Issue #9: implement worker frame protocol

docs/WorkerProcessLauncher.md

@@ -1,62 +0,0 @@
-# Worker Process Launcher
-
-The gateway uses `WorkerProcessLauncher` to validate and start one worker
-process for a gateway session. The launcher owns process start semantics only;
-pipe handshaking and `WorkerReady` validation remain part of the worker client
-startup path.
-
-## Launch Inputs
-
-`WorkerProcessLaunchRequest` carries the per-session bootstrap values:
-
-- `SessionId`,
-- `PipeName`,
-- `ProtocolVersion`,
-- `Nonce`,
-- optional `PipeReservation` cleanup handle.
-
-The launcher passes `SessionId`, `PipeName`, and `ProtocolVersion` as command
-line arguments:
-
-```text
---session-id <sessionId> --pipe-name <pipeName> --protocol-version <version>
-```
-
-The launcher sets the nonce through the `MXGATEWAY_WORKER_NONCE` environment
-variable. The nonce is not included in `WorkerProcessCommandLine` so logs and
-diagnostics can report the launch command without exposing the secret.
-
-## Validation And Cleanup
-
-Before starting the process, the launcher validates that the configured worker
-path exists, has a `.exe` extension, contains a valid Windows Portable
-Executable header, and matches the configured `RequiredArchitecture`.
-
-After the process starts, `IWorkerStartupProbe` waits for startup readiness.
-The default probe only verifies that the worker did not exit immediately. The
-worker client replaces this probe when pipe connection, hello, and
-`WorkerReady` handling are implemented.
-
-If startup fails or exceeds `WorkerOptions.StartupTimeoutSeconds`, the launcher
-kills the worker process tree, disposes the process handle, disposes the
-optional pipe reservation, records a worker kill metric, and reports a
-`WorkerProcessLaunchException`.
-
-## Verification
-
-Run the focused launcher tests after changing process launch behavior:
-
-```bash
-dotnet test src/MxGateway.Tests/MxGateway.Tests.csproj --filter WorkerProcessLauncherTests
-```
-
-Run the gateway build because the launcher is part of `MxGateway.Server`:
-
-```bash
-dotnet build src/MxGateway.Server/MxGateway.Server.csproj
-```
-
-## Related Documentation
-
-- [Gateway Process Detailed Design](./gateway-process-design.md)
-- [Worker Frame Protocol](./WorkerFrameProtocol.md)

docs/gateway-dashboard-design.md

@@ -105,12 +105,6 @@ Do not let Razor components directly mutate gateway session or worker objects.
 Create a small read-only dashboard service that projects gateway state into
 plain DTOs.
 
-`GatewayMetrics.GetSnapshot()` is the metrics input for the first dashboard
-projection. It carries current session and worker gauges, command and event
-counters, queue depth, and fault totals. The dashboard reads that snapshot
-instead of reading raw `Meter` instruments because exporter configuration is an
-operations concern, not a UI dependency.
-
 Suggested service:
 
 ```csharp
@@ -367,3 +361,4 @@ The first dashboard slice should implement:
 8. workers page with worker table.
 9. 1-second realtime refresh through Blazor Server.
 10. redaction tests for secrets.
+

docs/gateway-process-design.md

@@ -360,15 +360,6 @@ Before launch, validate:
 - worker file version or product version is acceptable,
 - worker is expected to be x86.
 
-`WorkerProcessLauncher` implements the first validation layer now: it resolves
-the worker executable path, requires a `.exe`, validates the Windows Portable
-Executable header, and verifies the configured processor architecture. It passes
-only `--session-id`, `--pipe-name`, and `--protocol-version` on the command
-line. The per-session nonce is set through `MXGATEWAY_WORKER_NONCE` so the
-command line remains safe to log. Startup failures and startup timeouts kill and
-dispose the worker process and the pre-created pipe reservation before the
-session manager observes the failure.
-
 ## Worker IPC
 
 The gateway creates the pipe server before launching the worker.
@@ -598,20 +589,6 @@ The gateway should split the key into a stable key id and secret component,
 load the key record by id, hash the presented secret, and compare using a
 constant-time comparison.
 
-`ApiKeyParser` accepts only `authorization: Bearer mxgw_<key-id>_<secret>`.
-Malformed headers fail before any database lookup. The parsed raw secret is
-kept only long enough for `ApiKeySecretHasher` to compute an HMAC-SHA256 hash
-using the configured `Authentication:PepperSecretName` lookup in application
-configuration. The raw secret is not stored in the auth database, identity
-model, logs, or verification result.
-
-`ApiKeyVerifier` loads the stored key record by key id, rejects revoked keys,
-hashes the presented secret, and compares the stored and presented hashes with
-`CryptographicOperations.FixedTimeEquals`. A successful verification returns an
-`ApiKeyIdentity` with key id, key prefix, display name, and scopes. Failure
-results distinguish malformed credentials, missing keys, revoked keys, missing
-pepper configuration, and hash mismatch for internal authorization handling.
-
 Recommended scopes:
 
 - `session:open`
@@ -631,44 +608,10 @@ gRPC admin API. It should initialize the auth database, create keys, list keys
 without secrets, revoke keys, rotate keys, and print raw secrets only once at
 creation.
 
-`MxGateway.Server` exposes local API-key administration as an `apikey`
-subcommand before the web host starts:
-
-```bash
-MxGateway.Server apikey init-db --sqlite-path C:\ProgramData\MxGateway\gateway-auth.db
-MxGateway.Server apikey create-key --key-id operator01 --display-name Operator --scopes session:open,events:read
-MxGateway.Server apikey list-keys --json
-MxGateway.Server apikey revoke-key --key-id operator01
-MxGateway.Server apikey rotate-key --key-id operator01 --json
-```
-
-The subcommands accept `--sqlite-path`, `--pepper`, and `--json`. `--pepper`
-sets the local `MxGateway:ApiKeyPepper` configuration value for the command
-process; deployments should normally provide the pepper through the configured
-secret source. `create-key` and `rotate-key` print the full raw API key exactly
-once. `list-keys` never prints raw secrets or `secret_hash` values.
-
 SQLite auth storage should use startup migrations with a `schema_version` table.
 Migrations should run inside transactions and fail startup if the database
 schema is newer than the running binary understands.
 
-The v1 auth store uses `Microsoft.Data.Sqlite` and creates the
-`schema_version`, `api_keys`, and `api_key_audit` tables through
-`SqliteAuthStoreMigrator`. `AuthStoreMigrationHostedService` runs those
-migrations at gateway startup when API-key authentication and
-`Authentication:RunMigrationsOnStartup` are enabled. A database with a newer
-schema version fails startup instead of being modified by an older gateway
-binary.
-
-`IApiKeyStore` reads stored key records and exposes an active-key lookup that
-excludes rows with `revoked_utc` set. Hash verification belongs to the API-key
-hashing layer, but the store preserves the `secret_hash` bytes, display name,
-scopes, timestamps, and revocation state needed by that layer.
-
-`IApiKeyAuditStore` appends audit events to `api_key_audit` and returns recent
-events for diagnostics and future administrative tools. Audit records store key
-ids and event metadata only; they do not store raw API key secrets.
-
 Commands requiring authorization:
 
 - writes,
@@ -721,26 +664,6 @@ Metrics:
 
 Do not log credential values or full tag values by default.
 
-The gateway registers `GatewayMetrics` as the in-process metrics foundation.
-It emits .NET `Meter` instruments for collectors and keeps a
-`GatewayMetricsSnapshot` for dashboard projection. The snapshot exists because
-the dashboard needs current counters and queue depths without depending on a
-specific metrics exporter.
-
-HTTP request handling uses `UseGatewayRequestLoggingScope()` to attach common
-structured log fields when request metadata is present:
-
-- `SessionId`,
-- `ClientIdentity`,
-- `WorkerProcessId`,
-- `CorrelationId`,
-- `CommandMethod`.
-
-`GatewayLogRedactor` redacts API key secrets and command values before they are
-added to log state. Value logging remains opt-in and redacted by default so
-secured writes, authentication commands, and ordinary tag values do not leak
-through diagnostics.
-
 ## Configuration
 
 Suggested configuration shape:
@@ -787,18 +710,6 @@ Suggested configuration shape:
 
 Do not scatter connection or path constants through implementation code.
 
-`MxGateway.Server` binds this section to `GatewayOptions` at startup and
-registers validation with `ValidateOnStart()`. Startup fails before the gateway
-begins serving traffic when required authentication settings are missing,
-timeouts or queue sizes are not positive, dashboard settings are malformed, or
-the configured worker protocol version does not match the contract version.
-
-The gateway exposes read-only effective settings through
-`IGatewayConfigurationProvider`. This projection is for dashboard settings and
-diagnostics, so it redacts secret-related fields such as
-`Authentication:PepperSecretName` and does not include raw API keys or key
-material.
-
 ## Galaxy Repository Metadata
 
 Galaxy hierarchy and tag metadata can be discovered through SQL Server when

docs/mxaccess-worker-instance-design.md

@@ -26,33 +26,6 @@ Style guides:
 - [C# Style Guide](./style-guides/CSharpStyleGuide.md)
 - [Protobuf Style Guide](./style-guides/ProtobufStyleGuide.md)
 
-## Build And Test
-
-Build the SDK-style worker project with the .NET SDK MSBuild entry point. The
-project targets .NET Framework 4.8, but the SDK resolver comes from the .NET SDK
-installation:
-
-```powershell
-dotnet msbuild src\MxGateway.Worker\MxGateway.Worker.csproj /restore /p:Configuration=Debug /p:Platform=x86
-```
-
-`docs/toolchain-links.md` records the Visual Studio MSBuild executable for
-classic .NET Framework and COM interop builds:
-
-```powershell
-& "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\MSBuild\Current\Bin\MSBuild.exe" src\MxGateway.Worker\MxGateway.Worker.csproj /p:Configuration=Debug /p:Platform=x86
-```
-
-Run the worker tests with the same platform target:
-
-```powershell
-dotnet test src\MxGateway.Worker.Tests\MxGateway.Worker.Tests.csproj -p:Platform=x86
-```
-
-The only MXAccess interop reference belongs in `MxGateway.Worker`. Gateway and
-test projects may reference the worker project for metadata and scaffold tests,
-but they must not reference `ArchestrA.MXAccess.dll` directly.
-
 ## Responsibilities
 
 The worker owns:
@@ -114,21 +87,6 @@ Startup sequence:
 If validation fails before MXAccess creation, exit quickly with a non-zero exit
 code. If MXAccess creation fails, send `WorkerFault` when possible and exit.
 
-The bootstrap layer returns structured exit codes before it creates pipes,
-starts the STA, or touches MXAccess:
-
-| Exit code | Name | Meaning |
-|-----------|------|---------|
-| `0` | `Success` | Required bootstrap options are valid. |
-| `1` | `UnexpectedFailure` | A non-bootstrap exception reaches the process boundary. |
-| `2` | `InvalidArguments` | Required arguments are missing or unknown arguments are present. |
-| `3` | `InvalidProtocolVersion` | `--protocol-version` is not numeric or does not match the supported worker protocol. |
-| `4` | `MissingNonce` | `MXGATEWAY_WORKER_NONCE` is absent or empty. |
-
-Bootstrap logs use `WorkerConsoleLogger` key/value output. `WorkerLogRedactor`
-redacts fields whose names indicate nonce, secret, password, token,
-credential, or API key values before the message is written.
-
 ## Internal Components
 
 ```text

gateway.md

@@ -47,8 +47,6 @@ Detailed follow-up docs:
   security, observability, and test strategy.
 - `docs/WorkerFrameProtocol.md` covers the gateway-side named-pipe frame
   reader/writer and `WorkerEnvelope` validation rules.
-- `docs/WorkerProcessLauncher.md` covers worker executable validation, process
-  launch arguments, nonce handling, and startup cleanup behavior.
 - `docs/mxaccess-worker-instance-design.md` covers each .NET Framework 4.8 x86
   MXAccess worker instance, including STA ownership, message pumping, COM
   lifetime, command dispatch, event sinks, conversion, and shutdown.
@@ -101,13 +99,6 @@ Responsibilities:
 
 The gateway must never instantiate or call MXAccess directly.
 
-The gateway observability foundation lives in `MxGateway.Server.Diagnostics`
-and `MxGateway.Server.Metrics`. Structured logging scopes carry session,
-worker, correlation, command, and client identity fields with redaction applied
-before values enter log state. `GatewayMetrics` exposes counters, gauges, and
-histograms through .NET `Meter` and a snapshot API that dashboard services can
-project without binding to a metrics exporter.
-
 ### Worker Process
 
 Runtime:

src/MxGateway.Contracts/MxGateway.Contracts.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFrameworks>net10.0;net48</TargetFrameworks>
+    <TargetFramework>net10.0</TargetFramework>
   </PropertyGroup>
 
   <ItemGroup>
@@ -17,7 +17,6 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="System.Runtime.CompilerServices.Unsafe" Version="6.1.2" />
   </ItemGroup>
 
 </Project>

src/MxGateway.Server/Configuration/AuthenticationMode.cs

@@ -1,7 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public enum AuthenticationMode
-{
-    ApiKey,
-    Disabled
-}

src/MxGateway.Server/Configuration/AuthenticationOptions.cs

@@ -1,12 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed class AuthenticationOptions
-{
-    public AuthenticationMode Mode { get; init; } = AuthenticationMode.ApiKey;
-
-    public string SqlitePath { get; init; } = @"C:\ProgramData\MxGateway\gateway-auth.db";
-
-    public string PepperSecretName { get; init; } = "MxGateway:ApiKeyPepper";
-
-    public bool RunMigrationsOnStartup { get; init; } = true;
-}

src/MxGateway.Server/Configuration/DashboardOptions.cs

@@ -1,20 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed class DashboardOptions
-{
-    public bool Enabled { get; init; } = true;
-
-    public string PathBase { get; init; } = "/dashboard";
-
-    public bool RequireAdminScope { get; init; } = true;
-
-    public bool AllowAnonymousLocalhost { get; init; }
-
-    public int SnapshotIntervalMilliseconds { get; init; } = 1_000;
-
-    public int RecentFaultLimit { get; init; } = 100;
-
-    public int RecentSessionLimit { get; init; } = 200;
-
-    public bool ShowTagValues { get; init; }
-}

src/MxGateway.Server/Configuration/EffectiveAuthenticationConfiguration.cs

@@ -1,7 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed record EffectiveAuthenticationConfiguration(
-    string Mode,
-    string SqlitePath,
-    string PepperSecretName,
-    bool RunMigrationsOnStartup);

src/MxGateway.Server/Configuration/EffectiveDashboardConfiguration.cs

@@ -1,11 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed record EffectiveDashboardConfiguration(
-    bool Enabled,
-    string PathBase,
-    bool RequireAdminScope,
-    bool AllowAnonymousLocalhost,
-    int SnapshotIntervalMilliseconds,
-    int RecentFaultLimit,
-    int RecentSessionLimit,
-    bool ShowTagValues);

src/MxGateway.Server/Configuration/EffectiveEventConfiguration.cs

@@ -1,5 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed record EffectiveEventConfiguration(
-    int QueueCapacity,
-    string BackpressurePolicy);

src/MxGateway.Server/Configuration/EffectiveGatewayConfiguration.cs

@@ -1,9 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed record EffectiveGatewayConfiguration(
-    EffectiveAuthenticationConfiguration Authentication,
-    EffectiveWorkerConfiguration Worker,
-    EffectiveSessionConfiguration Sessions,
-    EffectiveEventConfiguration Events,
-    EffectiveDashboardConfiguration Dashboard,
-    EffectiveProtocolConfiguration Protocol);

src/MxGateway.Server/Configuration/EffectiveProtocolConfiguration.cs

@@ -1,3 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed record EffectiveProtocolConfiguration(uint WorkerProtocolVersion);

