@kb-labs/gateway-app 2.112.0 → 2.116.11

package/dist/index.js

@@ -1,8 +1,7 @@
 import { logDiagnosticEvent } from '@kb-labs/core-platform';
 import { createInMemoryDocumentDatabase, createInMemoryKVStore } from '@kb-labs/core-platform/inmemory';
-import { createServiceBootstrap, platform, getPlatformRoot, getProjectRoot, getAdapterStatus } from '@kb-labs/core-runtime';
 import { makeAssemblyHook } from '@kb-labs/plugin-runtime';
-import { createCorrelatedLogger, registerOpenAPI, createServiceReadyResponse, OperationMetricsTracker, createServiceObservabilityDescribe, createServiceObservabilityHealth } from '@kb-labs/shared-http';
+import { runService } from '@kb-labs/shared-daemon';
 import { HostStore, globalDispatcher, AdaptiveBuffer } from '@kb-labs/gateway-core';
 import { UsersStore, CredentialsStore, MembershipsStore, SessionsStore, InvitesStore, loadIdentityProviders, createPasswordPolicy, createStubPDP, createTenantResolver, createUserAuthService, ensureBootstrapAdmin, createRateLimiter, OAuthStateStore, AuthService, ensureBootstrapCliCredentials, verifyUserAccessToken, AuthError, getClientByHandle, issueCsrfToken, verifyCsrfToken, getClientByHostId } from '@kb-labs/gateway-auth';
 import { createRegistry, mergeOpenAPISpecs } from '@kb-labs/core-registry';
@@ -12,6 +11,8 @@ import Fastify from 'fastify';
 import fastifyCookie from '@fastify/cookie';
 import fastifyCors from '@fastify/cors';
 import fastifyHttpProxy from '@fastify/http-proxy';
+import { platform, getAdapterStatus } from '@kb-labs/core-runtime';
+import { createHttpLogger, registerOpenAPI, createServiceReadyResponse, OperationMetricsTracker, createServiceObservabilityDescribe, createServiceObservabilityHealth } from '@kb-labs/shared-http';
 import { PERMISSIONS, CANONICAL_OBSERVABILITY_METRICS, OBSERVABILITY_CONTRACT_VERSION, OBSERVABILITY_SCHEMA } from '@kb-labs/core-contracts';
 import { randomBytes, randomUUID, createHmac, timingSafeEqual } from 'crypto';
 import { classifyFailure } from '@kb-labs/core-retry';
@@ -3819,11 +3820,10 @@ function redactQueryToken(url) {
   return url.replace(/([?&]access_token=)[^&]*/gi, "$1[REDACTED]");
 }
 async function createServer(config, cache, logger, jwtConfig, registry, serviceTransport, userAuth, webhookManifests) {
-  const gatewayLogger = createCorrelatedLogger(logger, {
+  const gatewayLogger = createHttpLogger(logger, {
     serviceId: "gateway",
-    logsSource: "gateway",
-    layer: "gateway",
-    service: "server",
+    layer: "service",
+    component: "gateway-server",
     operation: "gateway.http"
   });
   const app = Fastify({
@@ -3855,27 +3855,25 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
     reply.header("X-Request-Id", requestId);
     reply.header("X-Trace-Id", traceId);
     const safeUrl = redactQueryToken(request.url);
-    request.kbLogger = createCorrelatedLogger(logger, {
+    request.kbLogger = createHttpLogger(logger, {
       serviceId: "gateway",
-      logsSource: "gateway",
-      layer: "gateway",
-      service: "request",
+      layer: "service",
+      component: "http-request",
       requestId,
       traceId,
       method: request.method,
       url: safeUrl,
       operation: "http.request"
     });
-    request.kbLogger.info(`\u2192 ${request.method.toUpperCase()} ${safeUrl}`);
+    request.kbLogger.debug("HTTP request started");
   });
   app.addHook("onResponse", async (request, reply) => {
     const requestLogger = request.kbLogger;
     if (!requestLogger) {
       return;
     }
-    const safeUrl = redactQueryToken(request.url);
-    requestLogger.info(`\u2713 ${request.method.toUpperCase()} ${safeUrl} ${reply.statusCode}`, {
-      statusCode: reply.statusCode
+    requestLogger.info("HTTP request completed", {
+      "http.status_code": reply.statusCode
     });
   });
   if (userAuth) {
@@ -3890,7 +3888,9 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
   }
   app.addHook(
     "onRequest",
-    createAuthMiddleware(cache, jwtConfig, { authEnabled: config.auth?.enabled !== false })
+    createAuthMiddleware(cache, jwtConfig, {
+      authEnabled: config.auth?.enabled !== false
+    })
   );
   const socketWsUpstreams = [];
   for (const [name, upstream] of Object.entries(config.upstreams)) {
@@ -3924,13 +3924,19 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
     });
