+        match Value::deserialize(deserializer)? {
+            Value::Number(number) => number.as_f64(),
+            Value::String(value) => value.trim().parse::<f64>().ok(),
+            Value::Bool(value) => Some(f64::from(value)),
+            _ => None,
+        }
+        .filter(|value| value.is_finite())
+        .ok_or_else(|| D::Error::custom("expected a finite number"))
+    }
+}
+
+fn integer_string(value: &str) -> Option<i64> {
+    let integer = match value.split_once('.') {
+        Some((integer, fraction)) => {
+            if fraction.is_empty() || !fraction.bytes().all(|byte| byte == b'0') {
+                return None;
+            }
+            integer
+        }
+        None => value,
+    };
+    if integer.starts_with('_') || integer.ends_with('_') || integer.contains("__") {
+        return None;
+    }
+    let digits = integer.strip_prefix(['+', '-']).unwrap_or(integer);
+    if digits.is_empty()
+        || digits.starts_with('_')
+        || !digits
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || byte == b'_')
+    {
+        return None;
+    }
+    integer.replace('_', "").parse().ok()
+}
+
+fn integral_float(value: f64) -> Option<i64> {
+    (value.is_finite()
+        && value.fract() == 0.0
+        && value >= i64::MIN as f64
+        && value < -(i64::MIN as f64))
+        .then_some(value as i64)
+}
+
+#[cfg(test)]
+mod tests {
+    use serde::Serialize;
+    use serde_json::json;
+    use serde_with::serde_as;
+
+    use super::*;
+
+    #[serde_as]
+    #[derive(Debug, Deserialize, Serialize, PartialEq)]
+    struct Numbers {
+        #[serde_as(deserialize_as = "Option<Vec<LaxI64>>")]
+        integers: Option<Vec<i64>>,
+        #[serde_as(deserialize_as = "Option<FiniteF64>")]
+        float: Option<f64>,
+    }
+
+    #[test]
+    fn adapters_compose_and_serialize_as_numbers() {
+        let numbers: Numbers = serde_json::from_value(json!({
+            "integers": ["9007199254740993.0", "1_000", " +2.000 ", 3.0, true],
+            "float": " 1.5 "
+        }))
+        .unwrap();
+        assert_eq!(
+            serde_json::to_value(numbers).unwrap(),
+            json!({
+                "integers": [9_007_199_254_740_993_i64, 1000, 2, 3, 1], "float": 1.5
+            })
+        );
+        for input in [json!({}), json!({"integers": null, "float": null})] {
+            assert_eq!(
+                serde_json::from_value::<Numbers>(input).unwrap(),
+                Numbers {
+                    integers: None,
+                    float: None,
+                }
+            );
+        }
+    }
+
+    #[test]
+    fn integer_bounds_and_invalid_values_are_checked() {
+        for input in [
+            json!(i64::MIN),
+            json!(i64::MAX),
+            json!(i64::MAX.to_string()),
+        ] {
+            assert!(serde_json::from_value::<Numbers>(json!({"integers": [input]})).is_ok());
+        }
+        for input in [
+            json!(u64::MAX),
+            json!(9_223_372_036_854_775_808_u64),
+            json!(9_223_372_036_854_775_808.0),
+            json!("-9223372036854775809"),
+            json!("1.0000000000000001"),
+            json!("1e3"),
+            json!("2."),
+            json!(".0"),
+            json!("_2"),
+            json!("2__0"),
+            json!(2.5),
+            json!(null),
+            json!({}),
+        ] {
+            assert!(serde_json::from_value::<Numbers>(json!({"integers": [input]})).is_err());
+        }
+    }
+
+    #[test]
+    fn floats_reject_nonfinite_and_invalid_values() {
+        for input in [
+            json!("NaN"),
+            json!("inf"),
+            json!("-inf"),
+            json!("1e999"),
+            json!([]),
+        ] {
+            assert!(serde_json::from_value::<Numbers>(json!({"float": input})).is_err());
+        }
+        for (input, expected) in [(json!(2), 2.0), (json!(2.5), 2.5), (json!(true), 1.0)] {
+            let numbers: Numbers = serde_json::from_value(json!({"float": input})).unwrap();
+            assert_eq!(numbers.float, Some(expected));
+        }
+    }
+}

litellm-rust/crates/core-utils/src/url_utils.rs

@@ -3,33 +3,30 @@ use std::marker::PhantomData;
 use url::Url;
 
 #[derive(Debug, thiserror::Error)]
-pub(crate) enum ApiUrlError {
+pub enum ApiUrlError {
     #[error("invalid URL: {0}")]
     Parse(#[from] url::ParseError),
     #[error("URL cannot be used as a base")]
     CannotBeBase,
 }
 
-pub(crate) struct Base;
-pub(crate) struct Complete;
+pub struct Base;
+pub struct Complete;
 
-pub(crate) struct ApiUrl<State> {
+pub struct ApiUrl<State> {
     url: Url,
     state: PhantomData<State>,
 }
 
 impl ApiUrl<Base> {
-    pub(crate) fn parse(value: &str) -> Result<Self, ApiUrlError> {
+    pub fn parse(value: &str) -> Result<Self, ApiUrlError> {
         Ok(Self {
             url: Url::parse(value.trim())?,
             state: PhantomData,
         })
     }
 
-    pub(crate) fn complete_path(
-        mut self,
-        target: &[&str],
-    ) -> Result<ApiUrl<Complete>, ApiUrlError> {
+    pub fn complete_path(mut self, target: &[&str]) -> Result<ApiUrl<Complete>, ApiUrlError> {
         let existing: Vec<String> = self
             .url
             .path_segments()
@@ -59,7 +56,7 @@ impl ApiUrl<Base> {
 }
 
 impl ApiUrl<Complete> {
-    pub(crate) fn append_query_pairs<'a>(
+    pub fn append_query_pairs<'a>(
         mut self,
         pairs: impl IntoIterator<Item = (&'a str, &'a str)>,
     ) -> Self {
@@ -67,7 +64,7 @@ impl ApiUrl<Complete> {
         self
     }
 
-    pub(crate) fn into_string(self) -> String {
+    pub fn into_string(self) -> String {
         self.url.into()
     }
 }

litellm-rust/crates/core/AGENTS.md

@@ -1,7 +1,14 @@
 litellm-core is the LiteLLM SDK in Rust — it makes the LLM call. Each top-level call is a module under `src/<route>/` exposing a public entrypoint named after the route (`messages::messages()`, the Rust equivalent of `litellm.messages()`): you call it and get a typed non-streaming response back.
 
-A route module owns everything the call needs: types, the provider template trait, provider transforms (under `providers/`), provider/auth/URL resolution, and the handler that performs the HTTP call. Handlers belong here, never in a host crate.
+## Crate layering
 
-Not here: serving HTTP (axum routes, extractors), config file reading, rollout state, databases, or host-specific callback execution. Core owns lifecycle sequencing and callback payload construction; hosts execute the selected integrations. Env reads are limited to credential fallback in a route's `prepare.rs`.
+Each crate mirrors one top-level Python package, so a Rust path reads as its Python path with the crate name in place of the package directory. Dependencies only point down:
 
-Routes (messages, ocr, realtime) and providers (anthropic, mistral, openai) are modules, not crates.
+- `litellm-types` mirrors `litellm/types/`: pure serde data, no I/O
+- `litellm-core-utils` mirrors `litellm/litellm_core_utils/`: pure helpers (provider resolution, prompt factory, call arguments), no network I/O
+- `litellm-llms` mirrors `litellm/llms/`: `base_llm/<api>/transformation.rs`, `<provider>/<api>/transformation.rs`, and `custom_httpx/` (HTTP helpers and the OCR request handler)
+- `litellm-core` mirrors the route packages (`litellm/ocr/`, `litellm/messages/`, ...): entrypoints, route request types, provider dispatch, the route machine, and hooks
+
+A route module owns the call entrypoint, route request types (`*Request<'a>`), credential fallback, provider dispatch, and the handler glue that runs a provider config. Provider code never imports from core; when it needs the caller's hooks mid-call it goes through `litellm_llms::custom_httpx::llm_http_handler::CallHooks`, which each route implements over its host. Import every item from its canonical path. Never re-export another crate's items or give an item a second public path; the only re-export allowed is a private submodule surfacing its item at its module root (`mod error; pub use error::Error;`). Handlers belong in core or llms, never in a host crate
+
+Not here: serving HTTP (axum routes, extractors), config file reading, rollout state, databases, or callback execution of any kind. Core runs each route as a machine that yields host operations and call events; which integrations consume those events is the host's business.

litellm-rust/crates/core/Cargo.toml

@@ -7,14 +7,15 @@ repository.workspace = true
 autotests = false
 
 [dependencies]
+litellm-types.workspace = true
+litellm-core-utils.workspace = true
+litellm-callbacks.workspace = true
 bytes.workspace = true
 futures-util.workspace = true
 base64.workspace = true
-data-url = "0.3.2"
 litellm-auth.workspace = true
 litellm-auth-aws.workspace = true
-litellm-auth-azure.workspace = true
-litellm-auth-gcp.workspace = true
+litellm-llms.workspace = true
 moka.workspace = true
 mime_guess = "2.0.5"
 rand.workspace = true
@@ -22,16 +23,18 @@ reqwest.workspace = true
 rustls.workspace = true
 rustls-native-certs.workspace = true
 serde.workspace = true
-serde_json.workspace = true
-serde_path_to_error = "0.1"
+serde_json = { workspace = true, features = ["preserve_order"] }
 strum.workspace = true
 subtle.workspace = true
 tokio = { workspace = true, features = ["sync"] }
 tokio-tungstenite.workspace = true
 thiserror.workspace = true
+time.workspace = true
 sha2.workspace = true
 url.workspace = true
 veil.workspace = true
 
 [dev-dependencies]
+litellm-llms = { workspace = true, features = ["test-support"] }
 rstest.workspace = true
+rstest_reuse.workspace = true

litellm-rust/crates/core/src/audio_transcription/client.rs

@@ -1,5 +1,4 @@
-use std::sync::OnceLock;
-use std::time::Duration;
+use std::{sync::OnceLock, time::Duration};
 
 use crate::constants::AUDIO_TRANSCRIPTION_TIMEOUT_SECS;
 

litellm-rust/crates/core/src/audio_transcription/error.rs

@@ -1,3 +1,5 @@
+use litellm_llms::base_llm::chat::transformation::Error as LlmError;
+
 #[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
 pub enum Error {
     #[error("expected {expected}, got {actual}")]
@@ -18,9 +20,22 @@ pub enum Error {
     #[error(transparent)]
     Auth(#[from] litellm_auth::Error),
     #[error(transparent)]
-    Transport(#[from] crate::transport::Error),
+    Transport(#[from] litellm_llms::custom_httpx::transport::Error),
     #[error(transparent)]
-    Headers(#[from] crate::http_utils::HeaderError),
+    Headers(#[from] litellm_llms::custom_httpx::http_handler::HeaderError),
     #[error(transparent)]
     Aws(#[from] litellm_auth_aws::Error),
 }
+
+impl From<LlmError> for Error {
+    fn from(error: LlmError) -> Self {
+        match error {
+            LlmError::InvalidType { expected, actual } => Self::InvalidType { expected, actual },
+            LlmError::MissingField(field) => Self::MissingField(field),
+            LlmError::InvalidRequest(message) => Self::InvalidRequest(message),
+            LlmError::InvalidResponse(message) => Self::InvalidResponse(message),
+            LlmError::Unsupported(reason) => Self::Unsupported(reason),
+            LlmError::Auth(error) => Self::Auth(error),
+        }
+    }
+}

litellm-rust/crates/core/src/audio_transcription/handler.rs

@@ -1,10 +1,8 @@
+use litellm_llms::custom_httpx::http_handler::{http_request, truncate_error_body};
 use serde_json::Value;
 
-use super::Error;
-use crate::http_utils::{http_request, truncate_error_body};
-
-use super::client::http_client;
-use super::types::ProviderAudioTranscriptionRequest;
+use super::{Error, client::http_client};
+use crate::audio_transcription::types::ProviderAudioTranscriptionRequest;
 
 pub async fn execute_audio_transcription_provider_call(
     request: ProviderAudioTranscriptionRequest,
@@ -19,25 +17,30 @@ pub async fn execute_audio_transcription_provider_call(
     if let Some(duration) = request.timeout {
         request_builder = request_builder.timeout(duration);
     }
-    let response = http_request(request_builder)
-        .await
-        .map_err(|error| Error::Transport(crate::transport::Error::Network(error.to_string())))?;
+    let response = http_request(request_builder).await.map_err(|error| {
+        Error::Transport(litellm_llms::custom_httpx::transport::Error::Network(
+            error.to_string(),
+        ))
+    })?;
     let status = response.status();
-    let text = response
-        .text()
-        .await
-        .map_err(|error| Error::Transport(crate::transport::Error::Network(error.to_string())))?;
+    let text = response.text().await.map_err(|error| {
+        Error::Transport(litellm_llms::custom_httpx::transport::Error::Network(
+            error.to_string(),
+        ))
+    })?;
     if !status.is_success() {
-        return Err(Error::Transport(crate::transport::Error::Http {
-            status: status.as_u16(),
-            body: truncate_error_body(&text),
-        }));
+        return Err(Error::Transport(
+            litellm_llms::custom_httpx::transport::Error::Http {
+                status: status.as_u16(),
+                body: truncate_error_body(&text),
+            },
+        ));
     }
     let response_json = serde_json::from_str(&text)
         .map_err(|error| Error::InvalidResponse(format!("invalid audio response JSON: {error}")))?;
     Ok(request
         .config
-        .transform_transcription_response(&request.model, response_json)?
+        .transform_audio_transcription_response(&request.model, response_json)?
         .into_json())
 }
 
@@ -45,12 +48,10 @@ async fn signed_headers(
     request: &ProviderAudioTranscriptionRequest,
     body: &[u8],
 ) -> Result<Vec<(String, String)>, Error> {
-    use std::collections::BTreeMap;
-    use std::time::SystemTime;
+    use std::{collections::BTreeMap, time::SystemTime};
 
