Merge pull request #50980 from BerriAI/litellm_chore_5cb36d

chore: bump litellm to 1.108.5 on lts/1.108.x

.circleci/scripts/classify_changes.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+category="${1:?usage: classify_changes.sh <backend|client|ui|cost-map-only|mcp-dependencies|windows-release|redis-compat>}"
+
+has_client=false
+has_backend=false
+has_ci=false
+has_cost_map=false
+has_mcp_dependencies=false
+has_windows_release=false
+has_redis_compat=false
+outside_cost_map_set=false
+while IFS= read -r file || [ -n "$file" ]; do
+  [ -n "$file" ] || continue
+  case "$file" in
+    litellm/_redis.py | litellm/_redis_credential_provider.py | litellm/caching/redis_cache.py | litellm/caching/evicted_client_closer.py | tests/unit/test_redis.py | tests/integration/sdk/test_redis_cluster_iam_auth.py | tests/unit/caching/test_redis_connection_pool.py | tests/unit/caching/test_redis_cluster_cache.py | tests/unit/caching/test_evicted_client_closer.py | .github/workflows/test-unit.yml | .github/actions/detect-changes/* | .github/scripts/detect_changes.sh | .circleci/scripts/classify_changes.sh | tests/integration/run.py | pyproject.toml | uv.lock)
+      has_redis_compat=true ;;
+  esac
+  case "$file" in
+    *.md | *.mdx) : ;;
+    pyproject.toml | */pyproject.toml | uv.lock | uv.toml | .python-version | rust-toolchain.toml | litellm-rust/* | litellm/__init__.py | litellm/proxy/proxy_server.py | litellm/*mcp* | tests/*mcp* | litellm/integrations/arize/* | tests/base_sdk_tests/* | scripts/check_mcp_sdk_install.py | .github/workflows/test-mcp-dependency-resolution.yml | .github/actions/detect-changes/* | .github/actions/setup-uv-with-retries/* | .github/actions/cache-cargo-build/* | .github/scripts/detect_changes.sh | .github/scripts/uv_sync_with_retries.sh | .circleci/scripts/classify_changes.sh | tests/unit/test_circleci_path_filter.py | tests/unit/test_detect_changes.py)
+      has_mcp_dependencies=true ;;
+  esac
+  case "$file" in
+    litellm-rust/* | litellm/rust_bridge/* | rust-toolchain.toml | pyproject.toml | uv.lock | tests/windows_tests/* | .circleci/*)
+      has_windows_release=true ;;
+  esac
+  case "$file" in
+    ui/* | tests/e2e/ui/*) has_client=true ;;
+    docs/* | *.md | *.mdx) : ;;
+    .github/* | .circleci/*) has_ci=true; has_backend=true ;;
+    *) has_backend=true ;;
+  esac
+  case "$file" in
+    model_prices_and_context_window.json | litellm/model_prices_and_context_window_backup.json | model_prices_and_context_window.schema.json)
+      has_cost_map=true ;;
+    tests/unit/proxy/*) : ;;
+    *) outside_cost_map_set=true ;;
+  esac
+done
+
+case "$category" in
+  mcp-dependencies)
+    [ "$has_mcp_dependencies" = true ] && echo run || echo skip
+    ;;
+  cost-map-only)
+    { [ "$has_cost_map" = true ] && [ "$outside_cost_map_set" = false ]; } && echo run || echo skip
+    ;;
+  windows-release)
+    [ "$has_windows_release" = true ] && echo run || echo skip
+    ;;
+  redis-compat)
+    [ "$has_redis_compat" = true ] && echo run || echo skip
+    ;;
+  backend)
+    [ "$has_backend" = true ] && echo run || echo skip
+    ;;
+  client)
+    { [ "$has_client" = true ] || [ "$has_backend" = true ]; } && echo run || echo skip
+    ;;
+  ui)
+    { [ "$has_client" = true ] || [ "$has_ci" = true ]; } && echo run || echo skip
+    ;;
+  *)
+    echo run
+    ;;
+esac

.circleci/scripts/path_filter.sh

@@ -6,12 +6,10 @@ here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 run_full() {
   echo "path-filter[$category]: running job ($1)"
-  echo "decision=run"
-  [ -z "${GITHUB_OUTPUT:-}" ] || echo "decision=run" >> "$GITHUB_OUTPUT"
   exit 0
 }
 
-[ "${GITHUB_EVENT_NAME:-}" = pull_request ] || run_full "not a pull request"
+[ -n "${CIRCLE_PULL_REQUEST:-}" ] || run_full "not a pull request"
 
 candidate_bases="${PATH_FILTER_BASE_BRANCH:-main}"
 merge_base=""
@@ -38,6 +36,5 @@ if [ "$decision" = run ]; then
   run_full "$category-relevant changes detected"
 fi
 
-echo "path-filter[$category]: only unrelated changes detected"
-echo "decision=skip"
-[ -z "${GITHUB_OUTPUT:-}" ] || echo "decision=skip" >> "$GITHUB_OUTPUT"
+echo "path-filter[$category]: only unrelated changes detected; halting job as successful"
+circleci-agent step halt

.circleci/scripts/run_integration.sh

@@ -30,7 +30,7 @@ egress_cgroup=litellm-integration
 cleanup() {
   original_status=$?
   trap - EXIT INT TERM
-  sudo .venv/bin/python .github/scripts/ci/stop_integration_processes.py \
+  sudo .venv/bin/python .circleci/scripts/stop_integration_processes.py \
     "$integration_identity" "$(id -u)" "$proxy_pid" "$peer_pid" "$upstream_pid" \
     > "$results/process-cleanup.txt" 2>&1 || original_status=1
   for owned_pid in "$peer_pid" "$proxy_pid" "$upstream_pid"; do
@@ -81,10 +81,10 @@ export INTEGRATION_UPSTREAM_URL=http://127.0.0.1:8190
 export INTEGRATION_MASTER_KEY="$LITELLM_MASTER_KEY"
 export LITELLM_UI_PATH="$PWD/litellm/proxy/_experimental/out"
 if [ "$suite" = browser ]; then
-  export LITELLM_UI_PATH="$PWD/litellm/ui/litellm-dashboard/out"
+  export LITELLM_UI_PATH="$PWD/ui/litellm-dashboard/out"
   test -f "$LITELLM_UI_PATH/index.html"
 fi
-export INTEGRATION_SEED="$(.venv/bin/python -c 'import hashlib,os; print(int(hashlib.sha256(((os.environ.get("GITHUB_SHA") or "local") + (os.environ.get("GITHUB_RUN_ID") or "local")).encode()).hexdigest()[:8],16))')"
+export INTEGRATION_SEED="$(.venv/bin/python -c 'import hashlib,os; print(int(hashlib.sha256(((os.environ.get("CIRCLE_SHA1") or os.environ.get("GITHUB_SHA") or "local") + (os.environ.get("CIRCLE_WORKFLOW_ID") or os.environ.get("GITHUB_RUN_ID") or "local")).encode()).hexdigest()[:8],16))')"
 export INTEGRATION_ORDER_SEED="$INTEGRATION_SEED"
 
 uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma > "$results/prisma-generate.log" 2>&1
@@ -93,7 +93,7 @@ export INTEGRATION_PROXY_DATABASE_URL=""
 export INTEGRATION_PROXY_READ_REPLICA_URL=""
 export INTEGRATION_ROUTING=""
 if [ "$mode" = replica ] || [ "$mode" = parity ]; then
-  .venv/bin/python .github/scripts/ci/prepare_replica_roles.py > "$results/prepare-replica-roles.log" 2>&1
+  .venv/bin/python .circleci/scripts/prepare_replica_roles.py > "$results/prepare-replica-roles.log" 2>&1
   export INTEGRATION_PROXY_DATABASE_URL="postgresql://litellm_writer:litellm-writer@127.0.0.1:5432/circle_test"
   export INTEGRATION_PROXY_READ_REPLICA_URL="postgresql://litellm_reader:litellm-reader@127.0.0.1:5432/circle_test"
 fi
@@ -128,8 +128,6 @@ fi
 sudo iptables -L integration_only -n -v -x > "$results/egress-guard.txt"
 awk '$3 == "REJECT" && $1 > 0 { rejected=1 } END { exit !rejected }' "$results/egress-guard.txt"
 
-export UV_OFFLINE=true
-
 if [ "$mode" = parity ]; then
   export INTEGRATION_WORKERS=1
 else
@@ -202,7 +200,7 @@ start_proxy() {
 if [ "$isolated_workers" = false ]; then
   start_proxy 4000 proxy.log
   proxy_pid="$launched_pid"
-  .venv/bin/python .github/scripts/ci/wait_integration_services.py
+  .venv/bin/python .circleci/scripts/wait_integration_services.py
   curl --noproxy '*' -sSf -X POST "$INTEGRATION_PROXY_URL/config/update" \
     -H "Authorization: Bearer $LITELLM_MASTER_KEY" -H 'Content-Type: application/json' \
     -d '{"router_settings": {"num_retries": 0}}' > "$results/seed-router-settings.json"
@@ -210,7 +208,7 @@ if [ "$isolated_workers" = false ]; then
     export INTEGRATION_PEER_URL=http://127.0.0.1:4001
     start_proxy 4001 peer.log
     peer_pid="$launched_pid"
-    .venv/bin/python .github/scripts/ci/wait_integration_services.py
+    .venv/bin/python .circleci/scripts/wait_integration_services.py
   fi
 fi
 
@@ -233,13 +231,14 @@ if [ "$suite" = browser ]; then
     E2E_UI_BASE_URL="$E2E_UI_BASE_URL" E2E_UI_ARTIFACT_DIR="$E2E_UI_ARTIFACT_DIR" \
     LITELLM_MASTER_KEY="$LITELLM_MASTER_KEY" CI=true \
     node tests/e2e/ui/node_modules/@playwright/test/cli.js test --config tests/e2e/ui/integration.config.ts
-  .venv/bin/python .github/scripts/ci/verify_integration_browser.py "$results/browser-results.json"
+  .venv/bin/python .circleci/scripts/verify_integration_browser.py "$results/browser-results.json"
   exit 0
 fi
 
 shard_arguments=()
-if [ -n "${INTEGRATION_SHARD_FILES:-}" ]; then
-  cp "$INTEGRATION_SHARD_FILES" "$results/node-files.txt"
+if [ "${CIRCLE_NODE_TOTAL:-1}" -gt 1 ]; then
+  .venv/bin/python tests/integration/run.py "$suite" --list \
+    | circleci tests split --split-by=timings --timings-type=filename > "$results/node-files.txt"
   shard_arguments=(--shard-files "$results/node-files.txt")
 fi
 
@@ -264,7 +263,7 @@ env -i PATH="$PATH" HOME="$HOME" PYTHONPATH="$PYTHONPATH" \
   "${license_env[@]}" \
   INTEGRATION_SEED="$INTEGRATION_SEED" \
   INTEGRATION_ORDER_SEED="$INTEGRATION_ORDER_SEED" \
-  INTEGRATION_CASE_SHARDS="${INTEGRATION_CASE_SHARDS:-1}" INTEGRATION_CASE_SHARD_INDEX="${INTEGRATION_CASE_SHARD_INDEX:-0}" \
+  INTEGRATION_CASE_SHARDS="${CIRCLE_NODE_TOTAL:-1}" INTEGRATION_CASE_SHARD_INDEX="${CIRCLE_NODE_INDEX:-0}" \
   LITELLM_LOCAL_MODEL_COST_MAP=True AWS_EC2_METADATA_DISABLED=true DO_NOT_TRACK=1 \
   INTEGRATION_PROXY_DATABASE_URL="$INTEGRATION_PROXY_DATABASE_URL" \
   INTEGRATION_PROXY_READ_REPLICA_URL="$INTEGRATION_PROXY_READ_REPLICA_URL" \

.circleci/scripts/run_migration_tests.py

@@ -0,0 +1,116 @@
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+from typing import Final
+from xml.etree import ElementTree
+
+SUITES: Final = {
+    "startup": (("test_startup.py",), 13),
+    "recovery": (("test_recovery.py",), 15),
+    "legacy": (("test_legacy.py", "test_pooling.py"), 11),
+    "upgrade": (("test_upgrade.py", "test_rolling_upgrade.py"), 5),
+    "shaped": (("test_shaped_database.py",), 1),
+}
+
+
+def successful_junit(path: Path, expected: int, exit_code: int) -> bool:
+    if exit_code != 0 or not path.is_file():
+        return False
+    try:
+        root: Final = ElementTree.parse(path).getroot()
+    except ElementTree.ParseError:
+        return False
+    cases: Final = tuple(root.iter("testcase"))
+    identities: Final = frozenset((case.get("classname"), case.get("name")) for case in cases)
+    return len(cases) == len(identities) == expected and all(
+        not any(case.find(tag) is not None for tag in ("failure", "error", "skipped")) for case in cases
+    )
+
+
+def output(*command: str) -> str:
+    return subprocess.check_output(command, text=True, timeout=90).strip()
+
+
+def record_image() -> None:
+    source: Final = output("git", "rev-parse", "HEAD")
+    image: Final = output("docker", "image", "inspect", "litellm-docker-database:ci", "--format", "{{.Id}}")
+    revision: Final = output(
+        "docker",
+        "image",
+        "inspect",
+        "litellm-docker-database:ci",
+        "--format",
+        '{{index .Config.Labels "org.opencontainers.image.revision"}}',
+    )
+    assert re.fullmatch(r"[0-9a-f]{40}", source), "Invalid source revision"
+    assert revision == source, "Candidate image revision differs from the tested source"
+    Path("migration-image.json").write_text(
+        json.dumps(
+            {
+                "source_sha": source,
+                "image_id": image,
+                "candidate_image": os.environ.get("MIGRATION_CANDIDATE_IMAGE", ""),
+            }
+        )
+    )
+
+
+def main() -> int:
+    suite: Final = os.environ["MIGRATION_TEST_SUITE"]
+    files, expected = SUITES[suite]
+    metadata: Final = json.loads(Path("migration-image.json").read_text())
+    assert metadata["source_sha"] == output("git", "rev-parse", "HEAD"), "Image and test source revisions differ"
+    assert metadata["image_id"] == output(
+        "docker", "image", "inspect", os.environ["LITELLM_MIGRATION_TEST_IMAGE"], "--format", "{{.Id}}"
+    ), "Loaded image differs from the build output"
+    assert metadata["candidate_image"] == os.environ.get("MIGRATION_CANDIDATE_IMAGE", ""), "Wrong release candidate"
+    destination: Final = Path(os.environ["MIGRATION_TEST_OUTPUT"])
+    junit: Final = destination / "junit" / "results.xml"
+    junit.parent.mkdir(parents=True, exist_ok=True)
+    result: Final = subprocess.run(
+        (
+            sys.executable,
+            "-m",
+            "pytest",
+            *(f"tests/e2e/migrations/{name}" for name in files),
+            "-vv",
+            "--tb=short",
+            "--durations=10",
+            f"--junitxml={junit}",
+            "-o",
+            "addopts=",
+            "--reruns=0",
+        ),
+        check=False,
+        timeout=1200,
+    )
+    passed: Final = successful_junit(junit, expected, result.returncode)
+    (destination / "verdict.json").write_text(
+        json.dumps(
+            {
+                **metadata,
+                "suite": suite,
+                "baseline_image": os.environ.get("LITELLM_MIGRATION_BASELINE_IMAGE", ""),
+                "expected_cases": expected,
+                "passed": passed,
+                "pytest_exit_code": result.returncode,
+                "test_revision": metadata["source_sha"],
+                "workflow_id": os.environ.get("CIRCLE_WORKFLOW_ID", ""),
+                "job_number": os.environ.get("CIRCLE_BUILD_NUM", ""),
+            },
+            indent=2,
+        )
+    )
+    return 0 if passed else 1
+
+
+if __name__ == "__main__":
+    if sys.argv[1:] == ["record-image"]:
+        record_image()
+    else:
+        raise SystemExit(main())

.circleci/scripts/verify_integration_browser.py

@@ -31,7 +31,7 @@ def main() -> None:
     result: Final = json.loads(Path(sys.argv[1]).read_text())
     assert not result.get("errors"), result.get("errors")
     expected: Final = json.loads(
-        (Path(__file__).resolve().parents[3] / "tests/e2e/ui/tests/integrationCritical/expected.json").read_text()
+        (Path(__file__).resolve().parents[2] / "tests/e2e/ui/tests/integrationCritical/expected.json").read_text()
     )
     assert expected and result["stats"]["expected"] == len(expected)
     assert all(result["stats"][name] == 0 for name in ("unexpected", "flaky", "skipped"))
@@ -41,7 +41,7 @@ def main() -> None:
 
     suites: Final = TypeAdapter(list[BrowserSuite]).validate_python(result["suites"], strict=True)
     specs: Final = tuple(spec for suite in suites for spec in cases(suite))
-    repository: Final = Path(__file__).resolve().parents[3]
+    repository: Final = Path(__file__).resolve().parents[2]
     report_root: Final = Path(result["config"]["rootDir"])
     assert report_root.is_absolute(), "Playwright rootDir must be explicit"
     observed: Final = tuple(

.devcontainer/devcontainer.json

@@ -0,0 +1,57 @@
+{
+	"name": "Python 3.11",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"image": "mcr.microsoft.com/devcontainers/python:3.11-bookworm",
+	// https://github.com/devcontainers/images/tree/main/src/python
+	// https://mcr.microsoft.com/en-us/product/devcontainers/python/tags
+
+	// "build": {
+	// 	"dockerfile": "Dockerfile",
+	// 	"context": ".."
+	// },
+
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	"features": {
+		"ghcr.io/devcontainers/features/node:1": {
+			"version": "lts"
+		},
+		"ghcr.io/devcontainers/features/docker-in-docker:2": {}
+	},
+
+	// Configure tool-specific properties.
+	"customizations": {
+		// Configure properties specific to VS Code.
+		"vscode": {
+			"settings": {},
+			"extensions": [
+				"ms-python.python",
+				"ms-python.vscode-pylance",
+				"GitHub.copilot",
+				"GitHub.copilot-chat",
+				"ms-python.autopep8"
+			]
+		}
+	},
+	
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	"forwardPorts": [4000],
+	
+	"containerEnv": {
+		"LITELLM_LOG": "DEBUG"
+	},
+
+	// Use 'portsAttributes' to set default properties for specific forwarded ports. 
+	// More info: https://containers.dev/implementors/json_reference/#port-attributes
+	"portsAttributes": {
+		"4000": {
+			"label": "LiteLLM Server",
+			"onAutoForward": "notify"
+		}
+	},
+
+	// More info: https://aka.ms/dev-containers-non-root.
+	// "remoteUser": "litellm",
+
+	// Use 'postCreateCommand' to run commands after the container is created.
+	"postCreateCommand": "bash ./.devcontainer/post-create.sh"
+}

.devcontainer/post-create.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -e
+
+echo "[post-create] Installing uv"
+curl -LsSf https://astral.sh/uv/0.10.9/install.sh | env UV_NO_MODIFY_PATH=1 sh
+export PATH="$HOME/.local/bin:$PATH"
+
+echo "[post-create] Installing Python dependencies (uv)"
+uv sync --frozen --group proxy-dev --extra proxy
+
+echo "[post-create] Generating Prisma client"
+uv run --no-sync prisma generate
+
+echo "[post-create] Installing npm dependencies"
+cd ui/litellm-dashboard && npm ci
+
+echo "[post-create] Done"

.dockerignore

@@ -0,0 +1,58 @@
+docs
+cookbook
+.circleci
+.github
+tests
+.git
+.devcontainer
+*.tgz
+log.txt
+docker/Dockerfile.*
+
+# Claude Flow generated files (must be excluded from Docker build)
+.claude/
+.claude-flow/
+.swarm/
+.hive-mind/
+memory/
+coordination/
+claude-flow
+.mcp.json
+hive-mind-prompt-*.txt
+
+# Python virtual environments and version managers
+.venv/
+venv/
+**/.venv/
+**/venv/
+.python-version
+.pyenv/
+__pycache__/
+**/__pycache__/
+*.pyc
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+**/pyvenv.cfg
+
+# Common project exclusions
+.vscode
+*.pyo
+*.pyd
+.Python
+env/
+.pytest_cache
+.coverage
+htmlcov/
+dist/
+build/
+*.egg-info/
+.DS_Store
+**/node_modules
+ui/litellm-dashboard/.next
+ui/litellm-dashboard/out
+litellm-rust/target/
+litellm/rust_bridge/_native*.so
+*.log
+.env
+.env.local

.env.example

@@ -0,0 +1,32 @@
+# OpenAI
+OPENAI_API_KEY = ""
+OPENAI_BASE_URL = ""
+# Cohere
+COHERE_API_KEY = ""
+# OpenRouter
+OR_SITE_URL = ""
+OR_APP_NAME = "LiteLLM Example app"
+OR_API_KEY = ""
+# Azure API base URL
+AZURE_API_BASE = ""
+# Azure API version
+AZURE_API_VERSION = ""
+# Azure API key
+AZURE_API_KEY = ""
+# Replicate
+REPLICATE_API_KEY = ""
+REPLICATE_API_TOKEN = ""
+# Anthropic
+ANTHROPIC_API_KEY = ""
+# Infisical
+INFISICAL_TOKEN = ""
+# Novita AI
+NOVITA_API_KEY = ""
+# INFINITY
+INFINITY_API_KEY = ""
+
+# Development Configs
+# Generate one with: echo "LITELLM_MASTER_KEY=sk-$(openssl rand -hex 32)"
+LITELLM_MASTER_KEY = ""
+DATABASE_URL = "postgresql://llmproxy:dbpassword9090@db:5432/litellm"
+STORE_MODEL_IN_DB = "True"

.git-blame-ignore-revs

@@ -0,0 +1,40 @@
+# Add the commit hash of any commit you want to ignore in `git blame` here.
+# One commit hash per line.
+#
+# The GitHub Blame UI will use this file automatically!
+#
+# Run this command to always ignore formatting commits in `git blame`
+#     git config blame.ignoreRevsFile .git-blame-ignore-revs
+
+# Update pydantic code to fix warnings (GH-3600)
+876840e9957bc7e9f7d6a2b58c4d7c53dad16481
+
+# style(ui): run prettier --write across the dashboard (#29622)
+7edf3a9cb55548b143df1692f4ed7c4681d7fcf7
+
+# style: reformat litellm/ with ruff format (#31317)
+17bfd415aeb5a57fb646b5cc67da1c730aa7c50b
+
+# style: unify ruff format width on 120 (#31518)
+48b5a5a0cc5a694a11219416ee0b6eb6e620e74e
+
+# refactor(imports): move collections.abc names out of typing (#35495)
+397e8e4918777e4e60a7f5e88699e0a9a7dabb3d
+
+# refactor(lint): apply every safe ruff autofix and zero 28 strict-rule budgets (#35495)
+b604e2b20c6db2099085a2f0e59b7e99e87eed6f
+
+# refactor(logging): drop redundant !s conversion flags from f-strings (#35546)
+7b2d3440cba3160277470f7a0180098ae9b87864
+
+# perf: build log messages lazily so filtered-out log records cost nothing (#35703)
+c9887a1f94bc1e7e4bdfe64d640f0509a0bc19dd
+
+# feat(lint): enforce Final on locals and freeze function parameters (#35807)
+2708620d6a599cc73c1950a942d26ac26a7ed3d4
+
+# chore(lint): remove litellm/types from the ruff lint exclusion (#35926)
+4e32a8bf6a1e1af1e04b67c759841ccef44b2235
+
+# chore(lint): strip inert type: ignore comments and zero LIT009/LIT010/LIT011 headroom (#35928)
+338e411103ad5d7003e97f34f04fa36bca542dbe

.gitattributes

@@ -0,0 +1,2 @@
+*.ipynb linguist-vendored
+ui/litellm-dashboard/src/lib/http/schema.d.ts linguist-generated

.gitguardian.yaml

@@ -0,0 +1,106 @@
+version: 2
+
+secret:
+  # Exclude files and paths by globbing
+  ignored_paths:
+    - "**/*.whl"
+    - "**/*.pyc"
+    - "**/__pycache__/**"
+    - "**/node_modules/**"
+    - "**/dist/**"
+    - "**/build/**"
+    - "**/.git/**"
+    - "**/venv/**"
+    - "**/.venv/**"
+    
+    # Large data/metadata files that don't need scanning
+    - "**/model_prices_and_context_window*.json"
+    - "**/*_metadata/*.txt"
+    - "**/tokenizers/*.json"
+    - "**/tokenizers/*"
+    - "miniconda.sh"
+    
+    # Build outputs and static assets
+    - "litellm/proxy/_experimental/out/**"
+    - "ui/litellm-dashboard/public/**"
+    - "**/swagger/*.js"
+    - "**/*.woff"
+    - "**/*.woff2"
+    - "**/*.avif"
+    - "**/*.webp"
+    
+    # Test data files
+    - "**/tests/**/data_map.txt"
+    - "tests/**/*.txt"
+    
+    # Documentation and other non-code files
+    - "docs/**"
+    - "**/*.md"
+    - "**/*.lock"
+    - "uv.lock"
+    - "package-lock.json"
+
+  # Ignore security incidents with the SHA256 of the occurrence (false positives)
+  ignored_matches:
+    # === Current detected false positives (SHA-based) ===
+    
+    # gcs_pub_sub_body - folder name, not a password
+    - name: GCS pub/sub test folder name
+      match: 75f377c456eede69e5f6e47399ccee6016a2a93cc5dd11db09cc5b1359ae569a
+    
+    # os.environ/APORIA_API_KEY_1 - environment variable reference
+    - name: Environment variable reference APORIA_API_KEY_1
+      match: e2ddeb8b88eca97a402559a2be2117764e11c074d86159ef9ad2375dea188094
+    
+    # os.environ/APORIA_API_KEY_2 - environment variable reference
+    - name: Environment variable reference APORIA_API_KEY_2
+      match: 09aa39a29e050b86603aa55138af1ff08fb86a4582aa965c1bd0672e1575e052
+    
+    # oidc/circleci_v2/ - test authentication path, not a secret
+    - name: OIDC CircleCI test path
+      match: feb3475e1f89a65b7b7815ac4ec597e18a9ec1847742ad445c36ca617b536e15
+    
+    # text-davinci-003 - OpenAI model identifier, not a secret
+    - name: OpenAI model identifier text-davinci-003
+      match: c489000cf6c7600cee0eefb80ad0965f82921cfb47ece880930eb7e7635cf1f1
+    
+    # Base64 Basic Auth in test_pass_through_endpoints.py - test fixture, not a real secret
+    - name: Test Base64 Basic Auth header in pass_through_endpoints test
+      match: 61bac0491f395040617df7ef6d06029eac4d92a4457ac784978db80d97be1ae0
+    
+    # PostgreSQL password "postgres" in CI configs - standard test database password
+    - name: Test PostgreSQL password in CI configurations
+      match: 6e0d657eb1f0fbc40cf0b8f3c3873ef627cc9cb7c4108d1c07d979c04bc8a4bb
+    
+    # Bearer token in locustfile.py - test/example API key for load testing
+    - name: Test Bearer token in locustfile load test
+      match: 2a0abc2b0c3c1760a51ffcdf8d6b1d384cef69af740504b1cfa82dd70cdc7ff9
+    
+    # Inkeep API key in docusaurus.config.js - public documentation site key
+    - name: Inkeep API key in documentation config
+      match: c366657791bfb5fc69045ec11d49452f09a0aebbc8648f94e2469b4025e29a75
+    
+    # Langfuse credentials in test_completion.py - test credentials for integration test
+    - name: Langfuse test credentials in test_completion
+      match: c39310f68cc3d3e22f7b298bb6353c4f45759adcc37080d8b7f4e535d3cfd7f4
+    
+    # === Preventive patterns for test keys (pattern-based) ===
+    
+    # Test API keys (124 instances across 45 files)
+    - name: Test API keys with sk-test prefix
+      match: sk-test-
+    
+    # Mock API keys
+    - name: Mock API keys with sk-mock prefix
+      match: sk-mock-
+    
+    # Fake API keys
+    - name: Fake API keys with sk-fake prefix
+      match: sk-fake-
+    
+    # Generic test API key patterns
+    - name: Test API key patterns
+      match: test-api-key
+
+    - name: Short fake sk keys (1–9 digits only)
+      match: \bsk-\d{1,9}\b

.githooks/pre-push

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+#
+# pre-push — enforce Conventional Branches
+#   https://conventional-branch.github.io/
+#
+# Branch format:  <type>/<description>
+#   <type> must be one of: feature, bugfix, hotfix, release, chore
+#
+# Protected branches (always allowed):
+#   - main
+#   - dependabot/*
+#   - gh-readonly-queue/*
+#
+# Tag pushes and branch deletions are skipped.
+# Bypass: git push --no-verify.
+
+set -eu
+
+ZERO_OID="0000000000000000000000000000000000000000"
+ZERO_OID_SHA256="0000000000000000000000000000000000000000000000000000000000000000"
+ALLOWED_TYPES="feature|bugfix|hotfix|release|chore"
+BRANCH_PATTERN="^(${ALLOWED_TYPES})/.+"
+
+PROTECTED_NAMES="main"
+PROTECTED_PREFIXES="dependabot/ gh-readonly-queue/"
+
+is_protected() {
+    branch="$1"
+    for name in $PROTECTED_NAMES; do
+        if [ "$branch" = "$name" ]; then
+            return 0
+        fi
+    done
+    for prefix in $PROTECTED_PREFIXES; do
+        case "$branch" in "$prefix"*) return 0 ;; esac
+    done
+    return 1
+}
+
+invalid=""
+
+while read -r local_ref local_oid remote_ref remote_oid; do
+    # Branch deletion (no local commit being pushed).
+    if [ "$local_oid" = "$ZERO_OID" ] || [ "$local_oid" = "$ZERO_OID_SHA256" ]; then
+        continue
+    fi
+
+    # Only validate branch pushes; ignore tags and other ref namespaces.
+    case "$remote_ref" in
+        refs/heads/*) ;;
+        *) continue ;;
+    esac
+
+    branch="${remote_ref#refs/heads/}"
+
+    if is_protected "$branch"; then
+        continue
+    fi
+
+    if ! printf '%s' "$branch" | grep -Eq "$BRANCH_PATTERN"; then
+        invalid="$invalid $branch"
+    fi
+done
+
+if [ -n "$invalid" ]; then
+    cat >&2 <<EOF
+✗ Branch name does not follow Conventional Branches.
+
+  Invalid:$invalid
+
+  Expected: <type>/<description>
+
+  Allowed types: feature, bugfix, hotfix, release, chore
+  Examples:
+    feature/weighted-round-robin
+    bugfix/streaming-empty-chunks
+    chore/bump-deps
+    hotfix/auth-bypass
+
+  Protected (always allowed): main, dependabot/*, gh-readonly-queue/*.
+
+See https://conventional-branch.github.io/
+
+Rename with: git branch -m <new-name>
+To bypass (use sparingly): git push --no-verify
+EOF
+    exit 1
+fi
+
+exit 0

.github/AGENTS.md

@@ -1,5 +0,0 @@
-# CI
-
-Integration groups and replica runs remain in `workflows/test-integration.yml`. Do not duplicate them in another workflow.
-
-CI helpers used by existing workflows live in `scripts/ci/`. Jobs that need merge bases check out full history. Removing a CI job does not count its tests as covered. List tests that no remaining job invokes explicitly in `ci-coverage-allowlist.yml`.

.github/CODEOWNERS

@@ -1,6 +1,2 @@
-/model_prices_and_context_window.json @mateo-berri @ryan-crabbe-berri @kerry-berri @joshua-berri
-/litellm/model_prices_and_context_window_backup.json @mateo-berri @ryan-crabbe-berri @kerry-berri @joshua-berri
-/litellm/scripts/ci_cd/cost_map_pins.json @mateo-berri @ryan-crabbe-berri @kerry-berri @joshua-berri
-/litellm/deploy/helm/ @yassin-berriai
-/litellm/deploy/terraform/ @yassin-berriai
-/.github/workflows/zizmor.yml @yuneng-berri
+/model_prices_and_context_window.json @mateo-berri @ryan-crabbe-berri @kerry-berri
+/litellm/model_prices_and_context_window_backup.json @mateo-berri @ryan-crabbe-berri @kerry-berri

.github/CONTRIBUTING.md

@@ -1,388 +0,0 @@
-# Contributing to LiteLLM
-
-Thank you for your interest in contributing to LiteLLM! We welcome contributions of all kinds - from bug fixes and documentation improvements to new features and integrations.
-
-## **Checklist before submitting a PR**
-
-Here are the core requirements for any PR submitted to LiteLLM:
-
-- [ ] **Sign the Contributor License Agreement (CLA)** - [see details](#contributor-license-agreement-cla)
-- [ ] **Keep scope isolated** - Your changes should address 1 specific problem at a time
-- [ ] **Prove it works end to end** - If your change affects what the proxy or SDK does, paste the commands you ran against a live proxy and their output in the PR - [see details](#proving-your-change-works-end-to-end)
-
-#### Proxy (Backend) PRs
-
-- [ ] **Add testing** - Adding at least 1 test is a hard requirement - [see details](#adding-testing)
-- [ ] **Ensure your PR passes all checks**:
-  - [ ] [Linting / Formatting](#running-linting-and-formatting-checks) - `make lint`
-  - [ ] [The tests covering your change](#running-unit-tests) pass, e.g. `uv run pytest tests/unit/<your_test_file>.py -v`. CI runs the full unit test matrix, so you don't need to run the whole suite locally
-
-#### UI PRs
-
-- [ ] **Ensure the UI builds successfully** - `npm run build`
-- [ ] **Ensure all UI unit tests pass** - `npm run test`
-- [ ] **Add tests for new components or logic** - If you are adding a new component or new logic, add corresponding tests
-
-## **Contributor License Agreement (CLA)**
-
-Before contributing code to LiteLLM, you must sign our [Contributor License Agreement (CLA)](https://cla-assistant.io/BerriAI/litellm). This is a legal requirement for all contributions to be merged into the main repository.
-
-**Important:** We strongly recommend reviewing and signing the CLA before starting work on your contribution to avoid any delays in the PR process.
-
-## Quick Start
-
-### 1. Setup Your Local Development Environment
-
-```bash
-# Fork the repository on GitHub (click the Fork button at https://github.com/BerriAI/litellm)
-# Then clone your fork locally
-git clone https://github.com/YOUR_USERNAME/litellm.git
-cd litellm
-
-# Create a new branch for your feature (see "Commit and Branch Conventions" below)
-git checkout -b litellm_your_feature
-
-# Install development dependencies
-make install-dev
-
-# Install git hooks that enforce commit conventions (one-time, opt-in)
-make install-hooks
-
-# Verify your setup works
-make help
-```
-
-That's it! Your local development environment is ready.
-
-## Commit and Branch Conventions
-
-Commits follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/). Internal contributors name branches with the `litellm_` prefix and no `/`, and fork branches can use any name. Run `make install-hooks` once per clone to enable the local hook that enforces the commit convention. See the [contributor docs](https://docs.litellm.ai/docs/extras/contributing_code#commit-and-branch-conventions) for details
-
-### 2. Development Workflow
-
-Here's the recommended workflow for making changes:
-
-```bash
-# Make your changes to the code
-# ...
-
-# Format your code (auto-fixes formatting issues)
-make format
-
-# Run all linting checks (matches CI exactly)
-make lint
-
-# Run the tests covering your change (CI runs the full suite)
-uv run pytest tests/unit/<your_test_file>.py -v
-
-# Commit your changes (must follow Conventional Commits — see above)
-git add .
-git commit -m "feat(scope): your descriptive commit message"
-
-# Push and create a PR
-git push origin litellm_your_feature
-```
-
-## Adding Testing
-
-**Adding at least 1 test is a hard requirement for all PRs.**
-
-### Where to Add Tests
-
-Add your tests to the [`tests/unit/` directory](https://github.com/BerriAI/litellm/tree/main/tests/unit).
-
-- This directory mirrors the structure of the `litellm/` directory
-- **Only add mocked tests** - no real LLM API calls in this directory
-- For integration tests with real APIs, use the appropriate test directories
-
-Tests that call `litellm.register_model` or change `litellm.model_cost` should use the `local_model_cost_map` fixture from `tests/unit/conftest.py`. It provides a fresh catalog and restores the previous map, so pricing and capability overrides cannot leak into later tests
-
-### File Naming Convention
-
-The `tests/unit/` directory follows the same structure as `litellm/`:
-
-- `litellm/proxy/caching_routes.py` → `tests/unit/proxy/test_caching_routes.py`
-- `litellm/utils.py` → `tests/unit/test_utils.py`
-
-### Example Test
-
-```python
-import pytest
-from litellm import completion
-
-def test_your_feature():
-    """Test your feature with a descriptive docstring."""
-    # Arrange
-    messages = [{"role": "user", "content": "Hello"}]
-    
-    # Act
-    # Use mocked responses, not real API calls
-    
-    # Assert
-    assert expected_result == actual_result
-```
-
-## Running Tests and Checks
-
-### Running Unit Tests
-
-Run the tests covering your change:
-```bash
-uv run pytest tests/unit/test_your_file.py -v
-```
-
-`tests/unit` holds thousands of tests, so running all of it locally takes a long time. CI runs it as a parallel matrix (`make test-unit-llms`, `make test-unit-proxy-core`, and the other `test-unit-*` targets) on beefier boxes, so if, for whatever reason, you must run the whole suite, it's better to rely on CI to do that.
-
-If you're running broader test suites, proxy tests, or anything that touches PostgreSQL-backed fixtures/plugins, install the full local test environment first:
-
-```bash
-make install-test-deps
-```
-
-This syncs the locked test environment used across the repo, including `psycopg` v3 plus `psycopg-binary`, `psycopg2-binary` (used by some proxy E2E tests), and a generated Prisma client for DB-backed proxy tests, so pytest startup matches CI without manual package installs.
-
-### Running Linting and Formatting Checks
-
-Run all linting checks (matches CI exactly):
-
-```bash
-make lint
-```
-
-Individual linting commands:
-```bash
-make format-check       # Check ruff format formatting
-make lint-ruff          # Run Ruff linting
-make lint-basedpyright  # Run basedpyright type checking
-make check-circular-imports    # Check for circular imports
-make check-import-safety       # Check import safety
-```
-
-Apply formatting (auto-fixes issues):
-```bash
-make format
-```
-
-> **Formatting is enforced in CI.** All PRs must pass the `ruff format --check` step.
->
-> - **AI coding agents** (Claude Code, Copilot, Cursor, etc.): follow `AGENTS.md` and run `make format` before committing.
-> - **VS Code users**: Install the [Ruff extension](https://marketplace.visualstudio.com/items?itemName=charliermarsh.ruff) and enable format-on-save:
->   ```json
->   {
->     "[python]": {
->       "editor.defaultFormatter": "charliermarsh.ruff",
->       "editor.formatOnSave": true
->     }
->   }
->   ```
-
-### CI Compatibility
-
-To ensure your changes will pass CI, run the exact same checks locally:
-
-```bash
-# This runs the same checks as the GitHub workflows
-make lint
-make test-unit
-```
-
-For exact CI compatibility (pins OpenAI version like CI):
-```bash
-make install-dev-ci     # Installs exact CI dependencies
-```
-
-## Available Make Commands
-
-Run `make help` to see all available commands:
-
-```bash
-make help                       # Show all available commands
-make install-dev               # Install development dependencies
-make install-proxy-dev         # Install proxy development dependencies
-make install-test-deps         # Install the full local test environment
-make format                    # Apply ruff format code formatting
-make format-check              # Check ruff format formatting (matches CI)
-make lint                      # Run all linting checks
-make test-unit                 # Run unit tests
-make test-integration          # Run integration tests
-make test-unit-helm            # Run Helm unit tests
-```
-
-## Code Quality Standards
-
-LiteLLM follows the [Google Python Style Guide](https://google.github.io/styleguide/pyguide.html).
-
-Our automated quality checks include:
-- **Ruff** for formatting, linting, and code quality
-- **basedpyright** for static type checking
-- **Circular import detection**
-- **Import safety validation**
-
-All checks must pass before your PR can be merged.
-
-## Common Issues and Solutions
-
-### 1. Linting Failures
-
-If `make lint` fails:
-
-1. **Formatting issues**: Run `make format` to auto-fix
-2. **Ruff issues**: Check the output and fix manually
-3. **basedpyright issues**: Add proper type hints
-4. **Circular imports**: Refactor import dependencies
-5. **Import safety**: Fix any unprotected imports
-
-### 2. Test Failures
-
-If `make test-unit` fails:
-
-1. Check if you broke existing functionality
-2. Add tests for your new code
-3. Ensure tests use mocks, not real API calls
-4. Check test file naming conventions
-
-### 3. Common Development Tips
-
-- **Use type hints**: basedpyright requires proper type annotations
-- **Write descriptive commit messages**: Help reviewers understand your changes
-- **Keep PRs focused**: One feature/fix per PR
-- **Test edge cases**: Don't just test the happy path
-- **Update documentation**: If you change APIs, update docs
-
-## Proving Your Change Works End to End
-
-Tests are required, but they do not prove that your change works for a user. A PR that changes what the proxy or SDK does shows a real run in its "Screenshots / Proof of Fix" section, meaning the exact commands you sent to a live proxy and the output that came back, against real provider APIs and not mocks. `pytest` output does not count as proof, because a passing test only shows that the code does what its mocks expect. A PR that changes only docs or CI shows the rendered page or the CI run instead
-
-A good proof looks like this:
-
-1. Install the proxy dependencies with `make install-proxy-dev`, then start the proxy from your branch with a config that has the model you changed, `uv run litellm --config your_config.yaml --detailed_debug`
-2. Send the request a user would send with `curl`, and paste both the command and the response. When cost or routing is involved, include the response headers, since `x-litellm-response-cost` is what the user sees
-3. For a bug fix, do this twice, once at the merge base with BerriAI/litellm's main (`git merge-base origin/main HEAD`, with your remote for BerriAI/litellm in place of `origin` in a fork clone) to show the bug and once at your branch's latest commit to show the fix. Name both commit hashes
-4. If your change is reachable from more than one endpoint (`/v1/chat/completions`, `/v1/responses`, `/v1/messages`), show each one
-5. If the request can stream, show a `"stream": true` run too, because streaming builds usage and cost on a different path. A stream sends its headers before its usage exists, so show the `usage.cost` on the last chunk, which `/v1/chat/completions` sends when the request has `"stream_options": {"include_usage": true}` and other endpoints send with `include_cost_in_streaming_usage: true` under `litellm_settings`, or, when the proxy has a database, the request's row on the Admin UI's Logs page or `GET /spend/logs`
-6. For UI changes, add before and after screenshots and name the page
-7. If users reach your change through a coding tool such as Claude Code or Codex, drive that tool the way a user does and add before and after screenshots of it, because a `curl` or a headless run alone does not show what the user sees
-
-```bash
-curl -sD - http://localhost:4000/v1/chat/completions \
-  -H "Authorization: Bearer $LITELLM_MASTER_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"model": "your-model", "messages": [{"role": "user", "content": "hi"}]}'
-```
-
-When the provider reports its own usage or spend numbers, compare the proxy's numbers against them in the proof
-
-## Contributing an LLM Provider Integration
-
-Provider work (a new provider, a new parameter, a new usage or cost field) is the most common kind of contribution, and it is where PRs get reworked most often. Follow these rules
-
-**Preserve zero prices.** In [`model_prices_and_context_window.json`](../model_prices_and_context_window.json), an explicit `0.0` means that the priced operation is free. A missing field or `null` means no rate is specified, so the relevant calculator may use a fallback. For example, when no batch input rate is configured, batch cache writes use `cache_creation_input_token_cost` if set, otherwise the regular input rate, then apply the batch discount. A zero ordinary input rate does not make separately priced cache reads or writes free. Test `rate is None` before substituting a fallback, since `row.get("cache_creation_input_token_cost") or fallback` would discard a valid zero. Speech keeps character pricing ahead of token pricing even when the character rate is zero. If neither rate is configured, speech cost calculation raises an error. Its model lookup preserves unset rates instead of treating compatibility defaults as explicit zero prices. Perplexity keeps a configured legacy search rate ahead of the current search rate, including zero. When registering custom prices, `None` leaves an existing rate unchanged and `0.0` overrides it
-
-**Find the existing machinery before you add plumbing.** LiteLLM already has generic paths that move data between the endpoints, the provider transformations, and cost tracking. A second, hand-rolled path for the same data is a common reason a provider PR gets rewritten before merge. If you cannot find a mechanism for what you need, say so in the PR or ask in [#pr-review on Slack](https://join.slack.com/t/litellmossslack/shared_invite/zt-3o7nkuyfr-p_kbNJj8taRfXGgQI1~YyA) before you build one
-
-**Bill a new provider usage field from the usage object.** Leave the field on the usage object as an extra and read it in that provider's `cost_calculator.py`. A provider without one gets a new `cost_calculator.py` and an arm for it in `cost_per_token` (`litellm/cost_calculator.py`), which picks the calculator by provider. If the provider's transform builds `Usage` from named fields, as the Anthropic, Gemini, and Bedrock Converse ones do, pass the new field there too. Streamed requests rebuild usage in `ChunkProcessor.calculate_usage` (`litellm/litellm_core_utils/streaming_chunk_builder_utils.py`), which does not copy extras yet the way the Responses-to-chat bridge does (minus a short exclusion list), so until it does, bill the field on streams by naming it there, as Anthropic's `inference_geo` is. A provider that reports its own charge for the request, as OpenRouter does in `usage.cost`, is billed at that charge from `_hidden_params` before any calculator runs, unless the deployment sets its own prices. When the field counts a built-in tool such as web search, add the provider to `get_cost_for_web_search_request` in `litellm/llms/__init__.py`, and add a gate to `litellm/litellm_core_utils/llm_cost_calc/tool_call_cost_tracking.py` only when no existing gate fires. Then show the field's cost in your proof on every endpoint it reaches, streaming included
-
-**Do not change what a caller sees to make internals easier.** Each endpoint keeps the schema of the API it emulates. A `/v1/responses` caller gets `input_tokens` and a `/v1/chat/completions` caller gets `prompt_tokens`, whatever the provider sent and whatever cost tracking needs. A provider usage field that shows up as an extra key is fine, since it only adds a key, but renaming, removing, or reshaping a key the endpoint defines is not. Reshaping a public response to feed an internal consumer breaks every user of that endpoint
-
-## Building and Running Locally
-
-### LiteLLM Proxy Server
-
-To run the proxy server locally:
-
-```bash
-# Install proxy dependencies
-make install-proxy-dev
-
-# Start the proxy server
-uv run litellm --config your_config.yaml
-```
-
-### Docker Development
-
-If you want to build the Docker image yourself:
-
-```bash
-# Build the image (runs as a non-root user by default)
-docker build -f litellm/deploy/docker/Dockerfile -t litellm_dev .
-
-# Generate a master key. Requests send it as the bearer token
-export LITELLM_MASTER_KEY="sk-$(openssl rand -hex 32)"
-
-# Run with your config
-docker run \
-    -v $(pwd)/proxy_config.yaml:/app/config.yaml \
-    -e LITELLM_MASTER_KEY \
-    -p 4000:4000 \
-    litellm_dev \
-    --config /app/config.yaml --detailed_debug
-```
-
-## UI Development
-
-### 1. Setup Your Local UI Development Environment
-
-```bash
-# Clone the repo (if you haven't already)
-git clone https://github.com/YOUR_USERNAME/litellm.git
-cd litellm
-
-# Navigate to the UI dashboard directory
-cd litellm/ui/litellm-dashboard
-
-# Install dependencies
-npm install
-
-# Start the development server
-npm run dev
-```
-
-### 2. Adding UI Tests
-
-If you are adding a **new component** or **new logic**, you must add corresponding tests.
-
-### 3. Running UI Unit Tests
-
-```bash
-npm run test
-```
-
-### 4. Building the UI
-
-Ensure the UI builds successfully before submitting your PR:
-
-```bash
-npm run build
-```
-
-Local lint and budget checks follow origin's current default branch. They refresh it from the remote instead of trusting cached `origin/HEAD`. For an intentional comparison against another branch or commit, use `make check BASE_REF=<ref>` or the standalone gate's `--base <ref>` option. An explicit ref can also be used offline once it has been fetched locally. Without an override, unavailable remote metadata stops the check
-
-## Submitting Your PR
-
-1. **Push your branch**: `git push origin your-feature-branch`
-2. **Create a PR**: Go to GitHub and open a pull request against the repository's current default branch. Run `python3 litellm/scripts/default_branch.py --branch` to check its name
-3. **Fill out the PR template**: Provide clear description of changes
-4. **Wait for review**: Maintainers will review and provide feedback
-5. **Address feedback**: Make requested changes and push updates
-6. **Merge**: Once approved, your PR will be merged!
-
-## Getting Help
-
-If you need help:
-
-- 💬 [Join our Discord](https://discord.gg/wuPM9dRgDw)
-- 💬 [Join our Slack](https://www.litellm.ai/support)
-- 📧 Email us: ishaan@berri.ai / krrish@berri.ai
-- 🐛 [Create an issue](https://github.com/BerriAI/litellm/issues/new)
-
-## What to Contribute
-
-Looking for ideas? Check out:
-
-- 🐛 [Good first issues](https://github.com/BerriAI/litellm/labels/good%20first%20issue)
-- 🚀 [Feature requests](https://github.com/BerriAI/litellm/labels/enhancement)
-- 📚 Documentation improvements
-- 🧪 Test coverage improvements
-- 🔌 New LLM provider integrations
-
-Thank you for contributing to LiteLLM! 🚀 

