@harborclient/team-hub 0.2.1 → 0.2.3

package/dist/cli.js

@@ -42,6 +42,40 @@ function normalizeLlmConfig(section) {
   };
 }
 
+// src/config/loggingConfig.ts
+var DEFAULT_LOGGING_CONFIG = {
+  level: "info",
+  file: null,
+  console: true
+};
+function normalizeLoggingConfig(section) {
+  return {
+    level: section?.level ?? DEFAULT_LOGGING_CONFIG.level,
+    file: section?.file ?? DEFAULT_LOGGING_CONFIG.file,
+    console: section?.console ?? DEFAULT_LOGGING_CONFIG.console
+  };
+}
+
+// src/config/pluginsConfig.ts
+function dedupeUrls(urls) {
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const url of urls) {
+    if (seen.has(url)) {
+      continue;
+    }
+    seen.add(url);
+    deduped.push(url);
+  }
+  return deduped;
+}
+function normalizePluginsConfig(section) {
+  return {
+    catalogs: dedupeUrls(section.catalogs ?? []),
+    trusted: dedupeUrls(section.trusted ?? [])
+  };
+}
+
 // src/config/serverConfig.schema.ts
 import { z } from "zod/v4";
 var portSchema = z.union([
@@ -93,11 +127,23 @@ var llmSectionSchema = z.object({
   ),
   models: z.array(z.string().trim().min(1)).optional()
 });
+var pluginsSectionSchema = z.object({
+  catalogs: z.array(z.string().trim().url()).optional(),
+  trusted: z.array(z.string().trim().url()).optional()
+});
+var logLevelSchema = z.enum(["debug", "info", "warn", "error"]);
+var loggingSectionSchema = z.object({
+  level: logLevelSchema.optional(),
+  file: z.string().trim().min(1).optional(),
+  console: z.boolean().optional()
+});
 var serverConfigDocumentSchema = z.object({
   server: serverSectionSchema,
   db: dbSectionSchema,
   redis: redisSectionSchema,
-  llm: llmSectionSchema.optional()
+  llm: llmSectionSchema.optional(),
+  plugins: pluginsSectionSchema.optional(),
+  logging: loggingSectionSchema.optional()
 });
 
