chore(typing): add boto3/botocore stubs so basedpyright resolves the AWS SDK

[mateo-berri]

Relevant issues

Follow-up to the basedpyright-coverage work (the monster-function refactors in #30793, #30802, #30813). Those made basedpyright able to analyze the hottest functions; this one gives it real types for the AWS SDK surface those functions sit on.

Linear ticket

N/A

Pre-Submission checklist

• I have added meaningful tests: this PR changes no runtime code, only the dev dependency set and the basedpyright budget. The "test" is the type-check gate itself, measured before/after in the CI-equivalent frozen env below
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible; it only adds two dev-only stub packages and reconciles the per-rule basedpyright budget for exactly the rules they move
• I have requested a Greptile review and received a Confidence Score of at least 4/5

What and why

litellm's whole AWS surface (bedrock, sagemaker, the STS/KMS/S3 helpers in base_aws_llm.py, common_utils.py, the secret managers) is built on boto3/botocore, but boto3 lives in the proxy optional extra, not core or dev. So in CI's type-check env (uv sync --frozen, default-groups = ["dev"], no extras) boto3 is never installed; import boto3 is a suppressed reportMissingImports (pyrightconfig sets reportMissingImports: false) and every boto3 return value is Unknown. basedpyright has no types for any of it.

This adds botocore-stubs and types-boto3 (scoped to the services litellm actually constructs: bedrock, bedrock-agent, bedrock-runtime, kms, s3, sagemaker-runtime, sts) to the dev group, right next to the existing types-requests/types-redis/types-PyYAML stubs. They are stub-only (no botocore runtime pulled in), so the prod/Docker install is untouched; they only affect the type-check and local dev envs.

Net effect across the repo is 502 fewer basedpyright errors. boto3 return values stop being Unknown (reportUnknownVariableType -331, reportUnknownMemberType -285, reportUnknownParameterType -24, reportUnknownLambdaType -1, about 641 resolved), and in exchange the now-typed call sites surface about 139 genuine type-precision issues that were previously invisible behind Unknown (reportArgumentType +71, reportAny +35, reportAttributeAccessIssue +11, reportCallIssue +10, reportReturnType +8, a few reportUnnecessary*). Those are real and worth tracking: e.g. base_aws_llm.py returns assume_role(...)'s precise AssumeRoleResponseTypeDef from functions annotated -> dict, a couple of credential helpers return Credentials | None where the annotation promises Credentials, and boto3.session.Config should be botocore.config.Config (it carried a now-disabled # type: ignore). They cannot be fixed inside this PR without importing names that exist only in the dev-only stub packages and are absent in prod, so they are reconciled into the budget as honest, now-visible debt rather than papered over.

The budget change is surgical: only the 11 rules the stubs actually move, each set to its committed baseline plus the measured stub delta, slack untouched. Four ratchet down (the resolved Unknown*), seven ratchet up (the now-visible issues). No other rule is touched, so no unrelated drift is absorbed.

Screenshots / Proof of Fix

This PR has no runtime effect (the stubs are dev-only and are not installed in prod), so there is nothing to curl; the proof is the basedpyright delta, measured in an env that reproduces CI exactly. basedpyright resolves its interpreter from the env passed via --pythonpath, so a throwaway frozen env gives CI-accurate numbers without disturbing the local dev .venv.

Before (no stubs, equals litellm_internal_staging today):

UV_PROJECT_ENVIRONMENT=/tmp/ci_venv uv sync --frozen
uv run --no-sync basedpyright --pythonpath /tmp/ci_venv/bin/python --outputjson \
  | uv run --no-sync python scripts/type_check_gate.py
# total in-repo errors: 150287

After (this PR's dev group):

UV_PROJECT_ENVIRONMENT=/tmp/ci_venv_after uv sync --frozen
uv run --no-sync basedpyright --pythonpath /tmp/ci_venv_after/bin/python --outputjson \
  | uv run --no-sync python scripts/type_check_gate.py
# OK: every rule is within its basedpyright ceiling (149785 errors total)

Per-rule delta (drift-free, same machine, stubs the only difference):

rule                          before   after  delta
reportUnknownVariableType      21868   21537   -331
reportUnknownMemberType        27451   27166   -285
reportUnknownParameterType     13682   13658    -24
reportArgumentType              1877    1948    +71
reportAny                      25057   25092    +35
reportAttributeAccessIssue       317     328    +11
reportCallIssue                   77      87    +10
reportReturnType                 122     130     +8
TOTAL                         150287  149785   -502

git diff --stat basedpyright-code-budget.json is 11 baseline lines, slack unchanged.

Type

🚄 Infrastructure

Changes

Adds botocore-stubs==1.43.14 and types-boto3[bedrock,bedrock-agent,bedrock-runtime,kms,s3,sagemaker-runtime,sts]==1.43.30 to the dev dependency group (stub-only, no prod impact), regenerates uv.lock, and reconciles basedpyright-code-budget.json for the 11 rules the stubs move: four reportUnknown* baselines ratchet down as boto3 types resolve, seven ratchet up for the type-precision issues the stubs make visible. No runtime code changes.

[greptile-apps]

Greptile Summary

Adds botocore-stubs==1.43.14 and types-boto3[bedrock,bedrock-agent,bedrock-runtime,kms,s3,sagemaker-runtime,sts]==1.43.30 to the dev dependency group, regenerates uv.lock, and reconciles basedpyright-code-budget.json for the 11 rules the stubs move. No runtime code changes; prod/Docker install is unaffected.

• Dev deps only: 11 stub packages are added to uv.lock (all *-stubs or types-*); none are installed in the prod or Docker image.
• Budget arithmetic checks out: all 8 reported deltas in the PR description match the diff exactly (e.g. reportUnknownVariableType −331, reportArgumentType +71); the two undisclosed reportUnnecessary* bumps (+3, +1) are covered by the "a few reportUnnecessary*" note in the description.
• Slack values are untouched: only baselines shift, ceilings widen proportionally; no unrelated drift is absorbed.

Confidence Score: 5/5

Safe to merge — changes are confined to dev tooling and have no effect on the installed package or Docker image.

The change is purely additive stub packages in the dev group and a budget reconciliation whose per-rule deltas match the PR description exactly. No runtime code is touched, no prod dependency tree changes, and all 11 new lock entries are stub-only packages sourced from PyPI with pinned hashes.

No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Adds botocore-stubs and types-boto3 to the dev dependency group alongside existing types-* packages; no prod extras touched.
basedpyright-code-budget.json	Adjusts 11 rule baselines consistent with the measured stub delta; slack values are unchanged; arithmetic matches the PR description's per-rule table.
uv.lock	Adds 11 new stub-only packages (botocore-stubs, types-awscrt, types-boto3 + 7 service sub-packages, types-s3transfer); all sourced from PyPI with pinned hashes; no runtime packages introduced.

_{Reviews (1): Last reviewed commit: "chore(typing): add boto3/botocore stubs ..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!