src/MxGateway.Server/Configuration/EffectiveSessionConfiguration.cs

@@ -1,6 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed record EffectiveSessionConfiguration(
-    int DefaultCommandTimeoutSeconds,
-    int MaxSessions,
-    bool AllowMultipleEventSubscribers);

src/MxGateway.Server/Configuration/EffectiveWorkerConfiguration.cs

@@ -1,11 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed record EffectiveWorkerConfiguration(
-    string ExecutablePath,
-    string? WorkingDirectory,
-    string RequiredArchitecture,
-    int StartupTimeoutSeconds,
-    int ShutdownTimeoutSeconds,
-    int HeartbeatIntervalSeconds,
-    int HeartbeatGraceSeconds,
-    int MaxMessageBytes);

src/MxGateway.Server/Configuration/EventBackpressurePolicy.cs

@@ -1,6 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public enum EventBackpressurePolicy
-{
-    FailFast
-}

src/MxGateway.Server/Configuration/EventOptions.cs

@@ -1,8 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed class EventOptions
-{
-    public int QueueCapacity { get; init; } = 10_000;
-
-    public EventBackpressurePolicy BackpressurePolicy { get; init; } = EventBackpressurePolicy.FailFast;
-}

src/MxGateway.Server/Configuration/GatewayConfigurationProvider.cs

@@ -1,46 +0,0 @@
-using Microsoft.Extensions.Options;
-
-namespace MxGateway.Server.Configuration;
-
-public sealed class GatewayConfigurationProvider(IOptions<GatewayOptions> options) : IGatewayConfigurationProvider
-{
-    public const string RedactedValue = "[redacted]";
-
-    public EffectiveGatewayConfiguration GetEffectiveConfiguration()
-    {
-        GatewayOptions value = options.Value;
-
-        return new EffectiveGatewayConfiguration(
-            Authentication: new EffectiveAuthenticationConfiguration(
-                Mode: value.Authentication.Mode.ToString(),
-                SqlitePath: value.Authentication.SqlitePath,
-                PepperSecretName: RedactedValue,
-                RunMigrationsOnStartup: value.Authentication.RunMigrationsOnStartup),
-            Worker: new EffectiveWorkerConfiguration(
-                ExecutablePath: value.Worker.ExecutablePath,
-                WorkingDirectory: value.Worker.WorkingDirectory,
-                RequiredArchitecture: value.Worker.RequiredArchitecture.ToString(),
-                StartupTimeoutSeconds: value.Worker.StartupTimeoutSeconds,
-                ShutdownTimeoutSeconds: value.Worker.ShutdownTimeoutSeconds,
-                HeartbeatIntervalSeconds: value.Worker.HeartbeatIntervalSeconds,
-                HeartbeatGraceSeconds: value.Worker.HeartbeatGraceSeconds,
-                MaxMessageBytes: value.Worker.MaxMessageBytes),
-            Sessions: new EffectiveSessionConfiguration(
-                DefaultCommandTimeoutSeconds: value.Sessions.DefaultCommandTimeoutSeconds,
-                MaxSessions: value.Sessions.MaxSessions,
-                AllowMultipleEventSubscribers: value.Sessions.AllowMultipleEventSubscribers),
-            Events: new EffectiveEventConfiguration(
-                QueueCapacity: value.Events.QueueCapacity,
-                BackpressurePolicy: value.Events.BackpressurePolicy.ToString()),
-            Dashboard: new EffectiveDashboardConfiguration(
-                Enabled: value.Dashboard.Enabled,
-                PathBase: value.Dashboard.PathBase,
-                RequireAdminScope: value.Dashboard.RequireAdminScope,
-                AllowAnonymousLocalhost: value.Dashboard.AllowAnonymousLocalhost,
-                SnapshotIntervalMilliseconds: value.Dashboard.SnapshotIntervalMilliseconds,
-                RecentFaultLimit: value.Dashboard.RecentFaultLimit,
-                RecentSessionLimit: value.Dashboard.RecentSessionLimit,
-                ShowTagValues: value.Dashboard.ShowTagValues),
-            Protocol: new EffectiveProtocolConfiguration(value.Protocol.WorkerProtocolVersion));
-    }
-}

src/MxGateway.Server/Configuration/GatewayConfigurationServiceCollectionExtensions.cs

@@ -1,19 +0,0 @@
-using Microsoft.Extensions.Options;
-
-namespace MxGateway.Server.Configuration;
-
-public static class GatewayConfigurationServiceCollectionExtensions
-{
-    public static IServiceCollection AddGatewayConfiguration(this IServiceCollection services)
-    {
-        services
-            .AddOptions<GatewayOptions>()
-            .BindConfiguration(GatewayOptions.SectionName)
-            .ValidateOnStart();
-
-        services.AddSingleton<IValidateOptions<GatewayOptions>, GatewayOptionsValidator>();
-        services.AddSingleton<IGatewayConfigurationProvider, GatewayConfigurationProvider>();
-
-        return services;
-    }
-}

src/MxGateway.Server/Configuration/GatewayOptions.cs

@@ -1,18 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed class GatewayOptions
-{
-    public const string SectionName = "MxGateway";
-
-    public AuthenticationOptions Authentication { get; init; } = new();
-
-    public WorkerOptions Worker { get; init; } = new();
-
-    public SessionOptions Sessions { get; init; } = new();
-
-    public EventOptions Events { get; init; } = new();
-
-    public DashboardOptions Dashboard { get; init; } = new();
-
-    public ProtocolOptions Protocol { get; init; } = new();
-}

src/MxGateway.Server/Configuration/GatewayOptionsValidator.cs

@@ -1,210 +0,0 @@
-using Microsoft.Extensions.Options;
-using MxGateway.Contracts;
-
-namespace MxGateway.Server.Configuration;
-
-public sealed class GatewayOptionsValidator : IValidateOptions<GatewayOptions>
-{
-    private const int MinimumMaxMessageBytes = 1024;
-    private const int MaximumMaxMessageBytes = 256 * 1024 * 1024;
-
-    public ValidateOptionsResult Validate(string? name, GatewayOptions options)
-    {
-        List<string> failures = [];
-
-        ValidateAuthentication(options.Authentication, failures);
-        ValidateWorker(options.Worker, failures);
-        ValidateSessions(options.Sessions, failures);
-        ValidateEvents(options.Events, failures);
-        ValidateDashboard(options.Dashboard, failures);
-        ValidateProtocol(options.Protocol, failures);
-
-        return failures.Count == 0
-            ? ValidateOptionsResult.Success
-            : ValidateOptionsResult.Fail(failures);
-    }
-
-    private static void ValidateAuthentication(AuthenticationOptions options, List<string> failures)
-    {
-        if (!Enum.IsDefined(options.Mode))
-        {
-            failures.Add("MxGateway:Authentication:Mode must be a supported authentication mode.");
-            return;
-        }
-
-        if (options.Mode == AuthenticationMode.ApiKey)
-        {
-            AddIfBlank(
-                options.SqlitePath,
-                "MxGateway:Authentication:SqlitePath is required when API-key authentication is enabled.",
-                failures);
-            AddIfInvalidPath(
-                options.SqlitePath,
-                "MxGateway:Authentication:SqlitePath must be a valid filesystem path.",
-                failures);
-            AddIfBlank(
-                options.PepperSecretName,
-                "MxGateway:Authentication:PepperSecretName is required when API-key authentication is enabled.",
-                failures);
-        }
-    }
-
-    private static void ValidateWorker(WorkerOptions options, List<string> failures)
-    {
-        AddIfBlank(options.ExecutablePath, "MxGateway:Worker:ExecutablePath is required.", failures);
-        AddIfInvalidPath(
-            options.ExecutablePath,
-            "MxGateway:Worker:ExecutablePath must be a valid filesystem path.",
-            failures);
-
-        if (!string.IsNullOrWhiteSpace(options.ExecutablePath)
-            && !string.Equals(Path.GetExtension(options.ExecutablePath), ".exe", StringComparison.OrdinalIgnoreCase))
-        {
-            failures.Add("MxGateway:Worker:ExecutablePath must point to a .exe file.");
-        }
-
-        if (!string.IsNullOrWhiteSpace(options.WorkingDirectory))
-        {
-            AddIfInvalidPath(
-                options.WorkingDirectory,
-                "MxGateway:Worker:WorkingDirectory must be a valid filesystem path.",
-                failures);
-        }
-
-        if (!Enum.IsDefined(options.RequiredArchitecture))
-        {
-            failures.Add("MxGateway:Worker:RequiredArchitecture must be a supported worker architecture.");
-        }
-
-        AddIfNotPositive(
-            options.StartupTimeoutSeconds,
-            "MxGateway:Worker:StartupTimeoutSeconds must be greater than zero.",
-            failures);
-        AddIfNotPositive(
-            options.ShutdownTimeoutSeconds,
-            "MxGateway:Worker:ShutdownTimeoutSeconds must be greater than zero.",
-            failures);
-        AddIfNotPositive(
-            options.HeartbeatIntervalSeconds,
-            "MxGateway:Worker:HeartbeatIntervalSeconds must be greater than zero.",
-            failures);
-        AddIfNotPositive(
-            options.HeartbeatGraceSeconds,
-            "MxGateway:Worker:HeartbeatGraceSeconds must be greater than zero.",
-            failures);
-
-        if (options.HeartbeatGraceSeconds < options.HeartbeatIntervalSeconds)
-        {
-            failures.Add(
-                "MxGateway:Worker:HeartbeatGraceSeconds must be greater than or equal to HeartbeatIntervalSeconds.");
-        }
-
-        if (options.MaxMessageBytes is < MinimumMaxMessageBytes or > MaximumMaxMessageBytes)
-        {
-            failures.Add(
-                $"MxGateway:Worker:MaxMessageBytes must be between {MinimumMaxMessageBytes} and {MaximumMaxMessageBytes}.");
-        }
-    }
-
-    private static void ValidateSessions(SessionOptions options, List<string> failures)
-    {
-        AddIfNotPositive(
-            options.DefaultCommandTimeoutSeconds,
-            "MxGateway:Sessions:DefaultCommandTimeoutSeconds must be greater than zero.",
-            failures);
-        AddIfNotPositive(options.MaxSessions, "MxGateway:Sessions:MaxSessions must be greater than zero.", failures);
-    }
-
-    private static void ValidateEvents(EventOptions options, List<string> failures)
-    {
-        AddIfNotPositive(options.QueueCapacity, "MxGateway:Events:QueueCapacity must be greater than zero.", failures);
-
-        if (!Enum.IsDefined(options.BackpressurePolicy))
-        {
-            failures.Add("MxGateway:Events:BackpressurePolicy must be a supported backpressure policy.");
-        }
-    }
-
-    private static void ValidateDashboard(DashboardOptions options, List<string> failures)
-    {
-        if (options.Enabled)
-        {
-            AddIfBlank(options.PathBase, "MxGateway:Dashboard:PathBase is required when the dashboard is enabled.", failures);
-            if (!string.IsNullOrWhiteSpace(options.PathBase) && !options.PathBase.StartsWith('/'))
-            {
-                failures.Add("MxGateway:Dashboard:PathBase must start with '/'.");
-            }
-        }
-
-        AddIfNotPositive(
-            options.SnapshotIntervalMilliseconds,
-            "MxGateway:Dashboard:SnapshotIntervalMilliseconds must be greater than zero.",
-            failures);
-        AddIfNegative(
-            options.RecentFaultLimit,
-            "MxGateway:Dashboard:RecentFaultLimit must be greater than or equal to zero.",
-            failures);
-        AddIfNegative(
-            options.RecentSessionLimit,
-            "MxGateway:Dashboard:RecentSessionLimit must be greater than or equal to zero.",
-            failures);
-    }
-
-    private static void ValidateProtocol(ProtocolOptions options, List<string> failures)
-    {
-        if (options.WorkerProtocolVersion != GatewayContractInfo.WorkerProtocolVersion)
-        {
-            failures.Add(
-                $"MxGateway:Protocol:WorkerProtocolVersion must be {GatewayContractInfo.WorkerProtocolVersion}.");
-        }
-    }
-
-    private static void AddIfBlank(string? value, string message, List<string> failures)
-    {
-        if (string.IsNullOrWhiteSpace(value))
-        {
-            failures.Add(message);
-        }
-    }
-
-    private static void AddIfNotPositive(int value, string message, List<string> failures)
-    {
-        if (value <= 0)
-        {
-            failures.Add(message);
-        }
-    }
-
-    private static void AddIfNegative(int value, string message, List<string> failures)
-    {
-        if (value < 0)
-        {
-            failures.Add(message);
-        }
-    }
-
-    private static void AddIfInvalidPath(string? value, string message, List<string> failures)
-    {
-        if (string.IsNullOrWhiteSpace(value))
-        {
-            return;
-        }
-
-        try
-        {
-            _ = Path.GetFullPath(value);
-        }
-        catch (ArgumentException)
-        {
-            failures.Add(message);
-        }
-        catch (NotSupportedException)
-        {
-            failures.Add(message);
-        }
-        catch (PathTooLongException)
-        {
-            failures.Add(message);
-        }
-    }
-}

src/MxGateway.Server/Configuration/IGatewayConfigurationProvider.cs

@@ -1,6 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public interface IGatewayConfigurationProvider
-{
-    EffectiveGatewayConfiguration GetEffectiveConfiguration();
-}

src/MxGateway.Server/Configuration/ProtocolOptions.cs

@@ -1,8 +0,0 @@
-using MxGateway.Contracts;
-
-namespace MxGateway.Server.Configuration;
-
-public sealed class ProtocolOptions
-{
-    public uint WorkerProtocolVersion { get; init; } = GatewayContractInfo.WorkerProtocolVersion;
-}

src/MxGateway.Server/Configuration/SessionOptions.cs

@@ -1,10 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed class SessionOptions
-{
-    public int DefaultCommandTimeoutSeconds { get; init; } = 30;
-
-    public int MaxSessions { get; init; } = 64;
-
-    public bool AllowMultipleEventSubscribers { get; init; }
-}

src/MxGateway.Server/Configuration/WorkerArchitecture.cs

@@ -1,7 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public enum WorkerArchitecture
-{
-    X86,
-    X64
-}

src/MxGateway.Server/Configuration/WorkerOptions.cs

@@ -1,21 +0,0 @@
-namespace MxGateway.Server.Configuration;
-
-public sealed class WorkerOptions
-{
-    public string ExecutablePath { get; init; } =
-        @"src\MxGateway.Worker\bin\x86\Release\MxGateway.Worker.exe";
-
-    public string? WorkingDirectory { get; init; }
-
-    public WorkerArchitecture RequiredArchitecture { get; init; } = WorkerArchitecture.X86;
-
-    public int StartupTimeoutSeconds { get; init; } = 30;
-
-    public int ShutdownTimeoutSeconds { get; init; } = 10;
-
-    public int HeartbeatIntervalSeconds { get; init; } = 5;
-
-    public int HeartbeatGraceSeconds { get; init; } = 15;
-
-    public int MaxMessageBytes { get; init; } = 16 * 1024 * 1024;
-}

