@kb-labs/gateway-app 2.94.0 → 2.98.0

package/dist/index.js

@@ -1,55 +1,30 @@
 import { logDiagnosticEvent } from '@kb-labs/core-platform';
-import { createServiceBootstrap, platform, getPlatformRoot } from '@kb-labs/core-runtime';
+import { createInMemoryDocumentDatabase, createInMemoryKVStore } from '@kb-labs/core-platform/inmemory';
+import { createServiceBootstrap, platform, getPlatformRoot, getProjectRoot, getAdapterStatus } from '@kb-labs/core-runtime';
+import { makeAssemblyHook } from '@kb-labs/plugin-runtime';
 import { createCorrelatedLogger, registerOpenAPI, createServiceReadyResponse, OperationMetricsTracker, createServiceObservabilityDescribe, createServiceObservabilityHealth } from '@kb-labs/shared-http';
-import { SqliteHostStore, globalDispatcher, AdaptiveBuffer } from '@kb-labs/gateway-core';
-import { findNearestConfig, readJsonWithDiagnostics } from '@kb-labs/core-config';
+import { HostStore, globalDispatcher, AdaptiveBuffer } from '@kb-labs/gateway-core';
+import { UsersStore, CredentialsStore, MembershipsStore, SessionsStore, InvitesStore, loadIdentityProviders, createPasswordPolicy, createStubPDP, createTenantResolver, createUserAuthService, ensureBootstrapAdmin, createRateLimiter, OAuthStateStore, AuthService, verifyUserAccessToken, AuthError, getClientByHandle, issueCsrfToken, verifyCsrfToken, getClientByHostId } from '@kb-labs/gateway-auth';
+import { createRegistry, mergeOpenAPISpecs } from '@kb-labs/core-registry';
+import { loadEffectiveConfig } from '@kb-labs/core-config';
 import { GatewayConfigSchema, HostRegistrationSchema, RegisterRequestSchema, TokenRequestSchema, RefreshRequestSchema, ExecuteRequestSchema, ChatCompletionRequestSchema, TelemetryIngestRequestSchema, PlatformCallRequestSchema, HelloMessageSchema, SUPPORTED_PROTOCOL_VERSIONS, HostCapabilitySchema, AdapterCallMessageSchema, AdapterNameSchema, ClientHelloSchema, ClientCancelSchema, ClientUnsubscribeSchema, ClientSubscribeSchema, CLIENT_PROTOCOL_VERSION } from '@kb-labs/gateway-contracts';
 import Fastify from 'fastify';
+import fastifyCookie from '@fastify/cookie';
 import fastifyCors from '@fastify/cors';
 import fastifyHttpProxy from '@fastify/http-proxy';
-import { AuthService, getClientByHostId } from '@kb-labs/gateway-auth';
-import { randomUUID } from 'crypto';
-import { mergeOpenAPISpecs } from '@kb-labs/core-registry';
-import { WebSocketServer } from 'ws';
-import { CANONICAL_OBSERVABILITY_METRICS, OBSERVABILITY_CONTRACT_VERSION, OBSERVABILITY_SCHEMA } from '@kb-labs/core-contracts';
+import { PERMISSIONS, CANONICAL_OBSERVABILITY_METRICS, OBSERVABILITY_CONTRACT_VERSION, OBSERVABILITY_SCHEMA } from '@kb-labs/core-contracts';
+import { randomBytes, randomUUID, createHmac, timingSafeEqual } from 'crypto';
+import { WebSocketServer, WebSocket } from 'ws';
 import { hostname } from 'os';
 import { monitorEventLoopDelay, performance } from 'perf_hooks';
+import { Readable } from 'stream';
 
 // src/bootstrap.ts
-var CONFIG_FILENAMES = [
-  ".kb/kb.config.jsonc",
-  ".kb/kb.config.json",
-  "kb.config.jsonc",
-  "kb.config.json"
-];
-async function tryLoadGatewayFromDir(dir) {
-  for (const filename of CONFIG_FILENAMES) {
-    const { path: configPath } = await findNearestConfig({
-      startDir: dir,
-      stopDir: dir,
-      filenames: [filename]
-    });
-    if (!configPath) {
-      continue;
-    }
-    const result = await readJsonWithDiagnostics(configPath);
-    if (!result.ok || !result.data.gateway) {
-      continue;
-    }
-    return GatewayConfigSchema.parse(result.data.gateway);
-  }
-  return null;
-}
 async function loadGatewayConfig(repoRoot, platformRoot) {
-  const fromProject = await tryLoadGatewayFromDir(repoRoot);
-  if (fromProject) {
-    return fromProject;
-  }
-  if (platformRoot && platformRoot !== repoRoot) {
-    const fromPlatform = await tryLoadGatewayFromDir(platformRoot);
-    if (fromPlatform) {
-      return fromPlatform;
-    }
+  const merged = await loadEffectiveConfig(repoRoot, { platformRoot });
+  const gateway = merged?.data?.gateway;
+  if (gateway && typeof gateway === "object" && !Array.isArray(gateway)) {
+    return GatewayConfigSchema.parse(gateway);
   }
   return GatewayConfigSchema.parse({});
 }
@@ -59,16 +34,16 @@ async function resolveToken(token, cache, jwtConfig) {
   if (jwtContext) {
     return jwtContext;
   }
-  const machineEntry = await cache.get(
+  const hostEntry = await cache.get(
     `host:token:${token}`
   );
-  if (machineEntry) {
+  if (hostEntry) {
     return {
       type: "machine",
-      userId: machineEntry.hostId,
-      namespaceId: machineEntry.namespaceId,
+      userId: hostEntry.hostId,
+      namespaceId: hostEntry.namespaceId,
       tier: "free",
-      permissions: ["host:connect"]
+      permissions: hostEntry.permissions ?? ["host:connect"]
     };
   }
   return null;
@@ -82,29 +57,53 @@ function extractBearerToken(authHeader) {
 }
 
 // src/auth/middleware.ts
+var LOCAL_ADMIN_CONTEXT = {
+  type: "machine",
+  userId: "local-admin",
+  namespaceId: "local",
+  tier: "enterprise",
+  permissions: Object.values(PERMISSIONS)
+};
 var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
   "/health",
+  "/health/adapters",
   "/ready",
   "/hosts/register",
   // /hosts/connect and /clients/connect are handled at the HTTP upgrade level
   // by gateway-ws.ts (raw ws) — they never reach Fastify routing.
-  "/auth/register",
+  // NOTE: /auth/register is NOT public — it requires MACHINE_REGISTER permission
+  //       (cookie-auth admin or Bearer machine with that permission).
   "/auth/token",
   "/auth/refresh",
+  // User-auth public endpoints (ADR-0020, Phase 1.16).
+  "/auth/login",
+  "/auth/activate",
+  "/auth/providers",
   "/internal/dispatch",
   // has its own x-internal-secret auth
   "/internal/resolve-host"
   // has its own x-internal-secret auth
 ]);
-function createAuthMiddleware(cache, jwtConfig) {
+function createAuthMiddleware(cache, jwtConfig, options = {}) {
+  const authEnabled = options.authEnabled !== false;
   return async function authMiddleware(request, reply) {
+    if (!authEnabled) {
+      request.authContext = LOCAL_ADMIN_CONTEXT;
+      return;
+    }
     const rawPath = new URL(request.url, "http://localhost").pathname;
     const routePath = rawPath.replace(/\/+/g, "/").replace(/\/+$/, "") || "/";
     if (PUBLIC_ROUTES.has(routePath)) {
       return;
     }
+    if (routePath.startsWith("/auth/oauth/")) {
+      return;
+    }
     const queryToken = request.query["access_token"];
     const token = extractBearerToken(request.headers.authorization) ?? queryToken ?? null;
+    if (!token && request.userAuthContext) {
+      return;
+    }
     if (!token) {
       return reply.code(401).send({ error: "Unauthorized", message: "Missing Authorization header" });
     }
@@ -115,15 +114,95 @@ function createAuthMiddleware(cache, jwtConfig) {
     request.authContext = authContext;
   };
 }
-function registerAuthRoutes(app, authService) {
+
+// src/auth/user-cookies.ts
+var COOKIE_ACCESS = "kb_access";
+var COOKIE_REFRESH = "kb_refresh";
+var COOKIE_CSRF = "kb_csrf";
+var COOKIE_OAUTH_STATE = "kb_oauth_state";
+var REFRESH_COOKIE_PATH = "/api/auth/refresh";
+var OAUTH_COOKIE_PATH = "/api/auth/oauth";
+var baseAttrs = (cookieSecure, ttlSec) => ({
+  httpOnly: true,
+  secure: cookieSecure,
+  sameSite: "strict",
+  maxAge: ttlSec
+});
+var setSessionCookies = (reply, input, opts) => {
+  reply.setCookie(COOKIE_ACCESS, input.accessToken, {
+    ...baseAttrs(opts.cookieSecure, input.accessTtlSec),
+    path: "/"
+  });
+  reply.setCookie(COOKIE_REFRESH, input.refreshToken, {
+    ...baseAttrs(opts.cookieSecure, input.refreshTtlSec),
+    path: REFRESH_COOKIE_PATH
+  });
+  reply.setCookie(COOKIE_CSRF, input.csrfToken, {
+    // CSRF cookie is NON-HttpOnly so JS can read it.
+    httpOnly: false,
+    secure: opts.cookieSecure,
+    sameSite: "strict",
+    maxAge: input.refreshTtlSec,
+    path: "/"
+  });
+};
+var setOAuthStateCookie = (reply, state, opts, ttlSec) => {
+  reply.setCookie(COOKIE_OAUTH_STATE, state, {
+    httpOnly: true,
+    secure: opts.cookieSecure,
+    sameSite: "lax",
+    maxAge: ttlSec,
+    path: OAUTH_COOKIE_PATH
+  });
+};
+var clearOAuthStateCookie = (reply, opts) => {
+  reply.clearCookie(COOKIE_OAUTH_STATE, {
+    secure: opts.cookieSecure,
+    sameSite: "lax",
+    path: OAUTH_COOKIE_PATH
+  });
+};
+var clearSessionCookies = (reply, opts) => {
+  const common = { secure: opts.cookieSecure, sameSite: "strict" };
+  reply.clearCookie(COOKIE_ACCESS, { ...common, path: "/" });
+  reply.clearCookie(COOKIE_REFRESH, { ...common, path: REFRESH_COOKIE_PATH });
+  reply.clearCookie(COOKIE_CSRF, { ...common, path: "/" });
+};
+
+// src/auth/routes.ts
+function registerAuthRoutes(app, authService, userExt) {
   app.post("/auth/register", { schema: { tags: ["Auth"], summary: "Register new agent and get credentials" } }, async (request, reply) => {
+    const userCtx = request.userAuthContext;
+    const machineCtx = request.authContext;
+    if (userCtx && userExt?.pdp) {
+      const decision = await userExt.pdp.check(
+        { userId: userCtx.userId, tenantId: userCtx.tenantId, type: "user" },
+        PERMISSIONS.MACHINE_REGISTER
+      );
+      if (!decision.allow) {
+        return reply.code(403).send({ error: "Forbidden", message: `Permission denied: ${PERMISSIONS.MACHINE_REGISTER}` });
+      }
+    } else if (machineCtx) {
+      if (!machineCtx.permissions.includes(PERMISSIONS.MACHINE_REGISTER)) {
+        return reply.code(403).send({ error: "Forbidden", message: `Permission denied: ${PERMISSIONS.MACHINE_REGISTER}` });
+      }
+    } else {
+      return reply.code(401).send({ error: "Unauthorized", message: "Authentication required" });
+    }
     const parsed = RegisterRequestSchema.safeParse(request.body);
     if (!parsed.success) {
       return reply.code(400).send({ error: "Bad Request", issues: parsed.error.issues });
     }
-    const { name, capabilities, publicKey } = parsed.data;
-    const result = await authService.register({ name, capabilities, publicKey });
-    return reply.code(201).send(result);
+    const { name, capabilities, publicKey, handle, email } = parsed.data;
+    try {
+      const result = await authService.register({ name, capabilities, publicKey, handle, email });
+      return reply.code(200).send(result);
+    } catch (err) {
+      if (err instanceof Error && err.code === "HANDLE_TAKEN") {
+        return reply.code(409).send({ error: "Conflict", message: err.message });
+      }
+      throw err;
+    }
   });
   app.post("/auth/token", { schema: { tags: ["Auth"], summary: "Issue JWT token pair" } }, async (request, reply) => {
     const parsed = TokenRequestSchema.safeParse(request.body);
@@ -136,7 +215,15 @@ function registerAuthRoutes(app, authService) {
     }
     return reply.send(tokens);
   });
-  app.post("/auth/refresh", { schema: { tags: ["Auth"], summary: "Refresh JWT token pair" } }, async (request, reply) => {
+  app.post("/auth/refresh", { schema: { tags: ["Auth"], summary: "Refresh JWT token pair (machine or user)" } }, async (request, reply) => {
+    const cookies = request.cookies;
+    const refreshCookie = cookies?.[COOKIE_REFRESH];
+    if (refreshCookie && userExt) {
+      const handled = await userExt.userRefreshFn(request, reply);
+      if (handled) {
+        return;
+      }
+    }
     const parsed = RefreshRequestSchema.safeParse(request.body);
     if (!parsed.success) {
       return reply.code(400).send({ error: "Bad Request", issues: parsed.error.issues });
@@ -148,6 +235,625 @@ function registerAuthRoutes(app, authService) {
     return reply.send(tokens);
   });
 }
+var sendUnauthorized = (reply, message) => reply.code(401).send({ error: "Unauthorized", message });
+var createUserAuthMiddleware = (deps) => {
+  return async function userAuthMiddleware(request, reply) {
+    const cookies = request.cookies;
+    const token = cookies?.[COOKIE_ACCESS];
+    if (!token) {
+      return;
+    }
+    const payload = await verifyUserAccessToken(token, deps.jwtConfig);
+    if (!payload) {
+      return sendUnauthorized(reply, "Invalid session");
+    }
+    const hostHeader = request.headers["host"];
+    const resolvedTenant = deps.tenantResolver.resolve(
+      typeof hostHeader === "string" ? hostHeader : void 0
+    );
+    if (resolvedTenant !== null && resolvedTenant !== payload.tenantId) {
+      return sendUnauthorized(reply, "Tenant mismatch");
+    }
+    const user = await deps.users.getById(payload.userId);
+    if (!user || user.status !== "active") {
+      return sendUnauthorized(reply, "Session no longer valid");
+    }
+    request.userAuthContext = {
+      type: "user",
+      userId: payload.userId,
+      tenantId: payload.tenantId,
+      familyId: payload.familyId
+    };
+  };
+};
+
+// src/auth/oauth-return-to.ts
+var SAFE_RELATIVE_PATH = /^\/(?![/\\])/;
+function validateReturnTo(raw) {
+  if (typeof raw !== "string" || raw.length === 0) {
+    return "/";
+  }
+  if (!SAFE_RELATIVE_PATH.test(raw)) {
+    return "/";
+  }
+  return raw;
+}
+
+// src/auth/oauth-routes.ts
+var OAUTH_STATE_TTL_SEC = 10 * 60;
