@harborclient/team-hub 0.2.1 → 0.2.2

package/dist/cli.js

@@ -42,6 +42,40 @@ function normalizeLlmConfig(section) {
   };
 }
 
+// src/config/loggingConfig.ts
+var DEFAULT_LOGGING_CONFIG = {
+  level: "info",
+  file: null,
+  console: true
+};
+function normalizeLoggingConfig(section) {
+  return {
+    level: section?.level ?? DEFAULT_LOGGING_CONFIG.level,
+    file: section?.file ?? DEFAULT_LOGGING_CONFIG.file,
+    console: section?.console ?? DEFAULT_LOGGING_CONFIG.console
+  };
+}
+
+// src/config/pluginsConfig.ts
+function dedupeUrls(urls) {
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const url of urls) {
+    if (seen.has(url)) {
+      continue;
+    }
+    seen.add(url);
+    deduped.push(url);
+  }
+  return deduped;
+}
+function normalizePluginsConfig(section) {
+  return {
+    catalogs: dedupeUrls(section.catalogs ?? []),
+    trusted: dedupeUrls(section.trusted ?? [])
+  };
+}
+
 // src/config/serverConfig.schema.ts
 import { z } from "zod/v4";
 var portSchema = z.union([
@@ -93,11 +127,23 @@ var llmSectionSchema = z.object({
   ),
   models: z.array(z.string().trim().min(1)).optional()
 });
+var pluginsSectionSchema = z.object({
+  catalogs: z.array(z.string().trim().url()).optional(),
+  trusted: z.array(z.string().trim().url()).optional()
+});
+var logLevelSchema = z.enum(["debug", "info", "warn", "error"]);
+var loggingSectionSchema = z.object({
+  level: logLevelSchema.optional(),
+  file: z.string().trim().min(1).optional(),
+  console: z.boolean().optional()
+});
 var serverConfigDocumentSchema = z.object({
   server: serverSectionSchema,
   db: dbSectionSchema,
   redis: redisSectionSchema,
-  llm: llmSectionSchema.optional()
+  llm: llmSectionSchema.optional(),
+  plugins: pluginsSectionSchema.optional(),
+  logging: loggingSectionSchema.optional()
 });
 
 // src/config/serverConfig.ts
@@ -189,12 +235,30 @@ function parseServerConfig(document) {
     }
     llm = normalizeLlmConfig(parsedLlmSection.data);
   }
+  let plugins = null;
+  if (root.plugins !== void 0) {
+    const parsedPluginsSection = pluginsSectionSchema.safeParse(root.plugins);
+    if (!parsedPluginsSection.success) {
+      throw new ConfigError(formatZodError(parsedPluginsSection.error));
+    }
+    plugins = normalizePluginsConfig(parsedPluginsSection.data);
+  }
+  let logging = DEFAULT_LOGGING_CONFIG;
+  if (root.logging !== void 0) {
+    const parsedLoggingSection = loggingSectionSchema.safeParse(root.logging);
+    if (!parsedLoggingSection.success) {
+      throw new ConfigError(formatZodError(parsedLoggingSection.error));
+    }
+    logging = normalizeLoggingConfig(parsedLoggingSection.data);
+  }
   return {
     port: parsedDocument.data.server.port,
     host: parsedDocument.data.server.host,
     db: parsedDbSection.data,
     redis: parsedRedisSection.data,
-    llm
+    llm,
+    plugins,
+    logging
   };
 }
 function loadServerConfig(configPath) {
@@ -5618,6 +5682,48 @@ import {
   validatorCompiler
 } from "fastify-type-provider-zod";
 
