Merge remote-tracking branch 'origin/main' into litellm_batch_jsonl_line_item_callbacks

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

# Conflicts:
#	litellm/proxy/hooks/proxy_track_cost_callback.py

.circleci/scripts/unit_selection.sh

@@ -107,6 +107,7 @@ legacy_paths() {
       echo tests/unit/proxy/test_update_spend.py
       echo tests/unit/skills/test_skills_db.py ;;
     proxy-db-endpoints-and-responses)
+      echo tests/unit/proxy/engine
       echo tests/unit/proxy/auth/test_models_fallback_endpoint.py
       echo tests/unit/proxy/common_utils/test_check_batch_cost.py
       echo tests/unit/proxy/common_utils/test_check_responses_cost.py
@@ -148,7 +149,10 @@ legacy_paths() {
       echo tests/unit/proxy/test_proxy_server.py ;;
     proxy-db-proxy-utils) echo tests/unit/proxy/test_proxy_utils.py ;;
     proxy-extras) echo tests/unit/litellm_proxy_extras ;;
-    proxy-infra) echo tests/unit/gateway ;;
+    proxy-infra)
+      echo tests/unit/gateway
+      echo tests/unit/proxy/management_endpoints/test_roi_calculator_endpoints.py
+      echo tests/unit/proxy/roi_calculator ;;
     responses-caching-types)
       find tests/unit/responses -name 'test_*.py' -not -path 'tests/unit/responses/mcp/*'
       echo tests/unit/types ;;

.github/workflows/lens-worker.yml

@@ -0,0 +1,54 @@
+name: Lens Worker Image
+
+on:
+  pull_request:
+    branches: [main, litellm_oss_branch, "litellm_**"]
+    paths:
+      - deploy/lens/**
+      - litellm/proxy/engine/**
+      - .github/workflows/lens-worker.yml
+  push:
+    branches: [main, litellm_agent_engine]
+    paths:
+      - deploy/lens/**
+      - litellm/proxy/engine/**
+      - .github/workflows/lens-worker.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lens-worker-image:
+    permissions:
+      contents: read
+      packages: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+      - name: Build Lens worker
+        run: docker build -f deploy/lens/Dockerfile -t lens-worker:${{ github.sha }} .
+      - name: Verify standalone imports with a read-only filesystem
+        run: >-
+          docker run --rm --network none --read-only --cap-drop ALL
+          --security-opt no-new-privileges --entrypoint python
+          lens-worker:${{ github.sha }}
+          -c 'import os; import engine.worker; assert os.getuid() == 65532'
+      - name: Publish versioned Lens worker
+        if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm'
+        env:
+          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_USER: ${{ github.actor }}
+          IMAGE: ghcr.io/berriai/litellm-lens-worker:sha-${{ github.sha }}
+        run: |
+          printf '%s' "$REGISTRY_TOKEN" | docker login ghcr.io -u "$REGISTRY_USER" --password-stdin
+          docker tag lens-worker:${{ github.sha }} "$IMAGE"
+          docker push "$IMAGE"
+          printf 'Lens worker image: `%s`\n' "$IMAGE" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/test-postgres.yml

@@ -24,6 +24,7 @@ jobs:
     timeout-minutes: ${{ matrix.job-timeout-minutes }}
     permissions:
       contents: read
+      id-token: write
 
     services:
       postgres:
@@ -134,9 +135,19 @@ jobs:
         env:
           TEST_PATH: ${{ matrix.test-path }}
           WORKERS: ${{ matrix.workers }}
+          PYTEST_ADDOPTS: ${{ matrix.shard == 'proxy-behavior' && '--cov=litellm/proxy/engine --cov-report=xml:coverage-lens-postgres.xml' || '' }}
         run: |
           if [ "${WORKERS}" = "0" ]; then
             uv run --no-sync pytest ${TEST_PATH:?} -vv --tb=short --durations=10
           else
             uv run --no-sync pytest ${TEST_PATH:?} -vv --tb=short --durations=10 -n "${WORKERS}"
           fi
+
+      - name: Upload Lens database coverage
+        if: steps.changes.outputs.decision != 'skip' && matrix.shard == 'proxy-behavior' && !cancelled()
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          files: coverage-lens-postgres.xml
+          flags: lens-postgres
+          fail_ci_if_error: true

.github/workflows/test-unit.yml

@@ -79,7 +79,9 @@ jobs:
 
           - shard: integrations
             artifact-name: integrations
-            test-path: ""
+            test-path: >-
+              tests/test_litellm/integrations
+              tests/test_litellm/tracing
             unit-flag: integrations
             workers: 2
             reruns: 3

backend/routes/allowlist.py

@@ -81,6 +81,8 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
     # Spend / analytics
     "/spend/",
     "/analytics/",
+    "/engine/",
+    "/v1/traces",
     "/global/",
     "/user_agent",
     "/usage/",
@@ -144,6 +146,7 @@ BACKEND_EXACT_PATHS: frozenset[str] = frozenset(
     {
         "/",
         "/routes",
+        "/engine",
         "/openapi.json",
         "/docs",
         "/docs/oauth2-redirect",

cookbook/misc/test_responses_api.py

@@ -12,7 +12,7 @@ def encode_image(image_path):
 
 
 # Path to your image
-image_path = "litellm/proxy/logo.jpg"
+image_path = "litellm/proxy/logo.png"
 
 # Getting the Base64 string
 base64_image = encode_image(image_path)
@@ -27,7 +27,7 @@ response = client.responses.create(
                 {"type": "input_text", "text": "what color is the image"},
                 {
                     "type": "input_image",
-                    "image_url": f"data:image/jpeg;base64,{base64_image}",
+                    "image_url": f"data:image/png;base64,{base64_image}",
                 },
             ],
         }

deploy/lens/Dockerfile

@@ -0,0 +1,6 @@
+FROM python:3.12-slim
+WORKDIR /app
+RUN pip install --no-cache-dir httpx==0.28.1 pydantic==2.11.7
+COPY litellm/proxy/engine/__init__.py litellm/proxy/engine/models.py litellm/proxy/engine/analysis.py litellm/proxy/engine/worker.py /app/engine/
+USER 65532:65532
+CMD ["python", "-m", "engine.worker"]

deploy/lens/Dockerfile.dockerignore

@@ -0,0 +1,8 @@
+**
+!litellm/
+!litellm/proxy/
+!litellm/proxy/engine/
+!litellm/proxy/engine/__init__.py
+!litellm/proxy/engine/models.py
+!litellm/proxy/engine/analysis.py
+!litellm/proxy/engine/worker.py

deploy/lens/README.md

@@ -0,0 +1,59 @@
+# Lens worker
+
+Lens reviews recorded activity and saves evidence-linked findings in the LiteLLM dashboard under Observability, Lens (`/ui/lens/`)
+
+## Start a worker
+
+Upgrade your existing LiteLLM proxy to a release that includes Lens with PostgreSQL, agent tracing (`general_settings.tracing: {store: clickhouse}`), and ClickHouse configured through `CLICKHOUSE_URL` and a separate SELECT-only `CLICKHOUSE_READER_URL`. Enable the ClickHouse callback and request/response logging to analyze LLM requests. Lens can only inspect content you actually retain
+
+In Lens, click **Connect worker**, then **Generate setup command**. The LiteLLM address is filled in for you; change it only if the server running Docker needs a different network address. Copy the command and run it on your server. The dialog changes to **Worker connected** when the container checks in
+
+The command already contains the compatible worker image and one worker token. No separate API key, source checkout, environment file, or second LiteLLM deployment is needed. Keep the command private because it includes the token. The LiteLLM release provides the dashboard and APIs; the container only runs background analysis
+
+The dashboard and Compose file pin a verified worker image by digest. The image uses Linux amd64, and the generated command selects that platform. Worker image releases are independent of proxy releases: update the pinned image when changing their API contract. CI also publishes immutable commit tags for reproducible builds
+
+For deployments managed with Compose, download `compose.yaml` and provide `LITELLM_URL` and `LENS_WORKER_TOKEN` in an environment file. Its default image is already selected:
+
+```bash
+docker compose --env-file /path/to/lens.env -f compose.yaml up -d
+```
+
+Developers can build locally with `LENS_WORKER_IMAGE=litellm-lens-worker:local docker compose -f deploy/lens/compose.yaml -f deploy/lens/compose.build.yaml up -d --build`
+
+The worker needs outbound HTTPS access to LiteLLM. It needs no inbound ports, provider keys, direct database access, or GPU. The proxy calls your selected model through its configured router; trace content reaches that model provider. Use a model with JSON output support and known token prices. One worker handles one scan at a time and can serve multiple lenses. For more throughput, start another worker with a separate credential
+
+V1 setup, manual runs, feedback, and worker credentials are restricted to proxy administrators. Admin viewers can inspect results. Worker credentials can serve the administrator’s lenses. Revoke it in the connection dialog when retiring a worker. Redeploy the worker alongside proxy upgrades so their API versions match
+
+## Configure a lens
+
+Choose agent runs, individual LLM requests, or both. The matching-activity preview updates as you choose an application (the recorded OpenTelemetry service.name) or, for request activity, a LiteLLM model group and add metadata conditions. It shows run names, timestamps, and trace IDs; open a run to inspect its original steps before starting analysis. Suggestions come from up to 100 recent executions and may not include every recorded attribute. You can enter other exact keys and values. Leave service and filters blank for all activity your account can access. Filters are exact key/value matches, combined with AND. Trace filters match span or resource attributes on the same span. Request filters match logged metadata, including caller metadata stored under `requester_metadata`; `tag=value` matches request tags. `swarm=research` works only if your instrumentation records that attribute
+
+Write a few questions, give context about a successful run, choose a model, and set the monthly limit and sample size. Choose an initial history window from 1 hour to 30 days, in hours or days. Creation queues the first scan over that window. New lenses run once by default; opt into background monitoring for a custom interval from 1 minute to 7 days, entered in minutes, hours, or days. **Analyze now** checks activity since the last successful scan; **Recheck the last 24 hours** revisits recent history. The runs API accepts `lookback_hours` from 1 to 720 for other historical windows
+
+Pausing stops future scheduled scans; cancel the active scan separately if needed. The worker polls every 10 seconds; creating a lens or clicking Analyze now queues a scan, and due schedules are queued when the worker polls. Scans for the same lens never overlap, and its next interval starts after completion. Closing the browser does not stop the worker. Configuration edits apply to the next scan. A running scan retains its settings and selected execution IDs across retries
+
+## Read the results
+
+Needs attention shows issues, highest priority first. Patterns contains useful trends and successful behavior that may not need a fix. Each finding starts with a short explanation and a next step when useful. Expand the limitations for uncertainty and counterexamples. Evidence is grouped by run and collapsed until you need it; each quote opens the original step
+
+The Runs tab lists the actual sample frozen for the latest scan. Linked-run counts on findings include cited counterexamples, so they are not failure counts. The Scans tab shows history and coverage. Existing findings retain their original wording; the shorter summaries apply to new analysis
+
+## What a scan does
+
+The proxy selects newly received or updated executions with a two-minute settling period and a five-minute overlap. Older rows without receipt timestamps use execution end time. Overlapping scans do not increment a finding's occurrence count for the same execution ID
+
+A trace is spans sharing a trace ID within one team, not an automatically reconstructed conversation session. Requests are individual LLM calls. When both sources are enabled, requests correlated to a recorded span by response ID are excluded to reduce double counting
+
+The worker screens a deterministic sample, at most the configured 1–500 executions. For each execution it reads up to 160 spans, with 8,000 characters per span section, and splits these into model calls. It consolidates observations across batches, then investigates at most 10 candidate patterns using up to five model turns each. The dashboard shows these three stages, completed work counts, and elapsed time; progress is based on the selected sample, not every eligible execution. The investigator can read more original content from the selected executions. It has no shell, browsing, code-editing, or production-action tools
+
+Each model response must match a bounded JSON schema. A malformed response gets one repair attempt through the same budget controls; repeated invalid output fails the scan. Both the worker and proxy validate quoted evidence. Findings retain exact quotes and open the source trace or request. Resolve a finding after a fix, or dismiss it with a reason. A resolved finding reopens when new execution IDs support the same pattern; dismissed findings remain dismissed
+
+Coverage distinguishes eligible, sampled, reviewed, partial, and unassessable executions. Findings describe observations in the sample, not population-wide success rates or proven causes. A root span does not prove that a trace contains every expected span. Long, missing, redacted, or expired content limits the conclusions
+
+## Operations and limits
+
+PostgreSQL stores configurations, findings and the latest 50 jobs. Workers claim jobs with optimistic concurrency and a five-minute lease, renewed every 30 seconds. A disconnected job can be reclaimed up to three times. Cancellation stops subsequent work; a model call already in flight may finish and incur cost
+
+Before every model call, Lens reserves a conservative amount against the monthly lens budget. Successful calls reconcile to reported cost where pricing is available. Interrupted calls retain their reservation because the provider may have charged. A scan stops when the next reservation would exceed the limit, so it can stop with some budget remaining. Lens budgets are separate from virtual-key budgets; analysis calls use the proxy router directly
+
+V1 requires ClickHouse for both sources. It does not reconstruct sessions from unrelated trace IDs, guarantee exhaustive reviews, cache all per-execution observations across scans, or automatically fix agent code. Trace contents can change as late spans arrive, even though a job's selected IDs are fixed. Findings should be reviewed by a person before acting on them

deploy/lens/compose.build.yaml

@@ -0,0 +1,6 @@
+services:
+  lens-worker:
+    build:
+      context: ../..
+      dockerfile: deploy/lens/Dockerfile
+    image: litellm-lens-worker:local

deploy/lens/compose.yaml

@@ -0,0 +1,10 @@
+services:
+  lens-worker:
+    image: ${LENS_WORKER_IMAGE:-ghcr.io/berriai/litellm-lens-worker@sha256:47445afedfb6de2ae37a3a246ea1c939196bfd365436a880ab96ecf5f42b2342}
+    environment:
+      LITELLM_URL: ${LITELLM_URL:?Set the URL reachable from this container}
+      LENS_WORKER_TOKEN: ${LENS_WORKER_TOKEN:?Create a worker credential in the Lens UI}
+    restart: unless-stopped
+    read_only: true
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]

docker/Dockerfile.non_root

@@ -103,7 +103,7 @@ ENV LITELLM_NON_ROOT=true
 
 RUN mkdir -p /var/lib/litellm/ui /var/lib/litellm/assets && \
     cp -r /app/litellm/proxy/_experimental/out/. /var/lib/litellm/ui/ && \
-    cp /app/litellm/proxy/logo.jpg /var/lib/litellm/assets/logo.jpg && \
+    cp /app/litellm/proxy/logo.png /var/lib/litellm/assets/logo.png && \
     touch /var/lib/litellm/ui/.litellm_ui_ready
 
 RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \

docker/docker-compose.tracing.yml

@@ -0,0 +1,62 @@
+name: litellm-tracing
+
+services:
+  litellm:
+    build:
+      context: ..
+      target: runtime
+    command: ["--config", "/app/tracing-config.yaml", "--port", "4000"]
+    environment:
+      LITELLM_MASTER_KEY: local-tracing-master-key
+      LITELLM_SALT_KEY: sk-local-tracing-salt-key
+      DATABASE_URL: postgresql://litellm:litellm@db:5432/litellm
+      STORE_MODEL_IN_DB: "True"
+      CLICKHOUSE_URL: http://default:local-tracing@clickhouse:8123
+      CLICKHOUSE_READER_URL: http://default:local-tracing@clickhouse:8123
+      CLICKHOUSE_DATABASE: litellm
+      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
+    volumes:
+      - ./tracing-config.yaml:/app/tracing-config.yaml:ro
+    ports:
+      - "127.0.0.1:4002:4000"
+    depends_on:
+      db:
+        condition: service_healthy
+      clickhouse:
+        condition: service_healthy
+
+  db:
+    image: postgres:16
+    environment:
+      POSTGRES_DB: litellm
+      POSTGRES_USER: litellm
+      POSTGRES_PASSWORD: litellm
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    ports:
+      - "127.0.0.1:15432:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U litellm -d litellm"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  clickhouse:
+    image: clickhouse/clickhouse-server:26.9.6.6
+    environment:
+      CLICKHOUSE_USER: default
+      CLICKHOUSE_PASSWORD: local-tracing
+      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
+    volumes:
+      - clickhouse_data:/var/lib/clickhouse
+    ports:
+      - "127.0.0.1:18123:8123"
+    healthcheck:
+      test: ["CMD", "clickhouse-client", "--user", "default", "--password", "local-tracing", "--query", "SELECT 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+volumes:
+  postgres_data:
+  clickhouse_data:

docker/tracing-config.yaml

@@ -0,0 +1,10 @@
+model_list:
+  - model_name: gpt-6.1-sol
+    litellm_params:
+      model: openai/gpt-6.1-sol
+      api_key: os.environ/OPENAI_API_KEY
+
+general_settings:
+  master_key: os.environ/LITELLM_MASTER_KEY
+  tracing:
+    store: clickhouse

enterprise/litellm_enterprise/proxy/management_endpoints/project_endpoints.py

@@ -22,10 +22,8 @@ from litellm._uuid import uuid
 from litellm.proxy._types import *
 from litellm.proxy.auth.auth_checks import delete_cached_project_object
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
-from litellm.proxy.management_endpoints.common_utils import (
-    _is_user_team_admin,  # pyright: ignore[reportPrivateUsage]  # shared owner of team-admin membership
-    _set_object_metadata_field,
-)
+from litellm.proxy.management.teams.access import is_team_admin
+from litellm.proxy.management_endpoints.common_utils import _set_object_metadata_field
 from litellm.proxy.management_endpoints.team_admin_field_permissions import team_admin_may_manage_projects
 from litellm.proxy.management_helpers.utils import (
     management_endpoint_wrapper,
@@ -117,7 +115,7 @@ async def _check_user_permission_for_project(
         return False
 
     team: Final = LiteLLM_TeamTable.model_validate(team_row.model_dump())
-    return _is_user_team_admin(user_api_key_dict, team) or user_api_key_dict.user_id in (team.admins or [])
+    return is_team_admin(user_api_key_dict, team) or user_api_key_dict.user_id in (team.admins or [])
 
 
 async def _validate_team_exists(

gateway/routes/allowlist.py

@@ -73,6 +73,7 @@ GATEWAY_PATH_PREFIXES: tuple[str, ...] = (
     "/v1/containers",
     "/containers",
     "/v1/evals",
+    "/v1/traces",
     "/v1/memory",
     "/queue/chat/",
     # Google data plane (v1beta is the Google AI Studio version)

litellm-proxy-extras/litellm_proxy_extras/migrations/20260930000000_agent_engine/migration.sql

@@ -0,0 +1,10 @@
+CREATE TABLE IF NOT EXISTS "LiteLLM_Engine" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "version" INTEGER NOT NULL DEFAULT 0,
+    "data" JSONB NOT NULL
+);
+CREATE TABLE IF NOT EXISTS "LiteLLM_EngineWorker" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "token_hash" TEXT NOT NULL UNIQUE,
+    "data" JSONB NOT NULL
+);

litellm-proxy-extras/litellm_proxy_extras/schema.prisma

@@ -1894,3 +1894,15 @@ model LiteLLM_WorkflowMessage {
   @@unique([run_id, sequence_number])
   @@index([run_id])
 }
+
+model LiteLLM_Engine {
+  id      String @id
+  version Int @default(0)
+  data    Json
+}
+
+model LiteLLM_EngineWorker {
+  id         String @id
+  token_hash String @unique
+  data       Json
+}

litellm-rust/Cargo.lock

@@ -1274,6 +1274,18 @@ version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e8ccc4ea9f6acc32d102c0f6d471d11d913ad15f20c04de743374861fa1d414"
 