src/MxGateway.Server/Diagnostics/GatewayLogRedactor.cs

@@ -1,78 +0,0 @@
-namespace MxGateway.Server.Diagnostics;
-
-public static class GatewayLogRedactor
-{
-    public const string RedactedValue = "[redacted]";
-
-    private static readonly HashSet<string> SensitiveCommandMethods = new(StringComparer.OrdinalIgnoreCase)
-    {
-        "AuthenticateUser",
-        "WriteSecured",
-        "WriteSecured2"
-    };
-
-    public static bool IsCredentialBearingCommand(string? commandMethod)
-    {
-        return commandMethod is not null
-            && SensitiveCommandMethods.Contains(commandMethod);
-    }
-
-    public static string? RedactApiKey(string? authorizationHeader)
-    {
-        if (string.IsNullOrWhiteSpace(authorizationHeader))
-        {
-            return authorizationHeader;
-        }
-
-        const string bearerPrefix = "Bearer ";
-        if (!authorizationHeader.StartsWith(bearerPrefix, StringComparison.OrdinalIgnoreCase))
-        {
-            return RedactedValue;
-        }
-
-        string token = authorizationHeader[bearerPrefix.Length..].Trim();
-
-        if (!token.StartsWith("mxgw_", StringComparison.OrdinalIgnoreCase))
-        {
-            return $"{bearerPrefix}{RedactedValue}";
-        }
-
-        string[] tokenParts = token.Split('_', 3, StringSplitOptions.RemoveEmptyEntries);
-        if (tokenParts.Length < 2)
-        {
-            return $"{bearerPrefix}mxgw_{RedactedValue}";
-        }
-
-        return $"{bearerPrefix}mxgw_{tokenParts[1]}_{RedactedValue}";
-    }
-
-    public static string? RedactClientIdentity(string? clientIdentity)
-    {
-        if (string.IsNullOrWhiteSpace(clientIdentity))
-        {
-            return clientIdentity;
-        }
-
-        return clientIdentity.Contains("mxgw_", StringComparison.OrdinalIgnoreCase)
-            ? RedactApiKey(clientIdentity)
-            : clientIdentity;
-    }
-
-    public static object? RedactCommandValue(
-        string? commandMethod,
-        object? value,
-        bool valueLoggingEnabled = false)
-    {
-        if (value is null)
-        {
-            return null;
-        }
-
-        if (!valueLoggingEnabled || IsCredentialBearingCommand(commandMethod))
-        {
-            return RedactedValue;
-        }
-
-        return value;
-    }
-}

src/MxGateway.Server/Diagnostics/GatewayLogScope.cs

@@ -1,33 +0,0 @@
-namespace MxGateway.Server.Diagnostics;
-
-public sealed record GatewayLogScope(
-    string? SessionId = null,
-    int? WorkerProcessId = null,
-    ulong? CorrelationId = null,
-    string? CommandMethod = null,
-    string? ClientIdentity = null)
-{
-    public IReadOnlyDictionary<string, object?> ToDictionary()
-    {
-        Dictionary<string, object?> values = [];
-
-        AddIfPresent(values, "SessionId", SessionId);
-        AddIfPresent(values, "WorkerProcessId", WorkerProcessId);
-        AddIfPresent(values, "CorrelationId", CorrelationId);
-        AddIfPresent(values, "CommandMethod", CommandMethod);
-        AddIfPresent(values, "ClientIdentity", GatewayLogRedactor.RedactClientIdentity(ClientIdentity));
-
-        return values;
-    }
-
-    private static void AddIfPresent(
-        Dictionary<string, object?> values,
-        string key,
-        object? value)
-    {
-        if (value is not null)
-        {
-            values[key] = value;
-        }
-    }
-}

src/MxGateway.Server/Diagnostics/GatewayLoggerExtensions.cs

@@ -1,16 +0,0 @@
-using Microsoft.Extensions.Logging;
-
-namespace MxGateway.Server.Diagnostics;
-
-public static class GatewayLoggerExtensions
-{
-    public static IDisposable? BeginGatewayScope(
-        this ILogger logger,
-        GatewayLogScope scope)
-    {
-        ArgumentNullException.ThrowIfNull(logger);
-        ArgumentNullException.ThrowIfNull(scope);
-
-        return logger.BeginScope(scope.ToDictionary());
-    }
-}

src/MxGateway.Server/Diagnostics/GatewayRequestLoggingMiddlewareExtensions.cs

@@ -1,57 +0,0 @@
-using Microsoft.Extensions.Primitives;
-
-namespace MxGateway.Server.Diagnostics;
-
-public static class GatewayRequestLoggingMiddlewareExtensions
-{
-    public const string SessionIdHeaderName = "x-session-id";
-    public const string WorkerProcessIdHeaderName = "x-worker-process-id";
-    public const string CorrelationIdHeaderName = "x-correlation-id";
-    public const string CommandMethodHeaderName = "x-command-method";
-
-    public static IApplicationBuilder UseGatewayRequestLoggingScope(this IApplicationBuilder app)
-    {
-        ArgumentNullException.ThrowIfNull(app);
-
-        return app.Use(async (context, next) =>
-        {
-            ILogger logger = context.RequestServices
-                .GetRequiredService<ILoggerFactory>()
-                .CreateLogger("MxGateway.Request");
-
-            using IDisposable? scope = logger.BeginGatewayScope(new GatewayLogScope(
-                SessionId: ReadHeader(context, SessionIdHeaderName),
-                WorkerProcessId: ReadInt32Header(context, WorkerProcessIdHeaderName),
-                CorrelationId: ReadUInt64Header(context, CorrelationIdHeaderName),
-                CommandMethod: ReadHeader(context, CommandMethodHeaderName),
-                ClientIdentity: ReadHeader(context, "authorization")));
-
-            await next(context);
-        });
-    }
-
-    private static string? ReadHeader(HttpContext context, string headerName)
-    {
-        return context.Request.Headers.TryGetValue(headerName, out StringValues values)
-            ? values.ToString()
-            : null;
-    }
-
-    private static int? ReadInt32Header(HttpContext context, string headerName)
-    {
-        string? value = ReadHeader(context, headerName);
-
-        return int.TryParse(value, out int parsedValue)
-            ? parsedValue
-            : null;
-    }
-
-    private static ulong? ReadUInt64Header(HttpContext context, string headerName)
-    {
-        string? value = ReadHeader(context, headerName);
-
-        return ulong.TryParse(value, out ulong parsedValue)
-            ? parsedValue
-            : null;
-    }
-}

src/MxGateway.Server/GatewayApplication.cs

@@ -1,9 +1,4 @@
 using MxGateway.Contracts;
-using MxGateway.Server.Configuration;
-using MxGateway.Server.Diagnostics;
-using MxGateway.Server.Metrics;
-using MxGateway.Server.Security.Authentication;
-using MxGateway.Server.Workers;
 
 namespace MxGateway.Server;
 
@@ -14,7 +9,6 @@ public static class GatewayApplication
         WebApplicationBuilder builder = CreateBuilder(args);
         WebApplication app = builder.Build();
 
-        app.UseGatewayRequestLoggingScope();
         app.MapGatewayEndpoints();
 
         return app;
@@ -24,11 +18,7 @@ public static class GatewayApplication
     {
         WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
 
-        builder.Services.AddGatewayConfiguration();
-        builder.Services.AddSqliteAuthStore();
         builder.Services.AddHealthChecks();
-        builder.Services.AddSingleton<GatewayMetrics>();
-        builder.Services.AddWorkerProcessLauncher();
 
         return builder;
     }

src/MxGateway.Server/Metrics/GatewayMetrics.cs

@@ -1,306 +0,0 @@
-using System.Diagnostics.Metrics;
-
-namespace MxGateway.Server.Metrics;
-
-public sealed class GatewayMetrics : IDisposable
-{
-    public const string MeterName = "MxGateway.Server";
-
-    private readonly object _syncRoot = new();
-    private readonly Meter _meter;
-    private readonly Counter<long> _sessionsOpenedCounter;
-    private readonly Counter<long> _sessionsClosedCounter;
-    private readonly Counter<long> _commandsStartedCounter;
-    private readonly Counter<long> _commandsSucceededCounter;
-    private readonly Counter<long> _commandsFailedCounter;
-    private readonly Counter<long> _eventsReceivedCounter;
-    private readonly Counter<long> _queueOverflowsCounter;
-    private readonly Counter<long> _faultsCounter;
-    private readonly Counter<long> _workerKillsCounter;
-    private readonly Counter<long> _workerExitsCounter;
-    private readonly Counter<long> _heartbeatFailuresCounter;
-    private readonly Counter<long> _streamDisconnectsCounter;
-    private readonly Histogram<double> _workerStartupLatencyHistogram;
-    private readonly Histogram<double> _commandLatencyHistogram;
-    private readonly Histogram<double> _eventStreamSendLatencyHistogram;
-    private readonly Dictionary<string, long> _commandFailuresByMethod = new(StringComparer.OrdinalIgnoreCase);
-    private readonly Dictionary<string, long> _eventsByFamily = new(StringComparer.OrdinalIgnoreCase);
-
-    private int _openSessions;
-    private int _workersRunning;
-    private int _eventQueueDepth;
-    private long _sessionsOpened;
-    private long _sessionsClosed;
-    private long _commandsStarted;
-    private long _commandsSucceeded;
-    private long _commandsFailed;
-    private long _eventsReceived;
-    private long _queueOverflows;
-    private long _faults;
-    private long _workerKills;
-    private long _workerExits;
-    private long _heartbeatFailures;
-    private long _streamDisconnects;
-    private bool _disposed;
-
-    public GatewayMetrics()
-    {
-        _meter = new Meter(MeterName, typeof(GatewayMetrics).Assembly.GetName().Version?.ToString());
-        _sessionsOpenedCounter = _meter.CreateCounter<long>("mxgateway.sessions.opened");
-        _sessionsClosedCounter = _meter.CreateCounter<long>("mxgateway.sessions.closed");
-        _commandsStartedCounter = _meter.CreateCounter<long>("mxgateway.commands.started");
-        _commandsSucceededCounter = _meter.CreateCounter<long>("mxgateway.commands.succeeded");
-        _commandsFailedCounter = _meter.CreateCounter<long>("mxgateway.commands.failed");
-        _eventsReceivedCounter = _meter.CreateCounter<long>("mxgateway.events.received");
-        _queueOverflowsCounter = _meter.CreateCounter<long>("mxgateway.queues.overflows");
-        _faultsCounter = _meter.CreateCounter<long>("mxgateway.faults");
-        _workerKillsCounter = _meter.CreateCounter<long>("mxgateway.workers.killed");
-        _workerExitsCounter = _meter.CreateCounter<long>("mxgateway.workers.exited");
-        _heartbeatFailuresCounter = _meter.CreateCounter<long>("mxgateway.heartbeats.failed");
-        _streamDisconnectsCounter = _meter.CreateCounter<long>("mxgateway.grpc.streams.disconnected");
-        _workerStartupLatencyHistogram = _meter.CreateHistogram<double>("mxgateway.workers.startup.duration", "ms");
-        _commandLatencyHistogram = _meter.CreateHistogram<double>("mxgateway.commands.duration", "ms");
-        _eventStreamSendLatencyHistogram = _meter.CreateHistogram<double>("mxgateway.events.stream_send.duration", "ms");
-
-        _meter.CreateObservableGauge("mxgateway.sessions.open", GetOpenSessions);
-        _meter.CreateObservableGauge("mxgateway.workers.running", GetWorkersRunning);
-        _meter.CreateObservableGauge("mxgateway.events.queue.depth", GetEventQueueDepth);
-    }
-
-    public void SessionOpened()
-    {
-        lock (_syncRoot)
-        {
-            _openSessions++;
-            _sessionsOpened++;
-        }
-
-        _sessionsOpenedCounter.Add(1);
-    }
-
-    public void SessionClosed()
-    {
-        lock (_syncRoot)
-        {
-            if (_openSessions > 0)
-            {
-                _openSessions--;
-            }
-
-            _sessionsClosed++;
-        }
-
-        _sessionsClosedCounter.Add(1);
-    }
-
-    public void WorkerStarted(TimeSpan startupDuration)
-    {
-        lock (_syncRoot)
-        {
-            _workersRunning++;
-        }
-
-        _workerStartupLatencyHistogram.Record(startupDuration.TotalMilliseconds);
-    }
-
-    public void WorkerStopped(string reason)
-    {
-        lock (_syncRoot)
-        {
-            if (_workersRunning > 0)
-            {
-                _workersRunning--;
-            }
-
-            _workerExits++;
-        }
-
-        _workerExitsCounter.Add(1, new KeyValuePair<string, object?>("reason", reason));
-    }
-
-    public void WorkerKilled(string reason)
-    {
-        lock (_syncRoot)
-        {
-            _workerKills++;
-        }
-
-        _workerKillsCounter.Add(1, new KeyValuePair<string, object?>("reason", reason));
-    }
-
-    public void CommandStarted(string method)
-    {
-        lock (_syncRoot)
-        {
-            _commandsStarted++;
-        }
-
-        _commandsStartedCounter.Add(1, new KeyValuePair<string, object?>("method", method));
-    }
-
-    public void CommandSucceeded(string method, TimeSpan duration)
-    {
-        lock (_syncRoot)
-        {
-            _commandsSucceeded++;
-        }
-
-        KeyValuePair<string, object?> methodTag = new("method", method);
-        _commandsSucceededCounter.Add(1, methodTag);
-        _commandLatencyHistogram.Record(duration.TotalMilliseconds, methodTag);
-    }
-
-    public void CommandFailed(string method, string category, TimeSpan duration)
-    {
-        lock (_syncRoot)
-        {
-            _commandsFailed++;
-            Increment(_commandFailuresByMethod, method);
-        }
-
-        KeyValuePair<string, object?> methodTag = new("method", method);
-        KeyValuePair<string, object?> categoryTag = new("category", category);
-        _commandsFailedCounter.Add(1, methodTag, categoryTag);
-        _commandLatencyHistogram.Record(duration.TotalMilliseconds, methodTag, categoryTag);
-    }
-
-    public void EventReceived(string sessionId, string family)
-    {
-        lock (_syncRoot)
-        {
-            _eventsReceived++;
-            Increment(_eventsByFamily, family);
-        }
-
-        _eventsReceivedCounter.Add(
-            1,
-            new KeyValuePair<string, object?>("session_id", sessionId),
-            new KeyValuePair<string, object?>("family", family));
-    }
-
-    public void RecordEventStreamSend(string family, TimeSpan duration)
-    {
-        _eventStreamSendLatencyHistogram.Record(
-            duration.TotalMilliseconds,
-            new KeyValuePair<string, object?>("family", family));
-    }
-
-    public void SetEventQueueDepth(int depth)
-    {
-        if (depth < 0)
-        {
-            throw new ArgumentOutOfRangeException(nameof(depth), depth, "Queue depth cannot be negative.");
-        }
-
-        lock (_syncRoot)
-        {
-            _eventQueueDepth = depth;
-        }
-    }
-
-    public void QueueOverflow(string queueName)
-    {
-        lock (_syncRoot)
-        {
-            _queueOverflows++;
-        }
-
-        _queueOverflowsCounter.Add(1, new KeyValuePair<string, object?>("queue", queueName));
-    }
-
-    public void Fault(string category)
-    {
-        lock (_syncRoot)
-        {
-            _faults++;
-        }
-
-        _faultsCounter.Add(1, new KeyValuePair<string, object?>("category", category));
-    }
-
-    public void HeartbeatFailed(string sessionId)
-    {
-        lock (_syncRoot)
-        {
-            _heartbeatFailures++;
-        }
-
-        _heartbeatFailuresCounter.Add(1, new KeyValuePair<string, object?>("session_id", sessionId));
-    }
-
-    public void StreamDisconnected(string reason)
-    {
-        lock (_syncRoot)
-        {
-            _streamDisconnects++;
-        }
-
-        _streamDisconnectsCounter.Add(1, new KeyValuePair<string, object?>("reason", reason));
-    }
-
-    public GatewayMetricsSnapshot GetSnapshot()
-    {
-        lock (_syncRoot)
-        {
-            return new GatewayMetricsSnapshot(
-                OpenSessions: _openSessions,
-                WorkersRunning: _workersRunning,
-                EventQueueDepth: _eventQueueDepth,
-                SessionsOpened: _sessionsOpened,
-                SessionsClosed: _sessionsClosed,
-                CommandsStarted: _commandsStarted,
-                CommandsSucceeded: _commandsSucceeded,
-                CommandsFailed: _commandsFailed,
-                EventsReceived: _eventsReceived,
-                QueueOverflows: _queueOverflows,
-                Faults: _faults,
-                WorkerKills: _workerKills,
-                WorkerExits: _workerExits,
-                HeartbeatFailures: _heartbeatFailures,
-                StreamDisconnects: _streamDisconnects,
-                CommandFailuresByMethod: new Dictionary<string, long>(_commandFailuresByMethod, StringComparer.OrdinalIgnoreCase),
-                EventsByFamily: new Dictionary<string, long>(_eventsByFamily, StringComparer.OrdinalIgnoreCase));
-        }
-    }
-
-    public void Dispose()
-    {
-        if (_disposed)
-        {
-            return;
-        }
-
-        _meter.Dispose();
-        _disposed = true;
-    }
-
-    private int GetOpenSessions()
-    {
-        lock (_syncRoot)
-        {
-            return _openSessions;
-        }
-    }
-
-    private int GetWorkersRunning()
-    {
-        lock (_syncRoot)
-        {
-            return _workersRunning;
-        }
-    }
-
-    private int GetEventQueueDepth()
-    {
-        lock (_syncRoot)
-        {
-            return _eventQueueDepth;
-        }
-    }
-
-    private static void Increment(Dictionary<string, long> values, string key)
-    {
-        values.TryGetValue(key, out long currentValue);
-        values[key] = currentValue + 1;
-    }
-}

src/MxGateway.Server/Metrics/GatewayMetricsSnapshot.cs

@@ -1,20 +0,0 @@
-namespace MxGateway.Server.Metrics;
-
-public sealed record GatewayMetricsSnapshot(
-    int OpenSessions,
-    int WorkersRunning,
-    int EventQueueDepth,
-    long SessionsOpened,
-    long SessionsClosed,
-    long CommandsStarted,
-    long CommandsSucceeded,
-    long CommandsFailed,
-    long EventsReceived,
-    long QueueOverflows,
-    long Faults,
-    long WorkerKills,
-    long WorkerExits,
-    long HeartbeatFailures,
-    long StreamDisconnects,
-    IReadOnlyDictionary<string, long> CommandFailuresByMethod,
-    IReadOnlyDictionary<string, long> EventsByFamily);

src/MxGateway.Server/MxGateway.Server.csproj

@@ -4,10 +4,6 @@
     <TargetFramework>net10.0</TargetFramework>
   </PropertyGroup>
 
