fix(model,credential): resolve inconsistent state after apply for numeric params, vanished keys, mode, and credential read-back

- Normalize scientific notation strings in additional_litellm_params to
  canonical decimal form on both plan and read-back (e.g. '1.75e-07' →
  '0.000000175') to prevent inconsistent result errors
- Preserve known params (input_cost_per_token, output_cost_per_token) in
  additional_litellm_params when user explicitly configured them, fixing
  'element has vanished' errors
- Guard mode read-back with null check so API-inferred values (e.g.
  'video_generation') don't overwrite unconfigured null state; mark mode
  as Optional+Computed for import support
- Add retry with exponential backoff for credential read-back after
  creation to handle eventual-consistency 404 errors

Author: Nicholas Cecere

CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.6] - 2026-02-16
+
+### Fixed
+- **`litellm_model`**: Fixed "Provider produced inconsistent result after apply" for `additional_litellm_params` values containing small decimals — the API returns numeric strings in scientific notation (e.g. `"1.75e-07"`) which didn't match the user's decimal notation (e.g. `"0.000000175"`). Both plan and read-back values are now normalized to canonical decimal form.
+- **`litellm_model`**: Fixed "element has vanished" error when `input_cost_per_token` or `output_cost_per_token` are set via `additional_litellm_params` — these keys were incorrectly filtered out on read-back because they appeared in the known-params exclusion list. The filter now respects user-configured keys.
+- **`litellm_model`**: Fixed "was null, but now `video_generation`" error for the `mode` attribute — when the user didn't set `mode`, the API-inferred value (e.g. `"video_generation"` for sora-2) was written into state, conflicting with the null plan. Mode is now only populated from the API when the user configured it or it was previously set.
+- **`litellm_credential`**: Fixed "Credential not found" warning on create — the read-back immediately after creation could fail with 404 due to eventual consistency. Added retry logic with exponential backoff (matching the existing model resource pattern).
+
+### Changed
+- **`litellm_model`**: The `mode` attribute is now `Optional + Computed` (was `Optional` only), allowing the API to populate it during import.
+
 ## [1.0.5] - 2026-02-13
 
 ### Fixed

internal/provider/resource_credential.go

@@ -3,6 +3,7 @@ package provider
 import (
 	"context"
 	"fmt"
+	"time"
 
 	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/path"
@@ -109,8 +110,9 @@ func (r *CredentialResource) Create(ctx context.Context, req resource.CreateRequ
 	// Set the ID to credential name
 	data.ID = data.CredentialName
 
-	// Read back for full state (note: credential_values won't be returned for security)
-	if err := r.readCredential(ctx, &data); err != nil {
+	// Read back for full state with retry (note: credential_values won't be returned for security).
+	// The retry handles eventual-consistency delays after creating a credential.
+	if err := r.readCredentialWithRetry(ctx, &data, 5); err != nil {
 		resp.Diagnostics.AddWarning("Read Error", fmt.Sprintf("Credential created but failed to read back: %s", err))
 	}
 
@@ -271,3 +273,32 @@ func (r *CredentialResource) readCredential(ctx context.Context, data *Credentia
 
 	return nil
 }
+
+// readCredentialWithRetry retries the read operation with exponential backoff.
+// This handles eventual-consistency delays after creating a credential.
+func (r *CredentialResource) readCredentialWithRetry(ctx context.Context, data *CredentialResourceModel, maxRetries int) error {
+	var err error
+	delay := 1 * time.Second
+	maxDelay := 10 * time.Second
+
+	for i := 0; i < maxRetries; i++ {
+		err = r.readCredential(ctx, data)
+		if err == nil {
+			return nil
+		}
+
+		if !IsNotFoundError(err) {
+			return err
+		}
+
+		if i < maxRetries-1 {
+			time.Sleep(delay)
+			delay *= 2
+			if delay > maxDelay {
+				delay = maxDelay
+			}
+		}
+	}
+
+	return err
+}