+function getCookies(request) {
+  return request.cookies ?? {};
+}
+function callbackUrl(request, id, secure) {
+  const host = typeof request.headers.host === "string" ? request.headers.host : "localhost";
+  const proto = secure ? "https" : "http";
+  return `${proto}://${host}/api/auth/oauth/${id}/callback`;
+}
+function isRedirectProvider(p) {
+  return !!p && p.kind === "redirect";
+}
+function accessTtl(result) {
+  return result.access.expiresInSec;
+}
+function refreshTtl(result) {
+  return result.refresh.expiresInSec;
+}
+function registerOAuthRoutes(app, deps) {
+  const { userAuthService, providers, tenantResolver, oauthState, cookieOpts, rateLimiter } = deps;
+  const perIpPerMinute = deps.oauthCallbackPerIpPerMinute ?? 60;
+  function rateLimitGate(bucket) {
+    return async (request, reply) => {
+      if (!rateLimiter) {
+        return;
+      }
+      const r = await rateLimiter.check(`rl:oauth:${bucket}:ip:${request.ip}`, {
+        max: perIpPerMinute,
+        windowMs: 6e4
+      });
+      if (!r.allowed) {
+        reply.header("Retry-After", String(r.retryAfterSec));
+        await reply.code(429).send({ error: "Too Many Requests", message: "Rate limit exceeded", retryAfterSec: r.retryAfterSec });
+      }
+    };
+  }
+  function failCallback(reply) {
+    clearOAuthStateCookie(reply, cookieOpts);
+    return reply.redirect("/login?error=oauth", 302);
+  }
+  app.get(
+    "/auth/oauth/:id/start",
+    {
+      schema: { tags: ["Auth"], summary: "Begin a redirect/OAuth login flow" },
+      preHandler: rateLimitGate("start")
+    },
+    async (request, reply) => {
+      const { id } = request.params;
+      const provider = providers.get(id);
+      if (!isRedirectProvider(provider)) {
+        return reply.code(400).send({ error: "Bad Request", message: "Unknown or non-redirect provider" });
+      }
+      const host = typeof request.headers.host === "string" ? request.headers.host : "";
+      const tenantId = tenantResolver.resolve(host) ?? "";
+      const returnTo = validateReturnTo(request.query?.returnTo);
+      const state = issueCsrfToken();
+      const redirectUri = callbackUrl(request, id, cookieOpts.cookieSecure);
+      const startResult = await provider.startAuthorization({ state, redirectUri });
+      await oauthState.put(state, {
+        providerId: id,
+        tenantId,
+        returnTo,
+        session: startResult.session,
+        createdAt: Date.now()
+      });
+      setOAuthStateCookie(reply, state, cookieOpts, OAUTH_STATE_TTL_SEC);
+      return reply.redirect(startResult.redirectUrl, 302);
+    }
+  );
+  app.get(
+    "/auth/oauth/:id/callback",
+    {
+      schema: { tags: ["Auth"], summary: "Complete a redirect/OAuth login flow" },
+      preHandler: rateLimitGate("cb")
+    },
+    async (request, reply) => {
+      const { id } = request.params;
+      const { state, code, error } = request.query ?? {};
+      if (error) {
+        return failCallback(reply);
+      }
+      const cookieState = getCookies(request)[COOKIE_OAUTH_STATE];
+      if (!state || !cookieState || state !== cookieState) {
+        return failCallback(reply);
+      }
+      const record = await oauthState.consume(state);
+      if (!record) {
+        return failCallback(reply);
+      }
+      if (record.providerId !== id) {
+        return failCallback(reply);
+      }
+      const host = typeof request.headers.host === "string" ? request.headers.host : "";
+      const callbackTenant = tenantResolver.resolve(host);
+      if (callbackTenant !== null && callbackTenant !== record.tenantId) {
+        return failCallback(reply);
+      }
+      const provider = providers.get(record.providerId);
+      if (!isRedirectProvider(provider)) {
+        return failCallback(reply);
+      }
+      const redirectUri = callbackUrl(request, record.providerId, cookieOpts.cookieSecure);
+      try {
+        const result = await userAuthService.login(
+          {
+            providerId: record.providerId,
+            input: { code, state, session: record.session, redirectUri }
+          },
+          record.tenantId,
+          { ip: request.ip, userAgent: request.headers["user-agent"] }
+        );
+        setSessionCookies(reply, {
+          accessToken: result.access.token,
+          accessTtlSec: accessTtl(result),
+          refreshToken: result.refresh.token,
+          refreshTtlSec: refreshTtl(result),
+          csrfToken: result.csrf
+        }, cookieOpts);
+        clearOAuthStateCookie(reply, cookieOpts);
+        return reply.redirect(record.returnTo, 302);
+      } catch (err) {
+        if (err instanceof AuthError) {
+          return failCallback(reply);
+        }
+        throw err;
+      }
+    }
+  );
+}
+function getCookies2(request) {
+  return request.cookies ?? {};
+}
+function requireUser(request, reply) {
+  const ctx = request.userAuthContext;
+  if (!ctx) {
+    void reply.code(401).send({ error: "Unauthorized", message: "No active user session" });
+    return null;
+  }
+  return ctx;
+}
+function checkCsrf(request, reply) {
+  const cookieVal = getCookies2(request)[COOKIE_CSRF];
+  const headerVal = request.headers["x-csrf-token"];
+  const headerStr = typeof headerVal === "string" ? headerVal : void 0;
+  if (!verifyCsrfToken(cookieVal, headerStr)) {
+    void reply.code(403).send({ error: "Forbidden", message: "CSRF token mismatch" });
+    return false;
+  }
+  return true;
+}
+function accessTtl2(result) {
+  return result.access.expiresInSec;
+}
+function refreshTtl2(result) {
+  return result.refresh.expiresInSec;
+}
+function createUserRefreshFn(deps) {
+  const { userAuthService, cookieOpts } = deps;
+  return async function userRefreshFn(request, reply) {
+    const refreshCookie = getCookies2(request)[COOKIE_REFRESH];
+    if (!refreshCookie) {
+      return false;
+    }
+    try {
+      const result = await userAuthService.refresh(refreshCookie);
+      setSessionCookies(reply, {
+        accessToken: result.access.token,
+        accessTtlSec: accessTtl2(result),
+        refreshToken: result.refresh.token,
+        refreshTtlSec: refreshTtl2(result),
+        csrfToken: result.csrf
+      }, cookieOpts);
+      void reply.send({ ok: true });
+      return true;
+    } catch (err) {
+      if (err instanceof AuthError) {
+        clearSessionCookies(reply, cookieOpts);
+        void reply.code(401).send({ error: "Unauthorized", message: "Session expired or revoked" });
+        return true;
+      }
+      throw err;
+    }
+  };
+}
+function registerUserAuthRoutes(app, deps) {
+  const { userAuthService, users, sessions, invites, providers, pdp, tenantResolver, cookieOpts, inviteTtlMs, rateLimiter, authRateLimit, oauthState, oauthCallbackPerIpPerMinute } = deps;
+  const authRateLimitCfg = { loginPerIpPerMinute: 10, loginPerEmailPerMinute: 5, ...authRateLimit };
+  if (oauthState) {
+    registerOAuthRoutes(app, {
+      userAuthService,
+      providers,
+      tenantResolver,
+      oauthState,
+      cookieOpts,
+      rateLimiter,
+      oauthCallbackPerIpPerMinute
+    });
+  }
+  app.get("/auth/me", {
+    schema: { tags: ["Auth"], summary: "Get profile for the authenticated caller" }
+  }, async (request, reply) => {
+    if (request.userAuthContext) {
+      const { userId, tenantId } = request.userAuthContext;
+      const user = await users.getById(userId);
+      if (!user) {
+        return reply.code(404).send({ error: "Not found", message: "User record not found" });
+      }
+      return reply.send({ userId: user.userId, email: user.email, tenantId });
+    }
+    const auth = request.authContext;
+    if (!auth) {
+      return reply.code(401).send({ error: "Unauthorized", message: "Not authenticated" });
+    }
+    return reply.send({
+      userId: auth.userId,
+      namespaceId: auth.namespaceId,
+      email: auth.userId,
+      tenantId: auth.namespaceId
+    });
+  });
+  app.get("/auth/providers", {
+    schema: { tags: ["Auth"], summary: "List registered identity providers" }
+  }, async (_request, reply) => {
+    return reply.send({ providers: providers.list() });
+  });
+  app.post("/auth/login", {
+    schema: { tags: ["Auth"], summary: "Login with email/password (sets session cookies)" }
+  }, async (request, reply) => {
+    const { email, password, providerId, tenantId: bodyTenantId } = request.body ?? {};
+    if (typeof email !== "string" || !email) {
+      return reply.code(400).send({ error: "Bad Request", message: "email is required" });
+    }
+    if (typeof password !== "string" || !password) {
+      return reply.code(400).send({ error: "Bad Request", message: "password is required" });
+    }
+    const host = typeof request.headers.host === "string" ? request.headers.host : "";
+    const hostTenant = tenantResolver.resolve(host);
+    const tenantId = hostTenant ?? bodyTenantId ?? "";
+    if (rateLimiter) {
+      const emailNorm = email.toLowerCase().trim();
+      const [ipPeek, emailPeek] = await Promise.all([
+        rateLimiter.peek(`rl:login:ip:${request.ip}`, { max: authRateLimitCfg.loginPerIpPerMinute, windowMs: 6e4 }),
+        rateLimiter.peek(`rl:login:email:${emailNorm}`, { max: authRateLimitCfg.loginPerEmailPerMinute, windowMs: 6e4 })
+      ]);
+      if (!ipPeek.allowed || !emailPeek.allowed) {
+        const retryAfter = !ipPeek.allowed ? ipPeek.retryAfterSec : !emailPeek.allowed ? emailPeek.retryAfterSec : 60;
+        reply.header("Retry-After", String(retryAfter));
+        return reply.code(429).send({ error: "Too Many Requests", message: "Rate limit exceeded", retryAfterSec: retryAfter });
+      }
+    }
+    try {
+      const result = await userAuthService.login(
+        { providerId: providerId ?? "email-password", input: { email, password } },
+        tenantId,
+        { ip: request.ip, userAgent: request.headers["user-agent"] }
+      );
+      setSessionCookies(reply, {
+        accessToken: result.access.token,
+        accessTtlSec: accessTtl2(result),
+        refreshToken: result.refresh.token,
+        refreshTtlSec: refreshTtl2(result),
+        csrfToken: result.csrf
+      }, cookieOpts);
+      return reply.send({ ok: true });
+    } catch (err) {
+      if (err instanceof AuthError) {
+        if (rateLimiter) {
+          const perIpMax = authRateLimitCfg.loginPerIpPerMinute;
+          const perEmailMax = authRateLimitCfg.loginPerEmailPerMinute;
+          const emailNorm = email.toLowerCase().trim();
+          const [ipResult, emailResult] = await Promise.all([
+            rateLimiter.check(`rl:login:ip:${request.ip}`, { max: perIpMax, windowMs: 6e4 }),
+            rateLimiter.check(`rl:login:email:${emailNorm}`, { max: perEmailMax, windowMs: 6e4 })
+          ]);
+          if (!ipResult.allowed || !emailResult.allowed) {
+            const retryAfter = !ipResult.allowed ? ipResult.retryAfterSec : !emailResult.allowed ? emailResult.retryAfterSec : 60;
+            reply.header("Retry-After", String(retryAfter));
+            return reply.code(429).send({ error: "Too Many Requests", message: "Rate limit exceeded", retryAfterSec: retryAfter });
+          }
+        }
+        return reply.code(401).send({ error: "invalid_credentials" });
+      }
+      throw err;
+    }
+  });
+  app.post("/auth/logout", {
+    schema: { tags: ["Auth"], summary: "Logout and clear session cookies" }
+  }, async (request, reply) => {
+    const ctx = requireUser(request, reply);
+    if (!ctx) {
+      return;
+    }
+    if (!checkCsrf(request, reply)) {
+      return;
+    }
+    const refreshCookie = getCookies2(request)[COOKIE_REFRESH];
+    if (refreshCookie) {
+      await userAuthService.logout(refreshCookie).catch(() => {
+      });
+    }
+    clearSessionCookies(reply, cookieOpts);
+    return reply.send({ ok: true });
+  });
+  app.get("/auth/permissions", {
+    schema: { tags: ["Auth"], summary: "List permissions for the authenticated user" }
+  }, async (request, reply) => {
+    if (request.userAuthContext) {
+      const ctx = request.userAuthContext;
+      const permissions = await pdp.enumeratePermissions({
+        userId: ctx.userId,
+        tenantId: ctx.tenantId,
+        type: "user"
+      });
+      return reply.send({ permissions });
+    }
+    const auth = request.authContext;
+    if (!auth) {
+      return reply.code(401).send({ error: "Unauthorized", message: "No active session" });
+    }
+    return reply.send({ permissions: auth.permissions });
+  });
+  app.post("/auth/activate", {
+    schema: { tags: ["Auth"], summary: "Activate invite and create account (auto-login)" }
+  }, async (request, reply) => {
+    const { token, password } = request.body ?? {};
+    if (typeof token !== "string" || !token) {
+      return reply.code(400).send({ error: "Bad Request", message: "token is required" });
+    }
+    if (typeof password !== "string" || !password) {
+      return reply.code(400).send({ error: "Bad Request", message: "password is required" });
+    }
+    try {
+      const result = await userAuthService.activate({
+        activationToken: token,
+        password,
+        deviceCtx: {
+          ip: request.ip,
+          userAgent: request.headers["user-agent"]