+// src/server/logging/httpLogging.ts
+function registerHttpLogging(app, logger) {
+  app.addHook("onRequest", async (request) => {
+    logger.debug("request", {
+      reqId: request.id,
+      method: request.method,
+      url: request.url,
+      ip: request.ip
+    });
+  });
+  app.addHook("onError", async (request, reply, error) => {
+    logger.error("request error", {
+      reqId: request.id,
+      method: request.method,
+      url: request.url,
+      statusCode: reply.statusCode,
+      message: error.message,
+      stack: error.stack
+    });
+  });
+}
+
+// src/server/logging/logger.ts
+import winston from "winston";
+function createLogger(config) {
+  const transports = [];
+  if (config.console) {
+    transports.push(new winston.transports.Console());
+  }
+  if (config.file) {
+    transports.push(new winston.transports.File({ filename: config.file }));
+  }
+  if (transports.length === 0) {
+    transports.push(new winston.transports.Console({ silent: true }));
+  }
+  return winston.createLogger({
+    level: config.level,
+    format: winston.format.combine(winston.format.timestamp(), winston.format.json()),
+    transports
+  });
+}
+
 // src/packageVersion.ts
 import { readFileSync as readFileSync2 } from "fs";
 function readPackageVersion() {
@@ -5953,6 +6059,15 @@ var createdApiTokenResponseSchema = z8.object({
 var listAdminTokensResponseSchema = z8.object({
   tokens: z8.array(hubApiTokenRecordSchema)
 });
+var reloadConfigSectionResultSchema = z8.object({
+  section: z8.enum(["db", "redis", "llm", "plugins", "server"]),
+  status: z8.enum(["reloaded", "unchanged", "failed", "restart-required"]),
+  error: z8.string().optional()
+});
+var reloadConfigResponseSchema = z8.object({
+  sections: z8.array(reloadConfigSectionResultSchema),
+  fatalError: z8.string().optional()
+});
 function serializeHubUser(user) {
   return {
     id: user.id,
@@ -6159,7 +6274,7 @@ function denySelfRoleChange(reply, targetUserId, actorUserId, existingRole, requ
   return true;
 }
 async function registerAdminRoutes(app, options) {
-  const { db, llm } = options;
+  const { db, getLlm, reloadConfig } = options;
   const routes = app.withTypeProvider();
   routes.route({
     method: "GET",
@@ -6180,6 +6295,7 @@ async function registerAdminRoutes(app, options) {
           return;
         }
         const systemUserId = db.getSystemUserId();
+        const llm = getLlm();
         const [users, collections, environments] = await Promise.all([
           db.listUsers(),
           db.listCollections(),
@@ -6232,6 +6348,7 @@ async function registerAdminRoutes(app, options) {
           return;
         }
         const input = buildAdminUserCreateInput(request.body);
+        const llm = getLlm();
         const [collections, environments] = await Promise.all([
           db.listCollections(),
           db.listEnvironments()
@@ -6346,6 +6463,7 @@ async function registerAdminRoutes(app, options) {
      * Lists all hub-offered LLM models for operator user management.
      */
     handler: async (request, reply) => {
+      const llm = getLlm();
       if (!llm) {
         return sendLlmUnavailable(reply);
       }
@@ -6397,6 +6515,7 @@ async function registerAdminRoutes(app, options) {
         }
         const input = buildAdminUserUpdateInput(existing, request.body);
         const role = request.body.role ?? existing.role;
+        const llm = getLlm();
         const [collections, environments] = await Promise.all([
           db.listCollections(),
           db.listEnvironments()
@@ -6586,6 +6705,31 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "POST",
+    url: "/admin/config/reload",
+    schema: {
+      response: {
+        200: reloadConfigResponseSchema,
+        400: reloadConfigResponseSchema,
+        403: errorResponseSchema
+      }
+    },
+    /**
+     * Re-reads server.yaml and applies reloadable config sections on a best-effort basis.
+     */
+    handler: async (request, reply) => {
+      const user = requireAuthenticatedUser(request);
+      if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+        return;
+      }
+      const result = await reloadConfig();
+      if (result.fatalError) {
+        return reply.code(400).send(result);
+      }
+      return reply.send(result);
+    }
+  });
 }
 
 // src/server/auth/sessionCapabilities.ts
@@ -7523,14 +7667,15 @@ async function registerLlmRoutes(app, options) {
      * Lists hub-offered models the authenticated user may use.
      */
     handler: async (request, reply) => {
-      if (!options.llm) {
+      const llm = options.getLlm();
+      if (!llm) {
         return sendLlmUnavailable2(reply);
       }
       const user = requireAuthenticatedUser(request);
       if (denyUnlessAllowed(reply, canUseLlm(user))) {
         return;
       }
-      const offered = listHubOfferedModels(options.llm).filter(
+      const offered = listHubOfferedModels(llm).filter(
         (model) => isLlmModelAllowed(user, model.id)
       );
       return reply.send({
@@ -7556,7 +7701,8 @@ async function registerLlmRoutes(app, options) {
      * Returns the authenticated user's current monthly LLM usage summary.
      */
     handler: async (request, reply) => {
-      if (!options.llm) {
+      const llm = options.getLlm();
+      if (!llm) {
         return sendLlmUnavailable2(reply);
       }
       const user = requireAuthenticatedUser(request);
@@ -7588,7 +7734,8 @@ async function registerLlmRoutes(app, options) {
      * Runs one stateless LLM completion step using hub-configured provider keys.
      */
     handler: async (request, reply) => {
-      if (!options.llm) {
+      const llm = options.getLlm();
+      if (!llm) {
         return sendLlmUnavailable2(reply);
       }
       const user = requireAuthenticatedUser(request);
@@ -7596,7 +7743,7 @@ async function registerLlmRoutes(app, options) {
         return;
       }
       const { model, messages, tools, systemPrompt } = request.body;
-      if (!isHubModelOffered(options.llm, model)) {
+      if (!isHubModelOffered(llm, model)) {
         return reply.code(403).send({ error: "Model is not offered by this Team Hub." });
       }
       if (!isLlmModelAllowed(user, model)) {
@@ -7610,7 +7757,7 @@ async function registerLlmRoutes(app, options) {
       if (isNewTurn && isOverMonthlyLimit(totalTokens, user.llmMonthlyTokenLimit)) {
         return sendMonthlyLimitExceeded(reply);
       }
-      const result = await runLlmCompletion(options.llm, {
+      const result = await runLlmCompletion(llm, {
         model,
         messages,
         tools,
@@ -7648,6 +7795,43 @@ async function registerLlmRoutes(app, options) {
   });
 }
 