-    use crate::audio_transcription::transformation::AudioTranscriptionAuth;
-    use crate::providers::bedrock::audio_transcription::aws_auth_config;
-    use crate::providers::bedrock::aws_base::{resolve_credentials, sign_bedrock_post};
+    use litellm_auth_aws::{aws_auth_config, resolve_credentials, sign_bedrock_post};
+    use litellm_llms::base_llm::audio_transcription::transformation::AudioTranscriptionAuth;
 
     let AudioTranscriptionAuth::AwsSigV4 { region, .. } = &request.auth else {
         return Ok(request.upstream_headers.clone());

litellm-rust/crates/core/src/audio_transcription/mod.rs

@@ -1,16 +1,14 @@
 mod error;
+pub mod types;
 pub use error::Error;
 mod client;
 mod handler;
 mod prepare;
-pub mod transformation;
-pub mod types;
-
-use serde_json::Value;
-
 pub use handler::execute_audio_transcription_provider_call;
 pub use prepare::prepare_audio_transcription_provider_call;
-pub use types::{AudioTranscriptionRequest, ProviderAudioTranscriptionRequest};
+use serde_json::Value;
+
+use crate::audio_transcription::types::AudioTranscriptionRequest;
 
 pub async fn audio_transcription(request: AudioTranscriptionRequest<'_>) -> Result<Value, Error> {
     execute_audio_transcription_provider_call(prepare_audio_transcription_provider_call(request)?)

litellm-rust/crates/core/src/audio_transcription/prepare.rs

@@ -1,12 +1,18 @@
+use litellm_core_utils::get_llm_provider_logic::{CustomLlmProvider, get_custom_llm_provider};
+use litellm_llms::{
+    base_llm::audio_transcription::transformation::{
+        AudioTranscriptionAuth, BaseAudioTranscriptionConfig,
+    },
+    bedrock::audio_transcription::BEDROCK_AUDIO_TRANSCRIPTION_CONFIG,
+    custom_httpx::http_handler::{has_header, string_headers},
+};
+
 use super::Error;
-use crate::http_utils::{has_header, string_headers};
-use crate::providers::bedrock::audio_transcription::BEDROCK_AUDIO_TRANSCRIPTION_CONFIG;
-use crate::providers::custom_llm_provider::{CustomLlmProvider, get_custom_llm_provider};
+use crate::audio_transcription::types::{
+    AudioTranscriptionRequest, ProviderAudioTranscriptionRequest,
+};
 
-use super::transformation::{AudioTranscriptionAuth, AudioTranscriptionProviderConfig};
-use super::types::{AudioTranscriptionRequest, ProviderAudioTranscriptionRequest};
-
-fn provider_config(provider: &str) -> Option<&'static dyn AudioTranscriptionProviderConfig> {
+fn provider_config(provider: &str) -> Option<&'static dyn BaseAudioTranscriptionConfig> {
     if provider == "bedrock" {
         return Some(&BEDROCK_AUDIO_TRANSCRIPTION_CONFIG);
     }
@@ -46,7 +52,7 @@ pub fn prepare_audio_transcription_provider_call(
     if !has_header(&headers, "content-type") {
         headers.push(("Content-Type".to_string(), "application/json".to_string()));
     }
-    let url = config.complete_url(
+    let url = config.get_complete_url(
         request.api_base,
         &model,
         &request.optional_params,
@@ -54,7 +60,7 @@ pub fn prepare_audio_transcription_provider_call(
     )?;
     let filtered_params = config.map_transcription_params(&request.optional_params);
     let transformed =
-        config.transform_transcription_request(&model, request.audio, filtered_params)?;
+        config.transform_audio_transcription_request(&model, request.audio, filtered_params)?;
     Ok(ProviderAudioTranscriptionRequest {
         model,
         custom_llm_provider: provider_info.custom_llm_provider.to_string(),

litellm-rust/crates/core/src/audio_transcription/tests.rs

@@ -1,11 +1,13 @@
-use std::io::{Read, Write};
-use std::net::TcpListener;
-use std::thread;
+use std::{
+    io::{Read, Write},
+    net::TcpListener,
+    thread,
+};
 
 use serde_json::{Map, json};
 
 use super::audio_transcription;
-use super::types::AudioTranscriptionRequest;
+use crate::audio_transcription::types::AudioTranscriptionRequest;
 
 #[tokio::test]
 async fn bedrock_request_is_signed_and_contains_audio() {

litellm-rust/crates/core/src/audio_transcription/types.rs

@@ -1,10 +1,10 @@
 use std::time::Duration;
 
-use serde::{Deserialize, Serialize};
+use litellm_llms::base_llm::audio_transcription::transformation::{
+    AudioTranscriptionAuth, BaseAudioTranscriptionConfig,
+};
 use serde_json::{Map, Value};
 
-use super::transformation::{AudioTranscriptionAuth, AudioTranscriptionProviderConfig};
-
 pub struct AudioTranscriptionRequest<'a> {
     pub model: &'a str,
     pub audio: Value,
@@ -18,15 +18,15 @@ pub struct AudioTranscriptionRequest<'a> {
 
 #[derive(Clone)]
 pub struct ProviderAudioTranscriptionRequest {
-    pub(super) model: String,
-    pub(super) custom_llm_provider: String,
-    pub(super) config: &'static dyn AudioTranscriptionProviderConfig,
-    pub(super) url: String,
-    pub(super) body: Value,
-    pub(super) upstream_headers: Vec<(String, String)>,
-    pub(super) auth: AudioTranscriptionAuth,
-    pub(super) optional_params: Map<String, Value>,
-    pub(super) timeout: Option<Duration>,
+    pub model: String,
+    pub custom_llm_provider: String,
+    pub config: &'static dyn BaseAudioTranscriptionConfig,
+    pub url: String,
+    pub body: Value,
+    pub upstream_headers: Vec<(String, String)>,
+    pub auth: AudioTranscriptionAuth,
+    pub optional_params: Map<String, Value>,
+    pub timeout: Option<Duration>,
 }
 
 impl ProviderAudioTranscriptionRequest {
@@ -50,21 +50,3 @@ impl ProviderAudioTranscriptionRequest {
         Self { body, ..self }
     }
 }
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct AudioTranscriptionRequestData {
-    pub body: Value,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct AudioTranscriptionResponseData {
-    pub text: String,
-}
-
-impl AudioTranscriptionResponseData {
-    pub fn into_json(self) -> Value {
-        serde_json::json!({
-            "text": self.text,
-        })
-    }
-}

litellm-rust/crates/core/src/call_lifecycle/host.rs

@@ -1,122 +0,0 @@
-use std::future::Future;
-use std::pin::Pin;
-
-pub enum HostCallStep<O, C> {
-    Host(O),
-    Complete(C),
-}
-
-pub type HostCallFuture<'a, O, C, E> =
-    Pin<Box<dyn Future<Output = Result<HostCallStep<O, C>, E>> + Send + 'a>>;
-
-pub trait HostCall: Send + Sync {
-    type Error: Send + Sync + 'static;
-    type Operation: Send + 'static;
-    type Result: Send + 'static;
-    type Complete: Send + 'static;
-
-    fn resume(
-        &mut self,
-        result: Option<Self::Result>,
-    ) -> HostCallFuture<'_, Self::Operation, Self::Complete, Self::Error>;
-
-    fn interrupt(
-        &mut self,
-        failure: HostFailure<Self::Error>,
-    ) -> HostCallFuture<'_, Self::Operation, Self::Complete, Self::Error>;
-}
-
-pub enum HostStep<V, S> {
-    Ready(V),
-    Suspend(S),
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum HostPhase {
-    Setup,
-    DeploymentPreCall,
-    Prepare,
-    Execute,
-    ConstructResponse,
-    DeploymentPostCall,
-    Finalize,
-    Success,
-    MapFailure,
-    DeploymentFailure,
-    Failure,
-    AsyncFailure,
-    Complete,
-}
-
-#[derive(Clone, Debug)]
-pub enum HostFailure<E> {
-    Error(E),
-    Cancelled(E),
-}
-
-pub struct HostLifecycle {
-    phase: HostPhase,
-    asynchronous: bool,
-}
-
-impl HostLifecycle {
-    pub fn new(asynchronous: bool) -> Self {
-        Self {
-            phase: HostPhase::Setup,
-            asynchronous,
-        }
-    }
-
-    pub fn phase(&self) -> HostPhase {
-        self.phase
-    }
-
-    pub fn accept<E>(&mut self, result: Result<(), HostFailure<E>>) -> Option<E> {
-        if let Err(failure) = result {
-            if self.phase == HostPhase::DeploymentFailure {
-                self.phase = HostPhase::Failure;
-                return None;
-            }
-            let error = match failure {
-                HostFailure::Cancelled(error) => {
-                    self.phase = HostPhase::Complete;
-                    return Some(error);
-                }
-                HostFailure::Error(error) => error,
-            };
-            match self.phase {
-                HostPhase::Failure | HostPhase::AsyncFailure => {
-                    self.advance();
-                    return None;
-                }
-                HostPhase::Success => self.phase = HostPhase::Complete,
-                HostPhase::Execute | HostPhase::ConstructResponse => {
-                    self.phase = HostPhase::MapFailure;
-                }
-                _ => self.phase = HostPhase::Failure,
-            }
-            return Some(error);
-        }
-        self.advance();
-        None
-    }
-
-    fn advance(&mut self) {
-        self.phase = match self.phase {
-            HostPhase::Setup if self.asynchronous => HostPhase::DeploymentPreCall,
-            HostPhase::Setup | HostPhase::DeploymentPreCall => HostPhase::Prepare,
-            HostPhase::Prepare => HostPhase::Execute,
-            HostPhase::Execute => HostPhase::ConstructResponse,
-            HostPhase::ConstructResponse if self.asynchronous => HostPhase::DeploymentPostCall,
-            HostPhase::ConstructResponse | HostPhase::DeploymentPostCall => HostPhase::Finalize,
-            HostPhase::Finalize => HostPhase::Success,
-            HostPhase::MapFailure if self.asynchronous => HostPhase::DeploymentFailure,
-            HostPhase::MapFailure | HostPhase::DeploymentFailure => HostPhase::Failure,
-            HostPhase::Failure if self.asynchronous => HostPhase::AsyncFailure,
-            HostPhase::Failure
-            | HostPhase::AsyncFailure
-            | HostPhase::Success
-            | HostPhase::Complete => HostPhase::Complete,
-        };
-    }
-}