+        }
+      });
+      setSessionCookies(reply, {
+        accessToken: result.access.token,
+        accessTtlSec: accessTtl2(result),
+        refreshToken: result.refresh.token,
+        refreshTtlSec: refreshTtl2(result),
+        csrfToken: result.csrf
+      }, cookieOpts);
+      return reply.send({ ok: true });
+    } catch (err) {
+      if (err instanceof AuthError) {
+        const code = err.code;
+        if (code === "unknown_invite") {
+          return reply.code(401).send({ error: "invalid_invite", message: "Invalid or expired invite" });
+        }
+        if (code === "invalid_invite") {
+          return reply.code(422).send({ error: "invalid_invite", message: "Invalid or expired invite" });
+        }
+        return reply.code(400).send({ error: "Bad Request", message: err.message });
+      }
+      throw err;
+    }
+  });
+  app.post("/auth/password/change", {
+    schema: { tags: ["Auth"], summary: "Change password (revokes all other sessions)" }
+  }, async (request, reply) => {
+    const ctx = requireUser(request, reply);
+    if (!ctx) {
+      return;
+    }
+    if (!checkCsrf(request, reply)) {
+      return;
+    }
+    const { currentPassword, newPassword } = request.body ?? {};
+    if (!currentPassword || !newPassword) {
+      return reply.code(400).send({
+        error: "Bad Request",
+        message: "currentPassword and newPassword are required"
+      });
+    }
+    try {
+      await userAuthService.changePassword({
+        userId: ctx.userId,
+        currentFamilyId: ctx.familyId,
+        currentPassword,
+        newPassword
+      });
+      return reply.send({ ok: true });
+    } catch (err) {
+      if (err instanceof AuthError) {
+        const code = err.code;
+        if (code === "invalid_current_password") {
+          return reply.code(400).send({ error: "Bad Request", message: "Current password is incorrect" });
+        }
+        if (code === "weak_password") {
+          return reply.code(400).send({ error: "Bad Request", message: err.message });
+        }
+      }
+      throw err;
+    }
+  });
+  app.get("/auth/sessions", {
+    schema: { tags: ["Auth"], summary: "List active sessions for the authenticated user" }
+  }, async (request, reply) => {
+    const ctx = requireUser(request, reply);
+    if (!ctx) {
+      return;
+    }
+    const families = await sessions.listFamiliesByUser(ctx.userId);
+    return reply.send({
+      sessions: families.map((f) => ({
+        familyId: f.familyId,
+        createdAt: f.createdAt,
+        lastUsedAt: f.lastUsedAt,
+        userAgent: f.userAgent,
+        ipFirst: f.ipFirst,
+        isCurrent: f.familyId === ctx.familyId
+      }))
+    });
+  });
+  app.post("/auth/sessions/revoke-all", {
+    schema: { tags: ["Auth"], summary: "Revoke all sessions except the current one" }
+  }, async (request, reply) => {
+    const ctx = requireUser(request, reply);
+    if (!ctx) {
+      return;
+    }
+    if (!checkCsrf(request, reply)) {
+      return;
+    }
+    await sessions.revokeAllUserSessionsExcept(ctx.userId, ctx.familyId);
+    return reply.send({ ok: true });
+  });
+  app.post("/auth/sessions/:fam/revoke", {
+    schema: { tags: ["Auth"], summary: "Revoke a specific session family" }
+  }, async (request, reply) => {
+    const ctx = requireUser(request, reply);
+    if (!ctx) {
+      return;
+    }
+    if (!checkCsrf(request, reply)) {
+      return;
+    }
+    const { fam } = request.params;
+    const ownFamilies = await sessions.listFamiliesByUser(ctx.userId);
+    if (!ownFamilies.some((f) => f.familyId === fam)) {
+      return reply.code(404).send({ error: "Not found", message: "Session not found" });
+    }
+    await sessions.revokeFamily(fam);
+    return reply.send({ ok: true });
+  });
+  async function requirePermission(request, reply, permission) {
+    const ctx = requireUser(request, reply);
+    if (!ctx) {
+      return false;
+    }
+    const decision = await pdp.check(
+      { userId: ctx.userId, tenantId: ctx.tenantId, type: "user" },
+      permission
+    );
+    if (!decision.allow) {
+      void reply.code(403).send({ error: "Forbidden", message: `Permission denied: ${permission}` });
+      return false;
+    }
+    return true;
+  }
+  app.post("/auth/invites", {
+    schema: { tags: ["Auth"], summary: "Create an invite for a new user (admin only)" }
+  }, async (request, reply) => {
+    if (!await requirePermission(request, reply, PERMISSIONS.INVITES_WRITE)) {
+      return;
+    }
+    if (!checkCsrf(request, reply)) {
+      return;
+    }
+    const ctx = request.userAuthContext;
+    const { email, groupId, ttlMs: bodyTtlMs } = request.body ?? {};
+    if (!email || !groupId) {
+      return reply.code(400).send({ error: "Bad Request", message: "email and groupId are required" });
+    }
+    const effectiveTtlMs = typeof bodyTtlMs === "number" && bodyTtlMs > 0 ? bodyTtlMs : inviteTtlMs;
+    const result = await invites.createInvite({
+      email,
+      tenantId: ctx.tenantId,
+      groupId,
+      createdBy: ctx.userId,
+      ttlMs: effectiveTtlMs
+    });
+    const host = typeof request.headers.host === "string" ? request.headers.host : "localhost";
+    const protocol = cookieOpts.cookieSecure ? "https" : "http";
+    const activationUrl = `${protocol}://${host}/activate?token=${result.activationToken}`;
+    return reply.code(201).send({ inviteId: result.inviteId, activationUrl });
+  });
+  app.post("/auth/invites/:id/revoke", {
+    schema: { tags: ["Auth"], summary: "Revoke a pending invite (admin only)" }
+  }, async (request, reply) => {
+    if (!await requirePermission(request, reply, PERMISSIONS.INVITES_WRITE)) {
+      return;
+    }
+    if (!checkCsrf(request, reply)) {
+      return;
+    }
+    const ctx = request.userAuthContext;
+    const invite = await invites.findById(request.params.id);
+    if (!invite || invite.tenantId !== ctx.tenantId) {
+      return reply.code(404).send({ error: "Not found", message: "Invite not found" });
+    }
+    await invites.revoke(request.params.id);
+    return reply.send({ ok: true });
+  });
+  app.get("/auth/invites", {
+    schema: { tags: ["Auth"], summary: "List invites for the tenant (admin only)" }
+  }, async (request, reply) => {
+    if (!await requirePermission(request, reply, PERMISSIONS.INVITES_READ)) {
+      return;
+    }
+    const ctx = request.userAuthContext;
+    const all = await invites.listByTenant(ctx.tenantId);
+    return reply.send({ invites: all });
+  });
+  app.get("/auth/users", {
+    schema: { tags: ["Auth"], summary: "List users for the tenant (admin only)" }
+  }, async (request, reply) => {
+    if (!await requirePermission(request, reply, PERMISSIONS.USERS_READ)) {
+      return;
+    }
+    const ctx = request.userAuthContext;
+    const all = await users.listByTenant(ctx.tenantId);
+    return reply.send({
+      users: all.map((u) => ({
+        userId: u.userId,
+        email: u.email,
+        tenantId: u.tenantId,
+        status: u.status
+      }))
+    });
+  });
+  app.post("/auth/users/:id/disable", {
+    schema: { tags: ["Auth"], summary: "Disable a user account (immediate via CD-1)" }
+  }, async (request, reply) => {
+    if (!await requirePermission(request, reply, PERMISSIONS.USERS_WRITE)) {
+      return;
+    }
+    if (!checkCsrf(request, reply)) {
+      return;
+    }
+    const ctx = request.userAuthContext;
+    const { id } = request.params;
+    const target = await users.getById(id);
+    if (!target || target.tenantId !== ctx.tenantId) {
+      return reply.code(404).send({ error: "Not found", message: "User not found" });
+    }
+    await users.setStatus(id, "disabled");
+    await sessions.revokeAllUserSessions(id);
+    return reply.send({ ok: true });
+  });
+  app.post("/auth/users/:id/enable", {
+    schema: { tags: ["Auth"], summary: "Re-enable a disabled user account" }
+  }, async (request, reply) => {
+    if (!await requirePermission(request, reply, PERMISSIONS.USERS_WRITE)) {
+      return;
+    }
+    if (!checkCsrf(request, reply)) {
+      return;
+    }
+    const ctx = request.userAuthContext;
+    const { id } = request.params;
+    const target = await users.getById(id);
+    if (!target || target.tenantId !== ctx.tenantId) {
+      return reply.code(404).send({ error: "Not found", message: "User not found" });
+    }
+    await users.setStatus(id, "active");
+    return reply.send({ ok: true });
+  });
+}
 
 // src/execute/execution-registry.ts
 var ExecutionRegistry = class {
@@ -591,7 +1297,7 @@ async function resolveLLMForTier(tier) {
   return llm;
 }
 function registerLLMGatewayRoutes(app, logger) {
-  app.post("/llm/v1/chat/completions", { schema: { tags: ["LLM"], summary: "OpenAI-compatible chat completions", hide: true } }, async (request, reply) => {
+  app.post("/api/v1/llm/chat/completions", { schema: { tags: ["LLM"], summary: "OpenAI-compatible chat completions", hide: true } }, async (request, reply) => {
     const auth = request.authContext;
     if (!auth) {
       return reply.code(401).send({ error: "Unauthorized" });
@@ -900,8 +1606,36 @@ var ALLOWED_METHODS = {
   embeddings: /* @__PURE__ */ new Set(["embed"]),
   storage: /* @__PURE__ */ new Set(["read", "write", "delete", "list", "exists"]),
   eventBus: /* @__PURE__ */ new Set(["publish", "subscribe"]),
-  sqlDatabase: /* @__PURE__ */ new Set(["query", "execute"]),
-  documentDatabase: /* @__PURE__ */ new Set(["find", "findOne", "insert", "update", "delete"])
+  documentDatabase: /* @__PURE__ */ new Set([
+    "find",
+    "findById",
+    "count",
+    "insertOne",
+    "insertMany",
+    "updateOne",
+    "updateMany",
+    "updateById",
+    "deleteMany",
+    "deleteById",
+    "bulkWrite",
+    "ensureCollection",
+    "ping"
+  ]),
+  kvStore: /* @__PURE__ */ new Set([
+    "get",
+    "getMany",
+    "set",
+    "setMany",
+    "setIfNotExists",
+    "delete",
+    "exists",
+    "cas",
+    "incr",
+    "ttl",
+    "expire",
+    "persist",
+    "ping"
+  ])
 };
 function resolveAdapter(name) {
   const adapterMap = {
@@ -912,8 +1646,8 @@ function resolveAdapter(name) {
     embeddings: () => platform.embeddings,
     storage: () => platform.storage,
     eventBus: () => platform.eventBus,
-    sqlDatabase: () => platform.sqlDatabase,
-    documentDatabase: () => platform.documentDatabase
+    documentDatabase: () => platform.documentDatabase,
+    kvStore: () => platform.kvStore
   };
   const getter = adapterMap[name];
   return getter ? getter() : void 0;
@@ -1027,11 +1761,8 @@ function registerPlatformRoutes(app, logger) {
 }
 var MERGED_CACHE_KEY = "__gateway_merged_openapi";
 var MERGED_CACHE_TTL = 3e4;
-var UPSTREAM_SPEC_URLS = [
-  "http://localhost:5050/openapi.json",
-  "http://localhost:7778/openapi.json"
-];
-function registerAggregatedDocsRoutes(app, cache) {
+function registerAggregatedDocsRoutes(app, config, serviceTransport, cache) {
+  const upstreamServiceIds = Object.values(config.upstreams).map((u) => u.serviceId);
   app.get("/openapi-merged.json", async (_req, reply) => {
     if (cache) {
       try {
@@ -1043,8 +1774,11 @@ function registerAggregatedDocsRoutes(app, cache) {
       }
     }
     const results = await Promise.allSettled(
-      UPSTREAM_SPEC_URLS.map(
-        (url) => fetch(url, { signal: AbortSignal.timeout(3e3) }).then((r) => r.json())
+      upstreamServiceIds.map(
+        (serviceId) => serviceTransport.call(serviceId, {
+          path: "/openapi.json",
+          signal: AbortSignal.timeout(3e3)
+        }).then((r) => r.payload)
       )
     );
     const specs = results.filter((r) => r.status === "fulfilled").map((r) => r.value);
@@ -1095,8 +1829,8 @@ var HostRegistry = class {
     const hosts = await this.store.listAll();
     for (const host of hosts) {
       const offline = { ...host, status: "offline", connections: [] };
-      const cacheKey = this.hostKey(host.namespaceId, host.hostId);
-      await this.cache.set(cacheKey, offline);
+      const cacheKey2 = this.hostKey(host.namespaceId, host.hostId);
+      await this.cache.set(cacheKey2, offline);
       await this.store.save(offline);
       await this.addToIndex(host.namespaceId, host.hostId);
     }
@@ -1268,10 +2002,16 @@ var HostRegistry = class {
     return results.filter((h) => h !== null);
   }
   async deregister(hostId, namespaceId) {
-    const deleted = this.store ? await this.store.delete(hostId, namespaceId) : false;
+    if (this.store) {
+      const deleted = await this.store.delete(hostId, namespaceId);
+      await this.cache.delete(this.hostKey(namespaceId, hostId));
+      await this.removeFromIndex(namespaceId, hostId);
+      return deleted;
+    }
+    const exists = !!await this.cache.get(this.hostKey(namespaceId, hostId));
     await this.cache.delete(this.hostKey(namespaceId, hostId));
     await this.removeFromIndex(namespaceId, hostId);
-    return deleted;
+    return exists;
   }
   async ensureRegistered(hostId, namespaceId, name, capabilities = []) {
     const existing = await this.get(hostId, namespaceId);
@@ -1356,8 +2096,29 @@ function createWsHandler(cache, jwtConfig, logger, hostRegistry) {
       socket.close(1008, "Missing Authorization header");
