langmart-gateway-type3 3.0.0

package/dist/gateway-server.js

@@ -0,0 +1,1811 @@
+"use strict";
+// File: gateway-type3/gateway-server.ts
+// Gateway Type 3 - Seller-Managed Gateway Server with Local Vault
+// Seller deploys this on their own infrastructure and manages provider credentials locally
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Type3GatewayServer = void 0;
+const ws_1 = __importDefault(require("ws"));
+const express_1 = __importDefault(require("express"));
+const uuid_1 = require("uuid");
+const axios_1 = __importDefault(require("axios"));
+const events_1 = require("events");
+const local_vault_1 = require("./local-vault");
+const gateway_config_1 = require("./gateway-config");
+const headless_session_1 = require("./headless-session");
+const gateway_mode_1 = require("./gateway-mode");
+/**
+ * Type 3 Gateway Server
+ * Seller-managed gateway deployed on seller's infrastructure
+ *
+ * Key Differences from Type 2:
+ * - Uses local vault for provider credentials (NOT central database)
+ * - Seller manages their own API keys
+ * - More privacy and control for sellers
+ *
+ * Similarities to Type 2:
+ * - Same WebSocket communication protocol with Type 1
+ * - Same request/response format
+ * - Same registration and heartbeat mechanisms
+ */
+class Type3GatewayServer extends events_1.EventEmitter {
+    constructor(config) {
+        super();
+        this.wss = null;
+        this.marketplaceWs = null;
+        this.activeRequests = new Map();
+        this.healthCheckInterval = null;
+        this.currentVersion = '3.0.0';
+        this.managementServer = null;
+        this.apiKey = ''; // API key for authentication
+        this.isAuthenticated = false;
+        this.currentUser = null; // Authenticated user info
+        this.reconnectInterval = null;
+        this.reconnectAttempts = 0;
+        this.maxReconnectAttempts = 0; // 0 = infinite
+        this.reconnectDelay = 15000; // 15 seconds
+        this.isShuttingDown = false;
+        this.headlessSessionManager = null; // For remote DevOps sessions
+        this.port = config.port;
+        this.marketplaceUrl = config.marketplaceUrl || 'wss://control.marketplace.ai';
+        this.marketplaceApiUrl = config.marketplaceUrl?.replace('wss://', 'https://').replace('control.', 'api.') || 'https://api.marketplace.ai';
+        // Set gateway mode (defaults to FULL for backward compatibility)
+        this.gatewayMode = config.mode ?? gateway_mode_1.GatewayMode.FULL;
+        this.enableRemoteLLMSession = config.enableRemoteLLMSession ?? true;
+        this.enableLLMRouting = config.enableLLMRouting ?? true;
+        const modeNames = { [gateway_mode_1.GatewayMode.REMOTE_LLM_SESSION_ONLY]: 'Remote LLM Session Only', [gateway_mode_1.GatewayMode.LLM_ROUTING_ONLY]: 'LLM Routing Only', [gateway_mode_1.GatewayMode.FULL]: 'Full' };
+        console.log(`[Gateway Type 3] Operating in ${modeNames[this.gatewayMode]} mode`);
+        console.log(`[Gateway Type 3]   Remote LLM Sessions: ${this.enableRemoteLLMSession ? '✅ Enabled' : '❌ Disabled'}`);
+        console.log(`[Gateway Type 3]   LLM Routing:     ${this.enableLLMRouting ? '✅ Enabled' : '❌ Disabled'}`);
+        // Use persistent configuration manager for gateway and instance IDs
+        console.log('[Gateway Type 3] Initializing gateway configuration...');
+        const configManager = new gateway_config_1.GatewayConfigManager(config.configPath);
+        const gatewayConfig = configManager.getOrCreateConfig();
+        // Use config-based IDs with datetime seeding (persists across restarts)
+        this.instanceId = gatewayConfig.gateway_id;
+        this.nodeId = `node-${this.instanceId}-${process.pid}`;
+        console.log(`[Gateway Type 3] Using Gateway ID: ${this.instanceId}`);
+        console.log(`[Gateway Type 3] Using Node ID: ${this.nodeId}`);
+        this.apiKey = config.apiKey || '';
+        // Initialize local vault - KEY DIFFERENCE from Type 2
+        this.vault = new local_vault_1.LocalVault({
+            vaultPath: config.vaultPath,
+            masterPassword: config.vaultPassword
+        });
+        // Initialize management REST API
+        this.managementApp = (0, express_1.default)();
+        this.managementApp.use(express_1.default.json());
+        this.setupManagementEndpoints();
+        this.metrics = {
+            startTime: Date.now(),
+            requestsHandled: 0,
+            requestsActive: 0,
+            errorCount: 0,
+            avgLatency: 0,
+            lastHealthCheck: new Date()
+        };
+    }
+    /**
+     * Start the Type 3 gateway server
+     */
+    async start() {
+        console.log(`[${this.nodeId}] Starting Type 3 Gateway Server on port ${this.port}`);
+        // 1. Start management REST API server for CLI
+        await this.startManagementServer();
+        // 2. Connect to marketplace control plane (primary function)
+        await this.connectToMarketplace();
+        // 3. Load credentials from local vault (only if LLM routing is enabled)
+        if (this.enableLLMRouting) {
+            await this.loadCredentials();
+        }
+        // 4. Initialize session manager for remote sessions (only if remote sessions enabled)
+        if (this.enableRemoteLLMSession) {
+            this.initializeHeadlessSessionManager();
+            console.log(`[${this.nodeId}] Remote session manager enabled`);
+        }
+        // 5. Start health monitoring
+        this.startHealthMonitoring();
+        // 6. Register with marketplace (includes tool discovery)
+        await this.registerGateway();
+        console.log(`[${this.nodeId}] Type 3 Gateway ready and registered`);
+        console.log(`[${this.nodeId}] Management API: http://localhost:${this.port}`);
+    }
+    /**
+     * Initialize the headless session manager for remote DevOps automation
+     */
+    initializeHeadlessSessionManager() {
+        this.headlessSessionManager = new headless_session_1.HeadlessSessionManager({
+            gatewayId: this.instanceId,
+            vault: this.vault,
+            marketplaceUrl: this.marketplaceUrl,
+            apiKey: this.apiKey
+        });
+        // Listen for session events
+        this.headlessSessionManager.on('session_started', (data) => {
+            console.log(`[${this.nodeId}] Headless session started: ${data.sessionId}`);
+        });
+        this.headlessSessionManager.on('session_completed', (data) => {
+            console.log(`[${this.nodeId}] Headless session completed: ${data.sessionId}`);
+        });
+        this.headlessSessionManager.on('session_timeout', (data) => {
+            console.log(`[${this.nodeId}] Headless session timed out: ${data.sessionId}`);
+        });
+        console.log(`[${this.nodeId}] Headless session manager initialized`);
+    }
+    /**
+     * Setup management REST API endpoints for CLI
+     */
+    setupManagementEndpoints() {
+        // GET /status - Get running status
+        this.managementApp.get('/status', (req, res) => {
+            const uptime = Date.now() - this.metrics.startTime;
+            const modeNames = {
+                [gateway_mode_1.GatewayMode.REMOTE_LLM_SESSION_ONLY]: 'Remote LLM Session Only',
+                [gateway_mode_1.GatewayMode.LLM_ROUTING_ONLY]: 'LLM Routing Only',
+                [gateway_mode_1.GatewayMode.FULL]: 'Full'
+            };
+            res.json({
+                status: 'running',
+                version: this.currentVersion,
+                instance_id: this.instanceId,
+                node_id: this.nodeId,
+                uptime_ms: uptime,
+                uptime_human: this.formatUptime(uptime),
+                marketplace_connected: this.marketplaceWs?.readyState === ws_1.default.OPEN,
+                marketplace_authenticated: this.isAuthenticated,
+                mode: {
+                    value: this.gatewayMode,
+                    name: modeNames[this.gatewayMode],
+                    remote_llm_session_enabled: this.enableRemoteLLMSession,
+                    llm_routing_enabled: this.enableLLMRouting
+                },
+                metrics: {
+                    requests_handled: this.metrics.requestsHandled,
+                    requests_active: this.metrics.requestsActive,
+                    error_count: this.metrics.errorCount,
+                    avg_latency_ms: this.metrics.avgLatency
+                },
+                credentials: this.enableLLMRouting ? {
+                    connections_count: this.vault.listAccessPoints().length,
+                    connection_ids: this.vault.listAccessPoints()
+                } : {
+                    connections_count: 0,
+                    connection_ids: [],
+                    note: 'LLM routing disabled in current mode'
+                }
+            });
+        });
+        // POST /shutdown - Gracefully shutdown
+        this.managementApp.post('/shutdown', async (req, res) => {
+            console.log(`[${this.nodeId}] Shutdown requested via management API`);
+            res.json({ status: 'shutting_down', message: 'Gateway shutdown initiated' });
+            // Shutdown after sending response
+            setTimeout(async () => {
+                await this.gracefulShutdown();
+                process.exit(0);
+            }, 500);
+        });
+        // GET /providers - List configured providers
+        this.managementApp.get('/providers', (req, res) => {
+            const accessPoints = this.vault.listAccessPoints();
+            res.json({
+                providers: accessPoints.map(apId => ({
+                    connection_id: apId,
+                    has_credential: this.vault.hasCredential(apId)
+                }))
+            });
+        });
+        // GET /providers/:id/api-key - Retrieve API key from vault
+        this.managementApp.get('/providers/:id/api-key', (req, res) => {
+            try {
+                const connectionId = req.params.id;
+                if (!this.vault.hasCredential(connectionId)) {
+                    return res.status(404).json({
+                        error: 'No API key found in vault for this connection',
+                        code: 'not_found'
+                    });
+                }
+                const apiKey = this.vault.getCredential(connectionId);
+                if (!apiKey) {
+                    return res.status(404).json({
+                        error: 'Failed to retrieve API key from vault',
+                        code: 'vault_error'