+// src/server/routes/schemas/plugins.ts
+import { z as z11 } from "zod/v4";
+var pluginSourcesResponseSchema = z11.object({
+  catalogs: z11.array(z11.string()),
+  trusted: z11.array(z11.string())
+});
+
+// src/server/routes/plugins.ts
+async function registerPluginsRoutes(app, options) {
+  const routes = app.withTypeProvider();
+  routes.route({
+    method: "GET",
+    url: "/plugins/sources",
+    schema: {
+      response: {
+        200: pluginSourcesResponseSchema
+      }
+    },
+    /**
+     * Returns plugin catalog and trusted-publisher URLs configured on this Team Hub.
+     */
+    handler: async (_request, reply) => {
+      const plugins = options.getPlugins();
+      if (!plugins) {
+        return reply.send({
+          catalogs: [],
+          trusted: []
+        });
+      }
+      return reply.send({
+        catalogs: plugins.catalogs,
+        trusted: plugins.trusted
+      });
+    }
+  });
+}
+
 // src/server/auth/bearerAuthPlugin.ts
 function registerBearerAuthDecorator(app) {
   app.decorateRequest("apiToken", null);
@@ -7658,8 +7842,8 @@ function buildAuthThrottleKey(request, token) {
   return `${request.ip}:${tokenPart}`;
 }
 function createBearerAuthHook(db, throttleStore) {
-  const policy = throttleStore.getPolicy();
   return async function bearerAuth(request, reply) {
+    const policy = throttleStore.getPolicy();
     const token = extractBearer(request.headers.authorization);
     const throttleKey = buildAuthThrottleKey(request, token);
     try {
@@ -7714,12 +7898,17 @@ async function registerProtectedRoutes(app, options) {
   registerBearerAuthDecorator(app);
   app.addHook("onRequest", createBearerAuthHook(options.db, options.throttleStore));
   await registerAuthRoutes(app);
-  await registerAdminRoutes(app, { db: options.db, llm: options.llm });
+  await registerAdminRoutes(app, {
+    db: options.db,
+    getLlm: options.getLlm,
+    reloadConfig: options.reloadConfig
+  });
   await registerCollectionRoutes(app, options.db);
   await registerEnvironmentRoutes(app, options.db);
   await registerFolderRoutes(app, options.db);
   await registerRequestRoutes(app, options.db);
-  await registerLlmRoutes(app, { db: options.db, llm: options.llm });
+  await registerLlmRoutes(app, { db: options.db, getLlm: options.getLlm });
+  await registerPluginsRoutes(app, { getPlugins: options.getPlugins });
 }
 async function registerRoutes(app, options) {
   await app.register(async (publicApp) => {
@@ -7731,21 +7920,36 @@ async function registerRoutes(app, options) {
 }
 