     const connDesc = conn.socketPath ? `${conn.baseUrl} (unix:${conn.socketPath})` : conn.baseUrl;
     const wsDesc = upstream.websocket ? wsOverSocket ? ", ws\u2192unix" : ", ws" : "";
-    gatewayLogger.info(`Upstream registered: ${name} \u2192 ${connDesc} (${upstream.prefix}${wsDesc})`);
+    gatewayLogger.info(
+      `Upstream registered: ${name} \u2192 ${connDesc} (${upstream.prefix}${wsDesc})`
+    );
   }
   await app.register(async function gatewayRoutes(scope) {
     if (config.pressure?.perTenant?.enabled === true && platform.hasResourceBroker) {
       scope.addHook(
         "preHandler",
-        createPressurePreHandler({ broker: platform.resourceBroker, logger, config })
+        createPressurePreHandler({
+          broker: platform.resourceBroker,
+          logger,
+          config
+        })
       );
     }
     const authService = new AuthService(cache, jwtConfig);
@@ -3941,7 +3947,11 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
       }),
       pdp: userAuth.pdp
     } : void 0;
-    registerAuthRoutes(scope, authService, userExt);
+    registerAuthRoutes(
+      scope,
+      authService,
+      userExt
+    );
     if (userAuth) {
       registerUserAuthRoutes(
         scope,
@@ -3973,32 +3983,69 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
       if (cached) {
         return cached;
       }
-      const adapterNames = ["llm", "cache", "analytics", "vectorStore", "embeddings"];
+      const adapterNames = [
+        "llm",
+        "cache",
+        "analytics",
+        "vectorStore",
+        "embeddings"
+      ];
       const adapters = {};
       for (const name of adapterNames) {
-        await observability.observeOperation(`gateway.adapter.${name}`, async () => {
-          const probeStart = Date.now();
-          try {
-            const pf = platform;
-            const adapter = pf[name] ?? pf.getAdapter?.(name);
-            adapters[name] = { available: !!adapter, latencyMs: Date.now() - probeStart };
-          } catch {
-            adapters[name] = { available: false, latencyMs: Date.now() - probeStart };
+        await observability.observeOperation(
+          `gateway.adapter.${name}`,
+          async () => {
+            const probeStart = Date.now();
+            try {
+              const pf = platform;
+              const adapter = pf[name] ?? pf.getAdapter?.(name);
+              adapters[name] = {
+                available: !!adapter,
+                latencyMs: Date.now() - probeStart
+              };
+            } catch {
+              adapters[name] = {
+                available: false,
+                latencyMs: Date.now() - probeStart
+              };
+            }
           }
-        });
+        );
       }
       const upstreams = {};
       for (const [name, upstream] of Object.entries(config.upstreams)) {
-        await observability.observeOperation(`gateway.upstream.${name}.health`, async () => {
-          const probeStart = Date.now();
-          try {
-            const res = await serviceTransport.call(upstream.serviceId, {
-              path: "/health",
-              signal: AbortSignal.timeout(2e3)
-            });
-            const latencyMs = Date.now() - probeStart;
-            upstreams[name] = { status: res.ok ? "up" : "down", latencyMs };
-            if (!res.ok) {
+        await observability.observeOperation(
+          `gateway.upstream.${name}.health`,
+          async () => {
+            const probeStart = Date.now();
+            try {
+              const res = await serviceTransport.call(upstream.serviceId, {
+                path: "/health",
+                signal: AbortSignal.timeout(2e3)
+              });
+              const latencyMs = Date.now() - probeStart;
+              upstreams[name] = { status: res.ok ? "up" : "down", latencyMs };
+              if (!res.ok) {
+                logDiagnosticEvent(logger, {
+                  domain: "service",
+                  event: "gateway.upstream.health",
+                  level: "warn",
+                  reasonCode: "upstream_unavailable",
+                  message: "Gateway upstream health probe failed",
+                  outcome: "failed",
+                  serviceId: "gateway",
+                  route: `${upstream.prefix}/health`,
+                  evidence: {