.github/PULL_REQUEST_TEMPLATE/general.md

@@ -4,18 +4,6 @@
      Drop every section you have nothing to put in, heading included: a bare "## Relevant issues" or
      "## Affected release" with nothing under it must not appear in the final description -->
 
-## Handwritten 1-3 sentence description
-
-<!-- The author writes this in their own words, and it can be left empty. AI agents never write here and leave the
-     placeholder line below as is, and when updating an existing PR they keep whatever the author wrote. Keep this heading
-     Say what the PR does for users and why, then anything that keeps it working over time (a sync job, a config someone owns)
-     No bullets, tables, or code names here. Everything else goes inside the Details block below -->
-
-[insert handwritten description here]
-
-<details>
-<summary>Details</summary>
-
 ## TLDR
 
 <!-- Fill in the bullets below and keep each one short and concrete: one line per bullet, roughly 10 words max
@@ -89,11 +77,9 @@ If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slac
 ## Screenshots / Proof of Fix
 
 <!-- Include screenshots, screen recordings, or command (e.g., curl) + output demonstrating that your changes work as expected
-     Simple PR exception (2026-10-28, #49030). A mechanical change fully proven by focused checks may skip before/after e2e. Follow AGENTS.md's eligibility rule, trace callers, and verify bug-fix regression sensitivity. Record E2E exception at <tip SHA>, scope, rationale, commands and results here. Tests/static checks suffice only for this exception. Keep CI and bot gates, reassess changed diffs, and honor explicit e2e requests. Omit the Before/After scaffold for an exception
-     Otherwise proof must be fully e2e, no mocks, with real provider calls where applicable. Pytest alone is insufficient. The following format applies to live proof
-     Show only the latest proof. Before uses the merge base and After the tested tip. Rerun affected QA after behavior changes. Verified neutral diffs may carry proof with the tested SHA, current tip, equivalence reason and focused checks, following AGENTS.md and /qa
-     Use matching Before/After case headings with numbered commands and observed output. Put shared setup above them. For one case, omit case headings
-     A reviewer must be able to rerun every case from the body alone, so the shared setup gives the proxy start command, the config.yaml, env var names (never values) and the client code or curl used, all exactly as run. Wrap any block longer than about 20 lines in a collapsed <details> with a one-line summary
+     The proof must be completely e2e with no mocks, using actual LLM calls costing real $$$ if applicable. `pytest` commands are not enough
+     Show ONLY the latest run: capture Before at the merge base and After at the PR's current tip, and when new commits change behavior, replace this whole section with the fresh run instead of stacking it on top of older ones. The run must be up to date. As soon as a new commit is made and it makes this PR description's after sha stale (it's no longer tip of PR), you must re-run the QA
+     Structure the section exactly as below: Before and After one heading level below this section, each naming the commit hash it was captured at, one lower-level heading per case inside each, the same case names in the same order on both sides, and numbered steps (command, observed output) under every case, never loose prose; shared setup (config, payloads) goes above Before, and with a single case, drop the case headings and number the steps directly
 
 ### Before (<hash>)
 
@@ -178,5 +164,3 @@ Example checklists:
 ## Final Attestation
 
 - [ ] The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR
-
-</details>

.github/SECURITY.md

@@ -1,89 +0,0 @@
-# Data Privacy and Security
-
-## Security Announcements
-
-LiteLLM maintains a security announcements mailing list that is open to anyone. Subscribers receive advance notice, typically one to two days, before we release a fix for a particularly severe vulnerability or for any vulnerability exploitable by an unauthenticated attacker. This notice is provided on a best-effort basis
-
-To subscribe, visit [https://security.litellm.ai/mailinglist/](https://security.litellm.ai/mailinglist/)
-
-## Security Vulnerability Reporting Guidelines
-
-
-We value the security community's role in protecting our systems and users.
-To report a security vulnerability, please submit a report through our vulnerability disclosure form:
-
-[LiteLLM VDP](https://security.litellm.ai/vdp/)
-
-These reports are submitted to HackerOne and are triaged there, though no account is needed.
-
-**Please do not submit vulnerabilities as draft GHSAs. As of 2026-11-11 new GHSA submissions will be closed.**
-
-### Vulnerability Categories
-
-We classify vulnerabilities into the following categories:
-
-**P0: Supply Chain Attacks**
-
-Attacks that compromise our CI/CD pipeline, allowing a malicious actor to point our PyPI package or Docker images (GHCR or Docker Hub) to vulnerable or tampered artifacts.
-
-**P1: Unauthenticated Proxy Access**
-
-Application-level attacks where an unauthenticated user is able to gain access to protected data on a LiteLLM proxy instance that should be protected (e.g api keys).
-
-**P2: Authenticated Malicious Actions**
-
-Application-level attacks where an authenticated user is able to perform actions beyond their intended permissions, such as privilege escalation or unauthorized data access.
-
-### Bug Bounty Program
-
-We offer bounties for responsibly disclosed vulnerabilities based on severity:
-
-**Note that currently only P0/P1 reports are eligible for a bounty, though submissions for P2 bugs are still encouraged**
-
-| Severity | Bounty Range | Example |
-|----------|-------------|---------|
-| **Critical** | $1,500 - $3,000 | P0 supply chain compromise |
-| **High** | $500 - $1,500 | P1 unauthenticated proxy access |
-| **Medium** | N/A | P2 authenticated privilege escalation |
-| **Low** | N/A | Minor information disclosure, low-impact misconfigurations |
-
-To qualify for a bounty, reports must include clear reproduction steps, a reproduction video as described above, and must not involve systems or accounts you do not own. We review all submissions promptly and will follow up within 5 business days.
-
-### Known Non-Issues
-
-- **Misconfigurations:** attacks that require misconfiguration of the application (e.g. not setting a `master_key` on the proxy configuration).
-- **Insecure configurations:** attacks that require deliberate configuration changes to disable security functionality. (e.g. IDOR on response IDs requiring configuration of `disable_responses_id_security` to `true`)
-- **Social engineering:** attacks that rely on social engineering as their primary mechanism (e.g. convincing a user's agent to install a malicious package we did not publish).
-
-## Security Measures
-
-### LiteLLM Github
-
-- All commits run through Github's CodeQL checking
-
-### Self-hosted Instances LiteLLM
-
-- **No data or telemetry is stored on LiteLLM Servers when you self host**
-- For installation and configuration, see: [Self-hosting guided](https://docs.litellm.ai/docs/proxy/deploy)
-- **Telemetry** We run no telemetry when you self host LiteLLM
-
-### LiteLLM Cloud
-
-- We encrypt all data stored using your `LITELLM_MASTER_KEY` and in transit using TLS.
-- Our database and application run on GCP, AWS infrastructure, partly managed by NeonDB.
-    - US data region: Northern California (AWS/GCP `us-west-1`) & Virginia (AWS `us-east-1`)
-    - EU data region Germany/Frankfurt (AWS/GCP `eu-central-1`)
-- All users have access to SSO (Single Sign-On) through OAuth 2.0 with Google, Okta, Microsoft, KeyCloak. 
-- Audit Logs with retention policy
-- Control Allowed IP Addresses that can access your Cloud LiteLLM Instance
-
-For security inquiries, please contact us at security@berri.ai
-
-#### Supported data regions for LiteLLM Cloud
-
-LiteLLM supports the following data regions:
-
-- US, Northern California (AWS/GCP `us-west-1`)
-- Europe, Frankfurt, Germany (AWS/GCP `eu-central-1`)
-
-All data, user accounts, and infrastructure are completely separated between these two regions

.github/actions/cache-cargo-build/action.yml

@@ -3,7 +3,7 @@ description: >-
   Cache the Cargo registry and target directory the root package's build needs,
   so only the first job on a given Cargo.lock compiles the bridge from scratch.
 
-  litellm builds through maturin, which compiles litellm/rust/crates/python-bridge
+  litellm builds through maturin, which compiles litellm-rust/crates/python-bridge
   in the dev profile for editable installs. `uv sync` therefore pays a full build
   in every job that installs the workspace. Nothing caught it, because the uv cache
   holds wheels uv downloads rather than wheels it builds, and a path dependency
@@ -31,8 +31,8 @@ runs:
         path: |
           ~/.cargo/registry
           ~/.cargo/git
-          litellm/rust/target
-        key: ${{ runner.os }}-maturin-${{ inputs.profile }}-${{ hashFiles('litellm/rust/Cargo.lock') }}
+          litellm-rust/target
+        key: ${{ runner.os }}-maturin-${{ inputs.profile }}-${{ hashFiles('litellm-rust/Cargo.lock') }}
         restore-keys: |
           ${{ runner.os }}-maturin-${{ inputs.profile }}-
 
@@ -43,7 +43,7 @@ runs:
         path: |
           ~/.cargo/registry
           ~/.cargo/git
-          litellm/rust/target
-        key: ${{ runner.os }}-maturin-${{ inputs.profile }}-${{ hashFiles('litellm/rust/Cargo.lock') }}
+          litellm-rust/target
+        key: ${{ runner.os }}-maturin-${{ inputs.profile }}-${{ hashFiles('litellm-rust/Cargo.lock') }}
         restore-keys: |
           ${{ runner.os }}-maturin-${{ inputs.profile }}-

.github/actions/cache-go-build/action.yml

@@ -1,39 +0,0 @@
-name: "Cache the Go build"
-description: >-
-  Restore the Go module and build caches on every run and save them only from
-  main, so pull requests reuse main's cache instead of evicting it with their
-  own copies.
-
-  actions/setup-go's built-in cache saves from every ref, and a cache saved by a
-  pull request is readable only by that pull request. Callers must pass
-  `cache: false` to setup-go and run this action after it.
-
-inputs:
-  dependency-path:
-    description: "Path to the go.sum that keys the cache"
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Restore and save the Go module and build caches
-      if: github.ref == 'refs/heads/main'
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-      with:
-        path: |
-          ~/go/pkg/mod
-          ~/.cache/go-build
-        key: ${{ runner.os }}-go-${{ hashFiles(inputs.dependency-path) }}
-        restore-keys: |
-          ${{ runner.os }}-go-
-
-    - name: Restore the Go module and build caches
-      if: github.ref != 'refs/heads/main'
-      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-      with:
-        path: |
-          ~/go/pkg/mod
-          ~/.cache/go-build
-        key: ${{ runner.os }}-go-${{ hashFiles(inputs.dependency-path) }}
-        restore-keys: |
-          ${{ runner.os }}-go-

.github/actions/detect-changes/action.yml

@@ -1,7 +1,7 @@
 name: "Detect relevant changes"
 description: >-
-  Classify the pull request's changed files with .github/scripts/ci/classify_changes.sh
-  and expose decision=run|skip for one category. backend means anything outside litellm/ui/,
+  Classify the pull request's changed files with .circleci/scripts/classify_changes.sh
+  and expose decision=run|skip for one category. backend means anything outside ui/,
   docs/ and markdown; ui means the dashboard sources alone. decision=skip lets callers
   short-circuit expensive steps while the job still completes successfully and satisfies
   its required status check, which a paths: filter cannot do because a workflow that

.github/actions/restore-rust-bridge/action.yml

@@ -1,37 +0,0 @@
-name: "Restore the Rust bridge"
-description: >-
-  Restore the prebuilt Rust bridge that the unit workflow's rust-bridge job saves
-  on main, keyed on every input of the Rust build.
-
-  The bridge is abi3, so one build serves every supported Python version. A job
-  whose Rust inputs match main installs the restored wheel and native library
-  instead of compiling them inside `uv sync`. On a miss the caller builds from
-  source as before.
-
-  The restored `rust-bridge-dist` directory holds the editable litellm wheel, the
-  litellm-proxy gateway wheel, and `litellm/rust_bridge/_native.abi3.so`.
-
-outputs:
-  key:
-    description: "Cache key for the bridge built from this checkout"
-    value: ${{ steps.key.outputs.key }}
-  cache-hit:
-    description: "'true' when the bridge for this exact key was restored"
-    value: ${{ steps.restore.outputs.cache-hit }}
-
-runs:
-  using: composite
-  steps:
-    - name: Define the Rust bridge cache key
-      id: key
-      shell: bash
-      env:
-        RUST_BRIDGE_CACHE_KEY: ${{ runner.os }}-rust-bridge-editable-${{ hashFiles('litellm/rust/Cargo.lock', 'litellm/rust/Cargo.toml', 'litellm/rust/crates/**', 'model_prices_and_context_window.json', 'pyproject.toml', 'litellm/packaging/litellm-proxy/pyproject.toml') }}
-      run: echo "key=$RUST_BRIDGE_CACHE_KEY" >> "$GITHUB_OUTPUT"
-
-    - name: Restore the Rust bridge
-      id: restore
-      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-      with:
-        path: rust-bridge-dist
-        key: ${{ steps.key.outputs.key }}

.github/actions/setup-uv-with-retries/action.yml

@@ -11,11 +11,6 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Configure the Rust build environment
-      shell: bash
-      working-directory: ${{ github.workspace }}
-      run: bash .github/scripts/setup_rust_environment.sh
-
     - name: Set up uv (attempt 1)
       id: attempt-1
       continue-on-error: true

.github/ci-coverage-allowlist.yml

@@ -4,18 +4,8 @@ description: >-
   by a job nor listed here, so every entry below is a decision on the record.
 
 test_paths:
-  - reason: ran only in CircleCI, removed
-    paths:
-      - tests/e2e/migrations/test_legacy.py
-      - tests/e2e/migrations/test_pooling.py
-      - tests/e2e/migrations/test_recovery.py
-      - tests/e2e/migrations/test_rolling_upgrade.py
-      - tests/e2e/migrations/test_shaped_database.py
-      - tests/e2e/migrations/test_startup.py
-      - tests/e2e/migrations/test_upgrade.py
-      - tests/integration/database/test_roi_observed.py
   - reason: >-
-      litellm.agent() end-to-end suite. It drives the real claude, codex, opencode and pi CLIs and
+      litellm.agent() end-to-end suite. It drives the real claude, codex and opencode CLIs and
       deepagents against a live LiteLLM AI Gateway, so it needs those binaries on PATH plus
       LITELLM_PROXY_API_BASE / LITELLM_PROXY_API_KEY, and skips without them. Run manually
       before changing litellm/harness; the mocked coverage runs in tests/unit/harness and
@@ -29,7 +19,7 @@ test_paths:
       - tests/rust-python-harness
   - reason: >-
       Owned by the open pull request that moves the Rust/Python parity checks (#45135). It ran in
-      the retired build_and_test job that globbed tests/test_*.py,
+      the CircleCI build_and_test job that globbed tests/test_*.py, which this migration deletes,
       and that pull request gives it a new home
     paths:
       - tests/test_rust_python_harness.py
@@ -67,10 +57,19 @@ test_paths:
       - tests/integration/test_oci_proxy_integration.py
 
 dockerfiles:
+  - reason: >-
+      The dashboard container is a static Next.js export served by nginx, and the dashboard build
+      and lint workflows already exercise that output, so building the image adds no signal about it
+    paths:
+      - ui/Dockerfile
+  - reason: >-
+      An example image under cookbook/ that is documentation rather than a shipped artifact
+    paths:
+      - cookbook/litellm-ollama-docker-image/Dockerfile
   - reason: >-
       The Rust gateway image compiles the whole workspace in release mode, which is too slow for
       a per-pull-request job while the gateway binary is still being assembled; the Rust lint,
       clippy, and compile jobs already cover the code it packages. Revisit when the gateway is
       published
     paths:
-      - litellm/rust/crates/gateway/Dockerfile
+      - litellm-rust/crates/gateway/Dockerfile

.github/codecov.yml

@@ -1,72 +0,0 @@
-codecov:
-  require_ci_to_pass: false # post coverage status even if CI has unrelated failures
-  notify:
-    wait_for_ci: false # post as soon as expected uploads arrive, don't wait on CI
-
-ignore:
-  - "litellm/rust/**"
-
-# Flagged uploads avoid overlapping sessions on reruns.
-# Only the flags below reuse parent coverage, avoiding stale line maps elsewhere.
-flag_management:
-  default_rules:
-    carryforward: false
-  individual_flags:
-    - name: unit
-      carryforward: true
-    - name: core-packaging
-      carryforward: true
-    - name: mcp-integration
-      carryforward: true
-
-component_management:
-  individual_components:
-    - component_id: "Router"
-      paths:
-        - "router"
-    - component_id: "LLMs"
-      paths:
-        - "*/llms/*"
-    - component_id: "Caching"
-      paths:
-        - "*/caching/*"
-        - ".*redis.*"
-    - component_id: "litellm_logging"
-      paths:
-        - "*/integrations/*"
-        - ".*litellm_logging.*"
-    - component_id: "Proxy_Authentication"
-      paths:
-        - "*/proxy/auth/**"
-    - component_id: "Enterprise"
-      paths:
-        - "litellm/enterprise/**"
-    - component_id: "Batches"
-      paths:
-        - "*/proxy/batches_endpoints/**"
-        - "litellm/batches/**"
-        - "*/llms/*/batches/**"
-    - component_id: "Videos"
-      paths:
-        - "litellm/videos/**"
-        - "*/proxy/video_endpoints/**"
-        - "*/llms/*/videos/**"
-    - component_id: "Realtime"
-      paths:
-        - "litellm/realtime_api/**"
-        - "*/proxy/realtime_endpoints/**"
-        - "*/llms/*/realtime/**"
-        - "litellm/litellm_core_utils/realtime_streaming.py"
-comment:
-  layout: "header, diff, flags, components"  # show component info in the PR comment
-
-coverage:
-  status:
-    project:
-      default:
-        target: auto
-        threshold: 0% # do not allow project coverage to drop
-    patch:
-      default:
-        target: auto
-        threshold: 0% # patch coverage should be 100%

.github/gitguardian.yaml

@@ -1,105 +0,0 @@
-version: 2
-
-secret:
-  # Exclude files and paths by globbing
-  ignored_paths:
-    - "**/*.whl"
-    - "**/*.pyc"
-    - "**/__pycache__/**"
-    - "**/node_modules/**"
-    - "**/dist/**"
-    - "**/build/**"
-    - "**/.git/**"
-    - "**/venv/**"
-    - "**/.venv/**"
-    
-    # Large data/metadata files that don't need scanning
-    - "**/model_prices_and_context_window*.json"
-    - "**/*_metadata/*.txt"
-    - "**/tokenizers/*.json"
-    - "**/tokenizers/*"
-    - "miniconda.sh"
-    
-    # Build outputs and static assets
-    - "litellm/proxy/_experimental/out/**"
-    - "litellm/ui/litellm-dashboard/public/**"
-    - "**/swagger/*.js"
-    - "**/*.woff"
-    - "**/*.woff2"
-    - "**/*.avif"
-    - "**/*.webp"
-    
-    # Test data files
-    - "**/tests/**/data_map.txt"
-    - "tests/**/*.txt"
-    
-    # Documentation and other non-code files
-    - "**/*.md"
-    - "**/*.lock"
-    - "uv.lock"
-    - "package-lock.json"
-
-  # Ignore security incidents with the SHA256 of the occurrence (false positives)
-  ignored_matches:
-    # === Current detected false positives (SHA-based) ===
-    
-    # gcs_pub_sub_body - folder name, not a password
-    - name: GCS pub/sub test folder name
-      match: 75f377c456eede69e5f6e47399ccee6016a2a93cc5dd11db09cc5b1359ae569a
-    
-    # os.environ/APORIA_API_KEY_1 - environment variable reference
-    - name: Environment variable reference APORIA_API_KEY_1
-      match: e2ddeb8b88eca97a402559a2be2117764e11c074d86159ef9ad2375dea188094
-    
-    # os.environ/APORIA_API_KEY_2 - environment variable reference
-    - name: Environment variable reference APORIA_API_KEY_2
-      match: 09aa39a29e050b86603aa55138af1ff08fb86a4582aa965c1bd0672e1575e052
-    
-    # oidc/circleci_v2/ - test authentication path, not a secret
-    - name: OIDC CircleCI test path
-      match: feb3475e1f89a65b7b7815ac4ec597e18a9ec1847742ad445c36ca617b536e15
-    
-    # text-davinci-003 - OpenAI model identifier, not a secret
-    - name: OpenAI model identifier text-davinci-003
-      match: c489000cf6c7600cee0eefb80ad0965f82921cfb47ece880930eb7e7635cf1f1
-    
-    # Base64 Basic Auth in test_pass_through_endpoints.py - test fixture, not a real secret
-    - name: Test Base64 Basic Auth header in pass_through_endpoints test
-      match: 61bac0491f395040617df7ef6d06029eac4d92a4457ac784978db80d97be1ae0
-    
-    # PostgreSQL password "postgres" in CI configs - standard test database password
-    - name: Test PostgreSQL password in CI configurations
-      match: 6e0d657eb1f0fbc40cf0b8f3c3873ef627cc9cb7c4108d1c07d979c04bc8a4bb
-    
-    # Bearer token in locustfile.py - test/example API key for load testing
-    - name: Test Bearer token in locustfile load test
-      match: 2a0abc2b0c3c1760a51ffcdf8d6b1d384cef69af740504b1cfa82dd70cdc7ff9
-    
-    # Inkeep API key in docusaurus.config.js - public documentation site key
-    - name: Inkeep API key in documentation config
-      match: c366657791bfb5fc69045ec11d49452f09a0aebbc8648f94e2469b4025e29a75
-    
-    # Langfuse credentials in test_completion.py - test credentials for integration test
-    - name: Langfuse test credentials in test_completion
-      match: c39310f68cc3d3e22f7b298bb6353c4f45759adcc37080d8b7f4e535d3cfd7f4
-    
-    # === Preventive patterns for test keys (pattern-based) ===
-    
-    # Test API keys (124 instances across 45 files)
-    - name: Test API keys with sk-test prefix
-      match: sk-test-
-    
-    # Mock API keys
-    - name: Mock API keys with sk-mock prefix
-      match: sk-mock-
-    
-    # Fake API keys
-    - name: Fake API keys with sk-fake prefix
-      match: sk-fake-
-    
-    # Generic test API key patterns
-    - name: Test API key patterns
-      match: test-api-key
-
-    - name: Short fake sk keys (1–9 digits only)
-      match: \bsk-\d{1,9}\b

.github/osv-scanner.toml

@@ -1,42 +0,0 @@
-[[IgnoredVulns]]
-id = "GHSA-69hj-f68j-2879"
-ignoreUntil = 2027-02-01
-reason = "filelock UnixFileLock truncates and chmods a file another user renames or hard-links in at the lock path, in every release before 4.2.1, which needs Python >= 3.11. Python 3.11+ now locks 4.2.4 and only the Python 3.10 resolution stays on 3.20.3, held below 3.20.4 by a [tool.uv] constraint because every newer 3.10-compatible release carries more filelock advisories. litellm's CLI takes FileLock only inside ~/.litellm, which it creates owner-only, and huggingface_hub takes it in the Hugging Face cache, which litellm reaches only to download the Kimi K3 tokenizer for Bedrock token counting, so the attack needs another local user who can rename or link files in that cache. Remove once 3.10 is dropped"
-
-[[IgnoredVulns]]
-id = "GHSA-8mx5-7m5m-r77g"
-ignoreUntil = 2027-02-01
-reason = "filelock WindowsFileLock ignores mode in every release from 3.10.0 before 4.2.1, which needs Python >= 3.11. Python 3.11+ now locks 4.2.4 and only the Python 3.10 resolution stays on 3.20.3, held below 3.20.4 by a [tool.uv] constraint because every newer 3.10-compatible release carries more filelock advisories. The proxy image is Linux, so only Windows installs on Python 3.10 run it, and there litellm's CLI takes FileLock only inside the owner-only ~/.litellm, whose lock file holds no data, while huggingface_hub takes it in the Hugging Face cache, which litellm reaches only to download the Kimi K3 tokenizer. Remove once 3.10 is dropped"
-
-[[IgnoredVulns]]
-id = "GHSA-pcg2-g6cj-q92c"
-ignoreUntil = 2027-02-01
-reason = "tornado 6.6 (published 2026-10-21) is the only fix and requires Python >= 3.11, so the Python 3.10 resolution stays on 6.5.10 while 3.11+ locks 6.6; litellm starts no tornado server or client, since semantic-router and aurelio-sdk only declare it and tenacity and sentry-sdk import it only to wrap tornado code when it is present, so tornado's HTTP header parsing is never reached; remove this entry once 3.10 is dropped"
-
-[[IgnoredVulns]]
-id = "GHSA-pw9p-v7r6-gx4p"
-ignoreUntil = 2027-02-01
-reason = "tornado 6.6 (published 2026-10-21) is the only fix and requires Python >= 3.11, so the Python 3.10 resolution stays on 6.5.10 while 3.11+ locks 6.6; litellm starts no tornado server or client, since semantic-router and aurelio-sdk only declare it and tenacity and sentry-sdk import it only to wrap tornado code when it is present, so tornado's RedirectHandler is never reached; remove this entry once 3.10 is dropped"
-
-[[IgnoredVulns]]
-id = "GHSA-r4j5-9xpp-3985"
-ignoreUntil = 2027-02-01
-reason = "tornado 6.6 (published 2026-10-21) is the only fix and requires Python >= 3.11, so the Python 3.10 resolution stays on 6.5.10 while 3.11+ locks 6.6; litellm starts no tornado server or client, since semantic-router and aurelio-sdk only declare it and tenacity and sentry-sdk import it only to wrap tornado code when it is present, so tornado's chunked body reading is never reached; remove this entry once 3.10 is dropped"
-
-[[IgnoredVulns]]
-id = "GHSA-45c3-73f7-pv4m"
-ignoreUntil = 2027-02-01
-reason = "dnspython 2.9.0 (published 2026-10-09) is the only fix and requires Python >= 3.11, so the Python 3.10 resolution stays on 2.8.0 while 3.11+ locks 2.9.0; the advisory is CPU use in dns.name.from_wire_parser and litellm only reaches dnspython through pydantic EmailStr, which never does DNS lookups; remove this entry once 3.10 is dropped or a 3.10-compatible fix ships"
-
-[[IgnoredVulns]]
-id = "GHSA-mmhr-3c5m-f64f"
-ignoreUntil = 2027-02-01
-reason = "soupsieve 4.0 is the first fix and requires Python >= 3.11.5, so Python 3.10 and 3.11.0-3.11.4 resolve 2.10 while newer Python versions resolve 4.1. litellm declares beautifulsoup4 in its ci dependency group and uses BeautifulSoup in tests/code_coverage_tests/bedrock_pricing.py to parse AWS pricing HTML with html.parser and find table rows and cells, not CSS selectors; no runtime litellm code imports soupsieve or beautifulsoup4. Remove once 3.10 is dropped and the minimum Python version is at least 3.11.5"
-
-[[PackageOverrides]]
-name = "pillow"
-version = "12.3.0"
-ecosystem = "PyPI"
-vulnerability.ignore = true
-effectiveUntil = 2027-02-01
-reason = "pillow 13.0.0 requires Python >= 3.11, so the Python 3.10 resolution of the ci and dev groups and of the mlflow extra stays on 12.3.0; 3.11+ is on 13.0.0; pillow has never shipped an older-major release after the next major (no 10.x after 11.0.0, no 11.x after 12.0.0), so 13.x is the only fix line; extended to 2027-02-01 with maintainer approval, same date as every other Python 3.10 entry; remove once 3.10 is dropped"

.github/packaging/build_backend.py

@@ -1,49 +0,0 @@
-import sys
-from collections.abc import Mapping
-from pathlib import Path
-from typing import Final
-
-import maturin
-from cli_package import PACKAGE_DIR, map_wheel
-from maturin import (
-    build_sdist as build_sdist,
-)
-from maturin import (
-    get_requires_for_build_editable as get_requires_for_build_editable,
-)
-from maturin import (
-    get_requires_for_build_sdist as get_requires_for_build_sdist,
-)
-from maturin import (
-    get_requires_for_build_wheel as get_requires_for_build_wheel,
-)
-from maturin import (
-    prepare_metadata_for_build_editable as prepare_metadata_for_build_editable,
-)
-from maturin import (
-    prepare_metadata_for_build_wheel as prepare_metadata_for_build_wheel,
-)
-
-
-def build_wheel(
-    wheel_directory: str,
-    config_settings: Mapping[str, str | list[str]] | None = None,
-    metadata_directory: str | None = None,
-) -> str:
-    filename: Final = maturin.build_wheel(wheel_directory, config_settings, metadata_directory)
-    map_wheel(Path(wheel_directory) / filename)
-    return filename
-
-
-def build_editable(
-    wheel_directory: str,
-    config_settings: Mapping[str, str | list[str]] | None = None,
-    metadata_directory: str | None = None,
-) -> str:
-    filename: Final = maturin.build_editable(wheel_directory, config_settings, metadata_directory)
-    map_wheel(Path(wheel_directory) / filename, source=Path(__file__).resolve().parents[2] / PACKAGE_DIR)
-    return filename
-
-
-if __name__ == "__main__":
-    build_editable(sys.argv[1])

.github/packaging/cli_package.py

@@ -1,93 +0,0 @@
-import argparse
-import base64
-import copy
-import csv
-import hashlib
-import io
-import os
-from pathlib import Path
-from tempfile import NamedTemporaryFile
-from typing import Final
-from zipfile import ZipFile, ZipInfo
-
-PACKAGE_DIR: Final = "litellm/cli"
-PACKAGE_NAME: Final = "litellm_cli"
-
-
-def editable_support(source: Path) -> tuple[tuple[str, bytes], ...]:
-    module: Final = "_litellm_cli_editable"
-    finder: Final = (
-        "import importlib.util\nimport sys\n\n"
-        "class _Finder:\n"
-        "    @staticmethod\n"
-        "    def find_spec(fullname, path=None, target=None):\n"
-        f"        if fullname == {PACKAGE_NAME!r}:\n"
-        "            return importlib.util.spec_from_file_location(\n"
-        f"                fullname, {str(source / '__init__.py')!r},\n"
-        f"                submodule_search_locations=[{str(source)!r}])\n"
-        "        return None\n\n"
-        "sys.meta_path.insert(0, _Finder())\n"
-    )
-    return ((f"{module}.py", finder.encode()), (f"{module}.pth", f"import {module}\n".encode()))
-
-
-def _name(name: str) -> str:
-    prefix: Final = f"{PACKAGE_DIR}/"
-    return f"{PACKAGE_NAME}/{name.removeprefix(prefix)}" if name.startswith(prefix) else name
-
-
-def _info(original: ZipInfo) -> ZipInfo:
-    mapped: Final = copy.copy(original)
-    mapped.filename = _name(original.filename)
-    return mapped
-
-
-def _record(entries: tuple[tuple[ZipInfo, bytes], ...], record: str) -> bytes:
-    buffer: Final = io.StringIO(newline="")
-    writer: Final = csv.writer(buffer, lineterminator="\n")
-    writer.writerows(
-        (
-            info.filename,
-            "sha256=" + base64.urlsafe_b64encode(hashlib.sha256(data).digest()).rstrip(b"=").decode(),
-            str(len(data)),
-        )
-        for info, data in entries
-    )
-    writer.writerow((record, "", ""))
-    return buffer.getvalue().encode()
-
-
-def map_wheel(wheel: Path, *, source: Path | None = None) -> None:
-    with ZipFile(wheel) as archive:
-        records: Final = tuple(info for info in archive.infolist() if info.filename.endswith(".dist-info/RECORD"))
-        if len(records) != 1:
-            raise ValueError("A wheel must contain exactly one RECORD")
-        entries: Final = tuple(
-            (_info(info), archive.read(info))
-            for info in archive.infolist()
-            if info != records[0] and (source is None or not info.filename.startswith(f"{PACKAGE_DIR}/"))
-        )
-    additions: Final = () if source is None else tuple((ZipInfo(name), data) for name, data in editable_support(source))
-    contents: Final = (*entries, *additions)
-    names: Final = tuple(info.filename for info, _ in contents)
-    if len(names) != len(frozenset(names)):
-        raise ValueError("The CLI package mapping would overwrite a wheel member")
-    if source is None and not any(name.startswith(f"{PACKAGE_NAME}/") for name in names):
-        raise ValueError("The wheel does not contain the CLI package")
-    with NamedTemporaryFile(dir=wheel.parent, suffix=".whl", delete=False) as temporary:
-        destination: Final = Path(temporary.name)
-    try:
-        with ZipFile(destination, "w") as archive:
-            for info, data in contents:
-                archive.writestr(info, data)
-            archive.writestr(records[0], _record(contents, records[0].filename))
-        os.replace(destination, wheel)
-    finally:
-        destination.unlink(missing_ok=True)
-
-
-if __name__ == "__main__":
-    parser: Final = argparse.ArgumentParser()
-    parser.add_argument("wheels", nargs="+", type=Path)
-    for wheel in parser.parse_args().wheels:
-        map_wheel(wheel)

.github/scripts/assert_ci_coverage.py

@@ -10,7 +10,6 @@ import warnings
 from collections.abc import Callable, Iterable, Mapping, Sequence
 from dataclasses import dataclass
 from functools import lru_cache
-from itertools import chain
 from types import MappingProxyType
 from typing import Final
 
@@ -18,6 +17,7 @@ import yaml
 
 REPO_ROOT = pathlib.Path(__file__).resolve().parents[2]
 WORKFLOW_DIR = REPO_ROOT / ".github" / "workflows"
+CIRCLECI_CONFIG = REPO_ROOT / ".circleci" / "config.yml"
 ALLOWLIST_FILE = REPO_ROOT / ".github" / "ci-coverage-allowlist.yml"
 TESTS_ROOT = REPO_ROOT / "tests"
 
@@ -25,18 +25,13 @@ ALLOWLIST_KEYS = frozenset({"description", "test_paths", "dockerfiles"})
 PATH_FILTER_KEYS = frozenset({"paths", "paths-ignore"})
 TEST_PATH_KEYS = frozenset({"test-path", "test-paths", "test_path"})
 DOCKERFILE_INPUT_KEYS = frozenset({"file", "dockerfile"})
-TEST_RUNNER_RE = re.compile(r"\bpytest\b|\bhelm unittest\b|\bplaywright test\b|\bpython[0-9.]*\s")
+TEST_RUNNER_RE = re.compile(r"\bpytest\b|\bcircleci tests\b|\bhelm unittest\b|\bplaywright test\b|\bpython[0-9.]*\s")
 IMAGE_BUILD_RE = re.compile(r"\bdocker\s+(?:buildx\s+)?build\b")
-TEST_TOKEN_RE = re.compile(r"tests/[A-Za-z0-9_./*?\[\]-]+")
-IGNORE_ARG_RE: Final = re.compile(r"--(?:ignore(?:-glob)?|deselect)[= ](\S+)")
+TEST_TOKEN_RE = re.compile(r"tests/[A-Za-z0-9_./*?-]+")
+IGNORE_ARG_RE: Final = re.compile(r"--ignore(?:-glob)?[= ](\S+)")
 DOCKERFILE_TOKEN_RE = re.compile(r"[A-Za-z0-9_./-]*Dockerfile[A-Za-z0-9_.-]*")
 COMMENT_RE = re.compile(r"^\s*#.*$", re.MULTILINE)
-GLOB_CHARS = frozenset("*?[")
-DEDICATED_INTEGRATION_WORKFLOWS: Final = MappingProxyType(
-    {
-        "image-scan.yml": "tests/integration/database/image/",
-    }
-)
+GLOB_CHARS = frozenset("*?")
 