 // src/server/createServer.ts
-async function createServer(config, options) {
+async function createServer(ctxOrConfig, options = {}) {
+  const isRuntimeContext = "getLlm" in ctxOrConfig && "configPath" in ctxOrConfig;
+  const ctx = isRuntimeContext ? ctxOrConfig : null;
+  const legacyConfig = isRuntimeContext ? null : ctxOrConfig;
+  const db = options.db ?? ctx?.db;
+  const throttleStore = options.throttleStore ?? ctx?.throttleStore;
+  if (!db || !throttleStore) {
+    throw new Error("createServer requires db and throttleStore.");
+  }
+  const logger = options.logger ?? ctx?.logger ?? createLogger(legacyConfig?.logging ?? DEFAULT_LOGGING_CONFIG);
   const app = Fastify({
     logger: options.verbose ?? false
   }).withTypeProvider();
   app.setValidatorCompiler(validatorCompiler);
   app.setSerializerCompiler(serializerCompiler);
+  registerHttpLogging(app, logger);
   await registerRoutes(app, {
     version: options.version ?? readPackageVersion(),
-    db: options.db,
-    throttleStore: options.throttleStore,
-    llm: config.llm
+    db,
+    throttleStore,
+    getLlm: ctx ? () => ctx.getLlm() : () => legacyConfig?.llm ?? null,
+    getPlugins: ctx ? () => ctx.getPlugins() : () => legacyConfig?.plugins ?? null,
+    reloadConfig: options.reloadConfig ?? (async () => ({ sections: [] }))
   });
   return app;
 }
 
+// src/server/runtimeContext.ts
+import { isDeepStrictEqual } from "util";
+
 // src/server/auth/throttle/RedisThrottleStore.ts
 import Redis from "ioredis";
 
@@ -7885,6 +8089,151 @@ function createThrottleStore(config) {
   return RedisThrottleStore.fromConfig(config);
 }
 