 // src/config/serverConfig.ts
@@ -189,12 +235,30 @@ function parseServerConfig(document) {
     }
     llm = normalizeLlmConfig(parsedLlmSection.data);
   }
+  let plugins = null;
+  if (root.plugins !== void 0) {
+    const parsedPluginsSection = pluginsSectionSchema.safeParse(root.plugins);
+    if (!parsedPluginsSection.success) {
+      throw new ConfigError(formatZodError(parsedPluginsSection.error));
+    }
+    plugins = normalizePluginsConfig(parsedPluginsSection.data);
+  }
+  let logging = DEFAULT_LOGGING_CONFIG;
+  if (root.logging !== void 0) {
+    const parsedLoggingSection = loggingSectionSchema.safeParse(root.logging);
+    if (!parsedLoggingSection.success) {
+      throw new ConfigError(formatZodError(parsedLoggingSection.error));
+    }
+    logging = normalizeLoggingConfig(parsedLoggingSection.data);
+  }
   return {
     port: parsedDocument.data.server.port,
     host: parsedDocument.data.server.host,
     db: parsedDbSection.data,
     redis: parsedRedisSection.data,
-    llm
+    llm,
+    plugins,
+    logging
   };
 }
 function loadServerConfig(configPath) {
@@ -367,7 +431,8 @@ function mapFirestoreCollection(id, data) {
     createdAt: data.createdAt,
     updatedAt: data.updatedAt ?? data.createdAt,
     createdByUserId: data.createdByUserId ?? null,
-    updatedByUserId: data.updatedByUserId ?? null
+    updatedByUserId: data.updatedByUserId ?? null,
+    deletionLocked: data.deletionLocked ?? false
   };
 }
 function mapFirestoreEnvironment(id, data) {
@@ -378,7 +443,8 @@ function mapFirestoreEnvironment(id, data) {
     createdAt: data.createdAt,
     updatedAt: data.updatedAt ?? data.createdAt,
     createdByUserId: data.createdByUserId ?? null,
-    updatedByUserId: data.updatedByUserId ?? null
+    updatedByUserId: data.updatedByUserId ?? null,
+    deletionLocked: data.deletionLocked ?? false
   };
 }
 function mapFirestoreFolder(id, data) {
@@ -924,7 +990,8 @@ var FirestoreDatabase = class _FirestoreDatabase {
       createdAt: now,
       updatedAt: now,
       createdByUserId: actingUserId,
-      updatedByUserId: actingUserId
+      updatedByUserId: actingUserId,
+      deletionLocked: false
     };
     await this.requireClient().collection(COLLECTIONS_COLLECTION).doc(id).set(data);
     await this.recordAuditEntry(actingUserId, "create", "collection", id);
@@ -986,6 +1053,46 @@ var FirestoreDatabase = class _FirestoreDatabase {
     ];
     await this.commitBatchedDeletes(refs);
   }
+  /**
+   * Finds a collection by stable identifier.
+   *
+   * @param id - Collection ID to look up.
+   */
+  async findCollectionById(id) {
+    const snapshot = await this.requireClient().collection(COLLECTIONS_COLLECTION).doc(id).get();
+    if (!snapshot.exists) {
+      return null;
+    }
+    return mapFirestoreCollection(id, snapshot.data());
+  }
+  /**
+   * Updates whether non-admin users may delete a collection.
+   *
+   * @param id - Collection ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the collection.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setCollectionDeletionLocked(id, deletionLocked, actingUserId) {
+    const docRef = this.requireClient().collection(COLLECTIONS_COLLECTION).doc(id);
+    const snapshot = await docRef.get();
+    if (!snapshot.exists) {
+      throw new Error("Collection not found");
+    }
+    const updatedAt = /* @__PURE__ */ new Date();
+    await docRef.update({
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+    await this.recordAuditEntry(actingUserId, "update", "collection", id);
+    const existing = snapshot.data();
+    return mapFirestoreCollection(id, {
+      ...existing,
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+  }
   /**
    * Lists all environments ordered by name.
    */
@@ -1011,7 +1118,8 @@ var FirestoreDatabase = class _FirestoreDatabase {
       createdAt: now,
       updatedAt: now,
       createdByUserId: actingUserId,
-      updatedByUserId: actingUserId
+      updatedByUserId: actingUserId,
+      deletionLocked: false
     };
     await this.requireClient().collection(ENVIRONMENTS_COLLECTION).doc(id).set(data);
     await this.recordAuditEntry(actingUserId, "create", "environment", id);
@@ -1057,6 +1165,46 @@ var FirestoreDatabase = class _FirestoreDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "environment", id);
     await this.requireClient().collection(ENVIRONMENTS_COLLECTION).doc(id).delete();
   }
+  /**
+   * Finds an environment by stable identifier.
+   *
+   * @param id - Environment ID to look up.
+   */
+  async findEnvironmentById(id) {
+    const snapshot = await this.requireClient().collection(ENVIRONMENTS_COLLECTION).doc(id).get();
+    if (!snapshot.exists) {
+      return null;
+    }
+    return mapFirestoreEnvironment(id, snapshot.data());
+  }
+  /**
+   * Updates whether non-admin users may delete an environment.
+   *
+   * @param id - Environment ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the environment.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setEnvironmentDeletionLocked(id, deletionLocked, actingUserId) {
+    const docRef = this.requireClient().collection(ENVIRONMENTS_COLLECTION).doc(id);
+    const snapshot = await docRef.get();
+    if (!snapshot.exists) {
+      throw new Error("Environment not found");
+    }
+    const updatedAt = /* @__PURE__ */ new Date();
+    await docRef.update({
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+    await this.recordAuditEntry(actingUserId, "update", "environment", id);
+    const existing = snapshot.data();
+    return mapFirestoreEnvironment(id, {
+      ...existing,
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+  }
   /**
    * Lists all saved requests in a collection.
    *
@@ -1667,7 +1815,8 @@ function mapCollectionSqlRow(row) {
     createdAt: row.created_at,
     updatedAt: row.updated_at ?? row.created_at,
     createdByUserId: row.created_by_user_id ?? null,
-    updatedByUserId: row.updated_by_user_id ?? null
+    updatedByUserId: row.updated_by_user_id ?? null,
+    deletionLocked: Boolean(row.deletion_locked)
   };
 }
 function mapEnvironmentSqlRow(row) {
@@ -1678,7 +1827,8 @@ function mapEnvironmentSqlRow(row) {
     createdAt: row.created_at,
     updatedAt: row.updated_at ?? row.created_at,
     createdByUserId: row.created_by_user_id ?? null,
-    updatedByUserId: row.updated_by_user_id ?? null
+    updatedByUserId: row.updated_by_user_id ?? null,
+    deletionLocked: Boolean(row.deletion_locked)
   };
 }
 function mapFolderSqlRow(row) {
@@ -1921,6 +2071,14 @@ CREATE TABLE IF NOT EXISTS llm_usage_log (
 )
 `.trim();
 var MYSQL_DEFAULT_AUTH_JSON = DEFAULT_AUTH_JSON;
+var COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL = `
+ALTER TABLE collections
+  ADD COLUMN IF NOT EXISTS deletion_locked TINYINT(1) NOT NULL DEFAULT 0;
+`.trim();
+var ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL = `
+ALTER TABLE environments
+  ADD COLUMN IF NOT EXISTS deletion_locked TINYINT(1) NOT NULL DEFAULT 0;
+`.trim();
 var MYSQL_MIGRATIONS = [
   USERS_MIGRATION_SQL,
   API_TOKENS_MIGRATION_SQL,
@@ -1941,7 +2099,9 @@ var MYSQL_MIGRATIONS = [
   FOLDERS_BACKFILL_UPDATED_AT_SQL,
   USERS_LLM_MIGRATION_SQL,
   LLM_USAGE_MIGRATION_SQL,
-  LLM_USAGE_LOG_MIGRATION_SQL
+  LLM_USAGE_LOG_MIGRATION_SQL,
+  COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL,
+  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL
 ];
 