       return;
     }
+    let resolveHello;
+    let rejectHello;
+    const helloRawPromise = new Promise((res, rej) => {
+      resolveHello = res;
+      rejectHello = rej;
+    });
+    helloRawPromise.catch(() => {
+    });
+    const helloTimeout = setTimeout(() => {
+      socket.close(1008, "Hello timeout");
+      rejectHello(new Error("Hello timeout"));
+    }, HELLO_TIMEOUT_MS);
+    socket.once("message", (raw) => {
+      clearTimeout(helloTimeout);
+      resolveHello(raw);
+    });
+    socket.once("close", () => {
+      clearTimeout(helloTimeout);
+      rejectHello(new Error("Socket closed before hello"));
+    });
     const tokenEntry = await resolveToken(token, cache, jwtConfig);
     if (!tokenEntry || tokenEntry.type !== "machine") {
+      clearTimeout(helloTimeout);
       logDiagnosticEvent(logger, {
         domain: "service",
         event: "gateway.hosts.ws.auth",
@@ -1376,88 +2137,67 @@ function createWsHandler(cache, jwtConfig, logger, hostRegistry) {
     const sessionId = randomUUID();
     let protocolVersion = null;
     let helloCaps = [];
-    let helloDone = false;
     const protocolVersions = SUPPORTED_PROTOCOL_VERSIONS;
-    await new Promise((resolve, reject) => {
-      const helloTimeout = setTimeout(() => {
-        if (!helloDone) {
-          helloDone = true;
-          logDiagnosticEvent(logger, {
-            domain: "service",
-            event: "gateway.hosts.ws.handshake",
-            level: "warn",
-            reasonCode: "websocket_hello_timeout",
-            message: "Host WebSocket hello timed out",
-            outcome: "failed",
-            serviceId: "gateway",
-            route: "/hosts/connect",
-            evidence: {
-              hostId,
-              namespaceId
-            }
-          });
-          socket.close(1008, "Hello timeout");
-          reject(new Error("Hello timeout"));
-        }
-      }, HELLO_TIMEOUT_MS);
-      socket.once("message", (raw) => {
-        if (helloDone) {
-          return;
-        }
-        helloDone = true;
-        clearTimeout(helloTimeout);
-        try {
-          const msg = HelloMessageSchema.parse(JSON.parse(raw.toString()));
-          if (!protocolVersions.includes(msg.protocolVersion)) {
-            logDiagnosticEvent(logger, {
-              domain: "service",
-              event: "gateway.hosts.ws.handshake",
-              level: "warn",
-              reasonCode: "websocket_protocol_unsupported",
-              message: "Host WebSocket protocol version is unsupported",
-              outcome: "failed",
-              serviceId: "gateway",
-              route: "/hosts/connect",
-              evidence: {
-                hostId,
-                namespaceId,
-                protocolVersion: msg.protocolVersion,
-                supportedVersions: [...SUPPORTED_PROTOCOL_VERSIONS]
-              }
-            });
-            send(socket, {
-              type: "negotiate",
-              supportedVersions: [...SUPPORTED_PROTOCOL_VERSIONS]
-            });
-            socket.close(1008, "Unsupported protocol version");
-            reject(new Error("Unsupported protocol version"));
-            return;
+    try {
+      const helloRaw = await helloRawPromise;
+      const msg = HelloMessageSchema.parse(JSON.parse(helloRaw.toString()));
+      if (!protocolVersions.includes(msg.protocolVersion)) {
+        logDiagnosticEvent(logger, {
+          domain: "service",
+          event: "gateway.hosts.ws.handshake",
+          level: "warn",
+          reasonCode: "websocket_protocol_unsupported",
+          message: "Host WebSocket protocol version is unsupported",
+          outcome: "failed",
+          serviceId: "gateway",
+          route: "/hosts/connect",
+          evidence: {
+            hostId,
+            namespaceId,
+            protocolVersion: msg.protocolVersion,
+            supportedVersions: [...SUPPORTED_PROTOCOL_VERSIONS]
           }
-          protocolVersion = msg.protocolVersion;
-          helloCaps = msg.capabilities ?? [];
-          resolve();
-        } catch (error) {
-          logDiagnosticEvent(logger, {
-            domain: "service",
-            event: "gateway.hosts.ws.handshake",
-            level: "warn",
-            reasonCode: "websocket_handshake_invalid",
-            message: "Host WebSocket hello message is invalid",
-            outcome: "failed",
-            error: error instanceof Error ? error : new Error(String(error)),
-            serviceId: "gateway",
-            route: "/hosts/connect",
-            evidence: {
-              hostId,
-              namespaceId
-            }
-          });
-          socket.close(1008, "Invalid hello message");
-          reject(new Error("Invalid hello"));
-        }
-      });
-    }).catch(() => {
-    });
+        });
+        send(socket, {
+          type: "negotiate",
+          supportedVersions: [...SUPPORTED_PROTOCOL_VERSIONS]
+        });
+        socket.close(1008, "Unsupported protocol version");
+        return;
+      }
+      protocolVersion = msg.protocolVersion;
+      helloCaps = msg.capabilities ?? [];
+    } catch (error) {
+      const isTimeout = error instanceof Error && error.message === "Hello timeout";
+      if (isTimeout) {
+        logDiagnosticEvent(logger, {
+          domain: "service",
+          event: "gateway.hosts.ws.handshake",
+          level: "warn",
+          reasonCode: "websocket_hello_timeout",
+          message: "Host WebSocket hello timed out",
+          outcome: "failed",
+          serviceId: "gateway",
+          route: "/hosts/connect",
+          evidence: { hostId, namespaceId }
+        });
+      } else if (!(error instanceof Error && error.message === "Socket closed before hello")) {
+        logDiagnosticEvent(logger, {
+          domain: "service",
+          event: "gateway.hosts.ws.handshake",
+          level: "warn",
+          reasonCode: "websocket_handshake_invalid",
+          message: "Host WebSocket hello message is invalid",
+          outcome: "failed",
+          error: error instanceof Error ? error : new Error(String(error)),
+          serviceId: "gateway",
+          route: "/hosts/connect",
+          evidence: { hostId, namespaceId }
+        });
+        socket.close(1008, "Invalid hello message");
+      }
+      return;
+    }
     if (!protocolVersion) {
       return;
     }
@@ -1839,9 +2579,106 @@ function createClientWsHandler(cache, jwtConfig, logger) {
   };
 }
 
+// src/ws/pump.ts
+var OPEN = 1;
+function normalizeCloseCode(code) {
+  if (code === void 0 || code === 1005 || code === 1006) {
+    return void 0;
+  }
+  return code;
+}
+function safeClose(ws, code, reason) {
+  if (ws.readyState === OPEN || ws.readyState === 0) {
+    try {
+      if (code === void 0) {
+        ws.close();
+      } else if (reason === void 0) {
+        ws.close(code);
+      } else {
+        ws.close(code, reason);
+      }
+    } catch {
+    }
+  }
+}
+function pumpBidirectional(client, upstream, logger) {
+  const pending = [];
+  let upstreamOpen = false;
+  let closed = false;
+  const closeBoth = (code, reason) => {
+    if (closed) {
+      return;
+    }
+    closed = true;
+    safeClose(client, code, reason);
+    safeClose(upstream, code, reason);
+  };
+  client.on("message", (data, isBinary) => {
+    if (upstreamOpen && upstream.readyState === OPEN) {
+      upstream.send(data, { binary: isBinary });
+    } else {
+      pending.push({ data, binary: isBinary });
+    }
+  });
+  upstream.on("open", () => {
+    upstreamOpen = true;
+    for (const frame of pending) {
+      if (upstream.readyState === OPEN) {
+        upstream.send(frame.data, { binary: frame.binary });
+      }
+    }
+    pending.length = 0;
+  });
+  upstream.on("message", (data, isBinary) => {
+    if (client.readyState === OPEN) {
+      client.send(data, { binary: isBinary });
+    }
+  });
+  upstream.on("close", (code, reason) => {
+    closeBoth(normalizeCloseCode(code), reason);
+  });
+  client.on("close", (code, reason) => {
+    closeBoth(normalizeCloseCode(code), reason);
+  });
+  upstream.on("error", (err) => {
+    logger.warn("Upstream WS error", { error: err.message });
+    closeBoth(1011);
+  });
+  client.on("error", (err) => {
+    logger.warn("Client WS error", { error: err.message });
+    closeBoth(1011);
+  });
+}
+
 // src/ws/gateway-ws.ts
 var GATEWAY_WS_PATHS = /* @__PURE__ */ new Set(["/hosts/connect", "/clients/connect"]);
-function attachGatewayWs(server, cache, jwtConfig, logger, hostRegistry) {
+var FORWARDED_WS_HEADERS = [
+  "authorization",
+  "cookie",
+  "x-request-id",
+  "x-trace-id",
+  "sec-websocket-protocol"
+];
+function pickSocketWsUpstream(pathname, upstreams) {
+  return upstreams.find(
+    (u) => pathname === u.prefix || pathname.startsWith(`${u.prefix}/`)
+  );
+}
+function buildUpstreamWsUrl(upstream, pathname, search) {
+  const rewritten = upstream.rewritePrefix + pathname.slice(upstream.prefix.length);
+  return `ws+unix://${upstream.socketPath}:${rewritten}${search}`;
+}
+function forwardWsHeaders(req) {
+  const out = {};
+  for (const name of FORWARDED_WS_HEADERS) {
+    const value = req.headers[name];
+    if (typeof value === "string") {
+      out[name] = value;
+    }
+  }
+  return out;
+}
+function attachGatewayWs(server, cache, jwtConfig, logger, hostRegistry, socketWsUpstreams = []) {
   const wss = new WebSocketServer({ noServer: true });
   const hostsHandler = createWsHandler(cache, jwtConfig, logger, hostRegistry);
   const clientsHandler = createClientWsHandler(cache, jwtConfig, logger);
@@ -1851,16 +2688,29 @@ function attachGatewayWs(server, cache, jwtConfig, logger, hostRegistry) {
     const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
     if (GATEWAY_WS_PATHS.has(pathname)) {
       wss.handleUpgrade(req, socket, head, (ws) => {
-        if (pathname === "/hosts/connect") {
-          hostsHandler(ws, req);
-        } else {
-          clientsHandler(ws, req);
-        }
+        const handlerPromise = pathname === "/hosts/connect" ? hostsHandler(ws, req) : clientsHandler(ws, req);
+        handlerPromise.catch((err) => {
+          logger.error("Unhandled WS handler error", err instanceof Error ? err : new Error(String(err)), { pathname });
+          try {
+            ws.close(1011, "Internal error");
+          } catch {
+          }
+        });
       });
-    } else {
-      for (const listener of existingListeners) {
-        listener.call(server, req, socket, head);
-      }
+      return;
+    }
+    const socketUpstream = pickSocketWsUpstream(pathname, socketWsUpstreams);
+    if (socketUpstream) {
+      const { search } = new URL(req.url ?? "/", "http://localhost");
+      const upstreamUrl = buildUpstreamWsUrl(socketUpstream, pathname, search);
+      wss.handleUpgrade(req, socket, head, (clientWs) => {
+        const upstreamWs = new WebSocket(upstreamUrl, { headers: forwardWsHeaders(req) });
+        pumpBidirectional(clientWs, upstreamWs, logger);
+      });
+      return;
+    }
+    for (const listener of existingListeners) {
+      listener.call(server, req, socket, head);
     }
   });
   logger.info("Gateway WS endpoints attached", { paths: [...GATEWAY_WS_PATHS] });
@@ -2117,10 +2967,767 @@ function mergeTopOperations(httpOperations, domainOperations, limit = 5) {
   }
   return [...sliced.slice(0, Math.max(0, limit - 1)), firstDomainOperation];
 }
+function registerInternalRoutes(scope, internalSecret, hostRegistry, cache) {
+  scope.post("/internal/dispatch", async (request, reply) => {
+    const provided = request.headers["x-internal-secret"];
+    if (!internalSecret || provided !== internalSecret) {
+      return reply.code(403).send({ error: "Forbidden" });
+    }
+    const body = request.body;
+    if (!body.namespaceId || !body.adapter || !body.method) {
+      return reply.code(400).send({ error: "Missing required fields: namespaceId, adapter, method" });
+    }
+    const hostId = body.hostId ?? globalDispatcher.firstHostWithCapability(body.namespaceId, body.adapter) ?? globalDispatcher.firstHost(body.namespaceId);
+    if (!hostId) {
+      return reply.code(503).send({
+        error: "No host connected",
+        namespaceId: body.namespaceId
+      });
+    }
+    try {
+      const result = await globalDispatcher.call(
+        body.namespaceId,
+        hostId,
+        body.adapter,
+        body.method,
+        body.args ?? []
+      );
+      return { result };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (message.includes("Host not connected")) {
+        return reply.code(503).send({ error: message });
+      }
+      return reply.code(502).send({ error: message });
+    }
+  });
+  scope.get("/internal/auth/handle/:handle", async (request, reply) => {
+    const provided = request.headers["x-internal-secret"];
+    if (!internalSecret || provided !== internalSecret) {
+      return reply.code(403).send({ error: "Forbidden" });
+    }
+    if (!cache) {
+      return reply.code(503).send({ error: "Cache not available" });
+    }
+    const { handle } = request.params;
+    const record = await getClientByHandle(cache, handle);