 # Trees whose jobs are sharded with no catch-all bucket, so every child that holds
 # tests has to be named by some shard or it runs nowhere. A child listed here is
@@ -119,7 +114,9 @@ def _scalars(node: object, key: str) -> tuple[Scalar, ...]:
 
 
 def _config_files() -> tuple[pathlib.Path, ...]:
-    return tuple(sorted(path for path in WORKFLOW_DIR.iterdir() if path.suffix in (".yml", ".yaml")))
+    workflows = tuple(sorted(path for path in WORKFLOW_DIR.iterdir() if path.suffix in (".yml", ".yaml")))
+    circleci = (CIRCLECI_CONFIG,) if CIRCLECI_CONFIG.is_file() else ()
+    return workflows + circleci
 
 
 def _all_scalars() -> tuple[Scalar, ...]:
@@ -245,6 +242,7 @@ def _describe(paths: tuple[str, ...]) -> str:
     return f"{len(paths)} test file(s) invoked by no job: {names}{suffix}"
 
 
+GLOB_CALL_RE = re.compile(r'circleci tests glob "([^"]+)"')
 KEYWORD_RE = re.compile(r"-k\s+\\?[\"']([^\"'\\]+)")
 
 
@@ -317,14 +315,16 @@ def _keyword_terms(
 
 
 def _slices() -> tuple[Slice, ...]:
+    if not CIRCLECI_CONFIG.exists():
+        return ()
     test_files: Final = frozenset(_test_files())
+    jobs: Final = yaml.safe_load(CIRCLECI_CONFIG.read_text()).get("jobs", {})
     return tuple(
-        Slice(job=f"{path.name}:{job}", globs=globs, named=named, required=required, excluded=excluded, understood=understood)
-        for path in _config_files()
-        for job, body in yaml.safe_load(path.read_text()).get("jobs", {}).items()
+        Slice(job=job, globs=globs, named=named, required=required, excluded=excluded, understood=understood)
+        for job, body in jobs.items()
         for text in ("\n".join(_strings(body)),)
         if "pytest" in text
-        for globs in (tuple(token for token in TEST_TOKEN_RE.findall(text) if GLOB_CHARS & set(token)),)
+        for globs in (tuple(GLOB_CALL_RE.findall(text)),)
         for named in (frozenset(TEST_TOKEN_RE.findall(text)) & test_files,)
         for required, excluded, understood in (
             _keyword_terms(tuple(KEYWORD_RE.findall(text)), attributable=len(globs) < 2),
@@ -351,11 +351,16 @@ def _matchable_names(relative_path: str) -> frozenset[str]:
 
 
 def _workflow_named_tokens() -> frozenset[str]:
+    """Test tokens a GitHub Actions job names directly.
+
+    A CircleCI `-k` that deselects a file no longer means the file runs nowhere once a
+    workflow names it, so the slice check has to credit those the same way the census does.
+    """
     return _invoked_test_tokens(
         scalar
         for path in _config_files()
+        if path != CIRCLECI_CONFIG
         for scalar in _scalars(yaml.safe_load(path.read_text(encoding="utf-8")), path.name)
-        if not KEYWORD_RE.search(scalar.value)
     )
 
 
@@ -555,33 +560,7 @@ def _integration_github_files(runner: pathlib.Path) -> frozenset[str]:
     return frozenset(ast.literal_eval(values))
 
 
-def _owns(workflow: str, relative_path: str) -> bool:
-    owned_root: Final = DEDICATED_INTEGRATION_WORKFLOWS.get(workflow)
-    return owned_root is not None and relative_path.startswith(owned_root)
-
-
-def _expression_suites(value: str) -> tuple[str, ...]:
-    suites: Final = chain.from_iterable(map(json.loads, re.findall(r"'(\[[^']*\])'", value)))
-    return tuple(suite for suite in suites if isinstance(suite, str) and "{" not in suite)
-
-
-def _matrix_suites(value: object) -> tuple[str, ...]:
-    if isinstance(value, list):
-        return tuple(suite for suite in value if isinstance(suite, str))
-    if isinstance(value, str):
-        return _expression_suites(value)
-    return ()
-
-
-def _tokens_outside_owner(relative_path: str, workflow_tokens: Mapping[str, frozenset[str]]) -> frozenset[str]:
-    return frozenset[str]().union(
-        *(tokens for workflow, tokens in workflow_tokens.items() if not _owns(workflow, relative_path))
-    )
-
-
-def _integration_ownership(
-    repo_root: pathlib.Path = REPO_ROOT, *, allowlist: Allowlist | None = None
-) -> tuple[frozenset[str], tuple[Finding, ...]]:
+def _integration_ownership(repo_root: pathlib.Path = REPO_ROOT) -> tuple[frozenset[str], tuple[Finding, ...]]:
     runner: Final = repo_root / "tests/integration/run.py"
     if not runner.exists():
         return frozenset(), ()
@@ -598,19 +577,26 @@ def _integration_ownership(
     browser_manifest: Final = repo_root / "tests/e2e/ui/tests/integrationCritical/expected.json"
     browser_nodes: Final = json.loads(browser_manifest.read_text()) if browser_manifest.exists() else ()
     browser_paths: Final = frozenset(node.split("::", 1)[0] for node in browser_nodes)
-    integration_path: Final = repo_root / ".github/workflows/test-integration.yml"
-    integration: Final = yaml.safe_load(integration_path.read_text()) if integration_path.exists() else {}
-    integration_jobs: Final = integration.get("jobs", {})
+    circle_path: Final = repo_root / ".circleci/config.yml"
+    circle: Final = yaml.safe_load(circle_path.read_text()) if circle_path.exists() else {}
+    circle_test_path_tokens: Final = _invoked_test_tokens(
+        scalar for scalar in _scalars(circle, "config.yml") if scalar.key == "test_path"
+    )
+    steps: Final = circle.get("jobs", {}).get("integration_contracts", {}).get("steps", ())
     invoked: Final = any(
-        ".github/scripts/ci/run_integration.sh" in scalar.value
-        for scalar in _scalars(integration_jobs, "integration")
-        if scalar.key == "run"
+        ".circleci/scripts/run_integration.sh" in scalar.value
+        for scalar in _scalars(steps, "integration_contracts")
+        if scalar.key == "command"
     )
     scheduled: Final = frozenset(
         suite
-        for body in integration_jobs.values()
-        if any(".github/scripts/ci/run_integration.sh" in scalar.value for scalar in _scalars(body, "integration"))
-        for suite in _matrix_suites(body.get("strategy", {}).get("matrix", {}).get("suite", ()))
+        for job in circle.get("workflows", {}).get("integration", {}).get("jobs", ())
+        if isinstance(job, dict) and "integration_contracts" in job
+        for suite in job["integration_contracts"]
+        .get("matrix", {})
+        .get("parameters", {})
+        .get("suite", (job["integration_contracts"].get("suite"),))
+        if isinstance(suite, str)
     )
     required: Final = (frozenset({"browser"}) if browser_paths else frozenset()) | frozenset(
         group
@@ -625,50 +611,31 @@ def _integration_ownership(
         )
         != 1
     )
-    workflow_tokens: Final = MappingProxyType(
-        {
-            path.name: _invoked_test_tokens(_scalars(yaml.safe_load(path.read_text()), path.name))
-            for path in (repo_root / ".github/workflows").glob("*.y*ml")
-        }
-    )
-    gha_tokens: Final = frozenset[str]().union(*workflow_tokens.values())
-    invoked_github_files: Final = frozenset(
-        path for path in github_files if any(_token_covers(token, path) for token in gha_tokens)
-    )
-    grouped: Final = (
-        frozenset(str(path.relative_to(repo_root)) for path in integration_root.rglob("test_*.py")) - github_files
+    gha_tokens: Final = _invoked_test_tokens(
+        scalar
+        for path in (repo_root / ".github/workflows").glob("*.y*ml")
+        for scalar in _scalars(yaml.safe_load(path.read_text()), path.name)
     )
     findings: Final = (
         tuple(
-            Finding(path, "integration file outside GITHUB_FILES is selected by GitHub Actions")
-            for path in sorted(grouped)
-            if any(
-                _token_covers(token, path)
-                for workflow, tokens in workflow_tokens.items()
-                if workflow != "test-integration.yml"
-                for token in tokens
-            )
+            Finding(path, "integration contract is also selected by GitHub Actions")
+            for path in paths
+            if any(_token_covers(token, path) for token in gha_tokens)
         )
         + tuple(
             Finding(path, "GitHub-owned integration contract has no invoking job")
             for path in sorted(github_files)
-            if path not in invoked_github_files and not (allowlist is not None and allowlist.covers_test(path))
+            if not any(_token_covers(token, path) for token in gha_tokens | circle_test_path_tokens)
         )
         + tuple(
             Finding(path, "GitHub-owned integration file is missing")
             for path in sorted(github_files)
             if not (repo_root / path).is_file()
         )
-        + tuple(
-            Finding(path, "GitHub-owned integration contract runs outside a dedicated integration workflow")
-            for path in sorted(github_files)
-            if any(_token_covers(token, path) for token in _tokens_outside_owner(path, workflow_tokens))
-        )
     )
     browser_commands: Final = tuple(
         scalar.value
         for path in (repo_root / ".github/workflows").glob("*.y*ml")
-        if path.name != "test-integration.yml"
         for scalar in _scalars(yaml.safe_load(path.read_text()), path.name)
         if scalar.key in {"run", "command"}
     )
@@ -701,14 +668,14 @@ def _integration_ownership(
         else ()
     )
     group_findings: Final = tuple(
-        Finding(group, "canonical integration group is not scheduled by GitHub Actions")
+        Finding(group, "canonical integration group is not scheduled by CircleCI")
         for group in sorted(required - scheduled)
     ) + tuple(Finding(path, "canonical node must have exactly one integration group") for path in sorted(ungrouped))
     if not paths or not invoked or not scheduled:
         return frozenset(), findings + (
-            Finding(str(runner.relative_to(repo_root)), "dedicated GitHub Actions runner is missing"),
+            Finding(str(runner.relative_to(repo_root)), "dedicated CircleCI runner is missing"),
         )
-    return paths | browser_paths | invoked_github_files, findings + group_findings + browser_findings + exclusion_findings
+    return paths | browser_paths | github_files, findings + group_findings + browser_findings + exclusion_findings
 
 
 def main() -> int:
@@ -720,10 +687,14 @@ def main() -> int:
     allowlist = _load_allowlist()
     scalars = _all_scalars()
 
-    integration_paths, ownership_findings = _integration_ownership(allowlist=allowlist)
-    test_findings = _uncovered_tests(
-        allowlist,
-        _invoked_selections(scalars) + (Selection(included=integration_paths, ignored=frozenset()),),
+    integration_paths, ownership_findings = _integration_ownership()
+    test_findings = (
+        _uncovered_tests(
+            allowlist,
+            _invoked_selections(scalars)
+            + (Selection(included=integration_paths, ignored=frozenset()),),
+        )
+        + ownership_findings
     )
     dockerfile_findings = _uncovered_dockerfiles(allowlist, _built_dockerfile_tokens(scalars))
     stale_findings = _stale_allowlist_paths(allowlist, test_files=_test_files(), dockerfiles=_dockerfiles())
@@ -740,25 +711,13 @@ def main() -> int:
             test_findings,
             "Add each to a job's test path, or list it in .github/ci-coverage-allowlist.yml with a reason.",
         )
-    if ownership_findings:
-        browser_remedy = (
-            " The browser group in test-integration.yml owns the integrationCritical Playwright contracts. "
-            "Other workflows and the default Playwright config must exclude them."
-            if any("browser" in finding.detail or "Playwright" in finding.detail for finding in ownership_findings)
-            else ""
-        )
-        _report(
-            "integration contracts with the wrong CI owner",
-            ownership_findings,
-            "Follow tests/integration/AGENTS.md, which says which CI job owns each integration file." + browser_remedy,
-        )
     if dockerfile_findings:
         _report(
             "Dockerfiles that no CI job builds",
             dockerfile_findings,
             "Build each in a workflow, or list it in .github/ci-coverage-allowlist.yml with a reason.",
         )
-    if stale_findings or test_findings or ownership_findings or dockerfile_findings:
+    if stale_findings or test_findings or dockerfile_findings:
         return 1
 
     _write(

.github/scripts/ci/classify_changes.sh

@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-set -uo pipefail
-
-category="${1:?usage: classify_changes.sh <backend|client|ui|cost-map-only|mcp-dependencies|windows-release|redis-compat>}"
-
-has_client=false
-has_backend=false
-has_ci=false
-has_cost_map=false
-has_mcp_dependencies=false
-has_windows_release=false
-has_redis_compat=false
-outside_cost_map_set=false
-while IFS= read -r file || [ -n "$file" ]; do
-  [ -n "$file" ] || continue
-  case "$file" in
-    litellm/_redis.py | litellm/_redis_credential_provider.py | litellm/caching/redis_cache.py | litellm/caching/evicted_client_closer.py | tests/unit/test_redis.py | tests/integration/sdk/test_redis_cluster_iam_auth.py | tests/unit/caching/test_redis_connection_pool.py | tests/unit/caching/test_redis_cluster_cache.py | tests/unit/caching/test_evicted_client_closer.py | .github/workflows/test-unit.yml | .github/actions/detect-changes/* | .github/scripts/detect_changes.sh | .github/scripts/ci/classify_changes.sh | tests/integration/run.py | pyproject.toml | uv.lock)
-      has_redis_compat=true ;;
-  esac
-  case "$file" in
-    *.md | *.mdx) : ;;
-    pyproject.toml | */pyproject.toml | uv.lock | uv.toml | .python-version | litellm/rust/* | litellm/__init__.py | litellm/proxy/proxy_server.py | litellm/*mcp* | tests/*mcp* | litellm/integrations/arize/* | tests/base_sdk_tests/* | litellm/scripts/check_mcp_sdk_install.py | .github/workflows/test-mcp-dependency-resolution.yml | .github/actions/detect-changes/* | .github/actions/setup-uv-with-retries/* | .github/actions/cache-cargo-build/* | .github/scripts/detect_changes.sh | .github/scripts/uv_sync_with_retries.sh | .github/scripts/ci/classify_changes.sh | tests/unit/test_ci_path_filter.py | tests/unit/test_detect_changes.py)
-      has_mcp_dependencies=true ;;
-  esac
-  case "$file" in
-    litellm/rust/* | litellm/rust_bridge/* | pyproject.toml | uv.lock | tests/windows_tests/* | .github/scripts/ci/* | .github/actions/*)
-      has_windows_release=true ;;
-  esac
-  case "$file" in
-    litellm/ui/* | tests/e2e/ui/*) has_client=true ;;
-    *.md | *.mdx) : ;;
-    .github/*) has_ci=true; has_backend=true ;;
-    *) has_backend=true ;;
-  esac
-  case "$file" in
-    model_prices_and_context_window.json | litellm/model_prices_and_context_window_backup.json)
-      has_cost_map=true ;;
-    tests/unit/proxy/*) : ;;
-    *) outside_cost_map_set=true ;;
-  esac
-done
-
-case "$category" in
-  mcp-dependencies)
-    [ "$has_mcp_dependencies" = true ] && echo run || echo skip
-    ;;
-  cost-map-only)
-    { [ "$has_cost_map" = true ] && [ "$outside_cost_map_set" = false ]; } && echo run || echo skip
-    ;;
-  windows-release)
-    [ "$has_windows_release" = true ] && echo run || echo skip
-    ;;
-  redis-compat)
-    [ "$has_redis_compat" = true ] && echo run || echo skip
-    ;;
-  backend)
-    [ "$has_backend" = true ] && echo run || echo skip
-    ;;
-  client)
-    { [ "$has_client" = true ] || [ "$has_backend" = true ]; } && echo run || echo skip
-    ;;
-  ui)
-    { [ "$has_client" = true ] || [ "$has_ci" = true ]; } && echo run || echo skip
-    ;;
-  *)
-    echo run
-    ;;
-esac

.github/scripts/detect_changes.sh

@@ -16,7 +16,7 @@ run_full() {
 }
 
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-classify="${here}/ci/classify_changes.sh"
+classify="${here}/../../.circleci/scripts/classify_changes.sh"
 
 [ -n "${PR_NUMBER:-}" ] || run_full "not a pull_request event"
 [ -n "${REPO:-}" ] || run_full "no repository in the environment"

.github/scripts/setup_rust_environment.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-root=$(git rev-parse --show-toplevel)
-toolchain=$(sed -n 's/^[[:space:]]*channel[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' "$root/litellm/rust/rust-toolchain.toml")
-test -n "$toolchain"
-rustup toolchain install "$toolchain" --profile minimal --component rustfmt --component clippy --no-self-update
-{
-  echo "RUSTUP_TOOLCHAIN=$toolchain"
-  echo "CARGO_NET_RETRY=5"
-  echo "CARGO_HTTP_MULTIPLEXING=false"
-  echo "SQLX_OFFLINE=${SQLX_OFFLINE:-true}"
-} >> "${GITHUB_ENV:?GITHUB_ENV is required}"

.github/scripts/smoke_test_native_wheel.py

@@ -7,8 +7,6 @@ import zipfile
 from pathlib import Path
 from typing import Final
 
-COST_MAP: Final = Path(__file__).resolve().parents[2] / "model_prices_and_context_window.json"
-
 CHILD_SCRIPT: Final = """
 from importlib.util import module_from_spec, spec_from_file_location
 from pathlib import Path
@@ -36,9 +34,6 @@ else:
 after = module.gil_stats()
 if not isinstance(after.get("releases"), int):
     raise AssertionError(f"native module unusable after panic: {after!r}")
-
-if module.bundled_model_cost_map() != Path(sys.argv[2]).read_bytes():
-    raise AssertionError("the wheel embeds a different model_prices_and_context_window.json than this checkout")
 """
 
 
@@ -60,9 +55,7 @@ def main() -> int:
 
         native_path: Final = Path(temporary_directory) / Path(native_members[0].filename).name
         native_path.write_bytes(archive.read(native_members[0]))
-        result: Final = subprocess.run(
-            (sys.executable, "-c", CHILD_SCRIPT, str(native_path), str(COST_MAP)), check=False
-        )
+        result: Final = subprocess.run((sys.executable, "-c", CHILD_SCRIPT, str(native_path)), check=False)
 
     if result.returncode != 0:
         sys.stderr.write(f"native wheel smoke test exited with status {result.returncode}\n")

.github/scripts/verify_linux_native_wheel.py

@@ -128,20 +128,6 @@ def main(
             member.filename
             for member in wheel_members
             if member.filename.endswith((".pdb", ".dwp", ".rlib", ".rmeta", "Cargo.toml", "Cargo.lock"))
-            or member.filename.startswith(
-                (
-                    "litellm/deploy/",
-                    "litellm/ui/",
-                    "litellm/vscode-extension/",
-                    "litellm/enterprise/",
-                    "litellm/proxy-extras/",
-                    "litellm/rust/",
-                    "litellm/packaging/",
-                    "litellm/scripts/",
-                    "litellm/runtime/",
-                    "litellm/schema.prisma",
-                )
-            )
             or any(part.endswith(".dSYM") for part in PurePosixPath(member.filename).parts)
         )
         native_member: Final = native_members[0]
@@ -228,7 +214,7 @@ def main(
     native_module: Final = load_native_module(native_path)
     native_module_loads: Final = native_module is not None
     panic_test_hook_absent: Final = native_module is not None and not hasattr(native_module, "_panic_for_test")
-    native_size_limit: Final = 55_000_000
+    native_size_limit: Final = 48_000_000
     native_size_within_limit: Final = native_member.file_size <= native_size_limit
     validations: Final = (
         (f"Python tag is {EXPECTED_PYTHON_TAG}", python_tag == EXPECTED_PYTHON_TAG),

.github/semgrep/rules/README.md

@@ -1,22 +0,0 @@
-# Custom Semgrep rules for LiteLLM
-
-Add custom rule YAML files here. Semgrep loads all `.yml`/`.yaml` files under this directory.
-
-**Run only custom rules (CI / fail on findings):**
-
-```bash
-semgrep scan --config .github/semgrep/rules . --error
-```
-
-**Run with registry + custom rules:**
-
-```bash
-semgrep scan --config auto --config .github/semgrep/rules .
-```
-
-**Layout:**
-
-- `python/` – Python-specific rules (security, patterns)
-- Add more subdirs as needed (e.g. `generic/` for language-agnostic rules)
-
-See [Semgrep rule syntax](https://semgrep.dev/docs/writing-rules/rule-syntax/).

.github/workflows/auto-close-duplicates.yml

@@ -16,8 +16,8 @@ on:
   pull_request:
     paths:
       - .github/workflows/auto-close-duplicates.yml
-      - litellm/scripts/auto-close-duplicates.ts
-      - litellm/scripts/auto-close-duplicates.test.ts
+      - scripts/auto-close-duplicates.ts
+      - scripts/auto-close-duplicates.test.ts
 
 permissions: {}
 
@@ -40,7 +40,7 @@ jobs:
           bun-version: "1.4.0"
 
       - name: Test the sweep
-        run: bun test litellm/scripts/auto-close-duplicates.test.ts
+        run: bun test scripts/auto-close-duplicates.test.ts
 
   sweep:
     if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm'
@@ -62,7 +62,7 @@ jobs:
           bun-version: "1.4.0"
 
       - name: Close unanswered duplicates, reopen ones the reporter answered
-        run: bun run litellm/scripts/auto-close-duplicates.ts
+        run: bun run scripts/auto-close-duplicates.ts
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DRY_RUN: ${{ inputs.dry_run == true }}

.github/workflows/check-schema-sync.yml

@@ -3,9 +3,9 @@ name: Check Schema Sync
 on:
   pull_request:
     paths:
-      - 'litellm/schema.prisma'
+      - 'schema.prisma'
       - 'litellm/proxy/schema.prisma'
-      - 'litellm/proxy-extras/litellm_proxy_extras/schema.prisma'
+      - 'litellm-proxy-extras/litellm_proxy_extras/schema.prisma'
 
 permissions:
   contents: read
@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   check-sync:
-    name: Verify litellm/schema.prisma copies match the canonical schema
+    name: Verify schema.prisma copies match root
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -27,7 +27,7 @@ jobs:
 
       - name: Reject symlinked schema files
         run: |
-          for f in litellm/schema.prisma litellm/proxy/schema.prisma litellm/proxy-extras/litellm_proxy_extras/schema.prisma; do
+          for f in schema.prisma litellm/proxy/schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma; do
             if [ -L "$f" ]; then
               echo "::error file=$f::$f is a symlink, which is not allowed"
               exit 1
@@ -38,24 +38,24 @@ jobs:
         run: |
           EXIT=0
 
-          diff litellm/schema.prisma litellm/proxy/schema.prisma || {
-            echo "::error file=litellm/proxy/schema.prisma::litellm/proxy/schema.prisma differs from root litellm/schema.prisma"
+          diff schema.prisma litellm/proxy/schema.prisma || {
+            echo "::error file=litellm/proxy/schema.prisma::litellm/proxy/schema.prisma differs from root schema.prisma"
             EXIT=1
           }
 
-          diff litellm/schema.prisma litellm/proxy-extras/litellm_proxy_extras/schema.prisma || {
-            echo "::error file=litellm/proxy-extras/litellm_proxy_extras/schema.prisma::litellm/proxy-extras/litellm_proxy_extras/schema.prisma differs from root litellm/schema.prisma"
+          diff schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma || {
+            echo "::error file=litellm-proxy-extras/litellm_proxy_extras/schema.prisma::litellm-proxy-extras/litellm_proxy_extras/schema.prisma differs from root schema.prisma"
             EXIT=1
           }
 
           if [ "$EXIT" -ne 0 ]; then
             echo ""
             echo "Schema files are out of sync."
-            echo "The root litellm/schema.prisma is the source of truth."
+            echo "The root schema.prisma is the source of truth."
             echo ""
             echo "To fix, run from the repo root:"
-            echo "  cp litellm/schema.prisma litellm/proxy/schema.prisma"
-            echo "  cp litellm/schema.prisma litellm/proxy-extras/litellm_proxy_extras/schema.prisma"
+            echo "  cp schema.prisma litellm/proxy/schema.prisma"
+            echo "  cp schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma"
             exit 1
           fi
 

.github/workflows/compat-matrix-image.yml

@@ -4,7 +4,7 @@ on:
   pull_request:
     paths:
       - tests/e2e/claude_code/cron_vm/**
-      - tests/e2e/cli_harness/npm_version_resolver.py
+      - tests/e2e/claude_code/pr_gate_version_resolver.py
       - .github/workflows/compat-matrix-image.yml
   workflow_dispatch:
 
@@ -26,24 +26,17 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Install the pinned uv the cron image ships
-        env:
-          UV_VERSION: 0.10.9
-          UV_SHA256: 20d79708222611fa540b5c9ed84f352bcd3937740e51aacc0f8b15b271c57594
-        run: |
-          set -euo pipefail
-          curl -fsSLo "$RUNNER_TEMP/uv.tar.gz" "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz"
-          echo "${UV_SHA256}  $RUNNER_TEMP/uv.tar.gz" | sha256sum -c -
-          mkdir -p "$RUNNER_TEMP/bin"
-          tar -xzf "$RUNNER_TEMP/uv.tar.gz" -C "$RUNNER_TEMP/bin" --strip-components=1 uv-x86_64-unknown-linux-gnu/uv
-          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - name: Build the Render cron image
+        run: docker build -f tests/e2e/claude_code/cron_vm/Dockerfile -t compat-matrix:${{ github.sha }} tests/e2e
 
-      - name: Resolve and install the Claude Code CLI as an unprivileged user
+      - name: Resolve and install the Claude Code CLI as the cron user
         run: |
-          set -euo pipefail
-          whoami
-          gh --version
-          uv --version
-          version="$(uv run --no-project --python 3.12 python tests/e2e/cli_harness/npm_version_resolver.py @anthropic-ai/claude-code)"
-          tests/e2e/claude_code/cron_vm/install_claude_code.sh "${version}" "$RUNNER_TEMP/claude-cli"
-          "$RUNNER_TEMP/claude-cli/claude" --version
+          docker run --rm compat-matrix:${{ github.sha }} bash -c '
+            set -euo pipefail
+            whoami
+            gh --version
+            uv --version
+            version="$(uv run --no-project --python 3.12 python /opt/litellm/tests/e2e/claude_code/pr_gate_version_resolver.py)"
+            /opt/litellm/tests/e2e/claude_code/cron_vm/install_claude_code.sh "${version}" /tmp/claude-cli
+            /tmp/claude-cli/claude --version
+          '

.github/workflows/conventional-commits.yml

@@ -3,7 +3,7 @@ name: Conventional PR Title
 # Squash-merge replaces the merge commit subject with the PR title, so
 # enforcing Conventional Commits at the PR-title level is what actually gates
 # the commits that land on the default branch. The local commit-msg hook
-# (litellm/scripts/githooks/commit-msg) is a best-effort assist; this workflow is the gate.
+# (.githooks/commit-msg) is a best-effort assist; this workflow is the gate.
 #
 # See https://www.conventionalcommits.org/en/v1.0.0/
 
@@ -28,7 +28,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          # Must mirror the type list in litellm/scripts/githooks/commit-msg.
+          # Must mirror the type list in .githooks/commit-msg.
           types: |
             feat
             fix

.github/workflows/cost-map-guard.yml

@@ -1,14 +1,13 @@
 name: Cost map guard
 
-on:
-  pull_request:
+on: # zizmor: ignore[dangerous-triggers] runs the base branch's code only; the PR's cost map files are read as data and never executed
+  pull_request_target:
     branches:
       - main
       - "litellm_**"
 
 permissions:
   contents: read
-  pull-requests: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
@@ -20,23 +19,17 @@ jobs:
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
-          ref: ${{ github.event.pull_request.base.sha }}
           persist-credentials: false
-      - name: Check out the base branch tip and fetch the pull request head and its merge base
+      - name: Fetch the pull request head and its merge base
         id: revisions
         env:
           GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          base_ref="$(gh api "repos/${GITHUB_REPOSITORY}/branches/${EVENT_BASE_REF}" --jq .name)" || base_ref="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .base.ref)"
-          target="$(gh api "repos/${GITHUB_REPOSITORY}/branches/${base_ref}" --jq '.commit.sha')"
-          merge_base="$(gh api "repos/${GITHUB_REPOSITORY}/compare/${target}...${HEAD_SHA}" --jq '.merge_base_commit.sha')"
-          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA" "$target"
-          git checkout -q --detach "$target"
+          merge_base="$(gh api "repos/${GITHUB_REPOSITORY}/compare/${BASE_SHA}...${HEAD_SHA}" --jq '.merge_base_commit.sha')"
+          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
           echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
-          echo "target=$target" >> "$GITHUB_OUTPUT"
       - name: Set up uv
         uses: ./.github/actions/setup-uv-with-retries
         with:
@@ -44,38 +37,7 @@ jobs:
       - name: Run the guard
         env:
           MERGE_BASE: ${{ steps.revisions.outputs.merge_base }}
-          COST_MAP_GUARD_TARGET: ${{ steps.revisions.outputs.target }}
-          COST_MAP_GUARD_AUTHOR_TYPE: ${{ github.event.pull_request.user.type }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           HEAD_REF: ${{ github.event.pull_request.head.ref }}
         run: |
-          guard=litellm/scripts/ci_cd/cost_map_guard.py
-          # TODO: Drop the legacy path after this lands on main.
-          if [ ! -f "$guard" ]; then
-            guard=scripts/ci_cd/cost_map_guard.py
-          fi
-          if [ ! -f "$guard" ]; then
-            guard=ci_cd/cost_map_guard.py
-          fi
-          uv run --no-project python "$guard" --base "$MERGE_BASE" --head "$HEAD_SHA" --head-ref "$HEAD_REF"
-      - name: Check whether the pull request changes the cost map
-        id: changed
-        env:
-          MERGE_BASE: ${{ steps.revisions.outputs.merge_base }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          if git diff --quiet "$MERGE_BASE" "$HEAD_SHA" -- model_prices_and_context_window.json; then
-            echo "cost_map=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "cost_map=true" >> "$GITHUB_OUTPUT"
-          fi
-      - if: steps.changed.outputs.cost_map == 'true'
-        run: rustup toolchain install --no-self-update
-      - name: Load the cost map through model-catalog
-        if: steps.changed.outputs.cost_map == 'true'
-        env:
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          git show "${HEAD_SHA}:model_prices_and_context_window.json" > "$RUNNER_TEMP/model_prices_and_context_window.json"
-          cargo run --locked --quiet --manifest-path litellm/rust/Cargo.toml -p litellm-model-catalog --bin check-registry \
-            -- "$RUNNER_TEMP/model_prices_and_context_window.json"
+          uv run --frozen python ci_cd/cost_map_guard.py --base "$MERGE_BASE" --head "$HEAD_SHA" --head-ref "$HEAD_REF"

.github/workflows/cost-map-pins-recheck.yml

@@ -1,91 +0,0 @@
-name: Cost map pins recheck
-
-on:
-  push:
-    branches:
-      - main
-      - "litellm_**"
-    paths:
-      - model_prices_and_context_window.json
-      - litellm/model_prices_and_context_window_backup.json
-      - litellm/scripts/ci_cd/cost_map_pins.json
-
-permissions: {}
-
-jobs:
-  rerun-cost-map-guard:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      actions: write
-      contents: read
-      pull-requests: read
-    steps:
-      - name: Re-run the cost map guard on open pull requests the push could break
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BASE_REF: ${{ github.ref_name }}
-          BEFORE_SHA: ${{ github.event.before }}
-          AFTER_SHA: ${{ github.event.after }}
-          FORCED: ${{ github.event.forced }}
-          COST_MAP_PATHS: '["model_prices_and_context_window.json", "litellm/model_prices_and_context_window_backup.json", "litellm/scripts/ci_cd/cost_map_pins.json"]'
-          PINS_PATHS: '["litellm/scripts/ci_cd/cost_map_pins.json"]'
-        run: |
-          if [[ "$BEFORE_SHA" =~ ^0+$ || "$FORCED" == true ]] \
-            || ! gh api "repos/${GITHUB_REPOSITORY}/compare/${BEFORE_SHA}...${AFTER_SHA}?per_page=1" \
-              --jq '(env.PINS_PATHS | fromjson) as $pins | (.files | length) < 300 and all(.files[]; [.filename, .previous_filename] | any(IN($pins[])) | not)' \
-              | grep -qx true; then
-            export RECHECK_PATHS="$COST_MAP_PATHS"
-          else
-            export RECHECK_PATHS="$PINS_PATHS"
-          fi
-          rerun_cutoff="$(date -u -d '30 days ago' +%Y-%m-%dT%H:%M:%SZ)"
-          candidates="$(gh api graphql --paginate -F owner="${GITHUB_REPOSITORY_OWNER}" -F name="${GITHUB_REPOSITORY#*/}" -F base="$BASE_REF" \
-            -f query='query($owner: String!, $name: String!, $base: String!, $endCursor: String) {
-              repository(owner: $owner, name: $name) {
-                pullRequests(states: OPEN, baseRefName: $base, first: 25, after: $endCursor) {
-                  nodes { number headRefOid changedFiles files(first: 100) { nodes { path } } }
-                  pageInfo { hasNextPage endCursor }
-                }
-              }
-            }' \
-            --jq '(env.RECHECK_PATHS | fromjson) as $paths | .data.repository.pullRequests.nodes[]
-              | {number, headRefOid, listed: any(.files.nodes[].path; IN($paths[])), unlisted: (.changedFiles > 100)}
-              | select(.listed or .unlisted) | "\(.number) \(.headRefOid) \(.listed)"')"
-          failed=0
-          declare -A rerun_heads
-          while read -r number head_sha listed; do
-            [ -n "$number" ] || continue
-            if [ "$listed" = false ]; then
-              if ! changed="$(gh api --paginate "repos/${GITHUB_REPOSITORY}/pulls/${number}/files?per_page=100" \
-                --jq '(env.RECHECK_PATHS | fromjson) as $paths | .[].filename | select(IN($paths[]))')"; then
-                echo "::error::could not list the files of #$number"
-                failed=1
-                continue
-              fi
-              [ -n "$changed" ] || continue
-            fi
-            [ -z "${rerun_heads[$head_sha]:-}" ] || continue
-            rerun_heads[$head_sha]=1
-            if ! runs="$(gh run list --repo "$GITHUB_REPOSITORY" --workflow cost-map-guard.yml --commit "$head_sha" --limit 100 --json databaseId,createdAt --jq '.[] | "\(.databaseId) \(.createdAt)"')"; then
-              echo "::error::could not list the cost map guard runs of #$number"
-              failed=1
-              continue
-            fi
-            if [ -z "$runs" ]; then
-              echo "::warning::no cost map guard run found for #$number"
-              continue
-            fi
-            while read -r run_id created_at; do
-              if [[ "$created_at" < "$rerun_cutoff" ]]; then
-                echo "::warning::cost map guard run $run_id for #$number is over 30 days old, so GitHub cannot re-run it; #$number gets the pin checks on its next push"
-                continue
-              fi
-              gh run watch "$run_id" --repo "$GITHUB_REPOSITORY" > /dev/null || true
-              if ! gh run rerun "$run_id" --repo "$GITHUB_REPOSITORY"; then
-                echo "::error::could not re-run cost map guard run $run_id for #$number"
-                failed=1
-              fi
-            done <<< "$runs"
-          done <<< "$candidates"
-          exit "$failed"

.github/workflows/duplicate_issue_check.yml

@@ -13,9 +13,9 @@ on:
       - .github/workflows/duplicate_issue_check.yml
       - .github/prompts/duplicate-issue-check.md
       - .github/prompts/duplicate-issue-check.schema.json
-      - litellm/scripts/flag-duplicate-issue.ts
-      - litellm/scripts/flag-duplicate-issue.test.ts
-      - litellm/scripts/auto-close-duplicates.ts
+      - scripts/flag-duplicate-issue.ts
+      - scripts/flag-duplicate-issue.test.ts
+      - scripts/auto-close-duplicates.ts
 
 permissions: {}
 
@@ -38,7 +38,7 @@ jobs:
           bun-version: "1.4.0"
 
       - name: Test the flag step
-        run: bun test litellm/scripts/flag-duplicate-issue.test.ts
+        run: bun test scripts/flag-duplicate-issue.test.ts
 
   classify:
     if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm'
@@ -125,7 +125,7 @@ jobs:
       - name: Checkout scripts
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
-          sparse-checkout: litellm/scripts
+          sparse-checkout: scripts
           persist-credentials: false
 
       - name: Setup Bun
@@ -134,7 +134,7 @@ jobs:
           bun-version: "1.4.0"
 
       - name: Comment and label
-        run: bun run litellm/scripts/flag-duplicate-issue.ts
+        run: bun run scripts/flag-duplicate-issue.ts
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERDICT: ${{ needs.classify.outputs.verdict }}

.github/workflows/guard-fork-dependencies.yml

@@ -8,8 +8,8 @@ on:
     paths:
       - "uv.lock"
       - "pyproject.toml"
-      - "litellm/proxy-extras/pyproject.toml"
-      - "litellm/enterprise/pyproject.toml"
+      - "litellm-proxy-extras/pyproject.toml"
+      - "enterprise/pyproject.toml"
 
 permissions: {}
 
@@ -130,12 +130,8 @@ jobs:
           }
 
           check_deps base/pyproject.toml pr/pyproject.toml "pyproject.toml" || had_error=1
-          base_extras=base/litellm/proxy-extras/pyproject.toml
-          [ -f "$base_extras" ] || base_extras=base/litellm-proxy-extras/pyproject.toml
-          base_enterprise=base/litellm/enterprise/pyproject.toml
-          [ -f "$base_enterprise" ] || base_enterprise=base/enterprise/pyproject.toml
-          check_deps "$base_extras" pr/litellm/proxy-extras/pyproject.toml "litellm/proxy-extras/pyproject.toml" || had_error=1
-          check_deps "$base_enterprise" pr/litellm/enterprise/pyproject.toml "litellm/enterprise/pyproject.toml" || had_error=1
+          check_deps base/litellm-proxy-extras/pyproject.toml pr/litellm-proxy-extras/pyproject.toml "litellm-proxy-extras/pyproject.toml" || had_error=1
+          check_deps base/enterprise/pyproject.toml pr/enterprise/pyproject.toml "enterprise/pyproject.toml" || had_error=1
 
           if [ "$had_error" -ne 0 ]; then
             echo ""