+                    });
+                }
+                res.json({
+                    success: true,
+                    connection_id: connectionId,
+                    api_key: apiKey
+                });
+            }
+            catch (error) {
+                console.error(`[${this.nodeId}] Error retrieving API key:`, error.message);
+                res.status(500).json({ error: error.message });
+            }
+        });
+        // POST /providers - Add provider credential
+        this.managementApp.post('/providers', async (req, res) => {
+            try {
+                const { connection_id, api_key, provider_name, description } = req.body;
+                if (!connection_id || !api_key) {
+                    return res.status(400).json({
+                        error: 'Missing required fields: connection_id, api_key'
+                    });
+                }
+                await this.vault.setCredential(connection_id, api_key, provider_name, description);
+                console.log(`[${this.nodeId}] Added provider credential via management API: ${connection_id}`);
+                res.json({
+                    status: 'success',
+                    message: 'Provider credential added',
+                    connection_id
+                });
+            }
+            catch (error) {
+                console.error(`[${this.nodeId}] Error adding provider:`, error.message);
+                res.status(500).json({ error: error.message });
+            }
+        });
+        // DELETE /providers/:id - Remove provider credential
+        this.managementApp.delete('/providers/:id', async (req, res) => {
+            try {
+                const accessPointId = req.params.id;
+                if (!this.vault.hasCredential(accessPointId)) {
+                    return res.status(404).json({
+                        error: 'Provider not found'
+                    });
+                }
+                await this.vault.removeCredential(accessPointId);
+                console.log(`[${this.nodeId}] Removed provider credential via management API: ${accessPointId}`);
+                res.json({
+                    status: 'success',
+                    message: 'Provider credential removed',
+                    connection_id: accessPointId
+                });
+            }
+            catch (error) {
+                console.error(`[${this.nodeId}] Error removing provider:`, error.message);
+                res.status(500).json({ error: error.message });
+            }
+        });
+        // POST /providers/:id/test - Test provider connection
+        this.managementApp.post('/providers/:id/test', async (req, res) => {
+            try {
+                const connectionId = req.params.id;
+                // Check if credential exists in vault
+                if (!this.vault.hasCredential(connectionId)) {
+                    return res.status(404).json({
+                        error: 'No API key found in local vault for this connection',
+                        code: 'missing_api_key'
+                    });
+                }
+                // Get API key from vault
+                const apiKey = this.vault.getCredential(connectionId);
+                if (!apiKey) {
+                    return res.status(404).json({
+                        error: 'Failed to retrieve API key from vault',
+                        code: 'vault_error'
+                    });
+                }
+                // Query marketplace for connection details
+                const marketplaceUrl = this.marketplaceUrl.replace('ws://', 'http://').replace('wss://', 'https://');
+                const connectionResponse = await axios_1.default.get(`${marketplaceUrl}/api/connections`, {
+                    headers: { 'Authorization': `Bearer ${this.apiKey}` },
+                    timeout: 5000
+                });
+                const connection = connectionResponse.data.connections?.find((c) => c.id === connectionId);
+                if (!connection) {
+                    return res.status(404).json({
+                        error: 'Connection not found in marketplace',
+                        code: 'connection_not_found'
+                    });
+                }
+                // Determine test endpoint - provider.key is nested in the response
+                const providerKey = connection.provider?.key || 'openai';
+                const providerName = connection.provider?.name || 'Unknown';
+                const endpointType = connection.endpoint_type || 'openai-v1';
+                const testUrl = this.getTestUrl(providerKey, connection.endpoint_url, endpointType);
+                console.log(`[${this.nodeId}] Testing ${providerName} at ${testUrl}`);
+                // Make test request
+                const response = await axios_1.default.get(testUrl, {
+                    headers: {
+                        'Authorization': `Bearer ${apiKey.trim()}`,
+                        'Content-Type': 'application/json'
+                    },
+                    timeout: 10000,
+                    validateStatus: (status) => status < 500
+                });
+                // Success
+                if (response.status >= 200 && response.status < 300) {
+                    return res.json({
+                        success: true,
+                        message: 'Connection test successful',
+                        provider: providerName,
+                        status: response.status,
+                        models_available: Array.isArray(response.data?.data) ? response.data.data.length : undefined
+                    });
+                }
+                // Auth error
+                if (response.status === 401 || response.status === 403) {
+                    return res.status(400).json({
+                        success: false,
+                        error: 'Authentication failed - API key may be invalid or expired',
+                        code: 'auth_failed',
+                        status: response.status
+                    });
+                }
+                // Other error
+                return res.status(400).json({
+                    success: false,
+                    error: `Provider returned error: ${response.statusText}`,
+                    code: 'provider_error',
+                    status: response.status
+                });
+            }
+            catch (error) {
+                if (error.code === 'ECONNREFUSED' || error.code === 'ENOTFOUND') {
+                    return res.status(400).json({
+                        success: false,
+                        error: 'Cannot reach provider endpoint - check endpoint URL',
+                        code: 'connection_failed',
+                        details: error.message
+                    });
+                }
+                if (error.response) {
+                    const status = error.response.status;
+                    if (status === 401 || status === 403) {
+                        return res.status(400).json({
+                            success: false,
+                            error: 'Authentication failed - API key may be invalid',
+                            code: 'auth_failed',
+                            status
+                        });
+                    }
+                    else {
+                        return res.status(400).json({
+                            success: false,
+                            error: error.response.data?.error?.message || 'Provider API error',
+                            code: 'provider_error',
+                            status
+                        });
+                    }
+                }
+                console.error(`[${this.nodeId}] Error testing provider:`, error.message);
+                return res.status(500).json({ error: error.message });
+            }
+        });
+        // POST /providers/:id/update-key - Update/add provider API key in vault
+        this.managementApp.post('/providers/:id/update-key', async (req, res) => {
+            try {
+                const connectionId = req.params.id;
+                const { api_key } = req.body;
+                if (!api_key) {
+                    return res.status(400).json({
+                        error: 'Missing required field: api_key'
+                    });
+                }
+                // Store the API key in the vault
+                await this.vault.setCredential(connectionId, api_key, 'provider', `Connection ${connectionId}`);
+                console.log(`[${this.nodeId}] Updated API key for connection ${connectionId}`);
+                res.json({
+                    success: true,
+                    message: 'API key updated successfully',
+                    connection_id: connectionId
+                });
+            }
+            catch (error) {
+                console.error(`[${this.nodeId}] Error updating API key:`, error.message);
+                res.status(500).json({ error: error.message });
+            }
+        });
+        // POST /auth - Update authentication API key
+        this.managementApp.post('/auth', async (req, res) => {
+            try {
+                const { api_key } = req.body;
+                if (!api_key) {
+                    return res.status(400).json({
+                        error: 'Missing required field: api_key'
+                    });
+                }
+                // Clear current user information when API key changes
+                this.apiKey = api_key;
+                this.isAuthenticated = false;
+                this.currentUser = null;
+                console.log(`[${this.nodeId}] Updated authentication API key via management API`);
+                console.log(`[${this.nodeId}] Cleared current user - re-authentication required`);
+                res.json({
+                    status: 'success',
+                    message: 'Authentication API key updated. Gateway will automatically reconnect.',
+                    note: 'User authentication will be refreshed on reconnection'
+                });
+                // Automatically trigger reconnection after response is sent
+                setTimeout(async () => {
+                    console.log(`[${this.nodeId}] Auto-reconnecting with new API key...`);
+                    await this.connectToMarketplace();
+                    await this.registerGateway();
+                }, 500);
+            }
+            catch (error) {