+                    upstreamId: name,
+                    serviceId: upstream.serviceId,
+                    statusCode: res.statusCode,
+                    latencyMs
+                  }
+                });
+              }
+            } catch (error) {
+              const latencyMs = Date.now() - probeStart;
+              upstreams[name] = { status: "down", latencyMs };
               logDiagnosticEvent(logger, {
                 domain: "service",
                 event: "gateway.upstream.health",
@@ -4006,37 +4053,18 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
                 reasonCode: "upstream_unavailable",
                 message: "Gateway upstream health probe failed",
                 outcome: "failed",
+                error: error instanceof Error ? error : new Error(String(error)),
                 serviceId: "gateway",
                 route: `${upstream.prefix}/health`,
                 evidence: {
                   upstreamId: name,
                   serviceId: upstream.serviceId,
-                  statusCode: res.statusCode,
                   latencyMs
                 }
               });
             }
-          } catch (error) {
-            const latencyMs = Date.now() - probeStart;
-            upstreams[name] = { status: "down", latencyMs };
-            logDiagnosticEvent(logger, {
-              domain: "service",
-              event: "gateway.upstream.health",
-              level: "warn",
-              reasonCode: "upstream_unavailable",
-              message: "Gateway upstream health probe failed",
-              outcome: "failed",
-              error: error instanceof Error ? error : new Error(String(error)),
-              serviceId: "gateway",
-              route: `${upstream.prefix}/health`,
-              evidence: {
-                upstreamId: name,
-                serviceId: upstream.serviceId,
-                latencyMs
-              }
-            });
           }
-        });
+        );
       }
       const llmOk = adapters.llm?.available ?? false;
       const allOk = Object.values(adapters).every((a) => a.available);
@@ -4052,131 +4080,241 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
       });
       return snapshot;
     };
-    scope.get("/health", { schema: { tags: ["System"], summary: "Gateway health check" } }, async () => {
-      return collectHealthSnapshot();
-    });
-    scope.get("/health/adapters", {
-      schema: {
-        tags: ["System"],
-        summary: "Platform adapter status \u2014 mode (real | inmemory | noop) per slot"
+    scope.get(
+      "/health",
+      { schema: { tags: ["System"], summary: "Gateway health check" } },
+      async () => {
+        return collectHealthSnapshot();
       }
-    }, async () => {
-      return getAdapterStatus();
-    });
-    scope.get("/ready", { schema: { tags: ["System"], summary: "Gateway readiness check" } }, async (_request, reply) => {
-      const health = await collectHealthSnapshot();
-      const upstreams = health.upstreams ?? {};
-      const missingRequiredUpstreams = ["rest"].filter((id) => (upstreams[id]?.status ?? "down") !== "up");
-      const ready = missingRequiredUpstreams.length === 0;
-      return reply.code(ready ? 200 : 503).send(createServiceReadyResponse({
-        ready,
-        status: ready ? "ready" : "degraded",
-        reason: ready ? "ready" : `upstream_unavailable:${missingRequiredUpstreams.join(",")}`,
-        components: {
-          gatewayAdapters: {
-            ready: true
-          },
-          restUpstream: {
-            ready: (upstreams.rest?.status ?? "down") === "up",
-            status: upstreams.rest?.status ?? "down"
-          },
-          workflowUpstream: {
-            ready: (upstreams.workflow?.status ?? "down") === "up",
-            status: upstreams.workflow?.status ?? "down"
-          },
-          marketplaceUpstream: {
-            ready: (upstreams.marketplace?.status ?? "down") === "up",
-            status: upstreams.marketplace?.status ?? "down"
-          }
+    );
+    scope.get(
+      "/health/adapters",
+      {
+        schema: {
+          tags: ["System"],
+          summary: "Platform adapter status \u2014 mode (real | inmemory | noop) per slot"
         }
-      }));
-    });