.github/workflows/image-scan.yml

@@ -7,30 +7,33 @@ on:
       - litellm_oss_branch
       - "litellm_**"
     paths:
-      - litellm/deploy/docker/Dockerfile
-      - litellm/deploy/docker/Dockerfile.dockerignore
-      - litellm/deploy/docker/docker-entrypoint.sh
-      - litellm/runtime/migrations/run.py
-      - litellm/runtime/gateway/main.py
-      - litellm/runtime/gateway/launch.py
-      - litellm/runtime/gateway/routes/allowlist.py
-      - litellm/cli/**
-      - .github/packaging/**
-      - litellm/runtime/backend/main.py
-      - litellm/runtime/backend/routes/allowlist.py
-      - litellm/rust/**
+      - Dockerfile
+      - docker/Dockerfile.non_root
+      - docker/Dockerfile.database
+      - migrations/Dockerfile
+      - migrations/run.py
+      - gateway/Dockerfile
+      - gateway/main.py
+      - gateway/routes/allowlist.py
+      - backend/Dockerfile
+      - backend/main.py
+      - litellm-rust/**
       - litellm/proxy/lens/**
+      - docker/component_entrypoint.sh
+      - docker/entrypoint.sh
       - litellm/proxy/prisma_migration.py
       - litellm/proxy/admin_mcp.py
       - litellm/proxy/proxy_server.py
+      - backend/routes/allowlist.py
       - pyproject.toml
-      - litellm/proxy-extras/**
+      - litellm-proxy-extras/**
       - tests/integration/database/image/**
       - uv.lock
-      - litellm/ui/litellm-dashboard/package-lock.json
-      - litellm/ui/nginx.conf
+      - ui/litellm-dashboard/package-lock.json
+      - ui/Dockerfile
+      - ui/nginx.conf
       - .github/workflows/image-scan.yml
-      - .github/grype.yaml
+      - .grype.yaml
   schedule:
     - cron: "41 6 * * *"
   workflow_dispatch:
@@ -41,18 +44,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-env:
-  IMAGE: litellm-image-scan:${{ github.sha }}
-  ADMIN_MCP_SCHEMA_IMAGE: litellm-admin-mcp-schema:${{ github.sha }}
-
 jobs:
-  build:
-    name: build
+  image-scan:
+    name: image-scan
     runs-on: ubuntu-latest
     if: >-
       github.event_name != 'pull_request' ||
       github.event.pull_request.head.repo.full_name == github.repository
-    timeout-minutes: 60
+    timeout-minutes: 30
     permissions:
       contents: read
     steps:
@@ -60,129 +59,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Build the image
-        run: docker build -f litellm/deploy/docker/Dockerfile --build-arg MATURIN_PEP517_ARGS="--profile ci" --build-arg LITELLM_RELEASE_TAG=v0.0.0-lens-ci -t "$IMAGE" .
-
-      - name: Save the image for the verify matrix
-        run: docker save "$IMAGE" | zstd -T0 -3 -o "$RUNNER_TEMP/litellm-image.tar.zst"
-
-      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: litellm-image
-          path: ${{ runner.temp }}/litellm-image.tar.zst
-          retention-days: 1
-          compression-level: 0
-
-      - name: Build the Admin MCP schema image
-        run: docker build -f litellm/deploy/docker/Dockerfile --build-arg MATURIN_PEP517_ARGS="--profile ci" --build-arg LITELLM_RELEASE_TAG=v0.0.0-lens-ci --target builder -t "$ADMIN_MCP_SCHEMA_IMAGE" .
-
-      - name: Save the Admin MCP schema image for the verify matrix
-        run: docker save "$ADMIN_MCP_SCHEMA_IMAGE" | zstd -T0 -3 -o "$RUNNER_TEMP/litellm-admin-mcp-schema.tar.zst"
-
-      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: litellm-admin-mcp-schema
-          path: ${{ runner.temp }}/litellm-admin-mcp-schema.tar.zst
-          retention-days: 1
-          compression-level: 0
-
-  verify:
-    name: verify (${{ matrix.check }})
-    needs: build
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        check: [scan, migrations, gateway, backend, ui, collector]
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: litellm-image
-          path: ${{ runner.temp }}
-
-      - name: Load the image
-        run: zstd -d --stdout "$RUNNER_TEMP/litellm-image.tar.zst" | docker load
-
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        if: matrix.check == 'migrations' || matrix.check == 'backend'
-        with:
-          name: litellm-admin-mcp-schema
-          path: ${{ runner.temp }}
-
-      - name: Load the Admin MCP schema image
-        if: matrix.check == 'migrations' || matrix.check == 'backend'
-        run: zstd -d --stdout "$RUNNER_TEMP/litellm-admin-mcp-schema.tar.zst" | docker load
-
-      - name: Set up Python
-        if: matrix.check != 'scan'
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Install pytest
-        if: matrix.check != 'scan'
-        run: python -m pip install "pytest==9.0.3"
-
-      # The prisma bake must migrate a fresh DB with no egress as an arbitrary
-      # non-root uid (OpenShift restricted-v2 / air-gapped / readOnlyFilesystem).
-      # `docker run` as the default uid with network hides a broken bake because
-      # the migration entrypoint exits 0 even when it applied nothing; asserting
-      # the schema was created is what catches it.
-      - name: Verify offline migration as a non-root uid
-        if: matrix.check == 'migrations'
-        env:
-          LITELLM_IMAGE: ${{ env.IMAGE }}
-          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: ${{ env.ADMIN_MCP_SCHEMA_IMAGE }}
-        run: |
-          python -m pytest --noconftest -v \
-            tests/integration/database/image/test_offline_image_migration.py \
-            tests/integration/database/image/test_image_bedrock_realtime_extra.py \
-            tests/integration/database/image/test_image_admin_mcp.py
-
-      - name: Verify the gateway component serves offline as a non-root uid
-        if: matrix.check == 'gateway'
-        env:
-          LITELLM_IMAGE: ${{ env.IMAGE }}
-          LITELLM_COMPONENT: gateway
-          LITELLM_IMAGE_COMPONENT: gateway
-        run: |
-          python -m pytest --noconftest -v \
-            tests/integration/database/image/test_component_image_serves_offline.py \
-            tests/integration/database/image/test_image_admin_mcp.py
-
-      - name: Verify the backend component serves offline as a non-root uid
-        if: matrix.check == 'backend'
-        env:
-          LITELLM_IMAGE: ${{ env.IMAGE }}
-          LITELLM_COMPONENT: backend
-          LITELLM_IMAGE_COMPONENT: backend
-          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: ${{ env.ADMIN_MCP_SCHEMA_IMAGE }}
-        run: |
-          python -m pytest --noconftest -v \
-            tests/integration/database/image/test_component_image_serves_offline.py \
-            tests/integration/database/image/test_image_admin_mcp.py
-
-      - name: Verify the ui component serves as an arbitrary uid with a read-only root fs
-        if: matrix.check == 'ui'
-        env:
-          LITELLM_IMAGE: ${{ env.IMAGE }}
-        run: python -m pytest --noconftest -v tests/integration/database/image/test_ui_image_serves_offline.py
-
-      - name: Verify the collector creates its socket as the image user
-        if: matrix.check == 'collector'
-        env:
-          LITELLM_IMAGE: ${{ env.IMAGE }}
-        run: python -m pytest --noconftest -v tests/integration/database/image/test_collector_image_serves_socket.py
-
       - name: Download Grype v0.114.0
-        if: matrix.check == 'scan'
         run: |
           curl -fsSL --retry 3 -o "$RUNNER_TEMP/grype.tar.gz" \
             https://github.com/anchore/grype/releases/download/v0.114.0/grype_0.114.0_linux_amd64.tar.gz
@@ -190,6 +67,33 @@ jobs:
           tar xzf "$RUNNER_TEMP/grype.tar.gz" -C "$RUNNER_TEMP" grype
           chmod +x "$RUNNER_TEMP/grype"
 
+      # Dockerfile.non_root is the rootless variant we ship. The other
+      # Dockerfiles share the same wolfi base and apk set, so OS-layer coverage
+      # is the same; matrix-scan if those variants ever diverge.
+      - name: Build runtime image
+        run: docker build -f docker/Dockerfile.non_root -t litellm-image-scan:${{ github.sha }} .
+
+      - name: Tag the cached builder for Admin MCP schema setup
+        run: docker build --target builder -f docker/Dockerfile.non_root -t litellm-admin-mcp-schema:${{ github.sha }} .
+
+      # The prisma bake must migrate a fresh DB with no egress as an arbitrary
+      # non-root uid (OpenShift restricted-v2 / air-gapped / readOnlyRootFilesystem).
+      # `docker run` as the default uid with network hides a broken bake because
+      # the migration entrypoint exits 0 even when it applied nothing; asserting
+      # the schema was created is what catches it.
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify offline migration as a non-root uid
+        env:
+          LITELLM_IMAGE: litellm-image-scan:${{ github.sha }}
+          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: litellm-admin-mcp-schema:${{ github.sha }}
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest --noconftest tests/integration/database/image/test_offline_image_migration.py tests/integration/database/image/test_image_bedrock_realtime_extra.py tests/integration/database/image/test_image_admin_mcp.py -v
+
       # Scans the whole shipped artifact: OS/apk plus every language package
       # baked into the image, including ones no lockfile declares (e.g. prisma's
       # vendored node engine) that osv-scan cannot see. osv-scan stays the fast
@@ -197,12 +101,175 @@ jobs:
       # free OSS, run as a pinned, checksum-verified binary; no GitHub Action
       # dependency and no vendor SaaS callout.
       - name: Scan image for fixable HIGH/CRITICAL CVEs
-        if: matrix.check == 'scan'
         env:
           GRYPE_MATCH_PYTHON_USING_CPES: "true"
         run: |
-          "$RUNNER_TEMP/grype" "$IMAGE" \
-            --config .github/grype.yaml \
+          "$RUNNER_TEMP/grype" litellm-image-scan:${{ github.sha }} \
+            --config .grype.yaml \
             --only-fixed \
             --fail-on high \
             --output table
+
+  runtime-image:
+    name: runtime-image (${{ matrix.dockerfile }})
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 45
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        dockerfile: [Dockerfile, docker/Dockerfile.database]
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build runtime image
+        run: docker build --build-arg LITELLM_RELEASE_TAG=v0.0.0-lens-ci -f "${{ matrix.dockerfile }}" -t litellm-runtime-scan:${{ github.sha }} .
+
+      - name: Tag the cached builder for Admin MCP schema setup
+        run: docker build --target builder -f "${{ matrix.dockerfile }}" -t litellm-admin-mcp-schema:${{ github.sha }} .
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify offline migration as a non-root uid
+        env:
+          LITELLM_IMAGE: litellm-runtime-scan:${{ github.sha }}
+          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: litellm-admin-mcp-schema:${{ github.sha }}
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest --noconftest tests/integration/database/image/test_offline_image_migration.py tests/integration/database/image/test_image_bedrock_realtime_extra.py tests/integration/database/image/test_image_admin_mcp.py -v
+
+
+  migrations-image:
+    name: migrations-image
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build migrations image
+        run: docker build -f migrations/Dockerfile -t litellm-migrations-scan:${{ github.sha }} .
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify offline migration as a non-root uid
+        env:
+          LITELLM_IMAGE: litellm-migrations-scan:${{ github.sha }}
+          LITELLM_MIGRATION_INTERPRETER: python3
+          LITELLM_MIGRATION_SCRIPT: /app/run.py
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest --noconftest tests/integration/database/image/test_offline_image_migration.py -v
+
+  gateway-image:
+    name: gateway-image
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build gateway image
+        run: docker build -f gateway/Dockerfile -t litellm-gateway-scan:${{ github.sha }} .
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify the gateway serves offline as a non-root uid
+        env:
+          LITELLM_IMAGE: litellm-gateway-scan:${{ github.sha }}
+          LITELLM_COMPONENT_PORT: "4000"
+          LITELLM_IMAGE_COMPONENT: gateway
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest --noconftest tests/integration/database/image/test_component_image_serves_offline.py tests/integration/database/image/test_image_bedrock_realtime_extra.py tests/integration/database/image/test_image_admin_mcp.py -v
+
+  ui-image:
+    name: ui-image
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build UI image
+        run: docker build -f ui/Dockerfile -t litellm-ui-scan:${{ github.sha }} .
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify the UI serves offline as an arbitrary uid with a read-only root fs
+        env:
+          LITELLM_IMAGE: litellm-ui-scan:${{ github.sha }}
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest --noconftest tests/integration/database/image/test_ui_image_serves_offline.py -v
+
+  backend-image:
+    name: backend-image
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build backend image
+        run: docker build -f backend/Dockerfile -t litellm-backend-scan:${{ github.sha }} .
+
+      - name: Tag the cached builder for Admin MCP schema setup
+        run: docker build --target builder -f backend/Dockerfile -t litellm-admin-mcp-schema:${{ github.sha }} .
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify the backend serves offline as a non-root uid
+        env:
+          LITELLM_IMAGE: litellm-backend-scan:${{ github.sha }}
+          LITELLM_ADMIN_MCP_SCHEMA_IMAGE: litellm-admin-mcp-schema:${{ github.sha }}
+          LITELLM_COMPONENT_PORT: "4001"
+          LITELLM_IMAGE_COMPONENT: backend
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest --noconftest tests/integration/database/image/test_component_image_serves_offline.py tests/integration/database/image/test_image_admin_mcp.py -v

.github/workflows/interactions-spec-canary.yml

@@ -1,94 +0,0 @@
-name: Interactions spec canary
-
-on:
-  schedule:
-    - cron: "17 7 * * *"
-  pull_request:
-    paths:
-      - .github/workflows/interactions-spec-canary.yml
-      - tests/unit/interactions/**
-      - litellm/types/interactions/**
-  workflow_dispatch:
-
-permissions: {}
-
-concurrency: interactions-spec-canary
-
-jobs:
-  interactions-spec-canary:
-    name: interactions-spec-canary
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: read
-    outputs:
-      compliance: ${{ steps.compliance.outcome }}
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Set up the Rust bridge
-        uses: ./.github/actions/rust-bridge
-
-      - name: Install dependencies
-        run: .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra proxy
-
-      - name: Run the compliance tests against Google's live spec
-        id: compliance
-        run: |
-          uv run --no-sync pytest tests/unit/interactions/test_openapi_compliance.py \
-            --interactions-spec-url=https://aistudio.google.com/api-reference/interactions.openapi.json \
-            --tb=short -vv -p no:rerunfailures -p no:pytest-retry \
-            --allow-hosts=127.0.0.1,::1,localhost,ai.google.dev,aistudio.google.com
-
-  tracking-issue:
-    name: tracking-issue
-    needs: interactions-spec-canary
-    if: always() && github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch && github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      issues: write
-    steps:
-      - name: File the tracking issue unless the compliance step passed, close it when it did
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        env:
-          COMPLIANCE_OUTCOME: ${{ needs.interactions-spec-canary.outputs.compliance }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        with:
-          script: |
-            const title = "Interactions spec canary is red";
-            const outcome = process.env.COMPLIANCE_OUTCOME;
-            const runUrl = process.env.RUN_URL;
-            const query = `repo:${context.repo.owner}/${context.repo.repo} is:issue is:open in:title "${title}"`;
-            const { data: found } = await github.rest.search.issuesAndPullRequests({ q: query, per_page: 20 });
-            const open = found.items.find((issue) => issue.title === title);
-            if (outcome === "success") {
-              if (open === undefined) return;
-              await github.rest.issues.createComment({ ...context.repo, issue_number: open.number, body: `Green again: ${runUrl}` });
-              await github.rest.issues.update({ ...context.repo, issue_number: open.number, state: "closed" });
-              return;
-            }
-            const state = outcome === "failure" ? "red" : `not run (compliance step outcome: ${outcome || "none"})`;
-            if (open !== undefined) {
-              await github.rest.issues.createComment({ ...context.repo, issue_number: open.number, body: `Still ${state}: ${runUrl}` });
-              return;
-            }
-            await github.rest.issues.create({
-              ...context.repo,
-              title,
-              assignees: ["mateo-berri"],
-              body: `The scheduled run of tests/unit/interactions/test_openapi_compliance.py against Google's live Interactions spec is ${state}: ${runUrl}\n\nlitellm/types/interactions/README.md says how to refresh the snapshot and regenerate the types.`,
-            });

.github/workflows/issue_classifier.yml

@@ -16,12 +16,12 @@ on:
       - .github/issue-labels.json
       - .github/ISSUE_TEMPLATE/bug_report.yml
       - .github/ISSUE_TEMPLATE/feature_request.yml
-      - litellm/scripts/classify-issue.ts
-      - litellm/scripts/classify-issue.test.ts
-      - litellm/scripts/label-issue.ts
-      - litellm/scripts/label-issue.test.ts
-      - litellm/scripts/issue-labels.ts
-      - litellm/scripts/auto-close-duplicates.ts
+      - scripts/classify-issue.ts
+      - scripts/classify-issue.test.ts
+      - scripts/label-issue.ts
+      - scripts/label-issue.test.ts
+      - scripts/issue-labels.ts
+      - scripts/auto-close-duplicates.ts
 
 permissions: {}
 
@@ -49,7 +49,7 @@ jobs:
           bun-version: "1.4.0"
 
       - name: Test the gate, the validation and the label step
-        run: bun test litellm/scripts/classify-issue.test.ts litellm/scripts/label-issue.test.ts
+        run: bun test scripts/classify-issue.test.ts scripts/label-issue.test.ts
 
   classify-issue:
     # An edit to a labelled issue is dropped here; the script decides the rest against the live labels
@@ -73,7 +73,7 @@ jobs:
         with:
           sparse-checkout: |
             .github
-            litellm/scripts
+            scripts
           persist-credentials: false
 
       - name: Setup Bun
@@ -108,7 +108,7 @@ jobs:
           ISSUE_CLASSIFIER_MODEL: ${{ vars.ISSUE_CLASSIFIER_MODEL }}
         run: |
           set -euo pipefail
-          bun run litellm/scripts/classify-issue.ts > classification.json
+          bun run scripts/classify-issue.ts > classification.json
           {
             echo 'verdict<<CLASSIFICATION'
             cat classification.json
@@ -143,7 +143,7 @@ jobs:
         with:
           sparse-checkout: |
             .github
-            litellm/scripts
+            scripts
           persist-credentials: false
 
       - name: Setup Bun
@@ -153,7 +153,7 @@ jobs:
           bun-version: "1.4.0"
 
       - name: Replace the labels in each namespace
-        run: bun run litellm/scripts/label-issue.ts
+        run: bun run scripts/label-issue.ts
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERDICT: ${{ needs.classify-issue.outputs.verdict }}

.github/workflows/issue_fixed_comment.yml

@@ -15,9 +15,9 @@ on:
   pull_request:
     paths:
       - .github/workflows/issue_fixed_comment.yml
-      - litellm/scripts/comment-fixed-issue.ts
-      - litellm/scripts/comment-fixed-issue.test.ts
-      - litellm/scripts/auto-close-duplicates.ts
+      - scripts/comment-fixed-issue.ts
+      - scripts/comment-fixed-issue.test.ts
+      - scripts/auto-close-duplicates.ts
 
 permissions: {}
 
@@ -44,7 +44,7 @@ jobs:
           bun-version: "1.4.0"
 
       - name: Test the closer lookup, the release placement, the comment and the superseded pull request close
-        run: bun test litellm/scripts/comment-fixed-issue.test.ts
+        run: bun test scripts/comment-fixed-issue.test.ts
 
   comment-fixed-issue:
     if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm'
@@ -58,7 +58,7 @@ jobs:
       - name: Checkout scripts
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
-          sparse-checkout: litellm/scripts
+          sparse-checkout: scripts
           persist-credentials: false
 
       - name: Setup Bun
@@ -69,7 +69,7 @@ jobs:
 
       - name: Name the release that carries the fix and close the pull requests it supersedes
         shell: bash
-        run: bun run litellm/scripts/comment-fixed-issue.ts | tee -a "${GITHUB_STEP_SUMMARY}"
+        run: bun run scripts/comment-fixed-issue.ts | tee -a "${GITHUB_STEP_SUMMARY}"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ISSUE_NUMBER: ${{ github.event.issue.number || github.event.inputs.issue_number }}

.github/workflows/issue_label_sync.yml

@@ -5,7 +5,7 @@ on:
     branches: [main]
     paths:
       - .github/issue-labels.json
-      - litellm/scripts/sync-issue-labels.ts
+      - scripts/sync-issue-labels.ts
   workflow_dispatch:
     inputs:
       dry_run:
@@ -16,9 +16,9 @@ on:
     paths:
       - .github/workflows/issue_label_sync.yml
       - .github/issue-labels.json
-      - litellm/scripts/sync-issue-labels.ts
-      - litellm/scripts/sync-issue-labels.test.ts
-      - litellm/scripts/issue-labels.ts
+      - scripts/sync-issue-labels.ts
+      - scripts/sync-issue-labels.test.ts
+      - scripts/issue-labels.ts
 
 permissions: {}
 
@@ -41,7 +41,7 @@ jobs:
           bun-version: "1.4.0"
 
       - name: Test the sync
-        run: bun test litellm/scripts/sync-issue-labels.test.ts
+        run: bun test scripts/sync-issue-labels.test.ts
 
   sync-issue-labels:
     if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm'
@@ -56,7 +56,7 @@ jobs:
         with:
           sparse-checkout: |
             .github
-            litellm/scripts
+            scripts
           persist-credentials: false
 
       - name: Setup Bun
@@ -66,7 +66,7 @@ jobs:
           bun-version: "1.4.0"
 
       - name: Create or recolour every label in .github/issue-labels.json
-        run: bun run litellm/scripts/sync-issue-labels.ts
+        run: bun run scripts/sync-issue-labels.ts
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == true }}

.github/workflows/mutation-test.yml

@@ -129,7 +129,7 @@ jobs:
           set +e
           uv run --no-sync --with mutmut==3.5.0 mutmut export-cicd-stats > /dev/null 2>&1
           uv run --no-sync --with mutmut==3.5.0 mutmut results > mutmut-results.txt 2>&1
-          uv run --no-sync python litellm/scripts/mutation_report.py
+          uv run --no-sync python scripts/mutation_report.py
           # The full report can be very long for big test files; the run-page
           # summary cuts off at 1 MB. Append the head of the report (summary
           # + survivor list) and link out to the artifact for the full body.

.github/workflows/osv-scan.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Scan lockfiles
         run: |
           "$RUNNER_TEMP/osv-scanner" scan source \
-            --config .github/osv-scanner.toml \
+            --config osv-scanner.toml \
             -L uv.lock \
-            -L litellm/ui/litellm-dashboard/package-lock.json \
-            -L litellm/vscode-extension/package-lock.json
+            -L ui/litellm-dashboard/package-lock.json \
+            -L vscode-extension/package-lock.json

.github/workflows/publish-lint-base-counts.yml

@@ -3,7 +3,7 @@ name: Publish lint base counts
 # Every commit on main can become a future merge-base.
 # Publishing its per-rule counts for each lint gate (strict ruff, type discipline,
 # test quality, basedpyright) as an artifact lets the gates download them through
-# litellm/scripts/lint_base_counts.py in seconds instead of scanning the merge-base tree in
+# scripts/lint_base_counts.py in seconds instead of scanning the merge-base tree in
 # a throwaway worktree on every fresh checkout or moved merge-base.
 # No concurrency group on purpose: runs must never cancel each other, because
 # every sha's artifact matters (any of them can become a merge-base).
@@ -30,15 +30,15 @@ jobs:
       matrix:
         include:
           - checker: ruff-strict
-            script: litellm/scripts/ruff_strict_gate.py
+            script: scripts/ruff_strict_gate.py
           - checker: type-discipline
-            script: litellm/scripts/type_discipline_gate.py
+            script: scripts/type_discipline_gate.py
           - checker: test-quality
-            script: litellm/scripts/test_quality_gate.py
+            script: scripts/test_quality_gate.py
           - checker: openapi-docs
-            script: litellm/scripts/openapi_docs_gate.py
+            script: scripts/openapi_docs_gate.py
           - checker: basedpyright
-            script: litellm/scripts/type_check_gate.py
+            script: scripts/type_check_gate.py
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
@@ -91,7 +91,7 @@ jobs:
       - name: Emit basedpyright counts for HEAD
         if: matrix.checker == 'basedpyright'
         run: |
-          python litellm/scripts/type_check_gate.py --emit-counts-dir "$RUNNER_TEMP/lint-counts"
+          python scripts/type_check_gate.py --emit-counts-dir "$RUNNER_TEMP/lint-counts"
 
       - name: Name the counts artifact
         run: |

.github/workflows/root-entry-limit.yml

@@ -1,27 +0,0 @@
-name: Root entry limit
-
-on:
-  pull_request: {}
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-jobs:
-  root-entry-limit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
-        with:
-          persist-credentials: false
-      - name: Check root entry count
-        env:
-          MAX_ROOT_ENTRIES: 15
-        run: |
-          count=$(find . -mindepth 1 -maxdepth 1 -printf '.\n' | wc -l)
-          echo "Root has $count entries. Maximum is $MAX_ROOT_ENTRIES."
-          if [ "$count" -gt "$MAX_ROOT_ENTRIES" ]; then
-            echo "::error::Repository root exceeds $MAX_ROOT_ENTRIES entries. Move new files into an existing directory."
-            exit 1
-          fi

.github/workflows/spend-logs-guard.yml

@@ -1,53 +0,0 @@
-name: Spend logs guard
-
-on:
-  pull_request:
-    branches:
-      - main
-
-permissions:
-  contents: read
-  pull-requests: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  spend-logs-guard:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          ref: ${{ github.event.pull_request.base.ref }}
-          persist-credentials: false
-      - name: Fetch the pull request head, its merge base and its reviews
-        id: revisions
-        env:
-          GH_TOKEN: ${{ github.token }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          BASE_REF: ${{ github.event.pull_request.base.ref }}
-        run: |
-          merge_base="$(gh api "repos/${GITHUB_REPOSITORY}/compare/${BASE_REF}...${HEAD_SHA}" --jq '.merge_base_commit.sha')"
-          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
-          gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/reviews" --paginate --slurp | jq 'add // []' > "$RUNNER_TEMP/reviews.json"
-          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-      - name: Run the guard
-        env:
-          MERGE_BASE: ${{ steps.revisions.outputs.merge_base }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          guard=litellm/scripts/ci_cd/spend_logs_guard.py
-          # TODO: Drop the legacy path after this lands on main.
-          if [ ! -f "$guard" ]; then
-            guard=scripts/ci_cd/spend_logs_guard.py
-          fi
-          if [ ! -f "$guard" ]; then
-            guard=ci_cd/spend_logs_guard.py
-          fi
-          uv run --no-project --with pydantic==2.14.1 python "$guard" --base "$MERGE_BASE" --head "$HEAD_SHA" --approver kerry-berri --reviews "$RUNNER_TEMP/reviews.json"

.github/workflows/sync-schema.yml

@@ -1,9 +1,9 @@
-name: Sync litellm/schema.prisma copies
+name: Sync schema.prisma copies
 
 on:
   pull_request:
     paths:
-      - 'litellm/schema.prisma'
+      - 'schema.prisma'
 
 # Scoped to ONLY the permissions needed:
 # - contents:write to push the sync commit to the PR branch
@@ -37,7 +37,7 @@ jobs:
 
       - name: Reject symlinked schema files
         run: |
-          for f in litellm/schema.prisma litellm/proxy/schema.prisma litellm/proxy-extras/litellm_proxy_extras/schema.prisma; do
+          for f in schema.prisma litellm/proxy/schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma; do
             if [ -L "$f" ]; then
               echo "::error file=$f::$f is a symlink, which is not allowed"
               exit 1
@@ -46,13 +46,13 @@ jobs:
 
       - name: Copy root schema to other locations
         run: |
-          cp litellm/schema.prisma litellm/proxy/schema.prisma
-          cp litellm/schema.prisma litellm/proxy-extras/litellm_proxy_extras/schema.prisma
+          cp schema.prisma litellm/proxy/schema.prisma
+          cp schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma
 
       - name: Check for changes
         id: diff
         run: |
-          if git diff --quiet -- litellm/proxy/schema.prisma litellm/proxy-extras/litellm_proxy_extras/schema.prisma; then
+          if git diff --quiet -- litellm/proxy/schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
             echo "Schemas already in sync. Nothing to do."
           else
@@ -68,6 +68,6 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -B "$GITHUB_HEAD_REF"
-          git add -- litellm/proxy/schema.prisma litellm/proxy-extras/litellm_proxy_extras/schema.prisma
-          git commit -m "chore: sync litellm/schema.prisma copies from the canonical schema"
+          git add -- litellm/proxy/schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma
+          git commit -m "chore: sync schema.prisma copies from root"
           git push origin "HEAD:$GITHUB_HEAD_REF"

.github/workflows/test-integration.yml

@@ -55,6 +55,7 @@ jobs:
     services:
       postgres:
         image: postgres:16@sha256:e17e86066e5ef83e0952a9347f5c792b7ece00972e2aa787a6986f471b3dd3d5
+        command: -c max_connections=1000 -c shared_preload_libraries=pg_stat_statements -c pg_stat_statements.track=all -c pg_stat_statements.max=20000
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
@@ -80,17 +81,6 @@ jobs:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           persist-credentials: false
-      - name: Configure PostgreSQL for integration workers
-        env:
-          POSTGRES_CONTAINER: ${{ job.services.postgres.id }}
-        run: |
-          docker exec "$POSTGRES_CONTAINER" sh -c 'printf "%s\n" "max_connections = 1000" "shared_preload_libraries = pg_stat_statements" "pg_stat_statements.track = all" "pg_stat_statements.max = 20000" >> "$PGDATA/postgresql.conf"'
-          docker restart "$POSTGRES_CONTAINER"
-          for attempt in $(seq 1 30); do
-            if docker exec "$POSTGRES_CONTAINER" pg_isready -U postgres; then exit 0; fi
-            sleep 1
-          done
-          exit 1
 
       - name: Set up Python
         timeout-minutes: 3
@@ -116,17 +106,6 @@ jobs:
         timeout-minutes: 20
         run: .github/scripts/uv_sync_with_retries.sh --frozen --all-groups --all-extras
 
-      - name: Install the Rust gateway
-        if: matrix.suite == 'management' || matrix.suite == 'management-replica'
-        timeout-minutes: 15
-        working-directory: packaging/litellm-proxy
-        env:
-          CARGO_INCREMENTAL: "0"
-        run: |
-          uv run --no-project --with maturin==1.15.0 maturin build --profile dev --strip --out "$RUNNER_TEMP/gateway-dist"
-          uv pip install --no-deps --python ../../.venv/bin/python "$RUNNER_TEMP"/gateway-dist/*.whl
-          test -x ../../.venv/bin/litellm-gateway
-
       - name: Install redis-server 7.2.16
         timeout-minutes: 3
         run: |
@@ -150,22 +129,22 @@ jobs:
         timeout-minutes: 5
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
-          node-version-file: litellm/ui/litellm-dashboard/.nvmrc
+          node-version-file: ui/litellm-dashboard/.nvmrc
           cache: "npm"
           cache-dependency-path: |
-            litellm/ui/litellm-dashboard/package-lock.json
+            ui/litellm-dashboard/package-lock.json
             tests/e2e/ui/package-lock.json
 
       - name: Install browser dependencies and build the dashboard
         if: matrix.suite == 'browser'
         timeout-minutes: 20
         run: |
-          (cd litellm/ui/litellm-dashboard && npm ci)
+          (cd ui/litellm-dashboard && npm ci)
           (cd tests/e2e/ui && npm ci)
           sudo env PATH="$PATH" DEBIAN_FRONTEND=noninteractive \
             node tests/e2e/ui/node_modules/@playwright/test/cli.js install-deps chromium
           node tests/e2e/ui/node_modules/@playwright/test/cli.js install chromium
-          (cd litellm/ui/litellm-dashboard && NEXT_TELEMETRY_DISABLED=1 npm run build)
+          (cd ui/litellm-dashboard && NEXT_TELEMETRY_DISABLED=1 npm run build)
 
       - name: Run integration contracts
         timeout-minutes: 45
@@ -176,8 +155,8 @@ jobs:
           LITELLM_LICENSE: ${{ secrets.LITELLM_LICENSE }}
         run: |
           case "$SUITE" in
-            *-replica) bash .github/scripts/ci/run_integration.sh "${SUITE%-replica}" replica ;;
-            *) bash .github/scripts/ci/run_integration.sh "$SUITE" ;;
+            *-replica) bash .circleci/scripts/run_integration.sh "${SUITE%-replica}" replica ;;
+            *) bash .circleci/scripts/run_integration.sh "$SUITE" ;;
           esac
 
       - name: Verify every case ran exactly once

.github/workflows/test-linting.yml

@@ -21,7 +21,7 @@ jobs:
       pull-requests: read
       actions: read
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 20
     services:
       redis:
         image: redis@sha256:e2debfb7956fa12c7ddc79d7e645c8cf26b30c99a6e9161ea9bf4171e1668a5f
@@ -48,13 +48,11 @@ jobs:
         if: steps.changes.outputs.decision != 'skip'
         env:
           GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
-          BASE_REF=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${EVENT_BASE_REF}" --jq .name) || BASE_REF=$(retry gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .base.ref)
-          MERGE_BASE=$(retry gh api "repos/${GITHUB_REPOSITORY}/compare/${BASE_REF}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
+          MERGE_BASE=$(retry gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
           test -n "$MERGE_BASE"
           retry git fetch --no-tags --depth=1 origin "$MERGE_BASE"
           echo "GATE_BASE_SHA=$MERGE_BASE" >> "$GITHUB_ENV"
@@ -73,14 +71,14 @@ jobs:
 
       - name: Cache uv dependencies
         if: steps.changes.outputs.decision != 'skip'
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cache/uv
             .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          key: ${{ runner.os }}-uv-lint-${{ hashFiles('uv.lock') }}
           restore-keys: |
-            ${{ runner.os }}-uv-
+            ${{ runner.os }}-uv-lint-
 
       - name: Clean Python cache
         if: steps.changes.outputs.decision != 'skip'
@@ -114,7 +112,7 @@ jobs:
       - name: Check ruff format
         if: steps.changes.outputs.decision != 'skip'
         run: |
-          git diff --name-only --diff-filter=ACMR "$GATE_BASE_SHA" HEAD -- ':(glob)litellm/**/*.py' | grep -Ev '^litellm/(enterprise|ui|vscode-extension|rust|proxy-extras|packaging|cli|scripts|runtime)/' > "$RUNNER_TEMP/ruff_format_files.txt" || true
+          git diff --name-only --diff-filter=ACMR "$GATE_BASE_SHA" HEAD -- ':(glob)litellm/**/*.py' | grep -v '^litellm/enterprise/' > "$RUNNER_TEMP/ruff_format_files.txt" || true
           if [ ! -s "$RUNNER_TEMP/ruff_format_files.txt" ]; then
             echo "No changed litellm Python files to check with ruff format."
             exit 0
@@ -133,7 +131,7 @@ jobs:
 
       - name: Check MCP operation boundary
         if: steps.changes.outputs.decision != 'skip'
-        run: uv run --no-sync python litellm/scripts/check_mcp_operation_boundary.py
+        run: uv run --no-sync python scripts/check_mcp_operation_boundary.py
 
       - name: Run Ruff linting
         if: steps.changes.outputs.decision != 'skip'
@@ -145,28 +143,28 @@ jobs:
       - name: Run Ruff linting (test tree)
         if: steps.changes.outputs.decision != 'skip'
         run: |
-          uv run --no-sync ruff check --config .github/linters/ruff-tests.toml tests
+          uv run --no-sync ruff check --config ruff-tests.toml tests
 
       - name: Check strict ruff rules (delta vs merge-base counts)
         if: steps.changes.outputs.decision != 'skip'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          uv run --no-sync python litellm/scripts/ruff_strict_gate.py --base "$GATE_BASE_SHA"
+          uv run --no-sync python scripts/ruff_strict_gate.py --base "$GATE_BASE_SHA"
 
       - name: Check type discipline (mutable collections / casts / type guards / kwargs / unexplained suppressions, delta vs merge-base counts)
         if: steps.changes.outputs.decision != 'skip'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          uv run --no-sync python litellm/scripts/type_discipline_gate.py --base "$GATE_BASE_SHA"
+          uv run --no-sync python scripts/type_discipline_gate.py --base "$GATE_BASE_SHA"
 
       - name: Check test quality (zero-assert / mock-echo tests, sys.path.insert, raw env writes, litellm global mutation, credential-gated skips, conftest snapshot inventory, delta vs merge-base counts)
         if: steps.changes.outputs.decision != 'skip'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          uv run --no-sync python litellm/scripts/test_quality_gate.py --base "$GATE_BASE_SHA"
+          uv run --no-sync python scripts/test_quality_gate.py --base "$GATE_BASE_SHA"
 
       - name: Check OpenAPI docs (POST routes without a request schema, description or 200 schema, delta vs merge-base counts)
         if: steps.changes.outputs.decision != 'skip'
@@ -174,7 +172,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           uv sync --frozen --group proxy-dev --group e2e-dev --extra proxy
-          uv run --no-sync python litellm/scripts/openapi_docs_gate.py --base "$GATE_BASE_SHA"
+          uv run --no-sync python scripts/openapi_docs_gate.py --base "$GATE_BASE_SHA"
 
       - name: Print OpenAI version
         if: steps.changes.outputs.decision != 'skip'
@@ -186,12 +184,12 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          uv run --no-sync python litellm/scripts/type_check_gate.py --base "$GATE_BASE_SHA"
+          uv run --no-sync python scripts/type_check_gate.py --base "$GATE_BASE_SHA"
 
       - name: Check tests/e2e basedpyright (zero errors)
         if: steps.changes.outputs.decision != 'skip'
         run: |
-          if git diff --name-only --diff-filter=ACMRD "$GATE_BASE_SHA" HEAD -- ':(glob)tests/e2e/**/*.py' ':(glob)tests/e2e_harness/**/*.py' pyproject.toml | grep -q .; then
+          if git diff --name-only --diff-filter=ACMRD "$GATE_BASE_SHA" HEAD -- ':(glob)tests/e2e/**/*.py' ':(glob)tests/e2e_harness/**/*.py' pyrightconfig.json | grep -q .; then
             uv run --no-sync basedpyright tests/e2e tests/e2e_harness
           else
             echo "No changed tests/e2e Python files; skipping."
@@ -208,7 +206,7 @@ jobs:
             exit 0
           fi
           retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
-          CLAUDE_VERSION="$(retry uv run --no-sync python tests/e2e/cli_harness/npm_version_resolver.py @anthropic-ai/claude-code)"
+          CLAUDE_VERSION="$(retry uv run --no-sync python tests/e2e/claude_code/pr_gate_version_resolver.py)"
           tests/e2e/claude_code/cron_vm/install_claude_code.sh "$CLAUDE_VERSION" "$RUNNER_TEMP/claude-cli"
           PATH="$RUNNER_TEMP/claude-cli:$PATH" uv run --no-sync pytest -q tests/e2e_harness
           uv run --no-sync pytest --tb=short -q --noconftest -o addopts= -o "pythonpath=tests/e2e tests/e2e_harness" -p no:rerunfailures \
@@ -258,7 +256,7 @@ jobs:
           if [ -n "$GITGUARDIAN_API_KEY" ]; then
             retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
             retry git fetch --no-tags --unshallow origin
-            uv tool run --from 'ggshield==1.48.0' ggshield --config-path .github/gitguardian.yaml secret scan repo .
+            uv tool run --from 'ggshield==1.48.0' ggshield secret scan repo .
           else
             echo "GITGUARDIAN_API_KEY not set, skipping ggshield scan"
           fi
@@ -266,12 +264,11 @@ jobs:
     name: ui
     permissions:
       contents: read
-      pull-requests: read
     runs-on: ubuntu-latest
     timeout-minutes: 8
     defaults:
       run:
-        working-directory: litellm/ui/litellm-dashboard
+        working-directory: ui/litellm-dashboard
 
     steps:
       - name: Checkout repository
@@ -284,12 +281,16 @@ jobs:
         id: changed
         env:
           GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          base_ref=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${EVENT_BASE_REF}" --jq .name) || base_ref=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .base.ref)
-          merge_base=$(gh api "repos/${GITHUB_REPOSITORY}/compare/${base_ref}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
+          # base.sha is the base branch tip from when the PR was opened, while
+          # actions/checkout leaves HEAD on a merge of the PR into the *current*
+          # base tip. "$BASE_SHA"...HEAD therefore spans every base-branch commit
+          # landed since, so a PR that touches no UI file still gets linted
+          # against hundreds of other people's files. Diff the PR head against its
+          # own merge base instead, which is exactly what this PR changed.
+          merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
           test -n "$merge_base"
           git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
           : > "$RUNNER_TEMP/prettier_files.txt"
@@ -315,9 +316,9 @@ jobs:
         if: steps.changed.outputs.has_files == 'true'
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
-          node-version-file: litellm/ui/litellm-dashboard/.nvmrc
+          node-version-file: ui/litellm-dashboard/.nvmrc
           cache: "npm"
-          cache-dependency-path: litellm/ui/litellm-dashboard/package-lock.json
+          cache-dependency-path: ui/litellm-dashboard/package-lock.json
 
       - name: Install dependencies
         if: steps.changed.outputs.has_files == 'true'
@@ -333,12 +334,12 @@ jobs:
           status=0
           if [ ${#prettier_files[@]} -gt 0 ]; then
             echo "::group::Prettier (${#prettier_files[@]} files)"
-            node_modules/.bin/prettier --check "${prettier_files[@]}" || { status=1; echo "::error::Unformatted files. Fix with: npm run format"; }
+            npx prettier --check "${prettier_files[@]}" || { status=1; echo "::error::Unformatted files. Fix with: npm run format"; }
             echo "::endgroup::"
           fi
           if [ ${#eslint_files[@]} -gt 0 ]; then
             echo "::group::ESLint (${#eslint_files[@]} files)"
-            node_modules/.bin/eslint --no-warn-ignored --pass-on-unpruned-suppressions "${eslint_files[@]}" || status=1
+            npx eslint --no-warn-ignored --pass-on-unpruned-suppressions "${eslint_files[@]}" || status=1
             echo "::endgroup::"
           fi
           exit $status
@@ -375,7 +376,7 @@ jobs:
             exit 0
           fi
           files="$(git diff --name-only "$base" HEAD)"
-          if grep -Ev '^litellm/(ui|vscode-extension|rust|proxy-extras|packaging|cli|scripts|runtime)/' <<< "$files" | grep -E '^(litellm/|enterprise/|(pyproject\.toml|uv\.lock)$|\.github/workflows/test-linting\.yml$)' >/dev/null || grep -Eq '^litellm/ui/litellm-dashboard/(src/lib/http/schema\.d\.ts|scripts/gen-api-types\.mjs|package(-lock)?\.json)$' <<< "$files"; then
+          if grep -Eq '^(litellm/|enterprise/|(pyproject\.toml|uv\.lock)$|ui/litellm-dashboard/(src/lib/http/schema\.d\.ts|scripts/gen-api-types\.mjs|package(-lock)?\.json)$|\.github/workflows/test-linting\.yml$)' <<< "$files"; then
             echo "relevant=true" >> "$GITHUB_OUTPUT"
           else
             echo "No litellm, enterprise, dependency or generator changes in this pull request, nothing to verify."
@@ -396,7 +397,7 @@ jobs:
 
       - name: Cache uv dependencies
         if: steps.changes.outputs.relevant == 'true'
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cache/uv
@@ -434,7 +435,7 @@ jobs:
             echo "A lazily loaded route or model changed without regenerating the snapshot that /openapi.json serves for unloaded features."
             echo "To fix, run from the repo root:"
             echo "  uv run python -m litellm.proxy._lazy_openapi_snapshot"
-            echo "then run npm run gen:api from litellm/ui/litellm-dashboard and commit both files."
+            echo "then run npm run gen:api from ui/litellm-dashboard and commit both files."
             exit 1
           fi
           echo "_lazy_openapi_snapshot.json is in sync with the lazily loaded routes."
@@ -443,18 +444,18 @@ jobs:
         if: steps.changes.outputs.relevant == 'true'
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
-          node-version-file: litellm/ui/litellm-dashboard/.nvmrc
+          node-version-file: ui/litellm-dashboard/.nvmrc
           cache: "npm"
-          cache-dependency-path: litellm/ui/litellm-dashboard/package-lock.json
+          cache-dependency-path: ui/litellm-dashboard/package-lock.json
 