+[[package]]
+name = "const-hex"
+version = "1.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e59eef12462b0f9b0a3620219be5d639afd79fe39dff0a42c3997061f9298b4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "proptest",
+ "serde_core",
+]
+
 [[package]]
 name = "const-oid"
 version = "0.9.6"
@@ -2372,9 +2384,9 @@ dependencies = [
  "http-body-util",
  "hyper 1.10.1",
  "lazy_static",
- "opentelemetry",
+ "opentelemetry 0.32.0",
  "opentelemetry-semantic-conventions",
- "opentelemetry_sdk",
+ "opentelemetry_sdk 0.32.1",
  "percent-encoding",
  "pin-project",
  "prost",
@@ -4356,10 +4368,15 @@ dependencies = [
 name = "litellm-traces"
 version = "0.1.0"
 dependencies = [
+ "base64 0.22.1",
+ "flate2",
  "litellm-http",
+ "opentelemetry-proto",
+ "prost",
  "rstest",
  "serde",
  "serde_json",
+ "sha2 0.10.9",
  "testcontainers-modules",
  "thiserror 2.0.19",
  "time",
@@ -4776,6 +4793,33 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "opentelemetry"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cdb0b1b267eb9db3331b434ed9ddab10d50e280a9adf9d13e5233e2002b61b5"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "js-sys",
+ "pin-project-lite",
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "opentelemetry-proto"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25da1ac11a0aeccf38d7f77ee0348715adaf8340f65ad46c94a02c6b20e2f65d"
+dependencies = [
+ "base64 0.22.1",
+ "const-hex",
+ "opentelemetry 0.33.0",
+ "opentelemetry_sdk 0.33.0",
+ "prost",
+ "serde",
+]
+
 [[package]]
 name = "opentelemetry-semantic-conventions"
 version = "0.32.1"
@@ -4791,7 +4835,23 @@ dependencies = [
  "futures-channel",
  "futures-executor",
  "futures-util",
- "opentelemetry",
+ "opentelemetry 0.32.0",
+ "percent-encoding",
+ "portable-atomic",
+ "rand 0.9.5",
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "opentelemetry_sdk"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb39533d9d1c912123efd7d41d7e0c29d16917b60ce15b4c8d87cb1af7f67520"
+dependencies = [
+ "futures-channel",
+ "futures-executor",
+ "futures-util",
+ "opentelemetry 0.33.0",
  "percent-encoding",
  "portable-atomic",
  "rand 0.9.5",
@@ -7524,7 +7584,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "adbc64cba7137545b8044cb1fe9814f7aacf3c6b5f9b45be8bb5db538befdb26"
 dependencies = [
  "js-sys",
- "opentelemetry",
+ "opentelemetry 0.32.0",
  "tracing",
  "tracing-core",
  "tracing-subscriber",

litellm-rust/crates/gateway-ui/Cargo.toml

@@ -6,7 +6,7 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
-axum = { workspace = true, features = ["json", "original-uri"] }
+axum = { workspace = true, features = ["json", "original-uri", "query"] }
 axum-login.workspace = true
 base64.workspace = true
 governor = { version = "0.10.4", default-features = false, features = ["std"] }
@@ -16,6 +16,7 @@ rand.workspace = true
 serde.workspace = true
 thiserror.workspace = true
 time.workspace = true
+tower = { version = "0.5", features = ["util"] }
 tower-cookies = "0.11.0"
 tower-http = { version = "0.6.11", features = ["fs", "set-header"] }
 tower-sessions.workspace = true

litellm-rust/crates/gateway-ui/src/dashboard.rs

@@ -1,7 +1,12 @@
 use std::path::Path;
 
-use axum::{Router, routing::get};
-use serde::Serialize;
+use axum::{
+    Router,
+    extract::{Query, Request},
+    routing::get,
+};
+use serde::{Deserialize, Serialize};
+use tower::ServiceExt;
 use tower_http::services::{ServeDir, ServeFile};
 
 #[derive(Serialize)]
@@ -9,9 +14,39 @@ struct Logo {
     logo_url: &'static str,
 }
 
+#[derive(Clone, Copy, Deserialize)]
+#[serde(rename_all = "lowercase")]
+enum Theme {
+    Light,
+    Dark,
+}
+
+#[derive(Clone, Copy, Deserialize)]
+#[serde(rename_all = "lowercase")]
+enum Variant {
+    Full,
+    Monogram,
+}
+
+#[derive(Deserialize)]
+struct LogoQuery {
+    theme: Option<Theme>,
+    variant: Option<Variant>,
+}
+
+fn logo_file(query: &LogoQuery) -> &'static str {
+    match (query.variant, query.theme) {
+        (Some(Variant::Monogram), Some(Theme::Dark)) => "assets/logos/litellm_monogram_dark.svg",
+        (Some(Variant::Monogram), _) => "assets/logos/litellm_monogram.svg",
+        (_, Some(Theme::Dark)) => "assets/logos/litellm_logo_dark.png",
+        _ => "assets/logos/litellm_logo.png",
+    }
+}
+
 pub fn dashboard_assets(directory: impl AsRef<Path>) -> Router {
     let directory = directory.as_ref();
     let assets = ServeDir::new(directory.join("_next")).append_index_html_on_directories(false);
+    let logos = directory.to_path_buf();
 
     crate::static_assets(directory)
         .route(
@@ -22,9 +57,11 @@ pub fn dashboard_assets(directory: impl AsRef<Path>) -> Router {
                 })
             }),
         )
-        .route_service(
+        .route(
             "/get_image",
-            ServeFile::new(directory.join("assets/logos/litellm_logo.jpg")),
+            get(move |Query(query): Query<LogoQuery>, request: Request| {
+                ServeFile::new(logos.join(logo_file(&query))).oneshot(request)
+            }),
         )
         .route_service(
             "/get_favicon",

litellm-rust/crates/gateway-ui/tests/assets.rs

@@ -40,7 +40,14 @@ fn dashboard(directory: TempDir) -> App {
     let export = directory.path().join("public");
     std::fs::create_dir_all(export.join("_next/static")).unwrap();
     std::fs::create_dir_all(export.join("assets/logos")).unwrap();
-    std::fs::write(export.join("assets/logos/litellm_logo.jpg"), "logo bytes").unwrap();
+    for (file, bytes) in [
+        ("litellm_logo.png", "logo bytes"),
+        ("litellm_logo_dark.png", "dark logo bytes"),
+        ("litellm_monogram.svg", "monogram bytes"),
+        ("litellm_monogram_dark.svg", "dark monogram bytes"),
+    ] {
+        std::fs::write(export.join("assets/logos").join(file), bytes).unwrap();
+    }
     std::fs::write(export.join("favicon.ico"), "icon bytes").unwrap();
     std::fs::write(export.join("_next/static/app.js"), "window.app = true;").unwrap();
     App {
@@ -130,7 +137,15 @@ async fn missing_paths_never_fall_back_to_dashboard(app: App, #[case] path: &str
 )]
 #[case::root_assets("/_next/static/app.js", "window.app = true;", "text/javascript")]
 #[case::nested_assets("/ui/_next/static/app.js", "window.app = true;", "text/javascript")]
-#[case::logo("/get_image", "logo bytes", "image/jpeg")]
+#[case::logo("/get_image", "logo bytes", "image/png")]
+#[case::logo_light("/get_image?theme=light", "logo bytes", "image/png")]
+#[case::logo_dark("/get_image?theme=dark", "dark logo bytes", "image/png")]
+#[case::monogram("/get_image?variant=monogram", "monogram bytes", "image/svg+xml")]
+#[case::monogram_dark(
+    "/get_image?theme=dark&variant=monogram",
+    "dark monogram bytes",
+    "image/svg+xml"
+)]
 #[case::favicon("/get_favicon", "icon bytes", "image/x-icon")]
 #[tokio::test]
 async fn dashboard_adapter_preserves_existing_urls(
@@ -184,3 +199,19 @@ async fn logo_discovery_points_to_served_image(dashboard: App) {
         "logo bytes"
     );
 }
+
+#[rstest]
+#[case::logo("/get_image")]
+#[case::logo_dark("/get_image?theme=dark")]
+#[case::monogram("/get_image?variant=monogram")]
+#[case::monogram_dark("/get_image?theme=dark&variant=monogram")]
+#[tokio::test]
+async fn committed_dashboard_export_serves_every_logo(#[case] path: &str) {
+    let export = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("../../../litellm/proxy/_experimental/out");
+    let response = litellm_gateway_ui::dashboard_assets(export)
+        .oneshot(Request::get(path).body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+}

litellm-rust/crates/python-bridge/src/lib.rs

@@ -44,7 +44,7 @@ mod _native {
     #[pymodule_export]
     use crate::routes::token_counter::TokenCounter;
     #[pymodule_export]
-    use crate::routes::traces::{trace_encode_rows, trace_ensure_schema, trace_query};
+    use crate::routes::traces::{NativeTraceStorage, trace_decode_otlp};
     #[cfg(feature = "huggingface")]
     #[pymodule_export]
     use crate::tokenizer::HuggingFaceEncoding;
@@ -109,9 +109,8 @@ mod tests {
                 "aresponses",
                 "ResponsesWebSocketConnection",
                 "NativeDiagnosticProcessor",
-                "trace_encode_rows",
-                "trace_ensure_schema",
-                "trace_query",
+                "NativeTraceStorage",
+                "trace_decode_otlp",
                 "TokenCounter",
                 "Tokenizer",
                 "gil_stats",

litellm-rust/crates/python-bridge/src/routes/traces.rs

@@ -1,19 +1,23 @@
 use std::collections::BTreeMap;
 
 use litellm_http::ClientVariant;
-use litellm_traces::{Connection, Error, Parameter};
+use litellm_traces::{Connection, Error, InsertTable, Parameter, ReadQuery};
 use pyo3::{
-    exceptions::{PyRuntimeError, PyValueError},
+    exceptions::{PyOverflowError, PyRuntimeError, PyValueError},
     prelude::*,
 };
 
 fn map_error(error: Error) -> PyErr {
     match error {
-        Error::InvalidRow | Error::InvalidSchema | Error::EmptySql => {
-            PyValueError::new_err(error.to_string())
-        }
+        Error::InvalidRow
+        | Error::InvalidTable
+        | Error::InvalidSchema
+        | Error::EmptySql
+        | Error::InvalidQuery => PyValueError::new_err(error.to_string()),
+        Error::InsertTooLarge => PyOverflowError::new_err(error.to_string()),
         Error::InvalidUrl
         | Error::QueryFailed(_)
+        | Error::InsertFailed(_)
         | Error::SchemaFailed(_)
         | Error::ResponseTooLarge
         | Error::InvalidResponse
@@ -21,63 +25,142 @@ fn map_error(error: Error) -> PyErr {
     }
 }
 
-#[pyfunction]
-pub fn trace_ensure_schema<'py>(
-    py: Python<'py>,
-    url: &str,
+#[pyclass]
+pub struct NativeTraceStorage {
     database: String,
-    user: &str,
-    password: &str,
-    trace_retention_days: u32,
-    spend_log_retention_days: u32,
-) -> PyResult<Bound<'py, PyAny>> {
-    let connection = Connection::writer(url, user, password).map_err(map_error)?;
-    let client = crate::http::host_client(py, ClientVariant::NoRedirect)?;
-    crate::execution::run_async(
-        py,
-        async move {
-            litellm_traces::ensure_schema(
-                &client,
-                &connection,
-                &database,
-                trace_retention_days,
-                spend_log_retention_days,
-            )
-            .await
-        },
-        map_error,
-    )
+    writer: Connection,
+    reader: Option<Connection>,
+}
+
+#[pymethods]
+impl NativeTraceStorage {
+    #[new]
+    #[pyo3(signature = (database, url, reader_url = None))]
+    fn new(database: String, url: &str, reader_url: Option<&str>) -> PyResult<Self> {
+        litellm_traces::schema_statements(&database, 1, 1).map_err(map_error)?;
+        Ok(Self {
+            writer: Connection::writer(url).map_err(map_error)?,
+            reader: reader_url
+                .map(|value| Connection::reader(value, &database))
+                .transpose()
+                .map_err(map_error)?,
+            database,
+        })
+    }
+
+    fn ensure_schema<'py>(
+        &self,
+        py: Python<'py>,
+        trace_retention_days: u32,
+        spend_log_retention_days: u32,
+    ) -> PyResult<Bound<'py, PyAny>> {
+        let client = crate::http::host_client(py, ClientVariant::NoRedirect)?;
+        let connection = self.writer.clone();
+        let database = self.database.clone();
+        crate::execution::run_async(
+            py,
+            async move {
+                litellm_traces::ensure_schema(
+                    &client,
+                    &connection,
+                    &database,
+                    trace_retention_days,
+                    spend_log_retention_days,
+                )
+                .await
+            },
+            map_error,
+        )
+    }
+
+    fn insert_rows<'py>(
+        &self,
+        py: Python<'py>,
+        table: &str,
+        #[pyo3(from_py_with = litellm_host_python::from_py_argument)] rows: Vec<
+            BTreeMap<String, serde_json::Value>,
+        >,
+    ) -> PyResult<Bound<'py, PyAny>> {
+        let table = InsertTable::parse(table).map_err(map_error)?;
+        let client = crate::http::host_client(py, ClientVariant::NoRedirect)?;
+        let connection = self.writer.clone();
+        let database = self.database.clone();
+        crate::execution::run_async(
+            py,
+            async move {
+                litellm_traces::insert_rows(&client, &connection, &database, table, rows).await
+            },
+            map_error,
+        )
+    }
+
+    fn lens_query<'py>(
+        &self,
+        py: Python<'py>,
+        name: &str,
+        #[pyo3(from_py_with = litellm_host_python::from_py_argument)] parameters: BTreeMap<
+            String,
+            Parameter,
+        >,
+    ) -> PyResult<Bound<'py, PyAny>> {
+        let query = litellm_traces::LensQuery::parse(name).map_err(map_error)?;
+        let connection = self.reader.clone().ok_or_else(|| {
+            PyRuntimeError::new_err("Trace reads require a separate ClickHouse reader URL")
+        })?;
+        let client = crate::http::host_client(py, ClientVariant::NoRedirect)?;
+        crate::execution::run_async(
+            py,
+            async move {
+                litellm_traces::execute_read(&client, &connection, query.sql(), &parameters).await
+            },
+            map_error,
+        )
+    }
+
+    fn query<'py>(
+        &self,
+        py: Python<'py>,
+        query: &str,
+        #[pyo3(from_py_with = litellm_host_python::from_py_argument)] parameters: BTreeMap<
+            String,
+            Parameter,
+        >,
+    ) -> PyResult<Bound<'py, PyAny>> {
+        let query = ReadQuery::parse(query).map_err(map_error)?;
+        let connection = self.reader.clone().ok_or_else(|| {
+            PyRuntimeError::new_err("Trace reads require a separate ClickHouse reader URL")
+        })?;
+        let client = crate::http::host_client(py, ClientVariant::NoRedirect)?;
+        crate::execution::run_async(
+            py,
+            async move {
+                litellm_traces::execute_named_read(&client, &connection, query, &parameters).await
+            },
+            map_error,
+        )
+    }
 }
 
 #[pyfunction]
-pub fn trace_query<'py>(
+pub fn trace_decode_otlp<'py>(
     py: Python<'py>,
-    url: &str,
-    database: &str,
-    user: &str,
-    password: &str,
-    sql: String,
-    #[pyo3(from_py_with = litellm_host_python::from_py_argument)] parameters: BTreeMap<
-        String,
-        Parameter,
-    >,
+    body: &[u8],
+    content_type: Option<&str>,
+    content_encoding: Option<&str>,
+    max_decompressed_bytes: usize,
 ) -> PyResult<Bound<'py, PyAny>> {
-    let connection = Connection::configured(url, database, user, password).map_err(map_error)?;
-    let client = crate::http::host_client(py, ClientVariant::NoRedirect)?;
-    crate::execution::run_async(
-        py,
-        async move { litellm_traces::execute_read(&client, &connection, &sql, &parameters).await },
-        map_error,
-    )
-}
-
-#[pyfunction]
-pub fn trace_encode_rows(
-    py: Python<'_>,
-    #[pyo3(from_py_with = litellm_host_python::from_py_argument)] rows: Vec<
-        BTreeMap<String, serde_json::Value>,
-    >,
-) -> PyResult<String> {
-    py.detach(|| litellm_traces::encode_rows(rows))
-        .map_err(map_error)
+    let spans = py
+        .detach(|| {
+            litellm_traces::decode_otlp(
+                body,
+                content_type,
+                content_encoding,
+                max_decompressed_bytes,
+            )
+        })
+        .map_err(|error| match error {
+            litellm_traces::DecodeError::TooLarge => PyOverflowError::new_err(error.to_string()),
+            _ => PyValueError::new_err(error.to_string()),
+        })?;
+    litellm_host_python::Pythonized(spans).into_pyobject(py)
 }

litellm-rust/crates/traces/AGENTS.md

@@ -2,5 +2,6 @@
 - Keep this crate independent of Python; PyO3 conversion and public Python exceptions belong in `python-bridge`
 - Keep the SQL migrations here as the only ClickHouse schema definition
 - Use typed query parameters and a dedicated SELECT-only reader with server-side limits
+- Keep `config/reader.xml` grants on the database the schema is created in (CLICKHOUSE_DATABASE, default `litellm`)
 - Bound insert time and encoded bytes; make retry deduplication behavior explicit for supported ClickHouse versions
 - Test storage behavior through the crate's public API against ClickHouse

litellm-rust/crates/traces/Cargo.toml

@@ -6,8 +6,13 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
+base64.workspace = true
+flate2.workspace = true
+opentelemetry-proto = { version = "0.33.0", default-features = false, features = ["gen-tonic-messages", "trace", "with-serde"] }
+prost = "0.14.4"
 time = { workspace = true, features = ["formatting"] }
 litellm-http.workspace = true
+sha2.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true

litellm-rust/crates/traces/config/reader.xml

@@ -24,7 +24,7 @@
             <profile>litellm_traces_reader</profile>
             <grants>
                 <query>GRANT SELECT ON litellm.otel_traces</query>
-                <query>GRANT SELECT ON litellm.agent_traces</query>
+                <query>GRANT SELECT ON litellm.agent_traces_by_key</query>
                 <query>GRANT SELECT ON litellm.spend_logs</query>
             </grants>
         </litellm_traces_reader>

litellm-rust/crates/traces/migrations/0001_otel_traces.sql

@@ -44,4 +44,4 @@ CREATE TABLE IF NOT EXISTS {database}.otel_traces
 ENGINE = MergeTree
 PARTITION BY toDate(Timestamp)
 ORDER BY (TeamId, ServiceName, toDateTime(Timestamp), TraceId)
-SETTINGS ttl_only_drop_parts = 1
+SETTINGS ttl_only_drop_parts = 1, non_replicated_deduplication_window = 1000

litellm-rust/crates/traces/migrations/0002_agent_traces.sql

@@ -1,6 +1,7 @@
-CREATE TABLE IF NOT EXISTS {database}.agent_traces
+CREATE TABLE IF NOT EXISTS {database}.agent_traces_by_key
 (
     TeamId        LowCardinality(String),
+    ApiKeyHash    String,
     TraceId       String,
     StartTs       SimpleAggregateFunction(min, DateTime64(9)),
     EndTs         SimpleAggregateFunction(max, DateTime64(9)),
@@ -20,4 +21,5 @@ CREATE TABLE IF NOT EXISTS {database}.agent_traces
     RequestIds    SimpleAggregateFunction(groupArrayArray, Array(String))
 )
 ENGINE = AggregatingMergeTree
-ORDER BY (TeamId, TraceId)
+ORDER BY (TeamId, ApiKeyHash, TraceId)
+SETTINGS non_replicated_deduplication_window = 1000

litellm-rust/crates/traces/migrations/0003_agent_traces_mv.sql

@@ -1,6 +1,7 @@
-CREATE MATERIALIZED VIEW IF NOT EXISTS {database}.agent_traces_mv TO {database}.agent_traces AS
+CREATE MATERIALIZED VIEW IF NOT EXISTS {database}.agent_traces_by_key_mv
+TO {database}.agent_traces_by_key AS
 SELECT
-    TeamId, TraceId,
+    TeamId, ApiKeyHash, TraceId,
     min(Timestamp)                                         AS StartTs,
     max(Timestamp + toIntervalNanosecond(Duration))        AS EndTs,
     any(ServiceName)                                       AS ServiceName,
@@ -18,4 +19,4 @@ SELECT
     groupUniqArrayIf(SpanName, ObservationType = 'agent')  AS AgentNames,
     groupArrayIf(LiteLLMRequestId, LiteLLMRequestId != '') AS RequestIds
 FROM {database}.otel_traces
-GROUP BY TeamId, TraceId
+GROUP BY TeamId, ApiKeyHash, TraceId