litellm-rust/crates/core/src/call_lifecycle/mod.rs

@@ -1,426 +0,0 @@
-use std::future::Future;
-use std::time::{Instant, SystemTime, UNIX_EPOCH};
-
-pub mod host;
-#[cfg(test)]
-#[path = "../../tests/host_lifecycle.rs"]
-mod host_tests;
-pub mod types;
-
-pub use types::{
-    CallLifecycleContext, CallLifecyclePhase, CallLifecyclePhaseTiming, CallLifecycleRequest,
-    CallLifecycleTiming,
-};
-
-pub trait CallLifecycleHooks<InitialReq, ProviderReq, Resp>: Send + Sync {
-    type Error: Send + Sync;
-    type PreCallFuture<'a>: Future<Output = Result<InitialReq, Self::Error>> + Send + 'a
-    where
-        Self: 'a,
-        InitialReq: 'a,
-        ProviderReq: 'a,
-        Resp: 'a;
-
-    type DuringCallFuture<'a>: Future<Output = Result<ProviderReq, Self::Error>> + Send + 'a
-    where
-        Self: 'a,
-        InitialReq: 'a,
-        ProviderReq: 'a,
-        Resp: 'a;
-
-    type SuccessFuture<'a>: Future<Output = ()> + Send + 'a
-    where
-        Self: 'a,
-        Resp: 'a;
-
-    type FailureFuture<'a>: Future<Output = ()> + Send + 'a
-    where
-        Self: 'a;
-
-    fn async_pre_call_hook<'a>(
-        &'a self,
-        context: &'a CallLifecycleContext,
-        request: InitialReq,
-    ) -> Self::PreCallFuture<'a>;
-
-    fn async_during_call_hook<'a>(
-        &'a self,
-        context: &'a CallLifecycleContext,
-        request: InitialReq,
-    ) -> Self::DuringCallFuture<'a>;
-
-    fn async_log_success_event<'a>(
-        &'a self,
-        context: &'a CallLifecycleContext,
-        response: &'a Resp,
-        timing: &'a CallLifecycleTiming,
-    ) -> Self::SuccessFuture<'a>;
-
-    fn async_log_failure_event<'a>(
-        &'a self,
-        context: &'a CallLifecycleContext,
-        error: &'a Self::Error,
-        timing: &'a CallLifecycleTiming,
-    ) -> Self::FailureFuture<'a>;
-}
-
-pub trait CallLifecycleObserver: Send + Sync {
-    fn on_phase_start(&self, _context: &CallLifecycleContext, _phase: CallLifecyclePhase) {}
-
-    fn on_phase_end(&self, _context: &CallLifecycleContext, _timing: &CallLifecyclePhaseTiming) {}
-}
-
-#[derive(Default)]
-pub struct NoopCallLifecycleObserver;
-
-impl CallLifecycleObserver for NoopCallLifecycleObserver {}
-
-pub struct CallLifecycle<'a> {
-    observer: &'a dyn CallLifecycleObserver,
-}
-
-impl<'a> CallLifecycle<'a> {
-    pub fn new(observer: &'a dyn CallLifecycleObserver) -> Self {
-        Self { observer }
-    }
-
-    pub async fn run_request<InitialReq, ProviderReq, Resp, Hooks, ProviderCall, ProviderFuture>(
-        &self,
-        request: InitialReq,
-        hooks: &Hooks,
-        provider_call: ProviderCall,
-    ) -> Result<Resp, Hooks::Error>
-    where
-        InitialReq: CallLifecycleRequest,
-        Hooks: CallLifecycleHooks<InitialReq, ProviderReq, Resp>,
-        ProviderCall: FnOnce(ProviderReq) -> ProviderFuture,
-        ProviderFuture: Future<Output = Result<Resp, Hooks::Error>>,
-    {
-        let context = request.lifecycle_context();
-        self.run(context, request, hooks, provider_call).await
-    }
-
-    pub async fn run<InitialReq, ProviderReq, Resp, Hooks, ProviderCall, ProviderFuture>(
-        &self,
-        context: CallLifecycleContext,
-        request: InitialReq,
-        hooks: &Hooks,
-        provider_call: ProviderCall,
-    ) -> Result<Resp, Hooks::Error>
-    where
-        Hooks: CallLifecycleHooks<InitialReq, ProviderReq, Resp>,
-        ProviderCall: FnOnce(ProviderReq) -> ProviderFuture,
-        ProviderFuture: Future<Output = Result<Resp, Hooks::Error>>,
-    {
-        let call_start = epoch_seconds();
-        let mut phases = Vec::new();
-
-        let pre_call = self.start_phase(&context, CallLifecyclePhase::PreCall);
-        let request = match hooks.async_pre_call_hook(&context, request).await {
-            Ok(request) => {
-                phases.push(self.finish_phase(&context, pre_call));
-                request
-            }
-            Err(error) => {
-                phases.push(self.finish_phase(&context, pre_call));
-                self.log_failure(&context, hooks, &error, call_start, &mut phases)
-                    .await;
-                return Err(error);
-            }
-        };
-
-        let during_call = self.start_phase(&context, CallLifecyclePhase::DuringCall);
-        let provider_request = match hooks.async_during_call_hook(&context, request).await {
-            Ok(request) => {
-                phases.push(self.finish_phase(&context, during_call));
-                request
-            }
-            Err(error) => {
-                phases.push(self.finish_phase(&context, during_call));
-                self.log_failure(&context, hooks, &error, call_start, &mut phases)
-                    .await;
-                return Err(error);
-            }
-        };
-
-        let provider_phase = self.start_phase(&context, CallLifecyclePhase::ProviderCall);
-        let result = provider_call(provider_request).await;
-        phases.push(self.finish_phase(&context, provider_phase));
-
-        match &result {
-            Ok(response) => {
-                let success_phase = self.start_phase(&context, CallLifecyclePhase::SuccessCallback);
-                let timing = CallLifecycleTiming::new(call_start, epoch_seconds(), phases.clone());
-                hooks
-                    .async_log_success_event(&context, response, &timing)
-                    .await;
-                phases.push(self.finish_phase(&context, success_phase));
-            }
-            Err(error) => {
-                self.log_failure(&context, hooks, error, call_start, &mut phases)
-                    .await;
-            }
-        }
-
-        result
-    }
-
-    async fn log_failure<InitialReq, ProviderReq, Resp, Hooks>(
-        &self,
-        context: &CallLifecycleContext,
-        hooks: &Hooks,
-        error: &Hooks::Error,
-        call_start: f64,
-        phases: &mut Vec<CallLifecyclePhaseTiming>,
-    ) where
-        Hooks: CallLifecycleHooks<InitialReq, ProviderReq, Resp>,
-    {
-        let failure_phase = self.start_phase(context, CallLifecyclePhase::FailureCallback);
-        let timing = CallLifecycleTiming::new(call_start, epoch_seconds(), phases.clone());
-        hooks.async_log_failure_event(context, error, &timing).await;
-        phases.push(self.finish_phase(context, failure_phase));
-    }
-
-    fn start_phase(&self, context: &CallLifecycleContext, phase: CallLifecyclePhase) -> PhaseStart {
-        self.observer.on_phase_start(context, phase);
-        PhaseStart {
-            phase,
-            start_time: epoch_seconds(),
-            started_at: Instant::now(),
-        }
-    }
-
-    fn finish_phase(
-        &self,
-        context: &CallLifecycleContext,
-        phase_start: PhaseStart,
-    ) -> CallLifecyclePhaseTiming {
-        let timing = CallLifecyclePhaseTiming {
-            phase: phase_start.phase,
-            start_time: phase_start.start_time,
-            end_time: epoch_seconds(),
-            duration: phase_start.started_at.elapsed(),
-        };
-        self.observer.on_phase_end(context, &timing);
-        timing
-    }
-}
-
-impl Default for CallLifecycle<'static> {
-    fn default() -> Self {
-        static OBSERVER: NoopCallLifecycleObserver = NoopCallLifecycleObserver;
-        Self::new(&OBSERVER)
-    }
-}
-
-struct PhaseStart {
-    phase: CallLifecyclePhase,
-    start_time: f64,
-    started_at: Instant,
-}
-
-fn epoch_seconds() -> f64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|duration| duration.as_secs_f64())
-        .unwrap_or(0.0)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::pin::Pin;
-    use std::sync::Mutex;
-
-    type BoxFuture<'a, T> = Pin<Box<dyn Future<Output = T> + Send + 'a>>;
-
-    #[derive(Default)]
-    struct RecordingHooks {
-        events: Mutex<Vec<&'static str>>,
-    }
-
-    struct RecordingRequest(String);
-
-    impl CallLifecycleRequest for RecordingRequest {
-        fn lifecycle_context(&self) -> CallLifecycleContext {
-            CallLifecycleContext::new("ocr", "mistral-ocr-latest", "mistral", "call_1")
-        }
-    }
-
-    impl RecordingHooks {
-        fn events(&self) -> Vec<&'static str> {
-            self.events.lock().unwrap().clone()
-        }
-    }
-
-    impl CallLifecycleHooks<String, String, String> for RecordingHooks {
-        type Error = crate::messages::Error;
-        type PreCallFuture<'a> = BoxFuture<'a, Result<String, crate::messages::Error>>;
-        type DuringCallFuture<'a> = BoxFuture<'a, Result<String, crate::messages::Error>>;
-        type SuccessFuture<'a> = BoxFuture<'a, ()>;
-        type FailureFuture<'a> = BoxFuture<'a, ()>;
-
-        fn async_pre_call_hook<'a>(
-            &'a self,
-            _context: &'a CallLifecycleContext,
-            request: String,
-        ) -> Self::PreCallFuture<'a> {
-            Box::pin(async move {
-                self.events.lock().unwrap().push("pre_call");
-                Ok(format!("{request}:pre"))
-            })
-        }
-
-        fn async_during_call_hook<'a>(
-            &'a self,
-            _context: &'a CallLifecycleContext,
-            request: String,
-        ) -> Self::DuringCallFuture<'a> {
-            Box::pin(async move {
-                self.events.lock().unwrap().push("during_call");
-                Ok(format!("{request}:during"))
-            })
-        }
-
-        fn async_log_success_event<'a>(
-            &'a self,
-            _context: &'a CallLifecycleContext,
-            _response: &'a String,
-            timing: &'a CallLifecycleTiming,
-        ) -> Self::SuccessFuture<'a> {
-            Box::pin(async move {
-                assert!(timing.end_time >= timing.start_time);
-                assert_eq!(timing.phases.len(), 3);
-                self.events.lock().unwrap().push("success");
-            })
-        }
-
-        fn async_log_failure_event<'a>(
-            &'a self,
-            _context: &'a CallLifecycleContext,
-            _error: &'a crate::messages::Error,
-            _timing: &'a CallLifecycleTiming,
-        ) -> Self::FailureFuture<'a> {
-            Box::pin(async move {
-                self.events.lock().unwrap().push("failure");
-            })
-        }
-    }
-
-    impl CallLifecycleHooks<RecordingRequest, String, String> for RecordingHooks {
-        type Error = crate::messages::Error;
-        type PreCallFuture<'a> = BoxFuture<'a, Result<RecordingRequest, crate::messages::Error>>;
-        type DuringCallFuture<'a> = BoxFuture<'a, Result<String, crate::messages::Error>>;
-        type SuccessFuture<'a> = BoxFuture<'a, ()>;
-        type FailureFuture<'a> = BoxFuture<'a, ()>;
-
-        fn async_pre_call_hook<'a>(
-            &'a self,
-            _context: &'a CallLifecycleContext,
-            request: RecordingRequest,
-        ) -> Self::PreCallFuture<'a> {
-            Box::pin(async move {
-                self.events.lock().unwrap().push("pre_call");
-                Ok(RecordingRequest(format!("{}:pre", request.0)))
-            })
-        }
-
-        fn async_during_call_hook<'a>(
-            &'a self,
-            _context: &'a CallLifecycleContext,
-            request: RecordingRequest,
-        ) -> Self::DuringCallFuture<'a> {
-            Box::pin(async move {
-                self.events.lock().unwrap().push("during_call");
-                Ok(format!("{}:during", request.0))
-            })
-        }
-
-        fn async_log_success_event<'a>(
-            &'a self,
-            _context: &'a CallLifecycleContext,
-            _response: &'a String,
-            _timing: &'a CallLifecycleTiming,
-        ) -> Self::SuccessFuture<'a> {
-            Box::pin(async move {
-                self.events.lock().unwrap().push("success");
-            })
-        }
-
-        fn async_log_failure_event<'a>(
-            &'a self,
-            _context: &'a CallLifecycleContext,
-            _error: &'a crate::messages::Error,
-            _timing: &'a CallLifecycleTiming,
-        ) -> Self::FailureFuture<'a> {
-            Box::pin(async move {
-                self.events.lock().unwrap().push("failure");
-            })
-        }
-    }
-
-    #[tokio::test]
-    async fn lifecycle_runs_hooks_around_provider_call() {
-        let hooks = RecordingHooks::default();
-        let response = CallLifecycle::default()
-            .run(
-                CallLifecycleContext::new("ocr", "mistral-ocr-latest", "mistral", "call_1"),
-                "request".to_string(),
-                &hooks,
-                |request| async move {
-                    assert_eq!(request, "request:pre:during");
-                    Ok("response".to_string())
-                },
-            )
-            .await
-            .expect("call succeeds");
-
-        assert_eq!(response, "response");
-        assert_eq!(hooks.events(), vec!["pre_call", "during_call", "success"]);
-    }
-
-    #[tokio::test]
-    async fn lifecycle_logs_failure_when_provider_fails() {
-        let hooks = RecordingHooks::default();
-        let error = CallLifecycle::default()
-            .run(
-                CallLifecycleContext::new("ocr", "mistral-ocr-latest", "mistral", "call_1"),
-                "request".to_string(),
-                &hooks,
-                |_request| async move {
-                    Err::<String, crate::messages::Error>(crate::messages::Error::Transport(
-                        crate::transport::Error::Network("provider down".to_string()),
-                    ))
-                },
-            )
-            .await
-            .expect_err("call fails");
-
-        assert_eq!(
-            error,
-            crate::messages::Error::Transport(crate::transport::Error::Network(
-                "provider down".to_string()
-            ))
-        );
-        assert_eq!(hooks.events(), vec!["pre_call", "during_call", "failure"]);
-    }
-
-    #[tokio::test]
-    async fn lifecycle_can_run_any_request_with_embedded_context() {
-        let hooks = RecordingHooks::default();
-        let response = CallLifecycle::default()
-            .run_request(
-                RecordingRequest("request".to_string()),
-                &hooks,
-                |request| async move {
-                    assert_eq!(request, "request:pre:during");
-                    Ok("response".to_string())
-                },
-            )
-            .await
-            .expect("call succeeds");
-
-        assert_eq!(response, "response");
-        assert_eq!(hooks.events(), vec!["pre_call", "during_call", "success"]);
-    }
-}

litellm-rust/crates/core/src/call_lifecycle/types.rs

@@ -1,75 +0,0 @@
-use std::time::Duration;
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct CallLifecycleContext {
-    pub call_type: String,
-    pub model: String,
-    pub custom_llm_provider: String,
-    pub litellm_call_id: String,
-}
-
-impl CallLifecycleContext {
-    pub fn new(
-        call_type: impl Into<String>,
-        model: impl Into<String>,
-        custom_llm_provider: impl Into<String>,
-        litellm_call_id: impl Into<String>,
-    ) -> Self {
-        Self {
-            call_type: call_type.into(),
-            model: model.into(),
-            custom_llm_provider: custom_llm_provider.into(),
-            litellm_call_id: litellm_call_id.into(),
-        }
-    }
-}
-
-pub trait CallLifecycleRequest {
-    fn lifecycle_context(&self) -> CallLifecycleContext;
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum CallLifecyclePhase {
-    PreCall,
-    DuringCall,
-    ProviderCall,
-    SuccessCallback,
-    FailureCallback,
-}
-
-impl CallLifecyclePhase {
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::PreCall => "pre_call",
-            Self::DuringCall => "during_call",
-            Self::ProviderCall => "provider_call",
-            Self::SuccessCallback => "success_callback",
-            Self::FailureCallback => "failure_callback",
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct CallLifecyclePhaseTiming {
-    pub phase: CallLifecyclePhase,
-    pub start_time: f64,
-    pub end_time: f64,
-    pub duration: Duration,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct CallLifecycleTiming {
-    pub start_time: f64,
-    pub end_time: f64,
-    pub phases: Vec<CallLifecyclePhaseTiming>,
-}
-
-impl CallLifecycleTiming {
-    pub fn new(start_time: f64, end_time: f64, phases: Vec<CallLifecyclePhaseTiming>) -> Self {
-        Self {
-            start_time,
-            end_time,
-            phases,
-        }
-    }
-}

litellm-rust/crates/core/src/chat_completions/client.rs

@@ -1,5 +1,4 @@
-use std::sync::OnceLock;
-use std::time::Duration;
+use std::{sync::OnceLock, time::Duration};
 
 use crate::constants::{CHAT_COMPLETIONS_CONNECT_TIMEOUT_SECS, CHAT_COMPLETIONS_TIMEOUT_SECS};
 

litellm-rust/crates/core/src/chat_completions/common_utils.rs

@@ -1,20 +1,19 @@
-use super::Error;
-use crate::http_utils::string_headers as shared_string_headers;
-use crate::providers::anthropic::chat_completions::transformation::ANTHROPIC_CHAT_COMPLETIONS_CONFIG;
+use litellm_llms::{
+    anthropic::chat::transformation::ANTHROPIC_CHAT_COMPLETIONS_CONFIG,
+    base_llm::chat::transformation::BaseConfig,
+    bedrock::chat::converse_transformation::BEDROCK_CHAT_COMPLETIONS_CONFIG,
+    custom_httpx::http_handler::string_headers as shared_string_headers,
+};
 use serde_json::{Map, Value};
 
-use super::transformation::ChatCompletionsProviderConfig;
+use super::Error;
 
 const HEADER_CONTEXT: &str = "chat completions";
 