-    scope.get("/metrics", { schema: { tags: ["Observability"], summary: "Gateway metrics in Prometheus format" } }, async (_request, reply) => {
-      const health = await collectHealthSnapshot();
-      const status = health.status ?? "healthy";
-      reply.header("Content-Type", "text/plain; version=0.0.4; charset=utf-8");
-      return observability.renderPrometheusMetrics(status);
-    });
-    scope.get("/observability/describe", {
-      schema: { tags: ["Observability"], summary: "Gateway observability contract descriptor" }
-    }, async () => observability.buildDescribe());
-    scope.get("/observability/health", {
-      schema: { tags: ["Observability"], summary: "Gateway observability health snapshot" }
-    }, async () => {
-      const health = await collectHealthSnapshot();
-      const adapterChecks = Object.entries(health.adapters ?? {}).map(([id, value]) => ({ id, available: !!value?.available, latencyMs: value?.latencyMs }));
-      const upstreamChecks = Object.entries(health.upstreams ?? {}).map(([id, value]) => ({ id, status: value?.status ?? "unknown", latencyMs: value?.latencyMs }));
-      const status = health.status ?? "healthy";
-      return observability.buildHealth({ status, adapterChecks, upstreamChecks });
-    });
+      },
+      async () => {
+        return getAdapterStatus();
+      }
+    );
+    scope.get(
+      "/ready",
+      { schema: { tags: ["System"], summary: "Gateway readiness check" } },
+      async (_request, reply) => {
+        const health = await collectHealthSnapshot();
+        const upstreams = health.upstreams ?? {};
+        const missingRequiredUpstreams = ["rest"].filter(
+          (id) => (upstreams[id]?.status ?? "down") !== "up"
+        );
+        const ready = missingRequiredUpstreams.length === 0;
+        return reply.code(ready ? 200 : 503).send(
+          createServiceReadyResponse({
+            ready,
+            status: ready ? "ready" : "degraded",
+            reason: ready ? "ready" : `upstream_unavailable:${missingRequiredUpstreams.join(",")}`,
+            components: {
+              gatewayAdapters: {
+                ready: true
+              },
+              restUpstream: {
+                ready: (upstreams.rest?.status ?? "down") === "up",
+                status: upstreams.rest?.status ?? "down"
+              },
+              workflowUpstream: {
+                ready: (upstreams.workflow?.status ?? "down") === "up",
+                status: upstreams.workflow?.status ?? "down"
+              },
+              marketplaceUpstream: {
+                ready: (upstreams.marketplace?.status ?? "down") === "up",
+                status: upstreams.marketplace?.status ?? "down"
+              }
+            }
+          })
+        );
+      }
+    );
+    scope.get(
+      "/metrics",
+      {
+        schema: {
+          tags: ["Observability"],
+          summary: "Gateway metrics in Prometheus format"
+        }
+      },
+      async (_request, reply) => {
+        const health = await collectHealthSnapshot();
+        const status = health.status ?? "healthy";
+        reply.header(
+          "Content-Type",
+          "text/plain; version=0.0.4; charset=utf-8"
+        );
+        return observability.renderPrometheusMetrics(status);
+      }
+    );
+    scope.get(
+      "/observability/describe",
+      {
+        schema: {
+          tags: ["Observability"],
+          summary: "Gateway observability contract descriptor"
+        }
+      },
+      async () => observability.buildDescribe()
+    );
+    scope.get(
+      "/observability/health",
+      {
+        schema: {
+          tags: ["Observability"],
+          summary: "Gateway observability health snapshot"
+        }
+      },
+      async () => {
+        const health = await collectHealthSnapshot();
+        const adapterChecks = Object.entries(
+          health.adapters ?? {}
+        ).map(([id, value]) => ({
+          id,
+          available: !!value?.available,
+          latencyMs: value?.latencyMs
+        }));
+        const upstreamChecks = Object.entries(
+          health.upstreams ?? {}
+        ).map(([id, value]) => ({
+          id,
+          status: value?.status ?? "unknown",
+          latencyMs: value?.latencyMs
+        }));
+        const status = health.status ?? "healthy";
+        return observability.buildHealth({
+          status,