+    if (!record) {
+      return reply.code(404).send({ error: "Handle not found" });
+    }
+    return { namespaceId: record.namespaceId, name: record.name, handle: record.handle };
+  });
+  scope.post("/internal/resolve-host", async (request, reply) => {
+    const provided = request.headers["x-internal-secret"];
+    if (!internalSecret || provided !== internalSecret) {
+      return reply.code(403).send({ error: "Forbidden" });
+    }
+    const body = request.body;
+    const namespaceId = body.namespaceId ?? "default";
+    const target = body.target ?? {};
+    const strategy = target.hostSelection ?? "any-matching";
+    let hostId;
+    if (strategy === "pinned" && target.hostId) {
+      const host = await hostRegistry.get(target.hostId, namespaceId);
+      if (host?.status === "online" || host?.status === "reconnecting") {
+        hostId = target.hostId;
+      }
+    } else {
+      hostId = globalDispatcher.firstHostWithCapability(namespaceId, "execution");
+    }
+    if (!hostId) {
+      return reply.code(404).send({ error: "No matching host found" });
+    }
+    return { hostId, strategy, namespaceId };
+  });
+}
+
+// src/pressure/resolve.ts
+function resolveResourceId(method, url, config) {
+  const pressure = config.pressure;
+  if (!pressure || pressure.enabled === false) {
+    return null;
+  }
+  const path = url.split("?")[0] ?? url;
+  const upperMethod = method.toUpperCase();
+  for (const override of pressure.perRoute) {
+    if (!path.startsWith(override.pathPrefix)) {
+      continue;
+    }
+    if (override.methods && override.methods.length > 0) {
+      const allowed = override.methods.some((m) => m.toUpperCase() === upperMethod);
+      if (!allowed) {
+        continue;
+      }
+    }
+    return { resource: override.resource, layer: "route", override };
+  }
+  for (const [name, upstream] of Object.entries(config.upstreams)) {
+    if (path.startsWith(upstream.prefix)) {
+      const limits = pressure.perService[name];
+      if (!limits) {
+        return null;
+      }
+      return { resource: `gateway:service:${name}`, layer: "service", upstream: name };
+    }
+  }
+  return null;
+}
+
+// src/pressure/register-limits.ts
+function registerPressureLimits(broker, config, logger) {
+  if (!config || config.enabled === false) {
+    return { perServiceRegistered: 0, perRouteRegistered: 0, perTenantEnabled: false };
+  }
+  let perServiceRegistered = 0;
+  for (const [name, limits] of Object.entries(config.perService)) {
+    broker.registerLimit(`gateway:service:${name}`, limits);
+    perServiceRegistered++;
+  }
+  let perRouteRegistered = 0;
+  for (const override of config.perRoute) {
+    broker.registerLimit(override.resource, override.limits);
+    perRouteRegistered++;
+  }
+  const perTenantEnabled = config.perTenant?.enabled === true;
+  logger.info("pressure.boot", {
+    event: "pressure.boot",
+    perService: perServiceRegistered,
+    perRoute: perRouteRegistered,
+    perTenant: perTenantEnabled
+  });
+  return { perServiceRegistered, perRouteRegistered, perTenantEnabled };
+}
+
+// src/pressure/hooks.ts
+function shouldSkip(request) {
+  const upgrade = request.headers.upgrade;
+  if (typeof upgrade === "string" && upgrade.length > 0) {
+    return true;
+  }
+  return false;
+}
+function armRequest(request) {
+  if (!request.pressureReleases) {
+    request.pressureReleases = [];
+    request.raw.on("close", () => {
+      void releaseAll(request);
+    });
+  }
+  return request.pressureReleases;
+}
+async function releaseAll(request) {
+  const releases = request.pressureReleases;
+  if (!releases || releases.length === 0) {
+    return;
+  }
+  const snapshot = releases.slice();
+  request.pressureReleases = [];
+  for (const release of snapshot) {
+    try {
+      await release();
+    } catch {
+    }
+  }
+}
+function retryAfterSeconds(waitTimeMs) {
+  if (!waitTimeMs || waitTimeMs <= 0) {
+    return 1;
+  }
+  return Math.max(1, Math.ceil(waitTimeMs / 1e3));
+}
+function createPressureOnRequest(deps) {
+  return async (request, reply) => {
+    if (shouldSkip(request)) {
+      return;
+    }
+    const resolved = resolveResourceId(request.method, request.url, deps.config);
+    if (!resolved) {
+      return;
+    }
+    const acquired = await deps.broker.tryAcquire(resolved.resource);
+    if (!acquired.allowed) {
+      const retryAfter = retryAfterSeconds(acquired.waitTimeMs);
+      deps.logger.warn("pressure.rejected", {
+        event: "pressure.rejected",
+        resource: resolved.resource,
+        layer: resolved.layer,
+        method: request.method,
+        url: request.url,
+        waitTimeMs: acquired.waitTimeMs
+      });
+      reply.code(429).header("Retry-After", String(retryAfter)).send({
+        error: "rate_limited",
+        resource: resolved.resource,
+        waitTimeMs: acquired.waitTimeMs ?? null
+      });
+      return reply;
+    }
+    armRequest(request).push(acquired.release);
+  };
+}
+function createPressurePreHandler(deps) {
+  const registered = /* @__PURE__ */ new Set();
+  const tenantCfg = deps.config.pressure?.perTenant;
+  return async (request, reply) => {
+    if (!tenantCfg || tenantCfg.enabled !== true) {
+      return;
+    }
+    if (shouldSkip(request)) {
+      return;
+    }
+    const namespaceId = request.authContext?.namespaceId;
+    if (!namespaceId) {
+      return;
+    }
+    const resource = `gateway:tenant:${namespaceId}`;
+    if (!registered.has(namespaceId)) {
+      deps.broker.registerLimit(resource, tenantCfg.limits);
+      registered.add(namespaceId);
+      deps.logger.debug?.("pressure.tenant.registered", {
+        event: "pressure.tenant.registered",
+        namespaceId
+      });
+    }
+    const acquired = await deps.broker.tryAcquire(resource);
+    if (!acquired.allowed) {
+      const retryAfter = retryAfterSeconds(acquired.waitTimeMs);
+      deps.logger.warn("pressure.rejected", {
+        event: "pressure.rejected",
+        resource,
+        layer: "tenant",
+        method: request.method,
+        url: request.url,
+        namespaceId,
+        waitTimeMs: acquired.waitTimeMs
+      });
+      reply.code(429).header("Retry-After", String(retryAfter)).send({
+        error: "rate_limited",
+        resource,
+        waitTimeMs: acquired.waitTimeMs ?? null
+      });
+      return reply;
+    }
+    armRequest(request).push(acquired.release);
+  };
+}
+function createPressureOnResponse() {
+  return async (request) => {
+    await releaseAll(request);
+  };
+}
+
+// src/webhook/secret-store.ts
+var PREVIOUS_SECRET_GRACE_MS = 864e5;
+function cacheKey(ns, pluginId, event, instanceId) {
+  const base = `webhook:secret:${ns}:${pluginId}:${event}`;
+  return instanceId ? `${base}:${instanceId}` : base;
+}
+var WebhookSecretStore = class {
+  constructor(cache) {
+    this.cache = cache;
+  }
+  cache;
+  async get(ns, pluginId, event, instanceId) {
+    return this.cache.get(cacheKey(ns, pluginId, event, instanceId));
+  }
+  async set(ns, pluginId, event, entry, instanceId) {
+    await this.cache.set(cacheKey(ns, pluginId, event, instanceId), entry);
+  }
+  async rotate(ns, pluginId, event, newSecret, instanceId) {
+    const existing = await this.get(ns, pluginId, event, instanceId);
+    const entry = { current: newSecret };
+    if (existing) {
+      entry.previous = existing.current;
+      entry.previousExpiresAt = Date.now() + PREVIOUS_SECRET_GRACE_MS;
+    }
+    await this.set(ns, pluginId, event, entry, instanceId);
+    return entry;
+  }
+  async delete(ns, pluginId, event, instanceId) {
+    await this.cache.delete(cacheKey(ns, pluginId, event, instanceId));
+  }
+};
+async function provisionWebhook(input, secretStore, backend, manifests, logger) {
+  const { namespaceId, pluginId, event, instanceId, baseUrl } = input;
+  const manifestEntry = manifests.find((m) => m.pluginId === pluginId);
+  const decl = manifestEntry?.manifest.webhooks?.handlers.find((h) => h.event === event);
+  if (!manifestEntry || !decl) {
+    throw new Error(`webhook '${pluginId}/${event}' not found`);
+  }
+  const existing = await secretStore.get(namespaceId, pluginId, event, instanceId);
+  const rotated = existing !== null;
+  const newSecret = randomBytes(32).toString("hex");
+  if (rotated) {
+    await secretStore.rotate(namespaceId, pluginId, event, newSecret, instanceId);
+  } else {
+    await secretStore.set(namespaceId, pluginId, event, { current: newSecret }, instanceId);
+  }
+  const url = instanceId ? `${baseUrl}/webhooks/${encodeURIComponent(pluginId)}/${event}/${instanceId}` : `${baseUrl}/webhooks/${encodeURIComponent(pluginId)}/${event}`;
+  let onProvisionCalled = false;
+  if (decl.onProvision) {
+    try {
+      await backend.execute({
+        handlerRef: decl.onProvision,
+        pluginRoot: manifestEntry.pluginRoot,
+        namespaceId,
+        input: { instanceId, secret: newSecret, url }
+      });
+      onProvisionCalled = true;
+    } catch (err) {
+      logger.error(
+        "onProvision handler failed",
+        err instanceof Error ? err : new Error(String(err)),
+        { pluginId, event, instanceId }
+      );
+    }
+  }
+  return { url, secret: newSecret, rotated, onProvisionCalled };
+}
+
+// src/webhook/admin-routes.ts
+var RL_PROVISION = "webhook-admin:provision";
+var RL_LIST = "webhook-admin:list";
+var RL_REVOKE = "webhook-admin:revoke";
+function registerWebhookAdminRoutes(scope, options) {
+  const { cache, logger, backend, manifests, baseUrl, broker } = options;
+  const secretStore = new WebhookSecretStore(cache);
+  broker.registerLimit(RL_PROVISION, { requestsPerMinute: 10 });
+  broker.registerLimit(RL_LIST, { requestsPerMinute: 60 });
+  broker.registerLimit(RL_REVOKE, { requestsPerMinute: 10 });
+  scope.post("/api/v1/webhooks/provision", async (request, reply) => {
+    const auth = request.authContext;
+    if (!auth) {
+      return reply.code(401).send({ error: "Unauthorized" });
+    }
+    const acquired = await broker.tryAcquire(RL_PROVISION);
+    try {
+      if (!acquired.allowed) {
+        const retryAfterSec = acquired.waitTimeMs ? Math.max(1, Math.ceil(acquired.waitTimeMs / 1e3)) : 1;
+        return reply.code(429).header("Retry-After", String(retryAfterSec)).send({ error: "Too Many Requests" });
+      }
+      const body = request.body;
+      const pluginId = typeof body?.pluginId === "string" ? body.pluginId : void 0;
+      const event = typeof body?.event === "string" ? body.event : void 0;
+      const instanceId = typeof body?.instanceId === "string" ? body.instanceId : void 0;
+      if (!pluginId) {
+        return reply.code(400).send({ error: "Bad Request", message: "pluginId is required" });
+      }
+      if (!event) {
+        return reply.code(400).send({ error: "Bad Request", message: "event is required" });
+      }
+      try {
+        const result = await provisionWebhook(
+          { namespaceId: auth.namespaceId, pluginId, event, instanceId, baseUrl },
+          secretStore,
+          backend,
+          manifests,
+          logger
+        );
+        return reply.code(200).send({
+          url: result.url,
+          secret: result.secret,
+          rotated: result.rotated
+        });
+      } catch (err) {
+        if (err instanceof Error && err.message.includes("not found")) {
+          return reply.code(404).send({ error: "Not Found", message: err.message });
+        }
+        throw err;
+      }
+    } finally {
+      await acquired.release();
+    }
+  });
+  scope.get("/api/v1/webhooks", async (request, reply) => {
+    const auth = request.authContext;
+    if (!auth) {
+      return reply.code(401).send({ error: "Unauthorized" });
+    }
+    const acquired = await broker.tryAcquire(RL_LIST);
+    try {
+      if (!acquired.allowed) {
+        const retryAfterSec = acquired.waitTimeMs ? Math.max(1, Math.ceil(acquired.waitTimeMs / 1e3)) : 1;
+        return reply.code(429).header("Retry-After", String(retryAfterSec)).send({ error: "Too Many Requests" });
+      }
+      const query = request.query;
+      const filterPluginId = query.pluginId;
+      const webhooks = [];
+      for (const entry of manifests) {
+        if (filterPluginId && entry.pluginId !== filterPluginId) {
+          continue;
+        }
+        if (!entry.manifest.webhooks?.handlers) {
+          continue;
+        }
+        for (const decl of entry.manifest.webhooks.handlers) {
+          const secretEntry = decl.multi ? null : await secretStore.get(auth.namespaceId, entry.pluginId, decl.event);
+          webhooks.push({
+            pluginId: entry.pluginId,
+            event: decl.event,
+            multi: decl.multi === true,
+            provisioned: secretEntry !== null
+          });
+        }
+      }
+      return reply.code(200).send({ webhooks });
+    } finally {
+      await acquired.release();
+    }
+  });
+  scope.delete(
+    "/api/v1/webhooks/:pluginId/:event",
+    async (request, reply) => {
+      const auth = request.authContext;
+      if (!auth) {
+        return reply.code(401).send({ error: "Unauthorized" });
+      }
+      const acquired = await broker.tryAcquire(RL_REVOKE);