       - name: Install dashboard dependencies
         if: steps.changes.outputs.relevant == 'true'
-        working-directory: litellm/ui/litellm-dashboard
+        working-directory: ui/litellm-dashboard
         run: npm ci
 
       - name: Regenerate types from the live spec
         if: steps.changes.outputs.relevant == 'true'
-        working-directory: litellm/ui/litellm-dashboard
+        working-directory: ui/litellm-dashboard
         env:
           LITELLM_PYTHON: "uv run --no-sync python"
         run: npm run gen:api
@@ -462,11 +463,11 @@ jobs:
       - name: Fail if types are stale
         if: steps.changes.outputs.relevant == 'true'
         run: |
-          if ! git diff --exit-code -- litellm/ui/litellm-dashboard/src/lib/http/schema.d.ts; then
-            echo "::error file=litellm/ui/litellm-dashboard/src/lib/http/schema.d.ts::Generated API types are out of sync with the proxy OpenAPI spec."
+          if ! git diff --exit-code -- ui/litellm-dashboard/src/lib/http/schema.d.ts; then
+            echo "::error file=ui/litellm-dashboard/src/lib/http/schema.d.ts::Generated API types are out of sync with the proxy OpenAPI spec."
             echo ""
             echo "A backend route or model changed without regenerating the dashboard types."
-            echo "To fix, run from litellm/ui/litellm-dashboard:"
+            echo "To fix, run from ui/litellm-dashboard:"
             echo "  npm run gen:api"
             echo "then commit the updated src/lib/http/schema.d.ts."
             exit 1
@@ -523,12 +524,6 @@ jobs:
       - name: check_provider_folders_documented
         run: uv run --no-sync python ./tests/code_coverage_tests/check_provider_folders_documented.py
 
-      - name: check_provider_endpoints_support_generated
-        run: uv run --no-sync python litellm/scripts/generate_provider_endpoints_support.py --check
-
-      - name: test_generate_provider_endpoints_support
-        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_generate_provider_endpoints_support.py
-
       - name: check_prisma_binary_cache
         run: uv run --no-sync python ./tests/code_coverage_tests/check_prisma_binary_cache.py
 
@@ -560,9 +555,6 @@ jobs:
       - name: router_code_coverage
         run: uv run --no-sync python ./tests/code_coverage_tests/router_code_coverage.py
 
-      - name: router_surface_check
-        run: uv run --no-sync python ./tests/code_coverage_tests/router_surface_check.py
-
       - name: test_chat_completion_imports
         run: uv run --no-sync python ./tests/code_coverage_tests/test_chat_completion_imports.py
 
@@ -629,12 +621,6 @@ jobs:
       - name: check_migrations_lock_timeout
         run: uv run --no-sync python ./tests/code_coverage_tests/check_migrations_lock_timeout.py
 
-      - name: check_no_none_string_error_fields
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_no_none_string_error_fields.py
-
-      - name: test_check_no_none_string_error_fields
-        run: uv run --no-sync pytest -q --noconftest -p no:cacheprovider -c /dev/null tests/code_coverage_tests/test_check_no_none_string_error_fields.py
-
       - name: check_no_publicly_known_master_key
         run: uv run --no-sync python ./tests/code_coverage_tests/check_no_publicly_known_master_key.py
 
@@ -703,7 +689,7 @@ jobs:
           version: "0.10.9"
 
       - name: Run Semgrep (custom rules)
-        run: uv tool run --from 'semgrep==1.157.0' semgrep scan --config .github/semgrep/rules . --error
+        run: uv tool run --from 'semgrep==1.157.0' semgrep scan --config .semgrep/rules . --error
   lint-passed:
     name: lint passed
     needs: [python, secret-scan, ui, ui-api-types, code-quality, ci-coverage, semgrep]

.github/workflows/test-mcp-dependency-resolution.yml

@@ -10,17 +10,17 @@ on:
       - "uv.lock"
       - "uv.toml"
       - ".python-version"
-      - "litellm/rust/rust-toolchain.toml"
-      - "litellm/rust/**"
+      - "rust-toolchain.toml"
+      - "litellm-rust/**"
       - "litellm/__init__.py"
       - "litellm/_version.py"
       - "litellm/_lazy_imports_registry.py"
-      - "litellm/scripts/build_core_distribution.py"
+      - "scripts/build_core_distribution.py"
       - "litellm/proxy/proxy_server.py"
       - "litellm/**/*mcp*"
       - "litellm/**/*mcp*/**"
       - "litellm/integrations/arize/**"
-      - "litellm/scripts/check_mcp_sdk_install.py"
+      - "scripts/check_mcp_sdk_install.py"
       - "tests/base_sdk_tests/**"
       - ".github/workflows/test-mcp-dependency-resolution.yml"
       - ".github/actions/detect-changes/**"
@@ -28,7 +28,7 @@ on:
       - ".github/actions/cache-cargo-build/**"
       - ".github/scripts/detect_changes.sh"
       - ".github/scripts/uv_sync_with_retries.sh"
-      - ".github/scripts/ci/classify_changes.sh"
+      - ".circleci/scripts/classify_changes.sh"
 
 permissions:
   contents: read
@@ -45,7 +45,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
@@ -91,7 +91,7 @@ jobs:
               checker=("$GITHUB_WORKSPACE/tests/base_sdk_tests/check_base_sdk_install.py")
               (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/.venv-$extra/bin/python" -I "$GITHUB_WORKSPACE/tests/base_sdk_tests/check_sdk_http.py")
             else
-              checker=("$GITHUB_WORKSPACE/litellm/scripts/check_mcp_sdk_install.py" --extra "$extra")
+              checker=("$GITHUB_WORKSPACE/scripts/check_mcp_sdk_install.py" --extra "$extra")
             fi
             (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/.venv-$extra/bin/python" "${checker[@]}")
           done
@@ -115,7 +115,7 @@ jobs:
             if [ "$extra" = core ]; then
               checker=("$GITHUB_WORKSPACE/tests/base_sdk_tests/check_base_sdk_install.py")
             else
-              checker=("$GITHUB_WORKSPACE/litellm/scripts/check_mcp_sdk_install.py" --extra "$extra")
+              checker=("$GITHUB_WORKSPACE/scripts/check_mcp_sdk_install.py" --extra "$extra")
             fi
             (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/.venv-lowest-$extra/bin/python" "${checker[@]}")
           done
@@ -132,7 +132,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
@@ -147,16 +147,15 @@ jobs:
       - name: Build the core wheel and source distribution
         run: >-
           uv run --no-project --with coverage==7.14.0 python -m coverage run --rcfile=/dev/null
-          --branch --include="*/litellm/scripts/build_core_distribution.py"
-          litellm/scripts/build_core_distribution.py --out-dir dist/core
+          --branch --include="*/scripts/build_core_distribution.py"
+          scripts/build_core_distribution.py --out-dir dist/core
       - name: Verify metadata, resources, and independent source rebuild
         env:
           CORE_DISTRIBUTION_DIR: ${{ github.workspace }}/dist/core
         run: >-
           uv run --no-project --with pytest==9.0.3 --with pytest-cov==5.0.0 --with coverage==7.14.0 --with 'tomli==2.4.1; python_version < "3.11"'
-          python -m coverage run --rcfile=/dev/null --append --branch
-          --include="*/litellm/scripts/build_core_distribution.py"
-          -m pytest tests/base_sdk_tests/test_core_distribution.py -v
+          python -m pytest tests/base_sdk_tests/test_core_distribution.py -v
+          --cov-config=/dev/null --cov=scripts.build_core_distribution --cov-branch --cov-append --cov-report=
       - name: Verify isolated core installations
         run: |
           wheel=$(realpath dist/core/litellm_core-*.whl)

.github/workflows/test-merge-smoke.yml

@@ -3,8 +3,6 @@ name: smoke
 on:
   pull_request:
     branches: [main, litellm_internal_staging, litellm_oss_staging, "litellm_**"]
-  push:
-    branches: [main]
   workflow_dispatch:
 
 permissions:
@@ -26,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Build the dashboard stage
-        run: docker build --target ui-builder -f litellm/deploy/docker/Dockerfile .
+        run: docker build --target ui-builder -f Dockerfile .
 
   core-checks:
     name: py${{ matrix.python-version }}
@@ -35,7 +33,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     env:
       LITELLM_LOCAL_MODEL_COST_MAP: "True"
     steps:
@@ -54,26 +52,8 @@ jobs:
         with:
           version: "0.10.9"
 
-      - name: Restore the Rust bridge
-        id: rust-bridge
-        uses: ./.github/actions/restore-rust-bridge
-
-      - name: Restore the Cargo build cache
-        if: steps.rust-bridge.outputs.cache-hit != 'true'
-        uses: ./.github/actions/cache-cargo-build
-
       - name: Install dependencies
-        env:
-          RUST_BRIDGE_RESTORED: ${{ steps.rust-bridge.outputs.cache-hit }}
-          PYTHON_VERSION: ${{ matrix.python-version }}
-        run: |
-          if [ "$RUST_BRIDGE_RESTORED" != "true" ]; then
-            .github/scripts/uv_sync_with_retries.sh --frozen --extra proxy --extra cli --group dev --group proxy-dev --python "$PYTHON_VERSION"
-            exit 0
-          fi
-          .github/scripts/uv_sync_with_retries.sh --frozen --extra proxy --extra cli --group dev --group proxy-dev --python "$PYTHON_VERSION" --no-install-project
-          uv pip install --no-deps --python .venv/bin/python rust-bridge-dist/litellm-*.whl
-          cp rust-bridge-dist/litellm/rust_bridge/_native.abi3.so litellm/rust_bridge/_native.abi3.so
+        run: .github/scripts/uv_sync_with_retries.sh --frozen --extra proxy --extra cli --group dev --group proxy-dev --python ${{ matrix.python-version }}
 
       - name: Create the loopback-only network namespace
         run: |
@@ -96,18 +76,11 @@ jobs:
       - name: Import and CLI checks
         run: $IN_NETNS .venv/bin/python .github/scripts/run_merge_smoke.py cli
 
-      - name: Routing and UUID compatibility
-        run: >-
-          $IN_NETNS .venv/bin/python -m pytest
-          tests/unit/router_strategy/test_complexity_router.py::TestCustomDimensions
-          tests/unit/test_uuid_helper.py -q
-
       - name: Proxy startup check
         run: $IN_NETNS .venv/bin/python .github/scripts/run_merge_smoke.py proxy-startup --diagnostics-dir "${RUNNER_TEMP}/smoke-diagnostics"
 
       - name: Upload smoke diagnostics
         if: always()
-        continue-on-error: true
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: merge-smoke-diagnostics-py${{ matrix.python-version }}
@@ -118,10 +91,6 @@ jobs:
         if: always()
         run: sudo ip netns delete smoke
 
-      - name: Keep only source-built wheels in the uv cache
-        if: always() && github.ref == 'refs/heads/main'
-        run: uv cache prune --ci
-
   all-extras:
     name: all-extras-py${{ matrix.python-version }}
     runs-on: ubuntu-24.04
@@ -148,38 +117,16 @@ jobs:
         with:
           version: "0.10.9"
 
-      - name: Restore the Rust bridge
-        id: rust-bridge
-        uses: ./.github/actions/restore-rust-bridge
-
-      - name: Restore the Cargo build cache
-        if: steps.rust-bridge.outputs.cache-hit != 'true'
-        uses: ./.github/actions/cache-cargo-build
-
       - name: Install every extra and dependency group
-        env:
-          RUST_BRIDGE_RESTORED: ${{ steps.rust-bridge.outputs.cache-hit }}
-          PYTHON_VERSION: ${{ matrix.python-version }}
-        run: |
-          if [ "$RUST_BRIDGE_RESTORED" != "true" ]; then
-            .github/scripts/uv_sync_with_retries.sh --frozen --all-groups --all-extras --python "$PYTHON_VERSION"
-            exit 0
-          fi
-          .github/scripts/uv_sync_with_retries.sh --frozen --all-groups --all-extras --python "$PYTHON_VERSION" --no-install-project --no-install-package litellm-proxy
-          uv pip install --no-deps --python .venv/bin/python rust-bridge-dist/*.whl
-          cp rust-bridge-dist/litellm/rust_bridge/_native.abi3.so litellm/rust_bridge/_native.abi3.so
+        run: .github/scripts/uv_sync_with_retries.sh --frozen --all-groups --all-extras --python ${{ matrix.python-version }}
 
       - name: Import the SDK, the proxy server and the enterprise package
         run: .venv/bin/python -c "import litellm, litellm.proxy.proxy_server, litellm_enterprise"
 
-      - name: Keep only source-built wheels in the uv cache
-        if: always() && github.ref == 'refs/heads/main'
-        run: uv cache prune --ci
-
   windows-sdk:
     name: windows-sdk
     runs-on: windows-2025
-    timeout-minutes: 30
+    timeout-minutes: 10
     env:
       LITELLM_LOCAL_MODEL_COST_MAP: "True"
     defaults:
@@ -202,15 +149,11 @@ jobs:
           version: "0.10.9"
 
       - name: Install dependencies
-        run: .github/scripts/uv_sync_with_retries.sh --frozen --group dev --python 3.11
+        run: .github/scripts/uv_sync_with_retries.sh --frozen --no-install-workspace --group dev --python 3.11
 
       - name: Run the Windows tests
         run: uv run --no-sync python -m pytest --tb=short -v tests/windows_tests
 
-      - name: Keep only source-built wheels in the uv cache
-        if: always() && github.ref == 'refs/heads/main'
-        run: uv cache prune --ci
-
   proxy-build-from-pip:
     name: proxy-build-from-pip
     runs-on: ubuntu-24.04
@@ -248,36 +191,8 @@ jobs:
       - name: Install the test client dependencies
         run: .github/scripts/uv_sync_with_retries.sh --frozen --no-install-workspace --extra proxy --group dev --python 3.12
 
-      - name: Cache Prisma binaries
-        timeout-minutes: 3
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Install the published proxy into its own venv
-        run: |
-          uv --no-config venv --python 3.13 /tmp/litellm-pip
-          uv --no-config pip install --python /tmp/litellm-pip/bin/python \
-            "litellm[proxy,proxy-runtime]==1.83.0" \
-            "google-cloud-aiplatform==1.133.0" \
-            "google-genai==1.37.0" \
-            "anthropic[vertex]==0.84.0" \
-            "grpcio==1.78.0" \
-            "prometheus-client==0.20.0" \
-            "langfuse==2.59.7" \
-            "opentelemetry-api==1.28.0" \
-            "opentelemetry-sdk==1.28.0" \
-            "opentelemetry-exporter-otlp==1.28.0" \
-            "ddtrace==4.11.0" \
-            "sentry-sdk==2.21.0" \
-            "mangum==0.17.0" \
-            "azure-ai-contentsafety==1.0.0" \
-            "azure-storage-file-datalake==12.20.0" \
-            "pypdf==6.7.5" \
-            "llm-sandbox==0.3.31" \
-            "detect-secrets==1.5.0" \
-            "prisma==0.11.0" \
-            "openai==2.24.0"
-          export PATH="/tmp/litellm-pip/bin:$PATH"
-          /tmp/litellm-pip/bin/prisma generate --schema=litellm/schema.prisma
+      - name: Build the image from the published package
+        run: docker build -t litellm-build-from-pip:smoke -f docker/build_from_pip/Dockerfile.build_from_pip .
 
       - name: Start the fake OpenAI endpoint
         run: |
@@ -295,21 +210,23 @@ jobs:
           echo "::add-mask::${key}"
           echo "LITELLM_MASTER_KEY=${key}" >> "${GITHUB_ENV}"
 
-      - name: Start the published proxy
-        env:
-          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/circle_test
-          LITELLM_LICENSE: bad-license
-          FAKE_OPENAI_API_BASE: http://localhost:8190
-          OTEL_EXPORTER: in_memory
-          USE_DDTRACE: "True"
-          DD_TRACE_OPENAI_ENABLED: "False"
-          GCS_FLUSH_INTERVAL: "1"
-          LITELLM_LOG: ERROR
+      - name: Start the proxy container
         run: |
-          cd /tmp/litellm-pip
-          nohup /tmp/litellm-pip/bin/ddtrace-run /tmp/litellm-pip/bin/litellm \
-            --config "${GITHUB_WORKSPACE}/tests/basic_proxy_startup_tests/build_from_pip_config.yaml" \
-            --port 4000 > /tmp/litellm-pip.log 2>&1 &
+          docker run -d \
+            -p 4000:4000 \
+            -e DATABASE_URL=postgresql://postgres:postgres@host.docker.internal:5432/circle_test \
+            -e LITELLM_MASTER_KEY \
+            -e FAKE_OPENAI_API_BASE=http://host.docker.internal:8190 \
+            -e OTEL_EXPORTER=in_memory \
+            -e USE_DDTRACE=True \
+            -e GCS_FLUSH_INTERVAL=1 \
+            -e LITELLM_LOG=ERROR \
+            --add-host host.docker.internal:host-gateway \
+            --name litellm-build-from-pip \
+            -v "${GITHUB_WORKSPACE}/docker/build_from_pip/litellm_config.yaml:/app/config.yaml" \
+            litellm-build-from-pip:smoke \
+            --config /app/config.yaml \
+            --port 4000
           for _ in $(seq 1 150); do
             curl -sf --max-time 5 -o /dev/null http://localhost:4000 && exit 0
             sleep 2
@@ -344,11 +261,7 @@ jobs:
 
       - name: Show the proxy logs
         if: always()
-        run: cat /tmp/litellm-pip.log || true
-
-      - name: Keep only source-built wheels in the uv cache
-        if: always() && github.ref == 'refs/heads/main'
-        run: uv cache prune --ci
+        run: docker logs litellm-build-from-pip || true
 
   smoke-passed:
     name: smoke passed

.github/workflows/test-rust-db.yml

@@ -1,108 +0,0 @@
-name: LiteLLM Rust DB
-
-on:
-  push:
-    paths:
-      - "litellm/rust/crates/db/**"
-      - "litellm/rust/Cargo.toml"
-      - "litellm/rust/Cargo.lock"
-      - "litellm/rust/clippy.toml"
-      - "litellm/proxy-extras/litellm_proxy_extras/migrations/**"
-      - "**/schema.prisma"
-      - "litellm/rust/.cargo/**"
-      - "litellm/rust/rust-toolchain.toml"
-      - "pyproject.toml"
-      - "uv.lock"
-      - ".github/actions/setup-uv-with-retries/**"
-      - ".github/workflows/test-rust-db.yml"
-  pull_request:
-    branches:
-      - main
-      - "litellm_**"
-    paths:
-      - "litellm/rust/crates/db/**"
-      - "litellm/rust/Cargo.toml"
-      - "litellm/rust/Cargo.lock"
-      - "litellm/rust/clippy.toml"
-      - "litellm/proxy-extras/litellm_proxy_extras/migrations/**"
-      - "**/schema.prisma"
-      - "litellm/rust/.cargo/**"
-      - "litellm/rust/rust-toolchain.toml"
-      - "pyproject.toml"
-      - "uv.lock"
-      - ".github/actions/setup-uv-with-retries/**"
-      - ".github/workflows/test-rust-db.yml"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: "0"
-
-jobs:
-  db-queries:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    services:
-      postgres:
-        image: postgres:16.6@sha256:557fea37a744d5f4c8faab304b0a90858b53ab119735a88c131fd19dab802f36
-        env:
-          POSTGRES_DB: litellm
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_USER: postgres
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U postgres -d litellm"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    env:
-      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/litellm
-      SQLX_OFFLINE: "false"
-    defaults:
-      run:
-        working-directory: litellm/rust
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - run: rustup toolchain install --no-self-update
-
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: litellm/rust
-          cache-on-failure: true
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: Install Python dependencies
-        working-directory: .
-        run: uv sync --frozen --extra extra-proxy
-
-      - name: Deploy Prisma migrations
-        working-directory: .
-        run: uv run --no-sync prisma migrate deploy --schema litellm/proxy-extras/litellm_proxy_extras/schema.prisma
-
-      - name: Install SQLx CLI
-        run: cargo install sqlx-cli --version 0.9.0 --locked --no-default-features -F postgres
-
-      - name: Check SQLx query metadata
-        working-directory: litellm/rust/crates/db
-        run: cargo sqlx prepare --check
-
-      - name: Test database queries
-        run: cargo test -p litellm-db --locked -- --include-ignored

.github/workflows/test-rust.yml

@@ -3,12 +3,11 @@ name: LiteLLM Rust
 on:
   push:
     paths:
-      - "litellm/rust/**"
-      - "model_prices_and_context_window.json"
+      - "litellm-rust/**"
       - "litellm/rust_bridge/**"
-      - "litellm/scripts/generate_trace_types.py"
-      - "litellm/scripts/trace_codegen/**"
-      - "litellm/scripts/lens_assets/**"
+      - "scripts/generate_trace_types.py"
+      - "scripts/trace_codegen/**"
+      - "scripts/lens_assets/**"
       - "litellm/tracing/**"
       - "tests/test_litellm_rust/**"
       - "litellm/integrations/custom_logger.py"
@@ -17,17 +16,13 @@ on:
       - "litellm/proxy/guardrails/**"
       - "litellm/utils.py"
       - "litellm/ocr/**"
-      - "litellm/chat_completions/dispatch.py"
-      - "litellm/embeddings/dispatch.py"
-      - "litellm/messages/dispatch.py"
-      - "litellm/responses/dispatch.py"
       - "litellm/llms/base_llm/ocr/**"
       - "litellm/llms/custom_httpx/llm_http_handler.py"
       - "Makefile"
-      - "litellm/rust/.cargo/**"
+      - ".cargo/**"
       - "pyproject.toml"
       - "uv.lock"
-      - "litellm/rust/rust-toolchain.toml"
+      - "rust-toolchain.toml"
       - ".github/actions/setup-uv-with-retries/**"
       - ".github/scripts/smoke_test_native_wheel.py"
       - ".github/scripts/verify_linux_native_wheel.py"
@@ -38,12 +33,11 @@ on:
       - main
       - "litellm_**"
     paths:
-      - "litellm/rust/**"
-      - "model_prices_and_context_window.json"
+      - "litellm-rust/**"
       - "litellm/rust_bridge/**"
-      - "litellm/scripts/generate_trace_types.py"
-      - "litellm/scripts/trace_codegen/**"
-      - "litellm/scripts/lens_assets/**"
+      - "scripts/generate_trace_types.py"
+      - "scripts/trace_codegen/**"
+      - "scripts/lens_assets/**"
       - "litellm/tracing/**"
       - "tests/test_litellm_rust/**"
       - "litellm/integrations/custom_logger.py"
@@ -52,17 +46,13 @@ on:
       - "litellm/proxy/guardrails/**"
       - "litellm/utils.py"
       - "litellm/ocr/**"
-      - "litellm/chat_completions/dispatch.py"
-      - "litellm/embeddings/dispatch.py"
-      - "litellm/messages/dispatch.py"
-      - "litellm/responses/dispatch.py"
       - "litellm/llms/base_llm/ocr/**"
       - "litellm/llms/custom_httpx/llm_http_handler.py"
       - "Makefile"
-      - "litellm/rust/.cargo/**"
+      - ".cargo/**"
       - "pyproject.toml"
       - "uv.lock"
-      - "litellm/rust/rust-toolchain.toml"
+      - "rust-toolchain.toml"
       - ".github/actions/setup-uv-with-retries/**"
       - ".github/scripts/smoke_test_native_wheel.py"
       - ".github/scripts/verify_linux_native_wheel.py"
@@ -78,7 +68,6 @@ concurrency:
 
 env:
   CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: "0"
 
 jobs:
   rust-lint:
@@ -86,21 +75,19 @@ jobs:
     timeout-minutes: 15
     defaults:
       run:
-        working-directory: litellm/rust
+        working-directory: litellm-rust
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           persist-credentials: false
 
-      - name: Configure the Rust build environment
-        working-directory: .
-        run: bash .github/scripts/setup_rust_environment.sh
+      - run: rustup toolchain install --no-self-update
 
       - run: cargo fmt --all --check
 
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          workspaces: litellm/rust
+          workspaces: litellm-rust
           cache-on-failure: true
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
@@ -114,7 +101,7 @@ jobs:
       CARGO_PROFILE_DEV_DEBUG: line-tables-only
     defaults:
       run:
-        working-directory: litellm/rust
+        working-directory: litellm-rust
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
@@ -142,13 +129,13 @@ jobs:
 
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          workspaces: litellm/rust
+          workspaces: litellm-rust
           cache-on-failure: true
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Check generated trace contracts
         working-directory: .
-        run: uv run litellm/scripts/generate_trace_types.py --check
+        run: uv run scripts/generate_trace_types.py --check
 
       - run: cargo nextest run --workspace --locked
 
@@ -188,7 +175,7 @@ jobs:
 
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          workspaces: litellm/rust
+          workspaces: litellm-rust
           cache-on-failure: true
           save-if: ${{ github.ref == 'refs/heads/main' }}
 

.github/workflows/test-terraform-modules.yml

@@ -3,16 +3,16 @@ name: Terraform Modules
 on:
   push:
     paths:
-      - "litellm/deploy/terraform/litellm/aws/**"
-      - "litellm/deploy/terraform/litellm/gcp/**"
+      - "terraform/litellm/aws/**"
+      - "terraform/litellm/gcp/**"
       - ".github/workflows/test-terraform-modules.yml"
   pull_request:
     branches:
       - main
       - "litellm_**"
     paths:
-      - "litellm/deploy/terraform/litellm/aws/**"
-      - "litellm/deploy/terraform/litellm/gcp/**"
+      - "terraform/litellm/aws/**"
+      - "terraform/litellm/gcp/**"
       - ".github/workflows/test-terraform-modules.yml"
 
 permissions:
@@ -33,7 +33,7 @@ jobs:
         module: [aws, gcp]
     defaults:
       run:
-        working-directory: litellm/deploy/terraform/litellm/${{ matrix.module }}
+        working-directory: terraform/litellm/${{ matrix.module }}
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:

.github/workflows/test-terraform-provider.yml

@@ -3,18 +3,16 @@ name: Terraform Provider
 on:
   push:
     paths:
-      - "litellm/deploy/terraform/provider/**"
-      - ".github/actions/cache-go-build/**"
+      - "terraform/provider/**"
       - ".github/workflows/test-terraform-provider.yml"
   pull_request:
     branches:
       - main
       - "litellm_**"
     paths:
-      - "litellm/deploy/terraform/provider/**"
+      - "terraform/provider/**"
       - "litellm/proxy/**"
-      - "litellm/enterprise/**"
-      - ".github/actions/cache-go-build/**"
+      - "enterprise/**"
       - ".github/workflows/test-terraform-provider.yml"
 
 permissions:
@@ -31,7 +29,7 @@ jobs:
     timeout-minutes: 10
     defaults:
       run:
-        working-directory: litellm/deploy/terraform/provider
+        working-directory: terraform/provider
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
@@ -39,13 +37,9 @@ jobs:
 
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version-file: litellm/deploy/terraform/provider/go.mod
-          cache: false
-
-      - name: Cache the Go build
-        uses: ./.github/actions/cache-go-build
-        with:
-          dependency-path: litellm/deploy/terraform/provider/go.sum
+          go-version-file: terraform/provider/go.mod
+          cache: true
+          cache-dependency-path: terraform/provider/go.sum
 
       - name: gofmt
         run: |
@@ -121,18 +115,14 @@ jobs:
 
       - name: Generate proxy OpenAPI schema
         run: |
-          uv run --no-sync python litellm/deploy/terraform/provider/tools/dump_openapi.py "${RUNNER_TEMP}/openapi.json"
+          uv run --no-sync python terraform/provider/tools/dump_openapi.py "${RUNNER_TEMP}/openapi.json"
 
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version-file: litellm/deploy/terraform/provider/go.mod
-          cache: false
-
-      - name: Cache the Go build
-        uses: ./.github/actions/cache-go-build
-        with:
-          dependency-path: litellm/deploy/terraform/provider/go.sum
+          go-version-file: terraform/provider/go.mod
+          cache: true
+          cache-dependency-path: terraform/provider/go.sum
 
       - name: Audit provider endpoints against the schema
-        working-directory: litellm/deploy/terraform/provider
+        working-directory: terraform/provider
         run: go run ./tools/endpointaudit -provider-dir ./litellm -spec "${RUNNER_TEMP}/openapi.json" -coverage-allowlist ./tools/endpointaudit/coverage_allowlist.txt

.github/workflows/test-unit.yml

@@ -41,6 +41,13 @@ jobs:
         timeout-minutes: 2
         uses: ./.github/actions/detect-changes
 
+      - name: Define editable Rust bridge cache key
+        id: rust-bridge-key
+        if: steps.changes.outputs.decision != 'skip'
+        env:
+          RUST_BRIDGE_CACHE_KEY: ${{ runner.os }}-rust-bridge-editable-${{ hashFiles('litellm-rust/Cargo.lock', 'litellm-rust/Cargo.toml', 'litellm-rust/crates/**', 'pyproject.toml') }}
+        run: echo "key=$RUST_BRIDGE_CACHE_KEY" >> "$GITHUB_OUTPUT"
+
       - name: Set up Python
         if: steps.changes.outputs.decision != 'skip'
         timeout-minutes: 3
@@ -59,7 +66,10 @@ jobs:
         id: rust-bridge-cache
         if: steps.changes.outputs.decision != 'skip'
         timeout-minutes: 5
-        uses: ./.github/actions/restore-rust-bridge
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830
+        with:
+          path: rust-bridge-dist
+          key: ${{ steps.rust-bridge-key.outputs.key }}
 
       - name: Cache the Rust build
         if: steps.changes.outputs.decision != 'skip' && steps.rust-bridge-cache.outputs.cache-hit != 'true'
@@ -69,23 +79,13 @@ jobs:
       - name: Build editable Rust bridge
         if: steps.changes.outputs.decision != 'skip' && steps.rust-bridge-cache.outputs.cache-hit != 'true'
         timeout-minutes: 15
-        env:
-          CARGO_INCREMENTAL: "0"
         run: |
           mkdir -p rust-bridge-dist
-          uv run --no-project --with maturin==1.15.0 python .github/packaging/build_backend.py rust-bridge-dist
+          uv run --no-project --with maturin==1.15.0 python -c 'import maturin; maturin.build_editable("rust-bridge-dist")'
           strip --strip-debug litellm/rust_bridge/_native.abi3.so
           mkdir -p rust-bridge-dist/litellm/rust_bridge
           cp litellm/rust_bridge/_native.abi3.so rust-bridge-dist/litellm/rust_bridge/_native.abi3.so
 
-      - name: Build the gateway wheel once for test shards
-        if: steps.changes.outputs.decision != 'skip' && steps.rust-bridge-cache.outputs.cache-hit != 'true'
-        timeout-minutes: 15
-        working-directory: litellm/packaging/litellm-proxy
-        env:
-          CARGO_INCREMENTAL: "0"
-        run: uv run --no-project --with maturin==1.15.0 maturin build --profile dev --strip --out ../../../rust-bridge-dist
-
       - name: Upload Rust bridge artifact
         if: steps.changes.outputs.decision != 'skip'
         timeout-minutes: 10
@@ -101,7 +101,7 @@ jobs:
         uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830
         with:
           path: rust-bridge-dist
-          key: ${{ steps.rust-bridge-cache.outputs.key }}
+          key: ${{ steps.rust-bridge-key.outputs.key }}
 
       - name: Expose the Rust bridge artifact
         id: rust-bridge-artifact
@@ -140,10 +140,8 @@ jobs:
         include:
           - shard: core-utils
             test-path: |-
-              tests/unit/accounting
               tests/unit/batch_completion
               tests/unit/decisions
-              tests/unit/extraction
               tests/unit/litellm_core_utils
               tests/unit/systemone
             python-version: "3.12"
@@ -158,7 +156,6 @@ jobs:
               tests/unit/google_genai
               tests/unit/router_strategy
               tests/unit/router_utils
-              tests/unit/redis
               tests/unit/proxy/common_utils/test_cache_aware_routing.py
               tests/unit/enterprise/enterprise_callbacks/send_emails
               tests/unit/enterprise/proxy/test_afile_retrieve_returns_unified_id.py
@@ -221,17 +218,14 @@ jobs:
 
           - shard: llms-providers
             test-path: |-
-              tests/unit/llms/test_api_base_trailing_slash_routes.py
               tests/unit/llms/test_cache_control_and_reasoning.py
               tests/unit/llms/test_custom_llm.py
               tests/unit/llms/test_file_content_block.py
               tests/unit/llms/test_file_search_responses.py
-              tests/unit/llms/test_get_complete_url_trailing_slash.py
               tests/unit/llms/test_lifecycle_fix.py
               tests/unit/llms/test_oss_decision.py
               tests/unit/llms/test_polling_url_origin_match.py
               tests/unit/llms/test_predibase_transformation.py
-              tests/unit/llms/test_subscription_accounts.py
               tests/unit/llms/a2a
               tests/unit/llms/aiml
               tests/unit/llms/aiohttp_openai
@@ -241,7 +235,6 @@ jobs:
               tests/unit/llms/azure_ai
               tests/unit/llms/base_llm
               tests/unit/llms/baseten
-              tests/unit/llms/bigmodel
               tests/unit/llms/black_forest_labs
               tests/unit/llms/brave
               tests/unit/llms/bytez
@@ -250,9 +243,7 @@ jobs:
               tests/unit/llms/chatgpt
               tests/unit/llms/clarifai
               tests/unit/llms/claude_code
-              tests/unit/llms/clf_ai_gateway
               tests/unit/llms/cloudflare
-              tests/unit/llms/codestral
               tests/unit/llms/codex
               tests/unit/llms/cohere
               tests/unit/llms/cometapi
@@ -272,14 +263,12 @@ jobs:
               tests/unit/llms/e2b
               tests/unit/llms/edenai
               tests/unit/llms/elevenlabs
-              tests/unit/llms/empiriolabs
               tests/unit/llms/exa_ai
               tests/unit/llms/fal_ai
               tests/unit/llms/fastcrw
               tests/unit/llms/featherless_ai
               tests/unit/llms/firecrawl
               tests/unit/llms/fireworks_ai
-              tests/unit/llms/friendliai
               tests/unit/llms/gdc
               tests/unit/llms/gemini
               tests/unit/llms/gigachat
@@ -312,7 +301,6 @@ jobs:
               tests/unit/llms/modelscope
               tests/unit/llms/mongodb
               tests/unit/llms/moonshot
-              tests/unit/llms/morph
               tests/unit/llms/nadir
               tests/unit/llms/nebius
               tests/unit/llms/neosantara
@@ -329,7 +317,6 @@ jobs:
               tests/unit/llms/openai_like
               tests/unit/llms/opencode
               tests/unit/llms/opensandbox
-              tests/unit/llms/opensearch
               tests/unit/llms/openrouter
               tests/unit/llms/ovhcloud
               tests/unit/llms/parallel_ai
@@ -337,7 +324,6 @@ jobs:
               tests/unit/llms/pass_through
               tests/unit/llms/perplexity
               tests/unit/llms/pg_vector
-              tests/unit/llms/pi
               tests/unit/llms/publicai
               tests/unit/llms/ragflow
               tests/unit/llms/recraft
@@ -373,7 +359,6 @@ jobs:
               tests/unit/llms/voyage
               tests/unit/llms/wandb
               tests/unit/llms/watsonx
-              tests/unit/llms/webiq
               tests/unit/llms/xai
               tests/unit/llms/xinference
               tests/unit/llms/you_com
@@ -409,7 +394,6 @@ jobs:
 
           - shard: router
             test-path: >-
-              tests/unit/router_rust
               tests/unit/test_router
             python-version: "3.12"
             workers: 4
@@ -429,7 +413,6 @@ jobs:
               tests/unit/embeddings
               tests/unit/endpoints
               tests/unit/files
-              tests/unit/fine_tuning
               tests/unit/images
               tests/unit/interactions
               tests/unit/messages
@@ -439,7 +422,6 @@ jobs:
               tests/unit/realtime_api
               tests/unit/rerank_api
               tests/unit/search
-              tests/unit/text_completions
               tests/unit/vector_stores
               tests/unit/videos
             python-version: "3.12"
@@ -451,13 +433,6 @@ jobs:
 
           - shard: rust-bridge-harness
             test-path: >-
-              tests/test_litellm_rust/test_dispatch.py
-              tests/test_litellm_rust/test_public_entries.py
-              tests/test_litellm_rust/chat_completions/test_dispatch.py
-              tests/test_litellm_rust/embeddings/test_dispatch.py
-              tests/test_litellm_rust/messages/test_dispatch.py
-              tests/test_litellm_rust/ocr/test_dispatch.py
-              tests/test_litellm_rust/responses/test_dispatch.py
               tests/unit/compression
               tests/unit/harness
               tests/unit/rust_bridge
@@ -527,7 +502,6 @@ jobs:
               tests/unit/proxy/management_helpers
               tests/unit/proxy/list_api
               tests/unit/proxy/analytics_endpoints
-              tests/unit/proxy/alerting_endpoints
               tests/unit/proxy/decisions_endpoints
               tests/unit/proxy/memory
               tests/unit/proxy/agent_endpoints
@@ -567,14 +541,12 @@ jobs:
               tests/unit/proxy/credential_endpoints
               tests/unit/proxy/discovery_endpoints
               tests/unit/proxy/shutdown
-              tests/unit/proxy/rust_forward
               tests/unit/proxy/public_endpoints
               tests/unit/proxy/prompts
               tests/unit/proxy/rag_endpoints
               tests/unit/proxy/rerank_endpoints
               tests/unit/proxy/realtime_endpoints
               tests/unit/proxy/ui_crud_endpoints
-              tests/unit/proxy/deps
               tests/unit/proxy/config_resolvers
               tests/unit/proxy/utils
             python-version: "3.12"
@@ -596,13 +568,13 @@ jobs:
 
           - shard: mcp-elicitation
             test-path: |-
-              tests/unit/mcp_client/test_mcp_client.py
-              tests/unit/proxy/mcp_server/test_capabilities.py
-              tests/unit/proxy/mcp_server/test_interactions.py
-              tests/unit/proxy/mcp_server/test_mcp_elicitation_handler.py
-              tests/unit/proxy/mcp_server/test_mcp_server_manager.py
-              tests/unit/proxy/mcp_server/test_mcp_server_tool_calls_and_headers.py
-              tests/unit/proxy/mcp_server/test_operations.py
+              tests/unit/experimental_mcp_client/test_mcp_client.py
+              tests/unit/proxy/_experimental/mcp_server/test_capabilities.py
+              tests/unit/proxy/_experimental/mcp_server/test_interactions.py
+              tests/unit/proxy/_experimental/mcp_server/test_mcp_elicitation_handler.py
+              tests/unit/proxy/_experimental/mcp_server/test_mcp_server_manager.py
+              tests/unit/proxy/_experimental/mcp_server/test_mcp_server_tool_calls_and_headers.py
+              tests/unit/proxy/_experimental/mcp_server/test_operations.py
             python-version: "3.12"
             workers: 4
             reruns: 0
@@ -610,32 +582,23 @@ jobs:
             job-timeout-minutes: 60
             dist: loadscope
 
-          - shard: proxy-infra-db-spend
+          - shard: proxy-infra
             test-path: |-
               tests/unit/proxy/db
               --ignore=tests/unit/proxy/db/db_transaction_queue/test_e2e_pod_lock_manager.py
               --ignore=tests/unit/proxy/db/test_update_daily_tag_spend.py
+              tests/unit/proxy/middleware
+              --ignore=tests/unit/proxy/middleware/test_request_size_limit_middleware.py
               tests/unit/proxy/spend_tracking
               --ignore=tests/unit/proxy/spend_tracking/test_search_api_logging.py
+              tests/unit/proxy/pass_through_endpoints
+              tests/unit/proxy/experimental
               tests/unit/proxy/common_utils
               --ignore=tests/unit/proxy/common_utils/test_cache_aware_routing.py
               --ignore=tests/unit/proxy/common_utils/test_check_batch_cost.py
               --ignore=tests/unit/proxy/common_utils/test_check_responses_cost.py
               --ignore=tests/unit/proxy/common_utils/test_proxy_encrypt_decrypt.py
               --ignore=tests/unit/proxy/common_utils/test_realtime_cache.py
-            python-version: "3.12"
-            workers: 4
-            reruns: 0
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-            dist: loadscope
-
-          - shard: proxy-infra-routing
-            test-path: |-
-              tests/unit/proxy/middleware
-              --ignore=tests/unit/proxy/middleware/test_request_size_limit_middleware.py
-              tests/unit/proxy/pass_through_endpoints
-              tests/unit/proxy/mcp_server/test_tool_registry.py
               tests/unit/proxy/enterprise_billing
               tests/unit/proxy/types_utils
               tests/unit/proxy/logging_endpoints
@@ -650,30 +613,34 @@ jobs:
             job-timeout-minutes: 60
             dist: loadscope
 