+          adapterChecks,
+          upstreamChecks
+        });
+      }
+    );
     if (!registry) {
-      gatewayLogger.warn("No persistent HostRegistry injected \u2014 hosts will be lost on restart");
+      gatewayLogger.warn(
+        "No persistent HostRegistry injected \u2014 hosts will be lost on restart"
+      );
     }
     const hostRegistry = registry ?? new HostRegistry(cache);
-    scope.post("/hosts/register", { schema: { tags: ["Hosts"], summary: "Register a host" } }, async (request, reply) => {
-      const parsed = HostRegistrationSchema.safeParse(request.body);
-      if (!parsed.success) {
-        return reply.code(400).send({ error: "Bad Request", issues: parsed.error.issues });
-      }
-      const result = await hostRegistry.register(parsed.data);
-      return reply.code(201).send({
-        hostId: result.descriptor.hostId,
-        machineToken: result.machineToken,
-        status: result.descriptor.status
-      });
-    });
-    scope.get("/hosts", { schema: { tags: ["Hosts"], summary: "List registered hosts" } }, async (request, reply) => {
-      const auth = request.authContext;
-      if (!auth) {
-        return reply.code(401).send({ error: "Unauthorized" });
-      }
-      const hosts = await hostRegistry.list(auth.namespaceId);
-      return { hosts };
-    });
-    scope.get("/hosts/:hostId", { schema: { tags: ["Hosts"], summary: "Get host by ID" } }, async (request, reply) => {
-      const auth = request.authContext;
-      if (!auth) {
-        return reply.code(401).send({ error: "Unauthorized" });
+    scope.post(
+      "/hosts/register",
+      { schema: { tags: ["Hosts"], summary: "Register a host" } },
+      async (request, reply) => {
+        const parsed = HostRegistrationSchema.safeParse(request.body);
+        if (!parsed.success) {
+          return reply.code(400).send({ error: "Bad Request", issues: parsed.error.issues });
+        }
+        const result = await hostRegistry.register(parsed.data);
+        return reply.code(201).send({
+          hostId: result.descriptor.hostId,
+          machineToken: result.machineToken,
+          status: result.descriptor.status
+        });
       }
-      const { hostId } = request.params;
-      const host = await hostRegistry.get(hostId, auth.namespaceId);
-      if (!host) {
-        return reply.code(404).send({ error: "Host not found" });
+    );
+    scope.get(
+      "/hosts",
+      { schema: { tags: ["Hosts"], summary: "List registered hosts" } },
+      async (request, reply) => {
+        const auth = request.authContext;
+        if (!auth) {
+          return reply.code(401).send({ error: "Unauthorized" });
+        }
+        const hosts = await hostRegistry.list(auth.namespaceId);
+        return { hosts };
       }
-      return host;
-    });
-    scope.delete("/hosts/:hostId", { schema: { tags: ["Hosts"], summary: "Deregister a host" } }, async (request, reply) => {
-      const auth = request.authContext;
-      if (!auth) {
-        return reply.code(401).send({ error: "Unauthorized" });
+    );
+    scope.get(
+      "/hosts/:hostId",
+      { schema: { tags: ["Hosts"], summary: "Get host by ID" } },
+      async (request, reply) => {
+        const auth = request.authContext;
+        if (!auth) {
+          return reply.code(401).send({ error: "Unauthorized" });
+        }
+        const { hostId } = request.params;
+        const host = await hostRegistry.get(hostId, auth.namespaceId);
+        if (!host) {
+          return reply.code(404).send({ error: "Host not found" });
+        }
+        return host;
       }
-      const { hostId } = request.params;
-      const deleted = await hostRegistry.deregister(hostId, auth.namespaceId);
-      if (!deleted) {
-        return reply.code(404).send({ error: "Host not found" });
+    );
+    scope.delete(
+      "/hosts/:hostId",
+      { schema: { tags: ["Hosts"], summary: "Deregister a host" } },
+      async (request, reply) => {
+        const auth = request.authContext;
+        if (!auth) {
+          return reply.code(401).send({ error: "Unauthorized" });
+        }
+        const { hostId } = request.params;
+        const deleted = await hostRegistry.deregister(hostId, auth.namespaceId);
+        if (!deleted) {
+          return reply.code(404).send({ error: "Host not found" });