+                console.error(`[${this.nodeId}] Error updating auth:`, error.message);
+                res.status(500).json({ error: error.message });
+            }
+        });
+        // POST /reconnect - Reconnect to marketplace
+        this.managementApp.post('/reconnect', async (req, res) => {
+            try {
+                console.log(`[${this.nodeId}] Reconnect requested via management API`);
+                res.json({
+                    status: 'reconnecting',
+                    message: 'Disconnecting and reconnecting to marketplace'
+                });
+                // Reconnect after sending response
+                setTimeout(async () => {
+                    await this.connectToMarketplace();
+                    await this.registerGateway();
+                }, 500);
+            }
+            catch (error) {
+                console.error(`[${this.nodeId}] Error reconnecting:`, error.message);
+                res.status(500).json({ error: error.message });
+            }
+        });
+        // GET /health - Health check endpoint
+        this.managementApp.get('/health', (req, res) => {
+            res.json({
+                status: 'healthy',
+                timestamp: new Date().toISOString(),
+                connected: this.marketplaceWs?.readyState === ws_1.default.OPEN,
+                authenticated: this.isAuthenticated,
+                current_user: this.currentUser ? {
+                    user_id: this.currentUser.id,
+                    user_email: this.currentUser.email,
+                    organization_id: this.currentUser.organization_id
+                } : null
+            });
+        });
+    }
+    /**
+     * Start management REST API server
+     */
+    async startManagementServer() {
+        return new Promise((resolve, reject) => {
+            this.managementServer = this.managementApp.listen(this.port, () => {
+                console.log(`[${this.nodeId}] Management API started on port ${this.port}`);
+                console.log(`[${this.nodeId}] CLI endpoints available at http://localhost:${this.port}`);
+                resolve();
+            });
+            this.managementServer.on('error', (error) => {
+                console.error(`[${this.nodeId}] Management server error:`, error.message);
+                reject(error);
+            });
+        });
+    }
+    /**
+     * Format uptime in human-readable format
+     */
+    formatUptime(ms) {
+        const seconds = Math.floor(ms / 1000);
+        const minutes = Math.floor(seconds / 60);
+        const hours = Math.floor(minutes / 60);
+        const days = Math.floor(hours / 24);
+        if (days > 0)
+            return `${days}d ${hours % 24}h ${minutes % 60}m`;
+        if (hours > 0)
+            return `${hours}h ${minutes % 60}m ${seconds % 60}s`;
+        if (minutes > 0)
+            return `${minutes}m ${seconds % 60}s`;
+        return `${seconds}s`;
+    }
+    /**
+     * Connect to marketplace control plane
+     */
+    async connectToMarketplace() {
+        return new Promise((resolve, reject) => {
+            if (this.reconnectInterval) {
+                clearTimeout(this.reconnectInterval);
+                this.reconnectInterval = null;
+            }
+            if (this.marketplaceWs) {
+                this.marketplaceWs.removeAllListeners();
+                if (this.marketplaceWs.readyState === ws_1.default.OPEN) {
+                    this.marketplaceWs.close();
+                }
+                this.marketplaceWs = null;
+            }
+            console.log(`[${this.nodeId}] Connecting to marketplace at ${this.marketplaceUrl}...`);
+            this.marketplaceWs = new ws_1.default(this.marketplaceUrl, {
+                headers: {
+                    'X-Gateway-Type': '3',
+                    'X-Instance-ID': this.instanceId,
+                    'X-Node-ID': this.nodeId,
+                    'X-Version': this.currentVersion
+                }
+            });
+            this.marketplaceWs.on('open', () => {
+                console.log(`[${this.nodeId}] ✅ Connected to marketplace control plane`);
+                this.reconnectAttempts = 0;
+                this.isAuthenticated = false;
+                resolve();
+            });
+            this.marketplaceWs.on('message', (data) => {
+                this.handleMarketplaceMessage(data.toString());
+            });
+            this.marketplaceWs.on('error', (error) => {
+                console.error(`[${this.nodeId}] ❌ Marketplace connection error:`, error.message);
+                this.emit('error', error);
+                if (this.reconnectAttempts === 0) {
+                    reject(error);
+                }
+            });
+            this.marketplaceWs.on('close', (code, reason) => {
+                console.log(`[${this.nodeId}] 🔌 Disconnected from marketplace (code: ${code}, reason: ${reason})`);
+                this.isAuthenticated = false;
+                this.currentUser = null; // Clear user info on disconnect
+                this.handleMarketplaceDisconnection();
+            });
+        });
+    }
+    /**
+     * Load API credentials from local vault
+     * KEY DIFFERENCE from Type 2: Reads from local vault instead of receiving from Type 1
+     */
+    async loadCredentials() {
+        console.log(`[${this.nodeId}] Loading credentials from local vault`);
+        // Initialize vault from environment if empty
+        const accessPoints = this.vault.listAccessPoints();
+        if (accessPoints.length === 0) {
+            console.log(`[${this.nodeId}] Vault is empty, initializing from environment by connection_id`);
+            await this.initializeVaultFromEnvironment();
+        }
+        const loadedAccessPoints = this.vault.listAccessPoints();
+        console.log(`[${this.nodeId}] Loaded ${loadedAccessPoints.length} credentials from vault`);
+        console.log(`[${this.nodeId}] Available connection_ids: ${loadedAccessPoints.join(', ')}`);
+    }
+    /**
+     * Initialize vault from environment variables using connection_id from database
+     */
+    async initializeVaultFromEnvironment() {
+        const { Pool } = require('pg');
+        const pool = new Pool({
+            host: process.env.DB_HOST || 'localhost',
+            port: parseInt(process.env.DB_PORT || '5432'),
+            database: process.env.DB_NAME || 'langmart',
+            user: process.env.DB_USER || 'langmart_admin',
+            password: process.env.DB_PASSWORD || 'langmart_secret_2024'
+        });
+        try {
+            // Query access points for this gateway's user
+            const result = await pool.query(`
+                SELECT ap.id, ap.access_key, p.provider_key
+                FROM connections ap
+                JOIN providers p ON ap.provider_id = p.id
+                WHERE ap.gateway_type = 3
+                AND ap.status = 'active'
+            `);
+            console.log(`[${this.nodeId}] Found ${result.rows.length} Type 3 access points in database`);
+            // Map environment variables to connection_ids
+            const providers = ['openai', 'anthropic', 'google', 'groq', 'deepseek', 'mistral'];
+            let stored = 0;
+            for (const row of result.rows) {
+                const providerKey = row.provider_key.toLowerCase();
+                const envKey = `${providerKey.toUpperCase()}_API_KEY`;
+                const apiKey = process.env[envKey];
+                if (apiKey && !apiKey.includes('mock')) {
+                    // Store with provider name for config mapping
+                    await this.vault.setCredential(row.id, apiKey, providerKey, `${providerKey} access point`);
+                    console.log(`[${this.nodeId}] Stored ${providerKey} credential as connection_id: ${row.id}`);
+                    stored++;
+                }
+            }
+            console.log(`[${this.nodeId}] Initialized ${stored} credentials from environment by UUID`);
+        }
+        catch (error) {
+            console.error(`[${this.nodeId}] Failed to initialize vault from environment:`, error.message);
+        }
+        finally {
+            await pool.end();
+        }
+    }
+    /**
+     * Register gateway with marketplace
+     * Includes tool discovery for remote DevOps sessions (if enabled)
+     */
+    async registerGateway() {
+        if (!this.apiKey) {
+            console.error(`[${this.nodeId}] FATAL: Cannot register without API key`);
+            console.error(`[${this.nodeId}] Gateway Type 3 requires API key for authentication`);
+            await this.gracefulShutdown();
+            process.exit(1);
+        }
+        // Get available tools from session manager (only if remote sessions enabled)
+        const availableTools = this.enableRemoteLLMSession ? (this.headlessSessionManager?.getAvailableTools() || []) : [];
+        // Get connections list (only if LLM routing is enabled)
+        const connections = this.enableLLMRouting ? this.vault.listAccessPoints() : [];
+        const modeNames = { [gateway_mode_1.GatewayMode.REMOTE_LLM_SESSION_ONLY]: 'remote_llm_session_only', [gateway_mode_1.GatewayMode.LLM_ROUTING_ONLY]: 'llm_routing_only', [gateway_mode_1.GatewayMode.FULL]: 'full' };
+        const registration = {
+            event: 'gateway_register',
+            gateway_type: 3,
+            instance_id: this.instanceId,
+            node_id: this.nodeId,
+            version: this.currentVersion,
+            endpoint: `wss://${this.instanceId}.gateway.seller.local:${this.port}`,
+            api_key: this.apiKey,
+            // Gateway mode - tells Type 1 what this gateway can handle
+            mode: modeNames[this.gatewayMode],
+            capabilities: {
+                // LLM routing capabilities (only advertised if LLM routing is enabled)
+                connections: connections,
+                max_concurrent: 100,
+                supports_streaming: this.enableLLMRouting,
+                supports_functions: this.enableLLMRouting,
+                // Remote session capabilities (only advertised if remote sessions enabled)
+                headless_inference: this.enableRemoteLLMSession,
+                available_tools: availableTools
+            },
+            metrics: {
+                uptime_seconds: Math.floor((Date.now() - this.metrics.startTime) / 1000),
+                cpu_usage: this.getCpuUsage(),
+                memory_usage_mb: Math.round(process.memoryUsage().heapUsed / 1024 / 1024)