-          - shard: proxy-infra-root-a-p
+          - shard: proxy-infra-root
             test-path: |-
-              tests/unit/proxy/test_[_a-p]*.py
-              --deselect=tests/unit/proxy/test_aproxy_startup.py
-              --deselect=tests/unit/proxy/test_component_allowlists.py
-              --deselect=tests/unit/proxy/test_credential_slot_registry.py
-              --deselect=tests/unit/proxy/test_custom_callback_input.py
-              --deselect=tests/unit/proxy/test_custom_logger_s3_gcs.py
-              --deselect=tests/unit/proxy/test_custom_tokenizer_bug.py
-              --deselect=tests/unit/proxy/test_db_schema_changes.py
-              --deselect=tests/unit/proxy/test_deprecated_key_grace_period.py
-              --deselect=tests/unit/proxy/test_get_favicon.py
-              --deselect=tests/unit/proxy/test_get_image.py
-              --deselect=tests/unit/proxy/test_prisma_client_backoff_retry.py
-              --deselect=tests/unit/proxy/test_prometheus_metrics_server.py
-              --deselect=tests/unit/proxy/test_prompt_test_endpoint.py
-              --deselect=tests/unit/proxy/test_proxy_cli.py
-              --deselect=tests/unit/proxy/test_proxy_config_unit_test.py
-              --deselect=tests/unit/proxy/test_proxy_custom_auth.py
-              --deselect=tests/unit/proxy/test_proxy_reject_logging.py
-              --deselect=tests/unit/proxy/test_proxy_server.py
-              --deselect=tests/unit/proxy/test_proxy_setting_guardrails.py
-              --deselect=tests/unit/proxy/test_proxy_token_counter.py
-              --deselect=tests/unit/proxy/test_proxy_utils.py
+              tests/unit/proxy/test_*.py
+              --ignore=tests/unit/proxy/test_aproxy_startup.py
+              --ignore=tests/unit/proxy/test_credential_slot_registry.py
+              --ignore=tests/unit/proxy/test_custom_callback_input.py
+              --ignore=tests/unit/proxy/test_custom_logger_s3_gcs.py
+              --ignore=tests/unit/proxy/test_custom_tokenizer_bug.py
+              --ignore=tests/unit/proxy/test_db_schema_changes.py
+              --ignore=tests/unit/proxy/test_deprecated_key_grace_period.py
+              --ignore=tests/unit/proxy/test_get_favicon.py
+              --ignore=tests/unit/proxy/test_get_image.py
+              --ignore=tests/unit/proxy/test_prisma_client_backoff_retry.py
+              --ignore=tests/unit/proxy/test_prompt_test_endpoint.py
+              --ignore=tests/unit/proxy/test_proxy_config_unit_test.py
+              --ignore=tests/unit/proxy/test_proxy_custom_auth.py
+              --ignore=tests/unit/proxy/test_proxy_reject_logging.py
+              --ignore=tests/unit/proxy/test_proxy_server.py
+              --ignore=tests/unit/proxy/test_proxy_setting_guardrails.py
+              --ignore=tests/unit/proxy/test_proxy_token_counter.py
+              --ignore=tests/unit/proxy/test_proxy_utils.py
+              --ignore=tests/unit/proxy/test_reducto_ocr_route.py
+              --ignore=tests/unit/proxy/test_response_polling_pre_call_checks.py
+              --ignore=tests/unit/proxy/test_server_root_path.py
+              --ignore=tests/unit/proxy/test_ui_path_detection.py
+              --ignore=tests/unit/proxy/test_unit_test_proxy_hooks.py
+              --ignore=tests/unit/proxy/test_update_spend.py
+              --ignore=tests/unit/proxy/test_zero_cost_model_budget_bypass.py
             python-version: "3.12"
             workers: 4
             reruns: 0
@@ -681,35 +648,6 @@ jobs:
             job-timeout-minutes: 60
             dist: loadscope
 
-          - shard: proxy-infra-root-q-z
-            test-path: |-
-              tests/unit/proxy/test_[q-z]*.py
-              --deselect=tests/unit/proxy/test_reducto_ocr_route.py
-              --deselect=tests/unit/proxy/test_response_polling_pre_call_checks.py
-              --deselect=tests/unit/proxy/test_server_root_path.py
-              --deselect=tests/unit/proxy/test_ui_path_detection.py
-              --deselect=tests/unit/proxy/test_unit_test_proxy_hooks.py
-              --deselect=tests/unit/proxy/test_update_spend.py
-              --deselect=tests/unit/proxy/test_zero_cost_model_budget_bypass.py
-            python-version: "3.12"
-            workers: 4
-            reruns: 0
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-            dist: loadscope
-
-          - shard: proxy-subprocess
-            test-path: |-
-              tests/unit/proxy/test_component_allowlists.py
-              tests/unit/proxy/test_prometheus_metrics_server.py
-              tests/unit/proxy/test_proxy_cli.py
-            python-version: "3.12"
-            workers: 2
-            reruns: 0
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-            dist: loadscope
-
           - shard: caching-local
             test-path: >-
               tests/unit/caching
@@ -762,6 +700,7 @@ jobs:
               tests/unit/responses/litellm_completion_transformation
               tests/unit/responses/test_additional_tools.py
               tests/unit/responses/test_custom_tool_call.py
+              tests/unit/responses/test_dispatch.py
               tests/unit/responses/test_metadata_codex_callback.py
               tests/unit/responses/test_no_duplicate_spend_logs.py
               tests/unit/responses/test_null_test_fix.py
@@ -862,14 +801,14 @@ jobs:
 
           - shard: mcp-oauth
             test-path: |-
-              tests/unit/proxy/mcp_server/test_discoverable_endpoints.py
-              tests/unit/proxy/mcp_server/test_mcp_server_manager.py
-              tests/unit/proxy/mcp_server/test_db_credentials.py
-              tests/unit/proxy/mcp_server/test_gateway_dcr_flow.py
-              tests/unit/proxy/mcp_server/test_mcp_oauth_passthrough_tools.py
-              tests/unit/proxy/mcp_server/test_mcp_max_concurrent_requests.py
-              tests/unit/proxy/mcp_server/faults/test_list_outcomes.py
-              tests/unit/proxy/mcp_server/outbound_credentials
+              tests/unit/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
+              tests/unit/proxy/_experimental/mcp_server/test_mcp_server_manager.py
+              tests/unit/proxy/_experimental/mcp_server/test_db_credentials.py
+              tests/unit/proxy/_experimental/mcp_server/test_gateway_dcr_flow.py
+              tests/unit/proxy/_experimental/mcp_server/test_mcp_oauth_passthrough_tools.py
+              tests/unit/proxy/_experimental/mcp_server/test_mcp_max_concurrent_requests.py
+              tests/unit/proxy/_experimental/mcp_server/faults/test_list_outcomes.py
+              tests/unit/proxy/_experimental/mcp_server/outbound_credentials
             python-version: "3.12"
             workers: 4
             reruns: 2
@@ -879,21 +818,19 @@ jobs:
 
           - shard: mcp-server
             test-path: |-
-              tests/unit/mcp_client
               tests/unit/experimental_mcp_client
-              tests/unit/proxy/mcp_server
               tests/unit/proxy/_experimental/mcp_server
               tests/unit/responses/mcp
-              --ignore=tests/unit/mcp_client/test_mcp_client.py
-              --ignore=tests/unit/proxy/mcp_server/test_capabilities.py
-              --ignore=tests/unit/proxy/mcp_server/test_interactions.py
-              --ignore=tests/unit/proxy/mcp_server/test_mcp_elicitation_handler.py
-              --ignore=tests/unit/proxy/mcp_server/test_mcp_server_manager.py
-              --ignore=tests/unit/proxy/mcp_server/test_mcp_server_tool_calls_and_headers.py
-              --ignore=tests/unit/proxy/mcp_server/test_operations.py
-              --ignore=tests/unit/proxy/mcp_server/test_discoverable_endpoints.py
-              --ignore=tests/unit/proxy/mcp_server/test_db_credentials.py
-              --ignore=tests/unit/proxy/mcp_server/outbound_credentials
+              --ignore=tests/unit/experimental_mcp_client/test_mcp_client.py
+              --ignore=tests/unit/proxy/_experimental/mcp_server/test_capabilities.py
+              --ignore=tests/unit/proxy/_experimental/mcp_server/test_interactions.py
+              --ignore=tests/unit/proxy/_experimental/mcp_server/test_mcp_elicitation_handler.py
+              --ignore=tests/unit/proxy/_experimental/mcp_server/test_mcp_server_manager.py
+              --ignore=tests/unit/proxy/_experimental/mcp_server/test_mcp_server_tool_calls_and_headers.py
+              --ignore=tests/unit/proxy/_experimental/mcp_server/test_operations.py
+              --ignore=tests/unit/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
+              --ignore=tests/unit/proxy/_experimental/mcp_server/test_db_credentials.py
+              --ignore=tests/unit/proxy/_experimental/mcp_server/outbound_credentials
             python-version: "3.12"
             workers: 4
             reruns: 0
@@ -1006,7 +943,7 @@ jobs:
         timeout-minutes: 3
         with:
           persist-credentials: false
-          fetch-depth: 1
+          fetch-depth: ${{ matrix.shard == 'db-and-spend' && '0' || '1' }}
 
       - name: Detect relevant changes
         id: changes
@@ -1039,37 +976,27 @@ jobs:
         with:
           artifact: ${{ needs.rust-bridge.outputs.artifact }}
 
-      - name: Install dependencies
+      - name: Install dependencies and check schema
         if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
+        timeout-minutes: 8
         env:
           RUST_BRIDGE_ARTIFACT: ${{ needs.rust-bridge.outputs.artifact }}
+          UNIT_SHARD: ${{ matrix.shard }}
+          SCHEMA_BASE_REF: origin/${{ github.event.repository.default_branch }}
         run: |
           diff -u model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
           if [ -z "$RUST_BRIDGE_ARTIFACT" ]; then
-            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra switchyard --extra saml --extra extra_proxy --extra proxy-runtime --extra utils
+            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra caching --extra extra_proxy --extra proxy-runtime --extra utils
           else
-            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra switchyard --extra saml --extra extra_proxy --extra proxy-runtime --extra utils --no-install-project --no-install-package litellm-proxy
+            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra caching --extra extra_proxy --extra proxy-runtime --extra utils --no-install-project
             uv pip install --no-deps --python .venv/bin/python rust-bridge-dist/*.whl
             cp rust-bridge-dist/litellm/rust_bridge/_native.abi3.so litellm/rust_bridge/_native.abi3.so
             uv run --no-sync python -c "import importlib.metadata; import litellm.rust_bridge._native; print(importlib.metadata.version('litellm'))"
           fi
           uv run --no-sync python -c 'import os, sys; print(sys.version); assert f"{sys.version_info.major}.{sys.version_info.minor}" == os.environ["UV_PYTHON"]'
-
-      - name: Check litellm/schema.prisma against the merge base
-        if: steps.changes.outputs.decision != 'skip' && matrix.shard == 'db-and-spend' && github.event_name == 'pull_request'
-        timeout-minutes: 3
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          base_ref=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${EVENT_BASE_REF}" --jq .name) || base_ref=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .base.ref)
-          merge_base=$(gh api "repos/${GITHUB_REPOSITORY}/compare/${base_ref}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
-          test -n "$merge_base"
-          git fetch --no-tags --depth=1 origin "$merge_base"
-          uv run --no-sync python litellm/scripts/check_schema_compatibility.py --base-commit "$merge_base"
+          if [ "$UNIT_SHARD" = "db-and-spend" ]; then
+            uv run --no-sync python scripts/check_schema_compatibility.py --base-ref "$SCHEMA_BASE_REF"
+          fi
 
       - name: Cache Prisma binaries
         if: steps.changes.outputs.decision != 'skip'
@@ -1134,7 +1061,7 @@ jobs:
             --timeout="${TEST_TIMEOUT_SECONDS}" \
             --rerun-except "from pytest-timeout" \
             --durations=20 \
-            --cov=./litellm --cov=./litellm/enterprise/litellm_enterprise \
+            --cov=./litellm --cov=./enterprise/litellm_enterprise \
             --cov-report=xml:coverage.xml \
             --cov-config=pyproject.toml
           status=$?
@@ -1164,7 +1091,7 @@ jobs:
     timeout-minutes: 20
     defaults:
       run:
-        working-directory: litellm/ui/litellm-dashboard
+        working-directory: ui/litellm-dashboard
 
     steps:
       - name: Checkout repository
@@ -1183,9 +1110,9 @@ jobs:
         if: steps.changes.outputs.decision != 'skip'
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
-          node-version-file: litellm/ui/litellm-dashboard/.nvmrc
+          node-version-file: ui/litellm-dashboard/.nvmrc
           cache: "npm"
-          cache-dependency-path: litellm/ui/litellm-dashboard/package-lock.json
+          cache-dependency-path: ui/litellm-dashboard/package-lock.json
 
       - name: Install dependencies
         if: steps.changes.outputs.decision != 'skip'
@@ -1206,20 +1133,18 @@ jobs:
         env:
           CI: "true"
           GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           full_suite() { npm run test -- --run --pool forks --maxWorkers=14; }
 
-          if [ -z "$PR_NUMBER" ]; then
+          if [ -z "$BASE_SHA" ]; then
             echo "Push to $GITHUB_REF_NAME: running the full suite"
             full_suite
             exit 0
           fi
 
-          base_ref=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${EVENT_BASE_REF}" --jq .name) || base_ref=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .base.ref)
-          merge_base=$(gh api "repos/${GITHUB_REPOSITORY}/compare/${base_ref}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
+          merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
           test -n "$merge_base"
           git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
           changed_files=()
@@ -1306,7 +1231,7 @@ jobs:
       - name: Install dependencies
         if: steps.changes.outputs.decision != 'skip'
         run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra switchyard
+          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
 
       - name: Cache Prisma binaries
         if: steps.changes.outputs.decision != 'skip'
@@ -1355,20 +1280,19 @@ jobs:
 
       - name: Run unit tests
         run: |
-          chart=litellm/deploy/helm/litellm
-          declared="$(grep -h '^suite:' "$chart"/tests/*.yaml | wc -l | tr -d '[:space:]')"
-          output="$(mktemp)"
-          helm unittest -f 'tests/*.yaml' "$chart" | tee "$output"
-          executed="$(sed -n 's/^Test Suites:.*[[:space:]]\([0-9][0-9]*\) total$/\1/p' "$output")"
-          if [ "$declared" != "$executed" ]; then
-            echo "::error::$chart declares $declared test suites but helm-unittest ran $executed. Suites are being skipped silently, so their assertions never execute."
-            exit 1
-          fi
-          echo "$chart: all $declared declared test suites ran"
+          for chart in helm/litellm-helm helm/litellm; do
+            declared="$(grep -h '^suite:' "$chart"/tests/*.yaml | wc -l | tr -d '[:space:]')"
+            output="$(mktemp)"
+            helm unittest -f 'tests/*.yaml' "$chart" | tee "$output"
+            executed="$(sed -n 's/^Test Suites:.*[[:space:]]\([0-9][0-9]*\) total$/\1/p' "$output")"
+            if [ "$declared" != "$executed" ]; then
+              echo "::error::$chart declares $declared test suites but helm-unittest ran $executed. Suites are being skipped silently, so their assertions never execute."
+              exit 1
+            fi
+            echo "$chart: all $declared declared test suites ran"
+          done
   openai-sdk-compat:
     name: OpenAI ${{ matrix.openai-version }} compatibility
-    needs: rust-bridge
-    if: ${{ !cancelled() }}
     permissions:
       contents: read
       pull-requests: read
@@ -1405,18 +1329,10 @@ jobs:
         with:
           version: "0.10.9"
 
-      - name: Set up the Rust bridge
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
-        uses: ./.github/actions/rust-bridge
-        with:
-          artifact: ${{ needs.rust-bridge.outputs.artifact }}
-
       - name: Install dependencies
         if: steps.changes.outputs.decision != 'skip'
         run: |
           .github/scripts/uv_sync_with_retries.sh --frozen --group dev --group proxy-dev --extra proxy --no-install-workspace
-          cp rust-bridge-dist/litellm/rust_bridge/_native.* litellm/rust_bridge/
           uv pip install "openai==${OPENAI_VERSION:?}" --exclude-newer-package openai=2026-10-07T00:00:00Z
           uv run --no-sync python -c 'import os, openai; assert openai.__version__ == os.environ["OPENAI_VERSION"], openai.__version__'
 
@@ -1508,9 +1424,9 @@ jobs:
           RUST_BRIDGE_ARTIFACT: ${{ needs.rust-bridge.outputs.artifact }}
         run: |
           if [ -z "$RUST_BRIDGE_ARTIFACT" ]; then
-            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra switchyard --extra saml --extra extra_proxy --extra proxy-runtime --extra utils
+            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra caching --extra extra_proxy --extra proxy-runtime --extra utils
           else
-            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra switchyard --extra saml --extra extra_proxy --extra proxy-runtime --extra utils --no-install-project --no-install-package litellm-proxy
+            .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml --extra caching --extra extra_proxy --extra proxy-runtime --extra utils --no-install-project
             uv pip install --no-deps --python .venv/bin/python rust-bridge-dist/*.whl
             cp rust-bridge-dist/litellm/rust_bridge/_native.abi3.so litellm/rust_bridge/_native.abi3.so
           fi

.github/workflows/test-vscode-extension.yml

@@ -8,13 +8,13 @@ on:
       - main
       - "litellm_**"
     paths:
-      - "litellm/vscode-extension/**"
+      - "vscode-extension/**"
       - ".github/workflows/test-vscode-extension.yml"
   push:
     branches:
       - main
     paths:
-      - "litellm/vscode-extension/**"
+      - "vscode-extension/**"
       - ".github/workflows/test-vscode-extension.yml"
 
 concurrency:
@@ -27,7 +27,7 @@ jobs:
     timeout-minutes: 10
     defaults:
       run:
-        working-directory: litellm/vscode-extension
+        working-directory: vscode-extension
 
     steps:
       - name: Checkout repository
@@ -41,7 +41,7 @@ jobs:
         with:
           node-version: "24"
           cache: npm
-          cache-dependency-path: litellm/vscode-extension/package-lock.json
+          cache-dependency-path: vscode-extension/package-lock.json
 
       - name: Install dependencies
         run: npm ci
@@ -59,5 +59,5 @@ jobs:
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: litellm-vscode
-          path: litellm/vscode-extension/*.vsix
+          path: vscode-extension/*.vsix
           if-no-files-found: error

.github/workflows/zizmor.yml

@@ -27,15 +27,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Install zizmor
-        run: |
-          curl -fsSL --retry 3 -o "$RUNNER_TEMP/zizmor.tar.gz" \
-            https://github.com/zizmorcore/zizmor/releases/download/v1.31.1/zizmor-x86_64-unknown-linux-gnu.tar.gz
-          echo "d185f726bdaf92df78273217dfdd24ebcd6b0ef48cf3ce776ff5762b6e138c99  $RUNNER_TEMP/zizmor.tar.gz" | sha256sum -c -
-          tar xzf "$RUNNER_TEMP/zizmor.tar.gz" -C "$RUNNER_TEMP" zizmor
-
       - name: Run zizmor
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          "$RUNNER_TEMP/zizmor" --no-ignores --no-config --min-severity=medium --format=github .
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          version: "1.24.1"
+          min-severity: medium
+          advanced-security: false
+          annotations: true

.gitignore

@@ -18,7 +18,7 @@ __pycache__/
 # Rust bridge build artifacts (compiled, platform-specific; regenerated by maturin/cargo)
 litellm/rust_bridge/_native*.so
 litellm/rust_bridge/_native*.pyd
-litellm/rust/target/
+litellm-rust/target/
 
 # Python package build output
 dist/
@@ -55,14 +55,14 @@ hosted_config.yaml
 litellm/proxy/tests/node_modules
 litellm/proxy/tests/package.json
 litellm/proxy/tests/package-lock.json
-litellm/ui/litellm-dashboard/.next
-litellm/ui/litellm-dashboard/node_modules
-litellm/ui/litellm-dashboard/next-env.d.ts
+ui/litellm-dashboard/.next
+ui/litellm-dashboard/node_modules
+ui/litellm-dashboard/next-env.d.ts
 *.tsbuildinfo
-litellm/ui/litellm-dashboard/package.json
-litellm/ui/litellm-dashboard/package-lock.json
-litellm/deploy/helm/litellm/charts/*.tgz
-litellm/deploy/helm/*.tgz
+ui/litellm-dashboard/package.json
+ui/litellm-dashboard/package-lock.json
+helm/litellm-helm/*.tgz
+helm/*.tgz
 litellm/proxy/vertex_key.json
 **/.vim/
 **/node_modules
@@ -105,8 +105,8 @@ litellm_config.yaml
 .cursor
 litellm/proxy/to_delete_loadtest_work/*
 update_model_cost_map.py
-tests/unit/proxy/mcp_server/test_mcp_server_manager.py
-litellm/scripts/test_vertex_ai_search.py
+tests/unit/proxy/_experimental/mcp_server/test_mcp_server_manager.py
+scripts/test_vertex_ai_search.py
 LAZY_LOADING_IMPROVEMENTS.md
 STABILIZATION_TODO.md
 **/test-results
@@ -146,7 +146,7 @@ crash.*.log
 # pytest coverage data
 .coverage
 
-litellm/ui/litellm-dashboard/out/
+ui/litellm-dashboard/out/
 litellm.log
 
 .coverage-rust

.npmrc

@@ -0,0 +1,5 @@
+# Supply-chain hardening
+# Packages needing lifecycle scripts: npm rebuild <pkg>
+ignore-scripts=true
+# Protects local npm install only — npm ci (used in CI) ignores this
+min-release-age=3

.semgrep/rules/README.md

@@ -0,0 +1,22 @@
+# Custom Semgrep rules for LiteLLM
+
+Add custom rule YAML files here. Semgrep loads all `.yml`/`.yaml` files under this directory.
+
+**Run only custom rules (CI / fail on findings):**
+
+```bash
+semgrep scan --config .semgrep/rules . --error
+```
+
+**Run with registry + custom rules:**
+
+```bash
+semgrep scan --config auto --config .semgrep/rules .
+```
+
+**Layout:**
+
+- `python/` – Python-specific rules (security, patterns)
+- Add more subdirs as needed (e.g. `generic/` for language-agnostic rules)
+
+See [Semgrep rule syntax](https://semgrep.dev/docs/writing-rules/rule-syntax/).

AGENTS.md

@@ -1,6 +1,7 @@
 Do not write comments unless they are any of:
 - absolutely necessary to explain some very complex business logic (in which case, keep it concise and clear)
 - used as an input for tools to read and act on. For example:
+  - entries in `.git-blame-ignore-revs` saying which commit is excluded from git blame
   - a lint or type checker suppression like `# mutable-ok` or `# pyright: ignore[reportArgumentType]  # <reason>` when introducing a truly unavoidable violation
 - a TODO or FIXME
   - Not great to have those, but if it's unavoidable, make sure to include a strong, concise reason for why it's there or, better yet, link to a GitHub issue for the follow-up work
@@ -28,9 +29,9 @@ A test must only fail when litellm code changes. Never pin facts we don't own (a
 
 `tests/unit/` mirrors `litellm/` in a parallel path (see `tests/unit/AGENTS.md`). Name tests `test_<filename>.py`, but always match the existing test file in the directory you touch — many provider dirs use longer descriptive names (e.g. `test_anthropic_chat_transformation.py`) to avoid ambiguity across sibling folders. For bug fixes, extend the existing mapped test file rather than creating a new one. Only create a new test file for a new feature (provider, endpoint, or transformation module) that has no mapped test yet, following that directory's naming convention (or `test_<filename>.py` if you're the first test there). One focused regression test beats many shallow ones
 
-End-to-end tests belong in `tests/e2e/`. A rule about one directory's files, like its harness or which CI runs it, goes in that directory's `AGENTS.md`, never only in a README or here. Read a directory's `AGENTS.md` before editing files in it
+End-to-end tests belong in `tests/e2e/` and must follow the harness conventions documented in that directory's `AGENTS.md`
 
-When creating PRs, target the repository's current default branch for both internal and external / OSS contributions. Check it with `python3 litellm/scripts/default_branch.py --branch` instead of assuming a branch name or relying on cached `origin/HEAD`
+When creating PRs, target the repository's current default branch for both internal and external / OSS contributions. Check it with `python3 scripts/default_branch.py --branch` instead of assuming a branch name or relying on cached `origin/HEAD`
 
 When writing a PR body, treat the comments and imperative instructions inside .github/PULL_REQUEST_TEMPLATE/general.md as rules to follow, not just layout. Agent harnesses may strip HTML comments from copies of that file injected into context, so read .github/PULL_REQUEST_TEMPLATE/general.md from disk before writing a PR body to make sure you see every comment rule. A section you have nothing to put in (Relevant issues, Affected release, Linear ticket, Caveats, QA runbook, and so on) is removed entirely, heading included, never left as an empty title
 
@@ -38,17 +39,14 @@ Same applies for filing bug reports and feature requests, with .github/ISSUE_TEM
 
 If you're resolving a linear ticket, in the "## Linear ticket" section of the PR, say "Resolves LIT-1234", replacing "LIT-1234" with the actual ticket id that you're resolving. If you don't have the ticket id, don't make one up or search for it. Just drop the section
 
-Run QA proxies with `python litellm/proxy/proxy_cli.py --config litellm/proxy/dev_config.yaml --num_workers 2 --detailed_debug --reload --use_v2_migration_resolver 2>&1 | tee litellm.log`, and swap its `--config` for a copy of `litellm/proxy/dev_config.yaml` that points both `router_settings` (`redis_host`, `redis_port`) and `general_settings.coordination_redis` (`host`, `port`) at one dedicated Redis instance, with credentials when required, so the workers share router state and spend, budget, and rate-limit counters. Check that two worker PIDs are serving, and use the same worker count and Redis setup for the before and after proof. When the PR is about `--run_gunicorn`, `--run_hypercorn`, or `--run_granian`, which `--reload` does not support, drop `--reload`. When it is about behavior without Redis, drop Redis. When the proxy prints `"workers" flag is ignored when reloading is enabled`, that checkout or its uvicorn reloads only one worker, so drop the two-worker check for it. Say in the proof which part you dropped and why
-
-Simple PRs may skip before/after e2e when the full diff is mechanical and focused checks completely prove it, such as #49030 restoring an existing helper name. Trace affected callers and run relevant tests/static checks at the tip. For a bug fix, establish that the regression catches the original defect. Size alone never qualifies. New behavior, API/provider semantics, auth, billing, persistence, concurrency or uncertain integration risk need live e2e. In Screenshots / Proof of Fix, record `E2E exception at <tip SHA>`, scope, rationale, commands and results. Tests count as proof only for this exception. Reassess changed diffs, retain CI/bot gates, and honor explicit e2e requests (2026-10-28, unnecessary live QA for #49030)
-
-For other PRs, proof must show the end user's real flow before and after, with commands and output against a live proxy and real provider calls where applicable. The body alone must let a reviewer rerun it, with the proxy command, config, env var names and client code exactly as run, and long blocks collapsed in <details>. Pytest alone is insufficient. For UI or interactive coding-tool flows, drive that surface and embed before/after screenshots, with URLs, clicks and input fields a reviewer can reproduce
+Never use `pytest` commands or the like as "Screenshots / Proof of Fix". We prefer curl'ing a live proxy instance running on localhost:4000 (I like to run it with `python litellm/proxy/proxy_cli.py --config litellm/proxy/dev_config.yaml --detailed_debug --reload --use_v2_migration_resolver 2>&1 | tee litellm.log`. The Admin UI dev server is `npm run dev` in `ui/litellm-dashboard`, served on port 3000) and showing both the command run and the output. Also, it should hit real LLM provider APIs, not mocks, and cost real $$$ because that is the most realistic test. The proof of fix should be exactly what the end user / customer would see / do. The run logs in PR #27703 is a prime example of how to do it (not a huge fan of using a python test script that future me and the team will have no visibility into. I prefer just curl commands or a short list of bash commands (e.g., using `for`)). If it's a UI thing, or the main use case runs through a headful agentic coding tool like Claude Code or Codex, drive that surface yourself and embed your own before and after screenshots of it in the PR (the Admin UI page, or what the coding tool shows), next to an ordered list of the URLs to go to (e.g., http://localhost:4000/ui/?page=logs), where to click, and what fields to fill out so a reviewer can reproduce it
 
 If you ever write any human-facing text (pull requests, issues, commit messages, discussion posts, github comments, release notes, docs, etc.), always follow these guidelines to sound less AI-y:
 - don't use emojis
 - don't use "—". Don't use ";" or ":" unless it would be nonsensical not to. Instead, reach for ",", ".", conjunction words, etc. in descending order of preference: vary among them, weighted toward the front of the list, and skip "," where it would cause a comma splice or the sentence is getting long. Overusing any one of them also feels AI-y. A word cap does not penalize you for adding more sentences
 - don't use the pattern "It's not X, it's Y", "You're not X, you're Y", etc.
 - unless explicitly asked, don't use bulleted or numbered lists unless it would be nonsensical not to. Instead, prefer prose
+- don't add a trailing "." at the end of paragraphs (just like this file). That means every paragraph, not just the last one (of the markdown file, PR description, GitHub comment, etc.). Rule of thumb: if you're adding new line(s) before the next sentence, don't add a ".". Exception is that docs (i.e., litellm-docs) should have trailing "."
 - don't use →. Instead, prefer not to use arrows, and if need be, use -> instead
 - use plain, simple, everyday engineering language: the common phrase engineers actually say over rare compact phrasing, in grammatically complete sentences. When explicitly asked to use bullets or ordered lists and structure legitimately helps the reader, prefer nested bullets (any depth is fine) over dense lines in a flat structure
 
@@ -56,17 +54,17 @@ Don't hesitate to use values in .env to get needed API keys and other secrets, a
 
 Python max line length is 120, not 88
 
-The five lint gates (`litellm/scripts/ruff_strict_gate.py`, `litellm/scripts/type_discipline_gate.py`, `litellm/scripts/test_quality_gate.py`, `litellm/scripts/openapi_docs_gate.py`, `litellm/scripts/type_check_gate.py`) compare each rule's codebase count on your branch against the count at its merge-base with the default branch, and a rule may not grow. There are no budget files to edit or ratchet: when a gate fails, fix the violations the branch introduced or remove at least as many of that rule elsewhere in the tree. The one exception is `reportAny` / `reportExplicitAny`, which share a fixed codebase-wide cap in `ANY_CAPS` in `litellm/scripts/type_check_gate.py` because Any spreads past the lines you touch. A branch may add Anys while the total stays under that cap. Only lower `ANY_CAPS`, and only in its own PR to the default branch, never raise it on a feature branch
+The five lint gates (`scripts/ruff_strict_gate.py`, `scripts/type_discipline_gate.py`, `scripts/test_quality_gate.py`, `scripts/openapi_docs_gate.py`, `scripts/type_check_gate.py`) compare each rule's codebase count on your branch against the count at its merge-base with the default branch, and a rule may not grow. There are no budget files to edit or ratchet: when a gate fails, fix the violations the branch introduced or remove at least as many of that rule elsewhere in the tree. The one exception is `reportAny` / `reportExplicitAny`, which share a fixed codebase-wide cap in `ANY_CAPS` in `scripts/type_check_gate.py` because Any spreads past the lines you touch. A branch may add Anys while the total stays under that cap. Only lower `ANY_CAPS`, and only in its own PR to the default branch, never raise it on a feature branch
 
 `make check` (f.k.a. `make pre-commit`, which still works identically as an alias) saves its complete output to a log file in .git (overwriting previous logs) and prints that path as its first and last output lines. To inspect a run, read or grep that log instead of re-running the multi-minute checks just to see a different slice
 
-`make check`, `make lint`, `litellm/scripts/pre_commit_lint.sh`, and the standalone lint gates (`litellm/scripts/ruff_strict_gate.py`, `litellm/scripts/type_discipline_gate.py`, `litellm/scripts/type_check_gate.py`) each hold one of 2 machine-wide slots, so when other sessions or worktrees on the same box are already running heavy work, yours prints "all N machine-wide slots are busy" followed by "queueing" and then stays quiet until a slot frees. Give the command a long timeout and let it wait rather than killing it, retrying it, or assuming it hung. Don't change the # of machine-wide slots or make it unlimited by setting `LITELLM_GATE_SLOTS=0`
+`make check`, `make lint`, `scripts/pre_commit_lint.sh`, and the standalone lint gates (`scripts/ruff_strict_gate.py`, `scripts/type_discipline_gate.py`, `scripts/type_check_gate.py`) each hold one of 2 machine-wide slots, so when other sessions or worktrees on the same box are already running heavy work, yours prints "all N machine-wide slots are busy" followed by "queueing" and then stays quiet until a slot frees. Give the command a long timeout and let it wait rather than killing it, retrying it, or assuming it hung. Don't change the # of machine-wide slots or make it unlimited by setting `LITELLM_GATE_SLOTS=0`
 
 If you're trying to create a new function that relies on untyped stuff, instead of adding more Any's and pushing `reportAny` / `reportExplicitAny` closer to their cap in `ANY_CAPS`, just validate it in the caller with Pydantic (a model or `TypeAdapter` that returns the typed thing or raises will do) and then pass the now typed variable in
 
 If you get an LIT001 fail, refactor the code to follow functional programming best practices rather than introducing mutable data structures. For example, build values in one shot with comprehensions or generators wrapped in `tuple()` / `MappingProxyType()` / `frozenset()` instead of seeding an empty `list`/`dict`/`set` and mutating it over time. Ideally, `# mutable-ok` is never used. Reach for it only as a genuine last resort when an immutable rewrite is truly impossible, and always pair it with a real reason
 
-Every lint or type suppression must name the exact rule inside brackets and carry a reason comment, e.g. `# pyright: ignore[reportArgumentType]  # stubs lack async overload` or `# noqa: TID251  # <reason>`. `# type: ignore` is banned (LIT009): `[tool.pyright]` in pyproject.toml sets `enableTypeIgnoreComments` to false, so it silently does nothing
+Every lint or type suppression must name the exact rule inside brackets and carry a reason comment, e.g. `# pyright: ignore[reportArgumentType]  # stubs lack async overload` or `# noqa: TID251  # <reason>`. `# type: ignore` is banned (LIT009): pyrightconfig.json sets `enableTypeIgnoreComments` to false, so it silently does nothing
 
 Commit and push your work when you're done without asking
 
@@ -74,7 +72,7 @@ When referencing or running models (coding, QA'ing, writing docs, writing tests,
 
 Always pull before starting any work. The checkout or worktree may be sitting on a stale branch
 
-Internal contributors branch a new PR off the repository's current default branch, with a branch name prefixed with litellm_
+If you're an internal contributor, when creating a new PR, the typical flow is to branch off the repository's current default branch and create a branch prefixed with litellm_. Do not create a branch prefixed with claude/ and generally do not have / in your branch names
 
 Do not add `Co-Authored-By: Claude` or any Claude attribution to commit messages. Never use a `claude/` prefix or put a `/` in a branch name. Do not add "Generated with Claude Code" (or any similar attribution) to PR descriptions or comments. Do not create a new PR/branch off the existing PR to fix/add something that is related and could've just been committed directly to the existing PR's branch
 
@@ -107,7 +105,6 @@ Follow these coding conventions for new/updated code (a three-line fix in a lega
 - No file sprawl: deliberate file and folder structure
 - Standard over hand-rolled: use the official SDK or a library where one exists. Where none does, follow industry standards instead of inventing local conventions
 - API-fragmentation-aware: when logic must branch on which API surface produced or consumes data (e.g. chat completions vs Anthropic Messages vs Responses API shapes), proactively look for an existing shared helper (e.g. `litellm_core_utils/prompt_templates/factory.py`) before writing per-surface parsing in the new module. If none exists, add one there instead of duplicating the same format-detection logic in every new guardrail/integration
-- Current default for new model names: logic that picks behavior from a model-name table (tokenizer, message framing, supported params) gives a provider's model the table does not list yet that provider's current behavior, never its oldest, since providers ship names faster than any table is updated
 