litellm-rust/crates/traces/migrations/0006_agent_traces_ttl.sql

@@ -1 +1 @@
-ALTER TABLE {database}.agent_traces MODIFY TTL toDateTime(StartTs) + INTERVAL {trace_retention_days} DAY
+ALTER TABLE {database}.agent_traces_by_key MODIFY TTL toDateTime(StartTs) + INTERVAL {trace_retention_days} DAY

litellm-rust/crates/traces/migrations/0008_trace_received.sql

@@ -0,0 +1 @@
+ALTER TABLE {database}.otel_traces ADD COLUMN IF NOT EXISTS EngineReceivedMs UInt64 DEFAULT 0

litellm-rust/crates/traces/migrations/0009_spend_received.sql

@@ -0,0 +1 @@
+ALTER TABLE {database}.spend_logs ADD COLUMN IF NOT EXISTS EngineReceivedMs UInt64 DEFAULT 0

litellm-rust/crates/traces/query/lens_content.sql

@@ -0,0 +1,26 @@
+SELECT * FROM (
+    SELECT SpanId AS span_id, ParentSpanId AS parent_span_id, SpanName AS name,
+        ObservationType AS kind,
+        substringUTF8(concat('Input: ',Input,'\nOutput: ',Output,'\nStatus: ',StatusCode,' ',StatusMessage),
+            {offset:UInt32},8000) AS content,
+        lengthUTF8(concat('Input: ',Input,'\nOutput: ',Output,'\nStatus: ',StatusCode,' ',StatusMessage))
+            >= {offset:UInt32}+8000 AS truncated
+    FROM otel_traces WHERE {source:String}='traces'
+      AND ({all_teams:UInt8}=1 OR TeamId={team:String})
+      AND ({key_hash:String}='' OR ApiKeyHash={key_hash:String})
+      AND ({trace_ref:String}='' OR hex(SHA256(concat(TeamId, char(0), ApiKeyHash, char(0), TraceId)))={trace_ref:String})
+      AND TraceId={id:String} AND TeamId={record_team:String} AND SpanId > {cursor:String}
+    ORDER BY SpanId LIMIT 1 BY SpanId LIMIT 40
+)
+UNION ALL
+SELECT * FROM (
+    SELECT request_id AS span_id, '' AS parent_span_id, model AS name, 'llm' AS kind,
+        substringUTF8(concat('Input: ',messages,'\nOutput: ',response,'\nError: ',error_str),
+            {offset:UInt32},8000) AS content,
+        lengthUTF8(concat('Input: ',messages,'\nOutput: ',response,'\nError: ',error_str))
+            >= {offset:UInt32}+8000 AS truncated
+    FROM spend_logs FINAL WHERE {source:String}='requests'
+      AND ({all_teams:UInt8}=1 OR team_id={team:String})
+      AND ({key_hash:String}='' OR api_key={key_hash:String})
+      AND request_id={id:String} AND team_id={record_team:String} LIMIT 1
+)

litellm-rust/crates/traces/query/lens_evidence.sql

@@ -0,0 +1,14 @@
+SELECT sum(matches) AS count FROM (
+    SELECT count() AS matches FROM otel_traces WHERE {source:String}='traces'
+      AND ({all_teams:UInt8}=1 OR TeamId={team:String})
+      AND ({key_hash:String}='' OR ApiKeyHash={key_hash:String})
+      AND ({trace_ref:String}='' OR hex(SHA256(concat(TeamId, char(0), ApiKeyHash, char(0), TraceId)))={trace_ref:String})
+      AND TraceId={id:String} AND TeamId={record_team:String} AND SpanId={span:String}
+      AND position(concat('Input: ',Input,'\nOutput: ',Output,'\nStatus: ',StatusCode,' ',StatusMessage),{quote:String})>0
+    UNION ALL
+    SELECT count() AS matches FROM spend_logs FINAL WHERE {source:String}='requests'
+      AND ({all_teams:UInt8}=1 OR team_id={team:String})
+      AND ({key_hash:String}='' OR api_key={key_hash:String})
+      AND request_id={id:String} AND team_id={record_team:String} AND request_id={span:String}
+      AND position(concat('Input: ',messages,'\nOutput: ',response,'\nError: ',error_str),{quote:String})>0
+)

litellm-rust/crates/traces/query/lens_sample.sql

@@ -0,0 +1,50 @@
+SELECT *, count() OVER () AS eligible FROM (
+    SELECT 'traces' AS source, TraceId AS trace_id, TeamId AS team_id, hex(SHA256(concat(TeamId, char(0), ApiKeyHash, char(0), TraceId))) AS trace_ref,
+        coalesce(nullIf(argMin(ResourceAttributes['run.name'], Timestamp), ''),
+            argMin(SpanName, Timestamp)) AS name, toString(min(Timestamp)) AS start_time,
+        uniqExact(SpanId) AS span_count, countIf(ParentSpanId='') > 0 AS root_seen,
+        argMin(ServiceName, Timestamp) AS service,
+        arrayZip(mapKeys(argMin(mapConcat(ResourceAttributes, SpanAttributes), tuple(ParentSpanId!='',Timestamp))),
+            mapValues(argMin(mapConcat(ResourceAttributes, SpanAttributes), tuple(ParentSpanId!='',Timestamp)))) AS attributes
+    FROM otel_traces
+    WHERE {source:String} IN ('traces','both')
+      AND ({all_teams:UInt8}=1 OR TeamId={team:String})
+      AND ({key_hash:String}='' OR ApiKeyHash={key_hash:String})
+      AND (TeamId,ApiKeyHash,TraceId) IN (
+          SELECT TeamId,ApiKeyHash,TraceId FROM otel_traces
+          WHERE ({all_teams:UInt8}=1 OR TeamId={team:String})
+            AND ({key_hash:String}='' OR ApiKeyHash={key_hash:String})
+            AND if(EngineReceivedMs>0,toInt64(EngineReceivedMs),
+                toUnixTimestamp64Milli(Timestamp)+toInt64(intDiv(Duration,1000000))) >= {start:UInt64}
+      )
+    GROUP BY TeamId,ApiKeyHash,TraceId
+    HAVING max(EngineReceivedMs) < {end:UInt64}
+       AND max(toUnixTimestamp64Milli(Timestamp)+toInt64(intDiv(Duration,1000000))) < {end:UInt64}
+       AND countIf(arrayAll((k,v) -> ResourceAttributes[k]=v OR SpanAttributes[k]=v,
+           {filter_keys:Array(String)},{filter_values:Array(String)})
+           AND ({service:String}='' OR ServiceName={service:String})) > 0
+    UNION ALL
+    SELECT 'requests' AS source, request_id AS trace_id, team_id, '' AS trace_ref, model AS name,
+        toString(start_time) AS start_time, toUInt64(1) AS span_count, toUInt8(1) AS root_seen,
+        model_group AS service,
+        arrayConcat(JSONExtractKeysAndValues(metadata, 'requester_metadata', 'String'),
+            arrayMap(t -> tuple('tag', t), request_tags)) AS attributes
+    FROM spend_logs FINAL
+    WHERE {source:String} IN ('requests','both')
+      AND ({all_teams:UInt8}=1 OR team_id={team:String})
+      AND ({key_hash:String}='' OR api_key={key_hash:String})
+      AND if(EngineReceivedMs>0,toInt64(EngineReceivedMs),toUnixTimestamp64Milli(end_time)) >= {start:UInt64}
+      AND EngineReceivedMs < {end:UInt64}
+      AND toUnixTimestamp64Milli(end_time) < {end:UInt64}
+      AND arrayAll((k,v) -> JSONExtractString(metadata,k)=v
+          OR JSONExtractString(metadata,'requester_metadata',k)=v OR (k='tag' AND has(request_tags,v)),
+          {filter_keys:Array(String)},{filter_values:Array(String)})
+      AND ({service:String}='' OR model_group={service:String})
+      AND NOT JSONExtractBool(metadata,'litellm_lens_internal')
+      AND ({source:String}!='both' OR (team_id,api_key,response_id) NOT IN (
+          SELECT TeamId,ApiKeyHash,LiteLLMRequestId FROM otel_traces
+          WHERE ({all_teams:UInt8}=1 OR TeamId={team:String})
+            AND ({key_hash:String}='' OR ApiKeyHash={key_hash:String}) AND LiteLLMRequestId!=''
+      ))
+)
+ORDER BY cityHash64(concat(source,team_id,trace_id)) LIMIT {limit:UInt32}

litellm-rust/crates/traces/query/list_traces.sql

@@ -0,0 +1,23 @@
+SELECT TraceId AS trace_id,
+       hex(SHA256(concat(TeamId, char(0), ApiKeyHash, char(0), TraceId))) AS trace_ref,
+       TeamId AS team_id, ApiKeyHash AS api_key_hash,
+       ifNull(any(RootName), '') AS name, any(ServiceName) AS service,
+       ifNull(any(RootInput), '') AS input_preview, ifNull(any(RootStatus), '') AS status,
+       toUnixTimestamp64Milli(min(StartTs)) AS start_ms,
+       dateDiff('millisecond', min(StartTs), max(EndTs)) AS duration_ms,
+       sum(SpanCount) AS span_count, length(groupUniqArrayArray(AgentNames)) AS agent_count,
+       sum(AgentCount) AS agent_invocations,
+       sum(LlmCount) AS llm_calls, sum(ToolCount) AS tool_calls,
+       sum(InputTokens) AS input_tokens, sum(OutputTokens) AS output_tokens,
+       groupUniqArrayArray(Models) AS models, sum(ErrorCount) AS error_count,
+       arrayDistinct(groupArrayArray(RequestIds)) AS request_ids
+FROM agent_traces_by_key
+WHERE (empty({team_ids:Array(String)}) OR TeamId IN {team_ids:Array(String)})
+  AND ({api_key_hash:String} = '' OR ApiKeyHash = {api_key_hash:String})
+GROUP BY TeamId, ApiKeyHash, TraceId
+HAVING min(StartTs) >= fromUnixTimestamp64Milli({start_ms:Int64})
+   AND min(StartTs) < fromUnixTimestamp64Milli({end_ms:Int64})
+   AND ({cursor_ms:Int64} = 0 OR (toUnixTimestamp64Milli(min(StartTs)), trace_ref)
+        < ({cursor_ms:Int64}, {cursor_trace_id:String}))
+ORDER BY start_ms DESC, trace_ref DESC
+LIMIT {limit:UInt32}

litellm-rust/crates/traces/query/span_detail.sql

@@ -0,0 +1,8 @@
+SELECT SpanId AS span_id, Input AS input, Output AS output, SpanAttributes AS attributes
+FROM otel_traces
+WHERE TraceId = {trace_id:String} AND SpanId = {span_id:String}
+  AND (empty({team_ids:Array(String)}) OR TeamId IN {team_ids:Array(String)})
+  AND ({api_key_hash:String} = '' OR ApiKeyHash = {api_key_hash:String})
+  AND ({trace_ref:String} = '' OR
+       hex(SHA256(concat(TeamId, char(0), ApiKeyHash, char(0), TraceId))) = {trace_ref:String})
+LIMIT 1

litellm-rust/crates/traces/query/spend_by_response_ids.sql

@@ -0,0 +1,9 @@
+SELECT request_id, response_id, team_id, api_key, spend,
+       toUnixTimestamp64Milli(start_time) AS start_ms
+FROM spend_logs FINAL
+WHERE response_id IN {response_ids:Array(String)}
+  AND start_time >= fromUnixTimestamp64Milli({start_ms:Int64})
+  AND start_time < fromUnixTimestamp64Milli({end_ms:Int64})
+  AND (empty({team_ids:Array(String)}) OR team_id IN {team_ids:Array(String)})
+  AND ({api_key_hash:String} = '' OR api_key = {api_key_hash:String})
+ORDER BY start_time DESC

litellm-rust/crates/traces/query/trace_spans.sql

@@ -0,0 +1,16 @@
+SELECT o.SpanId AS span_id, o.ParentSpanId AS parent_span_id, o.SpanName AS name,
+       o.ObservationType AS type, o.AgentName AS agent, o.StatusCode AS status,
+       o.StatusMessage AS status_message,
+       toUnixTimestamp64Nano(o.Timestamp) AS start_ns, o.Duration AS duration_ns,
+       o.ServiceName AS service, o.InputPreview AS input_preview, o.Model AS model,
+       o.InputTokens AS input_tokens, o.OutputTokens AS output_tokens,
+       o.LiteLLMRequestId AS litellm_request_id,
+       o.TeamId AS team_id, o.ApiKeyHash AS api_key_hash
+FROM otel_traces AS o
+WHERE o.TraceId = {trace_id:String}
+  AND (empty({team_ids:Array(String)}) OR o.TeamId IN {team_ids:Array(String)})
+  AND ({api_key_hash:String} = '' OR o.ApiKeyHash = {api_key_hash:String})
+  AND ({trace_ref:String} = '' OR
+       hex(SHA256(concat(o.TeamId, char(0), o.ApiKeyHash, char(0), o.TraceId))) = {trace_ref:String})
+ORDER BY o.Timestamp
+LIMIT 1 BY o.SpanId

litellm-rust/crates/traces/src/error.rs

@@ -2,14 +2,22 @@
 pub enum Error {
     #[error("invalid ClickHouse insert row")]
     InvalidRow,
+    #[error("invalid ClickHouse insert table")]
+    InvalidTable,
     #[error("invalid ClickHouse HTTP URL")]
     InvalidUrl,
     #[error("database must be a nonempty SQL identifier and retention must be positive")]
     InvalidSchema,
     #[error("SQL query must not be empty")]
     EmptySql,
+    #[error("unknown ClickHouse read query")]
+    InvalidQuery,
     #[error("ClickHouse query failed with HTTP status {0}")]
     QueryFailed(u16),
+    #[error("ClickHouse insert failed with HTTP status {0}")]
+    InsertFailed(u16),
+    #[error("ClickHouse insert exceeds the encoded size limit")]
+    InsertTooLarge,
     #[error("ClickHouse schema setup failed with HTTP status {0}")]
     SchemaFailed(u16),
     #[error("ClickHouse query exceeded the response size limit")]
@@ -19,3 +27,11 @@ pub enum Error {
     #[error("ClickHouse query transport failed")]
     Transport,
 }
+
+#[derive(Debug, thiserror::Error)]
+pub enum DecodeError {
+    #[error("invalid OTLP trace payload")]
+    InvalidPayload,
+    #[error("OTLP trace payload exceeds the decompressed size limit")]
+    TooLarge,
+}

litellm-rust/crates/traces/src/insert.rs

@@ -1,21 +1,146 @@
-use std::collections::BTreeMap;
+use std::{collections::BTreeMap, io::Write, time::Duration};
 
+use flate2::{Compression, write::GzEncoder};
+use litellm_http::Client;
 use serde_json::Value;
+use sha2::{Digest, Sha256};
 use time::{OffsetDateTime, format_description::well_known::Rfc3339};
 
-use crate::Error;
+use crate::{Connection, Error};
+
+const MAX_INSERT_BYTES: usize = 64 * 1024 * 1024;
+const INSERT_TIMEOUT: Duration = Duration::from_secs(30);
+
+pub enum InsertTable {
+    OtelTraces,
+    SpendLogs,
+}
+
+impl InsertTable {
+    pub fn parse(value: &str) -> Result<Self, Error> {
+        match value {
+            "otel_traces" => Ok(Self::OtelTraces),
+            "spend_logs" => Ok(Self::SpendLogs),
+            _ => Err(Error::InvalidTable),
+        }
+    }
+
+    fn name(&self) -> &'static str {
+        match self {
+            Self::OtelTraces => "otel_traces",
+            Self::SpendLogs => "spend_logs",
+        }
+    }
+}
+
+pub async fn insert_rows(
+    client: &Client,
+    connection: &Connection,
+    database: &str,
+    table: InsertTable,
+    rows: Vec<BTreeMap<String, Value>>,
+) -> Result<(), Error> {
+    if rows.is_empty() {
+        return Ok(());
+    }
+    let token = format!(
+        "{:x}",
+        Sha256::digest(encode_rows_with_limit(rows.clone(), MAX_INSERT_BYTES)?.as_bytes())
+    );
+    let received_ms = OffsetDateTime::now_utc().unix_timestamp_nanos() / 1_000_000;
+    let rows = rows
+        .into_iter()
+        .map(|row| {
+            row.into_iter()
+                .filter(|(key, _)| key != "EngineReceivedMs")
+                .chain(std::iter::once((
+                    "EngineReceivedMs".to_owned(),
+                    Value::from(received_ms as u64),
+                )))
+                .collect()
+        })
+        .collect();
+    let encoded = encode_rows_with_limit(rows, MAX_INSERT_BYTES)?;
+    let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
+    encoder
+        .write_all(encoded.as_bytes())
+        .map_err(|_| Error::InvalidRow)?;
+    let body = encoder.finish().map_err(|_| Error::InvalidRow)?;
+    let mut url = connection.url().clone();
+    let existing_pairs: Vec<(String, String)> = url
+        .query_pairs()
+        .filter(|(key, _)| {
+            !matches!(
+                key.as_ref(),
+                "query"
+                    | "async_insert"
+                    | "async_insert_deduplicate"
+                    | "wait_for_async_insert"
+                    | "input_format_skip_unknown_fields"
+                    | "date_time_input_format"
+            )
+        })
+        .map(|(key, value)| (key.into_owned(), value.into_owned()))
+        .collect();
+    url.query_pairs_mut()
+        .clear()
+        .extend_pairs(existing_pairs)
+        .append_pair(
+            "query",
+            &format!(
+                "INSERT INTO `{database}`.{} FORMAT JSONEachRow",
+                table.name()
+            ),
+        )
+        .append_pair("insert_deduplication_token", &token)
+        .append_pair("async_insert", "1")
+        .append_pair("async_insert_deduplicate", "1")
+        .append_pair("wait_for_async_insert", "1")
+        .append_pair("input_format_skip_unknown_fields", "0")
+        .append_pair("date_time_input_format", "best_effort");
+    let response = client
+        .post(url)
+        .timeout(INSERT_TIMEOUT)
+        .header("Content-Encoding", "gzip")
+        .body(body)
+        .send()
+        .await
+        .map_err(|_| Error::Transport)?;
+    if !response.status().is_success() {
+        return Err(Error::InsertFailed(response.status().as_u16()));
+    }
+    Ok(())
+}
 
 pub fn encode_rows(rows: Vec<BTreeMap<String, Value>>) -> Result<String, Error> {
-    rows.into_iter()
-        .map(|row| {
-            let encoded = row
-                .into_iter()
-                .map(|(name, value)| insert_value(&name, value).map(|value| (name, value)))
-                .collect::<Result<BTreeMap<_, _>, _>>()?;
-            serde_json::to_string(&encoded).map_err(|_| Error::InvalidRow)
-        })
-        .collect::<Result<Vec<_>, _>>()
-        .map(|rows| rows.join("\n"))
+    encode_rows_with_limit(rows, usize::MAX)
+}
+
+fn encode_rows_with_limit(
+    rows: Vec<BTreeMap<String, Value>>,
+    limit: usize,
+) -> Result<String, Error> {
+    let mut body = Vec::new();
+    for row in rows {
+        let encoded = row
+            .into_iter()
+            .map(|(name, value)| insert_value(&name, value).map(|value| (name, value)))
+            .collect::<Result<BTreeMap<_, _>, _>>()?;
+        let record = serde_json::to_vec(&encoded).map_err(|_| Error::InvalidRow)?;
+        let size = body
+            .len()
+            .checked_add(record.len())
+            .and_then(|size| size.checked_add(usize::from(!body.is_empty())))
+            .ok_or(Error::InsertTooLarge)?;
+        if size > limit {
+            return Err(Error::InsertTooLarge);
+        }
+        if !body.is_empty() {
+            body.push(b'\n');
+        }
+        body.extend_from_slice(&record);
+    }
+    String::from_utf8(body).map_err(|_| Error::InvalidRow)
 }
 
 fn insert_value(name: &str, value: Value) -> Result<Value, Error> {
@@ -35,3 +160,29 @@ fn insert_value(name: &str, value: Value) -> Result<Value, Error> {
         .map(Value::String)
         .map_err(|_| Error::InvalidRow)
 }
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use rstest::rstest;
+    use serde_json::json;
+
+    use super::encode_rows_with_limit;
+    use crate::Error;
+
+    #[rstest]
+    fn encoded_limit_counts_utf8_bytes_across_rows() {
+        let rows = vec![
+            BTreeMap::from([("Input".to_owned(), json!("雪"))]),
+            BTreeMap::from([("Input".to_owned(), json!("雪"))]),
+        ];
+        let encoded = encode_rows_with_limit(rows.clone(), usize::MAX).expect("valid rows");
+
+        assert!(encode_rows_with_limit(rows.clone(), encoded.len()).is_ok());
+        assert!(matches!(
+            encode_rows_with_limit(rows, encoded.len() - 1),
+            Err(Error::InsertTooLarge)
+        ));
+    }
+}

litellm-rust/crates/traces/src/lib.rs

@@ -1,12 +1,14 @@
 mod error;
 mod insert;
+mod otlp;
 mod schema;
 mod sql;
 