+        }
+        return reply.code(204).send();
       }
-      return reply.code(204).send();
-    });
-    registerExecuteRoutes(scope, logger);
-    registerLLMGatewayRoutes(scope, logger);
-    registerTelemetryRoutes(scope, logger);
-    registerPlatformRoutes(scope, logger);
-    registerAggregatedDocsRoutes(scope, config, serviceTransport, cache);
-    registerInternalRoutes(scope, process.env.GATEWAY_INTERNAL_SECRET, hostRegistry, cache);
+    );
+    registerExecuteRoutes(
+      scope,
+      logger
+    );
+    registerLLMGatewayRoutes(
+      scope,
+      logger
+    );
+    registerTelemetryRoutes(
+      scope,
+      logger
+    );
+    registerPlatformRoutes(
+      scope,
+      logger
+    );
+    registerAggregatedDocsRoutes(
+      scope,
+      config,
+      serviceTransport,
+      cache
+    );
+    registerInternalRoutes(
+      scope,
+      process.env.GATEWAY_INTERNAL_SECRET,
+      hostRegistry,
+      cache
+    );
     if (platform.hasResourceBroker) {
       const webhookBaseUrl = process.env.GATEWAY_PUBLIC_URL ?? `http://localhost:${config.port + (Number(process.env.KB_NET_OFFSET) || 0)}`;
       const provisionBackend = {
-        async execute({ handlerRef, pluginRoot, input, namespaceId }) {
+        async execute({
+          handlerRef,
+          pluginRoot,
+          input,
+          namespaceId
+        }) {
           if (!namespaceId) {
             return;
           }
-          const hostId = globalDispatcher.firstHostWithCapability(namespaceId, "execution");
+          const hostId = globalDispatcher.firstHostWithCapability(
+            namespaceId,
+            "execution"
+          );
           if (!hostId) {
             return;
           }
-          return globalDispatcher.call(namespaceId, hostId, "execution", "execute", [
-            { handlerRef, pluginRoot, input }
-          ]);
+          return globalDispatcher.call(
+            namespaceId,
+            hostId,
+            "execution",
+            "execute",
+            [{ handlerRef, pluginRoot, input }]
+          );
         }
       };
       registerWebhookAdminRoutes(
@@ -4203,31 +4341,50 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
     });
   }
   await app.ready();
-  attachGatewayWs(app.server, cache, jwtConfig, logger, registry, socketWsUpstreams);
+  attachGatewayWs(
+    app.server,
+    cache,
+    jwtConfig,
+    logger,
+    registry,
+    socketWsUpstreams
+  );
   return app;
 }
 
 // src/bootstrap.ts
 async function bootstrap(repoRoot = process.cwd()) {
-  await createServiceBootstrap({ appId: "gateway", repoRoot, assemblyHook: makeAssemblyHook() });
-  const logger = createCorrelatedLogger(platform.logger, {
-    serviceId: "gateway",
-    logsSource: "gateway",
-    layer: "gateway",
-    service: "bootstrap",
-    operation: "gateway.bootstrap"
+  await runService({
+    appId: "gateway",
+    startDir: repoRoot,
+    defaultPort: 4e3,
+    portEnvVar: "GATEWAY_PORT",
+    defaultHost: "0.0.0.0",
+    hostEnvVar: "GATEWAY_HOST",
+    platform: {
+      assemblyHook: makeAssemblyHook()
+    },
+    setup: startGateway
   });
-  logger.info("Platform initialized", { repoRoot });
-  const config = await loadGatewayConfig(getProjectRoot() ?? repoRoot, getPlatformRoot());
+}
+async function startGateway({
+  platform: platform5,
+  projectRoot,
+  platformRoot,
+  logger: serviceLogger
+}) {
+  const logger = serviceLogger.forComponent("gateway-bootstrap").forOperation("gateway.bootstrap");
+  logger.info("Platform initialized", { projectRoot, platformRoot });
+  const config = await loadGatewayConfig(projectRoot, platformRoot);
   logger.info("Gateway config loaded", {
     port: config.port,
     upstreams: Object.keys(config.upstreams),
-    projectRoot: getProjectRoot() ?? repoRoot,
-    platformRoot: getPlatformRoot(),
+    projectRoot,
+    platformRoot,
     configProviderIds: config.auth?.providers ? Object.keys(config.auth.providers) : []
   });
   let hostStore;
-  const configuredDocs = platform.getAdapter("documentDatabase");
+  const configuredDocs = platform5.getAdapter("documentDatabase");
   const docs = configuredDocs ?? createInMemoryDocumentDatabase();
   if (configuredDocs) {
     hostStore = new HostStore(docs);
@@ -4239,7 +4396,13 @@ async function bootstrap(repoRoot = process.cwd()) {
   }