 Follow conventional commits for commit names and PR titles
 

ARCHITECTURE.md

@@ -0,0 +1,415 @@
+# LiteLLM Architecture - LiteLLM SDK + AI Gateway
+
+This document helps contributors understand where to make changes in LiteLLM.
+
+---
+
+## How It Works
+
+The LiteLLM AI Gateway (Proxy) uses the LiteLLM SDK internally for all LLM calls:
+
+```
+OpenAI SDK (client)    ──▶  LiteLLM AI Gateway (proxy/)  ──▶  LiteLLM SDK (litellm/)  ──▶  LLM API
+Anthropic SDK (client) ──▶  LiteLLMAI Gateway (proxy/)  ──▶  LiteLLM SDK (litellm/)  ──▶  LLM API
+Any HTTP client        ──▶  LiteLLMAI Gateway (proxy/)  ──▶  LiteLLM SDK (litellm/)  ──▶  LLM API
+```
+
+The **AI Gateway** adds authentication, rate limiting, budgets, and routing on top of the SDK.
+The **SDK** handles the actual LLM provider calls, request/response transformations, and streaming.
+
+---
+
+## 1. AI Gateway (Proxy) Request Flow
+
+The AI Gateway (`litellm/proxy/`) wraps the SDK with authentication, rate limiting, and management features.
+
+```mermaid
+sequenceDiagram
+    participant Client
+    participant ProxyServer as proxy/proxy_server.py
+    participant Auth as proxy/auth/user_api_key_auth.py
+    participant Redis as Redis Cache
+    participant Hooks as proxy/hooks/
+    participant Router as router.py
+    participant Main as main.py + utils.py
+    participant Handler as llms/custom_httpx/llm_http_handler.py
+    participant Transform as llms/{provider}/chat/transformation.py
+    participant Provider as LLM Provider API
+    participant CostCalc as cost_calculator.py
+    participant LoggingObj as litellm_logging.py
+    participant DBWriter as db/db_spend_update_writer.py
+    participant Postgres as PostgreSQL
+
+    %% Request Flow
+    Client->>ProxyServer: POST /v1/chat/completions
+    ProxyServer->>Auth: user_api_key_auth()
+    Auth->>Redis: Check API key cache
+    Redis-->>Auth: Key info + spend limits
+    ProxyServer->>Hooks: parallel_request_limiter, cache_control_check
+    Hooks->>Redis: Check/increment rate limit counters
+    ProxyServer->>Router: route_request()
+    Router->>Main: litellm.acompletion()
+    Main->>Handler: BaseLLMHTTPHandler.completion()
+    Handler->>Transform: ProviderConfig.transform_request()
+    Handler->>Provider: HTTP Request
+    Provider-->>Handler: Response
+    Handler->>Transform: ProviderConfig.transform_response()
+    Transform-->>Handler: ModelResponse
+    Handler-->>Main: ModelResponse
+    
+    %% Cost Attribution (in utils.py wrapper)
+    Main->>LoggingObj: update_response_metadata()
+    LoggingObj->>CostCalc: _response_cost_calculator()
+    CostCalc->>CostCalc: completion_cost(tokens × price)
+    CostCalc-->>LoggingObj: response_cost
+    LoggingObj-->>Main: Set response._hidden_params["response_cost"]
+    Main-->>ProxyServer: ModelResponse (with cost in _hidden_params)
+    
+    %% Response Headers + Async Logging
+    ProxyServer->>ProxyServer: Extract cost from hidden_params
+    ProxyServer->>LoggingObj: async_success_handler()
+    LoggingObj->>Hooks: async_log_success_event()
+    Hooks->>DBWriter: update_database(response_cost)
+    DBWriter->>Redis: Queue spend increment
+    DBWriter->>Postgres: Batch write spend logs (async)
+    ProxyServer-->>Client: ModelResponse + x-litellm-response-cost header
+```
+
+### Proxy Components
+
+```mermaid
+graph TD
+    subgraph "Incoming Request"
+        Client["POST /v1/chat/completions"]
+    end
+
+    subgraph "proxy/proxy_server.py"
+        Endpoint["chat_completion()"]
+    end
+
+    subgraph "proxy/auth/"
+        Auth["user_api_key_auth()"]
+    end
+
+    subgraph "proxy/"
+        PreCall["litellm_pre_call_utils.py"]
+        RouteRequest["route_llm_request.py"]
+    end
+
+    subgraph "litellm/"
+        Router["router.py"]
+        Main["main.py"]
+    end
+
+    subgraph "Infrastructure"
+        DualCache["DualCache<br/>(in-memory + Redis)"]
+        Postgres["PostgreSQL<br/>(keys, teams, spend logs)"]
+    end
+
+    Client --> Endpoint
+    Endpoint --> Auth
+    Auth --> DualCache
+    DualCache -.->|cache miss| Postgres
+    Auth --> PreCall
+    PreCall --> RouteRequest
+    RouteRequest --> Router
+    Router --> DualCache
+    Router --> Main
+    Main --> Client
+```
+
+**Key proxy files:**
+- `proxy/proxy_server.py` - Main API endpoints
+- `proxy/auth/` - Authentication (API keys, JWT, OAuth2)
+- `proxy/hooks/` - Proxy-level callbacks
+- `router.py` - Load balancing, fallbacks
+- `router_strategy/` - Routing algorithms (`lowest_latency.py`, `simple_shuffle.py`, etc.)
+
+**LLM-specific proxy endpoints:**
+
+| Endpoint | Directory | Purpose |
+|----------|-----------|---------|
+| `/v1/messages` | `proxy/anthropic_endpoints/` | Anthropic Messages API |
+| `/vertex-ai/*` | `proxy/vertex_ai_endpoints/` | Vertex AI passthrough |
+| `/gemini/*` | `proxy/google_endpoints/` | Google AI Studio passthrough |
+| `/v1/images/*` | `proxy/image_endpoints/` | Image generation |
+| `/v1/batches` | `proxy/batches_endpoints/` | Batch processing |
+| `/v1/files` | `proxy/openai_files_endpoints/` | File uploads |
+| `/v1/fine_tuning` | `proxy/fine_tuning_endpoints/` | Fine-tuning jobs |
+| `/v1/rerank` | `proxy/rerank_endpoints/` | Reranking |
+| `/v1/responses` | `proxy/response_api_endpoints/` | OpenAI Responses API |
+| `/v1/vector_stores` | `proxy/vector_store_endpoints/` | Vector stores |
+| `/*` (passthrough) | `proxy/pass_through_endpoints/` | Direct provider passthrough |
+
+**Proxy Hooks** (`proxy/hooks/__init__.py`):
+
+| Hook | File | Purpose |
+|------|------|---------|
+| `parallel_request_limiter` | `proxy/hooks/parallel_request_limiter_v3.py` | Rate limiting per key/user |
+| `cache_control_check` | `proxy/hooks/cache_control_check.py` | Cache validation |
+| `responses_id_security` | `proxy/hooks/responses_id_security.py` | Response ID validation |
+| `litellm_skills` | `proxy/hooks/litellm_skills/main.py` | Skills injection |
+
+To add a new proxy hook, implement `CustomLogger` and register in `PROXY_HOOKS`.
+
+### Infrastructure Components
+
+The AI Gateway uses external infrastructure for persistence and caching:
+
+```mermaid
+graph LR
+    subgraph "AI Gateway (proxy/)"
+        Proxy["proxy_server.py"]
+        Auth["auth/user_api_key_auth.py"]
+        DBWriter["db/db_spend_update_writer.py<br/>DBSpendUpdateWriter"]
+        InternalCache["utils.py<br/>InternalUsageCache"]
+        CostCallback["hooks/proxy_track_cost_callback.py<br/>_ProxyDBLogger"]
+        Scheduler["APScheduler<br/>ProxyStartupEvent"]
+    end
+
+    subgraph "SDK (litellm/)"
+        Router["router.py<br/>Router.cache (DualCache)"]
+        LLMCache["caching/caching_handler.py<br/>LLMCachingHandler"]
+        CacheClass["caching/caching.py<br/>Cache"]
+    end
+
+    subgraph "Redis (caching/redis_cache.py)"
+        RateLimit["Rate Limit Counters"]
+        SpendQueue["Spend Increment Queue"]
+        KeyCache["API Key Cache"]
+        TPM_RPM["TPM/RPM Tracking"]
+        Cooldowns["Deployment Cooldowns"]
+        LLMResponseCache["LLM Response Cache"]
+    end
+
+    subgraph "PostgreSQL (proxy/schema.prisma)"
+        Keys["LiteLLM_VerificationToken"]
+        Teams["LiteLLM_TeamTable"]
+        SpendLogs["LiteLLM_SpendLogs"]
+        Users["LiteLLM_UserTable"]
+    end
+
+    Auth --> InternalCache
+    InternalCache --> KeyCache
+    InternalCache -.->|cache miss| Keys
+    InternalCache --> RateLimit
+    Router --> TPM_RPM
+    Router --> Cooldowns
+    LLMCache --> CacheClass
+    CacheClass --> LLMResponseCache
+    CostCallback --> DBWriter
+    DBWriter --> SpendQueue
+    DBWriter --> SpendLogs
+    Scheduler --> SpendLogs
+    Scheduler --> Keys
+```
+
+| Component | Purpose | Key Files/Classes |
+|-----------|---------|-------------------|
+| **Redis** | Rate limiting, API key caching, TPM/RPM tracking, cooldowns, LLM response caching, spend queuing | `caching/redis_cache.py` (`RedisCache`), `caching/dual_cache.py` (`DualCache`) |
+| **PostgreSQL** | API keys, teams, users, spend logs | `proxy/utils.py` (`PrismaClient`), `proxy/schema.prisma` |
+| **InternalUsageCache** | Proxy-level cache for rate limits + API keys (in-memory + Redis) | `proxy/utils.py` (`InternalUsageCache`) |
+| **Router.cache** | TPM/RPM tracking, deployment cooldowns, client caching (in-memory + Redis) | `router.py` (`Router.cache: DualCache`) |
+| **LLMCachingHandler** | SDK-level LLM response/embedding caching | `caching/caching_handler.py` (`LLMCachingHandler`), `caching/caching.py` (`Cache`) |
+| **DBSpendUpdateWriter** | Batches spend updates to reduce DB writes | `proxy/db/db_spend_update_writer.py` (`DBSpendUpdateWriter`) |
+| **Cost Tracking** | Calculates and logs response costs | `proxy/hooks/proxy_track_cost_callback.py` (`_ProxyDBLogger`) |
+
+**Background Jobs** (APScheduler, initialized in `proxy/proxy_server.py` → `ProxyStartupEvent.initialize_scheduled_background_jobs()`):
+
+| Job | Interval | Purpose | Key Files |
+|-----|----------|---------|-----------|
+| `update_spend` | 60s | Batch write spend logs to PostgreSQL | `proxy/db/db_spend_update_writer.py` |
+| `reset_budget` | 10-12min | Reset budgets for keys/users/teams | `proxy/common_utils/reset_budget_job.py` |
+| `add_deployment` | 10s | Sync new model deployments from DB | `proxy/proxy_server.py` (`ProxyConfig`) |
+| `cleanup_old_spend_logs` | cron/interval | Delete old spend logs | `proxy/db/db_transaction_queue/spend_log_cleanup.py` |
+| `check_batch_cost` | 30min | Calculate costs for batch jobs | `enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py` |
+| `check_responses_cost` | 30min | Calculate costs for responses API | `enterprise/litellm_enterprise/proxy/common_utils/check_responses_cost.py` |
+| `process_rotations` | 1hr | Auto-rotate API keys | `proxy/common_utils/key_rotation_manager.py` |
+| `_run_background_health_check` | continuous | Health check model deployments | `proxy/proxy_server.py` |
+| `send_weekly_spend_report` | weekly | Slack spend alerts | `proxy/utils.py` (`SlackAlerting`) |
+| `send_monthly_spend_report` | monthly | Slack spend alerts | `proxy/utils.py` (`SlackAlerting`) |
+
+**Cost Attribution Flow:**
+1. LLM response returns to `utils.py` wrapper after `litellm.acompletion()` completes
+2. `update_response_metadata()` (`litellm_core_utils/llm_response_utils/response_metadata.py`) is called
+3. `logging_obj._response_cost_calculator()` (`litellm_core_utils/litellm_logging.py`) calculates cost via `litellm.completion_cost()` (`cost_calculator.py`)
+4. Cost is stored in `response._hidden_params["response_cost"]`
+5. `proxy/common_request_processing.py` extracts cost from `hidden_params` and adds to response headers (`x-litellm-response-cost`)
+6. `logging_obj.async_success_handler()` triggers callbacks including `_ProxyDBLogger.async_log_success_event()`
+7. `DBSpendUpdateWriter.update_database()` queues spend increments to Redis
+8. Background job `update_spend` flushes queued spend to PostgreSQL every 60s
+
+### Data Access Layer (Models & Repositories)
+
+Database entities and the operations on them live in two packages at the root of `litellm/` so both the gateway (`proxy/`) and the SDK can use them without importing proxy internals:
+
+- `litellm/models/` holds the canonical Pydantic definitions for every persisted entity (`LiteLLM_VerificationToken`, `LiteLLM_TeamTable`, `LiteLLM_UserTable`, etc.). `proxy/_types.py` re-exports these for backwards compatibility, so existing imports keep working.
+- `litellm/repositories/` holds the data-access layer. `BaseRepository[T]` provides the generic CRUD (`find_by_id`, `find_many`, `create`, `update`, `delete`, `count`, `exists`); entity repositories such as `VerificationTokenRepository`, `TeamRepository`, and `UserRepository` add domain-specific queries and writes on top of it.
+
+Conventions to follow when touching this layer:
+
+| Concern | How it's handled |
+|---------|------------------|
+| JSON columns | Prisma `Json` columns are stored as JSON strings. Repositories `json.dumps()` on write and `json.loads()` on read (see `_to_model` and the `_build_*_data` helpers). |
+| Archive-then-delete | `delete_team` / `delete_token` copy the row into the `LiteLLM_Deleted*` table and delete the original inside a single `prisma_client.db.tx()` transaction. Archive payloads are built explicitly so only columns that exist on the archive table are written. |
+| Column vs. field names | Where a model field differs from its DB column (for example `org_id` maps to the `organization_id` column), the repository translates in both directions rather than relying on Pydantic to guess. |
+| Array mutations | Adds use Prisma's atomic `push` (`add_member`, `add_admin`, `add_models`) to avoid read-modify-write races. Removals fall back to read-modify-write because Prisma has no atomic array remove. |
+
+To add a new entity, define the model under `litellm/models/`, re-export it from `proxy/_types.py` if existing code imports it from there, and add a repository under `litellm/repositories/` (subclass `BaseRepository` for plain CRUD, or add bespoke methods when the entity needs encryption, archiving, or atomic array updates). Mirror the tests in `tests/unit/repositories/`.
+
+---
+
+## 2. SDK Request Flow
+
+The SDK (`litellm/`) provides the core LLM calling functionality used by both direct SDK users and the AI Gateway.
+
+```mermaid
+graph TD
+    subgraph "SDK Entry Points"
+        Completion["litellm.completion()"]
+        Messages["litellm.messages()"]
+    end
+
+    subgraph "main.py"
+        Main["completion()<br/>acompletion()"]
+    end
+
+    subgraph "utils.py"
+        GetProvider["get_llm_provider()"]
+    end
+
+    subgraph "llms/custom_httpx/"
+        Handler["llm_http_handler.py<br/>BaseLLMHTTPHandler"]
+        HTTP["http_handler.py<br/>HTTPHandler / AsyncHTTPHandler"]
+    end
+
+    subgraph "llms/{provider}/chat/"
+        TransformReq["transform_request()"]
+        TransformResp["transform_response()"]
+    end
+
+    subgraph "litellm_core_utils/"
+        Streaming["streaming_handler.py"]
+    end
+
+    subgraph "integrations/ (async, off main thread)"
+        Callbacks["custom_logger.py<br/>Langfuse, Datadog, etc."]
+    end
+
+    Completion --> Main
+    Messages --> Main
+    Main --> GetProvider
+    GetProvider --> Handler
+    Handler --> TransformReq
+    TransformReq --> HTTP
+    HTTP --> Provider["LLM Provider API"]
+    Provider --> HTTP
+    HTTP --> TransformResp
+    TransformResp --> Streaming
+    Streaming --> Response["ModelResponse"]
+    Response -.->|async| Callbacks
+```
+
+**Key SDK files:**
+- `main.py` - Entry points: `completion()`, `acompletion()`, `embedding()`
+- `utils.py` - `get_llm_provider()` resolves model → provider
+- `llms/custom_httpx/llm_http_handler.py` - Central HTTP orchestrator
+- `llms/custom_httpx/http_handler.py` - Low-level HTTP client
+- `llms/{provider}/chat/transformation.py` - Provider-specific transformations
+- `litellm_core_utils/streaming_handler.py` - Streaming response handling
+- `integrations/` - Async callbacks (Langfuse, Datadog, etc.)
+
+---
+
+## 3. Translation Layer
+
+When a request comes in, it goes through a **translation layer** that converts between API formats.
+Each translation is isolated in its own file, making it easy to test and modify independently.
+
+### Where to find translations
+
+| Incoming API | Provider | Translation File |
+|--------------|----------|------------------|
+| `/v1/chat/completions` | Anthropic | `llms/anthropic/chat/transformation.py` |
+| `/v1/chat/completions` | Bedrock Converse | `llms/bedrock/chat/converse_transformation.py` |
+| `/v1/chat/completions` | Bedrock Invoke | `llms/bedrock/chat/invoke_transformations/anthropic_claude3_transformation.py` |
+| `/v1/chat/completions` | Gemini | `llms/gemini/chat/transformation.py` |
+| `/v1/chat/completions` | Vertex AI | `llms/vertex_ai/gemini/transformation.py` |
+| `/v1/chat/completions` | OpenAI | `llms/openai/chat/gpt_transformation.py` |
+| `/v1/messages` (passthrough) | Anthropic | `llms/anthropic/pass_through/messages/transformation.py` |
+| `/v1/messages` (passthrough) | Bedrock | `llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py` |
+| `/v1/messages` (passthrough) | Vertex AI | `llms/vertex_ai/vertex_ai_partner_models/anthropic/experimental_pass_through/transformation.py` |
+| Passthrough endpoints | All | `proxy/pass_through_endpoints/llm_provider_handlers/` |
+
+### Example: Debugging prompt caching
+
+If `/v1/messages` → Bedrock Converse prompt caching isn't working but Bedrock Invoke works:
+
+1. **Bedrock Converse translation**: `llms/bedrock/chat/converse_transformation.py`
+2. **Bedrock Invoke translation**: `llms/bedrock/chat/invoke_transformations/anthropic_claude3_transformation.py`
+3. Compare how each handles `cache_control` in `transform_request()`
+
+### How translations work
+
+Each provider has a `Config` class that inherits from `BaseConfig` (`llms/base_llm/chat/transformation.py`):
+
+```python
+class ProviderConfig(BaseConfig):
+    def transform_request(self, model, messages, optional_params, litellm_params, headers):
+        # Convert OpenAI format → Provider format
+        return {"messages": transformed_messages, ...}
+    
+    def transform_response(self, model, raw_response, model_response, logging_obj, ...):
+        # Convert Provider format → OpenAI format
+        return ModelResponse(choices=[...], usage=Usage(...))
+```
+
+The `BaseLLMHTTPHandler` (`llms/custom_httpx/llm_http_handler.py`) calls these methods - you never need to modify the handler itself.
+
+---
+
+## 4. Adding/Modifying Providers
+
+### To add a new provider:
+
+1. Create `llms/{provider}/chat/transformation.py`
+2. Implement `Config` class with `transform_request()` and `transform_response()`
+3. Add tests in `tests/llm_translation/test_{provider}.py`
+
+### To add a feature (e.g., prompt caching):
+
+1. Find the translation file from the table above
+2. Modify `transform_request()` to handle the new parameter
+3. Add unit tests that verify the transformation
+
+### Testing checklist
+
+When adding a feature, verify it works across all paths:
+
+| Test | File Pattern |
+|------|--------------|
+| OpenAI passthrough | `tests/llm_translation/test_openai*.py` |
+| Anthropic direct | `tests/llm_translation/test_anthropic*.py` |
+| Bedrock Invoke | `tests/llm_translation/test_bedrock*.py` |
+| Bedrock Converse | `tests/llm_translation/test_bedrock*converse*.py` |
+| Vertex AI | `tests/llm_translation/test_vertex*.py` |
+| Gemini | `tests/llm_translation/test_gemini*.py` |
+
+### Unit testing translations
+
+Translations are designed to be unit testable without making API calls:
+
+```python
+from litellm.llms.bedrock.chat.converse_transformation import BedrockConverseConfig
+
+def test_prompt_caching_transform():
+    config = BedrockConverseConfig()
+    result = config.transform_request(
+        model="anthropic.claude-3-opus",
+        messages=[{"role": "user", "content": "test", "cache_control": {"type": "ephemeral"}}],
+        optional_params={},
+        litellm_params={},
+        headers={}
+    )
+    assert "cachePoint" in str(result)  # Verify cache_control was translated
+```

CONTRIBUTING.md

@@ -0,0 +1,350 @@
+# Contributing to LiteLLM
+
+Thank you for your interest in contributing to LiteLLM! We welcome contributions of all kinds - from bug fixes and documentation improvements to new features and integrations.
+
+## **Checklist before submitting a PR**
+
+Here are the core requirements for any PR submitted to LiteLLM:
+
+- [ ] **Sign the Contributor License Agreement (CLA)** - [see details](#contributor-license-agreement-cla)
+- [ ] **Keep scope isolated** - Your changes should address 1 specific problem at a time
+
+#### Proxy (Backend) PRs
+
+- [ ] **Add testing** - Adding at least 1 test is a hard requirement - [see details](#adding-testing)
+- [ ] **Ensure your PR passes all checks**:
+  - [ ] [Linting / Formatting](#running-linting-and-formatting-checks) - `make lint`
+  - [ ] [The tests covering your change](#running-unit-tests) pass, e.g. `uv run pytest tests/unit/<your_test_file>.py -v`. CI runs the full unit test matrix, so you don't need to run the whole suite locally
+
+#### UI PRs
+
+- [ ] **Ensure the UI builds successfully** - `npm run build`
+- [ ] **Ensure all UI unit tests pass** - `npm run test`
+- [ ] **Add tests for new components or logic** - If you are adding a new component or new logic, add corresponding tests
+
+## **Contributor License Agreement (CLA)**
+
+Before contributing code to LiteLLM, you must sign our [Contributor License Agreement (CLA)](https://cla-assistant.io/BerriAI/litellm). This is a legal requirement for all contributions to be merged into the main repository.
+
+**Important:** We strongly recommend reviewing and signing the CLA before starting work on your contribution to avoid any delays in the PR process.
+
+## Quick Start
+
+### 1. Setup Your Local Development Environment
+
+```bash
+# Fork the repository on GitHub (click the Fork button at https://github.com/BerriAI/litellm)
+# Then clone your fork locally
+git clone https://github.com/YOUR_USERNAME/litellm.git
+cd litellm
+
+# Create a new branch for your feature (see "Commit and Branch Conventions" below)
+git checkout -b feature/your-feature
+
+# Install development dependencies
+make install-dev
+
+# Install git hooks that enforce commit + branch conventions (one-time, opt-in)
+make install-hooks
+
+# Verify your setup works
+make help
+```
+
+That's it! Your local development environment is ready.
+
+## Commit and Branch Conventions
+
+Commits follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) and branches follow [Conventional Branches](https://conventional-branch.github.io/). Run `make install-hooks` once per clone to enable the local git hooks that enforce these — see the [contributor docs](https://docs.litellm.ai/docs/extras/contributing_code#commit-and-branch-conventions) for the full type list, examples, the protected-branch bypass list, and how to opt out.
+
+### 2. Development Workflow
+
+Here's the recommended workflow for making changes:
+
+```bash
+# Make your changes to the code
+# ...
+
+# Format your code (auto-fixes formatting issues)
+make format
+
+# Run all linting checks (matches CI exactly)
+make lint
+
+# Run the tests covering your change (CI runs the full suite)
+uv run pytest tests/unit/<your_test_file>.py -v
+
+# Commit your changes (must follow Conventional Commits — see above)
+git add .
+git commit -m "feat(scope): your descriptive commit message"
+
+# Push and create a PR (branch must follow Conventional Branches — see above)
+git push origin feature/your-feature
+```
+
+## Adding Testing
+
+**Adding at least 1 test is a hard requirement for all PRs.**
+
+### Where to Add Tests
+
+Add your tests to the [`tests/unit/` directory](https://github.com/BerriAI/litellm/tree/main/tests/unit).
+
+- This directory mirrors the structure of the `litellm/` directory
+- **Only add mocked tests** - no real LLM API calls in this directory
+- For integration tests with real APIs, use the appropriate test directories
+
+### File Naming Convention
+
+The `tests/unit/` directory follows the same structure as `litellm/`:
+
+- `litellm/proxy/caching_routes.py` → `tests/unit/proxy/test_caching_routes.py`
+- `litellm/utils.py` → `tests/unit/test_utils.py`
+
+### Example Test
+
+```python
+import pytest
+from litellm import completion
+
+def test_your_feature():
+    """Test your feature with a descriptive docstring."""
+    # Arrange
+    messages = [{"role": "user", "content": "Hello"}]
+    
+    # Act
+    # Use mocked responses, not real API calls
+    
+    # Assert
+    assert expected_result == actual_result
+```
+
+## Running Tests and Checks
+
+### Running Unit Tests
+
+Run the tests covering your change:
+```bash
+uv run pytest tests/unit/test_your_file.py -v
+```
+
+`tests/unit` holds thousands of tests, so running all of it locally takes a long time. CI runs it as a parallel matrix (`make test-unit-llms`, `make test-unit-proxy-core`, and the other `test-unit-*` targets) on beefier boxes, so if, for whatever reason, you must run the whole suite, it's better to rely on CI to do that.
+
+If you're running broader test suites, proxy tests, or anything that touches PostgreSQL-backed fixtures/plugins, install the full local test environment first:
+
+```bash
+make install-test-deps
+```
+
+This syncs the locked test environment used across the repo, including `psycopg` v3 plus `psycopg-binary`, `psycopg2-binary` (used by some proxy E2E tests), and a generated Prisma client for DB-backed proxy tests, so pytest startup matches CI without manual package installs.
+
+### Running Linting and Formatting Checks
+
+Run all linting checks (matches CI exactly):
+
+```bash
+make lint
+```
+
+Individual linting commands:
+```bash
+make format-check       # Check ruff format formatting
+make lint-ruff          # Run Ruff linting
+make lint-basedpyright  # Run basedpyright type checking
+make check-circular-imports    # Check for circular imports
+make check-import-safety       # Check import safety
+```
+
+Apply formatting (auto-fixes issues):
+```bash
+make format
+```
+
+> **Formatting is enforced in CI.** All PRs must pass the `ruff format --check` step.
+>
+> - **AI coding agents** (Claude Code, Copilot, Cursor, etc.): follow `AGENTS.md` and run `make format` before committing.
+> - **VS Code users**: Install the [Ruff extension](https://marketplace.visualstudio.com/items?itemName=charliermarsh.ruff) and enable format-on-save:
+>   ```json
+>   {
+>     "[python]": {
+>       "editor.defaultFormatter": "charliermarsh.ruff",
+>       "editor.formatOnSave": true
+>     }
+>   }
+>   ```
+
+### CI Compatibility
+
+To ensure your changes will pass CI, run the exact same checks locally:
+
+```bash
+# This runs the same checks as the GitHub workflows
+make lint
+make test-unit
+```
+
+For exact CI compatibility (pins OpenAI version like CI):
+```bash
+make install-dev-ci     # Installs exact CI dependencies
+```
+
+## Available Make Commands
+
+Run `make help` to see all available commands:
+
+```bash
+make help                       # Show all available commands
+make install-dev               # Install development dependencies
+make install-proxy-dev         # Install proxy development dependencies
+make install-test-deps         # Install the full local test environment
+make format                    # Apply ruff format code formatting
+make format-check              # Check ruff format formatting (matches CI)
+make lint                      # Run all linting checks
+make test-unit                 # Run unit tests
+make test-integration          # Run integration tests
+make test-unit-helm            # Run Helm unit tests
+```
+
+## Code Quality Standards
+
+LiteLLM follows the [Google Python Style Guide](https://google.github.io/styleguide/pyguide.html).
+
+Our automated quality checks include:
+- **Ruff** for formatting, linting, and code quality
+- **basedpyright** for static type checking
+- **Circular import detection**
+- **Import safety validation**
+
+All checks must pass before your PR can be merged.
+
+## Common Issues and Solutions
+
+### 1. Linting Failures
+
+If `make lint` fails:
+
+1. **Formatting issues**: Run `make format` to auto-fix
+2. **Ruff issues**: Check the output and fix manually
+3. **basedpyright issues**: Add proper type hints
+4. **Circular imports**: Refactor import dependencies
+5. **Import safety**: Fix any unprotected imports
+
+### 2. Test Failures
+
+If `make test-unit` fails:
+
+1. Check if you broke existing functionality
+2. Add tests for your new code
+3. Ensure tests use mocks, not real API calls
+4. Check test file naming conventions
+
+### 3. Common Development Tips
+
+- **Use type hints**: basedpyright requires proper type annotations
+- **Write descriptive commit messages**: Help reviewers understand your changes
+- **Keep PRs focused**: One feature/fix per PR
+- **Test edge cases**: Don't just test the happy path
+- **Update documentation**: If you change APIs, update docs
+
+## Building and Running Locally
+
+### LiteLLM Proxy Server
+
+To run the proxy server locally:
+
+```bash
+# Install proxy dependencies
+make install-proxy-dev
+
+# Start the proxy server
+uv run litellm --config your_config.yaml
+```
+
+### Docker Development
+
+If you want to build the Docker image yourself:
+
+```bash
+# Build using the non-root Dockerfile
+docker build -f docker/Dockerfile.non_root -t litellm_dev .
+
+# Generate a master key. Requests send it as the bearer token
+export LITELLM_MASTER_KEY="sk-$(openssl rand -hex 32)"
+
+# Run with your config
+docker run \
+    -v $(pwd)/proxy_config.yaml:/app/config.yaml \
+    -e LITELLM_MASTER_KEY \
+    -p 4000:4000 \
+    litellm_dev \
+    --config /app/config.yaml --detailed_debug
+```
+
+## UI Development
+
+### 1. Setup Your Local UI Development Environment
+
+```bash
+# Clone the repo (if you haven't already)
+git clone https://github.com/YOUR_USERNAME/litellm.git
+cd litellm
+
+# Navigate to the UI dashboard directory
+cd ui/litellm-dashboard
+
+# Install dependencies
+npm install
+
+# Start the development server
+npm run dev
+```
+
+### 2. Adding UI Tests
+
+If you are adding a **new component** or **new logic**, you must add corresponding tests.
+
+### 3. Running UI Unit Tests
+
+```bash
+npm run test
+```
+
+### 4. Building the UI
+
+Ensure the UI builds successfully before submitting your PR:
+
+```bash
+npm run build
+```
+
+Local lint and budget checks follow origin's current default branch. They refresh it from the remote instead of trusting cached `origin/HEAD`. For an intentional comparison against another branch or commit, use `make check BASE_REF=<ref>` or the standalone gate's `--base <ref>` option. An explicit ref can also be used offline once it has been fetched locally. Without an override, unavailable remote metadata stops the check
+
+## Submitting Your PR
+
+1. **Push your branch**: `git push origin your-feature-branch`
+2. **Create a PR**: Go to GitHub and open a pull request against the repository's current default branch. Run `python3 scripts/default_branch.py --branch` to check its name
+3. **Fill out the PR template**: Provide clear description of changes
+4. **Wait for review**: Maintainers will review and provide feedback
+5. **Address feedback**: Make requested changes and push updates
+6. **Merge**: Once approved, your PR will be merged!
+
+## Getting Help
+
+If you need help:
+
+- 💬 [Join our Discord](https://discord.gg/wuPM9dRgDw)
+- 💬 [Join our Slack](https://www.litellm.ai/support)
+- 📧 Email us: ishaan@berri.ai / krrish@berri.ai
+- 🐛 [Create an issue](https://github.com/BerriAI/litellm/issues/new)
+
+## What to Contribute
+
+Looking for ideas? Check out:
+
+- 🐛 [Good first issues](https://github.com/BerriAI/litellm/labels/good%20first%20issue)
+- 🚀 [Feature requests](https://github.com/BerriAI/litellm/labels/enhancement)
+- 📚 Documentation improvements
+- 🧪 Test coverage improvements
+- 🔌 New LLM provider integrations
+
+Thank you for contributing to LiteLLM! 🚀 

Dockerfile

@@ -0,0 +1,186 @@
+# syntax=docker/dockerfile:1.7
+
+# Base image for building
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:360896efb0753a5701c48f860e17130c205eae5a264797aa3e7ea126ee2923a7
+
+# Runtime image
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:360896efb0753a5701c48f860e17130c205eae5a264797aa3e7ea126ee2923a7
+ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
+# Pinned by digest like the other base images; bump explicitly on Node upgrades.
+ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
+# Checksum from https://www.pgbouncer.org/downloads/ (the Wolfi repo only carries 1.24.x)
+ARG PGBOUNCER_VERSION=1.26.0
+ARG PGBOUNCER_SHA256=afd25dd61ee6775d37b40629b87ce08736b3e6955f3057bb212e410fbf21c71d
+
+FROM $UV_IMAGE AS uvbin
+
+FROM $LITELLM_BUILD_IMAGE AS pgbouncer-builder
+ARG PGBOUNCER_VERSION
+ARG PGBOUNCER_SHA256
+USER root
+RUN apk add --no-cache build-base pkgconf libevent-dev openssl-dev curl
+WORKDIR /build
+RUN curl -fsSL -o pgbouncer.tar.gz "https://www.pgbouncer.org/downloads/files/${PGBOUNCER_VERSION}/pgbouncer-${PGBOUNCER_VERSION}.tar.gz" && \
+    echo "${PGBOUNCER_SHA256}  pgbouncer.tar.gz" | sha256sum -c - && \
+    tar xzf pgbouncer.tar.gz --strip-components=1 && \
+    ./configure --prefix=/usr/local --with-openssl=/usr && \
+    make -j"$(nproc)" pgbouncer && \
+    install -m 0755 pgbouncer /usr/local/bin/pgbouncer
+
+# Admin UI builder. Pinned to the build platform so the architecture-independent
+# Next.js static export compiles once natively even in a multi-arch build,
+# instead of once per target arch under QEMU.
+FROM --platform=$BUILDPLATFORM $UI_BUILD_IMAGE AS ui-builder
+
+ENV NEXT_TELEMETRY_DISABLED=1 \
+    npm_config_fund=false \
+    npm_config_audit=false
+
+WORKDIR /ui
+
+COPY ui/litellm-dashboard/package.json ui/litellm-dashboard/package-lock.json ./
+COPY ui/litellm-dashboard/vendor/ ./vendor/
+RUN --mount=type=cache,target=/root/.npm npm ci --prefer-offline
+
+COPY ui/litellm-dashboard/ ./
+RUN npm run build
+
+# Builder stage
+FROM $LITELLM_BUILD_IMAGE AS builder
+
+WORKDIR /app
+USER root
+
+COPY --from=uvbin /uv /usr/local/bin/uv
+COPY --from=uvbin /uvx /usr/local/bin/uvx
+
+RUN apk add --no-cache \
+    bash \
+    gcc \
+    python-3.13 \
+    python-3.13-dev \
+    rust \
+    openssl \
+    libssl3 \
+    openssl-dev \
+    nodejs \
+    npm \
+    libsndfile
+
+ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=0 \
+    PATH="/app/.venv/bin:${PATH}"
+
+# Copy dependency metadata first for layer caching
+COPY pyproject.toml uv.lock ./
+COPY enterprise/pyproject.toml enterprise/
+COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
+
+# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
+RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --group admin-mcp \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --extra saml \
+    --extra bedrock-realtime \
+    --python python3.13
+
+# Copy full source tree
+COPY . .
+
+# Replace the committed UI bundle with the one built from this exact source.
+# Clearing first drops the committed bundle's content-hashed chunks that COPY
+# would otherwise leave behind alongside the fresh ones.
+RUN rm -rf litellm/proxy/_experimental/out
+COPY --from=ui-builder /ui/out/. litellm/proxy/_experimental/out/
+
+# Build Admin UI before final sync (applies the enterprise color override when present)
+RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
+
+# Install project and workspace packages (fast - deps already cached)
+RUN uv sync --frozen --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --group admin-mcp \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --extra saml \
+    --extra bedrock-realtime \
+    --python python3.13
+
+RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
+    npm_config_cache=/root/.npm \
+    prisma generate --schema=./schema.prisma
+
+RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
+    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
+
+FROM $LITELLM_BUILD_IMAGE AS liteadmin-builder
+COPY --from=uvbin /uv /usr/local/bin/uv
+RUN apk add --no-cache python-3.13
+ADD --checksum=sha256:4fb1847e28e2be30ba76dac94f02c4903291326516a0f4ba772f6ffb8b25d05c \
+    https://github.com/BerriAI/litellm-admin-agent/archive/5661c805ce479a0cf11b842ea133cf8d22cd7e34.tar.gz /tmp/liteadmin.tar.gz
+RUN mkdir /tmp/liteadmin && tar xzf /tmp/liteadmin.tar.gz --strip-components=1 -C /tmp/liteadmin && \
+    uv venv /opt/liteadmin --python python3.13 && \
+    uv pip install --python /opt/liteadmin/bin/python --require-hashes -r /tmp/liteadmin/requirements.txt && \
+    uv pip install --python /opt/liteadmin/bin/python --no-deps /tmp/liteadmin
+
+# Runtime stage
+FROM $LITELLM_RUNTIME_IMAGE AS runtime
+ARG LITELLM_RELEASE_TAG=""
+ENV LITELLM_RELEASE_TAG=${LITELLM_RELEASE_TAG}
+
+USER root
+
+# The base image only configures Chainguard's authenticated apk repo, which
+# requires an enterprise subscription. Add the public Wolfi repo so `apk add`
+# also works for anyone installing extra packages into a running container.
+# https://github.com/BerriAI/litellm/issues/33518
+RUN echo "https://packages.wolfi.dev/os" >> /etc/apk/repositories
+
+# node (without npm) is required by the prisma CLI at runtime
+RUN apk add --no-cache bash openssl libssl3 tzdata nodejs python-3.13 libsndfile libevent
+COPY --from=pgbouncer-builder /usr/local/bin/pgbouncer /usr/local/bin/pgbouncer
+
+WORKDIR /app
+ENV PATH="/app/.venv/bin:${PATH}" \
+    PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
+    PRISMA_CLI_PATH=/opt/prisma/binaries/node_modules/.bin/prisma \
+    PRISMA_CLI_QUERY_ENGINE_TYPE=binary \
+    PRISMA_OFFLINE_MODE=true
+
+# Copy only what runtime needs. The application is installed inside the venv;
+# the rest of the builder's /app is source and build metadata that must not
+# ship (manifest-scanning tools attribute everything in it to this image).
+# entrypoint.sh invokes litellm/proxy/prisma_migration.py by source path.
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=liteadmin-builder /opt/liteadmin /opt/liteadmin
+COPY --from=builder /app/docker /app/docker
+COPY --from=builder /app/schema.prisma /app/schema.prisma
+COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/prisma_migration.py
+# enterprise/ is imported by source path at runtime (proxy_cli puts the
+# working directory on sys.path; litellm/proxy/hooks resolves
+# enterprise.enterprise_hooks from it)
+COPY --from=builder /app/enterprise /app/enterprise
+COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras
+# Prisma CLI + engines are baked under /opt/prisma, a fixed path every
+# runtime uid can read and that no cache volume mount shadows. The paths are
+# pinned via PRISMA_BINARY_CACHE_DIR / PRISMA_CLI_PATH and recorded into the
+# generated client at build time, so `prisma migrate deploy` on a fresh
+# database needs no npm and no network access (#33650, #24554).
+COPY --from=builder /opt/prisma /opt/prisma
+
+RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
+    find /app/.venv -type d -path "*/tornado/test" -delete && \
+    chmod -R a+rX /opt/prisma && \
+    test -x /opt/prisma/binaries/node_modules/.bin/prisma && \
+    test -f /opt/prisma/binaries/node_modules/prisma/build/index.js && \
+    python -c "from prisma.client import BINARY_PATHS; paths = list(BINARY_PATHS.query_engine.values()); assert paths and all(p.startswith('/opt/prisma/') for p in paths), paths"
+
+EXPOSE 4000/tcp
+
+ENTRYPOINT ["docker/prod_entrypoint.sh"]
+CMD ["--port", "4000"]

GEMINI.md

@@ -0,0 +1 @@
+Read @AGENTS.md for coding guidelines

LICENSE

@@ -1,6 +1,6 @@
 Portions of this software are licensed as follows:
 
-* All content that resides under the "litellm/enterprise/" directory of this repository, if that directory exists, is licensed under the license defined in "litellm/enterprise/LICENSE".
+* All content that resides under the "enterprise/" directory of this repository, if that directory exists, is licensed under the license defined in "enterprise/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is available under the MIT license as defined below.
 ---
 MIT License

Makefile

@@ -22,7 +22,7 @@ help:
 	@echo "  make install-proxy-dev-ci - Install proxy dev dependencies (CI-compatible)"
 	@echo "  make install-test-deps  - Install the full local test environment"
 	@echo "  make install-helm-unittest - Install helm unittest plugin"
-	@echo "  make install-hooks      - Install git hooks (Conventional Commits)"
+	@echo "  make install-hooks      - Install git hooks (Conventional Commits + Branches)"
 	@echo "  make check              - Run CI-equivalent lint on staged files, or on the diff vs the base branch when nothing is staged"
 	@echo "  make pre-commit         - Legacy alias for make check"
 	@echo "  make format             - Apply ruff format code formatting"
@@ -54,24 +54,20 @@ help:
 	@echo "  make test-integration   - Run integration tests"
 	@echo "  make test-unit-helm     - Run helm unit tests"
 	@echo "  make test-rust-extension - Build the Rust extension and run its public Python tests"
-	@echo "  make rust-sqlx-prepare  - Refresh litellm/rust/crates/db/.sqlx against a migrated Postgres container"
+	@echo "  make rust-sqlx-prepare  - Refresh litellm-rust/crates/db/.sqlx against a migrated Postgres container"
 	@echo ""
 	@echo "Heavy targets (check, lint) queue for LITELLM_GATE_SLOTS machine-wide"
 	@echo "slots (default 2; 0 disables) so parallel sessions don't thrash one machine."
 
 UV := uv
-export RUSTUP_TOOLCHAIN ?= $(shell sed -n 's/^[[:space:]]*channel[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' litellm/rust/rust-toolchain.toml)
-export CARGO_NET_RETRY ?= 5
-export CARGO_HTTP_MULTIPLEXING ?= false
-export SQLX_OFFLINE ?= true
 UV_RUN := $(UV) run --no-sync
 BASE_REF ?=
 export BASE_REF
-RESOLVE_BASE = python3 litellm/scripts/default_branch.py --base "$(BASE_REF)"
+RESOLVE_BASE = python3 scripts/default_branch.py --base "$(BASE_REF)"
 
 # Machine-wide slot queue for the heavy targets below; python3 + stdlib only, so
-# it runs before any venv exists. See litellm/scripts/gate_slot_lock.py.
-GATE_SLOT_LOCK := python3 litellm/scripts/gate_slot_lock.py
+# it runs before any venv exists. See scripts/gate_slot_lock.py.
+GATE_SLOT_LOCK := python3 scripts/gate_slot_lock.py
 
 LINT_DEP_INSTALL ?= install-dev
 LINT_E2E_DEP_INSTALL ?= lint-install
@@ -94,8 +90,8 @@ install-dev:
 # machine-wide slots the CPU-bound gates below share.
 bootstrap:
 	$(UV) sync --inexact --frozen --extra proxy --group proxy-dev --group e2e-dev
-	$(UV_RUN) python litellm/scripts/prisma_generate_if_needed.py
-	cd litellm/ui/litellm-dashboard && ../../scripts/with_dashboard_node.sh npm install --no-audit --no-fund
+	$(UV_RUN) python scripts/prisma_generate_if_needed.py
+	cd ui/litellm-dashboard && ../../scripts/with_dashboard_node.sh npm install --no-audit --no-fund
 	@main_root=$$(git worktree list --porcelain | head -1 | sed 's/^worktree //'); \
 	if [ "$$main_root" != "$$(git rev-parse --show-toplevel)" ] && [ -f "$$main_root/.env" ] && [ ! -f .env ]; then \
 		cp "$$main_root/.env" .env && echo "bootstrap: copied .env from $$main_root"; \
@@ -124,13 +120,13 @@ install-helm-unittest:
 		helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.8.2; \
 	}
 
-# Install git hooks that enforce Conventional Commits.
+# Install git hooks that enforce Conventional Commits and Conventional Branches.
 # Opt-in: not chained into install-dev.
 install-hooks:
-	./litellm/scripts/install_git_hooks.sh
+	./scripts/install_git_hooks.sh
 
 # Formatting
-# Wrap width is pyproject.toml's single source of truth (line-length = 120), shared by the
+# Wrap width is ruff.toml's single source of truth (line-length = 120), shared by the
 # formatter and the import sorter so there's no 88-vs-120 split to reconcile.
 format: install-dev
 	cd litellm && $(UV_RUN) ruff format --exclude '/enterprise/' . && cd ..
@@ -143,12 +139,12 @@ lint-fetch-base:
 
 # Mirror test-linting.yml's python job environment: the proxy-dev group plus a generated
 # Prisma client, so `basedpyright tests/e2e` resolves the same modules CI does. The
-# basedpyright gate itself no longer measures here (litellm/scripts/type_check_gate.py provisions its
+# basedpyright gate itself no longer measures here (scripts/type_check_gate.py provisions its
 # own .venv-typecheck). --inexact tops up the venv instead of pruning the proxy extras
 # gen:api and the running proxy need.
 lint-install:
 	$(UV) sync --inexact --frozen --group proxy-dev --group e2e-dev
-	$(UV_RUN) python litellm/scripts/prisma_generate_if_needed.py
+	$(UV_RUN) python scripts/prisma_generate_if_needed.py
 
 # Diff-scoped format check, mirroring test-linting.yml's "Check ruff format" step:
 # only the litellm Python files changed vs the base are checked, so a pre-existing
@@ -157,7 +153,7 @@ lint-install:
 # the same set CI's ':(glob)litellm/**/*.py' selects.
 lint-format-check-changed: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
 	@base_ref=$$($(RESOLVE_BASE)) && \
-	changed=$$(git diff --name-only --diff-filter=ACMR --merge-base "$$base_ref" -- 'litellm/*.py') && \
+	changed=$$(git diff --name-only --diff-filter=ACMR "$$base_ref...HEAD" -- 'litellm/*.py') && \
 	files=$$(printf '%s\n' "$$changed" | grep -v '^litellm/enterprise/' || true) || exit $$?; \
 	if [ -z "$$files" ]; then \
 		echo "No changed litellm Python files to format-check."; \
@@ -167,9 +163,9 @@ lint-format-check-changed: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
 
 # Linting targets
 lint-ruff: $(LINT_DEP_INSTALL)
-	$(UV_RUN) python litellm/scripts/check_mcp_operation_boundary.py
+	$(UV_RUN) python scripts/check_mcp_operation_boundary.py
 	cd litellm && $(UV_RUN) ruff check . && cd ..
-	$(UV_RUN) ruff check --config .github/linters/ruff-tests.toml tests
+	$(UV_RUN) ruff check --config ruff-tests.toml tests
 
 # faster linter for developing ...
 # inspiration from:
@@ -208,7 +204,7 @@ lint-ruff-FULL-dev: install-dev
 	else echo "No changed .py files to check."; fi
 
 lint-basedpyright: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
-	$(UV_RUN) python litellm/scripts/type_check_gate.py --base "$(BASE_REF)"
+	$(UV_RUN) python scripts/type_check_gate.py --base "$(BASE_REF)"
 
 lint-e2e-basedpyright: $(LINT_E2E_DEP_INSTALL)
 	$(UV_RUN) basedpyright tests/e2e tests/e2e_harness
@@ -216,29 +212,29 @@ lint-e2e-basedpyright: $(LINT_E2E_DEP_INSTALL)
 # Type-discipline gate (mutable collections / casts / type guards / kwargs /
 # unexplained suppressions), the test-linting.yml step `make lint` used to omit.
 lint-type-discipline: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
-	$(UV_RUN) python litellm/scripts/type_discipline_gate.py --base "$(BASE_REF)"
+	$(UV_RUN) python scripts/type_discipline_gate.py --base "$(BASE_REF)"
 
 # Test-quality gate (zero-assert / mock-echo tests, sys.path.insert, raw env writes,
 # litellm module-global mutation, credential-gated skips, conftest snapshot
 # inventory), counted across tests/ the same delta-vs-base way.
 lint-test-quality: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
-	$(UV_RUN) python litellm/scripts/test_quality_gate.py --base "$(BASE_REF)"
+	$(UV_RUN) python scripts/test_quality_gate.py --base "$(BASE_REF)"
 