-pub use error::Error;
-pub use insert::encode_rows;
+pub use error::{DecodeError, Error};
+pub use insert::{InsertTable, encode_rows, insert_rows};
+pub use otlp::{DecodedSpan, decode_otlp};
 pub use schema::{ensure_schema, schema_statements};
-pub use sql::{Parameter, execute_read};
+pub use sql::{LensQuery, Parameter, ReadQuery, execute_named_read, execute_read};
 use url::Url;
 
 #[derive(Clone)]
@@ -53,17 +55,32 @@ impl Connection {
         Ok(connection)
     }
 
-    pub fn writer(url: &str, user: &str, password: &str) -> Result<Self, Error> {
+    pub fn writer(url: &str) -> Result<Self, Error> {
         let mut connection = Self::parse(url)?;
+        let pairs: Vec<_> = connection
+            .url
+            .query_pairs()
+            .filter(|(key, _)| !matches!(key.as_ref(), "database" | "readonly" | "query"))
+            .map(|(key, value)| (key.into_owned(), value.into_owned()))
+            .collect();
+        connection.url.query_pairs_mut().clear().extend_pairs(pairs);
+        Ok(connection)
+    }
+
+    pub fn reader(url: &str, database: &str) -> Result<Self, Error> {
+        let mut connection = Self::parse(url)?;
+        let pairs: Vec<_> = connection
+            .url
+            .query_pairs()
+            .filter(|(key, _)| key != "database")
+            .map(|(key, value)| (key.into_owned(), value.into_owned()))
+            .collect();
         connection
             .url
-            .set_username(user)
-            .map_err(|_| Error::InvalidUrl)?;
-        connection
-            .url
-            .set_password(Some(password))
-            .map_err(|_| Error::InvalidUrl)?;
-        connection.url.set_query(None);
+            .query_pairs_mut()
+            .clear()
+            .extend_pairs(pairs)
+            .append_pair("database", database);
         Ok(connection)
     }
 

litellm-rust/crates/traces/src/otlp.rs

@@ -0,0 +1,221 @@
+use std::{collections::BTreeMap, io::Read};
+
+use base64::Engine;
+use flate2::read::GzDecoder;
+use opentelemetry_proto::tonic::{
+    collector::trace::v1::ExportTraceServiceRequest,
+    common::v1::{AnyValue, KeyValue, any_value::Value as AttributeValue},
+    trace::v1::{Span, span::SpanKind, status::StatusCode},
+};
+use prost::Message;
+use serde::Serialize;
+use serde_json::Value;
+
+use crate::DecodeError;
+
+#[derive(Serialize)]
+pub struct DecodedEvent {
+    pub name: String,
+    pub attributes: BTreeMap<String, String>,
+}
+
+#[derive(Serialize)]
+pub struct DecodedSpan {
+    pub trace_id: String,
+    pub span_id: String,
+    pub parent_span_id: String,
+    pub trace_state: String,
+    pub name: String,
+    pub kind: String,
+    pub resource_attributes: BTreeMap<String, String>,
+    pub scope_name: String,
+    pub scope_version: String,
+    pub attributes: BTreeMap<String, String>,
+    pub start_ns: u64,
+    pub end_ns: u64,
+    pub status_code: String,
+    pub status_message: String,
+    pub events: Vec<DecodedEvent>,
+}
+
+pub fn decode_otlp(
+    body: &[u8],
+    content_type: Option<&str>,
+    content_encoding: Option<&str>,
+    max_decompressed_bytes: usize,
+) -> Result<Vec<DecodedSpan>, DecodeError> {
+    let payload = if content_encoding == Some("gzip") || body.starts_with(&[0x1f, 0x8b]) {
+        let limit = u64::try_from(max_decompressed_bytes).map_err(|_| DecodeError::TooLarge)?;
+        let mut decoded = Vec::new();
+        GzDecoder::new(body)
+            .take(limit + 1)
+            .read_to_end(&mut decoded)
+            .map_err(|_| DecodeError::InvalidPayload)?;
+        decoded
+    } else {
+        body.to_vec()
+    };
+    if payload.len() > max_decompressed_bytes {
+        return Err(DecodeError::TooLarge);
+    }
+    let request = if content_type.is_some_and(|value| value.contains("json")) {
+        let value: Value =
+            serde_json::from_slice(&payload).map_err(|_| DecodeError::InvalidPayload)?;
+        serde_json::from_value(normalize_json_ids(value)?)
+            .map_err(|_| DecodeError::InvalidPayload)?
+    } else {
+        ExportTraceServiceRequest::decode(payload.as_slice())
+            .map_err(|_| DecodeError::InvalidPayload)?
+    };
+    Ok(request
+        .resource_spans
+        .into_iter()
+        .flat_map(|resource_spans| {
+            let resource_attributes = attributes(
+                resource_spans
+                    .resource
+                    .map(|resource| resource.attributes)
+                    .unwrap_or_default(),
+            );
+            resource_spans
+                .scope_spans
+                .into_iter()
+                .flat_map(move |scope_spans| {
+                    let scope = scope_spans.scope.unwrap_or_default();
+                    let resource_attributes = resource_attributes.clone();
+                    scope_spans.spans.into_iter().map(move |span| {
+                        decoded_span(span, &resource_attributes, &scope.name, &scope.version)
+                    })
+                })
+        })
+        .collect())
+}
+
+fn normalize_json_ids(value: Value) -> Result<Value, DecodeError> {
+    match value {
+        Value::Object(fields) => fields
+            .into_iter()
+            .map(|(name, value)| {
+                let normalized = if matches!(name.as_str(), "traceId" | "spanId" | "parentSpanId") {
+                    let encoded = value.as_str().ok_or(DecodeError::InvalidPayload)?;
+                    let bytes = base64::engine::general_purpose::STANDARD
+                        .decode(encoded)
+                        .map_err(|_| DecodeError::InvalidPayload)?;
+                    Value::String(hex_bytes(&bytes))
+                } else if name == "kind" && value.is_string() {
+                    let kind = SpanKind::from_str_name(value.as_str().unwrap_or_default())
+                        .ok_or(DecodeError::InvalidPayload)?;
+                    Value::from(kind as i32)
+                } else if name == "code" && value.is_string() {
+                    let code = StatusCode::from_str_name(value.as_str().unwrap_or_default())
+                        .ok_or(DecodeError::InvalidPayload)?;
+                    Value::from(code as i32)
+                } else {
+                    normalize_json_ids(value)?
+                };
+                Ok((name, normalized))
+            })
+            .collect::<Result<serde_json::Map<_, _>, _>>()
+            .map(Value::Object),
+        Value::Array(values) => values
+            .into_iter()
+            .map(normalize_json_ids)
+            .collect::<Result<Vec<_>, _>>()
+            .map(Value::Array),
+        value => Ok(value),
+    }
+}
+
+fn hex_bytes(bytes: &[u8]) -> String {
+    bytes.iter().map(|byte| format!("{byte:02x}")).collect()
+}
+
+fn decoded_span(
+    span: Span,
+    resource_attributes: &BTreeMap<String, String>,
+    scope_name: &str,
+    scope_version: &str,
+) -> DecodedSpan {
+    let status = span.status.unwrap_or_default();
+    DecodedSpan {
+        trace_id: hex_bytes(&span.trace_id),
+        span_id: hex_bytes(&span.span_id),
+        parent_span_id: hex_bytes(&span.parent_span_id),
+        trace_state: span.trace_state,
+        name: span.name,
+        kind: SpanKind::try_from(span.kind)
+            .unwrap_or(SpanKind::Unspecified)
+            .as_str_name()
+            .to_owned(),
+        resource_attributes: resource_attributes.clone(),
+        scope_name: scope_name.to_owned(),
+        scope_version: scope_version.to_owned(),
+        attributes: attributes(span.attributes),
+        start_ns: span.start_time_unix_nano,
+        end_ns: span.end_time_unix_nano,
+        status_code: StatusCode::try_from(status.code)
+            .unwrap_or(StatusCode::Unset)
+            .as_str_name()
+            .to_owned(),
+        status_message: status.message,
+        events: span
+            .events
+            .into_iter()
+            .map(|event| DecodedEvent {
+                name: event.name,
+                attributes: attributes(event.attributes),
+            })
+            .collect(),
+    }
+}
+
+fn attributes(values: Vec<KeyValue>) -> BTreeMap<String, String> {
+    values
+        .into_iter()
+        .map(|entry| {
+            (
+                entry.key,
+                entry.value.as_ref().map(attribute_text).unwrap_or_default(),
+            )
+        })
+        .collect()
+}
+
+fn attribute_text(value: &AnyValue) -> String {
+    match value.value.as_ref() {
+        Some(AttributeValue::StringValue(value)) => value.clone(),
+        Some(AttributeValue::BoolValue(value)) => value.to_string(),
+        Some(AttributeValue::IntValue(value)) => value.to_string(),
+        Some(AttributeValue::DoubleValue(value)) => {
+            serde_json::to_string(value).unwrap_or_default()
+        }
+        Some(AttributeValue::BytesValue(value)) => String::from_utf8_lossy(value).into_owned(),
+        Some(AttributeValue::ArrayValue(value)) => format!(
+            "[{}]",
+            value
+                .values
+                .iter()
+                .map(|value| serde_json::to_string(&attribute_text(value)).unwrap_or_default())
+                .collect::<Vec<_>>()
+                .join(", ")
+        ),
+        Some(AttributeValue::KvlistValue(value)) => format!(
+            "{{{}}}",
+            value
+                .values
+                .iter()
+                .map(|entry| format!(
+                    "{}: {}",
+                    serde_json::to_string(&entry.key).unwrap_or_default(),
+                    serde_json::to_string(
+                        &entry.value.as_ref().map(attribute_text).unwrap_or_default()
+                    )
+                    .unwrap_or_default()
+                ))
+                .collect::<Vec<_>>()
+                .join(", ")
+        ),
+        Some(AttributeValue::StringValueStrindex(value)) => value.to_string(),
+        None => String::new(),
+    }
+}

litellm-rust/crates/traces/src/schema.rs

@@ -4,7 +4,9 @@ use std::time::Duration;
 use crate::Connection;
 use crate::Error;
 
-const MIGRATIONS: [&str; 7] = [
+const SCHEMA_REQUEST_TIMEOUT: Duration = Duration::from_secs(30);
+
+const MIGRATIONS: [&str; 9] = [
     include_str!("../migrations/0001_otel_traces.sql"),
     include_str!("../migrations/0002_agent_traces.sql"),
     include_str!("../migrations/0003_agent_traces_mv.sql"),
@@ -12,6 +14,8 @@ const MIGRATIONS: [&str; 7] = [
     include_str!("../migrations/0005_otel_traces_ttl.sql"),
     include_str!("../migrations/0006_agent_traces_ttl.sql"),
     include_str!("../migrations/0007_spend_logs_ttl.sql"),
+    include_str!("../migrations/0008_trace_received.sql"),
+    include_str!("../migrations/0009_spend_received.sql"),
 ];
 
 pub fn schema_statements(
@@ -49,11 +53,30 @@ pub async fn ensure_schema(
     database: &str,
     trace_retention_days: u32,
     spend_log_retention_days: u32,
+) -> Result<(), Error> {
+    ensure_schema_with_timeout(
+        client,
+        connection,
+        database,
+        trace_retention_days,
+        spend_log_retention_days,
+        SCHEMA_REQUEST_TIMEOUT,
+    )
+    .await
+}
+
+async fn ensure_schema_with_timeout(
+    client: &Client,
+    connection: &Connection,
+    database: &str,
+    trace_retention_days: u32,
+    spend_log_retention_days: u32,
+    request_timeout: Duration,
 ) -> Result<(), Error> {
     for statement in schema_statements(database, trace_retention_days, spend_log_retention_days)? {
         let response = client
             .post(connection.url().clone())
-            .timeout(Duration::from_secs(10))
+            .timeout(request_timeout)
             .body(statement)
             .send()
             .await

litellm-rust/crates/traces/src/sql.rs

@@ -8,6 +8,34 @@ use crate::{Connection, Error};
 
 const MAX_RESPONSE_BYTES: usize = 4 * 1024 * 1024;
 
+pub enum ReadQuery {
+    ListTraces,
+    TraceSpans,
+    SpanDetail,
+    SpendByResponseIds,
+}
+
+impl ReadQuery {
+    pub fn parse(value: &str) -> Result<Self, Error> {
+        match value {
+            "list_traces" => Ok(Self::ListTraces),
+            "trace_spans" => Ok(Self::TraceSpans),
+            "span_detail" => Ok(Self::SpanDetail),
+            "spend_by_response_ids" => Ok(Self::SpendByResponseIds),
+            _ => Err(Error::InvalidQuery),
+        }
+    }
+
+    fn sql(&self) -> &'static str {
+        match self {
+            Self::ListTraces => include_str!("../query/list_traces.sql"),
+            Self::TraceSpans => include_str!("../query/trace_spans.sql"),
+            Self::SpanDetail => include_str!("../query/span_detail.sql"),
+            Self::SpendByResponseIds => include_str!("../query/spend_by_response_ids.sql"),
+        }
+    }
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(untagged)]
 pub enum Parameter {
@@ -112,3 +140,37 @@ pub async fn execute_read(
     }
     String::from_utf8(body).map_err(|_| Error::InvalidResponse)
 }
+
+#[derive(Clone, Copy)]
+pub enum LensQuery {
+    Sample,
+    Content,
+    Evidence,
+}
+
+impl LensQuery {
+    pub fn parse(name: &str) -> Result<Self, Error> {
+        match name {
+            "sample" => Ok(Self::Sample),
+            "content" => Ok(Self::Content),
+            "evidence" => Ok(Self::Evidence),
+            _ => Err(Error::InvalidQuery),
+        }
+    }
+    pub fn sql(self) -> &'static str {
+        match self {
+            Self::Sample => include_str!("../query/lens_sample.sql"),
+            Self::Content => include_str!("../query/lens_content.sql"),
+            Self::Evidence => include_str!("../query/lens_evidence.sql"),
+        }
+    }
+}
+
+pub async fn execute_named_read(
+    client: &Client,
+    connection: &Connection,
+    query: ReadQuery,
+    parameters: &BTreeMap<String, Parameter>,
+) -> Result<String, Error> {
+    execute_read(client, connection, query.sql(), parameters).await
+}

litellm-rust/crates/traces/tests/admin_sql.rs

@@ -40,7 +40,12 @@ async fn database() -> Result<Database, Box<dyn std::error::Error>> {
         "CREATE DATABASE litellm",
         "CREATE TABLE litellm.otel_traces (n UInt8) ENGINE = Memory",
         "INSERT INTO litellm.otel_traces VALUES (1)",
+        "CREATE TABLE litellm.agent_traces_by_key (n UInt8) ENGINE = Memory",
+        "INSERT INTO litellm.agent_traces_by_key VALUES (4)",
+        "CREATE TABLE litellm.spend_logs (n UInt8) ENGINE = Memory",
+        "INSERT INTO litellm.spend_logs VALUES (3)",
         "CREATE TABLE litellm.private_traces (n UInt8) ENGINE = Memory",
+        "CREATE TABLE private_traces (n UInt8) ENGINE = Memory",
     ] {
         client
             .post(&admin_url)
@@ -81,6 +86,15 @@ async fn admin_sql_reads_rows_with_enforced_settings(
     let json: Value = serde_json::from_str(&result)?;
     assert_eq!(json["data"][0]["answer"], 1);
 
+    let result = read(
+        &database.client,
+        &connection,
+        "SELECT n AS answer FROM agent_traces_by_key",
+    )
+    .await?;
+    let json: Value = serde_json::from_str(&result)?;
+    assert_eq!(json["data"][0]["answer"], 4);
+
     Ok(())
 }
 

litellm-rust/crates/traces/tests/migrations.rs

@@ -2,7 +2,8 @@ use std::{collections::BTreeMap, time::Duration};
 
 use litellm_http::Client;
 use litellm_traces::{
-    Connection, Error, encode_rows, ensure_schema, execute_read, schema_statements,
+    Connection, Error, InsertTable, Parameter, ReadQuery, encode_rows, ensure_schema,
+    execute_named_read, execute_read, schema_statements,
 };
 use rstest::{fixture, rstest};
 use testcontainers_modules::{
@@ -107,7 +108,7 @@ async fn schema_supports_span_rollups_and_spend_joins(
     #[future(awt)] database: TestResult<ClickHouseDatabase>,
 ) -> TestResult {
     let database = database?;
-    let writer = Connection::writer(&database.url, "default", "")?;
+    let writer = Connection::writer(&database.url)?;
     ensure_schema(&database.client, &writer, "trace_test", 7, 14).await?;
     ensure_schema(&database.client, &writer, "trace_test", 7, 14).await?;
     let timestamp = time::OffsetDateTime::now_utc().unix_timestamp_nanos() as i64;
@@ -124,6 +125,61 @@ async fn schema_supports_span_rollups_and_spend_joins(
     }))?;
     insert_rows(&database, "otel_traces", vec![span]).await?;
     insert_rows(&database, "spend_logs", vec![spend]).await?;
+    let reader = Connection::reader(&database.url, "trace_test")?;
+    let list_parameters = BTreeMap::from([
+        ("team_ids".into(), Parameter::Strings(vec!["team-1".into()])),
+        ("api_key_hash".into(), Parameter::Text(String::new())),
+        (
+            "start_ms".into(),
+            Parameter::Integer(timestamp / 1_000_000 - 1000),
+        ),
+        (
+            "end_ms".into(),
+            Parameter::Integer(timestamp / 1_000_000 + 1000),
+        ),
+        ("cursor_ms".into(), Parameter::Integer(0)),
+        ("cursor_trace_id".into(), Parameter::Text(String::new())),
+        ("limit".into(), Parameter::Integer(10)),
+    ]);
+    let listed: serde_json::Value = serde_json::from_str(
+        &execute_named_read(
+            &database.client,
+            &reader,
+            ReadQuery::ListTraces,
+            &list_parameters,
+        )
+        .await?,
+    )?;
+    assert_eq!(
+        listed["data"][0]["request_ids"],
+        serde_json::json!(["response-1"])
+    );
+    let spend_parameters = BTreeMap::from([
+        (
+            "response_ids".into(),
+            Parameter::Strings(vec!["response-1".into()]),
+        ),
+        ("team_ids".into(), Parameter::Strings(vec!["team-1".into()])),
+        ("api_key_hash".into(), Parameter::Text(String::new())),
+        (
+            "start_ms".into(),
+            Parameter::Integer(timestamp / 1_000_000 - 1000),
+        ),
+        (
+            "end_ms".into(),
+            Parameter::Integer(timestamp / 1_000_000 + 1000),
+        ),
+    ]);
+    let matched: serde_json::Value = serde_json::from_str(
+        &execute_named_read(
+            &database.client,
+            &reader,
+            ReadQuery::SpendByResponseIds,
+            &spend_parameters,
+        )
+        .await?,
+    )?;
+    assert_eq!(matched["data"][0]["spend"], 0.125);
     let body = read_json(
         &database,
         "SELECT o.TeamId, o.ApiKeyHash, o.ObservationType, o.InputPreview, s.spend, \
@@ -144,7 +200,7 @@ async fn schema_supports_span_rollups_and_spend_joins(
     let body = read_json(
         &database,
         "SELECT toUInt32(sum(SpanCount)) AS spans, toUInt32(sum(InputTokens)) AS tokens \
-         FROM trace_test.agent_traces WHERE TeamId = 'team-1' AND TraceId = 'trace-1'",
+         FROM trace_test.agent_traces_by_key WHERE TeamId = 'team-1' AND TraceId = 'trace-1'",
     )
     .await?;
     assert_eq!(
@@ -154,13 +210,129 @@ async fn schema_supports_span_rollups_and_spend_joins(
     Ok(())
 }
 