 // src/db/mysql/schemas.ts
@@ -1998,8 +2158,8 @@ function serializeAccessList(access) {
   return JSON.stringify(access);
 }
 var USER_SELECT_COLUMNS = `id, name, role, collection_access, environment_access, llm_access, llm_models, llm_monthly_token_limit, created_at, updated_at, created_by_user_id, updated_by_user_id`;
-var COLLECTION_SELECT_COLUMNS = `id, name, variables, headers, auth, pre_request_script, post_request_script, created_at, updated_at, created_by_user_id, updated_by_user_id`;
-var ENVIRONMENT_SELECT_COLUMNS = `id, name, variables, created_at, updated_at, created_by_user_id, updated_by_user_id`;
+var COLLECTION_SELECT_COLUMNS = `id, name, variables, headers, auth, pre_request_script, post_request_script, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
+var ENVIRONMENT_SELECT_COLUMNS = `id, name, variables, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
 var FOLDER_SELECT_COLUMNS = `id, collection_id, name, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id`;
 var REQUEST_SELECT_COLUMNS = `id, collection_id, folder_id, name, method, url, headers, params, auth, body, body_type, pre_request_script, post_request_script, comment, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id`;
 var API_TOKEN_SELECT_COLUMNS = `id, user_id, name, token_hash, token_prefix, created_at, last_used_at, revoked_at, created_by_user_id, updated_by_user_id`;
@@ -2591,6 +2751,50 @@ var MysqlDatabase = class _MysqlDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "collection", id);
     await this.executeStatement("DELETE FROM collections WHERE id = ?", [id]);
   }
+  /**
+   * Finds a collection by stable identifier.
+   *
+   * @param id - Collection ID to look up.
+   */
+  async findCollectionById(id) {
+    const rows = await this.queryRows(
+      `${COLLECTION_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    return row ? mapCollectionSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete a collection.
+   *
+   * @param id - Collection ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the collection.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setCollectionDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.executeStatement(
+      `UPDATE collections
+      SET deletion_locked = ?,
+        updated_at = ?,
+        updated_by_user_id = ?
+      WHERE id = ?`,
+      [deletionLocked ? 1 : 0, updatedAt, actingUserId, id]
+    );
+    if ((result.affectedRows ?? 0) === 0) {
+      throw new Error("Collection not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "collection", id);
+    const rows = await this.queryRows(
+      `${COLLECTION_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Collection not found");
+    }
+    return mapCollectionSqlRow(row);
+  }
   /**
    * Lists all environments ordered by name.
    */
@@ -2674,6 +2878,50 @@ var MysqlDatabase = class _MysqlDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "environment", id);
     await this.executeStatement("DELETE FROM environments WHERE id = ?", [id]);
   }
+  /**
+   * Finds an environment by stable identifier.
+   *
+   * @param id - Environment ID to look up.
+   */
+  async findEnvironmentById(id) {
+    const rows = await this.queryRows(
+      `${ENVIRONMENT_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    return row ? mapEnvironmentSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete an environment.
+   *
+   * @param id - Environment ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the environment.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setEnvironmentDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.executeStatement(
+      `UPDATE environments
+      SET deletion_locked = ?,
+        updated_at = ?,
+        updated_by_user_id = ?
+      WHERE id = ?`,
+      [deletionLocked ? 1 : 0, updatedAt, actingUserId, id]
+    );
+    if ((result.affectedRows ?? 0) === 0) {
+      throw new Error("Environment not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "environment", id);
+    const rows = await this.queryRows(
+      `${ENVIRONMENT_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Environment not found");
+    }
+    return mapEnvironmentSqlRow(row);
+  }
   /**
    * Lists all saved requests in a collection.
    *
@@ -3526,6 +3774,14 @@ CREATE INDEX IF NOT EXISTS llm_usage_log_user_created_at_idx ON llm_usage_log (u
 
 CREATE INDEX IF NOT EXISTS llm_usage_log_period_idx ON llm_usage_log (period);
 `.trim();
+var COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL2 = `
+ALTER TABLE collections
+  ADD COLUMN IF NOT EXISTS deletion_locked BOOLEAN NOT NULL DEFAULT FALSE;
+`.trim();
+var ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2 = `
+ALTER TABLE environments
+  ADD COLUMN IF NOT EXISTS deletion_locked BOOLEAN NOT NULL DEFAULT FALSE;
+`.trim();
 var POSTGRES_MIGRATIONS = [
   USERS_MIGRATION_SQL2,
   API_TOKENS_MIGRATION_SQL2,
@@ -3546,7 +3802,9 @@ var POSTGRES_MIGRATIONS = [
   FOLDERS_BACKFILL_UPDATED_AT_SQL2,
   USERS_LLM_MIGRATION_SQL2,
   LLM_USAGE_MIGRATION_SQL2,
-  LLM_USAGE_LOG_MIGRATION_SQL2
+  LLM_USAGE_LOG_MIGRATION_SQL2,
+  COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL2,
+  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2
 ];
 
 // src/db/postgres/schemas.ts
@@ -4108,6 +4366,46 @@ var PostgresDatabase = class _PostgresDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "collection", id);
     await this.query("DELETE FROM collections WHERE id = $1", [id]);
   }
+  /**
+   * Finds a collection by stable identifier.
+   *
+   * @param id - Collection ID to look up.
+   */
+  async findCollectionById(id) {
+    const result = await this.query(`${COLLECTION_SELECT2} WHERE id = $1`, [id]);
+    const row = result.rows[0];
+    return row ? mapCollectionSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete a collection.
+   *
+   * @param id - Collection ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the collection.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setCollectionDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.query(
+      `UPDATE collections
+      SET deletion_locked = $1,
+        updated_at = $2,
+        updated_by_user_id = $3
+      WHERE id = $4`,
+      [deletionLocked, updatedAt, actingUserId, id]
+    );
+    if ((result.rowCount ?? 0) === 0) {
+      throw new Error("Collection not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "collection", id);
+    const selectResult = await this.query(`${COLLECTION_SELECT2} WHERE id = $1`, [
+      id
+    ]);
+    const row = selectResult.rows[0];
+    if (!row) {
+      throw new Error("Collection not found");
+    }
+    return mapCollectionSqlRow(row);
+  }
   /**
    * Lists all environments ordered by name.
    */
@@ -4186,6 +4484,47 @@ var PostgresDatabase = class _PostgresDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "environment", id);
     await this.query("DELETE FROM environments WHERE id = $1", [id]);
   }
+  /**
+   * Finds an environment by stable identifier.
+   *
+   * @param id - Environment ID to look up.
+   */
+  async findEnvironmentById(id) {
+    const result = await this.query(`${ENVIRONMENT_SELECT2} WHERE id = $1`, [id]);
+    const row = result.rows[0];
+    return row ? mapEnvironmentSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete an environment.
+   *
+   * @param id - Environment ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the environment.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setEnvironmentDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.query(
+      `UPDATE environments
+      SET deletion_locked = $1,
+        updated_at = $2,
+        updated_by_user_id = $3
+      WHERE id = $4`,
+      [deletionLocked, updatedAt, actingUserId, id]
+    );
+    if ((result.rowCount ?? 0) === 0) {
+      throw new Error("Environment not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "environment", id);
+    const selectResult = await this.query(
+      `${ENVIRONMENT_SELECT2} WHERE id = $1`,
+      [id]
+    );
+    const row = selectResult.rows[0];
+    if (!row) {
+      throw new Error("Environment not found");
+    }
+    return mapEnvironmentSqlRow(row);
+  }
   /**
    * Lists all saved requests in a collection.
    *
@@ -5618,6 +5957,48 @@ import {
   validatorCompiler
 } from "fastify-type-provider-zod";
 
