iatoolkit 2.41.0__tar.gz → 2.41.2__tar.gz

{iatoolkit-2.41.0/src/iatoolkit.egg-info → iatoolkit-2.41.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.41.0
+Version: 2.41.2
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.41.0 → iatoolkit-2.41.2}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.41.0"
+__version__ = "2.41.2"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.41.0 → iatoolkit-2.41.2}/src/iatoolkit/common/model_registry.py

@@ -46,6 +46,58 @@ SERVABLE_PROVIDERS: tuple[str, ...] = (
 )
 
 
+@dataclass(frozen=True)
+class RouteParam:
+    """One thing a provider needs to know before it can be reached.
+
+    `is_env_name` marks a value that is the *name* of a deployment environment
+    variable, not the secret itself: what gets stored is `OSS_LLM_API_KEY`, and the
+    value behind it is read at request time and never persisted here.
+    """
+
+    name: str
+    required: bool = True
+    is_env_name: bool = False
+    #: A regular expression the value must match, or None for "any non-empty".
+    pattern: str | None = None
+
+
+#: What each provider needs in order to be reached, keyed by provider.
+#:
+#: The single declaration behind three things: what a catalogue entry may store,
+#: what refuses to publish without it, and which fields a form draws. Kept beside
+#: SERVABLE_PROVIDERS because the two answer halves of the same question — which
+#: providers exist, and what each one needs.
+#:
+#: Most providers need nothing: their SDK knows its own endpoint, and the
+#: credential comes from the company's provider_api_keys mapping. The two that
+#: appear here are the ones whose endpoint is a decision.
+#:
+#: `openai_compatible` requires both, and that is the point of the whole feature:
+#: an entry that carries its own endpoint and credential is reachable on its own,
+#: instead of depending on a block in every company's own configuration file. Two
+#: self-hosted models on two different endpoints stop being impossible.
+#:
+#: `openrouter` allows both and requires neither: there is one OpenRouter for
+#: everyone and its base URL has a working default, so an entry only overrides
+#: when it has a reason to.
+PROVIDER_ROUTE_PARAMS: dict[str, tuple[RouteParam, ...]] = {
+    "openai_compatible": (
+        RouteParam("base_url", required=True, pattern=r"^https?://\S+$"),
+        RouteParam("api_key_env", required=True, is_env_name=True, pattern=r"^[A-Z][A-Z0-9_]*$"),
+    ),
+    "openrouter": (
+        RouteParam("base_url", required=False, pattern=r"^https?://\S+$"),
+        RouteParam("api_key_env", required=False, is_env_name=True, pattern=r"^[A-Z][A-Z0-9_]*$"),
+    ),
+}
+
+
+def route_params_for(provider: str | None) -> tuple[RouteParam, ...]:
+    """What this provider needs. Empty for the ones that need nothing."""
+    return PROVIDER_ROUTE_PARAMS.get(str(provider or "").strip().lower(), ())
+
+
 @singleton
 class ModelRegistry:
     """

{iatoolkit-2.41.0 → iatoolkit-2.41.2}/src/iatoolkit/core.py

@@ -170,11 +170,9 @@ class IAToolkit:
         def _run_warmup():
             try:
                 warmup_service = self._injector.get(WarmupService)
-                warmed_companies = warmup_service.warmup_startup_configured_companies(trigger="core_startup")
-                if warmed_companies:
-                    logging.info("🔥 Startup warm-up completed for companies=%s", warmed_companies)
-                else:
-                    logging.info("🔥 Startup warm-up skipped: no embedding provider enabled warmup_on_startup.")
+                woken_endpoints = warmup_service.warmup_startup_configured_companies(trigger="core_startup")
+                if woken_endpoints:
+                    logging.info("🔥 Startup warm-up completed for endpoints=%s", woken_endpoints)
             except Exception:
                 logging.exception("⚠️ Startup warm-up failed.")
 