+#[rstest]
+#[tokio::test]
+async fn insert_rejects_unknown_columns_even_if_url_requests_skipping_them(
+    #[future(awt)] database: TestResult<ClickHouseDatabase>,
+) -> TestResult {
+    let database = database?;
+    let writer = Connection::writer(&format!(
+        "{}?input_format_skip_unknown_fields=1",
+        database.url
+    ))?;
+    ensure_schema(&database.client, &writer, "trace_test", 7, 14).await?;
+    let row = BTreeMap::from([
+        (
+            "Timestamp".to_owned(),
+            serde_json::json!(1_700_000_000_000_000_000_i64),
+        ),
+        (
+            "unexpected".to_owned(),
+            serde_json::json!("dropped silently"),
+        ),
+    ]);
+
+    assert!(matches!(
+        litellm_traces::insert_rows(
+            &database.client,
+            &writer,
+            "trace_test",
+            InsertTable::OtelTraces,
+            vec![row]
+        )
+        .await,
+        Err(Error::InsertFailed(_))
+    ));
+    assert_eq!(table_rows(&database, "otel_traces").await?, 0);
+    Ok(())
+}
+
+#[rstest]
+#[tokio::test]
+async fn retried_trace_insert_does_not_inflate_rollup(
+    #[future(awt)] database: TestResult<ClickHouseDatabase>,
+) -> TestResult {
+    let database = database?;
+    let writer = Connection::writer(&database.url)?;
+    ensure_schema(&database.client, &writer, "trace_test", 7, 14).await?;
+    let row: BTreeMap<String, serde_json::Value> = serde_json::from_value(serde_json::json!({
+        "Timestamp": time::OffsetDateTime::now_utc().unix_timestamp_nanos() as i64,
+        "TraceId": "retried-trace", "SpanId": "span-1", "ParentSpanId": "",
+        "TeamId": "team-1", "ApiKeyHash": "key-1", "SpanName": "root", "InputTokens": 7
+    }))?;
+    for _ in 0..2 {
+        litellm_traces::insert_rows(
+            &database.client,
+            &writer,
+            "trace_test",
+            InsertTable::OtelTraces,
+            vec![row.clone()],
+        )
+        .await?;
+    }
+    let counts = read_json(
+        &database,
+        "SELECT toUInt32(sum(SpanCount)) AS spans, toUInt32(sum(InputTokens)) AS tokens \
+         FROM trace_test.agent_traces_by_key WHERE TraceId = 'retried-trace'",
+    )
+    .await?;
+    assert_eq!(table_rows(&database, "otel_traces").await?, 1);
+    assert_eq!(counts["data"][0]["spans"], 1);
+    assert_eq!(counts["data"][0]["tokens"], 7);
+    Ok(())
+}
+
+#[rstest]
+#[tokio::test]
+async fn keyed_rollup_keeps_same_trace_ids_separate_by_api_key(
+    #[future(awt)] database: TestResult<ClickHouseDatabase>,
+) -> TestResult {
+    let database = database?;
+    let writer = Connection::writer(&database.url)?;
+    ensure_schema(&database.client, &writer, "trace_test", 7, 14).await?;
+    let timestamp = time::OffsetDateTime::now_utc().unix_timestamp_nanos() as i64;
+    let rows = vec![
+        serde_json::from_value(serde_json::json!({
+            "Timestamp": timestamp, "TraceId": "shared-id", "SpanId": "root-one",
+            "ParentSpanId": "", "SpanName": "root-one", "Input": "private-one",
+            "ResourceAttributes": {"litellm.api_key_hash": "key-one"}
+        }))?,
+        serde_json::from_value(serde_json::json!({
+            "Timestamp": timestamp, "TraceId": "shared-id", "SpanId": "root-two",
+            "ParentSpanId": "", "SpanName": "root-two", "Input": "private-two",
+            "ResourceAttributes": {"litellm.api_key_hash": "key-two"}
+        }))?,
+    ];
+    insert_rows(&database, "otel_traces", rows).await?;
+    execute_write(
+        &database,
+        "OPTIMIZE TABLE trace_test.agent_traces_by_key FINAL",
+    )
+    .await?;
+    let rows = read_json(
+        &database,
+        "SELECT ApiKeyHash, any(RootInput) AS RootInput \
+         FROM trace_test.agent_traces_by_key WHERE TraceId = 'shared-id' \
+         GROUP BY ApiKeyHash ORDER BY ApiKeyHash",
+    )
+    .await?;
+    assert_eq!(
+        rows["data"],
+        serde_json::json!([
+            {"ApiKeyHash": "key-one", "RootInput": "private-one"},
+            {"ApiKeyHash": "key-two", "RootInput": "private-two"}
+        ])
+    );
+    Ok(())
+}
+
 #[rstest]
 #[tokio::test]
 async fn rollup_merges_spans_across_days_without_losing_root_fields(
     #[future(awt)] database: TestResult<ClickHouseDatabase>,
 ) -> TestResult {
     let database = database?;
-    let writer = Connection::writer(&database.url, "default", "")?;
+    let writer = Connection::writer(&database.url)?;
     ensure_schema(&database.client, &writer, "trace_test", 7, 14).await?;
     let day_start = time::OffsetDateTime::now_utc()
         .replace_time(time::Time::MIDNIGHT)
@@ -179,12 +351,16 @@ async fn rollup_merges_spans_across_days_without_losing_root_fields(
         "ResourceAttributes": {"litellm.team_id": "team-1"}
     }))?;
     insert_rows(&database, "otel_traces", vec![child]).await?;
-    execute_write(&database, "OPTIMIZE TABLE trace_test.agent_traces FINAL").await?;
+    execute_write(
+        &database,
+        "OPTIMIZE TABLE trace_test.agent_traces_by_key FINAL",
+    )
+    .await?;
     let response = read_json(
         &database,
         "SELECT count() AS rows, any(RootName) AS RootName, any(RootInput) AS RootInput, \
          any(RootStatus) AS RootStatus, sum(SpanCount) AS SpanCount \
-         FROM trace_test.agent_traces",
+         FROM trace_test.agent_traces_by_key",
     )
     .await?;
     assert_eq!(
@@ -203,7 +379,7 @@ async fn spend_deduplication_preserves_subsecond_requests_and_retries(
     #[future(awt)] database: TestResult<ClickHouseDatabase>,
 ) -> TestResult {
     let database = database?;
-    let writer = Connection::writer(&database.url, "default", "")?;
+    let writer = Connection::writer(&database.url)?;
     ensure_schema(&database.client, &writer, "trace_test", 7, 14).await?;
     let now_ms = time::OffsetDateTime::now_utc().unix_timestamp_nanos() as i64 / 1_000_000;
     let base_start_time = now_ms / 1000 * 1000;
@@ -255,7 +431,7 @@ async fn retention_changes_materialize_existing_rows_and_remain_idempotent(
     #[future(awt)] database: TestResult<ClickHouseDatabase>,
 ) -> TestResult {
     let database = database?;
-    let writer = Connection::writer(&database.url, "default", "")?;
+    let writer = Connection::writer(&database.url)?;
     ensure_schema(&database.client, &writer, "trace_test", 30, 30).await?;
     let old_time = time::OffsetDateTime::now_utc() - time::Duration::days(20);
     let old_timestamp_ns = old_time.unix_timestamp_nanos() as i64;
@@ -271,6 +447,7 @@ async fn retention_changes_materialize_existing_rows_and_remain_idempotent(
     }))?;
     insert_rows(&database, "otel_traces", vec![span]).await?;
     insert_rows(&database, "spend_logs", vec![spend]).await?;
+    assert_eq!(table_rows(&database, "agent_traces_by_key").await?, 1);
     ensure_schema(&database.client, &writer, "trace_test", 14, 14).await?;
     let deadline = tokio::time::Instant::now() + Duration::from_secs(60);
     loop {
@@ -293,10 +470,14 @@ async fn retention_changes_materialize_existing_rows_and_remain_idempotent(
         tokio::time::sleep(Duration::from_millis(100)).await;
     }
     execute_write(&database, "OPTIMIZE TABLE trace_test.otel_traces FINAL").await?;
-    execute_write(&database, "OPTIMIZE TABLE trace_test.agent_traces FINAL").await?;
+    execute_write(
+        &database,
+        "OPTIMIZE TABLE trace_test.agent_traces_by_key FINAL",
+    )
+    .await?;
     execute_write(&database, "OPTIMIZE TABLE trace_test.spend_logs FINAL").await?;
     assert_eq!(table_rows(&database, "otel_traces").await?, 0);
-    assert_eq!(table_rows(&database, "agent_traces").await?, 0);
+    assert_eq!(table_rows(&database, "agent_traces_by_key").await?, 0);
     assert_eq!(table_rows(&database, "spend_logs").await?, 0);
     let mutation_count = mutation_rows(&database).await?;
     ensure_schema(&database.client, &writer, "trace_test", 14, 14).await?;
@@ -315,9 +496,9 @@ async fn schema_statement_timeout_maps_to_transport_error() -> TestResult {
     });
     let client = Client::no_redirect_for_test();
     let url = format!("http://{address}");
-    let writer = Connection::writer(&url, "default", "")?;
+    let writer = Connection::writer(&url)?;
     let result = tokio::time::timeout(
-        Duration::from_secs(12),
+        Duration::from_secs(35),
         ensure_schema(&client, &writer, "trace_test", 7, 14),
     )
     .await;
@@ -338,3 +519,148 @@ fn schema_rejects_invalid_configuration(
 ) {
     assert!(schema_statements(database, traces, spend).is_err());
 }
+
+#[rstest]
+#[tokio::test]
+async fn lens_filters_reads_and_evidence_keep_reused_trace_ids_separate(
+    #[future(awt)] database: TestResult<ClickHouseDatabase>,
+) -> TestResult {
+    use litellm_traces::{LensQuery, Parameter};
+    let database = database?;
+    let writer = Connection::writer(&database.url)?;
+    ensure_schema(&database.client, &writer, "trace_test", 7, 14).await?;
+    let timestamp = time::OffsetDateTime::now_utc().unix_timestamp_nanos() as i64;
+    for (key, text) in [("one", "timeout"), ("two", "success")] {
+        insert_rows(&database, "otel_traces", vec![serde_json::from_value(serde_json::json!({
+            "Timestamp": timestamp, "TraceId": "shared", "SpanId": "root", "ParentSpanId": "",
+            "ServiceName": "review", "SpanName": "release", "Input": text,
+            "ResourceAttributes": {"litellm.team_id": "team", "litellm.api_key_hash": key, "swarm": "release"}
+        }))?]).await?;
+    }
+    let connection = Connection::configured(&database.url, "trace_test", "default", "")?;
+    let parameters = BTreeMap::from([
+        ("source".into(), Parameter::Text("traces".into())),
+        ("all_teams".into(), Parameter::Integer(1)),
+        ("team".into(), Parameter::Text(String::new())),
+        ("key_hash".into(), Parameter::Text(String::new())),
+        (
+            "start".into(),
+            Parameter::Integer(timestamp / 1_000_000 - 1000),
+        ),
+        (
+            "end".into(),
+            Parameter::Integer(timestamp / 1_000_000 + 1000),
+        ),
+        ("service".into(), Parameter::Text("review".into())),
+        (
+            "filter_keys".into(),
+            Parameter::Strings(vec!["swarm".into()]),
+        ),
+        (
+            "filter_values".into(),
+            Parameter::Strings(vec!["release".into()]),
+        ),
+        ("limit".into(), Parameter::Integer(10)),
+    ]);
+    let sample: serde_json::Value = serde_json::from_str(
+        &execute_read(
+            &database.client,
+            &connection,
+            LensQuery::Sample.sql(),
+            &parameters,
+        )
+        .await?,
+    )?;
+    let rows = sample["data"].as_array().expect("sample rows");
+    assert_eq!(rows.len(), 2);
+    assert_ne!(rows[0]["trace_ref"], rows[1]["trace_ref"]);
+    let first_ref = rows[0]["trace_ref"].as_str().expect("reference");
+    let read_parameters: BTreeMap<_, _> = parameters
+        .into_iter()
+        .chain([
+            ("id".into(), Parameter::Text("shared".into())),
+            ("record_team".into(), Parameter::Text("team".into())),
+            ("trace_ref".into(), Parameter::Text(first_ref.into())),
+            ("cursor".into(), Parameter::Text(String::new())),
+            ("offset".into(), Parameter::Integer(1)),
+            ("span".into(), Parameter::Text("root".into())),
+        ])
+        .collect();
+    let content: serde_json::Value = serde_json::from_str(
+        &execute_read(
+            &database.client,
+            &connection,
+            LensQuery::Content.sql(),
+            &read_parameters,
+        )
+        .await?,
+    )?;
+    assert_eq!(content["data"].as_array().map(Vec::len), Some(1));
+    let text = content["data"][0]["content"].as_str().expect("content");
+    let opposite = if text.contains("timeout") {
+        "success"
+    } else {
+        "timeout"
+    };
+    let evidence_parameters = read_parameters
+        .into_iter()
+        .chain([("quote".into(), Parameter::Text(opposite.into()))])
+        .collect();
+    let evidence: serde_json::Value = serde_json::from_str(
+        &execute_read(
+            &database.client,
+            &connection,
+            LensQuery::Evidence.sql(),
+            &evidence_parameters,
+        )
+        .await?,
+    )?;
+    assert_eq!(evidence["data"][0]["count"], 0);
+    Ok(())
+}
+
+#[rstest]
+#[tokio::test]
+async fn lens_request_sample_does_not_trust_caller_tags(
+    #[future(awt)] database: TestResult<ClickHouseDatabase>,
+) -> TestResult {
+    use litellm_traces::{LensQuery, Parameter};
+    let database = database?;
+    let writer = Connection::writer(&database.url)?;
+    ensure_schema(&database.client, &writer, "trace_test", 7, 14).await?;
+    let timestamp = time::OffsetDateTime::now_utc().unix_timestamp_nanos() as i64 / 1_000_000;
+    for (id, internal) in [("external", false), ("internal", true)] {
+        let row = serde_json::from_value(serde_json::json!({
+            "request_id": id, "team_id": "team", "start_time": timestamp, "end_time": timestamp,
+            "request_tags": ["litellm-engine"],
+            "metadata": serde_json::json!({"litellm_lens_internal": internal}).to_string()
+        }))?;
+        insert_rows(&database, "spend_logs", vec![row]).await?;
+    }
+    let connection = Connection::configured(&database.url, "trace_test", "default", "")?;
+    let parameters = BTreeMap::from([
+        ("source".into(), Parameter::Text("requests".into())),
+        ("all_teams".into(), Parameter::Integer(1)),
+        ("team".into(), Parameter::Text(String::new())),
+        ("key_hash".into(), Parameter::Text(String::new())),
+        ("start".into(), Parameter::Integer(timestamp - 1000)),
+        ("end".into(), Parameter::Integer(timestamp + 60000)),
+        ("service".into(), Parameter::Text(String::new())),
+        ("filter_keys".into(), Parameter::Strings(vec![])),
+        ("filter_values".into(), Parameter::Strings(vec![])),
+        ("limit".into(), Parameter::Integer(10)),
+    ]);
+    let sample: serde_json::Value = serde_json::from_str(
+        &execute_read(
+            &database.client,
+            &connection,
+            LensQuery::Sample.sql(),
+            &parameters,
+        )
+        .await?,
+    )?;
+    let rows = sample["data"].as_array().expect("sample rows");
+    assert_eq!(rows.len(), 1);
+    assert_eq!(rows[0]["trace_id"], "external");
+    Ok(())
+}

litellm-rust/crates/traces/tests/otlp.rs

@@ -0,0 +1,47 @@
+use flate2::{Compression, write::GzEncoder};
+use litellm_traces::decode_otlp;
+use rstest::rstest;
+use std::io::Write;
+
+const FIXTURE: &[u8] = include_bytes!(
+    "../../../../tests/test_litellm/tracing/fixtures/langsmith_deep_agent_export.json"
+);
+
+#[rstest]
+#[case::json(FIXTURE, Some("application/json"), None)]
+#[case::gzip_json(FIXTURE, Some("application/json"), Some("gzip"))]
+fn decodes_neutral_spans(
+    #[case] body: &[u8],
+    #[case] content_type: Option<&str>,
+    #[case] content_encoding: Option<&str>,
+) {
+    let payload = if content_encoding == Some("gzip") {
+        let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
+        encoder.write_all(body).expect("gzip input");
+        encoder.finish().expect("gzip payload")
+    } else {
+        body.to_vec()
+    };
+    let spans = decode_otlp(&payload, content_type, content_encoding, 8 * 1024 * 1024)
+        .expect("valid OTLP export");
+    assert_eq!(spans.len(), 6);
+    assert_eq!(spans[0].trace_id, "4bad42b84e9de3ba46fc870185f8f023");
+    assert_eq!(spans[0].resource_attributes["service.name"], "agent-demo");
+    assert_eq!(spans[0].scope_name, "langsmith");
+    assert!(
+        spans
+            .iter()
+            .any(|span| span.attributes.contains_key("gen_ai.prompt"))
+    );
+}
+
+#[rstest]
+#[case::invalid(b"not protobuf", None, 8 * 1024 * 1024)]
+#[case::too_large(FIXTURE, Some("application/json"), 1)]
+fn rejects_invalid_or_oversized_payload(
+    #[case] body: &[u8],
+    #[case] content_type: Option<&str>,
+    #[case] limit: usize,
+) {
+    assert!(decode_otlp(body, content_type, None, limit).is_err());
+}

litellm/__init__.py

@@ -157,6 +157,7 @@ _custom_logger_compatible_callbacks_literal = Literal[
     "smtp_email",
     "deepeval",
     "s3_v2",
+    "clickhouse",
     "pointfive",
     "zerobus",
     "aws_sqs",

litellm/anthropic_beta_headers_config.json

@@ -49,7 +49,7 @@
     "computer-use-2025-11-24": "computer-use-2025-11-24",
     "context-1m-2025-08-07": "context-1m-2025-08-07",
     "context-management-2025-06-27": "context-management-2025-06-27",
-    "dangerous-tool-use-2026-09-03": null,
+    "dangerous-tool-use-2026-09-03": "dangerous-tool-use-2026-09-03",
     "effort-2025-11-24": "effort-2025-11-24",
     "fast-mode-2026-02-01": null,
     "files-api-2025-04-14": "files-api-2025-04-14",

litellm/constants.py

@@ -46,6 +46,19 @@ ROUTER_SETTINGS_MANAGED_OUTSIDE_CONFIG: Final[frozenset[str]] = frozenset(
 )
 DEFAULT_BATCH_SIZE: Final = int(os.getenv("DEFAULT_BATCH_SIZE", 512))
 DEFAULT_FLUSH_INTERVAL_SECONDS: Final = int(os.getenv("DEFAULT_FLUSH_INTERVAL_SECONDS", 5))
+# Agent tracing / ClickHouse
+CLICKHOUSE_BATCH_SIZE: Final = get_env_int("CLICKHOUSE_BATCH_SIZE", 10_000)
+CLICKHOUSE_FLUSH_INTERVAL_SECONDS: Final = float(os.getenv("CLICKHOUSE_FLUSH_INTERVAL_SECONDS", "1.0"))
+CLICKHOUSE_MAX_BUFFERED_ROWS: Final = get_env_int("CLICKHOUSE_MAX_BUFFERED_ROWS", 200_000)
+CLICKHOUSE_MAX_RETRIES: Final = get_env_int("CLICKHOUSE_MAX_RETRIES", 3)
+AGENT_TRACING_RETENTION_DAYS: Final = get_env_int("AGENT_TRACING_RETENTION_DAYS", 30)
+AGENT_TRACING_SPEND_LOG_RETENTION_DAYS: Final = get_env_int("AGENT_TRACING_SPEND_LOG_RETENTION_DAYS", 90)
+OTLP_MAX_BODY_BYTES: Final = get_env_int("OTLP_MAX_BODY_BYTES", 8 * 1024 * 1024)
+OTLP_MAX_ATTRIBUTE_VALUE_BYTES: Final = get_env_int("OTLP_MAX_ATTRIBUTE_VALUE_BYTES", 64 * 1024)
+OTLP_RETRY_AFTER_SECONDS: Final = get_env_int("OTLP_RETRY_AFTER_SECONDS", 2)
+OTLP_OFFLOAD_DECODE_BYTES: Final = get_env_int("OTLP_OFFLOAD_DECODE_BYTES", 256 * 1024)
+AGENT_TRACING_INPUT_PREVIEW_CHARS: Final = get_env_int("AGENT_TRACING_INPUT_PREVIEW_CHARS", 240)
+AGENT_TRACING_LIST_PAGE_SIZE: Final = get_env_int("AGENT_TRACING_LIST_PAGE_SIZE", 50)
 DEFAULT_S3_FLUSH_INTERVAL_SECONDS: Final = int(os.getenv("DEFAULT_S3_FLUSH_INTERVAL_SECONDS", 10))
 DEFAULT_S3_BATCH_SIZE: Final = int(os.getenv("DEFAULT_S3_BATCH_SIZE", 512))
 DEFAULT_S3_MAX_CONCURRENT_UPLOADS: Final = int(os.getenv("DEFAULT_S3_MAX_CONCURRENT_UPLOADS", "16"))

litellm/integrations/azure_storage/azure_storage.py

@@ -30,6 +30,14 @@ from litellm.types.secret_managers.get_azure_ad_token_provider import (
 from litellm.types.utils import StandardLoggingPayload
 