-pub(super) fn chat_completions_provider_config(
-    provider: &str,
-) -> Option<&'static dyn ChatCompletionsProviderConfig> {
+pub(super) fn chat_completions_provider_config(provider: &str) -> Option<&'static dyn BaseConfig> {
     match provider {
         "anthropic" => Some(&ANTHROPIC_CHAT_COMPLETIONS_CONFIG),
-        "bedrock" => Some(
-            &crate::providers::bedrock::chat_completions::transformation::BEDROCK_CHAT_COMPLETIONS_CONFIG,
-        ),
+        "bedrock" => Some(&BEDROCK_CHAT_COMPLETIONS_CONFIG),
         _ => None,
     }
 }

litellm-rust/crates/core/src/chat_completions/error.rs

@@ -1,3 +1,5 @@
+use litellm_llms::base_llm::chat::transformation::Error as LlmError;
+
 #[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
 pub enum Error {
     #[error("expected {expected}, got {actual}")]
@@ -18,9 +20,22 @@ pub enum Error {
     #[error(transparent)]
     Auth(#[from] litellm_auth::Error),
     #[error(transparent)]
-    Transport(#[from] crate::transport::Error),
+    Transport(#[from] litellm_llms::custom_httpx::transport::Error),
     #[error(transparent)]
-    Headers(#[from] crate::http_utils::HeaderError),
+    Headers(#[from] litellm_llms::custom_httpx::http_handler::HeaderError),
     #[error(transparent)]
     Aws(#[from] litellm_auth_aws::Error),
 }
+
+impl From<LlmError> for Error {
+    fn from(error: LlmError) -> Self {
+        match error {
+            LlmError::InvalidType { expected, actual } => Self::InvalidType { expected, actual },
+            LlmError::MissingField(field) => Self::MissingField(field),
+            LlmError::InvalidRequest(message) => Self::InvalidRequest(message),
+            LlmError::InvalidResponse(message) => Self::InvalidResponse(message),
+            LlmError::Unsupported(reason) => Self::Unsupported(reason),
+            LlmError::Auth(error) => Self::Auth(error),
+        }
+    }
+}

litellm-rust/crates/core/src/chat_completions/handler.rs

@@ -1,14 +1,13 @@
+use litellm_llms::{
+    base_llm::chat::transformation::{ChatCompletionsAuth, ProviderChatResponseData},
+    custom_httpx::http_handler::{http_request, truncate_error_body},
+};
+use litellm_types::utils::ChatCompletionsResponse;
 use serde_json::Value;
 
-use super::Error;
-use crate::http_utils::{http_request, truncate_error_body};
-
-use super::client::http_client;
-use super::prepare::prepare_provider_request;
-use super::transformation::ChatCompletionsAuth;
-use super::types::{
-    ChatCompletionsResponse, ProviderChatCompletionsRequest, ProviderChatResponseData,
-    ResolvedChatCompletionsRequest,
+use super::{Error, client::http_client, prepare::prepare_provider_request};
+use crate::chat_completions::types::{
+    ProviderChatCompletionsRequest, ResolvedChatCompletionsRequest,
 };
 
 pub(super) async fn execute_chat_completions_provider_call(
@@ -35,23 +34,30 @@ pub(super) async fn execute_chat_completions_provider_call(
         // so the host can still serve it. Everything else here, a timeout
         // above all, may have reached the provider and been answered.
         if err.is_connect() || err.is_builder() {
-            Error::Transport(crate::transport::Error::Connect(err.to_string()))
+            Error::Transport(litellm_llms::custom_httpx::transport::Error::Connect(
+                err.to_string(),
+            ))
         } else {
-            Error::Transport(crate::transport::Error::Network(err.to_string()))
+            Error::Transport(litellm_llms::custom_httpx::transport::Error::Network(
+                err.to_string(),
+            ))
         }
     })?;
 
     let status = response.status();
-    let text = response
-        .text()
-        .await
-        .map_err(|err| Error::Transport(crate::transport::Error::Network(err.to_string())))?;
+    let text = response.text().await.map_err(|err| {
+        Error::Transport(litellm_llms::custom_httpx::transport::Error::Network(
+            err.to_string(),
+        ))
+    })?;
 
     if !status.is_success() {
-        return Err(Error::Transport(crate::transport::Error::Http {
-            status: status.as_u16(),
-            body: truncate_error_body(&text),
-        }));
+        return Err(Error::Transport(
+            litellm_llms::custom_httpx::transport::Error::Http {
+                status: status.as_u16(),
+                body: truncate_error_body(&text),
+            },
+        ));
     }
 
     let body: Value = serde_json::from_str(&text).map_err(|err| {
@@ -60,6 +66,7 @@ pub(super) async fn execute_chat_completions_provider_call(
     request
         .config
         .transform_response(&request.model, ProviderChatResponseData { body })
+        .map_err(Error::from)
         .map_err(as_response_error)
 }
 
@@ -75,7 +82,9 @@ pub(super) async fn execute_chat_completions_provider_call(
 pub(super) fn as_response_error(err: Error) -> Error {
     match err {
         already @ (Error::InvalidResponse(_)
-        | Error::Transport(crate::transport::Error::Http { .. })) => already,
+        | Error::Transport(litellm_llms::custom_httpx::transport::Error::Http {
+            ..
+        })) => already,
         other => Error::InvalidResponse(other.to_string()),
     }
 }
@@ -84,10 +93,9 @@ pub(super) async fn signed_headers(
     request: &ProviderChatCompletionsRequest,
     body: &[u8],
 ) -> Result<Vec<(String, String)>, Error> {
-    use std::collections::BTreeMap;
-    use std::time::SystemTime;
+    use std::{collections::BTreeMap, time::SystemTime};
 
-    use crate::providers::bedrock::aws_base::{
+    use litellm_auth_aws::{
         aws_auth_config, aws_signature_headers, host_supplied_credentials,
         is_sigv4_computed_header, resolve_credentials, sign_bedrock_post,
     };

litellm-rust/crates/core/src/chat_completions/mod.rs

@@ -7,21 +7,18 @@
 //! calls the provider, and returns a typed OpenAI-shaped response.
 
 mod error;
+pub mod types;
 pub use error::Error;
 mod client;
 mod common_utils;
-pub mod conversation;
 pub(crate) mod handler;
 mod prepare;
-pub mod response_utils;
-pub mod transformation;
-pub mod types;
-
+use handler::execute_chat_completions_provider_call;
+use litellm_types::utils::ChatCompletionsResponse;
+use prepare::{parse_messages, resolve_provider_config, resolve_request};
 use serde_json::{Map, Value};
 
-use handler::execute_chat_completions_provider_call;
-use prepare::{parse_messages, resolve_provider_config, resolve_request};
-use types::{ChatCompletionsRequest, ChatCompletionsResponse};
+use crate::chat_completions::types::ChatCompletionsRequest;
 
 pub async fn chat_completions(
     request: ChatCompletionsRequest<'_>,

litellm-rust/crates/core/src/chat_completions/prepare.rs

@@ -1,20 +1,23 @@
+use litellm_core_utils::get_llm_provider_logic::{CustomLlmProvider, get_custom_llm_provider};
+use litellm_llms::{
+    base_llm::chat::transformation::{BaseConfig, ChatCompletionsAuth},
+    custom_httpx::http_handler::has_header,
+};
+use litellm_types::llms::openai::ChatMessage;
 use serde_json::Value;
 
-use super::Error;
-use crate::http_utils::has_header;
-use crate::providers::custom_llm_provider::{CustomLlmProvider, get_custom_llm_provider};
-
-use super::common_utils::{chat_completions_provider_config, string_headers};
-use super::transformation::{ChatCompletionsAuth, ChatCompletionsProviderConfig};
-use super::types::{
-    ChatCompletionsRequest, ChatMessage, ProviderChatCompletionsRequest,
-    ResolvedChatCompletionsRequest,
+use super::{
+    Error,
+    common_utils::{chat_completions_provider_config, string_headers},
+};
+use crate::chat_completions::types::{
+    ChatCompletionsRequest, ProviderChatCompletionsRequest, ResolvedChatCompletionsRequest,
 };
 
 pub(super) fn resolve_provider_config<'a>(
     model: &'a str,
     custom_llm_provider: Option<&'a str>,
-) -> Result<(String, &'static dyn ChatCompletionsProviderConfig), Error> {
+) -> Result<(String, &'static dyn BaseConfig), Error> {
     let provider_info = get_custom_llm_provider(model, custom_llm_provider)
         .or_else(|| {
             custom_llm_provider.map(|provider| CustomLlmProvider {
@@ -65,7 +68,7 @@ pub(super) fn resolve_request(
 fn validate_environment(
     request: &ResolvedChatCompletionsRequest<'_>,
     model: &str,
-    config: &dyn ChatCompletionsProviderConfig,
+    config: &dyn BaseConfig,
 ) -> Result<(Vec<(String, String)>, ChatCompletionsAuth), Error> {
     let env_lookup = |key: &str| std::env::var(key).ok();
     let mut headers = string_headers(request.extra_headers.clone())?;
@@ -122,7 +125,7 @@ pub(super) fn prepare_provider_request(
     let model = request.model;
     let config = request.config;
     let env_lookup = |key: &str| std::env::var(key).ok();
-    let url = config.complete_url(
+    let url = config.get_complete_url(
         request.api_base,
         &model,
         &request.optional_params,

litellm-rust/crates/core/src/chat_completions/tests.rs

@@ -1,10 +1,11 @@
+use litellm_llms::base_llm::chat::transformation::ChatCompletionsAuth;
 use serde_json::{Map, Value, json};
 
-use super::Error;
-
-use super::prepare::{prepare_provider_request, resolve_request};
-use super::transformation::ChatCompletionsAuth;
-use super::types::{ChatCompletionsRequest, ProviderChatCompletionsRequest};
+use super::{
+    Error,
+    prepare::{prepare_provider_request, resolve_request},
+};
+use crate::chat_completions::types::{ChatCompletionsRequest, ProviderChatCompletionsRequest};
 
 fn prepare_chat_completions_call(
     request: ChatCompletionsRequest<'_>,
@@ -264,7 +265,7 @@ fn rejects_non_string_extra_headers() {
     call.extra_headers = Some(Map::from_iter([("x-trace".to_string(), json!(7))]));
     assert_eq!(
         decline(call),
-        Error::Headers(crate::http_utils::HeaderError {
+        Error::Headers(litellm_llms::custom_httpx::http_handler::HeaderError {
             context: "chat completions",
             name: "x-trace".to_string(),
             actual: "number",
@@ -588,10 +589,12 @@ fn the_gate_agrees_with_prepare_on_every_case_it_accepts() {
 }
 
 mod round_trip {
-    use super::*;
-    use tokio::io::{AsyncReadExt, AsyncWriteExt};
-    use tokio::net::{TcpListener, TcpStream};
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::{TcpListener, TcpStream},
+    };
 
+    use super::*;
     use crate::chat_completions::chat_completions;
 
     async fn read_http_request(socket: &mut TcpStream) -> String {
@@ -768,7 +771,10 @@ mod round_trip {
         assert!(
             matches!(
                 err,
-                Error::Transport(crate::transport::Error::Http { status: 429, .. })
+                Error::Transport(litellm_llms::custom_httpx::transport::Error::Http {
+                    status: 429,
+                    ..
+                })
             ),
             "expected a 429, got {err:?}"
         );
@@ -793,7 +799,10 @@ mod round_trip {
         .await
         .expect_err("nothing is listening");
         assert!(
-            matches!(err, Error::Transport(crate::transport::Error::Connect(_))),
+            matches!(
+                err,
+                Error::Transport(litellm_llms::custom_httpx::transport::Error::Connect(_))
+            ),
             "expected a pre-send connect failure, got {err:?}"
         );
     }
@@ -816,11 +825,16 @@ mod round_trip {
         }
         // An upstream status is already unambiguous, so it survives intact.
         assert!(matches!(
-            as_response_error(Error::Transport(crate::transport::Error::Http {
+            as_response_error(Error::Transport(
+                litellm_llms::custom_httpx::transport::Error::Http {
+                    status: 500,
+                    body: "boom".to_string()
+                }
+            )),
+            Error::Transport(litellm_llms::custom_httpx::transport::Error::Http {
                 status: 500,
-                body: "boom".to_string()
-            })),
-            Error::Transport(crate::transport::Error::Http { status: 500, .. })
+                ..
+            })
         ));
     }
 }

litellm-rust/crates/core/src/chat_completions/types.rs

@@ -1,10 +1,9 @@
 use std::time::Duration;
 
-use serde::{Deserialize, Serialize};
+use litellm_llms::base_llm::chat::transformation::{BaseConfig, ChatCompletionsAuth};
+use litellm_types::llms::openai::ChatMessage;
 use serde_json::{Map, Value};
 
-use super::transformation::{ChatCompletionsAuth, ChatCompletionsProviderConfig};
-
 /// A `/chat/completions` call as it crosses into the core.
 ///
 /// `optional_params` arrives already mapped to the provider's own parameter
@@ -22,101 +21,24 @@ pub struct ChatCompletionsRequest<'a> {
     pub timeout: Option<Duration>,
 }
 