 # OpenAPI docs gate (POST routes without a request body schema, a description or a
 # 200 schema in app.openapi()), counted the same delta-vs-base way so a new endpoint
 # has to show up documented in Swagger UI.
 lint-openapi-docs: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
-	$(UV_RUN) python litellm/scripts/openapi_docs_gate.py --base "$(BASE_REF)"
+	$(UV_RUN) python scripts/openapi_docs_gate.py --base "$(BASE_REF)"
 
 lint-format: format-check
 
 lint-ruff-strict: install-dev
-	$(UV_RUN) python litellm/scripts/ruff_strict_gate.py --base "$(BASE_REF)"
+	$(UV_RUN) python scripts/ruff_strict_gate.py --base "$(BASE_REF)"
 
 # Strict gate, invoked the same way CI does in test-linting.yml so a local pass
 # means the CI check will pass too.
 lint-gate: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
-	$(UV_RUN) python litellm/scripts/ruff_strict_gate.py --base "$(BASE_REF)"
+	$(UV_RUN) python scripts/ruff_strict_gate.py --base "$(BASE_REF)"
 
 check-circular-imports: $(LINT_DEP_INSTALL)
 	cd litellm && $(UV_RUN) python ../tests/documentation_tests/test_circular_imports.py && cd ..
@@ -276,7 +272,7 @@ check:
 	@$(GATE_SLOT_LOCK) $(MAKE) check-inner
 
 check-inner: bootstrap
-	./litellm/scripts/pre_commit_lint.sh
+	./scripts/pre_commit_lint.sh
 
 pre-commit:
 	@echo "make pre-commit is a legacy alias; use make check" >&2
@@ -298,7 +294,7 @@ test-rust-extension:
 	"$$temporary/venv/bin/python" -I -m pytest --import-mode=importlib -m requires_rust_extension tests/test_litellm_rust
 
 rust-sqlx-prepare:
-	cd litellm/rust && cargo run -p litellm-db-testing --bin sqlx-prepare
+	cd litellm-rust && cargo run -p litellm-db-testing --bin sqlx-prepare
 
 test: install-test-deps
 	$(UV_RUN) pytest tests/
@@ -317,7 +313,7 @@ test-unit-proxy-core: install-test-deps
 	$(UV_RUN) pytest tests/unit/proxy/auth tests/unit/proxy/client tests/unit/proxy/db tests/unit/proxy/hooks tests/unit/proxy/policy_engine --ignore=tests/unit/proxy/db/db_transaction_queue/test_e2e_pod_lock_manager.py --ignore=tests/unit/proxy/db/test_update_daily_tag_spend.py --tb=short -vv -n 4 --durations=20
 
 test-unit-proxy-misc: install-test-deps
-	$(UV_RUN) pytest tests/unit/proxy/agent_endpoints tests/unit/proxy/anthropic_endpoints tests/unit/proxy/common_utils --ignore=tests/unit/proxy/common_utils/test_cache_aware_routing.py --ignore=tests/unit/proxy/common_utils/test_check_batch_cost.py --ignore=tests/unit/proxy/common_utils/test_check_responses_cost.py --ignore=tests/unit/proxy/common_utils/test_proxy_encrypt_decrypt.py --ignore=tests/unit/proxy/common_utils/test_realtime_cache.py tests/unit/proxy/discovery_endpoints tests/unit/proxy/mcp_server/test_tool_registry.py tests/unit/proxy/google_endpoints tests/unit/proxy/health_endpoints tests/unit/proxy/image_endpoints tests/unit/proxy/middleware --ignore=tests/unit/proxy/middleware/test_request_size_limit_middleware.py tests/unit/proxy/openai_files_endpoint tests/unit/proxy/pass_through_endpoints tests/unit/proxy/prompts tests/unit/proxy/public_endpoints tests/unit/proxy/response_api_endpoints tests/unit/proxy/shutdown tests/unit/proxy/spend_tracking --ignore=tests/unit/proxy/spend_tracking/test_search_api_logging.py tests/unit/proxy/ui_crud_endpoints tests/unit/proxy/vector_store_endpoints tests/unit/proxy/mcp_server/test_mcp_server_tool_calls_and_headers.py --ignore=tests/unit/proxy/google_endpoints/test_gemini_agents_endpoints.py --ignore=tests/unit/proxy/google_endpoints/test_google_endpoint_routing.py --ignore=tests/unit/proxy/google_endpoints/test_google_gemini_proxy_request.py --ignore=tests/unit/proxy/public_endpoints/test_blog_posts_endpoint.py --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/unit/proxy/agent_endpoints tests/unit/proxy/anthropic_endpoints tests/unit/proxy/common_utils --ignore=tests/unit/proxy/common_utils/test_cache_aware_routing.py --ignore=tests/unit/proxy/common_utils/test_check_batch_cost.py --ignore=tests/unit/proxy/common_utils/test_check_responses_cost.py --ignore=tests/unit/proxy/common_utils/test_proxy_encrypt_decrypt.py --ignore=tests/unit/proxy/common_utils/test_realtime_cache.py tests/unit/proxy/discovery_endpoints tests/unit/proxy/experimental tests/unit/proxy/google_endpoints tests/unit/proxy/health_endpoints tests/unit/proxy/image_endpoints tests/unit/proxy/middleware --ignore=tests/unit/proxy/middleware/test_request_size_limit_middleware.py tests/unit/proxy/openai_files_endpoint tests/unit/proxy/pass_through_endpoints tests/unit/proxy/prompts tests/unit/proxy/public_endpoints tests/unit/proxy/response_api_endpoints tests/unit/proxy/shutdown tests/unit/proxy/spend_tracking --ignore=tests/unit/proxy/spend_tracking/test_search_api_logging.py tests/unit/proxy/ui_crud_endpoints tests/unit/proxy/vector_store_endpoints tests/unit/proxy/_experimental/mcp_server/test_mcp_server_tool_calls_and_headers.py --ignore=tests/unit/proxy/google_endpoints/test_gemini_agents_endpoints.py --ignore=tests/unit/proxy/google_endpoints/test_google_endpoint_routing.py --ignore=tests/unit/proxy/google_endpoints/test_google_gemini_proxy_request.py --ignore=tests/unit/proxy/public_endpoints/test_blog_posts_endpoint.py --tb=short -vv -n 4 --durations=20
 
 test-unit-proxy-root: install-test-deps
 	$(UV_RUN) pytest tests/unit/proxy/test_*.py --ignore=tests/unit/proxy/test_aproxy_startup.py --ignore=tests/unit/proxy/test_credential_slot_registry.py --ignore=tests/unit/proxy/test_custom_callback_input.py --ignore=tests/unit/proxy/test_custom_logger_s3_gcs.py --ignore=tests/unit/proxy/test_custom_tokenizer_bug.py --ignore=tests/unit/proxy/test_db_schema_changes.py --ignore=tests/unit/proxy/test_deprecated_key_grace_period.py --ignore=tests/unit/proxy/test_get_favicon.py --ignore=tests/unit/proxy/test_get_image.py --ignore=tests/unit/proxy/test_prisma_client_backoff_retry.py --ignore=tests/unit/proxy/test_prompt_test_endpoint.py --ignore=tests/unit/proxy/test_proxy_config_unit_test.py --ignore=tests/unit/proxy/test_proxy_custom_auth.py --ignore=tests/unit/proxy/test_proxy_reject_logging.py --ignore=tests/unit/proxy/test_proxy_server.py --ignore=tests/unit/proxy/test_proxy_setting_guardrails.py --ignore=tests/unit/proxy/test_proxy_token_counter.py --ignore=tests/unit/proxy/test_proxy_utils.py --ignore=tests/unit/proxy/test_reducto_ocr_route.py --ignore=tests/unit/proxy/test_response_polling_pre_call_checks.py --ignore=tests/unit/proxy/test_server_root_path.py --ignore=tests/unit/proxy/test_ui_path_detection.py --ignore=tests/unit/proxy/test_unit_test_proxy_hooks.py --ignore=tests/unit/proxy/test_update_spend.py --ignore=tests/unit/proxy/test_zero_cost_model_budget_bypass.py --tb=short -vv -n 4 --durations=20
@@ -329,7 +325,7 @@ test-unit-core-utils: install-test-deps
 	$(UV_RUN) pytest tests/unit/litellm_core_utils --tb=short -vv -n 2 --durations=20
 
 test-unit-other: install-test-deps
-	$(UV_RUN) pytest tests/unit/caching tests/unit/responses tests/unit/secret_managers tests/unit/vector_stores tests/unit/a2a_protocol tests/unit/completion_extras tests/unit/containers tests/unit/enterprise tests/unit/mcp_client tests/unit/google_genai tests/unit/images tests/unit/interactions tests/unit/router_strategy tests/unit/router_utils tests/unit/types --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/unit/caching tests/unit/responses tests/unit/secret_managers tests/unit/vector_stores tests/unit/a2a_protocol tests/unit/completion_extras tests/unit/containers tests/unit/enterprise tests/unit/experimental_mcp_client tests/unit/google_genai tests/unit/images tests/unit/interactions tests/unit/router_strategy tests/unit/router_utils tests/unit/types --tb=short -vv -n 4 --durations=20
 
 test-unit-root: install-test-deps
 	$(UV_RUN) pytest tests/unit/test_*.py --tb=short -vv -n 4 --durations=20
@@ -345,7 +341,7 @@ test-integration: install-test-deps
 	$(UV_RUN) pytest tests/
 
 test-unit-helm: install-helm-unittest
-	helm unittest -f 'tests/*.yaml' litellm/deploy/helm/litellm
+	helm unittest -f 'tests/*.yaml' helm/litellm-helm
 
 # LLM Translation testing targets
 test-llm-translation: install-test-deps

README.md

@@ -6,7 +6,7 @@
         </p>
         <p align="center">Open Source AI Gateway for 100+ LLMs. Self-hosted. Enterprise-ready. Call any LLM in OpenAI format.</p>
         <p align="center">
-        <a href="https://render.com/deploy?repo=https://github.com/BerriAI/litellm&amp;blueprintPath=litellm/deploy/render/render.yaml" target="_blank" rel="nofollow"><img src="https://render.com/images/deploy-to-render-button.svg" alt="Deploy to Render" height="40"></a>
+        <a href="https://render.com/deploy?repo=https://github.com/BerriAI/litellm" target="_blank" rel="nofollow"><img src="https://render.com/images/deploy-to-render-button.svg" alt="Deploy to Render" height="40"></a>
         <a href="https://railway.com/deploy/RhvhdC?referralCode=7mRv9K&utm_medium=integration&utm_source=template&utm_campaign=generic"><img src="https://railway.com/button.svg" alt="Deploy on Railway" height="40"></a>
         <a href="https://console.aws.amazon.com/cloudshell/home" target="_blank" rel="nofollow"><img src="./.github/deploy-on-aws.png" alt="Deploy on AWS" height="40"></a>
         <a href="https://ssh.cloud.google.com/cloudshell/editor?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2FBerriAI%2Fterraform-google-litellm&cloudshell_git_branch=v1.105.0&cloudshell_workspace=examples%2Fdefault&cloudshell_tutorial=TUTORIAL.md&cloudshell_image=gcr.io/ds-artifacts-cloudshell/deploystack_custom_image&shellonly=true" target="_blank" rel="nofollow"><img src="./.github/deploy-on-gcp.png" alt="Deploy on GCP" height="40"></a>
@@ -99,7 +99,7 @@ proxy, CLI, and optional extras
 Build and install core from this checkout while its release integration is pending:
 
 ```shell
-python litellm/scripts/build_core_distribution.py --out-dir dist/core
+python scripts/build_core_distribution.py --out-dir dist/core
 python -m pip install dist/core/litellm_core-*.whl
 ```
 
@@ -141,56 +141,12 @@ response = client.chat.completions.create(
 )
 ```
 
-</details>
-
-<details>
-<summary><b>Auto Routing</b> - Choose a model for each prompt (Python SDK + AI Gateway)</summary>
-
-### Python SDK
-
-[**Docs: Autorouter SDK**](https://docs.litellm.ai/docs/autorouter_sdk)
-
-Install with `uv add litellm` and set `OPENAI_API_KEY` for the models below.
-
-```python
-import asyncio
-from litellm import Router
-
-router = Router(model_list=[
-    {"model_name": "fast", "litellm_params": {"model": "openai/gpt-6-luna"}},
-    {"model_name": "capable", "litellm_params": {"model": "openai/gpt-6.1-sol"}},
-    {"model_name": "auto", "litellm_params": {
-        "model": "auto_router/complexity_router",
-        "complexity_router_config": {
-            "classifier_type": "heuristic",
-            "tiers": {"SIMPLE": "fast", "MEDIUM": "fast",
-                      "COMPLEX": "capable", "REASONING": "capable"},
-            "return_raw_model_name": True,
-        },
-        "complexity_router_default_model": "capable",
-    }},
-])
-response = asyncio.run(router.acompletion(
-    model="auto", messages=[{"role": "user", "content": "What is 2+2?"}],
-))
-print(response.model, response.choices[0].message.content)
-```
-
-### AI Gateway (Proxy Server)
-
-[**Create an Auto Router**](https://docs.litellm.ai/docs/auto_router/setup), then call its model name. Replace `auto` and the URL below with yours, and set `LITELLM_API_KEY` to your virtual key.
-
-```shell
-curl http://localhost:4000/v1/chat/completions \
-  -H "Authorization: Bearer $LITELLM_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"model":"auto","messages":[{"role":"user","content":"What is 2+2?"}]}'
-```
+[**Docs: LLM Providers**](https://docs.litellm.ai/docs/providers)
 
 </details>
 
 <details>
-<summary><b>A2A</b> - Invoke A2A Agents (Python SDK + AI Gateway)</summary>
+<summary><b>Agents</b> - Invoke A2A Agents (Python SDK + AI Gateway)</summary>
 
 [**Supported Providers**](https://docs.litellm.ai/docs/a2a#add-a2a-agents) - LangGraph, Vertex AI Agent Engine, Azure AI Foundry, Bedrock AgentCore, Pydantic AI
 
@@ -267,7 +223,7 @@ async with httpx.AsyncClient(headers=headers, timeout=60.0) as http_client:
 ```python
 from mcp import ClientSession, StdioServerParameters
 from mcp.client.stdio import stdio_client
-from litellm import mcp_client
+from litellm import experimental_mcp_client
 import litellm
 
 server_params = StdioServerParameters(command="python", args=["mcp_server.py"])
@@ -277,7 +233,7 @@ async with stdio_client(server_params) as (read, write):
         await session.initialize()
 
         # Load MCP tools in OpenAI format
-        tools = await mcp_client.load_mcp_tools(session=session, format="openai")
+        tools = await experimental_mcp_client.load_mcp_tools(session=session, format="openai")
 
         # Use with any LiteLLM model
         response = await litellm.acompletion(
@@ -331,7 +287,7 @@ For MCP OAuth, an upstream may advertise dynamic client registration but refuse
 </details>
 
 <details>
-<summary><b>Agents</b> - Run Claude Code, Codex, OpenCode, pi or Deep Agents on any model (Python SDK)</summary>
+<summary><b>Agents</b> - Run Claude Code, Codex, OpenCode or Deep Agents on any model (Python SDK)</summary>
 
 ### Python SDK - Agents
 
@@ -340,7 +296,7 @@ import litellm
 from litellm import Harness, sandbox
 
 result = litellm.agent(
-    Harness.CLAUDE_CODE,  # or Harness.CODEX, Harness.OPENCODE, Harness.PI, Harness.DEEPAGENTS
+    Harness.CLAUDE_CODE,  # or Harness.CODEX, Harness.OPENCODE, Harness.DEEPAGENTS
     "Find why tests/test_router.py is flaky and fix it.",
     sandbox=sandbox.local("./repo"),
     model="litellm_proxy/claude-sonnet-4-5",  # a model group on your AI Gateway
@@ -349,7 +305,7 @@ result = litellm.agent(
 print(result.text, result.cost, [f.path for f in result.files])
 ```
 
-Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call the agent makes goes through your AI Gateway, tagged `harness,claude_code`. Drop the `litellm_proxy/` prefix to call a provider directly. Install `starlette uvicorn` plus the agent's CLI (`claude`, `codex`, `opencode` or `pi`), or `deepagents langchain-litellm` for Deep Agents.
+Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call the agent makes goes through your AI Gateway, tagged `harness,claude_code`. Drop the `litellm_proxy/` prefix to call a provider directly. Install `starlette uvicorn` plus the agent's CLI (`claude`, `codex` or `opencode`), or `deepagents langchain-litellm` for Deep Agents.
 
 [**Docs: Agent Harnesses**](https://docs.litellm.ai/docs/harness)
 
@@ -379,7 +335,6 @@ Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call th
 | [Bytez (`bytez`)](https://docs.litellm.ai/docs/providers/bytez) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Cerebras (`cerebras`)](https://docs.litellm.ai/docs/providers/cerebras) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Clarifai (`clarifai`)](https://docs.litellm.ai/docs/providers/clarifai) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
-| [CLF AI Gateway (`clf_ai_gateway`)](https://docs.litellm.ai/docs/providers/clf_ai_gateway) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Cloudflare AI Workers (`cloudflare`)](https://docs.litellm.ai/docs/providers/cloudflare_workers) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Codestral (`codestral`)](https://docs.litellm.ai/docs/providers/codestral) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Cognition (`cognition`)](https://docs.litellm.ai/docs/providers/cognition) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
@@ -398,9 +353,7 @@ Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call th
 | [Deepseek (`deepseek`)](https://docs.litellm.ai/docs/providers/deepseek) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Eden AI (`edenai`)](https://docs.litellm.ai/docs/providers/edenai) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |  |  |  |
 | [ElevenLabs (`elevenlabs`)](https://docs.litellm.ai/docs/providers/elevenlabs) | ✅ | ✅ | ✅ |  |  | ✅ | ✅ |  |  |  |
-| [EmpirioLabs AI (`empiriolabs`)](https://docs.litellm.ai/docs/providers/empiriolabs) | ✅ |  | ✅ |  |  |  |  |  |  |  |
 | [Empower (`empower`)](https://docs.litellm.ai/docs/providers/empower) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
-| [eu/jev Decisions API (`eu_jev`)](https://docs.litellm.ai/docs/pass_through/eu_jev) |  |  |  |  |  |  |  |  |  |  |
 | [Fal AI (`fal_ai`)](https://docs.litellm.ai/docs/providers/fal_ai) | ✅ | ✅ | ✅ |  | ✅ |  |  |  |  |  |
 | [Featherless AI (`featherless_ai`)](https://docs.litellm.ai/docs/providers/featherless_ai) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Fireworks AI (`fireworks_ai`)](https://docs.litellm.ai/docs/providers/fireworks_ai) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
@@ -431,7 +384,6 @@ Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call th
 | [ModelScope (`modelscope`)](https://docs.litellm.ai/docs/providers/modelscope) | ✅ | ✅ | ✅ |  | ✅ |  |  |  |  |  |
 | [Moonshot (`moonshot`)](https://docs.litellm.ai/docs/providers/moonshot) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Morph (`morph`)](https://docs.litellm.ai/docs/providers/morph) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
-| [Nace (`nace`)](https://console.nace.ai/docs/drex) |  |  |  |  |  |  |  |  |  |  |
 | [Nebius AI Studio (`nebius`)](https://docs.litellm.ai/docs/providers/nebius) | ✅ | ✅ | ✅ | ✅ |  |  |  |  |  |  |
 | [NLP Cloud (`nlp_cloud`)](https://docs.litellm.ai/docs/providers/nlp_cloud) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Novita AI (`novita`)](https://novita.ai/models/llm?utm_source=github_litellm&utm_medium=github_readme&utm_campaign=github_link) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
@@ -445,7 +397,6 @@ Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call th
 | [OpenAI-like (`openai_like`)](https://docs.litellm.ai/docs/providers/openai_compatible) |  |  |  | ✅ |  |  |  |  |  |  |
 | [OpenRouter (`openrouter`)](https://docs.litellm.ai/docs/providers/openrouter) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [OVHCloud AI Endpoints (`ovhcloud`)](https://docs.litellm.ai/docs/providers/ovhcloud) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
-| [Parallel AI (`parallel_ai`)](https://docs.litellm.ai/docs/search/parallel_ai) |  |  |  |  |  |  |  |  |  |  |
 | [Perplexity AI (`perplexity`)](https://docs.litellm.ai/docs/providers/perplexity) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Petals (`petals`)](https://docs.litellm.ai/docs/providers/petals) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Pinstripes (`pinstripes`)](https://docs.litellm.ai/docs/providers/pinstripes) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
@@ -475,7 +426,6 @@ Set `LITELLM_PROXY_API_BASE` and `LITELLM_PROXY_API_KEY` and every model call th
 | [Watsonx Text (`watsonx_text`)](https://docs.litellm.ai/docs/providers/watsonx) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [xAI (`xai`)](https://docs.litellm.ai/docs/providers/xai) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 | [Xinference (`xinference`)](https://docs.litellm.ai/docs/providers/xinference) |  |  |  | ✅ |  |  |  |  |  |  |
-| [ZeroGPU (`zerogpu`)](https://docs.litellm.ai/docs/providers/zerogpu) | ✅ | ✅ | ✅ |  |  |  |  |  |  |  |
 
 [**Read the Docs**](https://docs.litellm.ai/docs/)
 
@@ -490,7 +440,7 @@ You can use LiteLLM through either the Proxy Server or Python SDK. Both give you
 <tr>
 <th style={{width: '14%'}}></th>
 <th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/simple_proxy">LiteLLM AI Gateway</a></strong></th>
-<th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/python_sdk">LiteLLM Python SDK</a></strong></th>
+<th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/">LiteLLM Python SDK</a></strong></th>
 </tr>
 </thead>
 <tbody>
@@ -526,7 +476,7 @@ Run the LiteLLM proxy as a production-ready componentized stack (gateway, backen
 
 ```bash
 git clone https://github.com/BerriAI/litellm.git
-cd litellm/litellm/deploy/terraform/litellm/aws/examples/default
+cd litellm/terraform/litellm/aws/examples/default
 cp terraform.tfvars.example terraform.tfvars   # edit region/tenant/env
 terraform init && terraform apply
 ```
@@ -579,7 +529,7 @@ Provider API keys live in AWS Secrets Manager; reference ARNs via `gateway_extra
 
 [![Open in Cloud Shell](https://gstatic.com/cloudssh/images/open-btn.png)](https://ssh.cloud.google.com/cloudshell/editor?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2FBerriAI%2Fterraform-google-litellm&cloudshell_git_branch=v1.105.0&cloudshell_workspace=examples%2Fdefault&cloudshell_tutorial=TUTORIAL.md&cloudshell_image=gcr.io/ds-artifacts-cloudshell/deploystack_custom_image&shellonly=true)
 
-Real 1-click. Opens Cloud Shell, clones the [terraform-google-litellm](https://github.com/BerriAI/terraform-google-litellm) module mirror at the latest stable release (a small download instead of the full litellm repo), and walks you through `terraform apply` via a built-in [DeployStack tutorial](./litellm/deploy/terraform/litellm/gcp/examples/default/TUTORIAL.md). Pick the project, the tutorial sets up the Artifact Registry remote repo, writes `terraform.tfvars` from your answers, and runs apply
+Real 1-click. Opens Cloud Shell, clones the [terraform-google-litellm](https://github.com/BerriAI/terraform-google-litellm) module mirror at the latest stable release (a small download instead of the full litellm repo), and walks you through `terraform apply` via a built-in [DeployStack tutorial](./terraform/litellm/gcp/examples/default/TUTORIAL.md). Pick the project, the tutorial sets up the Artifact Registry remote repo, writes `terraform.tfvars` from your answers, and runs apply
 
 [Module page →](https://registry.terraform.io/modules/BerriAI/litellm/google/latest)
 
@@ -646,21 +596,21 @@ Provider API keys live in Secret Manager; reference resource IDs (e.g. `projects
 - Versioned object store for proxy state + file uploads
 - An auto-generated `LITELLM_MASTER_KEY` in your cloud's secret manager
 - A one-off migration job that runs `prisma migrate deploy` before the proxy starts
-- The same `proxy_config` surface as the [Helm chart](./litellm/deploy/helm/litellm/) — pass YAML as a typed map
+- The same `proxy_config` surface as the [Helm chart](./helm/litellm/) — pass YAML as a typed map
 
-The Terraform modules live at [`litellm/deploy/terraform/litellm/aws/`](./litellm/deploy/terraform/litellm/aws/) and [`litellm/deploy/terraform/litellm/gcp/`](./litellm/deploy/terraform/litellm/gcp/) in this repo; the registry entries are read-only mirrors updated on each release.
+The Terraform modules live at [`terraform/litellm/aws/`](./terraform/litellm/aws/) and [`terraform/litellm/gcp/`](./terraform/litellm/gcp/) in this repo; the registry entries are read-only mirrors updated on each release.
 
 ### Run in Developer Mode
 #### Services
 1. Setup .env file in root
-2. Run dependent services `docker compose -f litellm/deploy/compose/docker-compose.yml up db prometheus`
+2. Run dependent services `docker-compose up db prometheus`
 
 #### Backend
 1. Run `make bootstrap`
 2. Start proxy backend: `uv run python litellm/proxy/proxy_cli.py`
 
 #### Frontend
-1. Navigate to `litellm/ui/litellm-dashboard` (dependencies were already installed w/ `make bootstrap`)
+1. Navigate to `ui/litellm-dashboard` (dependencies were already installed w/ `make bootstrap`)
 2. Start dashboard: `npm run dev`
 
 ### Verify Docker Image Signatures
@@ -698,7 +648,7 @@ For companies that need better security, user management and professional suppor
 [Talk to founders](https://enterprise.litellm.ai/demo)
 
 This covers:
-- ✅ **Features under the [LiteLLM Commercial License](https://docs.litellm.ai/docs/enterprise):**
+- ✅ **Features under the [LiteLLM Commercial License](https://docs.litellm.ai/docs/proxy/enterprise):**
 - ✅ **Feature Prioritization**
 - ✅ **Custom Integrations**
 - ✅ **Professional Support - Dedicated discord + slack**
@@ -709,8 +659,6 @@ This covers:
 
 We welcome contributions to LiteLLM! Whether you're fixing bugs, adding features, or improving documentation, we appreciate your help.
 
-If you want to work closely with our team, check out [LiteLLM OSS Champions](https://www.litellm.ai/champions), our program for trusted OSS contributors with their own Slack channel and a voice in the roadmap
-
 ## Quick Start for Contributors
 
 This requires uv to be installed.
@@ -725,7 +673,7 @@ make test-unit      # Run unit tests
 make format-check   # Check formatting only
 ```
 
-For detailed contributing guidelines, see [CONTRIBUTING.md](.github/CONTRIBUTING.md).
+For detailed contributing guidelines, see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 > **📖 Contributing to documentation?** The LiteLLM docs have moved to a separate repository: [BerriAI/litellm-docs](https://github.com/BerriAI/litellm-docs). Please open doc PRs there. Docs are served at [docs.litellm.ai](https://docs.litellm.ai).
 

backend/Dockerfile

@@ -0,0 +1,115 @@
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:360896efb0753a5701c48f860e17130c205eae5a264797aa3e7ea126ee2923a7
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:360896efb0753a5701c48f860e17130c205eae5a264797aa3e7ea126ee2923a7
+ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
+
+FROM $UV_IMAGE AS uvbin
+
+# ---------- Builder ----------
+FROM $LITELLM_BUILD_IMAGE AS builder
+
+WORKDIR /app
+USER root
+
+COPY --from=uvbin /uv /uvx /usr/local/bin/
+
+# nodejs/npm so `prisma generate` uses Wolfi's Node via PRISMA_USE_GLOBAL_NODE
+# instead of nodeenv downloading one whose dynamic deps may not be in Wolfi
+# (e.g. Node 26.2.0 needs libatomic). Retry for transient apk.cgr.dev flakes.
+RUN for i in 1 2 3; do \
+      apk add --no-cache bash gcc python-3.13 python-3.13-dev openssl libssl3 openssl-dev libsndfile nodejs npm && break; \
+      [ $i = 3 ] && { echo "apk add failed after 3 retries" >&2; exit 1; }; \
+      sleep 5; \
+    done
+
+# UV_COMPILE_BYTECODE=1   precompiles .pyc at install time → faster cold start.
+# UV_LINK_MODE=copy       avoids hardlink warnings when uv installs from a
+#                         BuildKit cache mount (different filesystem).
+# UV_PYTHON_DOWNLOADS=0   force uv to use the apk-installed CPython instead of
+#                         silently pulling a managed interpreter.
+# PRISMA_USE_GLOBAL_NODE  explicit (matches default) so an env override can't
+#                         silently re-enable nodeenv's Node download.
+ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
+    UV_LINK_MODE=copy \
+    UV_COMPILE_BYTECODE=1 \
+    UV_PYTHON_DOWNLOADS=0 \
+    PRISMA_USE_GLOBAL_NODE=true \
+    PATH="/app/.venv/bin:${PATH}"
+
+# Stage 1 — install dependencies only.
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    --mount=type=bind,source=enterprise/pyproject.toml,target=enterprise/pyproject.toml \
+    --mount=type=bind,source=litellm-proxy-extras/pyproject.toml,target=litellm-proxy-extras/pyproject.toml \
+    uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
+        --extra proxy \
+        --extra proxy-runtime \
+        --group admin-mcp \
+        --extra extra_proxy \
+        --extra semantic-router \
+        --extra saml \
+        --python python3.13
+
+# Stage 2 — copy source and install the project + workspace members.
+COPY . .
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-default-groups --no-editable \
+        --extra proxy \
+        --extra proxy-runtime \
+        --group admin-mcp \
+        --extra extra_proxy \
+        --extra semantic-router \
+        --extra saml \
+        --python python3.13
+
+RUN cp "$(python -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')"/litellm/rust_bridge/_native*.so litellm/rust_bridge/
+
+RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
+    npm_config_cache=/root/.npm \
+    prisma generate --schema=./schema.prisma
+
+RUN sed -i 's/\r$//' docker/component_entrypoint.sh && chmod +x docker/component_entrypoint.sh
+
+# ---------- Runtime ----------
+FROM $LITELLM_RUNTIME_IMAGE AS runtime
+ARG LITELLM_RELEASE_TAG=""
+ENV LITELLM_RELEASE_TAG=${LITELLM_RELEASE_TAG}
+
+USER root
+
+RUN for i in 1 2 3; do \
+      apk add --no-cache bash openssl libssl3 tzdata python-3.13 libsndfile libatomic && break; \
+      [ $i = 3 ] && { echo "apk add failed after 3 retries" >&2; exit 1; }; \
+      sleep 5; \
+    done
+
+# wolfi-base ships an unprivileged `nonroot` account (UID/GID 65532) with
+# /home/nonroot. We run the backend as that user
+WORKDIR /app
+ENV HOME=/home/nonroot \
+    PATH="/app/.venv/bin:${PATH}" \
+    PYTHONPATH="/app" \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries
+
+COPY --from=builder --chown=nonroot:nonroot /app/.venv /app/.venv
+COPY --from=builder --chown=nonroot:nonroot /app/litellm /app/litellm
+COPY --from=builder --chown=nonroot:nonroot /app/enterprise /app/enterprise
+COPY --from=builder --chown=nonroot:nonroot /app/backend /app/backend
+COPY --from=builder --chown=nonroot:nonroot /app/docker/component_entrypoint.sh /app/docker/component_entrypoint.sh
+COPY --from=builder --chown=nonroot:nonroot /app/schema.prisma /app/schema.prisma
+COPY --from=builder /opt/prisma /opt/prisma
+
+RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
+    find /app/.venv -type d -path "*/tornado/test" -delete && \
+    chmod -R a+rX /opt/prisma && \
+    python -c "from prisma.client import BINARY_PATHS; paths = list(BINARY_PATHS.query_engine.values()); assert paths and all(p.startswith('/opt/prisma/') for p in paths), paths"
+
+USER nonroot
+
+EXPOSE 4001/tcp
+
+ENTRYPOINT ["/app/docker/component_entrypoint.sh", "uvicorn", "backend.main:app"]
+CMD ["--host", "0.0.0.0", "--port", "4001"]

backend/main.py

@@ -0,0 +1,62 @@
+"""UI backend entrypoint.
+
+Reuses the existing FastAPI app from `litellm.proxy.proxy_server` and trims its
+route table to just the management/admin surface used by the dashboard. Purely
+additive — no existing module is modified.
+
+Run with:
+    uvicorn backend.main:app --host 0.0.0.0 --port 4001
+"""
+
+from collections.abc import AsyncGenerator, Mapping
+from contextlib import asynccontextmanager
+from typing import Final
+
+from starlette.applications import Starlette
+from starlette.routing import Mount
+from starlette.types import Lifespan
+
+# See gateway/main.py for why we assemble DATABASE_URL(s) here before
+# importing proxy_server.
+from litellm.proxy.db.db_url_settings import DatabaseURLSettings
+
+DatabaseURLSettings.from_env().apply_to_env()
+
+from litellm.proxy.proxy_server import app
+
+from backend.routes.allowlist import (
+    BACKEND_EXACT_PATHS,
+    BACKEND_MOUNT_PATHS,
+    BACKEND_PATH_PREFIXES,
+)
+
+
+def _is_backend_route(route) -> bool:
+    """Keep the route on the backend if its path is in the management surface."""
+    path = getattr(route, "path", None)
+    if path is None:
+        return False
+    if isinstance(route, Mount):
+        # The dashboard UI static mounts are served by the dedicated UI container.
+        # Only Mounts in the backend allowlist (e.g. swagger docs) remain on backend.
+        return path in BACKEND_MOUNT_PATHS
+    if path in BACKEND_EXACT_PATHS:
+        return True
+    return any(path.startswith(prefix) for prefix in BACKEND_PATH_PREFIXES)
+
+
+# See gateway/main.py for why the trim runs inside the lifespan instead of at
+# module scope.
+_proxy_lifespan: Final = app.router.lifespan_context
+
+
+@asynccontextmanager
+async def _backend_lifespan(
+    app_: Starlette, lifespan: Lifespan[Starlette] = _proxy_lifespan
+) -> AsyncGenerator[Mapping[str, object], None]:
+    async with lifespan(app_) as state:
+        app_.router.routes = [r for r in app_.router.routes if _is_backend_route(r)]
+        yield state if state is not None else {}
+
+
+app.router.lifespan_context = _backend_lifespan

backend/routes/allowlist.py

@@ -0,0 +1,171 @@
+"""Path allowlist for the UI backend (control plane) component.
+
+The backend exposes management/admin endpoints consumed by the UI: keys, users,
+teams, orgs, customers, budgets, tags, workflows, model management, spend &
+analytics, settings (router/cache/cost-tracking/fallbacks), SSO/onboarding,
+audit logs, debug, enterprise admin, and UI bootstrap helpers (logo, favicon,
+.well-known config).
+
+Anything LLM data-plane is dropped — those run on the gateway component.
+"""
+
+BACKEND_PATH_PREFIXES: tuple[str, ...] = (
+    # Identity / access
+    "/key/",
+    "/v2/key/",
+    "/user/",
+    "/v2/user/",
+    "/team/",
+    "/v2/team/",
+    "/organization/",
+    "/v2/organization/",
+    "/customer/",
+    "/end_user/",
+    "/sso/",
+    "/liteadmin/slack/connect/",
+    "/moyai/connect/",
+    "/login",
+    "/v2/login",
+    "/v3/login",
+    "/logout",
+    "/session/logout",
+    "/token",
+    "/onboarding/",
+    "/audit",
+    "/telemetry/",
+    "/oauth/",
+    "/invitation/",
+    "/jwt/",
+    # Models & routing config
+    "/model/",
+    "/v1/model/info",
+    "/v1/model/deprecations",
+    "/v2/model/",
+    "/model_group",
+    "/model_access_group/",
+    "/model_hub/",
+    "/v1/access_group",
+    "/access_group/",
+    "/router/",
+    "/router_settings",
+    "/adaptive_router/",
+    "/auto_router/",
+    "/fallback",
+    "/fallbacks",
+    "/cache_settings",
+    "/coordination_redis/",
+    "/cost_tracking",
+    "/cost_optimization/",
+    "/cost/",
+    "/credentials",
+    "/credential",
+    "/provider/budgets",
+    # Tools / agents (registry & policy admin)
+    "/v1/tool/",
+    "/v1/agents",
+    "/agent/daily/activity/",
+    # Guardrails admin
+    "/v2/guardrails/",
+    # MCP server admin + BYOK OAuth flow (UI-initiated) + dynamic per-server endpoints
+    "/v1/mcp/",
+    "/test/",
+    "/{mcp_server_name}/",
+    # Budgets / tags / workflows / memory mgmt
+    "/budget/",
+    "/tag/",
+    "/workflow/",
+    "/v1/workflows/",
+    "/project/",
+    "/memory/",
+    "/mcp/",
+    # Control plane (see the List Endpoints + Tables standard). Every resource
+    # eventually moves under this prefix, so allowlist it once rather than
+    # per-resource.
+    "/management/v1/",
+    # Spend / analytics
+    "/spend/",
+    "/analytics/",
+    "/lens/",
+    "/v1/traces",
+    "/v1/logs",
+    "/global/",
+    "/user_agent",
+    "/usage/",
+    "/daily/",
+    # Deployment-wide gateway request and error counts. Scoped to the analytics reads rather
+    # than all of /gateway/, which stays free for data-plane routes.
+    "/gateway/daily/",
+    "/gateway/errors/",
+    # CloudZero cost-export admin (init / settings / export / dry-run / delete)
+    "/cloudzero/",
+    # Caching admin
+    "/cache/",
+    "/caching/",
+    # Callbacks / hooks
+    "/active/callbacks",
+    "/callbacks",
+    "/team_callback",
+    # Rust data-plane gateway → proxy control-plane API (logging today, auth later)
+    "/v1/rust_control_plane/",
+    # Alerting / email / IP allowlist
+    "/alerting/",
+    "/email/",
+    "/add/allowed_ip",
+    "/delete/allowed_ip",
+    "/get/",
+    # Enterprise admin
+    "/enterprise/",
+    # Debug / config / profiling
+    "/debug/",
+    "/config/",
+    "/memory-usage-in-mem-cache",
+    "/otel-spans",
+    "/lazy/",
+    "/in_product_nudges",
+    # Admin reload / schedule
+    "/reload/",
+    "/schedule/",
+    "/settings",
+    "/update/",
+    "/upload/",
+    # Dev / admin utilities
+    "/utils/",
+    # UI bootstrap helpers (assets the dashboard fetches)
+    "/get_logo_url",
+    "/get_image",
+    "/get_favicon",
+    "/.well-known/",
+    "/litellm/.well-known/",
+    "/ui_discovery/",
+    "/ui-config",
+    "/sso_settings",
+    "/public/",
+    "/robots.txt",
+    # Health (k8s probes)
+    "/health",
+    # Plugin system
+    "/api/plugins",
+    "/plugin-proxy/",
+)
+
+BACKEND_EXACT_PATHS: frozenset[str] = frozenset(
+    {
+        "/",
+        "/routes",
+        "/lens",
+        "/openapi.json",
+        "/docs",
+        "/docs/oauth2-redirect",
+        "/redoc",
+        "/fallback/login",
+        "/mcp",  # bare spelling of the aggregate MCP endpoint; /mcp/ prefix covers the rest
+    }
+)
+
+BACKEND_MOUNT_PATHS: frozenset[str] = frozenset(
+    {
+        "/admin",
+        "/swagger",  # API documentation static assets belong to the backend
+        "/mcp",  # lazily-mounted MCP sub-app serves on the backend component
+    }
+)

ci_cd/TEST_KEY_PATTERNS.md

@@ -33,7 +33,7 @@ token = "test-api-key-with-high-entropy"
 
 ## Configured Ignore Patterns
 
-These patterns are in `.github/gitguardian.yaml` for high-entropy test keys:
+These patterns are in `.gitguardian.yaml` for high-entropy test keys:
 - `sk-test-*` - OpenAI-style test keys
 - `sk-mock-*` - Mock API keys  
 - `sk-fake-*` - Fake API keys

ci_cd/baseline_db.py

@@ -0,0 +1,60 @@
+import subprocess
+from pathlib import Path
+from datetime import datetime
+
+
+def create_baseline():
+    """Create baseline migration in deploy/migrations"""
+    try:
+        # Get paths
+        root_dir = Path(__file__).parent.parent
+        deploy_dir = root_dir / "deploy"
+        migrations_dir = deploy_dir / "migrations"
+        schema_path = root_dir / "schema.prisma"
+
+        # Create migrations directory
+        migrations_dir.mkdir(parents=True, exist_ok=True)
+
+        # Create migration_lock.toml if it doesn't exist
+        lock_file = migrations_dir / "migration_lock.toml"
+        if not lock_file.exists():
+            lock_file.write_text('provider = "postgresql"\n')
+
+        # Create timestamp-based migration directory
+        timestamp = datetime.now().strftime("%Y%m%d%H%M%S")
+        migration_dir = migrations_dir / f"{timestamp}_baseline"
+        migration_dir.mkdir(parents=True, exist_ok=True)
+
+        # Generate migration SQL
+        result = subprocess.run(
+            [
+                "prisma",
+                "migrate",
+                "diff",
+                "--from-empty",
+                "--to-schema-datamodel",
+                str(schema_path),
+                "--script",
+            ],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+
+        # Write the SQL to migration.sql
+        migration_file = migration_dir / "migration.sql"
+        migration_file.write_text(result.stdout)
+
+        print(f"Created baseline migration in {migration_dir}")
+        return True
+
+    except subprocess.CalledProcessError as e:
+        print(f"Error running prisma command: {e.stderr}")
+        return False
+    except Exception as e:
+        print(f"Error creating baseline migration: {str(e)}")
+        return False
+
+
+if __name__ == "__main__":
+    create_baseline()