{iatoolkit-2.41.0 → iatoolkit-2.41.2}/src/iatoolkit/infra/llm_proxy.py

@@ -23,6 +23,7 @@ from iatoolkit.services.telemetry_service import NoopTelemetryService
 from openai import OpenAI, Timeout         # For OpenAI and xAI (OpenAI-compatible)
 
 from typing import Dict, List, Any, Tuple
+import os
 import threading
 import logging
 from injector import inject
@@ -586,11 +587,13 @@ class LLMProxy:
     ) -> dict:
         provider_config = self.configuration_service.get_llm_provider_config(company_short_name, provider) or {}
         secret_ref = self._model_credential_ref(model_config)
+        route_api_key_env = str(self._model_route(model_config).get("api_key_env") or "").strip() or None
         provider_api_key = self._get_api_key_from_config(
             company_short_name,
             provider,
             required=False,
             secret_ref=secret_ref,
+            route_api_key_env=route_api_key_env,
         )
         gateway_transport = self.gateway_resolver.resolve(
             company_short_name=company_short_name,
@@ -612,8 +615,9 @@ class LLMProxy:
                 provider,
                 required=True,
                 secret_ref=secret_ref,
+                route_api_key_env=route_api_key_env,
             )
-        configured_base_url = self._get_base_url_from_config(company_short_name, provider)
+        configured_base_url = self._get_base_url_from_config(company_short_name, provider, model_config=model_config)
         configured_headers = self._get_default_headers_from_config(company_short_name, provider)
         effective_base_url = gateway_transport.get("base_url") or configured_base_url
         effective_headers = dict(configured_headers)
@@ -726,6 +730,20 @@ class LLMProxy:
     # -------------------------------------------------------------------------
     # Configuration helpers
     # -------------------------------------------------------------------------
+    @staticmethod
+    def _model_route(model_config: Dict[str, Any] | None) -> Dict[str, Any]:
+        """The endpoint and credential variable this model carries, if any.
+
+        Comes from the catalogue entry, so two models of the same provider can sit
+        on two different endpoints — which is what `openai_compatible` could not do
+        while the endpoint lived in each company's own configuration file.
+
+        Empty means "ask the company's configuration", which is what every model
+        did before entries had routes.
+        """
+        route = (model_config or {}).get("route_config") if isinstance(model_config, dict) else None
+        return dict(route) if isinstance(route, dict) else {}
+
     @staticmethod
     def _model_credential_ref(model_config: Dict[str, Any] | None) -> str | None:
         """The secret this model is entitled to run on, when the company owns it.
@@ -753,6 +771,7 @@ class LLMProxy:
         *,
         required: bool = True,
         secret_ref: str | None = None,
+        route_api_key_env: str | None = None,
     ) -> str:
         """
         Read the LLM API key from company configuration and environment variables.
@@ -774,20 +793,36 @@ class LLMProxy:
         provider_keys = llm_config.get("provider_api_keys") or {}
         env_var_name = None
 
-        # 0) El secreto de la habilitación del modelo, cuando la empresa trae su
-        #    propia key. Gana sobre el mapeo del archivo porque es la decisión
-        #    explícita y por modelo; el mapeo es del deployment y por proveedor.
-        # 0) El secreto de la habilitación del modelo, cuando la empresa trae su
-        #    propia key. Gana sobre el mapeo del archivo porque es la decisión
-        #    explícita y por modelo; el mapeo es del deployment y por proveedor.
+        # Tres orígenes, en este orden, y el orden es la decisión:
+        #
+        # 1) El secreto de la habilitación del modelo, cuando la empresa trae su
+        #    propia key. Es la decisión explícita y por modelo de quién paga, así
+        #    que gana sobre todo lo demás.
+        # 2) La credencial de la ruta del catálogo, leída del entorno del
+        #    deployment y **no** del store de secretos de la empresa: el endpoint es
+        #    del operador, y un cliente que guarde un secreto con ese nombre no
+        #    debería apropiárselo en silencio. Quien quiera pagar con su key usa (1).
+        # 3) El mapeo del archivo de la empresa, que es el respaldo para todo lo que
+        #    no tiene ruta propia — es decir, todo lo que existía antes de esto.
         if secret_ref:
             env_var_name = secret_ref
 