+      try {
+        if (!acquired.allowed) {
+          const retryAfterSec = acquired.waitTimeMs ? Math.max(1, Math.ceil(acquired.waitTimeMs / 1e3)) : 1;
+          return reply.code(429).header("Retry-After", String(retryAfterSec)).send({ error: "Too Many Requests" });
+        }
+        const { pluginId, event } = request.params;
+        await secretStore.delete(auth.namespaceId, pluginId, event);
+        return reply.code(204).send();
+      } finally {
+        await acquired.release();
+      }
+    }
+  );
+  scope.delete(
+    "/api/v1/webhooks/:pluginId/:event/:instanceId",
+    async (request, reply) => {
+      const auth = request.authContext;
+      if (!auth) {
+        return reply.code(401).send({ error: "Unauthorized" });
+      }
+      const acquired = await broker.tryAcquire(RL_REVOKE);
+      try {
+        if (!acquired.allowed) {
+          const retryAfterSec = acquired.waitTimeMs ? Math.max(1, Math.ceil(acquired.waitTimeMs / 1e3)) : 1;
+          return reply.code(429).header("Retry-After", String(retryAfterSec)).send({ error: "Too Many Requests" });
+        }
+        const { pluginId, event, instanceId } = request.params;
+        await secretStore.delete(auth.namespaceId, pluginId, event, instanceId);
+        return reply.code(204).send();
+      } finally {
+        await acquired.release();
+      }
+    }
+  );
+}
+
+// src/webhook/idempotency-store.ts
+var IDEMPOTENCY_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var WebhookIdempotencyStore = class {
+  constructor(cache) {
+    this.cache = cache;
+  }
+  cache;
+  /**
+   * Check if this delivery has already been processed, and mark it atomically.
+   * Keys are scoped by namespaceId to prevent cross-tenant pollution.
+   *
+   * @returns `true` if duplicate (already processed), `false` if first time
+   */
+  async checkAndMark(namespaceId, pluginId, event, key) {
+    const cacheKey2 = `webhook:idempotency:${namespaceId}:${pluginId}:${event}:${key}`;
+    const isNew = await this.cache.setIfNotExists(cacheKey2, 1, IDEMPOTENCY_TTL_MS);
+    return !isNew;
+  }
+};
+function getHeader(headers, name) {
+  const lower = name.toLowerCase();
+  const value = headers[lower] ?? headers[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+var _SESSION_KEY = randomBytes(32);
+function safeEqual(a, b) {
+  const ha = createHmac("sha256", _SESSION_KEY).update(a).digest();
+  const hb = createHmac("sha256", _SESSION_KEY).update(b).digest();
+  return timingSafeEqual(ha, hb);
+}
+function isPreviousValid(entry) {
+  return entry.previous !== void 0 && entry.previousExpiresAt !== void 0 && entry.previousExpiresAt > Date.now();
+}
+function verifySecret(header, headers, entry) {
+  const value = getHeader(headers, header);
+  if (!value) {
+    return false;
+  }
+  if (safeEqual(value, entry.current)) {
+    return true;
+  }
+  if (isPreviousValid(entry) && safeEqual(value, entry.previous)) {
+    return true;
+  }
+  return false;
+}
+function computeHmac(body, secret) {
+  return createHmac("sha256", secret).update(body).digest("hex");
+}
+function verifyHmac(header, prefix, rawBody, headers, entry) {
+  const headerValue = getHeader(headers, header);
+  if (!headerValue) {
+    return false;
+  }
+  const receivedSig = prefix && headerValue.startsWith(prefix) ? headerValue.slice(prefix.length) : headerValue;
+  const expectedCurrent = computeHmac(rawBody, entry.current);
+  if (safeEqual(receivedSig, expectedCurrent)) {
+    return true;
+  }
+  if (isPreviousValid(entry)) {
+    const expectedPrevious = computeHmac(rawBody, entry.previous);
+    if (safeEqual(receivedSig, expectedPrevious)) {
+      return true;
+    }
+  }
+  return false;
+}
+async function verifyWebhookAuth(authConfig, req, secretStore, backend, pluginRoot) {
+  const entry = await secretStore.get(req.namespaceId, req.pluginId, req.event, req.instanceId);
+  if (!entry) {
+    return { valid: false, reason: "not provisioned" };
+  }
+  switch (authConfig.type) {
+    case "secret": {
+      const valid = verifySecret(authConfig.header, req.headers, entry);
+      return valid ? { valid: true } : { valid: false, reason: "invalid secret" };
+    }
+    case "hmac": {
+      const valid = verifyHmac(authConfig.header, authConfig.prefix, req.rawBody, req.headers, entry);
+      return valid ? { valid: true } : { valid: false, reason: "invalid hmac signature" };
+    }
+    case "custom": {
+      if (!backend || !pluginRoot) {
+        return { valid: false, reason: "custom validator requires backend and pluginRoot" };
+      }
+      try {
+        const bodyHmac = createHmac("sha256", entry.current).update(req.rawBody).digest("hex");
+        const result = await backend.execute({
+          handlerRef: authConfig.validator,
+          pluginRoot,
+          input: {
+            headers: req.headers,
+            rawBody: req.rawBody.toString("base64"),
+            bodyHmac
+          }
+        });
+        return result.valid ? { valid: true } : { valid: false, reason: "custom validator rejected" };
+      } catch {
+        return { valid: false, reason: "validator error" };
+      }
+    }
+  }
+}
+
+// src/webhook/router.ts
+function getByDotPath(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (!current || typeof current !== "object") {
+      return void 0;
+    }
+    current = current[part];
+  }
+  return current;
+}
+async function registerWebhookRoutes(scope, options) {
+  const { cache, broker, logger, manifests } = options;
+  const secretStore = new WebhookSecretStore(cache);
+  const idempotencyStore = new WebhookIdempotencyStore(cache);
+  const declMap = /* @__PURE__ */ new Map();
+  let needsRawBody = false;
+  for (const entry of manifests) {
+    const { pluginId, manifest, pluginRoot } = entry;
+    if (!manifest.webhooks?.handlers.length) {
+      continue;
+    }
+    for (const decl of manifest.webhooks.handlers) {
+      if (!decl.auth) {
+        throw new Error(`webhook '${pluginId}/${decl.event}' has no auth config`);
+      }
+      const mapKey = `${pluginId}:${decl.event}:${decl.multi ? "multi" : "single"}`;
+      declMap.set(mapKey, { pluginId, decl, pluginRoot, manifest });
+      broker.registerLimit(`webhook:${pluginId}:${decl.event}`, {
+        requestsPerMinute: decl.rateLimit?.requestsPerMinute ?? 60
+      });
+      if (decl.auth.type === "hmac" || decl.auth.type === "custom") {
+        needsRawBody = true;
+      }
+    }
+  }
+  if (declMap.size === 0) {
+    return 0;
+  }
+  if (needsRawBody) {
+    scope.addHook("preParsing", async (_request, _reply, payload) => {
+      const chunks = [];
+      for await (const chunk of payload) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      }
+      const body = Buffer.concat(chunks);
+      _request.rawBody = body;
+      return Readable.from(body);
+    });
+  }
+  scope.post(
+    "/webhooks/:pluginId/:event",
+    async (request, reply) => {
+      const { pluginId, event } = request.params;
+      const entry = declMap.get(`${pluginId}:${event}:single`);
+      if (!entry) {
+        return reply.code(404).send({ error: "Webhook not found" });
+      }
+      return handleWebhook({ request, reply, entry, namespaceHeader: request.headers["x-kb-namespace"], instanceId: void 0, secretStore, idempotencyStore, broker, logger });
+    }
+  );
+  scope.post(
+    "/webhooks/:pluginId/:event/:instanceId",
+    async (request, reply) => {
+      const { pluginId, event, instanceId } = request.params;
+      const entry = declMap.get(`${pluginId}:${event}:multi`);
+      if (!entry) {
+        return reply.code(404).send({ error: "Webhook not found" });
+      }
+      return handleWebhook({ request, reply, entry, namespaceHeader: request.headers["x-kb-namespace"], instanceId, secretStore, idempotencyStore, broker, logger });
+    }
+  );
+  return declMap.size;
+}
+async function handleWebhook({
+  request,
+  reply,
+  entry,
+  namespaceHeader,
+  instanceId,
+  secretStore,
+  idempotencyStore,
+  broker,
+  logger
+}) {
+  const { pluginId, decl, pluginRoot, manifest } = entry;
+  const namespaceId = Array.isArray(namespaceHeader) ? namespaceHeader[0] : namespaceHeader;
+  if (!namespaceId) {
+    return reply.code(400).send({ error: "Missing required header: x-kb-namespace" });
+  }
+  const rateResource = `webhook:${pluginId}:${decl.event}`;
+  const acquired = await broker.tryAcquire(rateResource);
+  try {
+    if (!acquired.allowed) {
+      const retryAfterSec = acquired.waitTimeMs ? Math.max(1, Math.ceil(acquired.waitTimeMs / 1e3)) : 1;
+      return reply.code(429).header("Retry-After", String(retryAfterSec)).send({
+        error: "Too Many Requests",
+        retryAfterMs: acquired.waitTimeMs ?? null
+      });
+    }
+    if (decl.challenge && request.body) {
+      const fieldValue = getByDotPath(request.body, decl.challenge.bodyPath);
+      if (fieldValue === decl.challenge.value) {
+        const replyValue = getByDotPath(request.body, decl.challenge.replyPath);
+        const replyKey = decl.challenge.replyPath.split(".").pop();
+        return reply.code(200).send({ [replyKey]: replyValue });
+      }
+    }
+    const rawBody = request.rawBody ?? (request.body == null ? Buffer.alloc(0) : Buffer.from(typeof request.body === "string" ? request.body : JSON.stringify(request.body)));
+    const authReq = {
+      headers: request.headers,
+      rawBody,
+      namespaceId,
+      pluginId,
+      event: decl.event,
+      instanceId
+    };
+    const authBackend = decl.auth.type === "custom" ? makeAuthBackend(namespaceId, pluginId) : void 0;
+    const authResult = await verifyWebhookAuth(decl.auth, authReq, secretStore, authBackend, pluginRoot);
+    if (!authResult.valid) {
+      return reply.code(401).send({ error: "Unauthorized", reason: authResult.reason });
+    }
+    if (decl.idempotencyKey && request.body) {
+      const deliveryKey = getByDotPath(request.body, decl.idempotencyKey);
+      if (typeof deliveryKey === "string") {
+        const isDuplicate = await idempotencyStore.checkAndMark(namespaceId, pluginId, decl.event, deliveryKey);
+        if (isDuplicate) {
+          return reply.code(200).send({ status: "duplicate" });
+        }
+      }
+    }
+    const webhookId = randomUUID();
+    const hostContext = {
+      host: "webhook",
+      event: decl.event,
+      source: request.ip,
+      payload: request.body,
+      namespaceId,
+      webhookId,
+      ...instanceId !== void 0 ? { instanceId } : {}
+    };
+    const hostId = globalDispatcher.firstHostWithCapability(namespaceId, "execution");
+    if (!hostId) {
+      return reply.code(503).send({ error: "No execution host connected" });
+    }
+    const dispatchArgs = [{
+      pluginId,
+      handlerRef: decl.handler,
+      input: request.body,
+      executionId: webhookId,
+      requestId: webhookId,
+      descriptor: {
+        hostType: "webhook",
+        hostContext,
+        pluginId,
+        pluginVersion: manifest.version,
+        requestId: webhookId,
+        permissions: decl.permissions ?? []
+      }
+    }];
+    if (decl.async) {
+      reply.code(202).send({ status: "accepted", webhookId });
+      void globalDispatcher.call(namespaceId, hostId, "execution", "execute", dispatchArgs).catch((err) => {
+        logger.error(
+          "Webhook async dispatch failed",
+          err instanceof Error ? err : new Error(String(err)),
+          { pluginId, event: decl.event, webhookId }
+        );
+      });
+      return;
+    }
+    try {
+      const result = await globalDispatcher.call(namespaceId, hostId, "execution", "execute", dispatchArgs);
+      return reply.code(200).send({ status: "ok", webhookId, result });
+    } catch (err) {
+      logger.error(
+        "Webhook dispatch failed",
+        err instanceof Error ? err : new Error(String(err)),
+        { pluginId, event: decl.event, webhookId }
+      );
+      return reply.code(500).send({ error: "Dispatch failed" });
+    }
+  } finally {
+    await acquired.release();
+  }
+}
+function makeAuthBackend(namespaceId, pluginId) {
+  return {
+    async execute({ handlerRef, pluginRoot, input }) {
+      const hostId = globalDispatcher.firstHostWithCapability(namespaceId, "execution");
+      if (!hostId) {
+        throw new Error("No execution host connected for custom auth");
+      }
+      return globalDispatcher.call(namespaceId, hostId, "execution", "execute", [
+        { pluginId, handlerRef, pluginRoot, input }
+      ]);
+    }
+  };
+}
+
+// src/server.ts
 function redactQueryToken(url) {
   return url.replace(/([?&]access_token=)[^&]*/gi, "$1[REDACTED]");
 }
-async function createServer(config, cache, logger, jwtConfig, registry) {
+async function createServer(config, cache, logger, jwtConfig, registry, serviceTransport, userAuth, webhookManifests) {
   const gatewayLogger = createCorrelatedLogger(logger, {
     serviceId: "gateway",
     logsSource: "gateway",
@@ -2129,8 +3736,11 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
     operation: "gateway.http"
   });
   const app = Fastify({
-    logger: false
+    logger: false,
+    // CD-10: gateway sits behind nginx; parse X-Forwarded-For for real client IPs.