+            }
+        };
+        // Log registration info based on mode
+        if (this.enableRemoteLLMSession) {
+            console.log(`[${this.nodeId}] Registering with ${availableTools.length} available tools for remote sessions`);
+        }
+        if (this.enableLLMRouting) {
+            console.log(`[${this.nodeId}] Registering with ${connections.length} connections for LLM routing`);
+        }
+        if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+            this.marketplaceWs.send(JSON.stringify(registration));
+        }
+    }
+    /**
+     * Handle messages from marketplace control plane
+     */
+    async handleMarketplaceMessage(data) {
+        try {
+            const message = JSON.parse(data);
+            // Gateway Type 1 sends both 'event' and 'type' properties for compatibility
+            // Check both to handle all message types
+            const eventType = message.event || message.type;
+            switch (eventType) {
+                case 'register_ack':
+                    console.log(`[${this.nodeId}] Registration acknowledged by Gateway Type 1`);
+                    this.isAuthenticated = true;
+                    // Capture authenticated user information
+                    if (message.user_id) {
+                        this.currentUser = {
+                            id: message.user_id,
+                            email: message.user_email,
+                            organization_id: message.organization_id
+                        };
+                        console.log(`[${this.nodeId}] Authenticated as user: ${this.currentUser.email} (${this.currentUser.id})`);
+                    }
+                    break;
+                case 'auth_failed':
+                    console.error(`[${this.nodeId}] FATAL: Authentication failed - ${message.reason || 'Invalid API key'}`);
+                    console.error(`[${this.nodeId}] Gateway Type 3 cannot operate without valid authentication`);
+                    this.isAuthenticated = false;
+                    this.currentUser = null; // Clear user info on authentication failure
+                    await this.gracefulShutdown();
+                    process.exit(1);
+                    break;
+                case 'auth_confirmed':
+                    // Gateway Type 1 sends auth_confirmed after successful authentication
+                    console.log(`[${this.nodeId}] Authentication confirmed by Gateway Type 1`);
+                    this.isAuthenticated = true;
+                    break;
+                case 'heartbeat':
+                case 'health_check':
+                    this.sendHealthStatus();
+                    break;
+                case 'heartbeat_ack':
+                    // Acknowledge heartbeat response from Type 1 (silently)
+                    break;
+                case 'inference_request':
+                    // Only handle inference requests if LLM routing is enabled
+                    if (!this.enableLLMRouting) {
+                        console.log(`[${this.nodeId}] Rejecting inference request - LLM routing not enabled in this mode`);
+                        this.sendErrorResponse(message.request_id, 'llm_routing_disabled', 'This gateway is not configured for LLM routing');
+                        break;
+                    }
+                    await this.handleForwardedInferenceRequest(message);
+                    break;
+                case 'http_request':
+                    // Only handle HTTP requests if LLM routing is enabled
+                    if (!this.enableLLMRouting) {
+                        console.log(`[${this.nodeId}] Rejecting HTTP request - LLM routing not enabled in this mode`);
+                        this.sendErrorResponse(message.request_id, 'llm_routing_disabled', 'This gateway is not configured for LLM routing');
+                        break;
+                    }
+                    await this.handleHttpRequest(message);
+                    break;
+                // ============= REMOTE SESSION EVENTS =============
+                case 'session_start':
+                    // Only handle session requests if remote sessions enabled
+                    if (!this.enableRemoteLLMSession) {
+                        console.log(`[${this.nodeId}] Rejecting session start - remote sessions not enabled in this mode`);
+                        this.sendSessionError(message.request_id, 'remote_session_disabled', 'This gateway is not configured for remote sessions');
+                        break;
+                    }
+                    await this.handleSessionStart(message);
+                    break;
+                case 'session_message':
+                    if (!this.enableRemoteLLMSession) {
+                        console.log(`[${this.nodeId}] Rejecting session message - remote sessions not enabled in this mode`);
+                        this.sendSessionError(message.request_id, 'remote_session_disabled', 'This gateway is not configured for remote sessions');
+                        break;
+                    }
+                    await this.handleSessionMessage(message);
+                    break;
+                case 'session_cancel':
+                    if (!this.enableRemoteLLMSession) {
+                        break; // Silently ignore
+                    }
+                    await this.handleSessionCancel(message);
+                    break;
+                case 'get_tools':
+                    // Always respond to get_tools, but return empty array if remote sessions disabled
+                    await this.handleGetTools(message);
+                    break;
+                case 'execute_script':
+                    // Handle script execution request from Type 1 (for remote server scripts)
+                    if (!this.enableRemoteLLMSession) {
+                        console.log(`[${this.nodeId}] Rejecting execute_script - remote sessions not enabled in this mode`);
+                        this.sendScriptError(message.requestId, 'remote_session_disabled', 'This gateway is not configured for remote operations');
+                        break;
+                    }
+                    await this.handleExecuteScript(message);
+                    break;
+                case 'shutdown':
+                    await this.gracefulShutdown();
+                    break;
+                default:
+                    console.log(`[${this.nodeId}] Unknown marketplace event: ${eventType}`);
+            }
+        }
+        catch (error) {
+            console.error(`[${this.nodeId}] Marketplace message error:`, error);
+        }
+    }
+    /**
+     * Handle inference request forwarded from Gateway Type 1
+     */
+    async handleForwardedInferenceRequest(message) {
+        const requestId = message.request_id || (0, uuid_1.v4)();
+        const startTime = Date.now();
+        console.log('\n============ GATEWAY TYPE 3 INFERENCE PROCESSING START ============');
+        console.log(`[Type3-${this.nodeId}] Step 0: Received forwarded inference request`);
+        console.log(`[Type3-${this.nodeId}] Request ID: ${requestId}`);
+        this.metrics.requestsActive++;
+        try {
+            console.log(`[Type3-${this.nodeId}] Step 1: Extracting request parameters`);
+            const provider = message.provider || 'openai';
+            const endpoint = message.endpoint || '/chat/completions';
+            const model = message.model || message.data?.model;
+            const messages = message.messages || message.data?.messages;
+            const stream = message.stream || message.data?.stream || false;
+            const temperature = message.temperature || message.data?.temperature;
+            const max_tokens = message.max_tokens || message.data?.max_tokens;
+            const tools = message.tools || message.data?.tools;
+            const endpointUrl = message.endpoint_url || message.endpointUrl;
+            console.log(`[Type3-${this.nodeId}] Step 2: Extracted parameters:`, {
+                provider,
+                endpoint,
+                model,
+                hasMessages: !!messages,
+                messageCount: messages?.length || 0,
+                stream,
+                hasTools: !!tools,
+                toolsCount: tools?.length || 0
+            });
+            // KEY FEATURE: Type 3 supports TWO credential sources
+            // Priority 1: connections table (from Type 1 message)
+            // Priority 2: local vault (indexed by connection_id)
+            console.log(`[Type3-${this.nodeId}] Step 3: Looking up provider API key`);
+            let apiKey = message.api_key || message.provider_api_key;
+            const accessPointId = message.accessPointId; // UUID from Type 1
+            if (apiKey) {
+                console.log(`[Type3-${this.nodeId}] ✓ Using API key from connections table`);
+                console.log(`[Type3-${this.nodeId}] Credential source: connections table (sent by Type 1)`);
+                console.log(`[Type3-${this.nodeId}] Access Point ID: ${accessPointId}`);
+                console.log(`[Type3-${this.nodeId}] API key:`, {
+                    provider,
+                    keyLength: apiKey.length,
+                    keyPrefix: apiKey.substring(0, 10) + '...'
+                });
+            }
+            else {
+                // Fall back to local vault using connection_id
+                console.log(`[Type3-${this.nodeId}] No API key in message, checking local vault`);
+                if (!accessPointId) {
+                    console.error(`[Type3-${this.nodeId}] ✗ ERROR: No connection_id provided`);
+                    throw new Error(`No connection_id available for credential lookup`);
+                }
+                console.log(`[Type3-${this.nodeId}] Looking up by connection_id: ${accessPointId}`);
+                apiKey = this.vault.getCredential(accessPointId);
+                if (apiKey) {
+                    console.log(`[Type3-${this.nodeId}] ✓ Using API key from local vault`);
+                    console.log(`[Type3-${this.nodeId}] Credential source: local vault`);
+                    console.log(`[Type3-${this.nodeId}] Access Point ID: ${accessPointId}`);
+                    console.log(`[Type3-${this.nodeId}] API key:`, {
+                        provider,
+                        keyLength: apiKey.length,
+                        keyPrefix: apiKey.substring(0, 10) + '...'