-        # 1) Intentar api-key específica por proveedor (si existe el bloque provider_api_keys)
+        if not env_var_name and route_api_key_env:
+            route_value = str(os.getenv(route_api_key_env) or "").strip()
+            if route_value:
+                return route_value
+            if not required:
+                return ""
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.API_KEY,
+                f"Environment variable '{route_api_key_env}', named by the catalogue entry "
+                f"for provider '{provider}', is not set in this deployment."
+            )
+
         if not env_var_name and provider_keys and isinstance(provider_keys, dict):
             env_var_name = provider_keys.get(provider)
 
-        # 2) Fallback: usar api-key global si no hay específica
+        # Compatibilidad hacia atrás: api-key global cuando no hay una por proveedor.
         if not env_var_name and llm_config.get("api-key"):
             env_var_name = llm_config["api-key"]
 
@@ -818,10 +853,21 @@ class LLMProxy:
 
         return api_key_value
 
-    def _get_base_url_from_config(self, company_short_name: str, provider: str) -> str:
+    def _get_base_url_from_config(
+        self,
+        company_short_name: str,
+        provider: str,
+        model_config: Dict[str, Any] | None = None,
+    ) -> str:
         if provider not in {self.PROVIDER_OPENAI_COMPATIBLE, self.PROVIDER_OPENROUTER}:
             return ""
 
+        # The entry's own endpoint wins: it is the operator's decision about this
+        # model, while the company's configuration is a default for the provider.
+        route_base_url = str(self._model_route(model_config).get("base_url") or "").strip()
+        if route_base_url:
+            return route_base_url
+
         provider_config = self.configuration_service.get_llm_provider_config(company_short_name, provider) or {}
         if not isinstance(provider_config, dict):
             provider_config = {}

{iatoolkit-2.41.0 → iatoolkit-2.41.2}/src/iatoolkit/locales/en.yaml

@@ -703,6 +703,18 @@ ui:
     mode_external_sync: "External"
     mode_managed_help: "The wiki is edited from this workspace and pages are saved into storage."
     mode_external_sync_help: "The wiki stays read-only in IAToolkit and updates from the configured storage root."
+    access_control: "Access control"
+    access_mode_off: "Off"
+    access_mode_off_help: "Access labels are stored but no page is filtered."
+    access_mode_dry_run: "Dry run"
+    access_mode_dry_run_help: "What would be denied is computed and logged, but every page is still served."
+    access_mode_enforce: "Enforced"
+    access_mode_enforce_help: "A reader only gets pages whose labels they hold. The admin panel still sees everything."
+    access_coverage: "{labelled} of {pages} pages carry access labels."
+    access_coverage_gap: "{unlabelled} with no label: nobody sees those while access control is enforced."
+    access_mode_ok: "Access control mode updated."
+    access_mode_error: "Could not change the access control mode."
+    access_mode_confirm: "Once enforced, each user only sees pages whose labels they hold. Continue?"
     root: "Storage root"
     edit_root: "Edit storage root"
     lock_root: "Lock storage root editing"
@@ -2189,6 +2201,11 @@ ui:
     form_secret_value: "Your provider key"
     secret_hint_new: "Stored encrypted for this provider. Your provider bills you directly."
     secret_hint_stored: "A key is already stored for this provider. Paste one to replace it."
+    form_route_base_url: "Endpoint"
+    form_route_base_url_hint: "The full URL requests go to, e.g. https://your-host/v1"
+    form_route_api_key_env: "Credential variable"
+    form_route_api_key_env_hint: "The NAME of an environment variable in this deployment, e.g. OSS_LLM_API_KEY. Never the key itself."
+    route_required: "This provider needs an endpoint and the name of its credential variable."
   secrets:
     title: "Secrets"
     subtitle: "Manage company secrets used by integrations and services."