-pub(super) struct ResolvedChatCompletionsRequest<'a> {
-    pub(super) model: String,
-    pub(super) config: &'static dyn ChatCompletionsProviderConfig,
-    pub(super) messages: Vec<ChatMessage>,
-    pub(super) optional_params: Map<String, Value>,
-    pub(super) api_key: Option<&'a str>,
-    pub(super) api_base: Option<&'a str>,
-    pub(super) extra_headers: Option<Map<String, Value>>,
-    pub(super) timeout: Option<Duration>,
-}
-
-pub(super) struct ProviderChatCompletionsRequest {
-    pub(super) model: String,
-    pub(super) config: &'static dyn ChatCompletionsProviderConfig,
-    pub(super) url: String,
-    pub(super) body: Value,
-    pub(super) upstream_headers: Vec<(String, String)>,
-    pub(super) auth: ChatCompletionsAuth,
-    pub(super) optional_params: Map<String, Value>,
-    pub(super) timeout: Option<Duration>,
-}
-
-/// The provider-shaped request body a config produces. Named rather than a bare
-/// `Value` so the transform contract stays a typed one, mirroring
-/// [`crate::audio_transcription::types::AudioTranscriptionRequestData`].
-pub struct ProviderChatRequestData {
-    pub body: Value,
-}
-
-/// The raw provider response body handed back to a config for normalization.
-pub struct ProviderChatResponseData {
-    pub body: Value,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum ChatMessageContent {
-    Text(String),
-    Parts(Vec<Value>),
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct ChatMessage {
-    pub role: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub content: Option<ChatMessageContent>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    #[serde(flatten)]
-    pub extra: Map<String, Value>,
-}
-
-/// OpenAI `usage`, including the `prompt_tokens_details` split LiteLLM's Python
-/// path reports so cost tracking sees the same numbers on either path.
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-pub struct PromptTokensDetails {
-    pub cached_tokens: u64,
-    pub cache_creation_tokens: u64,
-    pub text_tokens: u64,
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-pub struct ChatCompletionsUsage {
-    pub prompt_tokens: u64,
-    pub completion_tokens: u64,
-    pub total_tokens: u64,
-    pub prompt_tokens_details: PromptTokensDetails,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct ChatCompletionsChoiceMessage {
-    pub role: String,
-    // Whether an empty turn is `None` or `""` is the provider's choice, not a
-    // shared invariant: Anthropic's transform ends on `merged_text or None`
-    // while Converse assigns the joined string unconditionally. Each config
-    // mirrors its own, so keep this optional and serialize it even when None.
-    pub content: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct ChatCompletionsChoice {
-    pub index: u64,
-    pub message: ChatCompletionsChoiceMessage,
-    pub finish_reason: String,
-}
-
-/// The normalized response handed back to the host.
-///
-/// There is deliberately no `id`: Python mints the `chatcmpl-…` id on the
-/// `ModelResponse` it already created, and echoing the provider's own id here
-/// would change it. Pinned by `response_carries_no_id` in `tests.rs`.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct ChatCompletionsResponse {
-    pub created: u64,
+pub struct ResolvedChatCompletionsRequest<'a> {
     pub model: String,
-    pub choices: Vec<ChatCompletionsChoice>,
-    pub usage: ChatCompletionsUsage,
+    pub config: &'static dyn BaseConfig,
+    pub messages: Vec<ChatMessage>,
+    pub optional_params: Map<String, Value>,
+    pub api_key: Option<&'a str>,
+    pub api_base: Option<&'a str>,
+    pub extra_headers: Option<Map<String, Value>>,
+    pub timeout: Option<Duration>,
+}
+
+pub struct ProviderChatCompletionsRequest {
+    pub model: String,
+    pub config: &'static dyn BaseConfig,
+    pub url: String,
+    pub body: Value,
+    pub upstream_headers: Vec<(String, String)>,
+    pub auth: ChatCompletionsAuth,
+    pub optional_params: Map<String, Value>,
+    pub timeout: Option<Duration>,
 }

litellm-rust/crates/core/src/constants.rs

@@ -1,6 +1,4 @@
 pub const OPENAI_DEFAULT_API_BASE: &str = "https://api.openai.com";
-pub const OPENAI_RESPONSES_DEFAULT_API_BASE: &str = "https://api.openai.com/v1";
-pub const OPENAI_RESPONSES_PATH: &str = "/responses";
 
 /// Full-request timeout ceiling for Anthropic Messages provider calls, in
 /// seconds. Mirrors the Python Anthropic Messages default. The per-request
@@ -10,19 +8,10 @@ pub(crate) const MESSAGES_TIMEOUT_SECS: u64 = 600;
 /// Connect timeout for Anthropic Messages provider calls, in seconds.
 pub(crate) const MESSAGES_CONNECT_TIMEOUT_SECS: u64 = 10;
 
-/// Max characters of an upstream error body echoed across the call boundary
-/// before truncation, so provider bodies are bounded and data-minimized.
-pub(crate) const UPSTREAM_ERROR_BODY_MAX_CHARS: usize = 256;
-
 /// Provider name used for Anthropic Messages when a deployment's provider model
 /// does not carry an explicit provider prefix.
 pub const ANTHROPIC_MESSAGES_PROVIDER: &str = "anthropic";
 
-/// Prefix identifying an Anthropic OAuth token. Mirrors Python's
-/// `ANTHROPIC_OAUTH_TOKEN_PREFIX`, which is what makes `validate_environment`
-/// authenticate with `authorization` and drop `x-api-key` entirely.
-pub(crate) const ANTHROPIC_OAUTH_TOKEN_PREFIX: &str = "sk-ant-oat";
-
 /// Full-request timeout ceiling for chat completions provider calls, in
 /// seconds. Mirrors the Python chat completions default.
 pub(crate) const CHAT_COMPLETIONS_TIMEOUT_SECS: u64 = 600;
@@ -34,34 +23,3 @@ pub(crate) const AUDIO_TRANSCRIPTION_TIMEOUT_SECS: u64 = 600;
 
 /// `object` field every non-streaming chat completion response carries.
 pub const CHAT_COMPLETION_OBJECT: &str = "chat.completion";
-
-/// Placeholder Python substitutes for empty or whitespace-only message text,
-/// which Anthropic and Bedrock both reject. Must match
-/// `_EMPTY_TEXT_PLACEHOLDER` in
-/// `litellm/litellm_core_utils/prompt_templates/factory.py`.
-pub const EMPTY_TEXT_PLACEHOLDER: &str =
-    "[System: Empty message content sanitised to satisfy protocol]";
-
-pub(crate) const MEDIA_CONNECT_TIMEOUT_SECS: u64 = 10;
-
-pub(crate) const OCR_RESPONSE_MAX_BYTES: usize = 64 * 1024 * 1024;
-pub(crate) const OCR_HTTP_TIMEOUT_SECS: u64 = 600;
-pub(crate) const OCR_CONNECT_TIMEOUT_SECS: u64 = 10;
-pub const OCR_INLINE_MAX_BYTES: usize = 50 * 1024 * 1024;
-pub(crate) const OCR_DOWNLOAD_MAX_BYTES: u64 = 50 * 1024 * 1024;
-pub(crate) const OCR_MAX_FETCH_REDIRECTS: usize = 10;
-pub(crate) const OCR_POLL_TIMEOUT_SECS: u64 = 120;
-pub(crate) const OCR_POLL_RETRY_SECS: u64 = 2;
-pub(crate) const AZURE_DI_API_VERSION: &str = "2024-11-30";
-pub(crate) const AZURE_DI_SUBSCRIPTION_HEADER: &str = "Ocp-Apim-Subscription-Key";
-pub(crate) const AZURE_DI_DEFAULT_DPI: i64 = 96;
-pub(crate) const AZURE_DI_DEFAULT_WIDTH: f64 = 8.5;
-pub(crate) const AZURE_DI_DEFAULT_HEIGHT: f64 = 11.0;
-pub(crate) const REDUCTO_API_BASE: &str = "https://platform.reducto.ai";
-pub(crate) const REDUCTO_API_KEY_ENV: &str = "REDUCTO_API_KEY";
-pub(crate) const REDUCTO_ID_PREFIX: &str = "reducto://";
-pub(crate) const AZURE_AI_OCR_PATH: &str = "/providers/mistral/azure/ocr";
-pub(crate) const MISTRAL_OCR_API_BASE: &str = "https://api.mistral.ai/v1";
-
-pub(crate) const COHERE_PARSE_API_BASE: &str = "https://api.cohere.com";
-pub(crate) const COHERE_API_KEY_ENV: &str = "COHERE_API_KEY";

litellm-rust/crates/core/src/error.rs

@@ -1,7 +1,9 @@
+use litellm_llms::base_llm::ocr::error::Error as OcrError;
+
 #[derive(Debug, thiserror::Error)]
 pub enum Error {
     #[error(transparent)]
-    Ocr(#[from] crate::ocr::Error),
+    Ocr(#[from] OcrError),
     #[error(transparent)]
     Messages(#[from] crate::messages::Error),
     #[error(transparent)]

litellm-rust/crates/core/src/lib.rs

@@ -1,15 +1,10 @@
 pub mod audio_transcription;
-pub mod call_lifecycle;
 pub mod chat_completions;
 pub mod constants;
 pub mod error;
-pub mod http_utils;
-mod media;
+pub mod machine;
 pub mod messages;
 pub mod ocr;
-pub mod providers;
 pub mod responses;
-pub mod transport;
-mod url_utils;
 
 pub use error::Error;

litellm-rust/crates/core/src/machine/auth.rs

@@ -0,0 +1,53 @@
+use std::sync::Arc;
+
+use litellm_auth::{Error, ResolvedCredential, TokenFuture, TokenProvider, TokenProviderHandle};
+use litellm_callbacks::route::Route;
+
+use super::{HostChannel, MachineFault};
+
+/// A route whose host can mint credentials on the call's behalf.
+pub trait TokenRoute: Route {
+    fn acquire_token_op() -> Self::Op;
+    fn token_credential(result: Self::OpResult) -> Option<ResolvedCredential>;
+}
+
+/// A [`TokenProvider`] that asks the host for each credential through the call's own
+/// operation channel, so the host answers it on the caller's thread and context.
+pub struct HostTokenProvider<R: Route> {
+    channel: HostChannel<R>,
+}
+
+impl<R: Route> std::fmt::Debug for HostTokenProvider<R> {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("HostTokenProvider")
+    }
+}
+
+impl<R> HostTokenProvider<R>
+where
+    R: TokenRoute,
+    R::Error: From<MachineFault> + std::fmt::Display,
+{
+    pub fn handle(channel: HostChannel<R>) -> TokenProviderHandle {
+        TokenProviderHandle::new(Arc::new(Self { channel }))
+    }
+}
+
+impl<R> TokenProvider for HostTokenProvider<R>
+where
+    R: TokenRoute,
+    R::Error: From<MachineFault> + std::fmt::Display,
+{
+    fn acquire(&self) -> TokenFuture<'_> {
+        Box::pin(async move {
+            let result = self
+                .channel
+                .route(R::acquire_token_op())
+                .await
+                .map_err(|error| Error::AzureTokenAcquisition(error.to_string()))?;
+            R::token_credential(result).ok_or_else(|| {
+                Error::AzureTokenAcquisition("invalid token provider host result".into())
+            })
+        })
+    }
+}

litellm-rust/crates/core/src/machine/mod.rs

@@ -0,0 +1,186 @@
+//! The one machine every route runs on: it owns the route's provider future, polls it in
+//! place, and turns the host operations that future requests into [`Machine`] steps. No
+//! task is spawned; dropping the machine drops the in-flight call.
+
+mod auth;
+
+use std::{future::Future, pin::Pin};
+
+pub use auth::{HostTokenProvider, TokenRoute};
+use litellm_callbacks::{
+    event::{CallEvent, RequestContext, WireRequest},
+    host::{HostOp, HostResult},
+    machine::{HostFailure, Interrupted, Machine, MachineStep, Step},
+    route::Route,
+};
+use tokio::sync::{mpsc, oneshot};
+
+/// The machine's own failures, distinct from anything the provider call reports.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum MachineFault {
+    /// The host driver went away while the call was waiting on it.
+    Abandoned,
+    /// The host answered out of turn: a result with nothing pending, or nothing when a
+    /// result was pending.
+    Protocol(&'static str),
+    /// The host answered a route operation with the wrong result variant.
+    Mismatch,
+}
+
+pub type ExecuteFuture<R> =
+    Pin<Box<dyn Future<Output = Result<<R as Route>::Response, <R as Route>::Error>> + Send>>;
+
+struct PendingOp<R: Route> {
+    op: HostOp<R>,
+    reply: oneshot::Sender<HostResult<R>>,
+}
+
+/// The provider side of the machine: how the in-flight call reaches its host.
+pub struct HostChannel<R: Route> {
+    ops: mpsc::UnboundedSender<PendingOp<R>>,
+}
+
+impl<R: Route> Clone for HostChannel<R> {
+    fn clone(&self) -> Self {
+        Self {
+            ops: self.ops.clone(),
+        }
+    }
+}
+
+impl<R: Route> HostChannel<R>
+where
+    R::Error: From<MachineFault>,
+{
+    async fn invoke(&self, op: HostOp<R>) -> Result<HostResult<R>, R::Error> {
+        let (reply, answer) = oneshot::channel();
+        self.ops
+            .send(PendingOp { op, reply })
+            .map_err(|_| MachineFault::Abandoned)?;
+        answer.await.map_err(|_| MachineFault::Abandoned.into())
+    }
+
+    pub async fn route(&self, op: R::Op) -> Result<R::OpResult, R::Error> {
+        match self.invoke(HostOp::Route(op)).await? {
+            HostResult::Route(result) => Ok(result),
+            _ => Err(MachineFault::Mismatch.into()),
+        }
+    }
+
+    pub async fn before_send(
+        &self,
+        wire: WireRequest,
+        context: RequestContext,
+    ) -> Result<WireRequest, R::Error> {
+        let op = HostOp::BeforeSend {
+            wire: Box::new(wire),
+            context: Box::new(context),
+        };
+        match self.invoke(op).await? {
+            HostResult::BeforeSend(wire) => Ok(*wire),
+            _ => Err(MachineFault::Mismatch.into()),
+        }
+    }
+
+    pub async fn emit(&self, event: CallEvent) -> Result<(), R::Error> {
+        match self.invoke(HostOp::Emit(event)).await? {
+            HostResult::Emitted => Ok(()),
+            _ => Err(MachineFault::Mismatch.into()),
+        }
+    }
+}
+
+enum Execution<R: Route> {
+    Unstarted(Box<dyn FnOnce(HostChannel<R>) -> ExecuteFuture<R> + Send>),
+    Running(ExecuteFuture<R>),
+    Done,
+}
+
+pub struct RouteMachine<R: Route> {
+    execution: Execution<R>,
+    ops: mpsc::UnboundedReceiver<PendingOp<R>>,
+    channel: HostChannel<R>,
+    reply: Option<oneshot::Sender<HostResult<R>>>,
+}
+
+impl<R: Route> RouteMachine<R>
+where
+    R::Error: From<MachineFault>,
+{
+    pub fn new(execute: impl FnOnce(HostChannel<R>) -> ExecuteFuture<R> + Send + 'static) -> Self {
+        let (ops_tx, ops) = mpsc::unbounded_channel();
+        Self {
+            execution: Execution::Unstarted(Box::new(execute)),
+            ops,
+            channel: HostChannel { ops: ops_tx },
+            reply: None,
+        }
+    }
+
+    async fn step(
+        &mut self,
+        result: Option<HostResult<R>>,
+    ) -> Result<MachineStep<R, R::Response>, R::Error> {
+        match (self.reply.take(), result) {
+            (Some(reply), Some(result)) => {
+                reply
+                    .send(result)
+                    .map_err(|_| MachineFault::Protocol("the call stopped waiting on the host"))?;
+            }
+            (None, None) if matches!(self.execution, Execution::Unstarted(_)) => {}
+            (Some(reply), None) => {
+                self.reply = Some(reply);
+                return Err(MachineFault::Protocol("host operation result is required").into());
+            }
+            (None, Some(_)) => {
+                return Err(MachineFault::Protocol("unexpected host operation result").into());
+            }
+            (None, None) => {
+                return Err(
+                    MachineFault::Protocol("call cannot be resumed after completion").into(),
+                );
+            }
+        }
+        if let Execution::Unstarted(_) = self.execution {
+            let Execution::Unstarted(start) =
+                std::mem::replace(&mut self.execution, Execution::Done)
+            else {
+                unreachable!()
+            };
+            self.execution = Execution::Running(start(self.channel.clone()));
+        }
+        let Execution::Running(future) = &mut self.execution else {
+            return Err(MachineFault::Protocol("call cannot be resumed after completion").into());
+        };
+        tokio::select! {
+            biased;
+            pending = self.ops.recv() => {
+                let pending = pending.ok_or(MachineFault::Abandoned)?;
+                self.reply = Some(pending.reply);
+                Ok(MachineStep::Host(pending.op))
+            }
+            outcome = future => {
+                self.execution = Execution::Done;
+                outcome.map(MachineStep::Complete)
+            }
+        }
+    }
+}
+
+impl<R: Route> Machine for RouteMachine<R>
+where
+    R::Error: From<MachineFault>,
+{
+    type Route = R;
+    type Complete = R::Response;
+
+    fn resume(&mut self, result: Option<HostResult<R>>) -> Step<'_, Self> {
+        Box::pin(self.step(result))
+    }
+
+    fn interrupt(&mut self, failure: HostFailure<R::Error>) -> Interrupted<'_, Self> {
+        self.reply = None;
+        self.execution = Execution::Done;
+        Box::pin(async move { Err(failure.into_error()) })
+    }
+}