+                    });
+                }
+                else {
+                    console.error(`[Type3-${this.nodeId}] ✗ ERROR: No API key found for connection_id: ${accessPointId}`);
+                    console.error(`[Type3-${this.nodeId}] Checked sources:`);
+                    console.error(`[Type3-${this.nodeId}]   1. connections table (via message): NOT FOUND`);
+                    console.error(`[Type3-${this.nodeId}]   2. local vault (by connection_id ${accessPointId}): NOT FOUND`);
+                    console.error(`[Type3-${this.nodeId}] Available connection_ids in vault: ${this.vault.listAccessPoints().join(', ')}`);
+                    throw new Error(`No API key available. Add credential to local vault using connection_id: ${accessPointId}`);
+                }
+            }
+            // Forward to provider API
+            console.log(`[Type3-${this.nodeId}] Step 4: Preparing to forward to provider`);
+            let response;
+            const requestPayload = {
+                model,
+                messages,
+                temperature,
+                max_tokens,
+                stream
+            };
+            if (tools) {
+                requestPayload.tools = tools;
+            }
+            console.log(`[Type3-${this.nodeId}] Step 5: Request payload prepared`);
+            if (stream) {
+                console.log(`[Type3-${this.nodeId}] Step 6: Forwarding STREAMING request to provider`);
+                response = await this.forwardToProviderStreaming(provider, endpoint, apiKey, requestPayload, endpointUrl, requestId);
+            }
+            else {
+                console.log(`[Type3-${this.nodeId}] Step 6: Forwarding NON-STREAMING request to provider`);
+                response = await this.forwardToProvider(provider, endpoint, apiKey, requestPayload, endpointUrl);
+            }
+            if (!stream) {
+                console.log(`[Type3-${this.nodeId}] Step 7: Received response from provider`);
+                if (this.marketplaceWs && this.marketplaceWs.readyState === ws_1.default.OPEN) {
+                    const responseMessage = {
+                        event: 'inference_response',
+                        request_id: requestId,
+                        data: response,
+                        metrics: {
+                            latency_ms: Date.now() - startTime,
+                            gateway_type: 3,
+                            node_id: this.nodeId
+                        }
+                    };
+                    this.marketplaceWs.send(JSON.stringify(responseMessage));
+                    console.log(`[Type3-${this.nodeId}] Step 8: Response sent successfully`);
+                }
+            }
+            else {
+                console.log(`[Type3-${this.nodeId}] Step 7: Streaming response handled via stream events`);
+            }
+            this.metrics.requestsHandled++;
+            console.log(`[Type3-${this.nodeId}] Step 9: Request completed successfully`);
+            console.log('============ GATEWAY TYPE 3 INFERENCE PROCESSING END ============\n');
+        }
+        catch (error) {
+            console.error(`[Type3-${this.nodeId}] ERROR in request ${requestId}:`, error.message);
+            if (this.marketplaceWs && this.marketplaceWs.readyState === ws_1.default.OPEN) {
+                this.marketplaceWs.send(JSON.stringify({
+                    event: 'inference_error',
+                    request_id: requestId,
+                    error: {
+                        code: error.response?.status || 500,
+                        message: error.message,
+                        type: 'provider_error'
+                    },
+                    metrics: {
+                        latency_ms: Date.now() - startTime,
+                        gateway_type: 3
+                    }
+                }));
+            }
+            this.metrics.errorCount++;
+        }
+        finally {
+            this.metrics.requestsActive--;
+        }
+    }
+    /**
+     * Forward request to provider API (non-streaming)
+     */
+    async forwardToProvider(provider, endpoint, apiKey, payload, endpointUrl) {
+        // Type 3 is a PURE FORWARDER like Type 2
+        // Type 1 handles ALL translation
+        let url;
+        if (endpointUrl) {
+            if (endpointUrl.startsWith('http://') || endpointUrl.startsWith('https://')) {
+                url = endpointUrl + endpoint;
+            }
+            else {
+                url = endpointUrl + endpoint;
+            }
+        }
+        else {
+            console.warn(`[${this.nodeId}] No endpointUrl provided, using generic URL`);
+            url = `https://api.${provider}.com${endpoint}`;
+        }
+        if (provider.toLowerCase() === 'google' || provider.toLowerCase() === 'gemini') {
+            url = `${url}?key=${apiKey}`;
+        }
+        const headers = this.getProviderHeaders(provider, apiKey);
+        if (provider.toLowerCase() === 'google' || provider.toLowerCase() === 'gemini') {
+            delete headers['x-goog-api-key'];
+            delete headers['Authorization'];
+        }
+        const response = await axios_1.default.post(url, payload, {
+            headers,
+            timeout: 120000,
+            validateStatus: (status) => status < 500
+        });
+        if (response.headers['x-ratelimit-limit-requests']) {
+            this.reportRateLimits(provider, response.headers);
+        }
+        if (response.status >= 400) {
+            const error = new Error(response.data?.error?.message || 'Provider error');
+            error.response = { status: response.status, data: response.data };
+            throw error;
+        }
+        return response.data;
+    }
+    /**
+     * Forward streaming request to provider
+     */
+    async forwardToProviderStreaming(provider, endpoint, apiKey, payload, endpointUrl, requestId) {
+        console.log(`[${this.nodeId}] Starting streaming request to provider ${provider}`);
+        let url;
+        if (endpointUrl) {
+            if (endpointUrl.startsWith('http://') || endpointUrl.startsWith('https://')) {
+                url = endpointUrl + endpoint;
+            }
+            else {
+                url = endpointUrl + endpoint;
+            }
+        }
+        else {
+            url = `https://api.${provider}.com${endpoint}`;
+        }
+        if (provider.toLowerCase() === 'google' || provider.toLowerCase() === 'gemini') {
+            url = `${url}?key=${apiKey}&alt=sse`;
+        }
+        const headers = this.getProviderHeaders(provider, apiKey);
+        if (provider.toLowerCase() === 'google' || provider.toLowerCase() === 'gemini') {
+            delete headers['x-goog-api-key'];
+            delete headers['Authorization'];
+        }
+        try {
+            const response = await (0, axios_1.default)({
+                method: 'POST',
+                url,
+                headers,
+                data: payload,
+                responseType: 'stream',
+                timeout: 120000
+            });
+            response.data.on('data', (chunk) => {
+                const lines = chunk.toString().split('\n');
+                for (const line of lines) {
+                    if (line.startsWith('data: ')) {
+                        const data = line.substring(6);
+                        if (data === '[DONE]') {
+                            if (this.marketplaceWs && this.marketplaceWs.readyState === ws_1.default.OPEN) {
+                                this.marketplaceWs.send(JSON.stringify({
+                                    event: 'stream_end',
+                                    request_id: requestId,
+                                    timestamp: new Date().toISOString()
+                                }));
+                            }
+                        }
+                        else {
+                            try {
+                                const parsed = JSON.parse(data);
+                                if (this.marketplaceWs && this.marketplaceWs.readyState === ws_1.default.OPEN) {
+                                    this.marketplaceWs.send(JSON.stringify({
+                                        event: 'stream_chunk',
+                                        request_id: requestId,
+                                        data: parsed,
+                                        timestamp: new Date().toISOString()
+                                    }));
+                                }
+                            }
+                            catch (e) {
+                                // Skip invalid JSON
+                            }
+                        }
+                    }
+                }
+            });
+            return new Promise((resolve, reject) => {
+                response.data.on('end', () => {
+                    console.log(`[${this.nodeId}] Streaming completed for request ${requestId}`);
+                    if (this.marketplaceWs && this.marketplaceWs.readyState === ws_1.default.OPEN) {
+                        this.marketplaceWs.send(JSON.stringify({
+                            event: 'stream_complete',
+                            request_id: requestId,
+                            stream_completed: true,
+                            timestamp: new Date().toISOString()
+                        }));
+                    }
+                    resolve({ stream_completed: true });
+                });
+                response.data.on('error', (error) => {
+                    console.error(`[${this.nodeId}] Stream error for request ${requestId}:`, error);
+                    if (this.marketplaceWs && this.marketplaceWs.readyState === ws_1.default.OPEN) {
+                        this.marketplaceWs.send(JSON.stringify({
+                            event: 'stream_error',
+                            request_id: requestId,
+                            error: {
+                                message: error.message,
+                                code: 500
+                            },
+                            timestamp: new Date().toISOString()
+                        }));
+                    }
+                    reject(error);
+                });
+            });
+        }
+        catch (error) {
+            console.error(`[${this.nodeId}] Failed to initiate streaming:`, error);
+            throw error;
+        }
+    }
+    /**
+     * Get provider-specific headers
+     */
+    getProviderHeaders(provider, apiKey) {
+        const baseHeaders = {
+            'Content-Type': 'application/json',
+            'User-Agent': `LangMartGateway-Type3/${this.currentVersion}`
+        };
+        switch (provider) {
+            case 'openai':