   let userAuth;
   {
-    const { accessTtlSec, refreshTtlSec, graceWindowMs, bcryptCost, cookieSecure } = resolveAuthRuntimeConfig(config.auth, process.env);
+    const {
+      accessTtlSec,
+      refreshTtlSec,
+      graceWindowMs,
+      bcryptCost,
+      cookieSecure
+    } = resolveAuthRuntimeConfig(config.auth, process.env);
     const tenantPattern = config.tenants?.pattern ?? "{tenant}.kblabs.ru";
     const bootstrapTenantId = config.auth?.bootstrap?.tenantId ?? process.env.GATEWAY_BOOTSTRAP_TENANT_ID ?? "kblabs-cloud";
     const users = new UsersStore(docs);
@@ -4272,7 +4435,9 @@ async function bootstrap(repoRoot = process.cwd()) {
       invites,
       providers,
       passwordPolicy,
-      jwtConfig: { secret: process.env.GATEWAY_JWT_SECRET ?? "dev-insecure-secret-change-me" },
+      jwtConfig: {
+        secret: process.env.GATEWAY_JWT_SECRET ?? "dev-insecure-secret-change-me"
+      },
       accessTtlSec,
       refreshTtlSec,
       bcryptCost
@@ -4292,16 +4457,18 @@ async function bootstrap(repoRoot = process.cwd()) {
       });
     });
     const inviteTtlMs = process.env.AUTH_INVITE_TTL_MS ? parseInt(process.env.AUTH_INVITE_TTL_MS, 10) : config.auth?.inviteTtlMs ?? 7 * 24 * 60 * 60 * 1e3;
-    const kv = platform.getAdapter("kvStore") ?? createInMemoryKVStore();
+    const kv = platform5.getAdapter("kvStore") ?? createInMemoryKVStore();
     const rateLimiter = createRateLimiter(kv);
-    if (!platform.getAdapter("kvStore")) {
-      logger.warn("kvStore adapter not configured \u2014 auth rate limiting using in-memory KV (counters reset on restart)");
+    if (!platform5.getAdapter("kvStore")) {
+      logger.warn(
+        "kvStore adapter not configured \u2014 auth rate limiting using in-memory KV (counters reset on restart)"
+      );
     }
     const loginPerIpPerMinute = process.env.AUTH_LOGIN_RATE_LIMIT_PER_IP ? parseInt(process.env.AUTH_LOGIN_RATE_LIMIT_PER_IP, 10) : config.auth?.rateLimit?.loginPerIpPerMinute ?? 10;
     const loginPerEmailPerMinute = process.env.AUTH_LOGIN_RATE_LIMIT_PER_EMAIL ? parseInt(process.env.AUTH_LOGIN_RATE_LIMIT_PER_EMAIL, 10) : config.auth?.rateLimit?.loginPerEmailPerMinute ?? 5;
     const oauthState = new OAuthStateStore(kv);
     const hasRedirectProvider = providers.list().some((p) => p.kind === "redirect");
-    if (hasRedirectProvider && !platform.getAdapter("kvStore")) {
+    if (hasRedirectProvider && !platform5.getAdapter("kvStore")) {
       logger.warn(
         "OAuth requires a shared kvStore (Redis) in multi-process/HA; in-memory state is per-process and callbacks may land on a different worker"
       );
@@ -4330,13 +4497,13 @@ async function bootstrap(repoRoot = process.cwd()) {
       persistent: !!configuredDocs
     });
   }
-  const cache = platform.cache;
+  const cache = platform5.cache;
   const registry = new HostRegistry(cache, hostStore);
   let restoredCount = 0;
   try {
     restoredCount = await registry.restore();
   } catch (error) {
-    logDiagnosticEvent(platform.logger, {
+    logDiagnosticEvent(platform5.logger, {
       domain: "registry",
       event: "gateway.hosts.restore",
       level: "error",
@@ -4355,8 +4522,6 @@ async function bootstrap(repoRoot = process.cwd()) {
   }
   let webhookManifests = [];
   try {
-    const projectRoot = getProjectRoot() ?? repoRoot;
-    const platformRoot = getPlatformRoot();
     const pluginRegistry = await createRegistry({
       root: projectRoot,
       platformRoot: platformRoot !== projectRoot ? platformRoot : void 0,
@@ -4369,7 +4534,9 @@ async function bootstrap(repoRoot = process.cwd()) {
       pluginRoot: entry.pluginRoot
     }));
     if (webhookManifests.length > 0) {
-      logger.info("Webhook manifests discovered", { count: webhookManifests.length });
+      logger.info("Webhook manifests discovered", {
+        count: webhookManifests.length
+      });
     }
   } catch (err) {
     logger.warn("Webhook manifest discovery failed \u2014 webhook routes disabled", {
@@ -4386,7 +4553,9 @@ async function bootstrap(repoRoot = process.cwd()) {
     );
   }
   if (!jwtSecret) {
-    logger.warn("GATEWAY_JWT_SECRET not set \u2014 using insecure default (dev only, never use in production!)");
+    logger.warn(
+      "GATEWAY_JWT_SECRET not set \u2014 using insecure default (dev only, never use in production!)"