internal/provider/resource_model.go

@@ -152,6 +152,10 @@ func (r *ModelResource) Schema(ctx context.Context, req resource.SchemaRequest,
 			"mode": schema.StringAttribute{
 				Description: "Model mode. Supported values: chat, completion, embedding, audio_speech, audio_transcription, image_generation, video_generation, batch, rerank, realtime, responses, ocr, moderation.",
 				Optional:    true,
+				Computed:    true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
 			},
 			"litellm_credential_name": schema.StringAttribute{
 				Description: "Name of the credential to use for this model. References a credential created via litellm_credential resource.",
@@ -260,6 +264,10 @@ func (r *ModelResource) Create(ctx context.Context, req resource.CreateRequest,
 		return
 	}
 
+	// Normalise numeric strings in additional_litellm_params so that the
+	// planned value uses the same canonical form as the read-back value.
+	data.AdditionalLiteLLMParams = normalizeAdditionalParams(ctx, data.AdditionalLiteLLMParams)
+
 	modelID := uuid.New().String()
 
 	if err := r.createOrUpdateModel(ctx, &data, modelID, false); err != nil {
@@ -306,6 +314,10 @@ func (r *ModelResource) Update(ctx context.Context, req resource.UpdateRequest,
 		return
 	}
 
+	// Normalise numeric strings in additional_litellm_params so that the
+	// planned value uses the same canonical form as the read-back value.
+	data.AdditionalLiteLLMParams = normalizeAdditionalParams(ctx, data.AdditionalLiteLLMParams)
+
 	var state ModelResourceModel
 	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
 	if resp.Diagnostics.HasError() {
@@ -556,30 +568,30 @@ func (r *ModelResource) readModel(ctx context.Context, data *ModelResourceModel)
 
 		// Handle additional_litellm_params map - preserve state when API omits custom params.
 		knownLiteLLMParams := map[string]struct{}{
-			"custom_llm_provider":                {},
-			"model":                              {},
-			"input_cost_per_token":               {},
-			"output_cost_per_token":              {},
-			"tpm":                                {},
-			"rpm":                                {},
-			"api_key":                            {},
-			"api_base":                           {},
-			"api_version":                        {},
-			"reasoning_effort":                   {},
-			"thinking":                           {},
-			"aws_access_key_id":                  {},
-			"aws_secret_access_key":              {},
-			"aws_region_name":                    {},
-			"aws_session_name":                   {},
-			"aws_role_name":                      {},
-			"vertex_project":                     {},
-			"vertex_location":                    {},
-			"vertex_credentials":                 {},
-			"litellm_credential_name":            {},
-			"input_cost_per_pixel":               {},
-			"output_cost_per_pixel":              {},
-			"input_cost_per_second":              {},
-			"output_cost_per_second":             {},
+			"custom_llm_provider":     {},
+			"model":                   {},
+			"input_cost_per_token":    {},
+			"output_cost_per_token":   {},
+			"tpm":                     {},
+			"rpm":                     {},
+			"api_key":                 {},
+			"api_base":                {},
+			"api_version":             {},
+			"reasoning_effort":        {},
+			"thinking":                {},
+			"aws_access_key_id":       {},
+			"aws_secret_access_key":   {},
+			"aws_region_name":         {},
+			"aws_session_name":        {},
+			"aws_role_name":           {},
+			"vertex_project":          {},
+			"vertex_location":         {},
+			"vertex_credentials":      {},
+			"litellm_credential_name": {},
+			"input_cost_per_pixel":    {},
+			"output_cost_per_pixel":   {},
+			"input_cost_per_second":   {},
+			"output_cost_per_second":  {},
 		}
 