+// src/server/logging/httpLogging.ts
+function registerHttpLogging(app, logger) {
+  app.addHook("onRequest", async (request) => {
+    logger.debug("request", {
+      reqId: request.id,
+      method: request.method,
+      url: request.url,
+      ip: request.ip
+    });
+  });
+  app.addHook("onError", async (request, reply, error) => {
+    logger.error("request error", {
+      reqId: request.id,
+      method: request.method,
+      url: request.url,
+      statusCode: reply.statusCode,
+      message: error.message,
+      stack: error.stack
+    });
+  });
+}
+
+// src/server/logging/logger.ts
+import winston from "winston";
+function createLogger(config) {
+  const transports = [];
+  if (config.console) {
+    transports.push(new winston.transports.Console());
+  }
+  if (config.file) {
+    transports.push(new winston.transports.File({ filename: config.file }));
+  }
+  if (transports.length === 0) {
+    transports.push(new winston.transports.Console({ silent: true }));
+  }
+  return winston.createLogger({
+    level: config.level,
+    format: winston.format.combine(winston.format.timestamp(), winston.format.json()),
+    transports
+  });
+}
+
 // src/packageVersion.ts
 import { readFileSync as readFileSync2 } from "fs";
 function readPackageVersion() {
@@ -5638,6 +6019,9 @@ function canUseDataApi(user) {
 function canListCollections(user) {
   return canUseDataApi(user) || canUseManagementApi(user);
 }
+function canListEnvironments(user) {
+  return canUseDataApi(user) || canUseManagementApi(user);
+}
 function hasWildcardAccess(access) {
   return access.includes("*");
 }
@@ -5666,20 +6050,14 @@ function canCreateEnvironment(user) {
   return user.role === "user" && hasWildcardAccess(user.environmentAccess);
 }
 function filterAccessibleCollections(user, collections) {
-  if (user.role === "admin") {
-    return [];
-  }
-  if (hasWildcardAccess(user.collectionAccess)) {
+  if (user.role === "admin" || hasWildcardAccess(user.collectionAccess)) {
     return collections;
   }
   const allowed = new Set(user.collectionAccess);
   return collections.filter((collection) => allowed.has(collection.id));
 }
 function filterAccessibleEnvironments(user, environments) {
-  if (user.role === "admin") {
-    return [];
-  }
-  if (hasWildcardAccess(user.environmentAccess)) {
+  if (user.role === "admin" || hasWildcardAccess(user.environmentAccess)) {
     return environments;
   }
   const allowed = new Set(user.environmentAccess);
@@ -5704,6 +6082,17 @@ function isOverMonthlyLimit(totalTokens, limit) {
   return totalTokens >= limit;
 }
 