-  <ItemGroup>
-    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.7" />
-  </ItemGroup>
-
   <ItemGroup>
     <ProjectReference Include="..\MxGateway.Contracts\MxGateway.Contracts.csproj" />
   </ItemGroup>

src/MxGateway.Server/Program.cs

@@ -1,43 +1,7 @@
 using MxGateway.Server;
-using MxGateway.Server.Configuration;
-using MxGateway.Server.Security.Authentication;
 
-ApiKeyAdminParseResult apiKeyAdminCommand = ApiKeyAdminCommandLineParser.Parse(args);
+var app = GatewayApplication.Build(args);
-if (apiKeyAdminCommand.IsApiKeyCommand)
-{
-    if (apiKeyAdminCommand.Command is null)
-    {
-        await Console.Error.WriteLineAsync(apiKeyAdminCommand.Error);
-        return 2;
-    }
-
-    WebApplicationBuilder builder = GatewayApplication.CreateBuilder([]);
-    ApplyApiKeyAdminOverrides(builder.Configuration, apiKeyAdminCommand.Command);
-    await using WebApplication cliApp = builder.Build();
-    await using AsyncServiceScope scope = cliApp.Services.CreateAsyncScope();
-
-    ApiKeyAdminCliRunner runner = scope.ServiceProvider.GetRequiredService<ApiKeyAdminCliRunner>();
-
-    return await runner.RunAsync(apiKeyAdminCommand.Command, Console.Out, CancellationToken.None);
-}
-
-WebApplication app = GatewayApplication.Build(args);
 
 app.Run();
 
-return 0;
-
-static void ApplyApiKeyAdminOverrides(IConfiguration configuration, ApiKeyAdminCommand command)
-{
-    if (!string.IsNullOrWhiteSpace(command.SqlitePath))
-    {
-        configuration[$"{GatewayOptions.SectionName}:Authentication:SqlitePath"] = command.SqlitePath;
-    }
-
-    if (!string.IsNullOrWhiteSpace(command.Pepper))
-    {
-        configuration["MxGateway:ApiKeyPepper"] = command.Pepper;
-    }
-}
-
 public partial class Program;

src/MxGateway.Server/Security/Authentication/ApiKeyAdminCliRunner.cs

@@ -1,180 +0,0 @@
-using System.Text.Json;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class ApiKeyAdminCliRunner(
-    IAuthStoreMigrator migrator,
-    IApiKeyAdminStore adminStore,
-    IApiKeyAuditStore auditStore,
-    IApiKeySecretHasher hasher)
-{
-    private static readonly JsonSerializerOptions JsonOptions = new()
-    {
-        WriteIndented = true
-    };
-
-    public async Task<int> RunAsync(
-        ApiKeyAdminCommand command,
-        TextWriter output,
-        CancellationToken cancellationToken)
-    {
-        ApiKeyAdminOutput result = command.Kind switch
-        {
-            ApiKeyAdminCommandKind.InitDb => await InitDbAsync(cancellationToken).ConfigureAwait(false),
-            ApiKeyAdminCommandKind.CreateKey => await CreateKeyAsync(command, cancellationToken).ConfigureAwait(false),
-            ApiKeyAdminCommandKind.ListKeys => await ListKeysAsync(cancellationToken).ConfigureAwait(false),
-            ApiKeyAdminCommandKind.RevokeKey => await RevokeKeyAsync(command, cancellationToken).ConfigureAwait(false),
-            ApiKeyAdminCommandKind.RotateKey => await RotateKeyAsync(command, cancellationToken).ConfigureAwait(false),
-            _ => throw new InvalidOperationException($"Unsupported API key command '{command.Kind}'.")
-        };
-
-        await WriteOutputAsync(command, result, output).ConfigureAwait(false);
-
-        return 0;
-    }
-
-    private async Task<ApiKeyAdminOutput> InitDbAsync(CancellationToken cancellationToken)
-    {
-        await migrator.MigrateAsync(cancellationToken).ConfigureAwait(false);
-        await AppendAuditAsync(null, "init-db", null, cancellationToken).ConfigureAwait(false);
-
-        return new ApiKeyAdminOutput("init-db", "initialized", null, []);
-    }
-
-    private async Task<ApiKeyAdminOutput> CreateKeyAsync(
-        ApiKeyAdminCommand command,
-        CancellationToken cancellationToken)
-    {
-        await migrator.MigrateAsync(cancellationToken).ConfigureAwait(false);
-
-        string keyId = Required(command.KeyId);
-        string secret = ApiKeySecretGenerator.Generate();
-        string apiKey = FormatApiKey(keyId, secret);
-
-        await adminStore.CreateAsync(
-                new ApiKeyCreateRequest(
-                    KeyId: keyId,
-                    KeyPrefix: $"mxgw_{keyId}",
-                    SecretHash: hasher.HashSecret(secret),
-                    DisplayName: Required(command.DisplayName),
-                    Scopes: command.Scopes,
-                    CreatedUtc: DateTimeOffset.UtcNow),
-                cancellationToken)
-            .ConfigureAwait(false);
-        await AppendAuditAsync(keyId, "create-key", null, cancellationToken).ConfigureAwait(false);
-
-        return new ApiKeyAdminOutput("create-key", "created", apiKey, []);
-    }
-
-    private async Task<ApiKeyAdminOutput> ListKeysAsync(CancellationToken cancellationToken)
-    {
-        await migrator.MigrateAsync(cancellationToken).ConfigureAwait(false);
-        IReadOnlyList<ApiKeyRecord> keys = await adminStore.ListAsync(cancellationToken).ConfigureAwait(false);
-        await AppendAuditAsync(null, "list-keys", null, cancellationToken).ConfigureAwait(false);
-
-        return new ApiKeyAdminOutput(
-            "list-keys",
-            "ok",
-            null,
-            keys.Select(ToListedKey).ToArray());
-    }
-
-    private async Task<ApiKeyAdminOutput> RevokeKeyAsync(
-        ApiKeyAdminCommand command,
-        CancellationToken cancellationToken)
-    {
-        await migrator.MigrateAsync(cancellationToken).ConfigureAwait(false);
-
-        string keyId = Required(command.KeyId);
-        bool revoked = await adminStore.RevokeAsync(keyId, DateTimeOffset.UtcNow, cancellationToken)
-            .ConfigureAwait(false);
-
-        await AppendAuditAsync(keyId, "revoke-key", revoked ? "revoked" : "not-found-or-already-revoked", cancellationToken)
-            .ConfigureAwait(false);
-
-        return new ApiKeyAdminOutput("revoke-key", revoked ? "revoked" : "not-found-or-already-revoked", null, []);
-    }
-
-    private async Task<ApiKeyAdminOutput> RotateKeyAsync(
-        ApiKeyAdminCommand command,
-        CancellationToken cancellationToken)
-    {
-        await migrator.MigrateAsync(cancellationToken).ConfigureAwait(false);
-
-        string keyId = Required(command.KeyId);
-        string secret = ApiKeySecretGenerator.Generate();
-        string apiKey = FormatApiKey(keyId, secret);
-
-        bool rotated = await adminStore.RotateAsync(keyId, hasher.HashSecret(secret), DateTimeOffset.UtcNow, cancellationToken)
-            .ConfigureAwait(false);
-
-        await AppendAuditAsync(keyId, "rotate-key", rotated ? "rotated" : "not-found", cancellationToken)
-            .ConfigureAwait(false);
-
-        return new ApiKeyAdminOutput("rotate-key", rotated ? "rotated" : "not-found", rotated ? apiKey : null, []);
-    }
-
-    private static async Task WriteOutputAsync(
-        ApiKeyAdminCommand command,
-        ApiKeyAdminOutput result,
-        TextWriter output)
-    {
-        if (command.Json)
-        {
-            await output.WriteLineAsync(JsonSerializer.Serialize(result, JsonOptions)).ConfigureAwait(false);
-            return;
-        }
-
-        await output.WriteLineAsync($"{result.Command}: {result.Status}").ConfigureAwait(false);
-
-        if (result.ApiKey is not null)
-        {
-            await output.WriteLineAsync($"API key: {result.ApiKey}").ConfigureAwait(false);
-        }
-
-        foreach (ApiKeyAdminListedKey key in result.Keys)
-        {
-            string revoked = key.RevokedUtc is null ? "active" : "revoked";
-            await output.WriteLineAsync($"{key.KeyId}\t{key.DisplayName}\t{revoked}\t{string.Join(',', key.Scopes)}")
-                .ConfigureAwait(false);
-        }
-    }
-
-    private async Task AppendAuditAsync(
-        string? keyId,
-        string eventType,
-        string? details,
-        CancellationToken cancellationToken)
-    {
-        await auditStore.AppendAsync(
-                new ApiKeyAuditEntry(
-                    KeyId: keyId,
-                    EventType: eventType,
-                    RemoteAddress: null,
-                    Details: details),
-                cancellationToken)
-            .ConfigureAwait(false);
-    }
-
-    private static ApiKeyAdminListedKey ToListedKey(ApiKeyRecord key)
-    {
-        return new ApiKeyAdminListedKey(
-            KeyId: key.KeyId,
-            KeyPrefix: key.KeyPrefix,
-            DisplayName: key.DisplayName,
-            Scopes: key.Scopes,
-            CreatedUtc: key.CreatedUtc,
-            LastUsedUtc: key.LastUsedUtc,
-            RevokedUtc: key.RevokedUtc);
-    }
-
-    private static string FormatApiKey(string keyId, string secret)
-    {
-        return $"mxgw_{keyId}_{secret}";
-    }
-
-    private static string Required(string? value)
-    {
-        return value ?? throw new InvalidOperationException("Required command value was not provided.");
-    }
-}

src/MxGateway.Server/Security/Authentication/ApiKeyAdminCommand.cs

@@ -1,10 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ApiKeyAdminCommand(
-    ApiKeyAdminCommandKind Kind,
-    bool Json,
-    string? SqlitePath,
-    string? Pepper,
-    string? KeyId,
-    string? DisplayName,
-    IReadOnlySet<string> Scopes);

src/MxGateway.Server/Security/Authentication/ApiKeyAdminCommandKind.cs

@@ -1,10 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public enum ApiKeyAdminCommandKind
-{
-    InitDb,
-    CreateKey,
-    ListKeys,
-    RevokeKey,
-    RotateKey
-}

src/MxGateway.Server/Security/Authentication/ApiKeyAdminCommandLineParser.cs

@@ -1,159 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public static class ApiKeyAdminCommandLineParser
-{
-    public static ApiKeyAdminParseResult Parse(IReadOnlyList<string> args)
-    {
-        if (args.Count == 0 || !string.Equals(args[0], "apikey", StringComparison.OrdinalIgnoreCase))
-        {
-            return ApiKeyAdminParseResult.NotApiKeyCommand();
-        }
-
-        if (args.Count < 2)
-        {
-            return ApiKeyAdminParseResult.Fail("Missing apikey subcommand.");
-        }
-
-        if (!TryParseKind(args[1], out ApiKeyAdminCommandKind kind))
-        {
-            return ApiKeyAdminParseResult.Fail($"Unknown apikey subcommand '{args[1]}'.");
-        }
-
-        Dictionary<string, string?> options = new(StringComparer.OrdinalIgnoreCase);
-        bool json = false;
-
-        for (int index = 2; index < args.Count; index++)
-        {
-            string arg = args[index];
-            if (string.Equals(arg, "--json", StringComparison.OrdinalIgnoreCase))
-            {
-                json = true;
-                continue;
-            }
-
-            if (!arg.StartsWith("--", StringComparison.Ordinal))
-            {
-                return ApiKeyAdminParseResult.Fail($"Unexpected argument '{arg}'.");
-            }
-
-            string name = arg[2..];
-            string? value;
-
-            int equalsIndex = name.IndexOf('=', StringComparison.Ordinal);
-            if (equalsIndex >= 0)
-            {
-                value = name[(equalsIndex + 1)..];
-                name = name[..equalsIndex];
-            }
-            else
-            {
-                if (index + 1 >= args.Count || args[index + 1].StartsWith("--", StringComparison.Ordinal))
-                {
-                    return ApiKeyAdminParseResult.Fail($"Option '--{name}' requires a value.");
-                }
-
-                value = args[++index];
-            }
-
-            options[name] = value;
-        }
-
-        string? keyId = GetOption(options, "key-id");
-        string? displayName = GetOption(options, "display-name");
-        IReadOnlySet<string> scopes = ParseScopes(GetOption(options, "scopes"));
-
-        string? validationError = Validate(kind, keyId, displayName);
-        if (validationError is not null)
-        {
-            return ApiKeyAdminParseResult.Fail(validationError);
-        }
-
-        return ApiKeyAdminParseResult.Success(new ApiKeyAdminCommand(
-            Kind: kind,
-            Json: json,
-            SqlitePath: GetOption(options, "sqlite-path"),
-            Pepper: GetOption(options, "pepper"),
-            KeyId: keyId,
-            DisplayName: displayName,
-            Scopes: scopes));
-    }
-
-    private static bool TryParseKind(string value, out ApiKeyAdminCommandKind kind)
-    {
-        switch (value.ToLowerInvariant())
-        {
-            case "init-db":
-                kind = ApiKeyAdminCommandKind.InitDb;
-                return true;
-            case "create-key":
-                kind = ApiKeyAdminCommandKind.CreateKey;
-                return true;
-            case "list-keys":
-                kind = ApiKeyAdminCommandKind.ListKeys;
-                return true;
-            case "revoke-key":
-                kind = ApiKeyAdminCommandKind.RevokeKey;
-                return true;
-            case "rotate-key":
-                kind = ApiKeyAdminCommandKind.RotateKey;
-                return true;
-            default:
-                kind = default;
-                return false;
-        }
-    }
-
-    private static string? Validate(ApiKeyAdminCommandKind kind, string? keyId, string? displayName)
-    {
-        if (kind is ApiKeyAdminCommandKind.CreateKey or ApiKeyAdminCommandKind.RevokeKey or ApiKeyAdminCommandKind.RotateKey
-            && string.IsNullOrWhiteSpace(keyId))
-        {
-            return $"Subcommand '{KindName(kind)}' requires --key-id.";
-        }
-
-        if (!string.IsNullOrWhiteSpace(keyId) && !IsValidKeyId(keyId))
-        {
-            return "API key id may contain only letters, numbers, periods, and hyphens.";
-        }
-
-        if (kind == ApiKeyAdminCommandKind.CreateKey && string.IsNullOrWhiteSpace(displayName))
-        {
-            return "Subcommand 'create-key' requires --display-name.";
-        }
-
-        return null;
-    }
-
-    private static string KindName(ApiKeyAdminCommandKind kind)
-    {
-        return kind switch
-        {
-            ApiKeyAdminCommandKind.InitDb => "init-db",
-            ApiKeyAdminCommandKind.CreateKey => "create-key",
-            ApiKeyAdminCommandKind.ListKeys => "list-keys",
-            ApiKeyAdminCommandKind.RevokeKey => "revoke-key",
-            ApiKeyAdminCommandKind.RotateKey => "rotate-key",
-            _ => kind.ToString()
-        };
-    }
-
-    private static bool IsValidKeyId(string keyId)
-    {
-        return keyId.All(character =>
-            char.IsAsciiLetterOrDigit(character)
-            || character is '.' or '-');
-    }
-
-    private static string? GetOption(Dictionary<string, string?> options, string name)
-    {
-        return options.TryGetValue(name, out string? value) ? value : null;
-    }
-
-    private static IReadOnlySet<string> ParseScopes(string? scopes)
-    {
-        return new HashSet<string>(
-            (scopes ?? string.Empty)
-                .Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries),
-            StringComparer.Ordinal);
-    }
-}