+    trustProxy: true
   });
+  await app.register(fastifyCookie);
   const isProduction = process.env.NODE_ENV === "production";
   await registerOpenAPI(app, {
     title: "KB Labs Gateway",
@@ -2142,6 +3752,11 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
   await app.register(fastifyCors, { origin: false });
   const observability = new GatewayObservabilityCollector(config);
   observability.register(app);
+  if (config.pressure && config.pressure.enabled !== false && platform.hasResourceBroker) {
+    const deps = { broker: platform.resourceBroker, logger, config };
+    app.addHook("onRequest", createPressureOnRequest(deps));
+    app.addHook("onResponse", createPressureOnResponse());
+  }
   app.addHook("onRequest", async (request, reply) => {
     const requestId = request.headers["x-request-id"] || request.id || randomUUID();
     const traceId = request.headers["x-trace-id"] || randomUUID();
@@ -2172,26 +3787,92 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
       statusCode: reply.statusCode
     });
   });
-  const PROXY_TIMEOUT_MS = 36e5;
+  const socketWsUpstreams = [];
   for (const [name, upstream] of Object.entries(config.upstreams)) {
+    const conn = serviceTransport.connectionInfo(upstream.serviceId);
+    if (!conn) {
+      throw new Error(
+        `Gateway startup error: no transport config for upstream "${name}" (serviceId: "${upstream.serviceId}"). Configure @kb-labs/adapters-service-transport-http as adapterOptions.serviceTransport.services in kb.config.json.`
+      );
+    }
+    const wsOverSocket = Boolean(upstream.websocket) && Boolean(conn.socketPath);
+    if (wsOverSocket) {
+      socketWsUpstreams.push({
+        prefix: upstream.prefix,
+        rewritePrefix: upstream.rewritePrefix ?? upstream.prefix,
+        socketPath: conn.socketPath
+      });
+    }
     await app.register(fastifyHttpProxy, {
-      upstream: upstream.url,
+      upstream: conn.baseUrl,
       prefix: upstream.prefix,
       rewritePrefix: upstream.rewritePrefix ?? upstream.prefix,
       disableCache: true,
-      websocket: upstream.websocket ?? false,
-      http: {
-        requestOptions: {
-          timeout: PROXY_TIMEOUT_MS
-        }
+      // Disable http-proxy WS for socket upstreams — the gateway dialer owns it.
+      websocket: wsOverSocket ? false : upstream.websocket ?? false,
+      undici: {
+        // Restore 1-hour body timeout for SSE streams and large transfers.
+        // undici defaults: headersTimeout=30s, bodyTimeout=300s — too short for streaming.
+        bodyTimeout: 36e5,
+        ...conn.socketPath ? { socketPath: conn.socketPath } : {}
       }
     });
-    gatewayLogger.info(`Upstream registered: ${name} \u2192 ${upstream.url} (${upstream.prefix}${upstream.websocket ? ", ws" : ""})`);
+    const connDesc = conn.socketPath ? `${conn.baseUrl} (unix:${conn.socketPath})` : conn.baseUrl;
+    const wsDesc = upstream.websocket ? wsOverSocket ? ", ws\u2192unix" : ", ws" : "";
+    gatewayLogger.info(`Upstream registered: ${name} \u2192 ${connDesc} (${upstream.prefix}${wsDesc})`);
   }
   await app.register(async function gatewayRoutes(scope) {
-    scope.addHook("onRequest", createAuthMiddleware(cache, jwtConfig));
+    if (userAuth) {
+      scope.addHook(
+        "onRequest",
+        createUserAuthMiddleware({
+          users: userAuth.users,
+          tenantResolver: userAuth.tenantResolver,
+          jwtConfig
+        })
+      );
+    }
+    scope.addHook(
+      "onRequest",
+      createAuthMiddleware(cache, jwtConfig, { authEnabled: config.auth?.enabled !== false })
+    );
+    if (config.pressure?.perTenant?.enabled === true && platform.hasResourceBroker) {
+      scope.addHook(
+        "preHandler",
+        createPressurePreHandler({ broker: platform.resourceBroker, logger, config })
+      );
+    }
     const authService = new AuthService(cache, jwtConfig);
-    registerAuthRoutes(scope, authService);
+    const userExt = userAuth ? {
+      userRefreshFn: createUserRefreshFn({
+        userAuthService: userAuth.userAuthService,
+        cookieOpts: { cookieSecure: userAuth.cookieSecure }
+      }),
+      pdp: userAuth.pdp
+    } : void 0;
+    registerAuthRoutes(scope, authService, userExt);
+    if (userAuth) {
+      registerUserAuthRoutes(
+        scope,
+        {
+          userAuthService: userAuth.userAuthService,
+          users: userAuth.users,
+          sessions: userAuth.sessions,
+          invites: userAuth.invites,
+          providers: userAuth.providers,
+          pdp: userAuth.pdp,
+          tenantResolver: userAuth.tenantResolver,
+          cookieOpts: { cookieSecure: userAuth.cookieSecure },
+          accessTtlSec: userAuth.accessTtlSec,
+          refreshTtlSec: userAuth.refreshTtlSec,
+          inviteTtlMs: userAuth.inviteTtlMs,
+          rateLimiter: userAuth.rateLimiter,
+          authRateLimit: userAuth.authRateLimit,
+          oauthState: userAuth.oauthState,
+          oauthCallbackPerIpPerMinute: userAuth.oauthCallbackPerIpPerMinute
+        }
+      );
+    }
     const HEALTH_CACHE_KEY = "__gateway_health";
     const HEALTH_CACHE_TTL = 15e3;
     const startupTime = Date.now();
@@ -2219,7 +3900,8 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
         await observability.observeOperation(`gateway.upstream.${name}.health`, async () => {
           const probeStart = Date.now();
           try {
-            const res = await fetch(`${upstream.url}/health`, {
+            const res = await serviceTransport.call(upstream.serviceId, {
+              path: "/health",
               signal: AbortSignal.timeout(2e3)
             });
             const latencyMs = Date.now() - probeStart;
@@ -2236,8 +3918,8 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
                 route: `${upstream.prefix}/health`,
                 evidence: {
                   upstreamId: name,
-                  upstreamUrl: upstream.url,
-                  statusCode: res.status,
+                  serviceId: upstream.serviceId,
+                  statusCode: res.statusCode,
                   latencyMs
                 }
               });
@@ -2257,7 +3939,7 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
               route: `${upstream.prefix}/health`,
               evidence: {
                 upstreamId: name,
-                upstreamUrl: upstream.url,
+                serviceId: upstream.serviceId,
                 latencyMs
               }
             });
@@ -2281,6 +3963,14 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
     scope.get("/health", { schema: { tags: ["System"], summary: "Gateway health check" } }, async () => {
       return collectHealthSnapshot();
     });
+    scope.get("/health/adapters", {
+      schema: {
+        tags: ["System"],
+        summary: "Platform adapter status \u2014 mode (real | inmemory | noop) per slot"
+      }
+    }, async () => {
+      return getAdapterStatus();
+    });
     scope.get("/ready", { schema: { tags: ["System"], summary: "Gateway readiness check" } }, async (_request, reply) => {
       const health = await collectHealthSnapshot();
       const upstreams = health.upstreams ?? {};
@@ -2379,73 +4069,55 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
     registerLLMGatewayRoutes(scope, logger);
     registerTelemetryRoutes(scope, logger);
     registerPlatformRoutes(scope, logger);
-    registerAggregatedDocsRoutes(scope, cache);
-    const internalSecret = process.env.GATEWAY_INTERNAL_SECRET;
-    scope.post("/internal/dispatch", async (request, reply) => {
-      const provided = request.headers["x-internal-secret"];
-      if (!internalSecret || provided !== internalSecret) {
-        return reply.code(403).send({ error: "Forbidden" });
-      }
-      const body = request.body;
-      if (!body.namespaceId || !body.adapter || !body.method) {
-        return reply.code(400).send({ error: "Missing required fields: namespaceId, adapter, method" });
-      }
-      const hostId = body.hostId ?? globalDispatcher.firstHostWithCapability(body.namespaceId, body.adapter) ?? globalDispatcher.firstHost(body.namespaceId);
-      if (!hostId) {
-        return reply.code(503).send({
-          error: "No host connected",
-          namespaceId: body.namespaceId
-        });
-      }
-      try {
-        const result = await globalDispatcher.call(
-          body.namespaceId,
-          hostId,
-          body.adapter,
-          body.method,
-          body.args ?? []
-        );
-        return { result };
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (message.includes("Host not connected")) {
-          return reply.code(503).send({ error: message });
+    registerAggregatedDocsRoutes(scope, config, serviceTransport, cache);
+    registerInternalRoutes(scope, process.env.GATEWAY_INTERNAL_SECRET, hostRegistry, cache);
+    if (platform.hasResourceBroker) {
+      const webhookBaseUrl = process.env.GATEWAY_PUBLIC_URL ?? `http://localhost:${config.port + (Number(process.env.KB_NET_OFFSET) || 0)}`;
+      const provisionBackend = {
+        async execute({ handlerRef, pluginRoot, input, namespaceId }) {
+          if (!namespaceId) {
+            return;
+          }
+          const hostId = globalDispatcher.firstHostWithCapability(namespaceId, "execution");
+          if (!hostId) {
+            return;
+          }
+          return globalDispatcher.call(namespaceId, hostId, "execution", "execute", [
+            { handlerRef, pluginRoot, input }
+          ]);
         }
-        return reply.code(502).send({ error: message });
-      }
-    });
-    scope.post("/internal/resolve-host", async (request, reply) => {
-      const provided = request.headers["x-internal-secret"];
-      if (!internalSecret || provided !== internalSecret) {
-        return reply.code(403).send({ error: "Forbidden" });
-      }
-      const body = request.body;
-      const namespaceId = body.namespaceId ?? "default";
-      const target = body.target ?? {};
-      const strategy = target.hostSelection ?? "any-matching";
-      let hostId;
-      if (strategy === "pinned" && target.hostId) {
-        const host = await hostRegistry.get(target.hostId, namespaceId);
-        if (host?.status === "online" || host?.status === "reconnecting") {
-          hostId = target.hostId;
+      };
+      registerWebhookAdminRoutes(
+        scope,
+        {
+          cache,
+          logger,
+          backend: provisionBackend,
+          manifests: webhookManifests ?? [],
+          baseUrl: webhookBaseUrl,
+          broker: platform.resourceBroker
         }
-      } else {
-        hostId = globalDispatcher.firstHostWithCapability(namespaceId, "execution");
-      }
-      if (!hostId) {
-        return reply.code(404).send({ error: "No matching host found" });
-      }
-      return { hostId, strategy, namespaceId };
-    });
+      );
+    }
   });