{iatoolkit-2.41.0 → iatoolkit-2.41.2}/src/iatoolkit/locales/es.yaml

@@ -705,6 +705,18 @@ ui:
     mode_external_sync: "Externa"
     mode_managed_help: "La wiki se edita desde esta interfaz y guarda sus páginas en storage."
     mode_external_sync_help: "La wiki queda de solo lectura en IAToolkit y se actualiza desde la raíz storage configurada."
+    access_control: "Control de acceso"
+    access_mode_off: "Desactivado"
+    access_mode_off_help: "Las etiquetas de acceso se guardan pero no se filtra ninguna página."
+    access_mode_dry_run: "Simulación"
+    access_mode_dry_run_help: "Se calcula y registra en el log qué páginas se negarían, pero se siguen entregando todas."
+    access_mode_enforce: "Activo"
+    access_mode_enforce_help: "Cada lector recibe solo las páginas cuyas etiquetas posee. El panel de administración sigue viendo todo."
+    access_coverage: "{labelled} de {pages} páginas con etiquetas de acceso."
+    access_coverage_gap: "{unlabelled} sin etiqueta: con el control activo no las ve nadie."
+    access_mode_ok: "Modo de control de acceso actualizado."
+    access_mode_error: "No se pudo cambiar el modo de control de acceso."
+    access_mode_confirm: "Al activarlo, cada usuario verá solo las páginas cuyas etiquetas posee. ¿Continuar?"
     root: "Raíz storage"
     edit_root: "Editar raíz storage"
     lock_root: "Bloquear edición de raíz storage"
@@ -2195,6 +2207,11 @@ ui:
     form_secret_value: "Tu key del proveedor"
     secret_hint_new: "Se guarda cifrada para este proveedor. Tu proveedor te factura directamente."
     secret_hint_stored: "Ya hay una key guardada para este proveedor. Pegá otra para reemplazarla."
+    form_route_base_url: "Endpoint"
+    form_route_base_url_hint: "La URL completa a la que van las requests, ej. https://tu-host/v1"
+    form_route_api_key_env: "Variable de la credencial"
+    form_route_api_key_env_hint: "El NOMBRE de una variable de entorno de este deployment, ej. OSS_LLM_API_KEY. Nunca la key."
+    route_required: "Este proveedor necesita un endpoint y el nombre de la variable con su credencial."
   secrets:
     title: "Secrets"
     subtitle: "Administra los secrets de la empresa usados por integraciones y servicios."

{iatoolkit-2.41.0 → iatoolkit-2.41.2}/src/iatoolkit/repositories/models.py

@@ -1241,6 +1241,20 @@ class ModelCatalogEntry(Base):
     model_key = Column(String(120), nullable=False, unique=True, index=True)
     provider = Column(String(60), nullable=False, index=True)
 
+    #: How to reach this model, when reaching it is a decision: the endpoint and
+    #: the name of the environment variable holding its credential.
+    #:
+    #: A JSON object rather than columns because providers do not agree on what
+    #: they need — an Azure deployment wants a deployment name and an api version,
+    #: a gateway may want headers — and `base_url` is meaningless for the
+    #: providers whose SDK knows its own. What may go in here is declared per
+    #: provider in `PROVIDER_ROUTE_PARAMS` and validated on write: an unvalidated
+    #: blob becomes decoration, and a typo in a key is silent.
+    #:
+    #: Empty means "ask the company's own configuration", which is what every
+    #: entry did before this existed.
+    route_config = Column(JSON, nullable=False, default=dict)
+
     display_name = Column(String(120), nullable=False)
     description = Column(Text, nullable=False, default="")
 

{iatoolkit-2.41.0 → iatoolkit-2.41.2}/src/iatoolkit/services/tenant_wiki_service.py