src/MxGateway.Server/Security/Authentication/ApiKeyAdminListedKey.cs

@@ -1,10 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ApiKeyAdminListedKey(
-    string KeyId,
-    string KeyPrefix,
-    string DisplayName,
-    IReadOnlySet<string> Scopes,
-    DateTimeOffset CreatedUtc,
-    DateTimeOffset? LastUsedUtc,
-    DateTimeOffset? RevokedUtc);

src/MxGateway.Server/Security/Authentication/ApiKeyAdminOutput.cs

@@ -1,7 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ApiKeyAdminOutput(
-    string Command,
-    string Status,
-    string? ApiKey,
-    IReadOnlyList<ApiKeyAdminListedKey> Keys);

src/MxGateway.Server/Security/Authentication/ApiKeyAdminParseResult.cs

@@ -1,22 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ApiKeyAdminParseResult(
-    bool IsApiKeyCommand,
-    ApiKeyAdminCommand? Command,
-    string? Error)
-{
-    public static ApiKeyAdminParseResult NotApiKeyCommand()
-    {
-        return new ApiKeyAdminParseResult(false, null, null);
-    }
-
-    public static ApiKeyAdminParseResult Success(ApiKeyAdminCommand command)
-    {
-        return new ApiKeyAdminParseResult(true, command, null);
-    }
-
-    public static ApiKeyAdminParseResult Fail(string error)
-    {
-        return new ApiKeyAdminParseResult(true, null, error);
-    }
-}

src/MxGateway.Server/Security/Authentication/ApiKeyAuditEntry.cs

@@ -1,7 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ApiKeyAuditEntry(
-    string? KeyId,
-    string EventType,
-    string? RemoteAddress,
-    string? Details);

src/MxGateway.Server/Security/Authentication/ApiKeyAuditRecord.cs

@@ -1,9 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ApiKeyAuditRecord(
-    long AuditId,
-    string? KeyId,
-    string EventType,
-    string? RemoteAddress,
-    DateTimeOffset CreatedUtc,
-    string? Details);

src/MxGateway.Server/Security/Authentication/ApiKeyCreateRequest.cs

@@ -1,9 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ApiKeyCreateRequest(
-    string KeyId,
-    string KeyPrefix,
-    byte[] SecretHash,
-    string DisplayName,
-    IReadOnlySet<string> Scopes,
-    DateTimeOffset CreatedUtc);

src/MxGateway.Server/Security/Authentication/ApiKeyIdentity.cs

@@ -1,7 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ApiKeyIdentity(
-    string KeyId,
-    string KeyPrefix,
-    string DisplayName,
-    IReadOnlySet<string> Scopes);

src/MxGateway.Server/Security/Authentication/ApiKeyParser.cs

@@ -1,45 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class ApiKeyParser : IApiKeyParser
-{
-    private const string BearerPrefix = "Bearer ";
-    private const string TokenPrefix = "mxgw_";
-
-    public bool TryParseAuthorizationHeader(string? authorizationHeader, out ParsedApiKey? apiKey)
-    {
-        apiKey = null;
-
-        if (string.IsNullOrWhiteSpace(authorizationHeader)
-            || !authorizationHeader.StartsWith(BearerPrefix, StringComparison.OrdinalIgnoreCase))
-        {
-            return false;
-        }
-
-        string token = authorizationHeader[BearerPrefix.Length..].Trim();
-
-        if (!token.StartsWith(TokenPrefix, StringComparison.OrdinalIgnoreCase))
-        {
-            return false;
-        }
-
-        string keyPayload = token[TokenPrefix.Length..];
-        int separatorIndex = keyPayload.IndexOf('_', StringComparison.Ordinal);
-
-        if (separatorIndex <= 0 || separatorIndex == keyPayload.Length - 1)
-        {
-            return false;
-        }
-
-        string keyId = keyPayload[..separatorIndex];
-        string secret = keyPayload[(separatorIndex + 1)..];
-
-        if (string.IsNullOrWhiteSpace(keyId) || string.IsNullOrWhiteSpace(secret))
-        {
-            return false;
-        }
-
-        apiKey = new ParsedApiKey(keyId, secret);
-
-        return true;
-    }
-}

src/MxGateway.Server/Security/Authentication/ApiKeyPepperUnavailableException.cs

@@ -1,4 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class ApiKeyPepperUnavailableException(string pepperSecretName)
-    : InvalidOperationException($"API key pepper secret '{pepperSecretName}' is not configured.");

src/MxGateway.Server/Security/Authentication/ApiKeyRecord.cs

@@ -1,11 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ApiKeyRecord(
-    string KeyId,
-    string KeyPrefix,
-    byte[] SecretHash,
-    string DisplayName,
-    IReadOnlySet<string> Scopes,
-    DateTimeOffset CreatedUtc,
-    DateTimeOffset? LastUsedUtc,
-    DateTimeOffset? RevokedUtc);

src/MxGateway.Server/Security/Authentication/ApiKeyRecordReader.cs

@@ -1,26 +0,0 @@
-using Microsoft.Data.Sqlite;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public static class ApiKeyRecordReader
-{
-    public static ApiKeyRecord Read(SqliteDataReader reader)
-    {
-        return new ApiKeyRecord(
-            KeyId: reader.GetString(0),
-            KeyPrefix: reader.GetString(1),
-            SecretHash: (byte[])reader["secret_hash"],
-            DisplayName: reader.GetString(3),
-            Scopes: ApiKeyScopeSerializer.Deserialize(reader.GetString(4)),
-            CreatedUtc: DateTimeOffset.Parse(reader.GetString(5), System.Globalization.CultureInfo.InvariantCulture),
-            LastUsedUtc: ReadNullableDateTimeOffset(reader, 6),
-            RevokedUtc: ReadNullableDateTimeOffset(reader, 7));
-    }
-
-    private static DateTimeOffset? ReadNullableDateTimeOffset(SqliteDataReader reader, int ordinal)
-    {
-        return reader.IsDBNull(ordinal)
-            ? null
-            : DateTimeOffset.Parse(reader.GetString(ordinal), System.Globalization.CultureInfo.InvariantCulture);
-    }
-}

src/MxGateway.Server/Security/Authentication/ApiKeyScopeSerializer.cs

@@ -1,23 +0,0 @@
-using System.Text.Json;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public static class ApiKeyScopeSerializer
-{
-    public static string Serialize(IReadOnlySet<string> scopes)
-    {
-        return JsonSerializer.Serialize(scopes.Order(StringComparer.Ordinal));
-    }
-
-    public static IReadOnlySet<string> Deserialize(string value)
-    {
-        if (string.IsNullOrWhiteSpace(value))
-        {
-            return new HashSet<string>(StringComparer.Ordinal);
-        }
-
-        string[]? scopes = JsonSerializer.Deserialize<string[]>(value);
-
-        return new HashSet<string>(scopes ?? [], StringComparer.Ordinal);
-    }
-}

src/MxGateway.Server/Security/Authentication/ApiKeySecretGenerator.cs

@@ -1,17 +0,0 @@
-using System.Security.Cryptography;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public static class ApiKeySecretGenerator
-{
-    public static string Generate()
-    {
-        Span<byte> bytes = stackalloc byte[32];
-        RandomNumberGenerator.Fill(bytes);
-
-        return Convert.ToBase64String(bytes)
-            .TrimEnd('=')
-            .Replace('+', '-')
-            .Replace('/', '_');
-    }
-}

src/MxGateway.Server/Security/Authentication/ApiKeySecretHasher.cs

@@ -1,35 +0,0 @@
-using System.Security.Cryptography;
-using System.Text;
-using Microsoft.Extensions.Options;
-using MxGateway.Server.Configuration;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class ApiKeySecretHasher(
-    IConfiguration configuration,
-    IOptions<GatewayOptions> options) : IApiKeySecretHasher
-{
-    public byte[] HashSecret(string secret)
-    {
-        string pepper = GetPepper();
-        byte[] pepperBytes = Encoding.UTF8.GetBytes(pepper);
-        byte[] secretBytes = Encoding.UTF8.GetBytes(secret);
-
-        using HMACSHA256 hmac = new(pepperBytes);
-
-        return hmac.ComputeHash(secretBytes);
-    }
-
-    private string GetPepper()
-    {
-        string pepperSecretName = options.Value.Authentication.PepperSecretName;
-        string? pepper = configuration[pepperSecretName];
-
-        if (string.IsNullOrWhiteSpace(pepper))
-        {
-            throw new ApiKeyPepperUnavailableException(pepperSecretName);
-        }
-
-        return pepper;
-    }
-}

src/MxGateway.Server/Security/Authentication/ApiKeyVerificationFailure.cs

@@ -1,11 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public enum ApiKeyVerificationFailure
-{
-    None,
-    MissingOrMalformedCredentials,
-    PepperUnavailable,
-    KeyNotFound,
-    KeyRevoked,
-    SecretMismatch
-}

src/MxGateway.Server/Security/Authentication/ApiKeyVerificationResult.cs

@@ -1,23 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ApiKeyVerificationResult(
-    bool Succeeded,
-    ApiKeyIdentity? Identity,
-    ApiKeyVerificationFailure Failure)
-{
-    public static ApiKeyVerificationResult Success(ApiKeyIdentity identity)
-    {
-        return new ApiKeyVerificationResult(
-            Succeeded: true,
-            Identity: identity,
-            Failure: ApiKeyVerificationFailure.None);
-    }
-
-    public static ApiKeyVerificationResult Fail(ApiKeyVerificationFailure failure)
-    {
-        return new ApiKeyVerificationResult(
-            Succeeded: false,
-            Identity: null,
-            Failure: failure);
-    }
-}

src/MxGateway.Server/Security/Authentication/ApiKeyVerifier.cs

@@ -1,57 +0,0 @@
-using System.Security.Cryptography;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class ApiKeyVerifier(
-    IApiKeyParser parser,
-    IApiKeySecretHasher hasher,
-    IApiKeyStore keyStore) : IApiKeyVerifier
-{
-    public async Task<ApiKeyVerificationResult> VerifyAsync(
-        string? authorizationHeader,
-        CancellationToken cancellationToken)
-    {
-        if (!parser.TryParseAuthorizationHeader(authorizationHeader, out ParsedApiKey? parsedKey)
-            || parsedKey is null)
-        {
-            return ApiKeyVerificationResult.Fail(ApiKeyVerificationFailure.MissingOrMalformedCredentials);
-        }
-
-        ApiKeyRecord? storedKey = await keyStore.FindByKeyIdAsync(parsedKey.KeyId, cancellationToken)
-            .ConfigureAwait(false);
-
-        if (storedKey is null)
-        {
-            return ApiKeyVerificationResult.Fail(ApiKeyVerificationFailure.KeyNotFound);
-        }
-
-        if (storedKey.RevokedUtc is not null)
-        {
-            return ApiKeyVerificationResult.Fail(ApiKeyVerificationFailure.KeyRevoked);
-        }
-
-        byte[] presentedHash;
-        try
-        {
-            presentedHash = hasher.HashSecret(parsedKey.Secret);
-        }
-        catch (ApiKeyPepperUnavailableException)
-        {
-            return ApiKeyVerificationResult.Fail(ApiKeyVerificationFailure.PepperUnavailable);
-        }
-
-        if (!CryptographicOperations.FixedTimeEquals(presentedHash, storedKey.SecretHash))
-        {
-            return ApiKeyVerificationResult.Fail(ApiKeyVerificationFailure.SecretMismatch);
-        }
-
-        await keyStore.MarkKeyUsedAsync(storedKey.KeyId, DateTimeOffset.UtcNow, cancellationToken)
-            .ConfigureAwait(false);
-
-        return ApiKeyVerificationResult.Success(new ApiKeyIdentity(
-            KeyId: storedKey.KeyId,
-            KeyPrefix: storedKey.KeyPrefix,
-            DisplayName: storedKey.DisplayName,
-            Scopes: storedKey.Scopes));
-    }
-}

src/MxGateway.Server/Security/Authentication/AuthSqliteConnectionFactory.cs

@@ -1,27 +0,0 @@
-using Microsoft.Data.Sqlite;
-using Microsoft.Extensions.Options;
-using MxGateway.Server.Configuration;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class AuthSqliteConnectionFactory(IOptions<GatewayOptions> options)
-{
-    public SqliteConnection CreateConnection()
-    {
-        string sqlitePath = options.Value.Authentication.SqlitePath;
-        string? directory = Path.GetDirectoryName(sqlitePath);
-
-        if (!string.IsNullOrWhiteSpace(directory))
-        {
-            Directory.CreateDirectory(directory);
-        }
-
-        SqliteConnectionStringBuilder builder = new()
-        {
-            DataSource = sqlitePath,
-            Mode = SqliteOpenMode.ReadWriteCreate
-        };
-
-        return new SqliteConnection(builder.ToString());
-    }
-}

src/MxGateway.Server/Security/Authentication/AuthStoreMigrationException.cs

@@ -1,3 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class AuthStoreMigrationException(string message) : InvalidOperationException(message);

src/MxGateway.Server/Security/Authentication/AuthStoreMigrationHostedService.cs

@@ -1,24 +0,0 @@
-using Microsoft.Extensions.Options;
-using MxGateway.Server.Configuration;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class AuthStoreMigrationHostedService(
-    IOptions<GatewayOptions> options,
-    IAuthStoreMigrator migrator) : IHostedService
-{
-    public async Task StartAsync(CancellationToken cancellationToken)
-    {
-        AuthenticationOptions authentication = options.Value.Authentication;
-
-        if (authentication.Mode == AuthenticationMode.ApiKey && authentication.RunMigrationsOnStartup)
-        {
-            await migrator.MigrateAsync(cancellationToken).ConfigureAwait(false);
-        }
-    }
-
-    public Task StopAsync(CancellationToken cancellationToken)
-    {
-        return Task.CompletedTask;
-    }
-}

src/MxGateway.Server/Security/Authentication/AuthStoreServiceCollectionExtensions.cs