 AZURE_STORAGE_TOKEN_SCOPE: Final = "https://storage.azure.com/.default"
+_ADLS_SAFE_NAME: Final = str.maketrans("/", "_", "=")
+
+
+def adls_safe_file_name(payload_id: str | None) -> str:
+    """`=` padding and `/` in a base64 payload id are what the Data Lake service rejects, so the name drops the
+    padding and maps `/` to `_`. Standard base64 has no `_` and its padding is fixed by the length, so ids from
+    that alphabet stay distinct; anything else is left as is."""
+    return f"{(payload_id or str(uuid.uuid4())).translate(_ADLS_SAFE_NAME)}.json"
 
 
 @cache
@@ -46,6 +54,7 @@ class AzureBlobStorageLogger(CustomBatchLogger):
         build_credential_chain_token_provider: Callable[
             [], Callable[[], str]
         ] = _cached_credential_chain_token_provider,
+        clock: Callable[[], float] = time.time,
         **kwargs,
     ):
         try:
@@ -69,6 +78,7 @@ class AzureBlobStorageLogger(CustomBatchLogger):
             self.azure_storage_endpoint_suffix: str = (
                 os.getenv("AZURE_STORAGE_ENDPOINT_SUFFIX") or AZURE_STORAGE_DEFAULT_ENDPOINT_SUFFIX
             )
+            self._clock: Callable[[], float] = clock
             self._service_client = None
             # Time that the azure service client expires, in order to reset the connection pool and keep it fresh
             self._service_client_timeout: float | None = None
@@ -182,7 +192,7 @@ class AzureBlobStorageLogger(CustomBatchLogger):
                 async_client: Final = get_async_httpx_client(llm_provider=httpxSpecialProvider.LoggingCallback)
                 json_payload: Final = safe_dumps(payload) + "\n"  # Add newline for each log entry
                 payload_bytes: Final = json_payload.encode("utf-8")
-                filename: Final = f"{payload.get('id') or str(uuid.uuid4())}.json"
+                filename: Final = adls_safe_file_name(payload.get("id"))
                 base_url = f"{self.azure_storage_dfs_endpoint}/{self.azure_storage_file_system}/{filename}"
 
                 # Execute the 3-step upload process
@@ -331,7 +341,7 @@ class AzureBlobStorageLogger(CustomBatchLogger):
         from azure.storage.filedatalake.aio import DataLakeServiceClient
 
         # expire old clients to recover from connection issues
-        if self._service_client_timeout and self._service_client and self._service_client_timeout > time.time():
+        if self._service_client_timeout and self._service_client and self._service_client_timeout <= self._clock():
             await self._service_client.close()
             self._service_client = None
         if not self._service_client:
@@ -339,7 +349,7 @@ class AzureBlobStorageLogger(CustomBatchLogger):
                 account_url=self.azure_storage_dfs_endpoint,
                 credential=self.azure_storage_account_key,
             )
-            self._service_client_timeout = time.time() + _DEFAULT_TTL_FOR_HTTPX_CLIENTS
+            self._service_client_timeout = self._clock() + _DEFAULT_TTL_FOR_HTTPX_CLIENTS
         return self._service_client
 
     async def upload_to_azure_data_lake_with_azure_account_key(self, payload: StandardLoggingPayload):
@@ -368,7 +378,7 @@ class AzureBlobStorageLogger(CustomBatchLogger):
                 verbose_logger.debug("Created directory: %s", today)
 
             # Create a file client
-            file_name: Final = f"{payload.get('id') or str(uuid.uuid4())}.json"
+            file_name: Final = adls_safe_file_name(payload.get("id"))
             file_client: Final = directory_client.get_file_client(file_name)
 
             # Create the file

litellm/integrations/clickhouse/clickhouse_batch_logger.py

@@ -0,0 +1,100 @@
+"""
+Shared base for everything LiteLLM writes to ClickHouse.
+
+Built on `CustomBatchLogger`: rows accumulate in `log_queue` and are flushed as one
+gzip JSONEachRow insert, either every `CLICKHOUSE_FLUSH_INTERVAL_SECONDS` or as soon as
+`batch_size` rows are queued. Subclasses only pick the table and build rows:
+
+- `ClickHouseSpendLogger`  -> spend_logs   (LiteLLM requests when tracing is enabled)
+"""
+
+import asyncio
+import os
+from collections.abc import Mapping, Sequence
+from typing import Any, ClassVar
+
+from litellm._logging import verbose_logger
+from litellm.constants import (
+    CLICKHOUSE_BATCH_SIZE,
+    CLICKHOUSE_FLUSH_INTERVAL_SECONDS,
+    CLICKHOUSE_MAX_BUFFERED_ROWS,
+    CLICKHOUSE_MAX_RETRIES,
+)
+from litellm.integrations.custom_batch_logger import CustomBatchLogger
+from litellm.rust_bridge.traces import TraceStorage
+
+
+def clickhouse_storage_from_env() -> TraceStorage:
+    return TraceStorage(
+        database=os.getenv("CLICKHOUSE_DATABASE", "litellm"),
+        url=os.getenv("CLICKHOUSE_URL", ""),
+    )
+
+
+class ClickHouseBatchLogger(CustomBatchLogger):
+    table: ClassVar[str]
+
+    def __init__(self, storage: TraceStorage | None = None) -> None:
+        self.storage = storage or clickhouse_storage_from_env()
+        self.rows_written = 0
+        self.rows_dropped = 0
+        self._failed_attempts = 0
+        super().__init__(
+            flush_lock=asyncio.Lock(),
+            batch_size=CLICKHOUSE_BATCH_SIZE,
+            flush_interval=CLICKHOUSE_FLUSH_INTERVAL_SECONDS,
+        )
+        self._flush_task: asyncio.Task[None] | None = None
+
+    def start(self) -> None:
+        if self._flush_task is None or self._flush_task.done():
+            self._flush_task = asyncio.get_running_loop().create_task(self.periodic_flush())
+
+    def is_full(self) -> bool:
+        """Backpressure signal: producers should reject (429) instead of enqueueing."""
+        return len(self.log_queue) >= CLICKHOUSE_MAX_BUFFERED_ROWS
+
+    def enqueue(self, rows: Sequence[Mapping[str, object]]) -> None:
+        """Never awaits ClickHouse. Kicks off an early flush once a full batch is queued."""
+        self.start()
+        self.log_queue.extend(rows)
+        if len(self.log_queue) >= self.batch_size:
+            asyncio.get_running_loop().create_task(self.flush_queue())
+
+    async def flush_queue(self) -> None:
+        # Swap the queue under the lock so rows enqueued during the insert are kept.
+        if self.flush_lock is None:
+            return
+        async with self.flush_lock:
+            while self.log_queue:
+                batch = self.log_queue[: self.batch_size]
+                self.log_queue = self.log_queue[len(batch) :]
+                if not await self._insert(batch):
+                    break
+
+    async def async_send_batch(self) -> None:
+        await self.flush_queue()
+
+    async def _insert(self, batch: list[dict[str, Any]]) -> bool:
+        try:
+            await self.storage.insert_rows(self.table, batch)
+            self.rows_written += len(batch)
+            self._failed_attempts = 0
+            return True
+        except Exception as e:
+            self._failed_attempts += 1
+            if self._failed_attempts >= CLICKHOUSE_MAX_RETRIES:
+                self.rows_dropped += len(batch)
+                self._failed_attempts = 0
+                verbose_logger.error(
+                    "ClickHouse: dropped %s rows for %s after %s attempts: %s",
+                    len(batch),
+                    self.table,
+                    CLICKHOUSE_MAX_RETRIES,
+                    e,
+                )
+            else:
+                # put it back; the next periodic flush retries it
+                self.log_queue = batch + self.log_queue
+                verbose_logger.warning("ClickHouse: insert into %s failed, will retry: %s", self.table, e)
+            return False

litellm/integrations/clickhouse/clickhouse_spend_logger.py

@@ -0,0 +1,170 @@
+"""
+`clickhouse` logging callback: one `spend_logs` row per LiteLLM request.
+
+Agent LLM spans join to these rows on `otel_traces.LiteLLMRequestId = spend_logs.response_id`,
+so `response_id` is always the raw provider response id (cache-hit suffix stripped).
+"""
+
+import json
+import re
+from collections.abc import Mapping
+from types import MappingProxyType
+from typing import Any, Final
+
+import litellm
+from litellm._logging import verbose_logger
+from litellm.integrations.clickhouse.clickhouse_batch_logger import ClickHouseBatchLogger
+from litellm.integrations.clickhouse.context import is_lens_analysis
+from litellm.integrations.clickhouse.schema import SPEND_LOGS_TABLE
+from litellm.tracing.types import SpendLogRecord
+from litellm.types.utils import StandardLoggingPayload
+
+# litellm_logging.py rewrites cache-hit ids as f"{id}_cache_hit{time.time()}"
+MILLISECONDS_PER_SECOND: Final = 1000
+_CACHE_HIT_SUFFIX: Final = re.compile(r"_cache_hit[0-9.]*$")
+# W3C trace context: version-traceid-parentid-flags
+_TRACEPARENT: Final = re.compile(r"^[0-9a-f]{2}-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$")
+_INVALID_TRACE_ID: Final = "0" * 32
+_INVALID_SPAN_ID: Final = "0" * 16
+TRACE_INGEST_ROUTE: Final = "/v1/traces"
+
+
+def strip_cache_hit_suffix(request_id: str) -> str:
+    return _CACHE_HIT_SUFFIX.sub("", request_id)
+
+
+def parse_traceparent(value: object) -> tuple[str, str]:
+    """(trace_id, span_id) from a W3C `traceparent` header, or ("", "") if absent/invalid."""
+    if not isinstance(value, str):
+        return "", ""
+    match = _TRACEPARENT.match(value.strip().lower())
+    if match is None or match.group(1) == _INVALID_TRACE_ID or match.group(2) == _INVALID_SPAN_ID:
+        return "", ""
+    return match.group(1), match.group(2)
+
+
+def _to_ms(seconds: object) -> int | None:
+    return int(float(seconds) * MILLISECONDS_PER_SECOND) if isinstance(seconds, (int, float)) else None
+
+
+def _int(value: object) -> int:
+    return value if isinstance(value, int) and not isinstance(value, bool) else 0
+
+
+def _json(value: object) -> str:
+    if value is None or value == "":
+        return ""
+    return value if isinstance(value, str) else json.dumps(value, default=str)
+
+
+def _json_mapping(value: Mapping[str, Any]) -> str:
+    return _json(dict(value))  # mutable-ok: [LIT002] JSON serialization requires a dict
+
+
+def _find_traceparent(metadata: Mapping[str, Any], kwargs: Mapping[str, Any]) -> tuple[str, str]:
+    custom_headers = metadata.get("requester_custom_headers") or MappingProxyType({})
+    proxy_request = (kwargs.get("litellm_params") or MappingProxyType({})).get(
+        "proxy_server_request"
+    ) or MappingProxyType({})
+    request_headers = proxy_request.get("headers") or MappingProxyType({})
+    for headers in (custom_headers, request_headers):
+        for name, value in headers.items():
+            if str(name).lower() == "traceparent":
+                return parse_traceparent(value)
+    return "", ""
+
+
+def _cache_tokens(usage: Mapping[str, Any]) -> tuple[int, int]:
+    """(cache_read, cache_write) from a Usage dict: OpenAI prompt_tokens_details first, Anthropic fields as fallback."""
+    details = usage.get("prompt_tokens_details") or MappingProxyType({})
+    cache_read = _int(details.get("cached_tokens")) or _int(usage.get("cache_read_input_tokens"))
+    cache_write = (
+        _int(details.get("cache_write_tokens"))
+        or _int(details.get("cache_creation_tokens"))
+        or _int(usage.get("cache_creation_input_tokens"))
+    )
+    return cache_read, cache_write
+
+
+def _request_tags(value: object) -> list[str]:
+    if not isinstance(value, list):
+        return []  # mutable-ok: [LIT002] empty spend-log tag payload
+    return [str(tag) for tag in value]  # mutable-ok: [LIT002] SpendLogRecord schema
+
+
+def _session_id(payload: StandardLoggingPayload, kwargs: Mapping[str, Any]) -> str:
+    """Mirrors proxy `_get_session_id_for_spend_log`: explicit session id, else the payload trace id."""
+    request_metadata = (kwargs.get("litellm_params") or MappingProxyType({})).get("metadata") or MappingProxyType({})
+    return str(payload.get("session_id") or request_metadata.get("session_id") or payload.get("trace_id") or "")
+
+
+def _is_trace_ingest(payload: StandardLoggingPayload) -> bool:
+    """OTLP exports to POST /v1/traces are not LLM requests; don't write them as spend rows."""
+    return str(payload.get("call_type") or "").startswith(TRACE_INGEST_ROUTE)
+
+
+def spend_log_row_from_payload(payload: StandardLoggingPayload, kwargs: Mapping[str, Any]) -> SpendLogRecord:
+    metadata: Mapping[str, Any] = payload.get("metadata") or MappingProxyType({})
+    hidden_params: Mapping[str, Any] = payload.get("hidden_params") or MappingProxyType({})
+    usage: Mapping[str, Any] = metadata.get("usage_object") or hidden_params.get("usage_object") or MappingProxyType({})
+    cache_read_tokens, cache_write_tokens = _cache_tokens(usage)
+    trace_id, span_id = _find_traceparent(metadata, kwargs)
+    request_id = str(payload.get("id") or "")
+    redact = litellm.turn_off_message_logging is True
+    completion_start_ms = _to_ms(payload.get("completionStartTime"))
+    return SpendLogRecord(
+        request_id=request_id,
+        response_id=strip_cache_hit_suffix(request_id),
+        call_type=payload.get("call_type") or "",
+        api_key=metadata.get("user_api_key_hash") or "",
+        key_alias=metadata.get("user_api_key_alias") or "",
+        team_id=metadata.get("user_api_key_team_id") or metadata.get("team_id") or "",
+        team_alias=metadata.get("user_api_key_team_alias") or metadata.get("team_alias") or "",
+        organization_id=metadata.get("user_api_key_org_id") or "",
+        user=metadata.get("user_api_key_user_id") or "",
+        end_user=payload.get("end_user") or metadata.get("user_api_key_end_user_id") or "",
+        model=payload.get("model") or "",
+        model_group=payload.get("model_group") or "",
+        model_id=payload.get("model_id") or "",
+        custom_llm_provider=payload.get("custom_llm_provider") or "",
+        api_base=payload.get("api_base") or "",
+        spend=float(payload.get("response_cost") or 0.0),
+        prompt_tokens=_int(payload.get("prompt_tokens")),
+        completion_tokens=_int(payload.get("completion_tokens")),
+        total_tokens=_int(payload.get("total_tokens")),
+        cache_read_tokens=cache_read_tokens,
+        cache_write_tokens=cache_write_tokens,
+        start_time=_to_ms(payload.get("startTime")) or 0,
+        end_time=_to_ms(payload.get("endTime")) or 0,
+        completion_start_time=completion_start_ms or None,
+        status=payload.get("status") or "",
+        error_str=payload.get("error_str") or "",
+        cache_hit=payload.get("cache_hit") is True,
+        session_id=_session_id(payload, kwargs),
+        trace_id=trace_id,
+        span_id=span_id,
+        request_tags=_request_tags(payload.get("request_tags")),
+        metadata=_json_mapping(MappingProxyType({**metadata, "litellm_lens_internal": is_lens_analysis()})),
+        messages="" if redact else _json(payload.get("messages")),
+        response="" if redact else _json(payload.get("response")),
+    )
+
+
+class ClickHouseSpendLogger(ClickHouseBatchLogger):
+    table = SPEND_LOGS_TABLE
+
+    async def async_log_success_event(self, kwargs, response_obj, start_time, end_time) -> None:
+        self._log(kwargs)
+
+    async def async_log_failure_event(self, kwargs, response_obj, start_time, end_time) -> None:
+        self._log(kwargs)
+
+    def _log(self, kwargs: Mapping[str, Any]) -> None:
+        try:
+            payload = kwargs.get("standard_logging_object")
+            if payload is None or _is_trace_ingest(payload):
+                return
+            row: Final = spend_log_row_from_payload(payload, kwargs)
+            self.enqueue([dict(row)])  # mutable-ok: [LIT002] batch logger API
+        except Exception as e:
+            verbose_logger.exception("ClickHouseSpendLogger: failed to log request: %s", e)

litellm/integrations/clickhouse/context.py

@@ -0,0 +1,19 @@
+from collections.abc import Iterator
+from contextlib import contextmanager
+from contextvars import ContextVar
+from typing import Final
+
+_lens_analysis: Final = ContextVar("litellm_lens_analysis", default=False)
+
+
+def is_lens_analysis() -> bool:
+    return _lens_analysis.get()
+
+
+@contextmanager
+def lens_analysis() -> Iterator[None]:
+    token: Final = _lens_analysis.set(True)
+    try:
+        yield
+    finally:
+        _lens_analysis.reset(token)

litellm/integrations/clickhouse/schema.py

@@ -0,0 +1,11 @@
+from typing import Final
+
+from litellm.rust_bridge.traces import TraceStorage
+
+OTEL_TRACES_TABLE: Final = "otel_traces"
+AGENT_TRACES_BY_KEY_TABLE: Final = "agent_traces_by_key"
+SPEND_LOGS_TABLE: Final = "spend_logs"
+
+
+async def ensure_schema(storage: TraceStorage, trace_retention_days: int, spend_log_retention_days: int) -> None:
+    await storage.ensure_schema(trace_retention_days, spend_log_retention_days)

litellm/integrations/custom_batch_logger.py

@@ -27,7 +27,7 @@ class CustomBatchLogger(CustomLogger):
         self,
         flush_lock: asyncio.Lock | None = None,
         batch_size: int | None = None,
-        flush_interval: int | None = None,
+        flush_interval: float | None = None,
         max_queue_size: int | None = None,
         **kwargs,
     ) -> None:

litellm/litellm_core_utils/core_helpers.py

@@ -339,6 +339,13 @@ def get_or_create_metadata_bucket(
     return metadata_key, metadata_bucket
 