+// src/db/deletionLockedError.ts
+var DeletionLockedError = class extends Error {
+  /**
+   * @param entityType - Human-readable entity kind shown in the error message.
+   */
+  constructor(entityType) {
+    super(`Deletion is locked for this ${entityType}.`);
+    this.name = "DeletionLockedError";
+  }
+};
+
 // src/server/routes/schemas/common.ts
 import { z as z5 } from "zod/v4";
 var errorResponseSchema = z5.object({
@@ -5780,6 +6169,10 @@ function handleDbError(reply, error) {
     void reply.code(400).send(errorResponseSchema.parse({ error: error.message }));
     return true;
   }
+  if (error instanceof DeletionLockedError) {
+    void reply.code(403).send(errorResponseSchema.parse({ error: error.message }));
+    return true;
+  }
   if (isDuplicateUserNameDbError(error)) {
     void reply.code(400).send(errorResponseSchema.parse({ error: DUPLICATE_USER_NAME_MESSAGE }));
     return true;
@@ -5884,7 +6277,19 @@ var llmUsageSummaryResponseSchema = z7.object({
 // src/server/routes/schemas/admin.ts
 var adminResourceOptionSchema = z8.object({
   id: z8.string(),
-  name: z8.string()
+  name: z8.string(),
+  deletionLocked: z8.boolean()
+});
+var adminEntityConfigSchema = z8.object({
+  id: z8.string(),
+  name: z8.string(),
+  deletionLocked: z8.boolean()
+});
+var updateAdminCollectionBodySchema = z8.object({
+  deletionLocked: z8.boolean()
+});
+var updateAdminEnvironmentBodySchema = z8.object({
+  deletionLocked: z8.boolean()
 });
 var listAdminCollectionsResponseSchema = z8.object({
   collections: z8.array(adminResourceOptionSchema)
@@ -5953,6 +6358,15 @@ var createdApiTokenResponseSchema = z8.object({
 var listAdminTokensResponseSchema = z8.object({
   tokens: z8.array(hubApiTokenRecordSchema)
 });
+var reloadConfigSectionResultSchema = z8.object({
+  section: z8.enum(["db", "redis", "llm", "plugins", "server"]),
+  status: z8.enum(["reloaded", "unchanged", "failed", "restart-required"]),
+  error: z8.string().optional()
+});
+var reloadConfigResponseSchema = z8.object({
+  sections: z8.array(reloadConfigSectionResultSchema),
+  fatalError: z8.string().optional()
+});
 function serializeHubUser(user) {
   return {
     id: user.id,
@@ -5992,7 +6406,8 @@ var collectionRecordSchema = z9.object({
   createdAt: timestampSchema,
   updatedAt: timestampSchema,
   createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable()
+  updatedByUserId: z9.string().nullable(),
+  deletionLocked: z9.boolean()
 });
 var environmentRecordSchema = z9.object({
   id: z9.string(),
@@ -6001,7 +6416,8 @@ var environmentRecordSchema = z9.object({
   createdAt: timestampSchema,
   updatedAt: timestampSchema,
   createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable()
+  updatedByUserId: z9.string().nullable(),
+  deletionLocked: z9.boolean()
 });
 var folderRecordSchema = z9.object({
   id: z9.string(),
@@ -6159,7 +6575,7 @@ function denySelfRoleChange(reply, targetUserId, actorUserId, existingRole, requ
   return true;
 }
 async function registerAdminRoutes(app, options) {
-  const { db, llm } = options;
+  const { db, getLlm, reloadConfig } = options;
   const routes = app.withTypeProvider();
   routes.route({
     method: "GET",
@@ -6180,6 +6596,7 @@ async function registerAdminRoutes(app, options) {
           return;
         }
         const systemUserId = db.getSystemUserId();
+        const llm = getLlm();
         const [users, collections, environments] = await Promise.all([
           db.listUsers(),
           db.listCollections(),
@@ -6232,6 +6649,7 @@ async function registerAdminRoutes(app, options) {
           return;
         }
         const input = buildAdminUserCreateInput(request.body);
+        const llm = getLlm();
         const [collections, environments] = await Promise.all([
           db.listCollections(),
           db.listEnvironments()
@@ -6288,7 +6706,8 @@ async function registerAdminRoutes(app, options) {
         return reply.send({
           collections: collections.map((collection) => ({
             id: collection.id,
-            name: collection.name
+            name: collection.name,
+            deletionLocked: collection.deletionLocked
           }))
         });
       } catch (error) {
@@ -6321,7 +6740,8 @@ async function registerAdminRoutes(app, options) {
         return reply.send({
           environments: environments.map((environment) => ({
             id: environment.id,
-            name: environment.name
+            name: environment.name,
+            deletionLocked: environment.deletionLocked
           }))
         });
       } catch (error) {
@@ -6332,6 +6752,154 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "DELETE",
+    url: "/admin/collections/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes a collection regardless of deletion lock state.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const collection = await db.findCollectionById(request.params.id);
+        if (!collection) {
+          void reply.code(404).send({ error: "Collection not found" });
+          return;
+        }
+        await db.deleteCollection(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/admin/collections/:id",
+    schema: {
+      params: idParamSchema,
+      body: updateAdminCollectionBodySchema,
+      response: {
+        200: adminEntityConfigSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Updates admin configuration for a collection.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const collection = await db.setCollectionDeletionLocked(
+          request.params.id,
+          request.body.deletionLocked,
+          user.id
+        );
+        return reply.send({
+          id: collection.id,
+          name: collection.name,
+          deletionLocked: collection.deletionLocked
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "DELETE",
+    url: "/admin/environments/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes an environment regardless of deletion lock state.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const environment = await db.findEnvironmentById(request.params.id);
+        if (!environment) {
+          void reply.code(404).send({ error: "Environment not found" });
+          return;
+        }
+        await db.deleteEnvironment(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/admin/environments/:id",
+    schema: {
+      params: idParamSchema,
+      body: updateAdminEnvironmentBodySchema,
+      response: {
+        200: adminEntityConfigSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Updates admin configuration for an environment.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const environment = await db.setEnvironmentDeletionLocked(
+          request.params.id,
+          request.body.deletionLocked,
+          user.id
+        );
+        return reply.send({
+          id: environment.id,
+          name: environment.name,
+          deletionLocked: environment.deletionLocked
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
   routes.route({
     method: "GET",
     url: "/admin/llm/models",
@@ -6346,6 +6914,7 @@ async function registerAdminRoutes(app, options) {
      * Lists all hub-offered LLM models for operator user management.
      */
     handler: async (request, reply) => {
+      const llm = getLlm();
       if (!llm) {
         return sendLlmUnavailable(reply);
       }
@@ -6397,6 +6966,7 @@ async function registerAdminRoutes(app, options) {
         }
         const input = buildAdminUserUpdateInput(existing, request.body);
         const role = request.body.role ?? existing.role;
+        const llm = getLlm();
         const [collections, environments] = await Promise.all([
           db.listCollections(),
           db.listEnvironments()
@@ -6586,6 +7156,31 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "POST",
+    url: "/admin/config/reload",
+    schema: {
+      response: {
+        200: reloadConfigResponseSchema,
+        400: reloadConfigResponseSchema,
+        403: errorResponseSchema
+      }
+    },
+    /**
+     * Re-reads server.yaml and applies reloadable config sections on a best-effort basis.
+     */
+    handler: async (request, reply) => {
+      const user = requireAuthenticatedUser(request);
+      if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+        return;
+      }
+      const result = await reloadConfig();
+      if (result.fatalError) {
+        return reply.code(400).send(result);
+      }
+      return reply.send(result);
+    }
+  });
 }
 