+            case 'deepseek':
+            case 'groq':
+            case 'mistral':
+                return {
+                    ...baseHeaders,
+                    'Authorization': `Bearer ${apiKey}`
+                };
+            case 'anthropic':
+                return {
+                    ...baseHeaders,
+                    'x-api-key': apiKey,
+                    'anthropic-version': '2023-06-01'
+                };
+            case 'google':
+                return {
+                    ...baseHeaders,
+                    'x-goog-api-key': apiKey
+                };
+            default:
+                return {
+                    ...baseHeaders,
+                    'Authorization': `Bearer ${apiKey}`
+                };
+        }
+    }
+    /**
+     * Generic HTTP request forwarder
+     * Type 3 is ONLY a forwarder - it makes HTTP calls and returns RAW responses
+     * Type 1 does all business logic, translation, and storage
+     *
+     * Message format:
+     * {
+     *   event: 'http_request',
+     *   requestId: 'uuid',
+     *   connection_id: 'uuid',
+     *   method: 'GET' | 'POST' | etc,
+     *   url: 'http://localhost:11434/api/tags',
+     *   headers: { ... },
+     *   body: { ... } (optional)
+     * }
+     */
+    async handleHttpRequest(message) {
+        const requestId = message.requestId || (0, uuid_1.v4)();
+        const { connection_id, method, url, headers = {}, body } = message;
+        console.log(`[${this.nodeId}] Forwarding HTTP ${method} request to: ${url}`);
+        try {
+            // Get API key from local vault if connection_id provided
+            let requestHeaders = { ...headers };
+            if (connection_id) {
+                const apiKey = this.vault.getCredential(connection_id);
+                if (apiKey) {
+                    // Add authorization header if not already present
+                    if (!requestHeaders['Authorization'] && !requestHeaders['authorization']) {
+                        requestHeaders['Authorization'] = `Bearer ${apiKey}`;
+                    }
+                }
+            }
+            // Make HTTP request - GENERIC forwarding
+            const fetchOptions = {
+                method: method,
+                headers: requestHeaders
+            };
+            if (body && (method === 'POST' || method === 'PUT' || method === 'PATCH')) {
+                fetchOptions.body = typeof body === 'string' ? body : JSON.stringify(body);
+                if (!requestHeaders['Content-Type']) {
+                    requestHeaders['Content-Type'] = 'application/json';
+                }
+            }
+            console.log(`[${this.nodeId}] Making ${method} request to ${url}`);
+            const response = await fetch(url, fetchOptions);
+            const responseText = await response.text();
+            // Try to parse as JSON, fallback to text
+            let responseData;
+            try {
+                responseData = JSON.parse(responseText);
+            }
+            catch {
+                responseData = responseText;
+            }
+            // Send RAW HTTP response back to Type 1
+            const wsResponse = {
+                event: 'http_response',
+                requestId: requestId,
+                success: response.ok,
+                status: response.status,
+                headers: Object.fromEntries(response.headers.entries()),
+                body: responseData, // RAW response body
+                timestamp: new Date().toISOString()
+            };
+            if (this.marketplaceWs && this.marketplaceWs.readyState === ws_1.default.OPEN) {
+                this.marketplaceWs.send(JSON.stringify(wsResponse));
+                console.log(`[${this.nodeId}] Sent HTTP response (${response.status}) to Type 1`);
+            }
+        }
+        catch (error) {
+            console.error(`[${this.nodeId}] HTTP forwarding error:`, error.message);
+            if (this.marketplaceWs && this.marketplaceWs.readyState === ws_1.default.OPEN) {
+                this.marketplaceWs.send(JSON.stringify({
+                    event: 'http_response',
+                    requestId: requestId,
+                    success: false,
+                    error: error.message,
+                    timestamp: new Date().toISOString()
+                }));
+            }
+        }
+    }
+    /**
+     * Send health status to marketplace
+     */
+    sendHealthStatus() {
+        if (this.marketplaceWs && this.marketplaceWs.readyState === ws_1.default.OPEN) {
+            const heartbeat = {
+                type: 'heartbeat',
+                timestamp: new Date().toISOString()
+            };
+            this.marketplaceWs.send(JSON.stringify(heartbeat));
+        }
+        const status = {
+            event: 'health_status',
+            instance_id: this.instanceId,
+            node_id: this.nodeId,
+            status: this.determineHealthStatus(),
+            metrics: {
+                uptime_seconds: Math.floor((Date.now() - this.metrics.startTime) / 1000),
+                requests_handled: this.metrics.requestsHandled,
+                requests_active: this.metrics.requestsActive,
+                error_rate: this.metrics.errorCount / Math.max(1, this.metrics.requestsHandled),
+                avg_latency_ms: Math.round(this.metrics.avgLatency),
+                cpu_usage_percent: this.getCpuUsage(),
+                memory_usage_mb: Math.round(process.memoryUsage().heapUsed / 1024 / 1024),
+                connection_count: this.vault.listAccessPoints().length
+            },
+            timestamp: new Date().toISOString()
+        };
+        if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+            this.marketplaceWs.send(JSON.stringify(status));
+        }
+        this.metrics.lastHealthCheck = new Date();
+    }
+    /**
+     * Determine health status
+     */
+    determineHealthStatus() {
+        const errorRate = this.metrics.errorCount / Math.max(1, this.metrics.requestsHandled);
+        if (errorRate > 0.1)
+            return 'unhealthy';
+        if (errorRate > 0.05)
+            return 'degraded';
+        if (this.metrics.requestsActive > 50)
+            return 'overloaded';
+        return 'healthy';
+    }
+    /**
+     * Report rate limits
+     */
+    reportRateLimits(provider, headers) {
+        const rateLimits = {
+            event: 'rate_limits',
+            instance_id: this.instanceId,
+            provider,
+            limits: {
+                rpm: headers['x-ratelimit-limit-requests'],
+                tpm: headers['x-ratelimit-limit-tokens'],
+                remaining: headers['x-ratelimit-remaining-requests'],
+                reset: headers['x-ratelimit-reset-requests']
+            },
+            timestamp: new Date().toISOString()
+        };
+        if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+            this.marketplaceWs.send(JSON.stringify(rateLimits));
+        }
+    }
+    /**
+     * Start health monitoring
+     */
+    startHealthMonitoring() {
+        this.healthCheckInterval = setInterval(() => {
+            this.sendHealthStatus();
+            if (this.marketplaceWs?.readyState !== ws_1.default.OPEN) {
+                console.warn(`[${this.nodeId}] Lost connection to marketplace, reconnecting...`);
+                this.connectToMarketplace().catch(console.error);
+            }
+        }, 30000);
+    }
+    /**
+     * Handle marketplace disconnection
+     */
+    handleMarketplaceDisconnection() {
+        if (this.isShuttingDown) {
+            console.log(`[${this.nodeId}] Shutdown in progress, skipping reconnection`);
+            return;
+        }
+        if (this.reconnectInterval) {
+            clearTimeout(this.reconnectInterval);
+            this.reconnectInterval = null;
+        }
+        this.reconnectAttempts++;
+        if (this.maxReconnectAttempts > 0 && this.reconnectAttempts > this.maxReconnectAttempts) {
+            console.error(`[${this.nodeId}] ❌ Maximum reconnection attempts exceeded`);
+            this.emit('max_reconnect_exceeded');
+            return;
+        }
+        console.log(`[${this.nodeId}] 🔄 Scheduling reconnection attempt ${this.reconnectAttempts}...`);
+        this.reconnectInterval = setTimeout(async () => {
+            console.log(`[${this.nodeId}] 🔄 Attempting to reconnect (attempt ${this.reconnectAttempts})...`);
+            try {
+                await this.connectToMarketplace();
+                if (this.marketplaceWs && this.marketplaceWs.readyState === ws_1.default.OPEN) {
+                    console.log(`[${this.nodeId}] 📝 Re-registering after reconnection...`);
+                    await this.registerGateway();
+                }
+            }
+            catch (error) {
+                console.error(`[${this.nodeId}] ❌ Reconnection attempt failed:`, error.message);
+            }
+        }, this.reconnectDelay);
+    }
+    /**
+     * Get CPU usage
+     */
+    getCpuUsage() {
+        const cpus = require('os').cpus();
+        let totalIdle = 0;
+        let totalTick = 0;
+        cpus.forEach((cpu) => {
+            for (const type in cpu.times) {
+                totalTick += cpu.times[type];
+            }
+            totalIdle += cpu.times.idle;
+        });
+        const idle = totalIdle / cpus.length;
+        const total = totalTick / cpus.length;
+        return 100 - ~~(100 * idle / total);
+    }
+    /**
+     * Get test URL for provider
+     * Uses /v1/models endpoint for OpenAI-compatible providers
+     */
+    getTestUrl(providerKey, baseUrl, endpointType) {
+        const cleanBaseUrl = baseUrl.replace(/\/$/, ''); // Remove trailing slash
+        // Provider-specific test endpoints
+        switch (providerKey.toLowerCase()) {
+            case 'ollama':
+                // If using OpenAI-compatible endpoint, use OpenAI pattern
+                if (endpointType === 'openai-v1' || cleanBaseUrl.includes('/v1')) {
+                    // OpenAI-compatible Ollama: /v1/models
+                    if (cleanBaseUrl.includes('/v1')) {
+                        return `${cleanBaseUrl}/models`;
+                    }
+                    return `${cleanBaseUrl}/v1/models`;
+                }
+                // Native Ollama API: /api/tags
+                if (cleanBaseUrl.includes('/api')) {
+                    return `${cleanBaseUrl}/tags`;
+                }
+                return `${cleanBaseUrl}/api/tags`;
+            case 'openai':
+            case 'groq':
+            case 'anthropic':
+            case 'together':
+            case 'fireworks':
+            case 'deepseek':
+            case 'mistral':
+            case 'perplexity':
+            case 'openrouter':