+  if (webhookManifests?.length && platform.hasResourceBroker) {
+    process.env.GATEWAY_PUBLIC_URL ?? `http://localhost:${config.port + (Number(process.env.KB_NET_OFFSET) || 0)}`;
+    await app.register(async (webhookScope) => {
+      await registerWebhookRoutes(webhookScope, {
+        cache,
+        broker: platform.resourceBroker,
+        logger,
+        manifests: webhookManifests});
+    });
+  }
   await app.ready();
-  attachGatewayWs(app.server, cache, jwtConfig, logger, registry);
+  attachGatewayWs(app.server, cache, jwtConfig, logger, registry, socketWsUpstreams);
   return app;
 }
 
 // src/bootstrap.ts
 async function bootstrap(repoRoot = process.cwd()) {
-  await createServiceBootstrap({ appId: "gateway", repoRoot });
+  await createServiceBootstrap({ appId: "gateway", repoRoot, assemblyHook: makeAssemblyHook() });
   const logger = createCorrelatedLogger(platform.logger, {
     serviceId: "gateway",
     logsSource: "gateway",
@@ -2454,20 +4126,123 @@ async function bootstrap(repoRoot = process.cwd()) {
     operation: "gateway.bootstrap"
   });
   logger.info("Platform initialized", { repoRoot });
-  const config = await loadGatewayConfig(repoRoot, getPlatformRoot());
+  const config = await loadGatewayConfig(getProjectRoot() ?? repoRoot, getPlatformRoot());
   logger.info("Gateway config loaded", {
     port: config.port,
-    upstreams: Object.keys(config.upstreams)
+    upstreams: Object.keys(config.upstreams),
+    projectRoot: getProjectRoot() ?? repoRoot,
+    platformRoot: getPlatformRoot(),
+    configProviderIds: config.auth?.providers ? Object.keys(config.auth.providers) : []
   });
   let hostStore;
-  const db = platform.getAdapter("sqlDatabase");
-  if (db) {
-    hostStore = new SqliteHostStore(db);
-    logger.info("Host store: SQLite (persistent)");
+  const configuredDocs = platform.getAdapter("documentDatabase");
+  const docs = configuredDocs ?? createInMemoryDocumentDatabase();
+  if (configuredDocs) {
+    hostStore = new HostStore(docs);
+    logger.info("Host store: documentDatabase-backed (persistent)");
   } else {
-    logger.warn("Host store: none (cache-only, hosts will be lost on restart)");
+    hostStore = new HostStore(docs);
+    logger.warn("documentDatabase: in-memory fallback (data lost on restart)");
+    logger.warn("Host store: in-memory (hosts will be lost on restart)");
   }
-  const registry = new HostRegistry(platform.cache, hostStore);
+  let userAuth;
+  {
+    const accessTtlSec = config.auth?.sessionAccessTtlSec ?? (process.env.AUTH_ACCESS_TTL_SEC ? parseInt(process.env.AUTH_ACCESS_TTL_SEC, 10) : 900);
+    const refreshTtlSec = config.auth?.sessionRefreshTtlSec ?? (process.env.AUTH_REFRESH_TTL_SEC ? parseInt(process.env.AUTH_REFRESH_TTL_SEC, 10) : 30 * 24 * 3600);
+    const graceWindowMs = (config.auth?.refreshGraceWindowSec ?? 5) * 1e3;
+    const bcryptCost = config.auth?.bcryptCost ?? 12;
+    const cookieSecure = config.auth?.cookieSecure ?? (process.env.AUTH_COOKIE_SECURE === "false" ? false : true);
+    const tenantPattern = config.tenants?.pattern ?? "{tenant}.kblabs.ru";
+    const bootstrapTenantId = config.auth?.bootstrap?.tenantId ?? process.env.GATEWAY_BOOTSTRAP_TENANT_ID ?? "kblabs-cloud";
+    const users = new UsersStore(docs);
+    const credentials = new CredentialsStore(docs);
+    const memberships = new MembershipsStore(docs);
+    const sessions = new SessionsStore(docs, {
+      refreshTtlMs: refreshTtlSec * 1e3,
+      graceWindowMs
+    });
+    const invites = new InvitesStore(docs);
+    const providers = await loadIdentityProviders(config.auth?.providers, {
+      users,
+      credentials,
+      tenantId: bootstrapTenantId,
+      bcryptCost,
+      logger
+    });
+    const passwordPolicy = createPasswordPolicy({
+      minLength: config.auth?.passwordPolicy?.minLength ?? 8,
+      maxLength: config.auth?.passwordPolicy?.maxLength ?? 256,
+      hibpEnabled: config.auth?.passwordPolicy?.hibpEnabled ?? true
+    });
+    const pdp = createStubPDP({ memberships });
+    const tenantResolver = createTenantResolver({ pattern: tenantPattern });
+    const userAuthService = createUserAuthService({
+      users,
+      credentials,
+      memberships,
+      sessions,
+      invites,
+      providers,
+      passwordPolicy,
+      jwtConfig: { secret: process.env.GATEWAY_JWT_SECRET ?? "dev-insecure-secret-change-me" },
+      accessTtlSec,
+      refreshTtlSec,
+      bcryptCost
+    });
+    const adminEmail = config.auth?.bootstrap?.adminEmail ?? process.env.GATEWAY_BOOTSTRAP_ADMIN_EMAIL;
+    const adminPassword = process.env.GATEWAY_BOOTSTRAP_ADMIN_PASSWORD;
+    await ensureBootstrapAdmin({
+      bootstrap: adminEmail && adminPassword ? { adminEmail, adminPassword, tenantId: bootstrapTenantId } : void 0,
+      users,
+      credentials,
+      memberships,
+      bcryptCost,
+      logger
+    }).catch((err) => {
+      logger.warn("Bootstrap admin seed failed (non-fatal)", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    });
+    const inviteTtlMs = process.env.AUTH_INVITE_TTL_MS ? parseInt(process.env.AUTH_INVITE_TTL_MS, 10) : config.auth?.inviteTtlMs ?? 7 * 24 * 60 * 60 * 1e3;
+    const kv = platform.getAdapter("kvStore") ?? createInMemoryKVStore();
+    const rateLimiter = createRateLimiter(kv);
+    if (!platform.getAdapter("kvStore")) {
+      logger.warn("kvStore adapter not configured \u2014 auth rate limiting using in-memory KV (counters reset on restart)");
+    }
+    const loginPerIpPerMinute = process.env.AUTH_LOGIN_RATE_LIMIT_PER_IP ? parseInt(process.env.AUTH_LOGIN_RATE_LIMIT_PER_IP, 10) : config.auth?.rateLimit?.loginPerIpPerMinute ?? 10;
+    const loginPerEmailPerMinute = process.env.AUTH_LOGIN_RATE_LIMIT_PER_EMAIL ? parseInt(process.env.AUTH_LOGIN_RATE_LIMIT_PER_EMAIL, 10) : config.auth?.rateLimit?.loginPerEmailPerMinute ?? 5;
+    const oauthState = new OAuthStateStore(kv);
+    const hasRedirectProvider = providers.list().some((p) => p.kind === "redirect");
+    if (hasRedirectProvider && !platform.getAdapter("kvStore")) {
+      logger.warn(
+        "OAuth requires a shared kvStore (Redis) in multi-process/HA; in-memory state is per-process and callbacks may land on a different worker"
+      );
+    }
+    userAuth = {
+      userAuthService,
+      users,
+      sessions,
+      invites,
+      providers,
+      pdp,
+      tenantResolver,
+      cookieSecure,
+      accessTtlSec,
+      refreshTtlSec,
+      inviteTtlMs,
+      rateLimiter,
+      authRateLimit: { loginPerIpPerMinute, loginPerEmailPerMinute },
+      oauthState
+    };
+    logger.info("User auth infrastructure initialised", {
+      tenantPattern,
+      bootstrapTenantId,
+      cookieSecure,
+      persistent: !!configuredDocs
+    });
+  }
+  const cache = platform.cache;
+  const registry = new HostRegistry(cache, hostStore);
   let restoredCount = 0;
   try {
     restoredCount = await registry.restore();
@@ -2489,9 +4264,29 @@ async function bootstrap(repoRoot = process.cwd()) {
   if (restoredCount > 0) {
     logger.info("Restored hosts from store", { count: restoredCount });
   }
-  for (const [token, entry] of Object.entries(config.staticTokens)) {
-    await platform.cache.set(`host:token:${token}`, entry);
-    logger.info("Static token seeded", { hostId: entry.hostId, namespaceId: entry.namespaceId });
+  let webhookManifests = [];
+  try {
+    const projectRoot = getProjectRoot() ?? repoRoot;
+    const platformRoot = getPlatformRoot();
+    const pluginRegistry = await createRegistry({
+      root: projectRoot,
+      platformRoot: platformRoot !== projectRoot ? platformRoot : void 0,
+      cache: { ttlMs: 6e5, adapter: cache }
+    });
+    const snapshot = pluginRegistry.snapshot();
+    webhookManifests = snapshot.manifests.filter((entry) => (entry.manifest.webhooks?.handlers?.length ?? 0) > 0).map((entry) => ({
+      pluginId: entry.pluginId,
+      manifest: entry.manifest,
+      pluginRoot: entry.pluginRoot
+    }));
+    if (webhookManifests.length > 0) {
+      logger.info("Webhook manifests discovered", { count: webhookManifests.length });
+    }
+  } catch (err) {
+    logger.warn("Webhook manifest discovery failed \u2014 webhook routes disabled", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    webhookManifests = [];
   }
   const DEV_JWT_SECRET = "dev-insecure-secret-change-me";
   const jwtSecret = process.env.GATEWAY_JWT_SECRET;
@@ -2505,9 +4300,28 @@ async function bootstrap(repoRoot = process.cwd()) {
     logger.warn("GATEWAY_JWT_SECRET not set \u2014 using insecure default (dev only, never use in production!)");
   }
   const jwtConfig = { secret: jwtSecret ?? DEV_JWT_SECRET };
-  const server = await createServer(config, platform.cache, platform.logger, jwtConfig, registry);
-  const address = await server.listen({ port: config.port, host: "0.0.0.0" });
-  logger.info("Gateway listening", { address });
+  if (platform.hasResourceBroker) {
+    registerPressureLimits(platform.resourceBroker, config.pressure, platform.logger);
+  } else {
+    logger.warn("Resource broker unavailable \u2014 pressure control disabled");
+  }
+  const serviceTransport = platform.getAdapter("serviceTransport");
+  if (!serviceTransport) {
+    throw new Error(
+      'Gateway requires the serviceTransport adapter. Configure it in kb.config.json:\n  "adapters": { "serviceTransport": "@kb-labs/adapters-service-transport-http" },\n  "adapterOptions": { "serviceTransport": { "services": { "rest": { "url": "http://127.0.0.1:5050" }, ... } } }'
+    );
+  }
+  const server = await createServer(config, cache, platform.logger, jwtConfig, registry, serviceTransport, userAuth, webhookManifests);
+  const bindHost = config.host ?? "0.0.0.0";
+  if (config.auth?.enabled === false && !isLoopbackHost(bindHost)) {
+    throw new Error(
+      `Refusing to start: auth is disabled but the gateway binds to "${bindHost}" (not loopback). A no-auth platform reachable on the network grants full access to anyone. Either set gateway.auth.enabled = true, or bind to 127.0.0.1 (gateway.host) for solo/local use.`
+    );
+  }
+  const netOffset = Number(process.env.KB_NET_OFFSET) || 0;
+  const listenPort = config.port + netOffset;
+  const address = await server.listen({ port: listenPort, host: bindHost });
+  logger.info("Gateway listening", { address, authEnabled: config.auth?.enabled !== false });
   const shutdown = async (signal) => {
     logger.warn("Received shutdown signal", { signal });
     await platform.shutdown();
@@ -2518,6 +4332,10 @@ async function bootstrap(repoRoot = process.cwd()) {
   process.on("SIGTERM", () => shutdown("SIGTERM"));
   process.on("SIGINT", () => shutdown("SIGINT"));
 }
+function isLoopbackHost(host) {
+  const h = host.trim().toLowerCase();
+  return h === "127.0.0.1" || h === "localhost" || h === "::1" || h === "[::1]" || h.startsWith("127.");
+}
 
 // src/index.ts
 bootstrap(process.cwd()).catch((error) => {