+// src/server/runtimeContext.ts
+var runtimeContextStates = /* @__PURE__ */ new WeakMap();
+function createSwappableProxy(holder) {
+  return new Proxy({}, {
+    /**
+     * Forwards property reads to the current underlying instance.
+     */
+    get(_target, prop) {
+      const value = Reflect.get(holder.underlying, prop, holder.underlying);
+      if (typeof value === "function") {
+        return value.bind(holder.underlying);
+      }
+      return value;
+    }
+  });
+}
+function getState(ctx) {
+  const state = runtimeContextStates.get(ctx);
+  if (!state) {
+    throw new Error("Invalid runtime context.");
+  }
+  return state;
+}
+function formatReloadError(error) {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return String(error);
+}
+function createRuntimeContext(config, configPath) {
+  const state = {
+    configPath,
+    host: config.host,
+    port: config.port,
+    activeDbConfig: config.db,
+    activeRedisConfig: config.redis,
+    dbHolder: { underlying: createDatabase(config.db) },
+    throttleHolder: { underlying: createThrottleStore(config.redis) },
+    llm: config.llm,
+    plugins: config.plugins
+  };
+  const ctx = {
+    configPath: state.configPath,
+    get host() {
+      return state.host;
+    },
+    get port() {
+      return state.port;
+    },
+    db: createSwappableProxy(state.dbHolder),
+    throttleStore: createSwappableProxy(state.throttleHolder),
+    getLlm: () => state.llm,
+    getPlugins: () => state.plugins,
+    logger: createLogger(config.logging)
+  };
+  runtimeContextStates.set(ctx, state);
+  return ctx;
+}
+async function connectRuntimeContext(ctx) {
+  const state = getState(ctx);
+  await state.dbHolder.underlying.connect();
+  await state.throttleHolder.underlying.connect();
+}
+async function disconnectAll(ctx) {
+  const state = getState(ctx);
+  await state.dbHolder.underlying.disconnect();
+  await state.throttleHolder.underlying.disconnect();
+}
+async function reloadDbSection(state, nextDbConfig) {
+  if (isDeepStrictEqual(state.activeDbConfig, nextDbConfig)) {
+    return { section: "db", status: "unchanged" };
+  }
+  try {
+    const nextDb = createDatabase(nextDbConfig);
+    await nextDb.connect();
+    const previousDb = state.dbHolder.underlying;
+    state.dbHolder.underlying = nextDb;
+    state.activeDbConfig = nextDbConfig;
+    await previousDb.disconnect();
+    return { section: "db", status: "reloaded" };
+  } catch (error) {
+    return { section: "db", status: "failed", error: formatReloadError(error) };
+  }
+}
+async function reloadRedisSection(state, nextRedisConfig) {
+  if (isDeepStrictEqual(state.activeRedisConfig, nextRedisConfig)) {
+    return { section: "redis", status: "unchanged" };
+  }
+  try {
+    const nextStore = createThrottleStore(nextRedisConfig);
+    await nextStore.connect();
+    const previousStore = state.throttleHolder.underlying;
+    state.throttleHolder.underlying = nextStore;
+    state.activeRedisConfig = nextRedisConfig;
+    await previousStore.disconnect();
+    return { section: "redis", status: "reloaded" };
+  } catch (error) {
+    return { section: "redis", status: "failed", error: formatReloadError(error) };
+  }
+}
+function reloadServerSection(state, nextConfig) {
+  if (state.host === nextConfig.host && state.port === nextConfig.port) {
+    return { section: "server", status: "unchanged" };
+  }
+  return {
+    section: "server",
+    status: "restart-required",
+    error: "Changes to server.host or server.port require a full process restart."
+  };
+}
+async function reloadRuntimeConfig(ctx) {
+  const state = getState(ctx);
+  let nextConfig;
+  try {
+    nextConfig = loadServerConfig(state.configPath);
+  } catch (error) {
+    const message = error instanceof ConfigError ? error.message : formatReloadError(error);
+    return { sections: [], fatalError: message };
+  }
+  const sections = [];
+  sections.push(await reloadDbSection(state, nextConfig.db));
+  sections.push(await reloadRedisSection(state, nextConfig.redis));
+  state.llm = nextConfig.llm;
+  sections.push({ section: "llm", status: "reloaded" });
+  state.plugins = nextConfig.plugins;
+  sections.push({ section: "plugins", status: "reloaded" });
+  sections.push(reloadServerSection(state, nextConfig));
+  return { sections };
+}
+function formatConfigReloadSummary(result) {
+  return result.sections.map((section) => {
+    if (section.error) {
+      return `${section.section}: ${section.status} (${section.error})`;
+    }
+    return `${section.section}: ${section.status}`;
+  }).join(", ");
+}
+function logConfigReloadResult(result) {
+  if (result.fatalError) {
+    console.error(`Team Hub config reload failed: ${result.fatalError}`);
+    return;
+  }
+  console.log(`Team Hub config reloaded (${formatConfigReloadSummary(result)}).`);
+}
+
 // src/server.ts
 function formatListenAddress(address, port) {
   if (!address) {
@@ -7896,12 +8245,11 @@ function formatListenAddress(address, port) {
   const host = address.includes(":") && !address.startsWith("[") ? `[${address}]` : address;
   return `http://${host}:${port}`;
 }
-function registerGracefulShutdown(app, db, throttleStore) {
+function registerGracefulShutdown(app, ctx) {
   const shutdown = async (signal) => {
     app.log.info(`Received ${signal}, shutting down.`);
     await app.close();
-    await db.disconnect();
-    await throttleStore.disconnect();
+    await disconnectAll(ctx);
     process.exit(0);
   };
   process.once("SIGINT", () => {
@@ -7911,33 +8259,42 @@ function registerGracefulShutdown(app, db, throttleStore) {
     void shutdown("SIGTERM");
   });
 }
-async function runServer(config, options) {
-  const app = await createServer(config, {
+function registerConfigReloadHandler(reloadConfig) {
+  process.on("SIGHUP", () => {
+    void reloadConfig();
+  });
+}
+async function runServer(ctx, options = {}) {
+  const reloadConfig = async () => {
+    const result = await reloadRuntimeConfig(ctx);
+    logConfigReloadResult(result);
+    return result;
+  };
+  const app = await createServer(ctx, {
     verbose: options.verbose,
-    db: options.db,
-    throttleStore: options.throttleStore
+    reloadConfig
   });
-  await options.db.connect();
-  await options.throttleStore.connect();
+  await connectRuntimeContext(ctx);
   await app.listen({
-    host: config.host,
-    port: config.port
+    host: ctx.host,
+    port: ctx.port
   });
   const address = app.server.address();
-  const port = typeof address === "object" && address ? address.port : config.port;
-  const host = typeof address === "object" && address ? address.address : config.host;
+  const port = typeof address === "object" && address ? address.port : ctx.port;
+  const host = typeof address === "object" && address ? address.address : ctx.host;
   if (options.verbose) {
-    console.log("Starting server with config:", config);
+    console.log("Starting server with config path:", ctx.configPath);
   }
   console.log(`Team Hub listening on ${formatListenAddress(host, port)}`);
-  registerGracefulShutdown(app, options.db, options.throttleStore);
+  registerGracefulShutdown(app, ctx);
+  registerConfigReloadHandler(reloadConfig);
   return app;
 }
 async function startCommand(options) {
+  const configPath = resolveConfigPath(options.config);
   const config = loadServerConfig(options.config);
-  const db = createDatabase(config.db);
-  const throttleStore = createThrottleStore(config.redis);
-  await runServer(config, { verbose: options.verbose, db, throttleStore });
+  const ctx = createRuntimeContext(config, configPath);
+  await runServer(ctx, { verbose: options.verbose });
 }
 function registerStartCommand(program, handler = startCommand) {
   program.command("start").description("Start the Team Hub server").action(