+            default:
+                // OpenAI-compatible: /v1/models
+                // If baseUrl already has /v1 path, just append /models
+                if (cleanBaseUrl.includes('/v1')) {
+                    return `${cleanBaseUrl}/models`;
+                }
+                return `${cleanBaseUrl}/v1/models`;
+        }
+    }
+    // ============= HEADLESS SESSION HANDLERS =============
+    /**
+     * Handle session start request from Type 1
+     */
+    async handleSessionStart(message) {
+        const requestId = message.requestId || message.request_id;
+        console.log(`[${this.nodeId}] Received session_start request: ${requestId}`);
+        if (!this.headlessSessionManager) {
+            this.sendSessionError(requestId, 'Headless session manager not initialized');
+            return;
+        }
+        try {
+            const config = {
+                sessionId: message.sessionId,
+                userId: message.userId,
+                organizationId: message.organizationId,
+                templateId: message.templateId,
+                systemPrompt: message.systemPrompt,
+                initialMessage: message.initialMessage,
+                modelId: message.modelId,
+                connectionId: message.connectionId,
+                maxTurns: message.maxTurns,
+                timeout: message.timeout,
+                disabledTools: message.disabledTools || [] // List of tools to disable (empty = all enabled)
+            };
+            console.log(`[${this.nodeId}] session_start received disabledTools: [${(message.disabledTools || []).join(', ')}]`);
+            const session = await this.headlessSessionManager.startSession(config);
+            // Send acknowledgment to Type 1
+            // NOTE: The initialMessage is the assistant's greeting, already added to session history
+            // We do NOT call processSessionMessageInternal because the greeting doesn't need an LLM response
+            if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+                this.marketplaceWs.send(JSON.stringify({
+                    event: 'session_started',
+                    requestId,
+                    sessionId: session.sessionId,
+                    gatewayId: this.instanceId,
+                    status: session.status,
+                    startedAt: session.startedAt.toISOString(),
+                    // Include the initial message so Type 1 can display it to the user
+                    initialMessage: message.initialMessage,
+                    timestamp: new Date().toISOString()
+                }));
+            }
+        }
+        catch (error) {
+            console.error(`[${this.nodeId}] Session start error:`, error.message);
+            this.sendSessionError(requestId, error.message);
+        }
+    }
+    /**
+     * Handle session message from Type 1
+     */
+    async handleSessionMessage(message) {
+        const requestId = message.requestId || message.request_id;
+        const sessionId = message.sessionId;
+        const userMessage = message.message || message.content;
+        const modelId = message.modelId; // Per-message model override
+        console.log(`[${this.nodeId}] Received session_message for session: ${sessionId}${modelId ? ` with model: ${modelId}` : ''}`);
+        if (!this.headlessSessionManager) {
+            this.sendSessionError(requestId, 'Headless session manager not initialized');
+            return;
+        }
+        await this.processSessionMessageInternal(sessionId, userMessage, requestId, modelId);
+    }
+    /**
+     * Internal method to process session messages with streaming
+     * @param modelId - Optional model ID to use for this specific message (overrides session default)
+     */
+    async processSessionMessageInternal(sessionId, userMessage, requestId, modelId) {
+        try {
+            // Stream handler to send chunks to Type 1
+            const onChunk = (chunk) => {
+                if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+                    this.marketplaceWs.send(JSON.stringify({
+                        event: 'session_chunk',
+                        requestId,
+                        sessionId,
+                        chunk,
+                        timestamp: new Date().toISOString()
+                    }));
+                }
+            };
+            const response = await this.headlessSessionManager.processMessage(sessionId, userMessage, onChunk, modelId // Pass per-message model ID
+            );
+            // Send final response to Type 1
+            if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+                this.marketplaceWs.send(JSON.stringify({
+                    event: 'session_response',
+                    requestId,
+                    sessionId,
+                    status: response.status,
+                    message: response.message,
+                    toolResults: response.toolResults,
+                    isComplete: response.isComplete,
+                    error: response.error,
+                    requestIds: response.requestIds, // LLM request IDs for request log linking
+                    usage: response.usage, // Token usage for display
+                    timestamp: new Date().toISOString()
+                }));
+            }
+        }
+        catch (error) {
+            console.error(`[${this.nodeId}] Session message error:`, error.message);
+            this.sendSessionError(requestId, error.message, sessionId);
+        }
+    }
+    /**
+     * Handle session cancel request from Type 1
+     */
+    async handleSessionCancel(message) {
+        const requestId = message.requestId || message.request_id;
+        const sessionId = message.sessionId;
+        console.log(`[${this.nodeId}] Received session_cancel for session: ${sessionId}`);
+        if (!this.headlessSessionManager) {
+            this.sendSessionError(requestId, 'Headless session manager not initialized');
+            return;
+        }
+        const success = await this.headlessSessionManager.cancelSession(sessionId);
+        if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+            this.marketplaceWs.send(JSON.stringify({
+                event: 'session_cancelled',
+                requestId,
+                sessionId,
+                success,
+                timestamp: new Date().toISOString()
+            }));
+        }
+    }
+    /**
+     * Handle tool discovery request from Type 1
+     */
+    async handleGetTools(message) {
+        const requestId = message.requestId || message.request_id;
+        console.log(`[${this.nodeId}] Received get_tools request`);
+        const tools = this.headlessSessionManager?.getAvailableTools() || [];
+        if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+            this.marketplaceWs.send(JSON.stringify({
+                event: 'tools_response',
+                requestId,
+                gatewayId: this.instanceId,
+                tools,
+                timestamp: new Date().toISOString()
+            }));
+        }
+    }
+    /**
+     * Send session error to Type 1
+     */
+    sendSessionError(requestId, error, sessionId) {
+        if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+            this.marketplaceWs.send(JSON.stringify({
+                event: 'session_error',
+                requestId,
+                sessionId,
+                error,
+                timestamp: new Date().toISOString()
+            }));
+        }
+    }
+    /**
+     * Send inference error response to Type 1
+     */
+    sendErrorResponse(requestId, code, message) {
+        if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+            this.marketplaceWs.send(JSON.stringify({
+                event: 'inference_error',
+                request_id: requestId,
+                error: {
+                    code,
+                    message
+                },
+                timestamp: new Date().toISOString()
+            }));
+        }
+    }
+    // ============= END HEADLESS SESSION HANDLERS =============
+    // ============= SCRIPT EXECUTION HANDLERS =============
+    /**
+     * Handle execute_script request from Type 1
+     * Executes a remote server script via SSH
+     *
+     * SECURITY: This handler includes fixes for:
+     * - #1: No hardcoded encryption key fallback
+     * - #2/#3: Parameter name/value validation and shell escaping
+     * - #4: Working directory path validation
+     */
+    async handleExecuteScript(message) {
+        const requestId = message.requestId;
+        const { script, server, parameters } = message;
+        const startTime = Date.now();
+        console.log(`[${this.nodeId}] Executing script "${script.name}" on server "${server.name}" (${server.hostname}:${server.port})`);
+        try {
+            // Import required modules for SSH execution
+            const { Client: SSHClient } = require('ssh2');
+            const crypto = require('crypto');
+            // SECURITY FIX #1: Require encryption key - no hardcoded fallback
+            const ENCRYPTION_KEY = process.env.SERVER_ENCRYPTION_KEY;
+            if (!ENCRYPTION_KEY && process.env.NODE_ENV !== 'development' && process.env.DEV_MODE !== 'true') {
+                throw new Error('SERVER_ENCRYPTION_KEY environment variable must be set in production');
+            }
+            const encryptionKey = ENCRYPTION_KEY || 'dev-only-key-not-for-production-use';
+            // Decrypt function supporting both old and new format
+            const decrypt = (encryptedText) => {
+                const parts = encryptedText.split(':');
+                let salt;
+                let iv;
+                let authTag;
+                let encrypted;
+                if (parts.length === 4) {
+                    // New format with random salt: salt:iv:authTag:encrypted
+                    salt = Buffer.from(parts[0], 'hex');
+                    iv = Buffer.from(parts[1], 'hex');
+                    authTag = Buffer.from(parts[2], 'hex');
+                    encrypted = parts[3];
+                }
+                else if (parts.length === 3) {
+                    // Legacy format with static salt: iv:authTag:encrypted
+                    console.warn(`[${this.nodeId}] Decrypting legacy format - consider re-encrypting`);
+                    salt = Buffer.from('salt');
+                    iv = Buffer.from(parts[0], 'hex');
+                    authTag = Buffer.from(parts[1], 'hex');
+                    encrypted = parts[2];
+                }
+                else {
+                    throw new Error('Invalid encrypted data format');
+                }
+                const key = crypto.scryptSync(encryptionKey, salt, 32);