@@ -1,20 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public static class AuthStoreServiceCollectionExtensions
-{
-    public static IServiceCollection AddSqliteAuthStore(this IServiceCollection services)
-    {
-        services.AddSingleton<IApiKeyParser, ApiKeyParser>();
-        services.AddSingleton<IApiKeySecretHasher, ApiKeySecretHasher>();
-        services.AddSingleton<IApiKeyVerifier, ApiKeyVerifier>();
-        services.AddSingleton<ApiKeyAdminCliRunner>();
-        services.AddSingleton<AuthSqliteConnectionFactory>();
-        services.AddSingleton<IAuthStoreMigrator, SqliteAuthStoreMigrator>();
-        services.AddSingleton<IApiKeyStore, SqliteApiKeyStore>();
-        services.AddSingleton<IApiKeyAdminStore, SqliteApiKeyAdminStore>();
-        services.AddSingleton<IApiKeyAuditStore, SqliteApiKeyAuditStore>();
-        services.AddHostedService<AuthStoreMigrationHostedService>();
-
-        return services;
-    }
-}

src/MxGateway.Server/Security/Authentication/IApiKeyAdminStore.cs

@@ -1,16 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public interface IApiKeyAdminStore
-{
-    Task CreateAsync(ApiKeyCreateRequest request, CancellationToken cancellationToken);
-
-    Task<IReadOnlyList<ApiKeyRecord>> ListAsync(CancellationToken cancellationToken);
-
-    Task<bool> RevokeAsync(string keyId, DateTimeOffset revokedUtc, CancellationToken cancellationToken);
-
-    Task<bool> RotateAsync(
-        string keyId,
-        byte[] secretHash,
-        DateTimeOffset rotatedUtc,
-        CancellationToken cancellationToken);
-}

src/MxGateway.Server/Security/Authentication/IApiKeyAuditStore.cs

@@ -1,8 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public interface IApiKeyAuditStore
-{
-    Task AppendAsync(ApiKeyAuditEntry entry, CancellationToken cancellationToken);
-
-    Task<IReadOnlyList<ApiKeyAuditRecord>> ListRecentAsync(int count, CancellationToken cancellationToken);
-}

src/MxGateway.Server/Security/Authentication/IApiKeyParser.cs

@@ -1,6 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public interface IApiKeyParser
-{
-    bool TryParseAuthorizationHeader(string? authorizationHeader, out ParsedApiKey? apiKey);
-}

src/MxGateway.Server/Security/Authentication/IApiKeySecretHasher.cs

@@ -1,6 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public interface IApiKeySecretHasher
-{
-    byte[] HashSecret(string secret);
-}

src/MxGateway.Server/Security/Authentication/IApiKeyStore.cs

@@ -1,10 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public interface IApiKeyStore
-{
-    Task<ApiKeyRecord?> FindByKeyIdAsync(string keyId, CancellationToken cancellationToken);
-
-    Task<ApiKeyRecord?> FindActiveByKeyIdAsync(string keyId, CancellationToken cancellationToken);
-
-    Task MarkKeyUsedAsync(string keyId, DateTimeOffset usedUtc, CancellationToken cancellationToken);
-}

src/MxGateway.Server/Security/Authentication/IApiKeyVerifier.cs

@@ -1,8 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public interface IApiKeyVerifier
-{
-    Task<ApiKeyVerificationResult> VerifyAsync(
-        string? authorizationHeader,
-        CancellationToken cancellationToken);
-}

src/MxGateway.Server/Security/Authentication/IAuthStoreMigrator.cs

@@ -1,6 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public interface IAuthStoreMigrator
-{
-    Task MigrateAsync(CancellationToken cancellationToken);
-}

src/MxGateway.Server/Security/Authentication/ParsedApiKey.cs

@@ -1,3 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed record ParsedApiKey(string KeyId, string Secret);

src/MxGateway.Server/Security/Authentication/SqliteApiKeyAdminStore.cs

@@ -1,116 +0,0 @@
-using Microsoft.Data.Sqlite;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class SqliteApiKeyAdminStore(AuthSqliteConnectionFactory connectionFactory) : IApiKeyAdminStore
-{
-    public async Task CreateAsync(ApiKeyCreateRequest request, CancellationToken cancellationToken)
-    {
-        await using SqliteConnection connection = connectionFactory.CreateConnection();
-        await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = """
-            INSERT INTO api_keys (
-                key_id,
-                key_prefix,
-                secret_hash,
-                display_name,
-                scopes,
-                created_utc,
-                last_used_utc,
-                revoked_utc)
-            VALUES (
-                $key_id,
-                $key_prefix,
-                $secret_hash,
-                $display_name,
-                $scopes,
-                $created_utc,
-                NULL,
-                NULL);
-            """;
-        AddCreateParameters(command, request);
-
-        await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
-    }
-
-    public async Task<IReadOnlyList<ApiKeyRecord>> ListAsync(CancellationToken cancellationToken)
-    {
-        await using SqliteConnection connection = connectionFactory.CreateConnection();
-        await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = """
-            SELECT key_id, key_prefix, secret_hash, display_name, scopes, created_utc, last_used_utc, revoked_utc
-            FROM api_keys
-            ORDER BY key_id;
-            """;
-
-        List<ApiKeyRecord> records = [];
-
-        await using SqliteDataReader reader = await command.ExecuteReaderAsync(cancellationToken)
-            .ConfigureAwait(false);
-
-        while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
-        {
-            records.Add(ApiKeyRecordReader.Read(reader));
-        }
-
-        return records;
-    }
-
-    public async Task<bool> RevokeAsync(string keyId, DateTimeOffset revokedUtc, CancellationToken cancellationToken)
-    {
-        await using SqliteConnection connection = connectionFactory.CreateConnection();
-        await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = """
-            UPDATE api_keys
-            SET revoked_utc = $revoked_utc
-            WHERE key_id = $key_id AND revoked_utc IS NULL;
-            """;
-        command.Parameters.AddWithValue("$key_id", keyId);
-        command.Parameters.AddWithValue("$revoked_utc", revokedUtc.ToString("O"));
-
-        int rows = await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
-
-        return rows > 0;
-    }
-
-    public async Task<bool> RotateAsync(
-        string keyId,
-        byte[] secretHash,
-        DateTimeOffset rotatedUtc,
-        CancellationToken cancellationToken)
-    {
-        await using SqliteConnection connection = connectionFactory.CreateConnection();
-        await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = """
-            UPDATE api_keys
-            SET secret_hash = $secret_hash,
-                last_used_utc = NULL,
-                revoked_utc = NULL
-            WHERE key_id = $key_id;
-            """;
-        command.Parameters.AddWithValue("$key_id", keyId);
-        command.Parameters.Add("$secret_hash", SqliteType.Blob).Value = secretHash;
-
-        int rows = await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
-
-        return rows > 0;
-    }
-
-    private static void AddCreateParameters(SqliteCommand command, ApiKeyCreateRequest request)
-    {
-        command.Parameters.AddWithValue("$key_id", request.KeyId);
-        command.Parameters.AddWithValue("$key_prefix", request.KeyPrefix);
-        command.Parameters.Add("$secret_hash", SqliteType.Blob).Value = request.SecretHash;
-        command.Parameters.AddWithValue("$display_name", request.DisplayName);
-        command.Parameters.AddWithValue("$scopes", ApiKeyScopeSerializer.Serialize(request.Scopes));
-        command.Parameters.AddWithValue("$created_utc", request.CreatedUtc.ToString("O"));
-    }
-}

src/MxGateway.Server/Security/Authentication/SqliteApiKeyAuditStore.cs

@@ -1,65 +0,0 @@
-using Microsoft.Data.Sqlite;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class SqliteApiKeyAuditStore(AuthSqliteConnectionFactory connectionFactory) : IApiKeyAuditStore
-{
-    public async Task AppendAsync(ApiKeyAuditEntry entry, CancellationToken cancellationToken)
-    {
-        await using SqliteConnection connection = connectionFactory.CreateConnection();
-        await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = """
-            INSERT INTO api_key_audit (key_id, event_type, remote_address, created_utc, details)
-            VALUES ($key_id, $event_type, $remote_address, $created_utc, $details);
-            """;
-        command.Parameters.AddWithValue("$key_id", (object?)entry.KeyId ?? DBNull.Value);
-        command.Parameters.AddWithValue("$event_type", entry.EventType);
-        command.Parameters.AddWithValue("$remote_address", (object?)entry.RemoteAddress ?? DBNull.Value);
-        command.Parameters.AddWithValue("$created_utc", DateTimeOffset.UtcNow.ToString("O"));
-        command.Parameters.AddWithValue("$details", (object?)entry.Details ?? DBNull.Value);
-
-        await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
-    }
-
-    public async Task<IReadOnlyList<ApiKeyAuditRecord>> ListRecentAsync(int count, CancellationToken cancellationToken)
-    {
-        if (count <= 0)
-        {
-            return [];
-        }
-
-        await using SqliteConnection connection = connectionFactory.CreateConnection();
-        await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = """
-            SELECT audit_id, key_id, event_type, remote_address, created_utc, details
-            FROM api_key_audit
-            ORDER BY audit_id DESC
-            LIMIT $count;
-            """;
-        command.Parameters.AddWithValue("$count", count);
-
-        List<ApiKeyAuditRecord> records = [];
-
-        await using SqliteDataReader reader = await command.ExecuteReaderAsync(cancellationToken)
-            .ConfigureAwait(false);
-
-        while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
-        {
-            records.Add(new ApiKeyAuditRecord(
-                AuditId: reader.GetInt64(0),
-                KeyId: reader.IsDBNull(1) ? null : reader.GetString(1),
-                EventType: reader.GetString(2),
-                RemoteAddress: reader.IsDBNull(3) ? null : reader.GetString(3),
-                CreatedUtc: DateTimeOffset.Parse(
-                    reader.GetString(4),
-                    System.Globalization.CultureInfo.InvariantCulture),
-                Details: reader.IsDBNull(5) ? null : reader.GetString(5)));
-        }
-
-        return records;
-    }
-}

src/MxGateway.Server/Security/Authentication/SqliteApiKeyStore.cs

@@ -1,66 +0,0 @@
-using Microsoft.Data.Sqlite;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class SqliteApiKeyStore(AuthSqliteConnectionFactory connectionFactory) : IApiKeyStore
-{
-    public Task<ApiKeyRecord?> FindByKeyIdAsync(string keyId, CancellationToken cancellationToken)
-    {
-        return FindByKeyIdAsync(keyId, requireActive: false, cancellationToken);
-    }
-
-    public Task<ApiKeyRecord?> FindActiveByKeyIdAsync(string keyId, CancellationToken cancellationToken)
-    {
-        return FindByKeyIdAsync(keyId, requireActive: true, cancellationToken);
-    }
-
-    public async Task MarkKeyUsedAsync(string keyId, DateTimeOffset usedUtc, CancellationToken cancellationToken)
-    {
-        await using SqliteConnection connection = connectionFactory.CreateConnection();
-        await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = """
-            UPDATE api_keys
-            SET last_used_utc = $last_used_utc
-            WHERE key_id = $key_id AND revoked_utc IS NULL;
-            """;
-        command.Parameters.AddWithValue("$key_id", keyId);
-        command.Parameters.AddWithValue("$last_used_utc", usedUtc.ToString("O"));
-
-        await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
-    }
-
-    private async Task<ApiKeyRecord?> FindByKeyIdAsync(
-        string keyId,
-        bool requireActive,
-        CancellationToken cancellationToken)
-    {
-        await using SqliteConnection connection = connectionFactory.CreateConnection();
-        await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-        await using SqliteCommand command = connection.CreateCommand();
-        command.CommandText = requireActive
-            ? """
-              SELECT key_id, key_prefix, secret_hash, display_name, scopes, created_utc, last_used_utc, revoked_utc
-              FROM api_keys
-              WHERE key_id = $key_id AND revoked_utc IS NULL;
-              """
-            : """
-              SELECT key_id, key_prefix, secret_hash, display_name, scopes, created_utc, last_used_utc, revoked_utc
-              FROM api_keys
-              WHERE key_id = $key_id;
-              """;
-        command.Parameters.AddWithValue("$key_id", keyId);
-
-        await using SqliteDataReader reader = await command.ExecuteReaderAsync(cancellationToken)
-            .ConfigureAwait(false);
-
-        if (!await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
-        {
-            return null;
-        }
-
-        return ApiKeyRecordReader.Read(reader);
-    }
-}

src/MxGateway.Server/Security/Authentication/SqliteAuthSchema.cs

@@ -1,12 +0,0 @@
-namespace MxGateway.Server.Security.Authentication;
-
-public static class SqliteAuthSchema
-{
-    public const int CurrentVersion = 1;
-
-    public const string SchemaVersionTable = "schema_version";
-
-    public const string ApiKeysTable = "api_keys";
-
-    public const string ApiKeyAuditTable = "api_key_audit";
-}

src/MxGateway.Server/Security/Authentication/SqliteAuthStoreMigrator.cs

@@ -1,135 +0,0 @@
-using Microsoft.Data.Sqlite;
-
-namespace MxGateway.Server.Security.Authentication;
-
-public sealed class SqliteAuthStoreMigrator(AuthSqliteConnectionFactory connectionFactory) : IAuthStoreMigrator
-{
-    public async Task MigrateAsync(CancellationToken cancellationToken)
-    {
-        await using SqliteConnection connection = connectionFactory.CreateConnection();
-        await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-        await using SqliteTransaction transaction =
-            (SqliteTransaction)await connection.BeginTransactionAsync(cancellationToken).ConfigureAwait(false);
-
-        int existingVersion = await ReadExistingSchemaVersionAsync(connection, transaction, cancellationToken)
-            .ConfigureAwait(false);
-
-        if (existingVersion > SqliteAuthSchema.CurrentVersion)
-        {
-            throw new AuthStoreMigrationException(
-                $"Auth database schema version {existingVersion} is newer than supported version {SqliteAuthSchema.CurrentVersion}.");
-        }
-
-        await ApplyVersionOneAsync(connection, transaction, cancellationToken).ConfigureAwait(false);
-
-        await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
-    }
-
-    private static async Task<int> ReadExistingSchemaVersionAsync(
-        SqliteConnection connection,
-        SqliteTransaction transaction,
-        CancellationToken cancellationToken)
-    {
-        await using SqliteCommand tableExistsCommand = connection.CreateCommand();
-        tableExistsCommand.Transaction = transaction;
-        tableExistsCommand.CommandText = """
-            SELECT COUNT(*)
-            FROM sqlite_master
-            WHERE type = 'table' AND name = $table_name;
-            """;
-        tableExistsCommand.Parameters.AddWithValue("$table_name", SqliteAuthSchema.SchemaVersionTable);
-
-        long tableCount = (long)(await tableExistsCommand.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false) ?? 0L);
-
-        if (tableCount == 0)
-        {
-            return 0;
-        }
-
-        await using SqliteCommand versionCommand = connection.CreateCommand();
-        versionCommand.Transaction = transaction;
-        versionCommand.CommandText = """
-            SELECT version
-            FROM schema_version
-            WHERE id = 1;
-            """;
-
-        object? version = await versionCommand.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false);
-
-        return version is null || version == DBNull.Value
-            ? 0
-            : Convert.ToInt32(version, System.Globalization.CultureInfo.InvariantCulture);
-    }
-
-    private static async Task ApplyVersionOneAsync(
-        SqliteConnection connection,
-        SqliteTransaction transaction,
-        CancellationToken cancellationToken)
-    {
-        await ExecuteNonQueryAsync(
-            connection,
-            transaction,
-            """
-            CREATE TABLE IF NOT EXISTS schema_version (
-                id INTEGER PRIMARY KEY CHECK (id = 1),
-                version INTEGER NOT NULL,
-                applied_utc TEXT NOT NULL
-            );
-
-            CREATE TABLE IF NOT EXISTS api_keys (
-                key_id TEXT PRIMARY KEY,
-                key_prefix TEXT NOT NULL,
-                secret_hash BLOB NOT NULL,
-                display_name TEXT NOT NULL,
-                scopes TEXT NOT NULL,
-                created_utc TEXT NOT NULL,
-                last_used_utc TEXT NULL,
-                revoked_utc TEXT NULL
-            );
-
-            CREATE TABLE IF NOT EXISTS api_key_audit (
-                audit_id INTEGER PRIMARY KEY AUTOINCREMENT,
-                key_id TEXT NULL,
-                event_type TEXT NOT NULL,
-                remote_address TEXT NULL,
-                created_utc TEXT NOT NULL,
-                details TEXT NULL
-            );
-
-            CREATE INDEX IF NOT EXISTS ix_api_keys_revoked_utc
-                ON api_keys (revoked_utc);
-
-            CREATE INDEX IF NOT EXISTS ix_api_key_audit_key_id_created_utc
-                ON api_key_audit (key_id, created_utc);
-            """,
-            cancellationToken).ConfigureAwait(false);
-
-        await using SqliteCommand versionCommand = connection.CreateCommand();
-        versionCommand.Transaction = transaction;
-        versionCommand.CommandText = """
-            INSERT INTO schema_version (id, version, applied_utc)
-            VALUES (1, $version, $applied_utc)
-            ON CONFLICT(id) DO UPDATE SET
-                version = excluded.version,
-                applied_utc = excluded.applied_utc;
-            """;
-        versionCommand.Parameters.AddWithValue("$version", SqliteAuthSchema.CurrentVersion);
-        versionCommand.Parameters.AddWithValue("$applied_utc", DateTimeOffset.UtcNow.ToString("O"));
-
-        await versionCommand.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
-    }
-
-    private static async Task ExecuteNonQueryAsync(
-        SqliteConnection connection,
-        SqliteTransaction transaction,
-        string commandText,
-        CancellationToken cancellationToken)
-    {
-        await using SqliteCommand command = connection.CreateCommand();
-        command.Transaction = transaction;
-        command.CommandText = commandText;
-
-        await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
-    }
-}