 
+def proxy_stamped_used_client_oauth_token(metadata: object, litellm_params: Mapping[str, object] | None) -> object:
+    litellm_metadata: Final = litellm_params.get("litellm_metadata") if litellm_params is not None else None
+    if isinstance(litellm_metadata, Mapping) and "used_client_oauth_token" in litellm_metadata:
+        return litellm_metadata["used_client_oauth_token"]
+    return metadata.get("used_client_oauth_token") if isinstance(metadata, Mapping) else None
+
+
 def get_litellm_metadata_from_kwargs(kwargs: dict):
     """
     Helper to get litellm metadata from all litellm request kwargs

litellm/litellm_core_utils/litellm_logging.py

@@ -76,6 +76,7 @@ from litellm.litellm_core_utils.classifier_logging import (
 from litellm.litellm_core_utils.core_helpers import (
     get_provider_response_headers_from_hidden_params,
     is_expected_client_error,
+    proxy_stamped_used_client_oauth_token,
     reconstruct_model_name,
     set_response_cost_in_hidden_params,
 )
@@ -184,6 +185,7 @@ from ..integrations.arize.arize_phoenix import ArizePhoenixLogger
 from ..integrations.athina import AthinaLogger
 from ..integrations.azure_sentinel.azure_sentinel import AzureSentinelLogger
 from ..integrations.azure_storage.azure_storage import AzureBlobStorageLogger
+from ..integrations.clickhouse.clickhouse_spend_logger import ClickHouseSpendLogger
 from ..integrations.custom_prompt_management import CustomPromptManagement
 from ..integrations.datadog.datadog import DataDogLogger
 from ..integrations.datadog.datadog_llm_obs import DataDogLLMObsLogger
@@ -287,7 +289,10 @@ else:
     _PAGERDUTY_ALERTING_FACTORY: Final = PagerDutyAlerting
 _in_memory_loggers: Final[list[CustomLogger]] = []
 
-_STANDARD_LOGGING_METADATA_KEYS: Final[frozenset[str]] = frozenset(StandardLoggingMetadata.__annotations__.keys())
+_STANDARD_LOGGING_METADATA_RESOLVED_KEYS: Final[frozenset[str]] = frozenset(("used_client_oauth_token",))
+_STANDARD_LOGGING_METADATA_KEYS: Final[frozenset[str]] = (
+    frozenset(StandardLoggingMetadata.__annotations__.keys()) - _STANDARD_LOGGING_METADATA_RESOLVED_KEYS
+)
 
 
 def _get_provider_request_id(original_exception: Exception) -> str | None:
@@ -4662,6 +4667,14 @@ def _init_custom_logger_compatible_class(
             _s3_v2_logger: Final = S3V2Logger()
             _in_memory_loggers.append(_s3_v2_logger)
             return _s3_v2_logger
+        elif logging_integration == "clickhouse":
+            for callback in _in_memory_loggers:
+                if isinstance(callback, ClickHouseSpendLogger):
+                    return callback
+
+            _clickhouse_spend_logger: Final = ClickHouseSpendLogger()
+            _in_memory_loggers.append(_clickhouse_spend_logger)
+            return _clickhouse_spend_logger
         elif logging_integration == "pointfive":
             for callback in _in_memory_loggers:
                 if isinstance(callback, PointFiveLogger):
@@ -5398,6 +5411,10 @@ def get_custom_logger_compatible_class(
             for callback in _in_memory_loggers:
                 if isinstance(callback, S3V2Logger):
                     return callback
+        elif logging_integration == "clickhouse":
+            for callback in _in_memory_loggers:
+                if isinstance(callback, ClickHouseSpendLogger):
+                    return callback
         elif logging_integration == "pointfive":
             for callback in _in_memory_loggers:
                 if isinstance(callback, PointFiveLogger):
@@ -5741,6 +5758,7 @@ class StandardLoggingPayloadSetup:
         proxy_server_request: dict | None = None,
         start_time: dt_object | None = None,
         response_id: str | None = None,
+        custom_llm_provider: str | None = None,
     ) -> StandardLoggingMetadata:
         """
         Clean and filter the metadata dictionary to include only the specified keys in StandardLoggingMetadata.
@@ -5755,6 +5773,9 @@ class StandardLoggingPayloadSetup:
             - If the input metadata is None or not a dictionary, an empty StandardLoggingMetadata object is returned.
             - If 'user_api_key' is present in metadata and is a valid SHA256 hash, it's stored as 'user_api_key_hash'.
         """
+        from litellm.llms.anthropic.common_utils import (  # noqa: PLC0415  # that module imports this one transitively
+            resolve_used_client_oauth_token,
+        )
 
         prompt_management_metadata: StandardLoggingPromptManagementMetadata | None = None
         if litellm_params is not None:
@@ -5804,6 +5825,10 @@ class StandardLoggingPayloadSetup:
             user_api_key_auth_metadata=None,
             team_alias=None,
             team_id=None,
+            used_client_oauth_token=resolve_used_client_oauth_token(
+                proxy_stamped_used_client_oauth_token(metadata, litellm_params),
+                custom_llm_provider,
+            ),
         )
         if isinstance(metadata, dict):
             for key in metadata.keys() & _STANDARD_LOGGING_METADATA_KEYS:
@@ -6532,6 +6557,7 @@ def get_standard_logging_object_payload(
             stream=kwargs.get("stream", False),
         )
         # clean up litellm metadata
+        selected_provider: Final = kwargs.get("custom_llm_provider")
         clean_metadata: Final = StandardLoggingPayloadSetup.get_standard_logging_metadata(
             metadata=metadata,
             litellm_params=litellm_params,
@@ -6543,6 +6569,7 @@ def get_standard_logging_object_payload(
             proxy_server_request=proxy_server_request,
             start_time=start_time,
             response_id=id,
+            custom_llm_provider=selected_provider if isinstance(selected_provider, str) else None,
         )
         _request_body: Final = proxy_server_request.get("body", {})
         end_user_id: Final = clean_metadata["user_api_key_end_user_id"] or _request_body.get(
@@ -6817,6 +6844,7 @@ def get_standard_logging_metadata(
         user_api_key_auth_metadata=None,
         team_alias=None,
         team_id=None,
+        used_client_oauth_token=None,
     )
     if isinstance(metadata, dict):
         # Update the clean_metadata with values from input metadata that match StandardLoggingMetadata fields

litellm/litellm_core_utils/llm_cost_calc/utils.py

@@ -76,6 +76,9 @@ _SERVICE_TIER_TO_COST_KEY_SUFFIX: Final[Mapping[str, str]] = MappingProxyType(
         ServiceTier.ULTRAFAST.value: ServiceTier.ULTRAFAST.value,
     }
 )
+SERVICE_TIER_COST_KEY_SUFFIXES: Final[tuple[str, ...]] = tuple(
+    sorted(frozenset(f"_{suffix}" for suffix in _SERVICE_TIER_TO_COST_KEY_SUFFIX.values()))
+)
 
 _INCLUSIVE_THRESHOLD_PROVIDERS: Final = frozenset({"xai"})
 _BATCH_KEY_SUFFIX: Final = "_batches"
@@ -663,13 +666,15 @@ def _get_token_base_cost(
 
     ## CHECK IF ABOVE THRESHOLD
     # Optimization: collect threshold keys first to avoid sorting all model_info keys.
-    # Exclude service_tier-specific variants (e.g. input_cost_per_token_above_200k_tokens_priority)
-    # so that the threshold detection loop only processes standard keys.  The
-    # service_tier-specific above-threshold key is resolved later via _get_service_tier_cost_key.
+    # Standard thresholds and thresholds suffixed for this request's service tier both count.
+    tier_key_suffix: Final = _get_service_tier_cost_key("", service_tier)
     threshold_keys: Final = [
         k
         for k in model_info
-        if k.startswith("input_cost_per_token_above_") and not k.endswith(_NON_STANDARD_THRESHOLD_SUFFIXES)
+        if k.startswith("input_cost_per_token_above_")
+        and (
+            not k.endswith(_NON_STANDARD_THRESHOLD_SUFFIXES) or (tier_key_suffix != "" and k.endswith(tier_key_suffix))
+        )
     ]
 
     # Only sort the threshold keys (typically 1-2 keys instead of 66+)

litellm/litellm_core_utils/llm_response_utils/get_api_base.py

@@ -59,6 +59,10 @@ def get_api_base(model: str, optional_params: dict | LiteLLM_Params) -> str | No
 
     if _optional_params.api_base is not None:
         return _optional_params.api_base
+    extra_params: Final = _optional_params.model_extra
+    base_url_alias: Final = extra_params.get("base_url") if extra_params is not None else None
+    if isinstance(base_url_alias, str) and base_url_alias:
+        return base_url_alias
 
     if litellm.model_alias_map and model in litellm.model_alias_map:
         model = litellm.model_alias_map[model]

litellm/llms/anthropic/common_utils.py

@@ -40,6 +40,7 @@ from litellm.types.llms.anthropic import (
 )
 from litellm.types.llms.openai import AllMessageValues
 from litellm.types.proxy.model_listing import ModelInfoResponse
+from litellm.types.utils import LlmProviders
 
 _MessageT = TypeVar("_MessageT")
 
@@ -226,6 +227,15 @@ def is_anthropic_oauth_key(value: str | None) -> bool:
     return value.startswith(ANTHROPIC_OAUTH_TOKEN_PREFIX)
 
 
+ANTHROPIC_OAUTH_FORWARD_PROVIDERS: Final[frozenset[str]] = frozenset((LlmProviders.ANTHROPIC.value,))
+
+
+def resolve_used_client_oauth_token(client_sent_oauth_token: object, custom_llm_provider: str | None) -> bool | None:
+    if not isinstance(client_sent_oauth_token, bool):
+        return None
+    return client_sent_oauth_token and custom_llm_provider in ANTHROPIC_OAUTH_FORWARD_PROVIDERS
+
+
 def _merge_beta_headers(existing: str | None, new_beta: str) -> str:
     """Merge a new beta value into an existing comma-separated anthropic-beta header."""
     if not existing:

litellm/llms/azure/passthrough/transformation.py

@@ -64,6 +64,16 @@ def logged_responses_stream(all_chunks: Sequence[str], logging_obj: Logging) ->
 
 
 AZURE_DEPLOYMENT_SEGMENT: Final = re.compile(r"(?<![^/])openai/deployments/([^/]+)")
+AZURE_BODY_MODEL_INFERENCE_ENDPOINTS: Final = frozenset(
+    {"responses", "chat/completions", "completions", "embeddings", "images/generations", "audio/speech"}
+)
+
+
+def is_azure_body_model_inference_endpoint(endpoint: str) -> bool:
+    if AZURE_DEPLOYMENT_SEGMENT.search(endpoint) is not None:
+        return False
+    path: Final = endpoint.strip("/")
+    return any(path == name or path.endswith(f"/{name}") for name in AZURE_BODY_MODEL_INFERENCE_ENDPOINTS)
 
 
 def azure_router_model_in_endpoint(endpoint: str, router_models: Collection[str]) -> str | None:

litellm/llms/hosted_vllm/chat/transformation.py

@@ -161,13 +161,14 @@ class HostedVLLMChatConfig(OpenAIGPTConfig):
         """
         Support translating:
         - video files from file_id or file_data to video_url
-        - thinking_blocks and reasoning_content on assistant messages are removed,
-          and content lists are converted to strings for vLLM compatibility
+        - thinking_blocks and non-string reasoning_content on assistant messages
+          are removed, and content lists are converted to strings for vLLM compatibility
         """
         for message in messages:
             if message["role"] == "assistant":
                 message.pop("thinking_blocks", None)
-                message.pop("reasoning_content", None)
+                if not isinstance(message.get("reasoning_content"), str):
+                    message.pop("reasoning_content", None)
                 existing_content = message.get("content")
                 if isinstance(existing_content, list):
                     text_parts = []

litellm/main.py

@@ -7931,6 +7931,7 @@ def transcription(
     api_version: str | None = None,
     max_retries: int | None = None,
     custom_llm_provider=None,
+    base_url: str | None = None,
     **kwargs,
 ) -> TranscriptionResponse | Coroutine[object, object, TranscriptionResponse]:
     """
@@ -7964,7 +7965,7 @@ def transcription(
     model, custom_llm_provider, dynamic_api_key, api_base = get_llm_provider(
         model=model,
         custom_llm_provider=custom_llm_provider,
-        api_base=api_base,
+        api_base=api_base or base_url,
         api_key=api_key,
     )
 
@@ -8237,6 +8238,7 @@ def speech(
     headers: dict | None = None,
     custom_llm_provider: str | None = None,
     aspeech: bool | None = None,
+    base_url: str | None = None,
     **kwargs,
 ) -> HttpxBinaryResponseContent | Coroutine[object, object, HttpxBinaryResponseContent]:
     user: Final = kwargs.get("user", None)
@@ -8246,7 +8248,7 @@ def speech(
     model_info: Final = kwargs.get("model_info", None)
     shared_session: Final = kwargs.get("shared_session", None)
     model, custom_llm_provider, dynamic_api_key, api_base = get_llm_provider(
-        model=model, custom_llm_provider=custom_llm_provider, api_base=api_base
+        model=model, custom_llm_provider=custom_llm_provider, api_base=api_base or base_url
     )
     kwargs.pop("tags", [])
 
@@ -8550,7 +8552,7 @@ def speech(
             extra_headers=headers,
             base_llm_http_handler=base_llm_http_handler,
             aspeech=aspeech or False,
-            api_base=generic_optional_params.api_base,
+            api_base=api_base,
             api_key=None,  # Vertex AI uses OAuth, not API key
             **kwargs,
         )