 // src/server/auth/sessionCapabilities.ts
@@ -6761,6 +7356,14 @@ async function registerCollectionRoutes(app, db) {
         )) {
           return;
         }
+        const collection = await db.findCollectionById(request.params.id);
+        if (!collection) {
+          void reply.code(404).send({ error: "Collection not found" });
+          return;
+        }
+        if (collection.deletionLocked) {
+          throw new DeletionLockedError("collection");
+        }
         await db.deleteCollection(request.params.id, user.id);
         return reply.code(204).send(null);
       } catch (error) {
@@ -6790,7 +7393,7 @@ async function registerEnvironmentRoutes(app, db) {
     handler: async (request, reply) => {
       try {
         const user = requireAuthenticatedUser(request);
-        if (denyUnlessAllowed(reply, canUseDataApi(user))) {
+        if (denyUnlessAllowed(reply, canListEnvironments(user))) {
           return;
         }
         const environments = await db.listEnvironments();
@@ -6897,6 +7500,14 @@ async function registerEnvironmentRoutes(app, db) {
         )) {
           return;
         }
+        const environment = await db.findEnvironmentById(request.params.id);
+        if (!environment) {
+          void reply.code(404).send({ error: "Environment not found" });
+          return;
+        }
+        if (environment.deletionLocked) {
+          throw new DeletionLockedError("environment");
+        }
         await db.deleteEnvironment(request.params.id, user.id);
         return reply.code(204).send(null);
       } catch (error) {
@@ -7523,14 +8134,15 @@ async function registerLlmRoutes(app, options) {
      * Lists hub-offered models the authenticated user may use.
      */
     handler: async (request, reply) => {
-      if (!options.llm) {
+      const llm = options.getLlm();
+      if (!llm) {
         return sendLlmUnavailable2(reply);
       }
       const user = requireAuthenticatedUser(request);
       if (denyUnlessAllowed(reply, canUseLlm(user))) {
         return;
       }
-      const offered = listHubOfferedModels(options.llm).filter(
+      const offered = listHubOfferedModels(llm).filter(
         (model) => isLlmModelAllowed(user, model.id)
       );
       return reply.send({
@@ -7556,7 +8168,8 @@ async function registerLlmRoutes(app, options) {
      * Returns the authenticated user's current monthly LLM usage summary.
      */
     handler: async (request, reply) => {
-      if (!options.llm) {
+      const llm = options.getLlm();
+      if (!llm) {
         return sendLlmUnavailable2(reply);
       }
       const user = requireAuthenticatedUser(request);
@@ -7588,7 +8201,8 @@ async function registerLlmRoutes(app, options) {
      * Runs one stateless LLM completion step using hub-configured provider keys.
      */
     handler: async (request, reply) => {
-      if (!options.llm) {
+      const llm = options.getLlm();
+      if (!llm) {
         return sendLlmUnavailable2(reply);
       }
       const user = requireAuthenticatedUser(request);
@@ -7596,7 +8210,7 @@ async function registerLlmRoutes(app, options) {
         return;
       }
       const { model, messages, tools, systemPrompt } = request.body;
-      if (!isHubModelOffered(options.llm, model)) {
+      if (!isHubModelOffered(llm, model)) {
         return reply.code(403).send({ error: "Model is not offered by this Team Hub." });
       }
       if (!isLlmModelAllowed(user, model)) {
@@ -7610,7 +8224,7 @@ async function registerLlmRoutes(app, options) {
       if (isNewTurn && isOverMonthlyLimit(totalTokens, user.llmMonthlyTokenLimit)) {
         return sendMonthlyLimitExceeded(reply);
       }
-      const result = await runLlmCompletion(options.llm, {
+      const result = await runLlmCompletion(llm, {
         model,
         messages,
         tools,
@@ -7648,6 +8262,43 @@ async function registerLlmRoutes(app, options) {
   });
 }
 
+// src/server/routes/schemas/plugins.ts
+import { z as z11 } from "zod/v4";
+var pluginSourcesResponseSchema = z11.object({
+  catalogs: z11.array(z11.string()),
+  trusted: z11.array(z11.string())
+});
+
+// src/server/routes/plugins.ts
+async function registerPluginsRoutes(app, options) {
+  const routes = app.withTypeProvider();
+  routes.route({
+    method: "GET",
+    url: "/plugins/sources",
+    schema: {
+      response: {
+        200: pluginSourcesResponseSchema
+      }
+    },
+    /**
+     * Returns plugin catalog and trusted-publisher URLs configured on this Team Hub.
+     */
+    handler: async (_request, reply) => {
+      const plugins = options.getPlugins();
+      if (!plugins) {
+        return reply.send({
+          catalogs: [],
+          trusted: []
+        });
+      }
+      return reply.send({
+        catalogs: plugins.catalogs,
+        trusted: plugins.trusted
+      });
+    }
+  });
+}
+
 // src/server/auth/bearerAuthPlugin.ts
 function registerBearerAuthDecorator(app) {
   app.decorateRequest("apiToken", null);
@@ -7658,8 +8309,8 @@ function buildAuthThrottleKey(request, token) {
   return `${request.ip}:${tokenPart}`;
 }
 function createBearerAuthHook(db, throttleStore) {
-  const policy = throttleStore.getPolicy();
   return async function bearerAuth(request, reply) {
+    const policy = throttleStore.getPolicy();
     const token = extractBearer(request.headers.authorization);
     const throttleKey = buildAuthThrottleKey(request, token);
     try {
@@ -7714,12 +8365,17 @@ async function registerProtectedRoutes(app, options) {
   registerBearerAuthDecorator(app);
   app.addHook("onRequest", createBearerAuthHook(options.db, options.throttleStore));
   await registerAuthRoutes(app);
-  await registerAdminRoutes(app, { db: options.db, llm: options.llm });
+  await registerAdminRoutes(app, {
+    db: options.db,
+    getLlm: options.getLlm,
+    reloadConfig: options.reloadConfig
+  });
   await registerCollectionRoutes(app, options.db);
   await registerEnvironmentRoutes(app, options.db);
   await registerFolderRoutes(app, options.db);
   await registerRequestRoutes(app, options.db);
-  await registerLlmRoutes(app, { db: options.db, llm: options.llm });
+  await registerLlmRoutes(app, { db: options.db, getLlm: options.getLlm });
+  await registerPluginsRoutes(app, { getPlugins: options.getPlugins });
 }
 async function registerRoutes(app, options) {
   await app.register(async (publicApp) => {
@@ -7731,21 +8387,36 @@ async function registerRoutes(app, options) {
 }
 
 // src/server/createServer.ts
-async function createServer(config, options) {
+async function createServer(ctxOrConfig, options = {}) {
+  const isRuntimeContext = "getLlm" in ctxOrConfig && "configPath" in ctxOrConfig;
+  const ctx = isRuntimeContext ? ctxOrConfig : null;
+  const legacyConfig = isRuntimeContext ? null : ctxOrConfig;
+  const db = options.db ?? ctx?.db;
+  const throttleStore = options.throttleStore ?? ctx?.throttleStore;
+  if (!db || !throttleStore) {
+    throw new Error("createServer requires db and throttleStore.");
+  }
+  const logger = options.logger ?? ctx?.logger ?? createLogger(legacyConfig?.logging ?? DEFAULT_LOGGING_CONFIG);
   const app = Fastify({
     logger: options.verbose ?? false
   }).withTypeProvider();
   app.setValidatorCompiler(validatorCompiler);
   app.setSerializerCompiler(serializerCompiler);
+  registerHttpLogging(app, logger);
   await registerRoutes(app, {
     version: options.version ?? readPackageVersion(),
-    db: options.db,
-    throttleStore: options.throttleStore,
-    llm: config.llm
+    db,
+    throttleStore,
+    getLlm: ctx ? () => ctx.getLlm() : () => legacyConfig?.llm ?? null,
+    getPlugins: ctx ? () => ctx.getPlugins() : () => legacyConfig?.plugins ?? null,
+    reloadConfig: options.reloadConfig ?? (async () => ({ sections: [] }))
   });
   return app;
 }
 
+// src/server/runtimeContext.ts
+import { isDeepStrictEqual } from "util";
+
 // src/server/auth/throttle/RedisThrottleStore.ts
 import Redis from "ioredis";
 
@@ -7885,6 +8556,151 @@ function createThrottleStore(config) {
   return RedisThrottleStore.fromConfig(config);
 }
 