@@ -445,6 +445,25 @@ class TenantWikiService:
             "mcp_index_source_path": self._index_source_display_path(wiki, source_storage_key),
             "index_path": "/",
             "index_source_path": self._index_source_display_path(wiki, source_storage_key),
+            "access_control": self._access_summary(wiki),
+        }
+
+    def _access_summary(self, wiki: KnowledgeWiki) -> dict:
+        """
+        The wiki's access control state, for the admin panel: the mode in force
+        and how many pages carry labels. A page with none is denied to everyone
+        once the mode is enforce, so that count is the number an operator has to
+        look at before raising it.
+        """
+        access_control = self.wiki_access_control(wiki)
+        pages = self.knowledge_wiki_repo.list_pages(wiki.id, include_archived=False, limit=self.MAX_PAGES)
+        labelled = sum(1 for page in pages if (page.access_tags or []))
+        return {
+            **access_control,
+            "modes": list(self.ACCESS_MODES),
+            "pages": len(pages),
+            "labelled": labelled,
+            "unlabelled": len(pages) - labelled,
         }
 
     def get_page(
@@ -1004,6 +1023,96 @@ class TenantWikiService:
             )
             return None
 
+    def set_access_control_mode(
+        self,
+        company_short_name: str,
+        *,
+        wiki_key: str,
+        mode: str,
+        allow_dark: bool = False,
+    ) -> dict:
+        """
+        Raises or lowers a wiki's access control mode, and nothing else.
+
+        Deliberately not routed through `configure_wiki`: that one rebuilds the
+        wiki from its arguments, so calling it with only settings would rename the
+        wiki and repoint its storage prefix to the default. This touches
+        `settings.access_control` and leaves every other field alone.
+
+        Enforcing a wiki whose pages carry no labels at all would serve nothing
+        to anyone, which is never the intent, so that case is refused unless
+        `allow_dark` says otherwise.
+        """
+        company = self._get_company(company_short_name)
+        if not company:
+            return {"status": "error", "error_message": "company not found"}
+        wiki = self.knowledge_wiki_repo.get_wiki_by_key(company.id, self.normalize_wiki_key(wiki_key))
+        if not wiki:
+            return {"status": "error", "error_message": "wiki not found"}
+
+        requested_mode = str(mode or "").strip().lower()
+        if requested_mode not in self.ACCESS_MODES:
+            # Not normalized silently: an unrecognized mode here would read as
+            # 'off' and quietly turn access control off.
+            return {
+                "status": "error",
+                "error_message": f"mode must be one of {', '.join(self.ACCESS_MODES)}",
+            }
+
+        pages = self.knowledge_wiki_repo.list_pages(wiki.id, include_archived=False, limit=self.MAX_PAGES)
+        labelled = sum(1 for page in pages if (page.access_tags or []))
+        previous = self.wiki_access_control(wiki)
+        if requested_mode == self.ACCESS_MODE_ENFORCE and not labelled and not allow_dark:
+            return {
+                "status": "error",
+                "error_message": (
+                    f"wiki '{wiki.wiki_key}' has no page carrying access labels, so enforcing would "
+                    "hide all of it from everyone. Sync the access manifest first."
+                ),
+            }
+
+        settings = dict(wiki.settings if isinstance(wiki.settings, dict) else {})
+        # Reassigned rather than mutated in place: an in-place change to a JSON
+        # column is not tracked and would never be written.
+        settings["access_control"] = {
+            "mode": requested_mode,
+            "manifest": previous["manifest"],
+        }
+        wiki.settings = settings
+        self.knowledge_wiki_repo.commit()
+
+        return {
+            "status": "success",
+            "wiki_key": wiki.wiki_key,
+            "previous_mode": previous["mode"],
+            "mode": requested_mode,
+            "manifest": previous["manifest"],
+            "manifest_status": self._probe_access_manifest(company_short_name, wiki, requested_mode),
+            "pages": len(pages),
+            "labelled": labelled,
+            "unlabelled": len(pages) - labelled,
+        }
+
+    def _probe_access_manifest(self, company_short_name: str, wiki: KnowledgeWiki, mode: str) -> str:
+        """
+        Reports whether the manifest could be read right now, without failing.
+
+        Answers the question that matters after raising the mode: would the next
+        sync abort? From dry_run up the manifest is required.
+        """
+        try:
+            _pages, meta = self._load_access_manifest(
+                company_short_name,
+                wiki,
+                {"mode": self.ACCESS_MODE_OFF, "manifest": self.wiki_access_control(wiki)["manifest"]},
+            )
+        except Exception as exc:
+            return f"error: {exc}"
+        status = str(meta.get("manifest_status") or "unknown")
+        if status != "loaded" and mode != self.ACCESS_MODE_OFF:
+            return f"{status} (the next sync will abort while the mode is '{mode}')"
+        return status
+
     def access_visibility_report(
         self,
         company_short_name: str,