litellm/model_prices_and_context_window_backup.json

@@ -42186,14 +42186,14 @@
         "supports_web_search": false
     },
     "openrouter/deepseek/deepseek-v4-pro": {
-        "cache_read_input_token_cost": 7.9025e-08,
-        "input_cost_per_token": 9.483e-07,
+        "cache_read_input_token_cost": 6.525e-08,
+        "input_cost_per_token": 7.83e-07,
         "litellm_provider": "openrouter",
         "max_input_tokens": 1048576,
         "max_output_tokens": 384000,
         "max_tokens": 384000,
         "mode": "chat",
-        "output_cost_per_token": 1.8966e-06,
+        "output_cost_per_token": 1.566e-06,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
@@ -42206,14 +42206,14 @@
         "supports_web_search": false
     },
     "openrouter/deepseek/deepseek-v4.1-flash": {
-        "cache_read_input_token_cost": 6e-09,
-        "input_cost_per_token": 3e-07,
+        "cache_read_input_token_cost": 2.91e-09,
+        "input_cost_per_token": 1.98e-08,
         "litellm_provider": "openrouter",
         "max_input_tokens": 1048576,
         "max_output_tokens": 943718,
         "max_tokens": 943718,
         "mode": "chat",
-        "output_cost_per_token": 1.2e-06,
+        "output_cost_per_token": 3.96e-07,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
@@ -42226,14 +42226,15 @@
         "supports_web_search": false
     },
     "openrouter/deepseek/deepseek-v4-pro-0813": {
-        "cache_read_input_token_cost": 1.72e-07,
-        "input_cost_per_token": 2.4298e-07,
+        "cache_read_input_token_cost": 4.4e-08,
+        "input_cost_per_token": 1.32e-06,
         "litellm_provider": "openrouter",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 943718,
-        "max_tokens": 943718,
+        "max_output_tokens": 393216,
+        "max_tokens": 393216,
         "mode": "chat",
-        "output_cost_per_token": 4.2e-06,
+        "off_peak_pricing": {"input_cost_per_token":6.6e-7,"output_cost_per_token":0.00000198,"cache_read_input_token_cost":2.2e-8,"windows":[{"hours_utc":"00:00-00:00","weekdays":["saturday","sunday"]},{"hours_utc":"00:00-01:00","weekdays":["monday","tuesday","wednesday","thursday","friday"]},{"hours_utc":"04:00-06:00","weekdays":["monday","tuesday","wednesday","thursday","friday"]},{"hours_utc":"10:00-00:00","weekdays":["monday","tuesday","wednesday","thursday","friday"]}]},
+        "output_cost_per_token": 3.96e-06,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
@@ -43284,14 +43285,13 @@
         "supports_web_search": true
     },
     "openrouter/openai/gpt-oss-120b": {
-        "cache_read_input_token_cost": 7.5e-08,
-        "input_cost_per_token": 1.5e-07,
+        "input_cost_per_token": 3.7e-08,
         "litellm_provider": "openrouter",
         "max_input_tokens": 131072,
-        "max_output_tokens": 65536,
-        "max_tokens": 65536,
+        "max_output_tokens": 117964,
+        "max_tokens": 117964,
         "mode": "chat",
-        "output_cost_per_token": 6e-07,
+        "output_cost_per_token": 1.7e-07,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
@@ -43871,14 +43871,14 @@
     },
     "openrouter/z-ai/glm-5.1": {
         "cache_creation_input_token_cost": 0.0,
-        "cache_read_input_token_cost": 2.6e-07,
-        "input_cost_per_token": 1.4e-06,
+        "cache_read_input_token_cost": 1.7914e-07,
+        "input_cost_per_token": 9.646e-07,
         "litellm_provider": "openrouter",
         "max_input_tokens": 204800,
         "max_output_tokens": 131072,
         "max_tokens": 131072,
         "mode": "chat",
-        "output_cost_per_token": 4.4e-06,
+        "output_cost_per_token": 3.0316e-06,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
@@ -67462,14 +67462,14 @@
         "supports_prompt_caching": true
     },
     "openrouter/deepseek/deepseek-v4-flash-0731": {
-        "cache_read_input_token_cost": 1.6e-08,
-        "input_cost_per_token": 1.8e-08,
+        "cache_read_input_token_cost": 8.9e-09,
+        "input_cost_per_token": 8.9e-09,
         "litellm_provider": "openrouter",
-        "max_input_tokens": 1310720,
+        "max_input_tokens": 1048576,
         "max_output_tokens": 943718,
         "max_tokens": 943718,
         "mode": "chat",
-        "output_cost_per_token": 3.2e-07,
+        "output_cost_per_token": 1.28e-06,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
@@ -67551,23 +67551,23 @@
         "supports_web_search": false
     },
     "openrouter/moonshotai/kimi-k3": {
-        "input_cost_per_token": 3e-06,
-        "output_cost_per_token": 1.5e-05,
-        "cache_read_input_token_cost": 3e-07,
+        "cache_read_input_token_cost": 2.7e-07,
+        "input_cost_per_token": 2.8e-07,
         "litellm_provider": "openrouter",
         "max_input_tokens": 1048576,
         "max_output_tokens": 943718,
         "max_tokens": 943718,
         "mode": "chat",
+        "output_cost_per_token": 1e-05,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
         "supports_pdf_input": false,
-        "supports_tool_choice": true,
+        "supports_prompt_caching": true,
         "supports_reasoning": true,
         "supports_response_schema": true,
+        "supports_tool_choice": true,
         "supports_vision": true,
-        "supports_prompt_caching": true,
         "supports_web_search": false
     },
     "openrouter/poolside/laguna-xs-2.1": {
@@ -67674,24 +67674,24 @@
         "supports_web_search": true
     },
     "openrouter/z-ai/glm-5.2": {
-        "input_cost_per_token": 6.496e-07,
-        "output_cost_per_token": 2.0416e-06,
-        "cache_read_input_token_cost": 1.2064e-07,
+        "cache_read_input_token_cost": 2.6e-07,
+        "input_cost_per_token": 3.249e-07,
         "litellm_provider": "openrouter",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 131072,
-        "max_tokens": 131072,
+        "max_output_tokens": 943718,
+        "max_tokens": 943718,
         "mode": "chat",
+        "output_cost_per_token": 3.99e-06,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
-        "supports_tool_choice": true,
-        "supports_reasoning": true,
-        "supports_response_schema": true,
         "supports_parallel_function_calling": true,
         "supports_pdf_input": false,
-        "supports_vision": false,
         "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_tool_choice": true,
+        "supports_vision": false,
         "supports_web_search": false
     },
     "openrouter/z-ai/glm-5.2:free": {
@@ -67714,24 +67714,24 @@
         "supports_web_search": false
     },
     "openrouter/moonshotai/kimi-k2.7-code": {
-        "input_cost_per_token": 6.562e-07,
-        "output_cost_per_token": 3.3e-06,
         "cache_read_input_token_cost": 1.8e-07,
+        "input_cost_per_token": 6.712e-07,
         "litellm_provider": "openrouter",
         "max_input_tokens": 262144,
         "max_output_tokens": 235929,
         "max_tokens": 235929,
         "mode": "chat",
+        "output_cost_per_token": 3.35e-06,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
-        "supports_tool_choice": true,
-        "supports_reasoning": true,
-        "supports_response_schema": true,
         "supports_parallel_function_calling": true,
         "supports_pdf_input": false,
-        "supports_vision": true,
         "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_tool_choice": true,
+        "supports_vision": true,
         "supports_web_search": false
     },
     "openrouter/nvidia/nemotron-3.5-content-safety": {
@@ -68037,14 +68037,14 @@
         "supports_web_search": true
     },
     "openrouter/deepseek/deepseek-v4-flash": {
-        "cache_read_input_token_cost": 2.8e-08,
-        "input_cost_per_token": 1.4e-07,
+        "cache_read_input_token_cost": 1.5708e-08,
+        "input_cost_per_token": 7.854e-08,
         "litellm_provider": "openrouter",
         "max_input_tokens": 1048576,
         "max_output_tokens": 384000,
         "max_tokens": 384000,
         "mode": "chat",
-        "output_cost_per_token": 2.8e-07,
+        "output_cost_per_token": 1.5708e-07,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
@@ -68078,14 +68078,14 @@
         "supports_web_search": false
     },
     "openrouter/google/gemma-4-26b-a4b-it": {
-        "cache_read_input_token_cost": 3.75e-08,
-        "input_cost_per_token": 6.75e-08,
+        "cache_read_input_token_cost": 4.25e-08,
+        "input_cost_per_token": 7.65e-08,
         "litellm_provider": "openrouter",
         "max_input_tokens": 262144,
         "max_output_tokens": 235929,
         "max_tokens": 235929,
         "mode": "chat",
-        "output_cost_per_token": 2.25e-07,
+        "output_cost_per_token": 2.55e-07,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
@@ -68177,23 +68177,23 @@
         "supports_web_search": false
     },
     "openrouter/minimax/minimax-m2.7": {
-        "input_cost_per_token": 3e-07,
-        "output_cost_per_token": 1.2e-06,
-        "cache_read_input_token_cost": 6e-08,
+        "cache_read_input_token_cost": 4.2e-08,
+        "input_cost_per_token": 2.1e-07,
         "litellm_provider": "openrouter",
         "max_input_tokens": 204800,
         "max_output_tokens": 176947,
         "max_tokens": 176947,
         "mode": "chat",
+        "output_cost_per_token": 8.4e-07,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
         "supports_pdf_input": false,
-        "supports_tool_choice": true,
+        "supports_prompt_caching": true,
         "supports_reasoning": true,
         "supports_response_schema": true,
+        "supports_tool_choice": true,
         "supports_vision": false,
-        "supports_prompt_caching": true,
         "supports_web_search": false
     },
     "openrouter/minimax/minimax-m2.7:free": {
@@ -68862,24 +68862,24 @@
         "supports_web_search": false
     },
     "openrouter/deepseek/deepseek-v3.1-terminus": {
-        "input_cost_per_token": 2.7e-07,
-        "output_cost_per_token": 1e-06,
         "cache_read_input_token_cost": 1.35e-07,
         "deprecation_date": "2026-09-28",
+        "input_cost_per_token": 3e-07,
         "litellm_provider": "openrouter",
         "max_input_tokens": 163840,
-        "max_output_tokens": 32768,
-        "max_tokens": 32768,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
+        "output_cost_per_token": 1e-06,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
         "supports_pdf_input": false,
-        "supports_tool_choice": true,
+        "supports_prompt_caching": true,
         "supports_reasoning": true,
         "supports_response_schema": true,
+        "supports_tool_choice": true,
         "supports_vision": false,
-        "supports_prompt_caching": true,
         "supports_web_search": false
     },
     "openrouter/qwen/qwen3-coder-flash": {
@@ -69093,21 +69093,21 @@
         "supports_web_search": false
     },
     "openrouter/qwen/qwen3-30b-a3b-instruct-2507": {
-        "input_cost_per_token": 1e-07,
-        "output_cost_per_token": 3e-07,
+        "input_cost_per_token": 4.815e-08,
         "litellm_provider": "openrouter",
         "max_input_tokens": 262144,
-        "max_output_tokens": 235929,
-        "max_tokens": 235929,
+        "max_output_tokens": 32000,
+        "max_tokens": 32000,
         "mode": "chat",
+        "output_cost_per_token": 1.9305e-07,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
         "supports_pdf_input": false,
         "supports_prompt_caching": false,
         "supports_reasoning": false,
-        "supports_tool_choice": true,
         "supports_response_schema": true,
+        "supports_tool_choice": true,
         "supports_vision": false,
         "supports_web_search": false
     },
@@ -72583,12 +72583,13 @@
         "max_input_tokens": 1049000,
         "mode": "chat",
         "output_cost_per_token": 5e-07,
-        "source": "https://wandb.ai/site/pricing/tokens/",
+        "source": "https://docs.wandb.ai/inference/models.md",
         "supports_function_calling": true,
         "supports_prompt_caching": true,
         "supports_reasoning": true,
         "supports_response_schema": true,
-        "supports_tool_choice": true
+        "supports_tool_choice": true,
+        "supports_vision": true
     },
     "openrouter/~anthropic/claude-fable-latest": {
         "cache_creation_input_token_cost": 1.25e-05,
@@ -74350,13 +74351,13 @@
     },
     "openrouter/meta/muse-glimmer-30b": {
         "cache_read_input_token_cost": 4e-08,
-        "input_cost_per_token": 3e-07,
+        "input_cost_per_token": 3.5e-07,
         "litellm_provider": "openrouter",
         "max_input_tokens": 131072,
-        "max_output_tokens": 16384,
-        "max_tokens": 16384,
+        "max_output_tokens": 117964,
+        "max_tokens": 117964,
         "mode": "chat",
-        "output_cost_per_token": 1.2e-06,
+        "output_cost_per_token": 1.5e-06,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,
         "supports_function_calling": true,
@@ -75988,12 +75989,12 @@
         "supports_web_search": false
     },
     "openrouter/stealth/space-bunny-alpha": {
-        "deprecation_date": "2098-12-31",
+        "deprecation_date": "2026-10-05",
         "input_cost_per_token": 0.0,
         "litellm_provider": "openrouter",
         "max_input_tokens": 1000000,
-        "max_output_tokens": 128000,
-        "max_tokens": 128000,
+        "max_output_tokens": 524288,
+        "max_tokens": 524288,
         "mode": "chat",
         "output_cost_per_token": 0.0,
         "source": "https://openrouter.ai/api/v1/models",
@@ -76167,6 +76168,7 @@
         "max_output_tokens": 64000,
         "max_tokens": 64000,
         "mode": "chat",
+        "off_peak_pricing": {"input_cost_per_token":7.506e-7,"output_cost_per_token":0.0000022509,"cache_read_input_token_cost":3.78e-8,"hours_utc":"16:00-00:00"},
         "output_cost_per_token": 2.501e-06,
         "source": "https://openrouter.ai/api/v1/models",
         "supports_audio_input": false,

litellm/policy_templates_backup.json

@@ -1128,7 +1128,7 @@
           "categories": [
             {
               "category": "eu_ai_act_art5_manipulation",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/eu_ai_act_art5_manipulation.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/eu_ai_act_art5_manipulation.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1147,7 +1147,7 @@
           "categories": [
             {
               "category": "eu_ai_act_art5_vulnerability",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/eu_ai_act_art5_vulnerability.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/eu_ai_act_art5_vulnerability.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1166,7 +1166,7 @@
           "categories": [
             {
               "category": "eu_ai_act_art5_social_scoring",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/eu_ai_act_art5_social_scoring.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/eu_ai_act_art5_social_scoring.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1185,7 +1185,7 @@
           "categories": [
             {
               "category": "eu_ai_act_art5_emotion_recognition",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/eu_ai_act_art5_emotion_recognition.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/eu_ai_act_art5_emotion_recognition.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1204,7 +1204,7 @@
           "categories": [
             {
               "category": "eu_ai_act_art5_biometric_profiling",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/eu_ai_act_art5_biometric_profiling.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/eu_ai_act_art5_biometric_profiling.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1223,7 +1223,7 @@
           "categories": [
             {
               "category": "eu_ai_act_art5_manipulation_fr",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/eu_ai_act_art5_manipulation_fr.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/eu_ai_act_art5_manipulation_fr.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1242,7 +1242,7 @@
           "categories": [
             {
               "category": "eu_ai_act_art5_vulnerability_fr",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/eu_ai_act_art5_vulnerability_fr.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/eu_ai_act_art5_vulnerability_fr.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1261,7 +1261,7 @@
           "categories": [
             {
               "category": "eu_ai_act_art5_social_scoring_fr",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/eu_ai_act_art5_social_scoring_fr.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/eu_ai_act_art5_social_scoring_fr.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1280,7 +1280,7 @@
           "categories": [
             {
               "category": "eu_ai_act_art5_emotion_recognition_fr",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/eu_ai_act_art5_emotion_recognition_fr.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/eu_ai_act_art5_emotion_recognition_fr.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1299,7 +1299,7 @@
           "categories": [
             {
               "category": "eu_ai_act_art5_biometric_profiling_fr",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/eu_ai_act_art5_biometric_profiling_fr.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/eu_ai_act_art5_biometric_profiling_fr.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1673,7 +1673,7 @@
           "categories": [
             {
               "category": "aviation_safety_topics",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/aviation_safety_topics.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/aviation_safety_topics.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1692,7 +1692,7 @@
           "categories": [
             {
               "category": "airline_brand_protection",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/airline_brand_protection.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/airline_brand_protection.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1864,7 +1864,7 @@
           "categories": [
             {
               "category": "airline_off_topic_restriction",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/airline_off_topic_restriction.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/airline_off_topic_restriction.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1962,7 +1962,7 @@
           "categories": [
             {
               "category": "uae_cultural_sensitivity",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/uae_cultural_sensitivity.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/uae_cultural_sensitivity.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -1981,7 +1981,7 @@
           "categories": [
             {
               "category": "uae_anti_discrimination",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/uae_anti_discrimination.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/uae_anti_discrimination.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2575,7 +2575,7 @@
           "categories": [
             {
               "category": "sg_pdpa_personal_identifiers",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sg_pdpa_personal_identifiers.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/sg_pdpa_personal_identifiers.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2594,7 +2594,7 @@
           "categories": [
             {
               "category": "sg_pdpa_sensitive_data",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sg_pdpa_sensitive_data.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/sg_pdpa_sensitive_data.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2613,7 +2613,7 @@
           "categories": [
             {
               "category": "sg_pdpa_do_not_call",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sg_pdpa_do_not_call.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/sg_pdpa_do_not_call.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2632,7 +2632,7 @@
           "categories": [
             {
               "category": "sg_pdpa_data_transfer",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sg_pdpa_data_transfer.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/sg_pdpa_data_transfer.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2651,7 +2651,7 @@
           "categories": [
             {
               "category": "sg_pdpa_profiling_automated_decisions",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sg_pdpa_profiling_automated_decisions.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/sg_pdpa_profiling_automated_decisions.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2710,7 +2710,7 @@
           "categories": [
             {
               "category": "sg_mas_fairness_bias",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sg_mas_fairness_bias.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/sg_mas_fairness_bias.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2729,7 +2729,7 @@
           "categories": [
             {
               "category": "sg_mas_transparency_explainability",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sg_mas_transparency_explainability.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/sg_mas_transparency_explainability.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2748,7 +2748,7 @@
           "categories": [
             {
               "category": "sg_mas_human_oversight",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sg_mas_human_oversight.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/sg_mas_human_oversight.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2767,7 +2767,7 @@
           "categories": [
             {
               "category": "sg_mas_data_governance",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sg_mas_data_governance.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/sg_mas_data_governance.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2786,7 +2786,7 @@
           "categories": [
             {
               "category": "sg_mas_model_security",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sg_mas_model_security.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/policy_templates/sg_mas_model_security.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2841,7 +2841,7 @@
           "categories": [
             {
               "category": "claims_fraud_coaching",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/categories/claims_fraud_coaching.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/categories/claims_fraud_coaching.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2860,7 +2860,7 @@
           "categories": [
             {
               "category": "claims_phi_disclosure",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/categories/claims_phi_disclosure.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/categories/claims_phi_disclosure.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2879,7 +2879,7 @@
           "categories": [
             {
               "category": "claims_prior_auth_gaming",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/categories/claims_prior_auth_gaming.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/categories/claims_prior_auth_gaming.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2898,7 +2898,7 @@
           "categories": [
             {
               "category": "claims_system_override",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/categories/claims_system_override.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/categories/claims_system_override.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"
@@ -2917,7 +2917,7 @@
           "categories": [
             {
               "category": "claims_medical_advice",
-              "category_file": "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/categories/claims_medical_advice.yaml",
+              "category_file": "litellm/proxy/guardrails/content_filter_data/categories/claims_medical_advice.yaml",
               "enabled": true,
               "action": "BLOCK",
               "severity_threshold": "medium"

litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py

@@ -506,7 +506,7 @@ def _build_authorize_html(
     <button class="close-btn" type="button" onclick="doCancel()" title="Close">&times;</button>
 
     <div class="logos">
-      <img src="/ui/assets/logos/litellm_logo.jpg" class="logo-img" alt="LiteLLM">
+      <img src="/get_image?variant=monogram" class="logo-img" alt="LiteLLM">
       <span class="logo-arrow">&#8594;</span>
       <div class="logo logo-s">{server_initial}</div>
     </div>

litellm/proxy/_experimental/out/assets/logos/litellm_monogram.svg

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 372.14 371.53">
+  <defs>
+    <style>
+      .cls-1 {
+        fill: #0117be;
+      }
+    </style>
+  </defs>
+  <path class="cls-1" d="M296.11,254.16c7.79-1.07,7.43-12.43.39-13.28-6.58-.79-14.5.86-21.17-.23l-50.86.37c-7.25,2.25-6.45,12.27,1.1,13.28l70.54-.14Z"/>
+  <path class="cls-1" d="M309.42,196.83c-35.23-15.22-72.84-26.08-109.96-35.87-33.05-8.71-69.92-16.92-103.8-21.32-31.89-4.14-63.43-3.41-95.51-3.23v6.54c36.23-.59,71.45.42,107.34,5.91,48.38,7.41,99.06,19.56,145.78,33.98,27.15,8.38,53.59,18.79,79.2,31.01l.1,67.98c12.46-2,31.2-8.81,39.28-20.3l-.04-24.63c-10.86-17.17-45.21-32.66-62.4-40.09Z"/>
+  <path class="cls-1" d="M14.79,115.72c-.07.12-.14.23-.21.35,23.36.36,46.79,1.59,69.97,4.75,36.98,5.04,75.62,13.61,111.4,24.06,17.99,5.25,35.13,13.22,54.25,12.22,4.13-.22,8.25-1.11,12.36-1.52l-.56-.73c-22.47-16.17-52.91-34.43-91.33-48.5C101.55,81.06,39.38,81.29.08,85.13l.05,31.74c3.47-.28,6.94-.56,10.39-.99,1.4-.02,2.84-.06,4.28-.16Z"/>
+  <path class="cls-1" d="M333.75-.37L37.67.08C16.84.11-.03,17.02,0,37.85l.06,39.13c27.48-4.04,66.25-6.26,112.14,2.78,1.52.3,6.38,1.29,12.73,2.77,54.99,12.83,104.51,41.22,151.11,71.93,22.76,14.99,46.61,30.85,68.19,47.42,8.92,6.85,19.82,15.04,27.57,24.61l-.29-189.2c-.03-20.83-16.94-37.69-37.77-37.66Z"/>
+  <path class="cls-1" d="M92.09,245.59h6.39s0,.03,0,.03l57.07-.09-48.14-66.6c-.53-.87-3.85-2.78-4.61-2.78h-4.75s0,.18,0,.18h-6.06s0-.09,0-.09l-91.76.14.11,69.62,91.76-.14v-.28Z"/>
+  <path class="cls-1" d="M.4,298.26l.05,35.68c.03,20.83,16.94,37.69,37.77,37.66l296.08-.45c20.83-.03,37.69-16.94,37.66-37.77l-.09-59.31c-17.35,19.08-52.22,22.16-75.65,23.75l-295.82.45Z"/>
+  <path class="cls-1" d="M159.06,253.3c-20.19.1-40.38.04-60.58.04v.26s-42.72.07-42.72.07c-.83.12-1.69.18-2.17,0l-53.25.08v9.76s166.32-.25,166.32-.25c-1.47-1.7-5.76-9.61-7.6-9.96Z"/>
+</svg>

litellm/proxy/_experimental/out/assets/logos/litellm_monogram_dark.svg

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 372.14 371.53">
+  <defs>
+    <style>
+      .cls-1 {
+        fill: #fff;
+      }
+    </style>
+  </defs>
+  <path class="cls-1" d="M296.11,254.16c7.79-1.07,7.43-12.43.39-13.28-6.58-.79-14.5.86-21.17-.23l-50.86.37c-7.25,2.25-6.45,12.27,1.1,13.28l70.54-.14Z"/>
+  <path class="cls-1" d="M309.42,196.83c-35.23-15.22-72.84-26.08-109.96-35.87-33.05-8.71-69.92-16.92-103.8-21.32-31.89-4.14-63.43-3.41-95.51-3.23v6.54c36.23-.59,71.45.42,107.34,5.91,48.38,7.41,99.06,19.56,145.78,33.98,27.15,8.38,53.59,18.79,79.2,31.01l.1,67.98c12.46-2,31.2-8.81,39.28-20.3l-.04-24.63c-10.86-17.17-45.21-32.66-62.4-40.09Z"/>
+  <path class="cls-1" d="M14.79,115.72c-.07.12-.14.23-.21.35,23.36.36,46.79,1.59,69.97,4.75,36.98,5.04,75.62,13.61,111.4,24.06,17.99,5.25,35.13,13.22,54.25,12.22,4.13-.22,8.25-1.11,12.36-1.52l-.56-.73c-22.47-16.17-52.91-34.43-91.33-48.5C101.55,81.06,39.38,81.29.08,85.13l.05,31.74c3.47-.28,6.94-.56,10.39-.99,1.4-.02,2.84-.06,4.28-.16Z"/>
+  <path class="cls-1" d="M333.75-.37L37.67.08C16.84.11-.03,17.02,0,37.85l.06,39.13c27.48-4.04,66.25-6.26,112.14,2.78,1.52.3,6.38,1.29,12.73,2.77,54.99,12.83,104.51,41.22,151.11,71.93,22.76,14.99,46.61,30.85,68.19,47.42,8.92,6.85,19.82,15.04,27.57,24.61l-.29-189.2c-.03-20.83-16.94-37.69-37.77-37.66Z"/>
+  <path class="cls-1" d="M92.09,245.59h6.39s0,.03,0,.03l57.07-.09-48.14-66.6c-.53-.87-3.85-2.78-4.61-2.78h-4.75s0,.18,0,.18h-6.06s0-.09,0-.09l-91.76.14.11,69.62,91.76-.14v-.28Z"/>
+  <path class="cls-1" d="M.4,298.26l.05,35.68c.03,20.83,16.94,37.69,37.77,37.66l296.08-.45c20.83-.03,37.69-16.94,37.66-37.77l-.09-59.31c-17.35,19.08-52.22,22.16-75.65,23.75l-295.82.45Z"/>
+  <path class="cls-1" d="M159.06,253.3c-20.19.1-40.38.04-60.58.04v.26s-42.72.07-42.72.07c-.83.12-1.69.18-2.17,0l-53.25.08v9.76s166.32-.25,166.32-.25c-1.47-1.7-5.76-9.61-7.6-9.96Z"/>
+</svg>