From 530211c5589bb1d29d1e0ed9147ba4bda49a753a Mon Sep 17 00:00:00 2001
From: Ishaan Jaff <ishaanjaffer0324@gmail.com>
Date: Wed, 6 May 2026 15:25:41 -0700
Subject: [PATCH] feat: add LiteLLM_AgentVMConfig table for BYOC AWS settings
 (root schema)

Per-team BYOC AWS config consumed by the agent-session EC2 VM provider.
`aws_creds_enc` is a JSON blob with each field individually encrypted via
`encrypt_value_helper` so a partial DB leak doesn't expose the secret.
Owned by Epic G's Settings UI (LIT-2891); consumed by Epic B's EC2 provider.

LIT-2878
---
 schema.prisma | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/schema.prisma b/schema.prisma
index 84ce99557e3..511e38d767b 100644
--- a/schema.prisma
+++ b/schema.prisma
@@ -80,6 +80,29 @@ model LiteLLM_AgentsTable {
   updated_by String
 }
 
+// BYOC AWS config for the agent-session VM provider.
+// One row per team. `aws_creds_enc` is a JSON blob with each field
+// individually encrypted via `encrypt_value_helper` (see
+// litellm/proxy/agent_session_endpoints/vm_providers/team_config.py).
+// Owned by Epic G's Settings UI; consumed by Epic B's EC2 provider.
+model LiteLLM_AgentVMConfig {
+  team_id              String   @id
+  aws_creds_enc        String?
+  region               String?
+  subnet_id            String?
+  security_group_id    String?
+  iam_instance_profile String?
+  ami_id               String?
+  instance_type        String?
+  use_spot             Boolean  @default(true)
+  warm_pool_size       Int      @default(0)
+  network_access       Json?
+  created_at           DateTime @default(now()) @map("created_at")
+  created_by           String
+  updated_at           DateTime @default(now()) @updatedAt @map("updated_at")
+  updated_by           String
+}
+
 model LiteLLM_OrganizationTable {
 		organization_id String @id @default(uuid())
     organization_alias  String