{iatoolkit-2.41.0 → iatoolkit-2.41.2}/src/iatoolkit/services/warmup_service.py

@@ -7,6 +7,8 @@ from __future__ import annotations
 
 import logging
 import time
+from urllib.parse import urlparse
+
 from injector import inject
 
 from iatoolkit.common.interfaces.secret_provider import SecretProvider
@@ -19,7 +21,12 @@ from iatoolkit.services.embedding_service import EmbeddingService
 class WarmupService:
     """
     Lightweight warm-up orchestrator.
-    Keep it simple: no shared state, no locking, no dedup.
+    Keep it simple: no shared state, no locking.
+
+    The one exception is the startup path, which deduplicates by resolved
+    endpoint URL. That is not coordination between processes — each process
+    still knocks on its own — it is not knocking N times for N tenants that
+    share one endpoint.
     """
 
     @inject
@@ -57,41 +64,80 @@ class WarmupService:
             self.warmup_company(company_short_name, trigger=trigger)
 
     def warmup_startup_configured_companies(self, trigger: str = "startup") -> list[str]:
-        warmed_companies: list[str] = []
-        for company_short_name in get_registered_companies().keys():
-            profiles = self._get_remote_text_embedding_profiles(company_short_name, startup_only=True)
-            if not profiles:
-                logging.info(
-                    "Startup warm-up skipped for company='%s': no embedding provider enabled warmup_on_startup.",
+        """Wakes each distinct inference endpoint once. Returns the hosts woken.
+
+        Once per endpoint, not once per tenant: waking is a property of the
+        endpoint, and tenants normally share one. Doing it per tenant only
+        multiplied requests against a container that was already starting, each
+        one willing to spend the tool's whole retry budget getting there.
+
+        Nothing is awaited beyond the call. Surviving a cold start is the
+        inference client's job, through ``retry_budget_seconds``; this only has
+        to knock on the door.
+        """
+        targets = self._startup_endpoints()
+        if not targets:
+            logging.info("Startup warm-up skipped: no embedding provider enabled warmup_on_startup.")
+            return []
+
+        woken: list[str] = []
+        for endpoint_url, (company_short_name, profile) in targets.items():
+            model_type, _config_section, _tool_name = profile
+            label = self._format_profile_labels([profile])[0]
+            host = self._endpoint_host(endpoint_url)
+            try:
+                self.embedding_service.embed_text(
                     company_short_name,
+                    "hello",
+                    model_type=model_type,
+                    suppress_error_logging=True,
                 )
-                continue
-
-            logging.info(
-                "Startup warm-up starting for company='%s' profiles=%s trigger='%s'.",
-                company_short_name,
-                self._format_profile_labels(profiles),
-                trigger,
-            )
-            warmed_profiles = self._warmup_remote_text_embeddings(
-                company_short_name,
-                startup_only=True,
-                profiles=profiles,
-            )
-            if not warmed_profiles:
+                logging.info(
+                    "🔥 Startup warm-up woke endpoint='%s' via company='%s' profile=%s trigger='%s'.",
+                    host, company_short_name, label, trigger,
+                )
+                woken.append(host)
+            except Exception as e:
                 logging.warning(
-                    "Startup warm-up attempted but no embedding profiles warmed for company='%s' profiles=%s.",
-                    company_short_name,
-                    self._format_profile_labels(profiles),
+                    "Startup warm-up could not wake endpoint='%s' via company='%s' profile=%s: %s",
+                    host, company_short_name, label, e,
                 )
+
+        return woken
+
+    def _startup_endpoints(self) -> dict[str, tuple[str, tuple[str, str, str]]]:
+        """One representative (company, profile) per distinct endpoint URL.
+
+        Keyed by the resolved URL rather than by company or tool name, so a
+        deployment where every tenant shares one endpoint knocks once, and a
+        tenant later pointed somewhere else gets its own knock without anyone
+        having to remember this function exists.
+        """
+        targets: dict[str, tuple[str, tuple[str, str, str]]] = {}
+        for company_short_name in get_registered_companies().keys():
+            inference_tools = self.config_service.get_configuration(company_short_name, "inference_tools") or {}
+            if not isinstance(inference_tools, dict):
                 continue
 