src/MxGateway.Server/Workers/IWorkerProcess.cs

@@ -1,14 +0,0 @@
-namespace MxGateway.Server.Workers;
-
-public interface IWorkerProcess : IDisposable
-{
-    int Id { get; }
-
-    bool HasExited { get; }
-
-    int? ExitCode { get; }
-
-    ValueTask WaitForExitAsync(CancellationToken cancellationToken);
-
-    void Kill(bool entireProcessTree);
-}

src/MxGateway.Server/Workers/IWorkerProcessFactory.cs

@@ -1,8 +0,0 @@
-using System.Diagnostics;
-
-namespace MxGateway.Server.Workers;
-
-public interface IWorkerProcessFactory
-{
-    IWorkerProcess Start(ProcessStartInfo startInfo);
-}

src/MxGateway.Server/Workers/IWorkerProcessLauncher.cs

@@ -1,8 +0,0 @@
-namespace MxGateway.Server.Workers;
-
-public interface IWorkerProcessLauncher
-{
-    Task<WorkerProcessHandle> LaunchAsync(
-        WorkerProcessLaunchRequest request,
-        CancellationToken cancellationToken = default);
-}

src/MxGateway.Server/Workers/IWorkerStartupProbe.cs

@@ -1,9 +0,0 @@
-namespace MxGateway.Server.Workers;
-
-public interface IWorkerStartupProbe
-{
-    Task WaitUntilReadyAsync(
-        IWorkerProcess process,
-        WorkerProcessLaunchRequest request,
-        CancellationToken cancellationToken);
-}

src/MxGateway.Server/Workers/SystemWorkerProcess.cs

@@ -1,27 +0,0 @@
-using System.Diagnostics;
-
-namespace MxGateway.Server.Workers;
-
-internal sealed class SystemWorkerProcess(Process process) : IWorkerProcess
-{
-    public int Id => process.Id;
-
-    public bool HasExited => process.HasExited;
-
-    public int? ExitCode => process.HasExited ? process.ExitCode : null;
-
-    public async ValueTask WaitForExitAsync(CancellationToken cancellationToken)
-    {
-        await process.WaitForExitAsync(cancellationToken).ConfigureAwait(false);
-    }
-
-    public void Kill(bool entireProcessTree)
-    {
-        process.Kill(entireProcessTree);
-    }
-
-    public void Dispose()
-    {
-        process.Dispose();
-    }
-}

src/MxGateway.Server/Workers/SystemWorkerProcessFactory.cs

@@ -1,22 +0,0 @@
-using System.Diagnostics;
-
-namespace MxGateway.Server.Workers;
-
-public sealed class SystemWorkerProcessFactory : IWorkerProcessFactory
-{
-    public IWorkerProcess Start(ProcessStartInfo startInfo)
-    {
-        Process process = new()
-        {
-            StartInfo = startInfo,
-        };
-
-        if (!process.Start())
-        {
-            process.Dispose();
-            throw new InvalidOperationException("Worker process failed to start.");
-        }
-
-        return new SystemWorkerProcess(process);
-    }
-}

src/MxGateway.Server/Workers/WorkerExecutableValidator.cs

@@ -1,80 +0,0 @@
-using System.Buffers.Binary;
-using MxGateway.Server.Configuration;
-
-namespace MxGateway.Server.Workers;
-
-internal static class WorkerExecutableValidator
-{
-    private const ushort ImageFileMachineI386 = 0x014c;
-    private const ushort ImageFileMachineAmd64 = 0x8664;
-    private const int DosHeaderSignatureOffset = 0;
-    private const int PeHeaderOffsetPointer = 0x3c;
-    private const int PeSignatureSize = 4;
-    private const int MachineOffsetFromPeHeader = PeSignatureSize;
-    private const int MinimumHeaderSize = 0x40;
-
-    public static void Validate(
-        string executablePath,
-        WorkerArchitecture requiredArchitecture)
-    {
-        ushort machine = ReadMachineType(executablePath);
-        ushort expectedMachine = requiredArchitecture switch
-        {
-            WorkerArchitecture.X86 => ImageFileMachineI386,
-            WorkerArchitecture.X64 => ImageFileMachineAmd64,
-            _ => throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.InvalidExecutable,
-                "Worker executable required architecture is unsupported."),
-        };
-
-        if (machine != expectedMachine)
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.InvalidExecutable,
-                $"Worker executable architecture does not match required {requiredArchitecture} architecture.");
-        }
-    }
-
-    private static ushort ReadMachineType(string executablePath)
-    {
-        byte[] header = new byte[MinimumHeaderSize];
-        using FileStream stream = File.OpenRead(executablePath);
-        if (stream.Read(header) < header.Length)
-        {
-            throw InvalidExecutable("Worker executable is too small to contain a valid PE header.");
-        }
-
-        if (header[DosHeaderSignatureOffset] != 'M' || header[DosHeaderSignatureOffset + 1] != 'Z')
-        {
-            throw InvalidExecutable("Worker executable does not contain an MZ header.");
-        }
-
-        int peHeaderOffset = BinaryPrimitives.ReadInt32LittleEndian(header.AsSpan(PeHeaderOffsetPointer, sizeof(int)));
-        if (peHeaderOffset < MinimumHeaderSize)
-        {
-            throw InvalidExecutable("Worker executable PE header offset is invalid.");
-        }
-
-        byte[] peHeaderBytes = new byte[PeSignatureSize + sizeof(ushort)];
-        stream.Position = peHeaderOffset;
-        if (stream.Read(peHeaderBytes) < peHeaderBytes.Length)
-        {
-            throw InvalidExecutable("Worker executable PE header is missing.");
-        }
-
-        if (peHeaderBytes[0] != 'P' || peHeaderBytes[1] != 'E' || peHeaderBytes[2] != 0 || peHeaderBytes[3] != 0)
-        {
-            throw InvalidExecutable("Worker executable does not contain a PE header.");
-        }
-
-        return BinaryPrimitives.ReadUInt16LittleEndian(
-            peHeaderBytes.AsSpan(MachineOffsetFromPeHeader, sizeof(ushort)));
-    }
-
-    private static WorkerProcessLaunchException InvalidExecutable(string message)
-    {
-        return new WorkerProcessLaunchException(
-            WorkerProcessLaunchErrorCode.InvalidExecutable,
-            message);
-    }
-}

src/MxGateway.Server/Workers/WorkerProcessCommandLine.cs

@@ -1,30 +0,0 @@
-namespace MxGateway.Server.Workers;
-
-public sealed class WorkerProcessCommandLine
-{
-    public WorkerProcessCommandLine(
-        string executablePath,
-        IReadOnlyList<string> arguments)
-    {
-        ExecutablePath = executablePath;
-        Arguments = arguments;
-    }
-
-    public string ExecutablePath { get; }
-
-    public IReadOnlyList<string> Arguments { get; }
-
-    public override string ToString()
-    {
-        return string.Join(
-            " ",
-            new[] { Quote(ExecutablePath) }.Concat(Arguments.Select(Quote)));
-    }
-
-    private static string Quote(string value)
-    {
-        return value.Contains(' ', StringComparison.Ordinal)
-            ? $"\"{value}\""
-            : value;
-    }
-}

src/MxGateway.Server/Workers/WorkerProcessHandle.cs

@@ -1,28 +0,0 @@
-namespace MxGateway.Server.Workers;
-
-public sealed class WorkerProcessHandle : IDisposable
-{
-    public WorkerProcessHandle(
-        IWorkerProcess process,
-        WorkerProcessCommandLine commandLine,
-        DateTimeOffset launchedAt)
-    {
-        Process = process;
-        ProcessId = process.Id;
-        CommandLine = commandLine;
-        LaunchedAt = launchedAt;
-    }
-
-    public IWorkerProcess Process { get; }
-
-    public int ProcessId { get; }
-
-    public WorkerProcessCommandLine CommandLine { get; }
-
-    public DateTimeOffset LaunchedAt { get; }
-
-    public void Dispose()
-    {
-        Process.Dispose();
-    }
-}

src/MxGateway.Server/Workers/WorkerProcessLaunchErrorCode.cs

@@ -1,13 +0,0 @@
-namespace MxGateway.Server.Workers;
-
-public enum WorkerProcessLaunchErrorCode
-{
-    Unknown = 0,
-    InvalidRequest = 1,
-    ExecutableNotFound = 2,
-    InvalidExecutable = 3,
-    InvalidWorkingDirectory = 4,
-    StartFailed = 5,
-    StartupTimeout = 6,
-    StartupFailed = 7,
-}

src/MxGateway.Server/Workers/WorkerProcessLaunchException.cs

@@ -1,23 +0,0 @@
-namespace MxGateway.Server.Workers;
-
-public sealed class WorkerProcessLaunchException : Exception
-{
-    public WorkerProcessLaunchException(
-        WorkerProcessLaunchErrorCode errorCode,
-        string message)
-        : base(message)
-    {
-        ErrorCode = errorCode;
-    }
-
-    public WorkerProcessLaunchException(
-        WorkerProcessLaunchErrorCode errorCode,
-        string message,
-        Exception innerException)
-        : base(message, innerException)
-    {
-        ErrorCode = errorCode;
-    }
-
-    public WorkerProcessLaunchErrorCode ErrorCode { get; }
-}

src/MxGateway.Server/Workers/WorkerProcessLaunchRequest.cs

@@ -1,8 +0,0 @@
-namespace MxGateway.Server.Workers;
-
-public sealed record WorkerProcessLaunchRequest(
-    string SessionId,
-    string PipeName,
-    uint ProtocolVersion,
-    string Nonce,
-    IDisposable? PipeReservation = null);

src/MxGateway.Server/Workers/WorkerProcessLauncher.cs

@@ -1,262 +0,0 @@
-using System.Diagnostics;
-using Microsoft.Extensions.Options;
-using MxGateway.Server.Configuration;
-using MxGateway.Server.Metrics;
-
-namespace MxGateway.Server.Workers;
-
-public sealed class WorkerProcessLauncher : IWorkerProcessLauncher
-{
-    public const string WorkerNonceEnvironmentVariableName = "MXGATEWAY_WORKER_NONCE";
-
-    private readonly IWorkerProcessFactory _processFactory;
-    private readonly IWorkerStartupProbe _startupProbe;
-    private readonly GatewayMetrics _metrics;
-    private readonly TimeProvider _timeProvider;
-    private readonly WorkerOptions _workerOptions;
-
-    public WorkerProcessLauncher(
-        IOptions<GatewayOptions> gatewayOptions,
-        IWorkerProcessFactory processFactory,
-        IWorkerStartupProbe startupProbe,
-        GatewayMetrics metrics,
-        TimeProvider? timeProvider = null)
-    {
-        ArgumentNullException.ThrowIfNull(gatewayOptions);
-        ArgumentNullException.ThrowIfNull(processFactory);
-        ArgumentNullException.ThrowIfNull(startupProbe);
-        ArgumentNullException.ThrowIfNull(metrics);
-
-        _workerOptions = gatewayOptions.Value.Worker;
-        _processFactory = processFactory;
-        _startupProbe = startupProbe;
-        _metrics = metrics;
-        _timeProvider = timeProvider ?? TimeProvider.System;
-    }
-
-    public async Task<WorkerProcessHandle> LaunchAsync(
-        WorkerProcessLaunchRequest request,
-        CancellationToken cancellationToken = default)
-    {
-        try
-        {
-            return await LaunchCoreAsync(request, cancellationToken).ConfigureAwait(false);
-        }
-        catch
-        {
-            request.PipeReservation?.Dispose();
-            throw;
-        }
-    }
-
-    private async Task<WorkerProcessHandle> LaunchCoreAsync(
-        WorkerProcessLaunchRequest request,
-        CancellationToken cancellationToken)
-    {
-        ValidateRequest(request);
-
-        DateTimeOffset startedAt = _timeProvider.GetUtcNow();
-        ProcessStartInfo startInfo = CreateStartInfo(request, out WorkerProcessCommandLine commandLine);
-
-        IWorkerProcess process;
-        try
-        {
-            process = _processFactory.Start(startInfo);
-        }
-        catch (Exception exception) when (exception is not WorkerProcessLaunchException)
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.StartFailed,
-                "Worker process failed to start.",
-                exception);
-        }
-
-        try
-        {
-            using CancellationTokenSource startupTimeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
-            startupTimeout.CancelAfter(TimeSpan.FromSeconds(_workerOptions.StartupTimeoutSeconds));
-
-            await _startupProbe
-                .WaitUntilReadyAsync(process, request, startupTimeout.Token)
-                .ConfigureAwait(false);
-
-            _metrics.WorkerStarted(_timeProvider.GetUtcNow() - startedAt);
-
-            return new WorkerProcessHandle(process, commandLine, startedAt);
-        }
-        catch (OperationCanceledException exception) when (!cancellationToken.IsCancellationRequested)
-        {
-            KillAndDispose(process, "StartupTimeout");
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.StartupTimeout,
-                "Worker process did not complete startup before the configured timeout.",
-                exception);
-        }
-        catch (OperationCanceledException)
-        {
-            KillAndDispose(process, "LaunchCanceled");
-            throw;
-        }
-        catch (Exception exception) when (exception is not WorkerProcessLaunchException)
-        {
-            KillAndDispose(process, "StartupFailed");
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.StartupFailed,
-                "Worker process failed during startup.",
-                exception);
-        }
-        catch (WorkerProcessLaunchException)
-        {
-            KillAndDispose(process, "StartupFailed");
-            throw;
-        }
-    }
-
-    private ProcessStartInfo CreateStartInfo(
-        WorkerProcessLaunchRequest request,
-        out WorkerProcessCommandLine commandLine)
-    {
-        string executablePath = ResolveExecutablePath();
-        string workingDirectory = ResolveWorkingDirectory(executablePath);
-        string[] arguments =
-        [
-            "--session-id",
-            request.SessionId,
-            "--pipe-name",
-            request.PipeName,
-            "--protocol-version",
-            request.ProtocolVersion.ToString(System.Globalization.CultureInfo.InvariantCulture),
-        ];
-
-        ProcessStartInfo startInfo = new()
-        {
-            FileName = executablePath,
-            WorkingDirectory = workingDirectory,
-            UseShellExecute = false,
-            CreateNoWindow = true,
-            ErrorDialog = false,
-        };
-
-        foreach (string argument in arguments)
-        {
-            startInfo.ArgumentList.Add(argument);
-        }
-
-        startInfo.Environment[WorkerNonceEnvironmentVariableName] = request.Nonce;
-
-        commandLine = new WorkerProcessCommandLine(executablePath, arguments);
-
-        return startInfo;
-    }
-
-    private string ResolveExecutablePath()
-    {
-        string executablePath;
-        try
-        {
-            executablePath = Path.GetFullPath(_workerOptions.ExecutablePath);
-        }
-        catch (Exception exception) when (exception is ArgumentException or NotSupportedException or PathTooLongException)
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.InvalidExecutable,
-                "Worker executable path is not a valid filesystem path.",
-                exception);
-        }
-
-        if (!string.Equals(Path.GetExtension(executablePath), ".exe", StringComparison.OrdinalIgnoreCase))
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.InvalidExecutable,
-                "Worker executable path must point to a .exe file.");
-        }
-
-        if (!File.Exists(executablePath))
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.ExecutableNotFound,
-                "Worker executable does not exist.");
-        }
-
-        WorkerExecutableValidator.Validate(executablePath, _workerOptions.RequiredArchitecture);
-
-        return executablePath;
-    }
-
-    private string ResolveWorkingDirectory(string executablePath)
-    {
-        if (string.IsNullOrWhiteSpace(_workerOptions.WorkingDirectory))
-        {
-            return Path.GetDirectoryName(executablePath) ?? Environment.CurrentDirectory;
-        }
-
-        string workingDirectory;
-        try
-        {
-            workingDirectory = Path.GetFullPath(_workerOptions.WorkingDirectory);
-        }
-        catch (Exception exception) when (exception is ArgumentException or NotSupportedException or PathTooLongException)
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.InvalidWorkingDirectory,
-                "Worker working directory is not a valid filesystem path.",
-                exception);
-        }
-
-        if (!Directory.Exists(workingDirectory))
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.InvalidWorkingDirectory,
-                "Worker working directory does not exist.");
-        }
-
-        return workingDirectory;
-    }
-
-    private void KillAndDispose(IWorkerProcess process, string reason)
-    {
-        try
-        {
-            if (!process.HasExited)
-            {
-                process.Kill(entireProcessTree: true);
-                _metrics.WorkerKilled(reason);
-            }
-        }
-        finally
-        {
-            process.Dispose();
-        }
-    }
-
-    private static void ValidateRequest(WorkerProcessLaunchRequest request)
-    {
-        if (string.IsNullOrWhiteSpace(request.SessionId))
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.InvalidRequest,
-                "Worker launch requires a session id.");
-        }
-
-        if (string.IsNullOrWhiteSpace(request.PipeName))
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.InvalidRequest,
-                "Worker launch requires a pipe name.");
-        }
-
-        if (request.ProtocolVersion == 0)
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.InvalidRequest,
-                "Worker launch requires a non-zero protocol version.");
-        }
-
-        if (string.IsNullOrWhiteSpace(request.Nonce))
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.InvalidRequest,
-                "Worker launch requires a nonce.");
-        }
-    }
-}