+    );
   }
   const jwtConfig = { secret: jwtSecret ?? DEV_JWT_SECRET };
   if (config.auth?.bootstrap?.provisionCliCredentials === true) {
@@ -4402,18 +4571,31 @@ async function bootstrap(repoRoot = process.cwd()) {
       });
     });
   }
-  if (platform.hasResourceBroker) {
-    registerPressureLimits(platform.resourceBroker, config.pressure, platform.logger);
+  if (platform5.hasResourceBroker) {
+    registerPressureLimits(
+      platform5.resourceBroker,
+      config.pressure,
+      platform5.logger
+    );
   } else {
     logger.warn("Resource broker unavailable \u2014 pressure control disabled");
   }
-  const serviceTransport = platform.getAdapter("serviceTransport");
+  const serviceTransport = platform5.getAdapter("serviceTransport");
   if (!serviceTransport) {
     throw new Error(
       'Gateway requires the serviceTransport adapter. Configure it in kb.config.json:\n  "adapters": { "serviceTransport": "@kb-labs/adapters-service-transport-http" },\n  "adapterOptions": { "serviceTransport": { "services": { "rest": { "url": "http://127.0.0.1:5050" }, ... } } }'
     );
   }
-  const server = await createServer(config, cache, platform.logger, jwtConfig, registry, serviceTransport, userAuth, webhookManifests);
+  const server = await createServer(
+    config,
+    cache,
+    platform5.logger,
+    jwtConfig,
+    registry,
+    serviceTransport,
+    userAuth,
+    webhookManifests
+  );
   const bindHost = config.host ?? "0.0.0.0";
   if (config.auth?.enabled === false && !isLoopbackHost(bindHost)) {
     throw new Error(
@@ -4423,16 +4605,14 @@ async function bootstrap(repoRoot = process.cwd()) {
   const netOffset = Number(process.env.KB_NET_OFFSET) || 0;
   const listenPort = config.port + netOffset;
   const address = await server.listen({ port: listenPort, host: bindHost });
-  logger.info("Gateway listening", { address, authEnabled: config.auth?.enabled !== false });
-  const shutdown = async (signal) => {
-    logger.warn("Received shutdown signal", { signal });
-    await platform.shutdown();
+  logger.info("Gateway listening", {
+    address,
+    authEnabled: config.auth?.enabled !== false
+  });
+  return async () => {
     await server.close();
-    logger.info("Gateway shutdown complete");
-    process.exit(0);
+    logger.info("Gateway service resources closed");
   };
-  process.on("SIGTERM", () => shutdown("SIGTERM"));
-  process.on("SIGINT", () => shutdown("SIGINT"));
 }
 function resolveAuthRuntimeConfig(authConfig, env) {
   const accessTtlSec = env.AUTH_ACCESS_TTL_SEC ? parseInt(env.AUTH_ACCESS_TTL_SEC, 10) : authConfig?.sessionAccessTtlSec ?? 900;
@@ -4440,7 +4620,13 @@ function resolveAuthRuntimeConfig(authConfig, env) {
   const graceWindowMs = (authConfig?.refreshGraceWindowSec ?? 5) * 1e3;
   const bcryptCost = authConfig?.bcryptCost ?? 12;
   const cookieSecure = env.AUTH_COOKIE_SECURE === "false" ? false : authConfig?.cookieSecure ?? true;
-  return { accessTtlSec, refreshTtlSec, graceWindowMs, bcryptCost, cookieSecure };
+  return {
+    accessTtlSec,
+    refreshTtlSec,
+    graceWindowMs,
+    bcryptCost,
+    cookieSecure
+  };
 }
 function isLoopbackHost(host) {
   const h = host.trim().toLowerCase();
@@ -4448,9 +4634,8 @@ function isLoopbackHost(host) {
 }
 
 // src/index.ts
-bootstrap(process.cwd()).catch((error) => {
-  console.error("Failed to start gateway:", error);
-  process.exit(1);
+bootstrap(process.cwd()).catch(() => {
+  process.exitCode = 1;
 });
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map