litellm-rust/crates/core/src/messages/client.rs

@@ -1,5 +1,4 @@
-use std::sync::OnceLock;
-use std::time::Duration;
+use std::{sync::OnceLock, time::Duration};
 
 use crate::constants::{MESSAGES_CONNECT_TIMEOUT_SECS, MESSAGES_TIMEOUT_SECS};
 

litellm-rust/crates/core/src/messages/common_utils.rs

@@ -1,18 +1,21 @@
-use super::Error;
-use crate::http_utils::string_headers as shared_string_headers;
-use crate::providers::anthropic::messages::transformation::ANTHROPIC_MESSAGES_CONFIG;
-use crate::providers::azure_ai::messages::transformation::AZURE_ANTHROPIC_MESSAGES_CONFIG;
+pub(super) use litellm_llms::custom_httpx::http_handler::{
+    has_bearer_auth, has_header, truncate_error_body,
+};
+use litellm_llms::{
+    anthropic::experimental_pass_through::messages::transformation::ANTHROPIC_MESSAGES_CONFIG,
+    azure_ai::anthropic::messages_transformation::AZURE_ANTHROPIC_MESSAGES_CONFIG,
+    base_llm::anthropic_messages::transformation::BaseAnthropicMessagesConfig,
+    custom_httpx::http_handler::string_headers as shared_string_headers,
+};
 use serde_json::{Map, Value};
 
-use super::transformation::AnthropicMessagesProviderConfig;
-
-pub(super) use crate::http_utils::{has_bearer_auth, has_header, truncate_error_body};
+use super::Error;
 
 const HEADER_CONTEXT: &str = "messages";
 
 pub(super) fn messages_provider_config(
     provider: &str,
-) -> Option<&'static dyn AnthropicMessagesProviderConfig> {
+) -> Option<&'static dyn BaseAnthropicMessagesConfig> {
     match provider {
         "anthropic" => Some(&ANTHROPIC_MESSAGES_CONFIG),
         "azure_ai" => Some(&AZURE_ANTHROPIC_MESSAGES_CONFIG),

litellm-rust/crates/core/src/messages/error.rs

@@ -1,17 +1,52 @@
+use litellm_llms::base_llm::chat::transformation::Error as LlmError;
+
 #[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
 pub enum Error {
     #[error("invalid provider: {0}")]
     InvalidProvider(String),
+    #[error("missing required field: {0}")]
+    MissingField(&'static str),
     #[error("invalid request: {0}")]
     InvalidRequest(String),
     #[error("invalid response: {0}")]
     InvalidResponse(String),
-    #[error("routing error: {0}")]
-    Routing(String),
+    #[error("unsupported by the Rust messages route: {0}")]
+    Unsupported(&'static str),
     #[error(transparent)]
     Auth(#[from] litellm_auth::Error),
     #[error(transparent)]
-    Transport(#[from] crate::transport::Error),
+    Transport(#[from] litellm_llms::custom_httpx::transport::Error),
     #[error(transparent)]
-    Headers(#[from] crate::http_utils::HeaderError),
+    Headers(#[from] litellm_llms::custom_httpx::http_handler::HeaderError),
+}
+
+impl From<LlmError> for Error {
+    fn from(error: LlmError) -> Self {
+        match error {
+            error @ LlmError::InvalidType { .. } => Self::InvalidRequest(error.to_string()),
+            LlmError::MissingField(field) => Self::MissingField(field),
+            LlmError::InvalidRequest(message) => Self::InvalidRequest(message),
+            LlmError::InvalidResponse(message) => Self::InvalidResponse(message),
+            LlmError::Unsupported(reason) => Self::Unsupported(reason),
+            LlmError::Auth(error) => Self::Auth(error),
+        }
+    }
+}
+
+impl Error {
+    pub fn is_request(&self) -> bool {
+        match self {
+            Self::InvalidProvider(_)
+            | Self::MissingField(_)
+            | Self::InvalidRequest(_)
+            | Self::Unsupported(_)
+            | Self::Headers(_) => true,
+            Self::Auth(error) => !matches!(error, litellm_auth::Error::MissingApiKey { .. }),
+            _ => false,
+        }
+    }
+
+    pub fn is_response(&self) -> bool {
+        matches!(self, Self::InvalidResponse(_))
+    }
 }

litellm-rust/crates/core/src/messages/handler.rs

@@ -1,11 +1,11 @@
-use super::Error;
-use crate::constants::ANTHROPIC_MESSAGES_PROVIDER;
-use crate::http_utils::http_request;
+use litellm_llms::custom_httpx::http_handler::http_request;
+use litellm_types::llms::anthropic_messages::anthropic_response::AnthropicMessagesResponse;
 
-use super::client::http_client;
-use super::common_utils::truncate_error_body;
-use super::prepare::prepare_provider_request;
-use super::types::{AnthropicMessagesResponse, MessagesRequest};
+use super::{
+    Error, client::http_client, common_utils::truncate_error_body,
+    prepare::prepare_provider_request,
+};
+use crate::{constants::ANTHROPIC_MESSAGES_PROVIDER, messages::types::MessagesRequest};
 
 pub(super) async fn execute_messages_provider_call(
     request: MessagesRequest<'_>,
@@ -19,26 +19,34 @@ pub(super) async fn execute_messages_provider_call(
         request_builder = request_builder.timeout(duration);
     }
 
-    let response = http_request(request_builder)
-        .await
-        .map_err(|err| Error::Transport(crate::transport::Error::Network(err.to_string())))?;
+    let response = http_request(request_builder).await.map_err(|err| {
+        Error::Transport(litellm_llms::custom_httpx::transport::Error::Network(
+            err.to_string(),
+        ))
+    })?;
 
     let status = response.status();
-    let text = response
-        .text()
-        .await
-        .map_err(|err| Error::Transport(crate::transport::Error::Network(err.to_string())))?;
+    let text = response.text().await.map_err(|err| {
+        Error::Transport(litellm_llms::custom_httpx::transport::Error::Network(
+            err.to_string(),
+        ))
+    })?;
 
     if !status.is_success() {
-        return Err(Error::Transport(crate::transport::Error::Http {
-            status: status.as_u16(),
-            body: truncate_error_body(&text),
-        }));
+        return Err(Error::Transport(
+            litellm_llms::custom_httpx::transport::Error::Http {
+                status: status.as_u16(),
+                body: truncate_error_body(&text),
+            },
+        ));
     }
 
     let response = serde_json::from_str(&text)
         .map_err(|err| Error::InvalidResponse(format!("invalid messages response JSON: {err}")))?;
-    request.config.transform_response(&request.model, response)
+    request
+        .config
+        .transform_anthropic_messages_response(&request.model, response)
+        .map_err(Error::from)
 }
 
 pub(super) async fn execute_messages_provider_stream(
@@ -46,9 +54,7 @@ pub(super) async fn execute_messages_provider_stream(
 ) -> Result<reqwest::Response, Error> {
     let request = prepare_provider_request(request)?;
     if request.provider != ANTHROPIC_MESSAGES_PROVIDER {
-        return Err(Error::InvalidRequest(
-            "streaming messages is not supported for this provider".to_string(),
-        ));
+        return Err(Error::Unsupported("streaming messages for this provider"));
     }
 
     let mut request_builder = http_client().post(&request.url).json(&request.body);
@@ -59,19 +65,24 @@ pub(super) async fn execute_messages_provider_stream(
         request_builder = request_builder.timeout(duration);
     }
 
-    let response = http_request(request_builder)
-        .await
-        .map_err(|err| Error::Transport(crate::transport::Error::Network(err.to_string())))?;
+    let response = http_request(request_builder).await.map_err(|err| {
+        Error::Transport(litellm_llms::custom_httpx::transport::Error::Network(
+            err.to_string(),
+        ))
+    })?;
     let status = response.status();
     if !status.is_success() {
-        let text = response
-            .text()
-            .await
-            .map_err(|err| Error::Transport(crate::transport::Error::Network(err.to_string())))?;
-        return Err(Error::Transport(crate::transport::Error::Http {
-            status: status.as_u16(),
-            body: truncate_error_body(&text),
-        }));
+        let text = response.text().await.map_err(|err| {
+            Error::Transport(litellm_llms::custom_httpx::transport::Error::Network(
+                err.to_string(),
+            ))
+        })?;
+        return Err(Error::Transport(
+            litellm_llms::custom_httpx::transport::Error::Http {
+                status: status.as_u16(),
+                body: truncate_error_body(&text),
+            },
+        ));
     }
     Ok(response)
 }

litellm-rust/crates/core/src/messages/mod.rs

@@ -8,16 +8,16 @@
 //! can splice the event stream to its own caller.
 
 mod error;
+pub mod types;
 pub use error::Error;
 mod client;
 mod common_utils;
 mod handler;
 mod prepare;
-pub mod transformation;
-pub mod types;
-
 use handler::{execute_messages_provider_call, execute_messages_provider_stream};
-use types::{AnthropicMessagesResponse, MessagesRequest};
+use litellm_types::llms::anthropic_messages::anthropic_response::AnthropicMessagesResponse;
+
+use crate::messages::types::MessagesRequest;
 
 pub async fn messages(request: MessagesRequest<'_>) -> Result<AnthropicMessagesResponse, Error> {
     execute_messages_provider_call(request).await

litellm-rust/crates/core/src/messages/prepare.rs

@@ -1,11 +1,15 @@
-use super::Error;
-use crate::providers::custom_llm_provider::{CustomLlmProvider, get_custom_llm_provider};
-
-use super::common_utils::{has_bearer_auth, has_header, messages_provider_config, string_headers};
-use super::transformation::{AnthropicMessagesProviderConfig, MessagesAuthStrategy};
-use super::types::{MessagesRequest, ProviderMessagesRequest};
+use litellm_core_utils::get_llm_provider_logic::{CustomLlmProvider, get_custom_llm_provider};
+use litellm_llms::base_llm::anthropic_messages::transformation::{
+    BaseAnthropicMessagesConfig, MessagesAuthStrategy,
+};
 use serde_json::{Map, Value};
 
+use super::{
+    Error,
+    common_utils::{has_bearer_auth, has_header, messages_provider_config, string_headers},
+};
+use crate::messages::types::{MessagesRequest, ProviderMessagesRequest};
+
 pub(super) fn prepare_provider_request(
     request: MessagesRequest<'_>,
 ) -> Result<ProviderMessagesRequest, Error> {
@@ -36,14 +40,14 @@ pub(super) fn prepare_provider_request(
     let typed_request = serde_json::from_value(request.body).map_err(|err| {
         Error::InvalidRequest(format!("invalid Anthropic messages request: {err}"))
     })?;
-    let transformed = config.transform_request(typed_request)?;
+    let transformed = config.transform_anthropic_messages_request(typed_request)?;
     let body = serde_json::to_value(transformed).map_err(|err| {
         Error::InvalidRequest(format!(
             "failed to serialize Anthropic messages request: {err}"
         ))
     })?;
 
-    let url = config.complete_url(request.api_base, &model, &env_lookup)?;
+    let url = config.get_complete_url(request.api_base, &model, &env_lookup)?;
 
     Ok(ProviderMessagesRequest {
         provider: provider.to_string(),
@@ -57,7 +61,7 @@ pub(super) fn prepare_provider_request(
 }
 
 fn validate_environment(
-    config: &dyn AnthropicMessagesProviderConfig,
+    config: &dyn BaseAnthropicMessagesConfig,
     extra_headers: Option<Map<String, Value>>,
     api_key: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,

litellm-rust/crates/core/src/messages/tests.rs

@@ -1,16 +1,19 @@
 use std::time::Duration;
 
 use serde_json::{Map, Value, json};
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::{TcpListener, TcpStream};
-
-use super::Error;
-
-use super::common_utils::{
-    has_bearer_auth, has_header, messages_provider_config, string_headers, truncate_error_body,
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::{TcpListener, TcpStream},
 };
-use super::messages;
-use super::types::MessagesRequest;
+
+use super::{
+    Error,
+    common_utils::{
+        has_bearer_auth, has_header, messages_provider_config, string_headers, truncate_error_body,
+    },
+    messages,
+};
+use crate::messages::types::MessagesRequest;
 
 async fn read_http_request(socket: &mut TcpStream) -> String {
     let mut request = Vec::new();
@@ -79,7 +82,7 @@ fn string_headers_rejects_non_string_values() {
     let err = string_headers(Some(headers)).expect_err("non-string header rejected");
     assert_eq!(
         err,
-        Error::Headers(crate::http_utils::HeaderError {
+        Error::Headers(litellm_llms::custom_httpx::http_handler::HeaderError {
             context: "messages",
             name: "x-count".to_string(),
             actual: "number",
@@ -429,7 +432,7 @@ async fn messages_maps_provider_error_status_to_http_error() {
 
     assert!(matches!(
         err,
-        Error::Transport(crate::transport::Error::Http { status: 401, .. })
+        Error::Transport(litellm_llms::custom_httpx::transport::Error::Http { status: 401, .. })
     ));
 }
 

litellm-rust/crates/core/src/messages/types.rs

@@ -1,10 +1,8 @@
 use std::time::Duration;
 
-use serde::{Deserialize, Serialize};
+use litellm_llms::base_llm::anthropic_messages::transformation::BaseAnthropicMessagesConfig;
 use serde_json::{Map, Value};
 
-use super::transformation::AnthropicMessagesProviderConfig;
-
 pub struct MessagesRequest<'a> {
     pub model: &'a str,
     pub body: Value,
@@ -15,120 +13,12 @@ pub struct MessagesRequest<'a> {
     pub timeout: Option<Duration>,
 }
 
-pub(super) struct ProviderMessagesRequest {
-    pub(super) provider: String,
-    pub(super) model: String,
-    pub(super) config: &'static dyn AnthropicMessagesProviderConfig,
-    pub(super) url: String,
-    pub(super) body: Value,
-    pub(super) upstream_headers: Vec<(String, String)>,
-    pub(super) timeout: Option<Duration>,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum SystemPrompt {
-    Text(String),
-    Blocks(Vec<ContentBlock>),
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum MessageContent {
-    Text(String),
-    Blocks(Vec<ContentBlock>),
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-pub struct ContentBlock {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cache_control: Option<CacheControl>,
-    #[serde(flatten)]
-    pub extra: Map<String, Value>,
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-pub struct CacheControl {
-    #[serde(rename = "type", skip_serializing_if = "Option::is_none")]
-    pub cache_type: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ttl: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub scope: Option<String>,
-    #[serde(flatten)]
-    pub extra: Map<String, Value>,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct AnthropicMessage {
-    pub role: String,
-    pub content: MessageContent,
-    #[serde(flatten)]
-    pub extra: Map<String, Value>,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct AnthropicMessagesRequest {
+pub struct ProviderMessagesRequest {
+    pub provider: String,
     pub model: String,
-    pub messages: Vec<AnthropicMessage>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_tokens: Option<u64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub system: Option<SystemPrompt>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub metadata: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub stop_sequences: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub stream: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub temperature: Option<f64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub top_p: Option<f64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub top_k: Option<i64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tools: Option<Vec<Value>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_choice: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub thinking: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub service_tier: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub container: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mcp_servers: Option<Vec<Value>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_management: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub output_format: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub output_config: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub speed: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub inference_geo: Option<String>,
-    #[serde(flatten)]
-    pub extra: Map<String, Value>,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct AnthropicMessagesResponse {
-    pub id: String,
-    #[serde(rename = "type")]
-    pub message_type: String,
-    pub role: String,
-    pub model: String,
-    pub content: Vec<Value>,
-    // Anthropic always includes stop_reason / stop_sequence, null until the turn
-    // ends; serialize them even when None so callers see the same shape as Python.
-    pub stop_reason: Option<String>,
-    pub stop_sequence: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub usage: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub container: Option<Value>,
-    #[serde(flatten)]
-    pub extra: Map<String, Value>,
+    pub config: &'static dyn BaseAnthropicMessagesConfig,
+    pub url: String,
+    pub body: Value,
+    pub upstream_headers: Vec<(String, String)>,
+    pub timeout: Option<Duration>,
 }

litellm-rust/crates/core/src/ocr/adapters/azure/cohere.rs

@@ -1,131 +0,0 @@
-use super::super::OcrAdapter;
-use crate::ocr::Error;
-use crate::ocr::OcrClient;
-use crate::ocr::codecs::cohere::{
-    CohereParams, CohereResponse, transform_request, transform_response, validate_document,
-};
-use crate::ocr::document::{inline_remote_document, validate_inline_document};
-use crate::ocr::error::{OcrError, OcrRequestError, OcrResponseError};
-use crate::ocr::prepare::{credential_env, transform_request_body};
-use crate::ocr::registry::OcrProvider;
-use crate::ocr::types::{LiteLLMOcrRequest, LiteLLMOcrResponse};
-use crate::url_utils::ApiUrl;
-use litellm_auth_azure::AzureAuthInputs;
-
-const AZURE_AI_API_BASE_ENV: &str = "AZURE_AI_API_BASE";
-
-pub(crate) struct AzureCohereAdapter;
-
-impl OcrAdapter for AzureCohereAdapter {
-    type ProviderResponse = CohereResponse;
-    const PROVIDER: OcrProvider = OcrProvider::AzureAi;
-
-    async fn prepare_request(
-        &self,
-        request: &LiteLLMOcrRequest,
-        client: &OcrClient,
-    ) -> Result<reqwest::Request, OcrError> {
-        let params = super::super::super::wire::decode_request_value::<CohereParams>(
-            serde_json::Value::Object(request.optional_params.clone()),
-            "optional_params",
-        )?;
-        let mut config = AzureAuthInputs::from_sourced_optional_params(
-            &request.optional_params,
-            &request.input_sources,
-        )
-        .map_err(Error::from)?;
-        config.azure_ad_token_provider = request.azure_ad_token_provider.clone();
-        let base = request
-            .connection
-            .api_base
-            .clone()
-            .or_else(|| credential_env(AZURE_AI_API_BASE_ENV))
-            .filter(|base| !base.trim().is_empty())
-            .ok_or_else(|| {
-                Error::Auth(
-                    "Missing Azure AI API Base - Set AZURE_AI_API_BASE or pass api_base".into(),
-                )
-            })?;
-        let headers =
-            super::validate_ai_environment(&request.connection, &config, &credential_env).await?;
-        validate_document(&request.document)?;
-        let remote = request.document.source().starts_with("http://")
-            || request.document.source().starts_with("https://");
-        let document = inline_remote_document(
-            client.document_fetcher(),
-            request.document.clone(),
-            &request.connection,
-        )
-        .await?;
-        let body = transform_request(&request.model, document, params)?;
-        transform_request_body(
-            client,
-            request,
-            &complete_url(&base)?,
-            &headers,
-            !remote,
-            body,
-            |body| {
-                validate_document(&body.document)?;
-                validate_inline_document(&body.document)
-            },
-        )
-        .await
-    }
-
-    fn transform_ocr_response(
-        &self,
-        request: &LiteLLMOcrRequest,
-        response: Self::ProviderResponse,
-    ) -> Result<LiteLLMOcrResponse, OcrResponseError> {
-        transform_response(&request.model, response)
-    }
-}
-
-fn complete_url(base: &str) -> Result<String, OcrError> {
-    let mut url = reqwest::Url::parse(base).map_err(|_| invalid_api_base())?;
-    if !matches!(url.scheme(), "http" | "https") {
-        return Err(invalid_api_base().into());
-    }
-    let path = url.path().trim_end_matches('/').to_string();
-    if path.ends_with("/v2/parse") {
-        url.set_path(&path);
-        return Ok(url.into());
-    }
-    url.set_path(path.strip_suffix("/models").unwrap_or(&path));
-    ApiUrl::parse(url.as_str())
-        .and_then(|url| url.complete_path(&["providers", "cohere", "v2", "parse"]))
-        .map(|url| url.into_string())
-        .map_err(|_| invalid_api_base().into())
-}
-
-fn invalid_api_base() -> OcrRequestError {
-    OcrRequestError::RequestField {
-        path: "api_base".into(),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn completes_foundry_urls_without_duplicate_paths_and_preserves_queries() {
-        for suffix in [
-            "",
-            "/models",
-            "/providers/cohere/v2",
-            "/providers/cohere/v2/parse",
-        ] {
-            assert_eq!(
-                complete_url(&format!("https://example.com{suffix}?tenant=a")).unwrap(),
-                "https://example.com/providers/cohere/v2/parse?tenant=a"
-            );
-        }
-        assert_eq!(
-            complete_url("https://example.com/v2/parse?tenant=a").unwrap(),
-            "https://example.com/v2/parse?tenant=a"
-        );
-        assert!(complete_url("relative/path").is_err());
-    }
-}

litellm-rust/crates/core/src/ocr/adapters/azure/document_intelligence/mod.rs

@@ -1,214 +0,0 @@
-use super::super::OcrAdapter;
-use crate::constants::{AZURE_DI_API_VERSION, AZURE_DI_SUBSCRIPTION_HEADER};
-use crate::ocr::Error;
-use crate::ocr::OcrClient;
-use crate::ocr::codecs::document_intelligence::{
-    self, AzureDocumentIntelligenceOperation, DocumentIntelligenceParams,
-};
-use crate::ocr::error::{OcrError, OcrRequestError, OcrResponseError};
-use crate::ocr::prepare::{credential_env, transform_request_body};
-use crate::ocr::registry::OcrProvider;
-use crate::ocr::types::{LiteLLMOcrRequest, LiteLLMOcrResponse, OcrConnection, OcrResponseFormat};
-use crate::url_utils::ApiUrl;
-use litellm_auth::{InputSource, Sourced};
-use litellm_auth_azure::AzureAuthInputs;
-
-mod polling;
-
-const AZURE_DI_API_KEY_ENV: &str = "AZURE_DOCUMENT_INTELLIGENCE_API_KEY";
-const AZURE_DI_ENDPOINT_ENV: &str = "AZURE_DOCUMENT_INTELLIGENCE_ENDPOINT";
-
-#[derive(Clone, Debug)]
-pub(crate) struct AzureDocumentIntelligenceAdapter;
-
-impl OcrAdapter for AzureDocumentIntelligenceAdapter {
-    type ProviderResponse = AzureDocumentIntelligenceOperation;
-    const PROVIDER: OcrProvider = OcrProvider::AzureAi;
-
-    async fn prepare_request(
-        &self,
-        request: &LiteLLMOcrRequest,
-        client: &OcrClient,
-    ) -> Result<reqwest::Request, OcrError> {
-        let params = map_ocr_params(request)?;
-        let mut config = AzureAuthInputs::from_sourced_optional_params(
-            &request.optional_params,
-            &request.input_sources,
-        )
-        .map_err(Error::from)?;
-        config.azure_ad_token_provider = request.azure_ad_token_provider.clone();
-        let headers = validate_environment(&request.connection, &config, &credential_env).await?;
-        let endpoint = nonblank(request.connection.api_base.clone())
-            .or_else(|| nonblank(credential_env(AZURE_DI_ENDPOINT_ENV)))
-            .ok_or_else(|| Error::Auth("Missing Azure Document Intelligence API Base - Set AZURE_DOCUMENT_INTELLIGENCE_ENDPOINT or pass api_base".into()))?;
-        let url = get_complete_url(&endpoint, &request.model, &params)?;
-        let body = document_intelligence::transform_ocr_request(request.document.clone())?;
-        transform_request_body(client, request, &url, &headers, false, body, |_| Ok(())).await
-    }
-
-    fn transform_ocr_response(
-        &self,
-        request: &LiteLLMOcrRequest,
-        response: Self::ProviderResponse,
-    ) -> Result<LiteLLMOcrResponse, OcrResponseError> {
-        document_intelligence::transform_ocr_response(&request.model, response)
-    }
-
-    async fn read_response(
-        &self,
-        client: &OcrClient,
-        response: reqwest::Response,
-        url: &str,
-        headers: &[(String, String)],
-        request: &LiteLLMOcrRequest,
-    ) -> Result<crate::ocr::wire::DecodedOcrResponse<Self::ProviderResponse>, OcrError> {
-        polling::read_operation_response(
-            client.polling_http(),
-            response,
-            url,
-            headers,
-            &request.connection,
-            request.response_format()? == OcrResponseFormat::Native,
-            &request.hooks,
-        )
-        .await
-    }
-}
-
-fn map_ocr_params(
-    request: &LiteLLMOcrRequest,
-) -> Result<DocumentIntelligenceParams, OcrRequestError> {
-    let params = document_intelligence::decode_input_params(
-        request.optional_params.clone(),
-        "optional_params",
-    )?;
-    let crate::ocr::prepare::ParsedProviderParams {
-        known: params,
-        extra_params: _extra_params,
-    } = params;
-    document_intelligence::map_ocr_params(params)
-}
-
-fn get_complete_url(
-    endpoint: &str,
-    model: &str,
-    params: &DocumentIntelligenceParams,
-) -> Result<String, OcrError> {
-    let model = format!("{}:analyze", model_id(model)?);
-    ApiUrl::parse(endpoint)
-        .and_then(|url| url.complete_path(&["documentintelligence", "documentModels", &model]))
-        .map(|url| {
-            url.append_query_pairs(
-                [("api-version", AZURE_DI_API_VERSION)]
-                    .into_iter()
-                    .chain(params.pages.iter().map(|pages| ("pages", pages.as_str())))
-                    .chain(
-                        params
-                            .features
-                            .iter()
-                            .map(|features| ("features", features.as_str())),
-                    ),
-            )
-            .into_string()
-        })
-        .map_err(|_| OcrRequestError::RequestField {
-            path: "api_base".into(),
-        })
-        .map_err(OcrError::from)
-}
-
-async fn validate_environment(
-    connection: &OcrConnection,
-    config: &AzureAuthInputs,
-    env_lookup: &(dyn Fn(&str) -> Option<String> + Sync),
-) -> Result<Vec<(String, String)>, OcrError> {
-    if crate::http_utils::has_header(&connection.extra_headers, "authorization")
-        || crate::http_utils::has_header(&connection.extra_headers, AZURE_DI_SUBSCRIPTION_HEADER)
-    {
-        super::validate_destination(connection, connection.extra_headers_source)?;
-        return Ok(connection.extra_headers.clone());
-    }
-    let key = nonblank(connection.api_key.clone())
-        .map(|value| Sourced::new(value, connection.api_key_source))
-        .or_else(|| {
-            nonblank(env_lookup(AZURE_DI_API_KEY_ENV))
-                .map(|value| Sourced::new(value, InputSource::Environment))
-        });
-    if let Some(key) = key {
-        super::validate_destination(connection, key.source())?;
-        return Ok(
-            std::iter::once((AZURE_DI_SUBSCRIPTION_HEADER.into(), key.into_value()))
-                .chain(connection.extra_headers.clone())
-                .collect(),
-        );
-    }
-    let token = super::resolve_entra(config, env_lookup)
-        .await?
-        .ok_or(Error::MissingAzureDocumentIntelligenceCredentials)?;
-    super::validate_destination(connection, token.source())?;
-    Ok(
-        std::iter::once(("Authorization".into(), format!("Bearer {}", token.value())))
-            .chain(connection.extra_headers.clone())
-            .collect(),
-    )
-}
-
-fn model_id(model: &str) -> Result<&str, OcrRequestError> {
-    let model = model.rsplit('/').next().unwrap_or(model);
-    if matches!(model, "." | "..") {
-        return Err(OcrRequestError::DotModel);
-    }
-    Ok(model)
-}
-
-fn nonblank(value: Option<String>) -> Option<String> {
-    value
-        .map(|value| value.trim().to_string())
-        .filter(|value| !value.is_empty())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[tokio::test]
-    async fn request_endpoint_cannot_receive_environment_key() {
-        let connection = OcrConnection {
-            api_base: Some("https://request.example".into()),
-            api_base_source: InputSource::Request,
-            ..Default::default()
-        };
-
-        let error = validate_environment(&connection, &Default::default(), &|name| {
-            (name == AZURE_DI_API_KEY_ENV).then(|| "environment-key".into())
-        })
-        .await
-        .unwrap_err();
-
-        assert!(
-            error
-                .to_string()
-                .contains("request-controlled Azure endpoint")
-        );
-    }
-
-    #[tokio::test]
-    async fn request_endpoint_accepts_request_owned_key() {
-        let connection = OcrConnection {
-            api_key: Some("request-key".into()),
-            api_key_source: InputSource::Request,
-            api_base: Some("https://request.example".into()),
-            api_base_source: InputSource::Request,
-            ..Default::default()
-        };
-
-        let headers = validate_environment(&connection, &Default::default(), &|_| None)
-            .await
-            .unwrap();
-
-        assert_eq!(
-            headers[0],
-            (AZURE_DI_SUBSCRIPTION_HEADER.into(), "request-key".into())
-        );
-    }
-}