 		// Build a set of keys the user configured in additional_litellm_params.
@@ -598,8 +610,14 @@ func (r *ModelResource) readModel(ctx context.Context, data *ModelResourceModel)
 
 		additionalParams := make(map[string]attr.Value)
 		for key, rawValue := range litellmParams {
+			// Skip "known" params (handled by top-level attributes) UNLESS the
+			// user explicitly placed them in additional_litellm_params.  Without
+			// this exception, keys like input_cost_per_token would be silently
+			// dropped on read-back, causing "element has vanished" errors.
 			if _, isKnown := knownLiteLLMParams[key]; isKnown {
-				continue
+				if _, inState := stateKeys[key]; !inState {
+					continue
+				}
 			}
 			// Only filter by state keys during normal Read (not Import).
 			// This prevents API-added defaults from causing drift.
@@ -611,7 +629,13 @@ func (r *ModelResource) readModel(ctx context.Context, data *ModelResourceModel)
 
 			switch v := rawValue.(type) {
 			case string:
-				additionalParams[key] = types.StringValue(v)
+				// Normalize numeric strings to decimal notation so that
+				// "1.75e-07" (from API) matches "0.000000175" (from config).
+				if f, err := strconv.ParseFloat(v, 64); err == nil {
+					additionalParams[key] = types.StringValue(strconv.FormatFloat(f, 'f', -1, 64))
+				} else {
+					additionalParams[key] = types.StringValue(v)
+				}
 			case bool:
 				additionalParams[key] = types.StringValue(strconv.FormatBool(v))
 			case float64:
@@ -644,7 +668,14 @@ func (r *ModelResource) readModel(ctx context.Context, data *ModelResourceModel)
 			data.Tier = types.StringValue(tier)
 		}
 		if mode, ok := modelInfo["mode"].(string); ok && mode != "" {
-			data.Mode = types.StringValue(mode)
+			// Only update mode from the API when the user configured it or it
+			// was previously set (not null).  This prevents an API-inferred
+			// mode (e.g. "video_generation") from appearing when the user
+			// didn't set it, which would cause "was null, but now ..." errors.
+			// During Import, mode will be Unknown, so we always populate it.
+			if !data.Mode.IsNull() {
+				data.Mode = types.StringValue(mode)
+			}
 		}
 		if teamID, ok := modelInfo["team_id"].(string); ok && teamID != "" {
 			data.TeamID = types.StringValue(teamID)
@@ -855,6 +886,37 @@ func (r *ModelResource) patchModel(ctx context.Context, data *ModelResourceModel
 	return r.client.DoRequestWithResponse(ctx, "PATCH", endpoint, patchReq, nil)
 }
 
+// normalizeNumericString normalises a string that represents a number into a
+// canonical decimal form.  This ensures that "2.5e-06" and "0.0000025" both
+// become "0.0000025", preventing Terraform from seeing a diff between the
+// planned value and the value read back from the API.
+func normalizeNumericString(s string) string {
+	// Try integer first – "500" stays "500".
+	if _, err := strconv.ParseInt(s, 10, 64); err == nil {
+		return s // already canonical
+	}
+	if f, err := strconv.ParseFloat(s, 64); err == nil {
+		return strconv.FormatFloat(f, 'f', -1, 64)
+	}
+	return s
+}
+
+// normalizeAdditionalParams returns a new MapValue where every numeric string
+// has been normalised to decimal notation.
+func normalizeAdditionalParams(ctx context.Context, m types.Map) types.Map {
+	if m.IsNull() || m.IsUnknown() {
+		return m
+	}
+	elements := make(map[string]string)
+	m.ElementsAs(ctx, &elements, false)
+	normalised := make(map[string]attr.Value, len(elements))
+	for k, v := range elements {
+		normalised[k] = types.StringValue(normalizeNumericString(v))
+	}
+	result, _ := types.MapValue(types.StringType, normalised)
+	return result
+}
+
 // convertStringValue converts a string to its most appropriate Go type.
 // This allows additional_litellm_params values (which are stored as strings in
 // Terraform state) to be sent as native JSON types in the API request.