tPj 4dZddlmZddlZddlZddlmZejdZejdejd d d d d ejdd d dejdejd e de fdZy)z=CLI commands for the at-rest credential encryption migration.)FinalN) HTTPClientcy)zEMigrate at-rest credentials to AES-256-GCM and attest residual state.Nrq/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/client/cli/commands/encryption.py encryptionr srmigrate)namez--check check_onlyTFzERead-only residual scan (no writes). Reports legacy values remaining.)is_flagdefaulthelpz --dry-runz;Run the full migration walkers without writing any changes.ctxdry_runct|jd|jd}|r|jdd}n|jddi|rddind }tj| t |t r|jd ini}|jd }||dkDrtjd|dy |dk(rtjdy y )aRe-encrypt at-rest credentials into the AES-256-GCM (v2:gcm:) format. Requires the proxy to be started with ``general_settings.encryption_algorithm: aes-256-gcm``. Idempotent and resumable; safe to re-run after an interruption. Examples: litellm-proxy encryption migrate --check # attestation scan, no writes litellm-proxy encryption migrate # perform the migration base_urlapi_keyGETz%/credentials/migrate-encryption/checkPOSTz/credentials/migrate-encryptionrtrueN)jsonparams)datareportresidual_legacyrz*[yellow]Residual legacy values remaining: z [/yellow]zA[green]No legacy values remaining (residual_legacy == 0).[/green]) robjrequestrich print_json isinstancedictgetprint)rr rclientresponserresiduals r r r s4swwz2CGGI4FGF>>%)PQ>>  -*1Iv&t "  OO"2r3sC % PP #     P    F  XXDX4X $Xr