litellm-rust/crates/core/src/ocr/adapters/azure/document_intelligence/polling.rs

@@ -1,119 +0,0 @@
-use std::sync::Arc;
-use std::time::Duration;
-
-use reqwest::Url;
-use tokio::time::Instant;
-
-use crate::constants::{AZURE_DI_SUBSCRIPTION_HEADER, OCR_POLL_RETRY_SECS};
-use crate::ocr::client::read_json_response;
-use crate::ocr::codecs::document_intelligence::{
-    AzureDocumentIntelligenceOperation, OperationStatus,
-};
-use crate::ocr::error::{OcrError, OcrPollingError, OcrResponseError};
-use crate::ocr::hooks::OcrHooks;
-use crate::ocr::types::OcrConnection;
-use crate::ocr::wire::DecodedOcrResponse;
-
-pub(super) async fn read_operation_response(
-    http_client: &reqwest::Client,
-    response: reqwest::Response,
-    original_url: &str,
-    headers: &[(String, String)],
-    connection: &OcrConnection,
-    native: bool,
-    hooks: &Arc<dyn OcrHooks>,
-) -> Result<DecodedOcrResponse<AzureDocumentIntelligenceOperation>, OcrError> {
-    if response.status() != reqwest::StatusCode::ACCEPTED {
-        let bytes =
-            crate::ocr::client::read_response_bytes(response, connection.max_response_bytes)
-                .await?;
-        crate::ocr::handler::post_call(hooks, &bytes).await?;
-        return Ok(crate::ocr::wire::decode_response(&bytes, native)?);
-    }
-    let location = response
-        .headers()
-        .get("operation-location")
-        .and_then(|value| value.to_str().ok())
-        .ok_or(OcrPollingError::PollLocation)?
-        .to_string();
-    let original = Url::parse(original_url).map_err(|_| OcrPollingError::PollOrigin)?;
-    let operation = Url::parse(&location).map_err(|_| OcrPollingError::PollOrigin)?;
-    if original.origin() != operation.origin()
-        || !operation.username().is_empty()
-        || operation.password().is_some()
-    {
-        return Err(OcrPollingError::PollOrigin.into());
-    }
-    let bytes =
-        crate::ocr::client::read_response_bytes(response, connection.max_response_bytes).await?;
-    crate::ocr::handler::post_call(hooks, &bytes).await?;
-    poll_operation(http_client, operation, headers, connection, native, hooks).await
-}
-
-async fn poll_operation(
-    http_client: &reqwest::Client,
-    url: Url,
-    headers: &[(String, String)],
-    connection: &OcrConnection,
-    native: bool,
-    hooks: &Arc<dyn OcrHooks>,
-) -> Result<DecodedOcrResponse<AzureDocumentIntelligenceOperation>, OcrError> {
-    let deadline = Instant::now()
-        .checked_add(connection.poll_timeout)
-        .ok_or(OcrPollingError::PollTimeout)?;
-    loop {
-        let remaining = deadline
-            .checked_duration_since(Instant::now())
-            .filter(|remaining| !remaining.is_zero())
-            .ok_or(OcrPollingError::PollTimeout)?;
-        let builder = http_client
-            .get(url.clone())
-            .timeout(remaining.min(connection.timeout));
-        let builder = crate::http_utils::with_headers(
-            builder,
-            headers,
-            crate::http_utils::HeaderPolicy::Only(&[AZURE_DI_SUBSCRIPTION_HEADER, "authorization"]),
-        );
-        let response = tokio::time::timeout_at(deadline, crate::http_utils::http_request(builder))
-            .await
-            .map_err(|_| OcrPollingError::PollTimeout)?
-            .map_err(crate::transport::Error::from)?;
-        let retry = response
-            .headers()
-            .get(reqwest::header::RETRY_AFTER)
-            .and_then(|value| value.to_str().ok())
-            .and_then(|value| value.parse::<u64>().ok())
-            .unwrap_or(OCR_POLL_RETRY_SECS)
-            .max(1);
-        let decoded = tokio::time::timeout_at(
-            deadline,
-            read_json_response::<AzureDocumentIntelligenceOperation>(
-                response,
-                native,
-                connection.max_response_bytes,
-            ),
-        )
-        .await
-        .map_err(|_| OcrPollingError::PollTimeout)??;
-        match &decoded.data.status {
-            Some(OperationStatus::Succeeded) => {
-                crate::ocr::handler::post_call(hooks, decoded.text.as_bytes()).await?;
-                return Ok(decoded);
-            }
-            Some(OperationStatus::Running | OperationStatus::NotStarted) => {
-                tokio::time::timeout_at(deadline, tokio::time::sleep(Duration::from_secs(retry)))
-                    .await
-                    .map_err(|_| OcrPollingError::PollTimeout)?;
-            }
-            status => {
-                return Err(OcrResponseError::OperationStatus(
-                    status
-                        .as_ref()
-                        .map(ToString::to_string)
-                        .unwrap_or_else(|| "None".into()),
-                )
-                .into());
-            }
-        }
-    }
-}

litellm-rust/crates/core/src/ocr/adapters/azure/mistral.rs

@@ -1,229 +0,0 @@
-use super::super::OcrAdapter;
-use crate::constants::AZURE_AI_OCR_PATH;
-use crate::ocr::Error;
-use crate::ocr::OcrClient;
-use crate::ocr::codecs::mistral::{self, MistralOcrParams, MistralOcrResponse};
-use crate::ocr::document::{inline_remote_document, validate_inline_document};
-use crate::ocr::error::{OcrError, OcrRequestError, OcrResponseError};
-use crate::ocr::prepare::{
-    _prepare_ocr_request, ParsedProviderParams, credential_env, transform_request_body,
-};
-use crate::ocr::registry::OcrProvider;
-use crate::ocr::types::{LiteLLMOcrRequest, LiteLLMOcrResponse, OcrConnection};
-use crate::url_utils::ApiUrl;
-use litellm_auth::{InputSource, Sourced};
-use litellm_auth_azure::AzureAuthInputs;
-
-const AZURE_AI_API_KEY_ENV: &str = "AZURE_AI_API_KEY";
-const AZURE_AI_API_BASE_ENV: &str = "AZURE_AI_API_BASE";
-
-#[derive(Clone, Debug)]
-pub(crate) struct AzureMistralAdapter;
-
-impl OcrAdapter for AzureMistralAdapter {
-    type ProviderResponse = MistralOcrResponse;
-    const PROVIDER: OcrProvider = OcrProvider::AzureAi;
-
-    async fn prepare_request(
-        &self,
-        request: &LiteLLMOcrRequest,
-        client: &OcrClient,
-    ) -> Result<reqwest::Request, OcrError> {
-        let ParsedProviderParams {
-            known: params,
-            extra_params: _extra_params,
-        } = _prepare_ocr_request::<MistralOcrParams>(request)?;
-        let mut config = AzureAuthInputs::from_sourced_optional_params(
-            &request.optional_params,
-            &request.input_sources,
-        )
-        .map_err(Error::from)?;
-        config.azure_ad_token_provider = request.azure_ad_token_provider.clone();
-        let url = get_complete_url(request.connection.api_base.as_deref(), &credential_env)?;
-        let headers = validate_environment(&request.connection, &config, &credential_env).await?;
-        let retains_document = !request.document.source().starts_with("http://")
-            && !request.document.source().starts_with("https://");
-        let document = inline_remote_document(
-            client.document_fetcher(),
-            request.document.clone(),
-            &request.connection,
-        )
-        .await?;
-        let body = mistral::transform_ocr_request(&request.model, document, &params)?;
-        transform_request_body(
-            client,
-            request,
-            &url,
-            &headers,
-            retains_document,
-            body,
-            |body| validate_inline_document(&body.document),
-        )
-        .await
-    }
-
-    fn transform_ocr_response(
-        &self,
-        request: &LiteLLMOcrRequest,
-        response: Self::ProviderResponse,
-    ) -> Result<LiteLLMOcrResponse, OcrResponseError> {
-        mistral::transform_ocr_response(&request.model, response)
-    }
-}
-
-fn get_complete_url(
-    api_base: Option<&str>,
-    env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> Result<String, OcrError> {
-    let base = nonblank(api_base.map(str::to_string))
-        .or_else(|| nonblank(env_lookup(AZURE_AI_API_BASE_ENV)))
-        .ok_or_else(|| Error::Auth(
-            "Missing Azure AI API Base - Set AZURE_AI_API_BASE environment variable or pass api_base parameter".into(),
-        ))?;
-    let path: Vec<&str> = AZURE_AI_OCR_PATH.trim_matches('/').split('/').collect();
-    ApiUrl::parse(&base)
-        .and_then(|url| url.complete_path(&path))
-        .map(|url| url.into_string())
-        .map_err(|_| {
-            OcrRequestError::RequestField {
-                path: "api_base".into(),
-            }
-            .into()
-        })
-}
-
-pub(in crate::ocr::adapters) async fn validate_environment(
-    connection: &OcrConnection,
-    config: &AzureAuthInputs,
-    env_lookup: &(dyn Fn(&str) -> Option<String> + Sync),
-) -> Result<Vec<(String, String)>, OcrError> {
-    if crate::http_utils::has_header(&connection.extra_headers, "authorization") {
-        if config.azure_ad_token_provider.is_some() {
-            super::resolve_entra(config, env_lookup).await?;
-        }
-        super::validate_destination(connection, connection.extra_headers_source)?;
-        return Ok(connection.extra_headers.clone());
-    }
-    let key = nonblank(connection.api_key.clone())
-        .map(|value| Sourced::new(value, connection.api_key_source))
-        .or_else(|| {
-            nonblank(env_lookup(AZURE_AI_API_KEY_ENV))
-                .map(|value| Sourced::new(value, InputSource::Environment))
-        });
-    if let Some(key) = key {
-        super::validate_destination(connection, key.source())?;
-        return Ok(bearer_headers(connection, key.value()));
-    }
-    let key = super::resolve_entra(config, env_lookup)
-        .await?
-        .ok_or(Error::MissingAzureAiCredentials)?;
-    super::validate_destination(connection, key.source())?;
-    Ok(bearer_headers(connection, key.value()))
-}
-
-fn bearer_headers(connection: &OcrConnection, key: &str) -> Vec<(String, String)> {
-    std::iter::once(("Authorization".into(), format!("Bearer {key}")))
-        .chain(connection.extra_headers.clone())
-        .collect()
-}
-
-fn nonblank(value: Option<String>) -> Option<String> {
-    value
-        .map(|value| value.trim().to_string())
-        .filter(|value| !value.is_empty())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn completes_azure_path_and_preserves_query() {
-        assert_eq!(
-            get_complete_url(Some("https://example.com/?tenant=a"), &|_| None).unwrap(),
-            "https://example.com/providers/mistral/azure/ocr?tenant=a"
-        );
-        assert_eq!(
-            get_complete_url(
-                Some("https://example.com/providers/mistral/azure/ocr"),
-                &|_| None
-            )
-            .unwrap(),
-            "https://example.com/providers/mistral/azure/ocr"
-        );
-    }
-
-    #[tokio::test]
-    async fn supplied_authorization_precedes_keys() {
-        let connection = OcrConnection {
-            api_key: Some("request-key".into()),
-            extra_headers: vec![("authorization".into(), "Bearer prepared".into())],
-            ..Default::default()
-        };
-        assert_eq!(
-            validate_environment(&connection, &Default::default(), &|_| {
-                Some("environment-key".into())
-            })
-            .await
-            .unwrap(),
-            connection.extra_headers
-        );
-    }
-
-    #[tokio::test]
-    async fn request_key_precedes_environment_key() {
-        let connection = OcrConnection {
-            api_key: Some("request-key".into()),
-            ..Default::default()
-        };
-        assert_eq!(
-            validate_environment(&connection, &Default::default(), &|_| {
-                Some("environment-key".into())
-            })
-            .await
-            .unwrap()[0],
-            ("Authorization".into(), "Bearer request-key".into())
-        );
-    }
-
-    #[tokio::test]
-    async fn request_endpoint_cannot_receive_environment_key() {
-        let connection = OcrConnection {
-            api_base: Some("https://request.example".into()),
-            api_base_source: InputSource::Request,
-            ..Default::default()
-        };
-
-        let error = validate_environment(&connection, &Default::default(), &|name| {
-            (name == AZURE_AI_API_KEY_ENV).then(|| "environment-key".into())
-        })
-        .await
-        .unwrap_err();
-
-        assert!(
-            error
-                .to_string()
-                .contains("request-controlled Azure endpoint")
-        );
-    }
-
-    #[tokio::test]
-    async fn request_endpoint_accepts_request_owned_key() {
-        let connection = OcrConnection {
-            api_key: Some("request-key".into()),
-            api_key_source: InputSource::Request,
-            api_base: Some("https://request.example".into()),
-            api_base_source: InputSource::Request,
-            ..Default::default()
-        };
-
-        let headers = validate_environment(&connection, &Default::default(), &|_| None)
-            .await
-            .unwrap();
-
-        assert_eq!(
-            headers[0],
-            ("Authorization".into(), "Bearer request-key".into())
-        );
-    }
-}