-            logging.info(
-                "Startup warm-up warmed company='%s' profiles=%s.",
-                company_short_name,
-                self._format_profile_labels(warmed_profiles),
-            )
-            warmed_companies.append(company_short_name)
+            for profile in self._get_remote_text_embedding_profiles(company_short_name, startup_only=True):
+                _model_type, _config_section, tool_name = profile
+                endpoint_url = self._resolve_endpoint_url(company_short_name, inference_tools, tool_name)
+                if not endpoint_url:
+                    continue
+
+                existing = targets.get(endpoint_url)
+                # Prefer the default text profile as the representative: it is the
+                # one rag_search uses, so if the container loads models on demand
+                # the one most likely to be asked for first is the one primed.
+                if existing is None or (profile[0] == "text" and existing[1][0] != "text"):
+                    targets[endpoint_url] = (company_short_name, profile)
+
+        return targets
+
+    @staticmethod
+    def _endpoint_host(endpoint_url: str) -> str:
+        """Host only: the URL can come from a secret, and the host is enough to log."""
+        return urlparse(endpoint_url).hostname or "unknown"
 
         return warmed_companies
 
@@ -205,8 +251,23 @@ class WarmupService:
         if provider != "huggingface":
             return False
 
+        return bool(self._resolve_endpoint_url(company_short_name, inference_tools, tool_name))
+
+    def _resolve_endpoint_url(
+            self,
+            company_short_name: str,
+            inference_tools: dict,
+            tool_name: str,
+    ) -> str:
+        """Where a tool's requests actually go, or "" when it resolves nowhere.
+
+        Same precedence the inference client uses — literal, secret ref, then
+        environment variable — because this is what identifies the thing being
+        woken. Two profiles that resolve here to the same URL are one endpoint,
+        whatever they are called in the company's configuration.
+        """
         if not tool_name:
-            return False
+            return ""
 
         defaults = inference_tools.get("_defaults") or {}
         if not isinstance(defaults, dict):
@@ -214,7 +275,7 @@ class WarmupService:
 
         tool_cfg = inference_tools.get(tool_name) or {}
         if not isinstance(tool_cfg, dict):
-            return False
+            return ""
 
         resolved_cfg = {**defaults, **tool_cfg}
         endpoint_url = (resolved_cfg.get("endpoint_url") or "").strip()
@@ -231,4 +292,4 @@ class WarmupService:
                     resolve_secret(self.secret_provider, company_short_name, endpoint_url_env, default="") or ""
                 ).strip()
 
-        return bool(endpoint_url)
+        return endpoint_url

{iatoolkit-2.41.0 → iatoolkit-2.41.2/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.41.0
+Version: 2.41.2
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT