pgserve 2.1.3 → 2.2.1

package/src/cli-ui.cjs

@@ -0,0 +1,580 @@
+/**
+ * `autopg ui [--port N] [--no-open]` (also reachable via `pgserve ui`).
+ *
+ * Boots a tiny http server bound to 127.0.0.1 that:
+ *   - serves the static console at `console/` (React + Babel CDN, no build).
+ *   - exposes 4 helper endpoints used by the SPA:
+ *       GET  /api/settings   → { settings, sources, etag }
+ *       PUT  /api/settings   → writeSettings + If-Match etag check
+ *       POST /api/restart    → invokes cli-restart.dispatch
+ *       GET  /api/status     → shells out to the existing wave-1 status
+ *
+ * Single-user dev tool: 127.0.0.1 only, no auth, no TLS. Designed to ride
+ * inside an operator's localhost session — not to be exposed.
+ *
+ * Port selection:
+ *   --port N      → bind exactly N or fail.
+ *   (no flag)     → walk 8433..8533 picking the first free port.
+ *
+ * Browser opening:
+ *   --no-open     → skip browser launch (CI/headless paths).
+ *   default       → `open` (macOS) / `xdg-open` (Linux) / `start` (Windows).
+ */
+
+'use strict';
+
+const http = require('node:http');
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawn, execFileSync } = require('node:child_process');
+
+const { loadEffectiveConfig, getSettingsPath } = require('./settings-loader.cjs');
+const { writeSettings } = require('./settings-writer.cjs');
+const cliRestart = require('./cli-restart.cjs');
+
+// `pg` is a devDependency today — graceful degradation if not installed.
+// /api/stats returns { ok: false, reason: 'pg-not-installed' } in that case.
+let PgClient = null;
+try { PgClient = require('pg').Client; } catch { /* optional */ }
+const {
+  ValidationError,
+  EtagMismatchError,
+  ERROR_CODES,
+} = require('./settings-validator.cjs');
+
+const PORT_RANGE_START = 8433;
+const PORT_RANGE_END = 8533;
+const HOST = '127.0.0.1';
+
+const MIME_TYPES = {
+  '.html': 'text/html; charset=utf-8',
+  '.htm': 'text/html; charset=utf-8',
+  '.js': 'application/javascript; charset=utf-8',
+  '.mjs': 'application/javascript; charset=utf-8',
+  '.jsx': 'application/javascript; charset=utf-8',
+  '.cjs': 'application/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.ico': 'image/x-icon',
+  '.txt': 'text/plain; charset=utf-8',
+  '.woff': 'font/woff',
+  '.woff2': 'font/woff2',
+};
+
+function parseArgs(args) {
+  const out = { port: null, noOpen: false, host: HOST };
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === '--port') {
+      const v = args[++i];
+      const n = Number.parseInt(v, 10);
+      if (!Number.isInteger(n) || n < 1 || n > 65535) {
+        throw new Error(`invalid --port "${v}"`);
+      }
+      out.port = n;
+    } else if (a === '--no-open') {
+      out.noOpen = true;
+    } else if (a === '--host') {
+      // Defense: still bind 127.0.0.1 unless explicitly opted out via env.
+      // We accept --host for parity but ignore non-loopback values.
+      const v = args[++i];
+      if (v === '127.0.0.1' || v === 'localhost') {
+        out.host = v;
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Try to bind a server on each candidate port until one succeeds.
+ * Returns a Promise<{server, port}>. Rejects if no port in the range works.
+ */
+function listenWithFallback(server, host, preferredPort) {
+  const candidates = preferredPort
+    ? [preferredPort]
+    : (() => {
+        const list = [];
+        for (let p = PORT_RANGE_START; p <= PORT_RANGE_END; p++) list.push(p);
+        return list;
+      })();
+
+  return new Promise((resolve, reject) => {
+    let i = 0;
+    function attempt() {
+      if (i >= candidates.length) {
+        reject(
+          new Error(
+            preferredPort
+              ? `port ${preferredPort} is not available`
+              : `no free port in ${PORT_RANGE_START}-${PORT_RANGE_END}`,
+          ),
+        );
+        return;
+      }
+      const port = candidates[i++];
+      const onErr = (err) => {
+        if (err.code === 'EADDRINUSE' && !preferredPort) {
+          server.removeListener('error', onErr);
+          attempt();
+          return;
+        }
+        reject(err);
+      };
+      server.once('error', onErr);
+      server.listen(port, host, () => {
+        server.removeListener('error', onErr);
+        resolve({ server, port });
+      });
+    }
+    attempt();
+  });
+}
+
+/**
+ * Resolve the static document root. The console directory lives at the
+ * repo root (alongside `bin/` and `src/`). When the package is installed
+ * via npm the `files` allowlist preserves the layout.
+ */
+function resolveConsoleRoot() {
+  // src/ → repo root → console/
+  return path.resolve(__dirname, '..', 'console');
+}
+
+/**
+ * Sanitize a request path against directory traversal, return the absolute
+ * file path on disk or null if the request escapes the document root.
+ */
+function safeJoin(root, urlPath) {
+  // Strip query string defensively even though the caller already removed it.
+  const clean = urlPath.split('?')[0];
+  // Normalize then refuse anything starting with `..` or absolute outside
+  // the root.
+  const decoded = decodeURIComponent(clean);
+  const normalized = path.posix.normalize(decoded).replace(/^\/+/, '');
+  const candidate = path.resolve(root, normalized);
+  if (!candidate.startsWith(`${root}${path.sep}`) && candidate !== root) {
+    return null;
+  }
+  return candidate;
+}
+
+function sendJson(res, status, payload) {
+  const body = JSON.stringify(payload);
+  res.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'content-length': Buffer.byteLength(body),
+    'cache-control': 'no-store',
+  });
+  res.end(body);
+}
+
+function sendError(res, status, code, message, extra = {}) {
+  sendJson(res, status, { error: { code, message, ...extra } });
+}
+
+function readBody(req, { limitBytes = 1_048_576 } = {}) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let total = 0;
+    req.on('data', (chunk) => {
+      total += chunk.length;
+      if (total > limitBytes) {
+        reject(new Error('request body too large'));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on('end', () => {
+      try {
+        const raw = Buffer.concat(chunks).toString('utf8');
+        if (!raw) return resolve({});
+        resolve(JSON.parse(raw));
+      } catch (err) {
+        reject(err);
+      }
+    });
+    req.on('error', reject);
+  });
+}
+
+// ─── handlers ────────────────────────────────────────────────────────────
+
+function handleGetSettings(req, res) {
+  try {
+    const { settings, sources, etag, path: settingsPath } = loadEffectiveConfig();
+    sendJson(res, 200, { settings, sources, etag, path: settingsPath });
+  } catch (err) {
+    sendError(res, 500, 'LOAD_FAILED', err.message ?? String(err));
+  }
+}
+
+async function handlePutSettings(req, res) {
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (err) {
+    sendError(res, 400, 'BAD_BODY', err.message ?? 'invalid JSON');
+    return;
+  }
+  const ifMatch = req.headers['if-match'];
+  if (!ifMatch) {
+    sendError(res, 428, 'PRECONDITION_REQUIRED', 'If-Match header required');
+    return;
+  }
+  try {
+    // Merge the patch onto the current effective tree before writing so
+    // partial PUTs only touch the supplied keys. The writer re-validates.
+    const { settings: current } = loadEffectiveConfig();
+    const merged = deepMergePlain(current, body);
+    const { etag } = writeSettings(merged, { ifMatch });
+    sendJson(res, 200, { ok: true, etag });
+  } catch (err) {
+    if (err instanceof EtagMismatchError) {
+      sendJson(res, 409, {
+        error: {
+          code: ERROR_CODES.ETAG_MISMATCH,
+          message: 'settings changed on disk; reload before retry',
+        },
+        currentEtag: err.currentEtag,
+      });
+      return;
+    }
+    if (err instanceof ValidationError) {
+      sendError(res, 400, err.code, err.detail ?? err.message, { field: err.field });
+      return;
+    }
+    sendError(res, 500, 'WRITE_FAILED', err.message ?? String(err));
+  }
+}
+
+function deepMergePlain(base, patch) {
+  if (!patch || typeof patch !== 'object' || Array.isArray(patch)) return base;
+  const out = base && typeof base === 'object' && !Array.isArray(base) ? { ...base } : {};
+  for (const [key, value] of Object.entries(patch)) {
+    if (
+      value &&
+      typeof value === 'object' &&
+      !Array.isArray(value) &&
+      out[key] &&
+      typeof out[key] === 'object' &&
+      !Array.isArray(out[key])
+    ) {
+      out[key] = deepMergePlain(out[key], value);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+function handlePostRestart(req, res, ctx) {
+  try {
+    const code = cliRestart.dispatch([], { scriptPath: ctx.scriptPath });
+    if (code === 0) {
+      sendJson(res, 200, { ok: true });
+    } else {
+      sendError(res, 500, 'RESTART_FAILED', `restart exited with code ${code}`);
+    }
+  } catch (err) {
+    sendError(res, 500, 'RESTART_FAILED', err.message ?? String(err));
+  }
+}
+
+function handleGetStatus(req, res, ctx) {
+  // The existing wave-1 `status --json` flow returns the canonical shape.
+  // Shell out via the wrapper so the response mirrors what an operator
+  // would see at the CLI.
+  try {
+    if (ctx.statusOverride) {
+      sendJson(res, 200, ctx.statusOverride());
+      return;
+    }
+    const out = execFileSync(process.execPath, [ctx.scriptPath, 'status', '--json'], {
+      encoding: 'utf8',
+      timeout: 5000,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const trimmed = out.trim();
+    sendJson(res, 200, trimmed ? JSON.parse(trimmed) : {});
+  } catch (err) {
+    // `pgserve status` exits 1 when not installed but still prints JSON.
+    // Surface the parsed payload when present; otherwise wrap the error.
+    const stdout = err?.stdout ? err.stdout.toString().trim() : '';
+    if (stdout) {
+      try {
+        sendJson(res, 200, JSON.parse(stdout));
+        return;
+      } catch {
+        // fall through
+      }
+    }
+    sendError(res, 500, 'STATUS_FAILED', err.message ?? String(err));
+  }
+}
+
+// Cached package.json — read once at module load so we never block on disk.
+const PKG_VERSION = (() => {
+  try { return require('../package.json').version; } catch { return 'unknown'; }
+})();
+
+async function handleGetStats(req, res) {
+  if (!PgClient) {
+    sendJson(res, 200, {
+      ok: false,
+      reason: 'pg-not-installed',
+      autopg: { version: PKG_VERSION },
+    });
+    return;
+  }
+  let client;
+  try {
+    const { settings } = loadEffectiveConfig();
+    const server = settings.server || {};
+    client = new PgClient({
+      host: server.host || '127.0.0.1',
+      port: server.port || 8432,
+      database: 'postgres',
+      user: server.pgUser || 'postgres',
+      password: server.pgPassword || 'postgres',
+      connectionTimeoutMillis: 1500,
+      query_timeout: 1500,
+    });
+    client.on('error', () => {}); // never crash the helper on PG hiccup
+    await client.connect();
+    // Single round-trip query covering everything the footer needs.
+    // pg_stat_activity gives client connections; pg_database the user-db
+    // count + total size; pg_stat_database the cache + xact aggregates;
+    // pg_settings for the short server_version (no parsing); and
+    // pg_postmaster_start_time for uptime.
+    const { rows: [row] } = await client.query(`
+      SELECT
+        (SELECT count(*)::int FROM pg_stat_activity
+          WHERE backend_type = 'client backend' AND pid <> pg_backend_pid()) AS connections,
+        (SELECT count(*)::int FROM pg_database
+          WHERE NOT datistemplate AND datname <> 'postgres') AS databases,
+        (SELECT setting FROM pg_settings WHERE name = 'server_version') AS pg_version,
+        EXTRACT(epoch FROM (now() - pg_postmaster_start_time()))::int AS uptime_sec,
+        (SELECT round(
+          100.0 * sum(blks_hit)::numeric
+            / nullif(sum(blks_hit) + sum(blks_read), 0),
+          2
+        )::float FROM pg_stat_database) AS cache_hit_pct,
+        (SELECT sum(xact_commit + xact_rollback)::bigint
+          FROM pg_stat_database) AS tx_total,
+        (SELECT sum(pg_database_size(datname))::bigint
+          FROM pg_database WHERE NOT datistemplate) AS size_bytes
+    `);
+    sendJson(res, 200, {
+      ok: true,
+      connections: row.connections,
+      databases: row.databases,
+      port: server.port || 8432,
+      pg: {
+        version: row.pg_version,
+        uptimeSec: row.uptime_sec,
+        cacheHitPct: row.cache_hit_pct,
+        txTotal: Number(row.tx_total ?? 0),
+        sizeBytes: Number(row.size_bytes ?? 0),
+      },
+      autopg: { version: PKG_VERSION },
+      ts: Date.now(),
+    });
+  } catch (err) {
+    sendJson(res, 200, {
+      ok: false,
+      reason: err.code || 'disconnected',
+      message: err.message,
+      autopg: { version: PKG_VERSION },
+    });
+  } finally {
+    if (client) {
+      try { await client.end(); } catch { /* already closed */ }
+    }
+  }
+}
+
+function handleStatic(req, res, root) {
+  let url = req.url.split('?')[0];
+  if (url === '/' || url === '') url = '/index.html';
+  const target = safeJoin(root, url);
+  if (!target) {
+    sendError(res, 400, 'BAD_PATH', 'invalid path');
+    return;
+  }
+  fs.stat(target, (statErr, stat) => {
+    if (statErr || !stat.isFile()) {
+      // SPA fallback: serve index.html on a miss so client routing works.
+      const fallback = path.join(root, 'index.html');
+      if (fs.existsSync(fallback)) {
+        serveFile(res, fallback);
+        return;
+      }
+      sendError(res, 404, 'NOT_FOUND', `no file at ${url}`);
+      return;
+    }
+    serveFile(res, target);
+  });
+}
+
+function serveFile(res, filePath) {
+  const ext = path.extname(filePath).toLowerCase();
+  const mime = MIME_TYPES[ext] || 'application/octet-stream';
+  fs.readFile(filePath, (err, data) => {
+    if (err) {
+      sendError(res, 500, 'READ_FAILED', err.message);
+      return;
+    }
+    res.writeHead(200, {
+      'content-type': mime,
+      'content-length': data.length,
+      'cache-control': 'no-cache',
+    });
+    res.end(data);
+  });
+}
+
+/**
+ * Build the request handler. `ctx.scriptPath` is the absolute path to
+ * `bin/pgserve-wrapper.cjs` (used for shell-outs). `ctx.consoleRoot`
+ * defaults to the repo's `console/` directory.
+ */
+function createHandler(ctx = {}) {
+  const consoleRoot = ctx.consoleRoot || resolveConsoleRoot();
+  return function handler(req, res) {
+    const url = req.url || '/';
+    const method = req.method || 'GET';
+
+    if (url.startsWith('/api/')) {
+      if (url === '/api/settings' && method === 'GET') return handleGetSettings(req, res);
+      if (url === '/api/settings' && method === 'PUT') return handlePutSettings(req, res);
+      if (url === '/api/restart' && method === 'POST') return handlePostRestart(req, res, ctx);
+      if (url === '/api/status' && method === 'GET') return handleGetStatus(req, res, ctx);
+      if (url === '/api/stats' && method === 'GET') return handleGetStats(req, res);
+      sendError(res, 404, 'NOT_FOUND', `${method} ${url}`);
+      return;
+    }
+
+    // Non-API → static file, GET/HEAD only.
+    if (method !== 'GET' && method !== 'HEAD') {
+      res.writeHead(405, { allow: 'GET, HEAD' });
+      res.end();
+      return;
+    }
+    handleStatic(req, res, consoleRoot);
+  };
+}
+
+/**
+ * Open a URL in the user's default browser. Best-effort: a failure is
+ * logged and the server keeps running. Operators can always copy the
+ * URL out of the boot banner.
+ */
+function openBrowser(url) {
+  let cmd;
+  let args;
+  if (process.platform === 'darwin') {
+    cmd = 'open';
+    args = [url];
+  } else if (process.platform === 'win32') {
+    cmd = 'cmd';
+    args = ['/c', 'start', '""', url];
+  } else {
+    cmd = 'xdg-open';
+    args = [url];
+  }
+  try {
+    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => {
+      process.stderr.write(`autopg: could not auto-open browser; visit ${url}\n`);
+    });
+    child.unref();
+  } catch {
+    process.stderr.write(`autopg: could not auto-open browser; visit ${url}\n`);
+  }
+}
+
+/**
+ * Boot the UI server. Resolves to `{ server, port, close }` so callers
+ * (and tests) can shut it down deterministically.
+ *
+ * In CLI mode, callers should pass `wireSignals: true` so SIGINT/SIGTERM
+ * stop the server cleanly and the process exits 0.
+ */
+async function startServer({ args = [], scriptPath, consoleRoot, wireSignals = false, openInBrowser = openBrowser } = {}) {
+  const opts = parseArgs(args);
+  const handler = createHandler({ scriptPath, consoleRoot });
+  const server = http.createServer(handler);
+  const { port } = await listenWithFallback(server, opts.host, opts.port);
+
+  const url = `http://${opts.host}:${port}`;
+  process.stdout.write(`autopg ui: listening on ${url}\n`);
+  process.stdout.write(`autopg ui: settings file is ${getSettingsPath()}\n`);
+
+  if (!opts.noOpen) {
+    openInBrowser(url);
+  }
+
+  function close() {
+    return new Promise((resolve) => server.close(() => resolve()));
+  }
+
+  if (wireSignals) {
+    const stop = async (sig) => {
+      process.stdout.write(`\nautopg ui: ${sig} received, shutting down\n`);
+      await close();
+      process.exit(0);
+    };
+    process.once('SIGINT', () => stop('SIGINT'));
+    process.once('SIGTERM', () => stop('SIGTERM'));
+  }
+
+  return { server, port, url, close };
+}
+
+/**
+ * CLI dispatch entry. Boots the server and parks until SIGINT/SIGTERM.
+ * Always returns 0 — the signal handlers exit the process directly.
+ */
+async function dispatch(args = [], ctx = {}) {
+  try {
+    await startServer({
+      args,
+      scriptPath: ctx.scriptPath,
+      consoleRoot: ctx.consoleRoot,
+      wireSignals: true,
+    });
+  } catch (err) {
+    process.stderr.write(`autopg ui: ${err.message ?? err}\n`);
+    return 1;
+  }
+  // Park forever — signal handlers terminate the process.
+  return new Promise(() => {});
+}
+
+module.exports = {
+  dispatch,
+  startServer,
+  createHandler,
+  parseArgs,
+  resolveConsoleRoot,
+  // Test surface
+  _internals: {
+    listenWithFallback,
+    safeJoin,
+    deepMergePlain,
+    handleGetSettings,
+    handlePutSettings,
+    handlePostRestart,
+    handleGetStatus,
+    openBrowser,
+    PORT_RANGE_START,
+    PORT_RANGE_END,
+  },
+};

package/src/cluster.js

@@ -16,6 +16,7 @@ import { createLogger } from './logger.js';
 import { PostgresManager } from './postgres.js';
 import { extractDatabaseName } from './protocol.js';
 import { EventEmitter } from 'events';
+import { loadEffectiveConfig } from './settings-loader.cjs';
 
 // PostgreSQL protocol constants
 const PROTOCOL_VERSION_3 = 196608;
@@ -427,21 +428,31 @@ export async function startClusterServer(options = {}) {
     const workers = new Map();
     const workerStats = new Map(); // Track stats from each worker
 
-    // Fork workers with PostgreSQL connection info
+    // Fork workers with PostgreSQL connection info.
+    //
+    // Pass through using AUTOPG_<X> (the primary names) so workers don't
+    // emit the legacy-PGSERVE deprecation log for our own internal IPC.
+    // PGSERVE_WORKER stays as-is — it's an internal flag, not part of the
+    // settings precedence chain.
+    const workerEnv = () => ({
+      PGSERVE_WORKER: 'true',
+      AUTOPG_PORT: String(port),
+      AUTOPG_HOST: host,
+      AUTOPG_PG_SOCKET: pgSocketPath || '',
+      AUTOPG_PG_PORT: String(pgPort),
+      AUTOPG_PG_USER: 'postgres',
+      AUTOPG_PG_PASSWORD: 'postgres',
+      AUTOPG_LOG_LEVEL: options.logLevel || 'info',
+      AUTOPG_AUTO_PROVISION: options.autoProvision !== false ? 'true' : 'false',
+      // max_connections is a postgres GUC, not a server-level env. Workers
+      // read it from settings.postgres via loadEffectiveConfig; we still
+      // ship the value here so a CLI override (e.g. `--max-connections`)
+      // reaches the worker before the daemon writes settings.json.
+      AUTOPG_MAX_CONNECTIONS: String(options.maxConnections || 1000),
+      AUTOPG_ENABLE_PGVECTOR: options.enablePgvector ? 'true' : 'false',
+    });
     for (let i = 0; i < numWorkers; i++) {
-      const worker = cluster.fork({
-        PGSERVE_WORKER: 'true',
-        PGSERVE_PORT: String(port),
-        PGSERVE_HOST: host,
-        PGSERVE_PG_SOCKET: pgSocketPath || '',
-        PGSERVE_PG_PORT: String(pgPort),
-        PGSERVE_PG_USER: 'postgres',
-        PGSERVE_PG_PASSWORD: 'postgres',
-        PGSERVE_LOG_LEVEL: options.logLevel || 'info',
-        PGSERVE_AUTO_PROVISION: options.autoProvision !== false ? 'true' : 'false',
-        PGSERVE_MAX_CONNECTIONS: String(options.maxConnections || 1000),
-        PGSERVE_ENABLE_PGVECTOR: options.enablePgvector ? 'true' : 'false'
-      });
+      const worker = cluster.fork(workerEnv());
       workers.set(worker.id, worker);
     }
 
@@ -457,19 +468,7 @@ export async function startClusterServer(options = {}) {
       }
 
       console.log(`[pgserve] Worker ${worker.id} died (${signal || code}), restarting...`);
-      const newWorker = cluster.fork({
-        PGSERVE_WORKER: 'true',
-        PGSERVE_PORT: String(port),
-        PGSERVE_HOST: host,
-        PGSERVE_PG_SOCKET: pgSocketPath || '',
-        PGSERVE_PG_PORT: String(pgPort),
-        PGSERVE_PG_USER: 'postgres',
-        PGSERVE_PG_PASSWORD: 'postgres',
-        PGSERVE_LOG_LEVEL: options.logLevel || 'info',
-        PGSERVE_AUTO_PROVISION: options.autoProvision !== false ? 'true' : 'false',
-        PGSERVE_MAX_CONNECTIONS: String(options.maxConnections || 1000),
-        PGSERVE_ENABLE_PGVECTOR: options.enablePgvector ? 'true' : 'false'
-      });
+      const newWorker = cluster.fork(workerEnv());
       workers.set(newWorker.id, newWorker);
     });
 
@@ -545,18 +544,24 @@ export async function startClusterServer(options = {}) {
       pgManager
     };
   } else {
-    // WORKER: Only run TCP routing, connect to PRIMARY's PostgreSQL
+    // WORKER: Only run TCP routing, connect to PRIMARY's PostgreSQL.
+    //
+    // Worker config comes from loadEffectiveConfig() (defaults < file < env).
+    // The primary fork() above sets PGSERVE_* env vars so existing supervised
+    // installs keep working; AUTOPG_* env vars take precedence when set, and
+    // a one-time deprecation note is emitted for legacy-only PGSERVE_* hits.
+    const { settings } = loadEffectiveConfig();
     const router = new ClusterRouter({
-      port: parseInt(process.env.PGSERVE_PORT) || 8432,
-      host: process.env.PGSERVE_HOST || '127.0.0.1',
-      pgSocketPath: process.env.PGSERVE_PG_SOCKET || null,
-      pgPort: parseInt(process.env.PGSERVE_PG_PORT) || 6432,
-      pgUser: process.env.PGSERVE_PG_USER || 'postgres',
-      pgPassword: process.env.PGSERVE_PG_PASSWORD || 'postgres',
-      logLevel: process.env.PGSERVE_LOG_LEVEL || 'info',
-      autoProvision: process.env.PGSERVE_AUTO_PROVISION === 'true',
-      maxConnections: parseInt(process.env.PGSERVE_MAX_CONNECTIONS) || 1000,
-      enablePgvector: process.env.PGSERVE_ENABLE_PGVECTOR === 'true'
+      port: settings.server.port,
+      host: settings.server.host,
+      pgSocketPath: settings.server.pgSocketPath || null,
+      pgPort: settings.server.pgPort,
+      pgUser: settings.server.pgUser,
+      pgPassword: settings.server.pgPassword,
+      logLevel: settings.runtime.logLevel,
+      autoProvision: settings.runtime.autoProvision,
+      maxConnections: settings.postgres.max_connections,
+      enablePgvector: settings.runtime.enablePgvector,
     });
 
     await router.start();