+                const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+                decipher.setAuthTag(authTag);
+                let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+                decrypted += decipher.final('utf8');
+                return decrypted;
+            };
+            // SECURITY FIX #2/#3: Shell-escape function
+            const shellEscape = (value) => {
+                return "'" + String(value).replace(/'/g, "'\\''") + "'";
+            };
+            // SECURITY FIX #2/#3: Validate parameter name pattern
+            const VALID_PARAM_NAME_REGEX = /^[A-Z_][A-Z0-9_]*$/;
+            // SECURITY FIX #4: Validate working directory path
+            const VALID_PATH_REGEX = /^[a-zA-Z0-9_./-]+$|^~(\/[a-zA-Z0-9_./-]+)?$/;
+            const validateWorkingDirectory = (path) => {
+                if (!path || path === '~')
+                    return true;
+                return VALID_PATH_REGEX.test(path) && !path.includes('..');
+            };
+            // Build the command with environment variables (with security validation)
+            const envVars = [];
+            for (const [key, value] of Object.entries(parameters || {})) {
+                // SECURITY FIX #2/#3: Validate parameter name
+                if (!VALID_PARAM_NAME_REGEX.test(key)) {
+                    throw new Error(`Invalid parameter name "${key}": must match pattern ${VALID_PARAM_NAME_REGEX}`);
+                }
+                // Shell-escape the value
+                const escapedValue = shellEscape(String(value));
+                envVars.push(`export ${key}=${escapedValue}`);
+            }
+            const envExports = envVars.length > 0 ? envVars.join('; ') + '; ' : '';
+            // SECURITY FIX #4: Validate working directory
+            if (!validateWorkingDirectory(script.working_directory || '')) {
+                throw new Error(`Invalid working directory "${script.working_directory}": contains invalid characters or path traversal`);
+            }
+            const cdCommand = script.working_directory && script.working_directory !== '~'
+                ? `cd ${shellEscape(script.working_directory)} 2>/dev/null || cd ~`
+                : 'cd ~';
+            const fullCommand = envExports
+                ? `${cdCommand}; ${envExports}${script.content}`
+                : `${cdCommand}; ${script.content}`;
+            // Build SSH config
+            const sshConfig = {
+                host: server.hostname,
+                port: server.port,
+                username: server.username,
+                readyTimeout: 30000,
+                keepaliveInterval: 10000
+            };
+            // Set authentication
+            if (server.auth_type === 'password' && server.encrypted_password) {
+                sshConfig.password = decrypt(server.encrypted_password);
+            }
+            else if ((server.auth_type === 'ssh_key' || server.auth_type === 'ssh_key_passphrase') && server.encrypted_ssh_key) {
+                sshConfig.privateKey = decrypt(server.encrypted_ssh_key);
+                if (server.auth_type === 'ssh_key_passphrase' && server.encrypted_passphrase) {
+                    sshConfig.passphrase = decrypt(server.encrypted_passphrase);
+                }
+            }
+            else {
+                throw new Error(`No valid credentials for auth type: ${server.auth_type}`);
+            }
+            // Execute via SSH
+            const result = await new Promise((resolve) => {
+                const conn = new SSHClient();
+                const timeoutMs = (script.timeout_seconds || 300) * 1000;
+                const timeout = setTimeout(() => {
+                    conn.end();
+                    resolve({
+                        success: false,
+                        exit_code: -1,
+                        stdout: '',
+                        stderr: '',
+                        duration_ms: Date.now() - startTime,
+                        error_message: `Execution timeout after ${script.timeout_seconds || 300} seconds`
+                    });
+                }, timeoutMs);
+                conn.on('ready', () => {
+                    conn.exec(fullCommand, (err, stream) => {
+                        if (err) {
+                            clearTimeout(timeout);
+                            conn.end();
+                            resolve({
+                                success: false,
+                                exit_code: -1,
+                                stdout: '',
+                                stderr: '',
+                                duration_ms: Date.now() - startTime,
+                                error_message: `Command execution failed: ${err.message}`
+                            });
+                            return;
+                        }
+                        let stdout = '';
+                        let stderr = '';
+                        stream.on('data', (data) => {
+                            stdout += data.toString();
+                        });
+                        stream.stderr.on('data', (data) => {
+                            stderr += data.toString();
+                        });
+                        stream.on('close', (code) => {
+                            clearTimeout(timeout);
+                            conn.end();
+                            resolve({
+                                success: code === 0,
+                                exit_code: code,
+                                stdout,
+                                stderr,
+                                duration_ms: Date.now() - startTime
+                            });
+                        });
+                    });
+                });
+                conn.on('error', (err) => {
+                    clearTimeout(timeout);
+                    resolve({
+                        success: false,
+                        exit_code: -1,
+                        stdout: '',
+                        stderr: '',
+                        duration_ms: Date.now() - startTime,
+                        error_message: `SSH connection failed: ${err.message}`
+                    });
+                });
+                try {
+                    conn.connect(sshConfig);
+                }
+                catch (err) {
+                    clearTimeout(timeout);
+                    resolve({
+                        success: false,
+                        exit_code: -1,
+                        stdout: '',
+                        stderr: '',
+                        duration_ms: Date.now() - startTime,
+                        error_message: `Failed to initiate connection: ${err.message}`
+                    });
+                }
+            });
+            console.log(`[${this.nodeId}] Script execution completed: ${result.success ? 'success' : 'failed'} (exit code: ${result.exit_code})`);
+            // Send result back to Type 1
+            if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+                this.marketplaceWs.send(JSON.stringify({
+                    event: 'script_result',
+                    requestId,
+                    success: true,
+                    result: {
+                        exit_code: result.exit_code,
+                        stdout: result.stdout,
+                        stderr: result.stderr,
+                        duration_ms: result.duration_ms,
+                        error_message: result.error_message
+                    },
+                    timestamp: new Date().toISOString()
+                }));
+            }
+        }
+        catch (error) {
+            console.error(`[${this.nodeId}] Script execution error:`, error.message);
+            this.sendScriptError(requestId, 'execution_failed', error.message);
+        }
+    }
+    /**
+     * Send script execution error to Type 1
+     */
+    sendScriptError(requestId, code, message) {
+        if (this.marketplaceWs?.readyState === ws_1.default.OPEN) {
+            this.marketplaceWs.send(JSON.stringify({
+                event: 'script_result',
+                requestId,
+                success: false,
+                error: message,
+                code,
+                timestamp: new Date().toISOString()
+            }));
+        }
+    }
+    // ============= END SCRIPT EXECUTION HANDLERS =============
+    /**
+     * Graceful shutdown
+     */
+    async gracefulShutdown() {
+        console.log(`[${this.nodeId}] Initiating graceful shutdown...`);
+        this.isShuttingDown = true;
+        if (this.reconnectInterval) {
+            clearTimeout(this.reconnectInterval);
+            this.reconnectInterval = null;
+        }
+        if (this.healthCheckInterval) {
+            clearInterval(this.healthCheckInterval);
+            this.healthCheckInterval = null;
+        }
+        // Wait for active requests
+        const maxWaitTime = 30000;
+        const startTime = Date.now();
+        while (this.activeRequests.size > 0 && Date.now() - startTime < maxWaitTime) {
+            console.log(`[${this.nodeId}] Waiting for ${this.activeRequests.size} active requests...`);
+            await new Promise(resolve => setTimeout(resolve, 1000));
+        }
+        // Close marketplace WebSocket
+        if (this.marketplaceWs) {
+            this.marketplaceWs.close();
+        }
+        // Close management API server
+        if (this.managementServer) {
+            await new Promise((resolve) => {
+                this.managementServer.close(() => {
+                    console.log(`[${this.nodeId}] Management API server closed`);
+                    resolve();
+                });
+            });
+        }
+        console.log(`[${this.nodeId}] Shutdown complete`);
+    }
+}
+exports.Type3GatewayServer = Type3GatewayServer;
+/**
+ * Start Type 3 Gateway Server
+ */
+if (require.main === module) {
+    const gateway = new Type3GatewayServer({
+        port: parseInt(process.env.GATEWAY_PORT || '8083'),
+        marketplaceUrl: process.env.MARKETPLACE_URL,
+        instanceId: process.env.INSTANCE_ID,
+        apiKey: process.env.GATEWAY_API_KEY,
+        vaultPath: process.env.VAULT_PATH,
+        vaultPassword: process.env.VAULT_PASSWORD,
+        configPath: process.env.GATEWAY_CONFIG_PATH // Optional: specify custom config path
+    });
+    gateway.start().catch(console.error);
+    process.on('SIGTERM', () => {
+        console.log('Received SIGTERM signal');
+        gateway.gracefulShutdown().then(() => process.exit(0));
+    });
+    process.on('SIGINT', () => {
+        console.log('Received SIGINT signal');
+        gateway.gracefulShutdown().then(() => process.exit(0));
+    });
+}
+//# sourceMappingURL=gateway-server.js.map