+// src/server/runtimeContext.ts
+var runtimeContextStates = /* @__PURE__ */ new WeakMap();
+function createSwappableProxy(holder) {
+  return new Proxy({}, {
+    /**
+     * Forwards property reads to the current underlying instance.
+     */
+    get(_target, prop) {
+      const value = Reflect.get(holder.underlying, prop, holder.underlying);
+      if (typeof value === "function") {
+        return value.bind(holder.underlying);
+      }
+      return value;
+    }
+  });
+}
+function getState(ctx) {
+  const state = runtimeContextStates.get(ctx);
+  if (!state) {
+    throw new Error("Invalid runtime context.");
+  }
+  return state;
+}
+function formatReloadError(error) {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return String(error);
+}
+function createRuntimeContext(config, configPath) {
+  const state = {
+    configPath,
+    host: config.host,
+    port: config.port,
+    activeDbConfig: config.db,
+    activeRedisConfig: config.redis,
+    dbHolder: { underlying: createDatabase(config.db) },
+    throttleHolder: { underlying: createThrottleStore(config.redis) },
+    llm: config.llm,
+    plugins: config.plugins
+  };
+  const ctx = {
+    configPath: state.configPath,
+    get host() {
+      return state.host;
+    },
+    get port() {
+      return state.port;
+    },
+    db: createSwappableProxy(state.dbHolder),
+    throttleStore: createSwappableProxy(state.throttleHolder),
+    getLlm: () => state.llm,
+    getPlugins: () => state.plugins,
+    logger: createLogger(config.logging)
+  };
+  runtimeContextStates.set(ctx, state);
+  return ctx;
+}
+async function connectRuntimeContext(ctx) {
+  const state = getState(ctx);
+  await state.dbHolder.underlying.connect();
+  await state.throttleHolder.underlying.connect();
+}
+async function disconnectAll(ctx) {
+  const state = getState(ctx);
+  await state.dbHolder.underlying.disconnect();
+  await state.throttleHolder.underlying.disconnect();
+}
+async function reloadDbSection(state, nextDbConfig) {
+  if (isDeepStrictEqual(state.activeDbConfig, nextDbConfig)) {
+    return { section: "db", status: "unchanged" };
+  }
+  try {
+    const nextDb = createDatabase(nextDbConfig);
+    await nextDb.connect();
+    const previousDb = state.dbHolder.underlying;
+    state.dbHolder.underlying = nextDb;
+    state.activeDbConfig = nextDbConfig;
+    await previousDb.disconnect();
+    return { section: "db", status: "reloaded" };
+  } catch (error) {
+    return { section: "db", status: "failed", error: formatReloadError(error) };
+  }
+}
+async function reloadRedisSection(state, nextRedisConfig) {
+  if (isDeepStrictEqual(state.activeRedisConfig, nextRedisConfig)) {
+    return { section: "redis", status: "unchanged" };
+  }
+  try {
+    const nextStore = createThrottleStore(nextRedisConfig);
+    await nextStore.connect();
+    const previousStore = state.throttleHolder.underlying;
+    state.throttleHolder.underlying = nextStore;
+    state.activeRedisConfig = nextRedisConfig;
+    await previousStore.disconnect();
+    return { section: "redis", status: "reloaded" };
+  } catch (error) {
+    return { section: "redis", status: "failed", error: formatReloadError(error) };
+  }
+}
+function reloadServerSection(state, nextConfig) {
+  if (state.host === nextConfig.host && state.port === nextConfig.port) {
+    return { section: "server", status: "unchanged" };
+  }
+  return {
+    section: "server",
+    status: "restart-required",
+    error: "Changes to server.host or server.port require a full process restart."
+  };
+}
+async function reloadRuntimeConfig(ctx) {
+  const state = getState(ctx);
+  let nextConfig;
+  try {
+    nextConfig = loadServerConfig(state.configPath);
+  } catch (error) {
+    const message = error instanceof ConfigError ? error.message : formatReloadError(error);
+    return { sections: [], fatalError: message };
+  }
+  const sections = [];
+  sections.push(await reloadDbSection(state, nextConfig.db));
+  sections.push(await reloadRedisSection(state, nextConfig.redis));
+  state.llm = nextConfig.llm;
+  sections.push({ section: "llm", status: "reloaded" });
+  state.plugins = nextConfig.plugins;
+  sections.push({ section: "plugins", status: "reloaded" });
+  sections.push(reloadServerSection(state, nextConfig));
+  return { sections };
+}
+function formatConfigReloadSummary(result) {
+  return result.sections.map((section) => {
+    if (section.error) {
+      return `${section.section}: ${section.status} (${section.error})`;
+    }
+    return `${section.section}: ${section.status}`;
+  }).join(", ");
+}
+function logConfigReloadResult(result) {
+  if (result.fatalError) {
+    console.error(`Team Hub config reload failed: ${result.fatalError}`);
+    return;
+  }
+  console.log(`Team Hub config reloaded (${formatConfigReloadSummary(result)}).`);
+}
+
 // src/server.ts
 function formatListenAddress(address, port) {
   if (!address) {
@@ -7896,12 +8712,11 @@ function formatListenAddress(address, port) {
   const host = address.includes(":") && !address.startsWith("[") ? `[${address}]` : address;
   return `http://${host}:${port}`;
 }
-function registerGracefulShutdown(app, db, throttleStore) {
+function registerGracefulShutdown(app, ctx) {
   const shutdown = async (signal) => {
     app.log.info(`Received ${signal}, shutting down.`);
     await app.close();
-    await db.disconnect();
-    await throttleStore.disconnect();
+    await disconnectAll(ctx);
     process.exit(0);
   };
   process.once("SIGINT", () => {
@@ -7911,33 +8726,42 @@ function registerGracefulShutdown(app, db, throttleStore) {
     void shutdown("SIGTERM");
   });
 }
-async function runServer(config, options) {
-  const app = await createServer(config, {
+function registerConfigReloadHandler(reloadConfig) {
+  process.on("SIGHUP", () => {
+    void reloadConfig();
+  });
+}
+async function runServer(ctx, options = {}) {
+  const reloadConfig = async () => {
+    const result = await reloadRuntimeConfig(ctx);
+    logConfigReloadResult(result);
+    return result;
+  };
+  const app = await createServer(ctx, {
     verbose: options.verbose,
-    db: options.db,
-    throttleStore: options.throttleStore
+    reloadConfig
   });
-  await options.db.connect();
-  await options.throttleStore.connect();
+  await connectRuntimeContext(ctx);
   await app.listen({
-    host: config.host,
-    port: config.port
+    host: ctx.host,
+    port: ctx.port
   });
   const address = app.server.address();
-  const port = typeof address === "object" && address ? address.port : config.port;
-  const host = typeof address === "object" && address ? address.address : config.host;
+  const port = typeof address === "object" && address ? address.port : ctx.port;
+  const host = typeof address === "object" && address ? address.address : ctx.host;
   if (options.verbose) {
-    console.log("Starting server with config:", config);
+    console.log("Starting server with config path:", ctx.configPath);
   }
   console.log(`Team Hub listening on ${formatListenAddress(host, port)}`);
-  registerGracefulShutdown(app, options.db, options.throttleStore);
+  registerGracefulShutdown(app, ctx);
+  registerConfigReloadHandler(reloadConfig);
   return app;
 }
 async function startCommand(options) {
+  const configPath = resolveConfigPath(options.config);
   const config = loadServerConfig(options.config);
-  const db = createDatabase(config.db);
-  const throttleStore = createThrottleStore(config.redis);
-  await runServer(config, { verbose: options.verbose, db, throttleStore });
+  const ctx = createRuntimeContext(config, configPath);
+  await runServer(ctx, { verbose: options.verbose });
 }
 function registerStartCommand(program, handler = startCommand) {
   program.command("start").description("Start the Team Hub server").action(