src/MxGateway.Server/Workers/WorkerProcessStartedProbe.cs

@@ -1,19 +0,0 @@
-namespace MxGateway.Server.Workers;
-
-public sealed class WorkerProcessStartedProbe : IWorkerStartupProbe
-{
-    public Task WaitUntilReadyAsync(
-        IWorkerProcess process,
-        WorkerProcessLaunchRequest request,
-        CancellationToken cancellationToken)
-    {
-        if (process.HasExited)
-        {
-            throw new WorkerProcessLaunchException(
-                WorkerProcessLaunchErrorCode.StartupFailed,
-                $"Worker process exited before startup completed with exit code {process.ExitCode}.");
-        }
-
-        return Task.CompletedTask;
-    }
-}

src/MxGateway.Server/Workers/WorkerServiceCollectionExtensions.cs

@@ -1,13 +0,0 @@
-namespace MxGateway.Server.Workers;
-
-public static class WorkerServiceCollectionExtensions
-{
-    public static IServiceCollection AddWorkerProcessLauncher(this IServiceCollection services)
-    {
-        services.AddSingleton<IWorkerProcessFactory, SystemWorkerProcessFactory>();
-        services.AddSingleton<IWorkerStartupProbe, WorkerProcessStartedProbe>();
-        services.AddSingleton<IWorkerProcessLauncher, WorkerProcessLauncher>();
-
-        return services;
-    }
-}

src/MxGateway.Server/appsettings.json

@@ -5,44 +5,5 @@
       "Microsoft.AspNetCore": "Warning"
     }
   },
-  "AllowedHosts": "*",
+  "AllowedHosts": "*"
-  "MxGateway": {
-    "Authentication": {
-      "Mode": "ApiKey",
-      "SqlitePath": "C:\\ProgramData\\MxGateway\\gateway-auth.db",
-      "PepperSecretName": "MxGateway:ApiKeyPepper",
-      "RunMigrationsOnStartup": true
-    },
-    "Worker": {
-      "ExecutablePath": "src\\MxGateway.Worker\\bin\\x86\\Release\\MxGateway.Worker.exe",
-      "RequiredArchitecture": "X86",
-      "StartupTimeoutSeconds": 30,
-      "ShutdownTimeoutSeconds": 10,
-      "HeartbeatIntervalSeconds": 5,
-      "HeartbeatGraceSeconds": 15,
-      "MaxMessageBytes": 16777216
-    },
-    "Sessions": {
-      "DefaultCommandTimeoutSeconds": 30,
-      "MaxSessions": 64,
-      "AllowMultipleEventSubscribers": false
-    },
-    "Events": {
-      "QueueCapacity": 10000,
-      "BackpressurePolicy": "FailFast"
-    },
-    "Dashboard": {
-      "Enabled": true,
-      "PathBase": "/dashboard",
-      "RequireAdminScope": true,
-      "AllowAnonymousLocalhost": false,
-      "SnapshotIntervalMilliseconds": 1000,
-      "RecentFaultLimit": 100,
-      "RecentSessionLimit": 200,
-      "ShowTagValues": false
-    },
-    "Protocol": {
-      "WorkerProtocolVersion": 1
-    }
-  }
 }

src/MxGateway.Tests/Configuration/GatewayOptionsTests.cs

@@ -1,119 +0,0 @@
-using Microsoft.Extensions.Configuration;
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Options;
-using MxGateway.Server.Configuration;
-
-namespace MxGateway.Tests.Configuration;
-
-public sealed class GatewayOptionsTests
-{
-    [Fact]
-    public void OptionsBinding_UsesDesignDefaults()
-    {
-        GatewayOptions options = BindOptions(new Dictionary<string, string?>());
-
-        Assert.Equal(AuthenticationMode.ApiKey, options.Authentication.Mode);
-        Assert.Equal(@"C:\ProgramData\MxGateway\gateway-auth.db", options.Authentication.SqlitePath);
-        Assert.Equal("MxGateway:ApiKeyPepper", options.Authentication.PepperSecretName);
-        Assert.True(options.Authentication.RunMigrationsOnStartup);
-
-        Assert.Equal(@"src\MxGateway.Worker\bin\x86\Release\MxGateway.Worker.exe", options.Worker.ExecutablePath);
-        Assert.Equal(WorkerArchitecture.X86, options.Worker.RequiredArchitecture);
-        Assert.Equal(30, options.Worker.StartupTimeoutSeconds);
-        Assert.Equal(10, options.Worker.ShutdownTimeoutSeconds);
-        Assert.Equal(5, options.Worker.HeartbeatIntervalSeconds);
-        Assert.Equal(15, options.Worker.HeartbeatGraceSeconds);
-        Assert.Equal(16 * 1024 * 1024, options.Worker.MaxMessageBytes);
-
-        Assert.Equal(30, options.Sessions.DefaultCommandTimeoutSeconds);
-        Assert.Equal(64, options.Sessions.MaxSessions);
-        Assert.False(options.Sessions.AllowMultipleEventSubscribers);
-
-        Assert.Equal(10_000, options.Events.QueueCapacity);
-        Assert.Equal(EventBackpressurePolicy.FailFast, options.Events.BackpressurePolicy);
-
-        Assert.True(options.Dashboard.Enabled);
-        Assert.Equal("/dashboard", options.Dashboard.PathBase);
-        Assert.True(options.Dashboard.RequireAdminScope);
-        Assert.False(options.Dashboard.AllowAnonymousLocalhost);
-        Assert.Equal(1_000, options.Dashboard.SnapshotIntervalMilliseconds);
-        Assert.Equal(100, options.Dashboard.RecentFaultLimit);
-        Assert.Equal(200, options.Dashboard.RecentSessionLimit);
-        Assert.False(options.Dashboard.ShowTagValues);
-
-        Assert.Equal(1u, options.Protocol.WorkerProtocolVersion);
-    }
-
-    [Fact]
-    public void OptionsBinding_AppliesConfigurationOverrides()
-    {
-        GatewayOptions options = BindOptions(
-            new Dictionary<string, string?>
-            {
-                ["MxGateway:Authentication:Mode"] = "Disabled",
-                ["MxGateway:Worker:ExecutablePath"] = @"C:\Gateway\MxGateway.Worker.exe",
-                ["MxGateway:Sessions:MaxSessions"] = "12",
-                ["MxGateway:Events:QueueCapacity"] = "256",
-                ["MxGateway:Dashboard:Enabled"] = "false"
-            });
-
-        Assert.Equal(AuthenticationMode.Disabled, options.Authentication.Mode);
-        Assert.Equal(@"C:\Gateway\MxGateway.Worker.exe", options.Worker.ExecutablePath);
-        Assert.Equal(12, options.Sessions.MaxSessions);
-        Assert.Equal(256, options.Events.QueueCapacity);
-        Assert.False(options.Dashboard.Enabled);
-    }
-
-    [Theory]
-    [InlineData("MxGateway:Worker:ExecutablePath", "worker.dll", "MxGateway:Worker:ExecutablePath must point to a .exe file.")]
-    [InlineData("MxGateway:Events:QueueCapacity", "0", "MxGateway:Events:QueueCapacity must be greater than zero.")]
-    [InlineData("MxGateway:Authentication:PepperSecretName", "", "MxGateway:Authentication:PepperSecretName is required")]
-    [InlineData("MxGateway:Dashboard:PathBase", "dashboard", "MxGateway:Dashboard:PathBase must start with '/'.")]
-    public void Validation_InvalidConfiguration_FailsClearly(string key, string value, string expectedFailure)
-    {
-        OptionsValidationException exception = Assert.Throws<OptionsValidationException>(() =>
-            _ = BindOptions(new Dictionary<string, string?> { [key] = value }));
-
-        Assert.Contains(exception.Failures, failure => failure.Contains(expectedFailure, StringComparison.Ordinal));
-    }
-
-    [Fact]
-    public void EffectiveConfiguration_RedactsPepperSecretName()
-    {
-        using ServiceProvider services = BuildServices(
-            new Dictionary<string, string?>
-            {
-                ["MxGateway:Authentication:PepperSecretName"] = "RawPepperSecretName"
-            });
-
-        IGatewayConfigurationProvider provider = services.GetRequiredService<IGatewayConfigurationProvider>();
-
-        EffectiveGatewayConfiguration configuration = provider.GetEffectiveConfiguration();
-
-        Assert.Equal(GatewayConfigurationProvider.RedactedValue, configuration.Authentication.PepperSecretName);
-        Assert.DoesNotContain(
-            "RawPepperSecretName",
-            System.Text.Json.JsonSerializer.Serialize(configuration),
-            StringComparison.Ordinal);
-    }
-
-    private static GatewayOptions BindOptions(IReadOnlyDictionary<string, string?> configurationValues)
-    {
-        using ServiceProvider services = BuildServices(configurationValues);
-
-        return services.GetRequiredService<IOptions<GatewayOptions>>().Value;
-    }
-
-    private static ServiceProvider BuildServices(IReadOnlyDictionary<string, string?> configurationValues)
-    {
-        IConfigurationRoot configuration = new ConfigurationBuilder()
-            .AddInMemoryCollection(configurationValues)
-            .Build();
-
-        ServiceCollection services = new();
-        services.AddSingleton<IConfiguration>(configuration);
-        services.AddGatewayConfiguration();
-
-        return services.BuildServiceProvider(validateScopes: true);
-    }
-}

src/MxGateway.Tests/Diagnostics/GatewayLogRedactorTests.cs

@@ -1,82 +0,0 @@
-using MxGateway.Server.Diagnostics;
-
-namespace MxGateway.Tests.Diagnostics;
-
-public sealed class GatewayLogRedactorTests
-{
-    [Fact]
-    public void RedactApiKey_PreservesKeyIdAndRemovesSecret()
-    {
-        string? redacted = GatewayLogRedactor.RedactApiKey("Bearer mxgw_operator01_super-secret");
-
-        Assert.Equal("Bearer mxgw_operator01_[redacted]", redacted);
-        Assert.DoesNotContain("super-secret", redacted);
-    }
-
-    [Fact]
-    public void RedactApiKey_RemovesSecretContainingUnderscores()
-    {
-        string? redacted = GatewayLogRedactor.RedactApiKey("Bearer mxgw_operator01_super_secret_value");
-
-        Assert.Equal("Bearer mxgw_operator01_[redacted]", redacted);
-        Assert.DoesNotContain("super_secret_value", redacted);
-    }
-
-    [Theory]
-    [InlineData("AuthenticateUser")]
-    [InlineData("WriteSecured")]
-    [InlineData("WriteSecured2")]
-    public void IsCredentialBearingCommand_IdentifiesSensitiveMxAccessCommands(string commandMethod)
-    {
-        Assert.True(GatewayLogRedactor.IsCredentialBearingCommand(commandMethod));
-    }
-
-    [Fact]
-    public void RedactCommandValue_DoesNotLogRawValuesByDefault()
-    {
-        object? redacted = GatewayLogRedactor.RedactCommandValue("Write", "plaintext-tag-value");
-
-        Assert.Equal("[redacted]", redacted);
-    }
-
-    [Fact]
-    public void RedactCommandValue_RedactsSecuredWriteEvenWhenValueLoggingIsEnabled()
-    {
-        object? redacted = GatewayLogRedactor.RedactCommandValue(
-            "WriteSecured",
-            "credential-bearing-value",
-            valueLoggingEnabled: true);
-
-        Assert.Equal("[redacted]", redacted);
-    }
-
-    [Fact]
-    public void RedactCommandValue_AllowsNonSensitiveValueOnlyWhenValueLoggingIsEnabled()
-    {
-        object? redacted = GatewayLogRedactor.RedactCommandValue(
-            "Write",
-            "diagnostic-value",
-            valueLoggingEnabled: true);
-
-        Assert.Equal("diagnostic-value", redacted);
-    }
-
-    [Fact]
-    public void LogScope_RedactsClientIdentityBeforeScopeStateIsCreated()
-    {
-        GatewayLogScope scope = new(
-            SessionId: "session-1",
-            WorkerProcessId: 1234,
-            CorrelationId: 99,
-            CommandMethod: "AuthenticateUser",
-            ClientIdentity: "Bearer mxgw_admin_secret");
-
-        IReadOnlyDictionary<string, object?> values = scope.ToDictionary();
-
-        Assert.Equal("session-1", values["SessionId"]);
-        Assert.Equal(1234, values["WorkerProcessId"]);
-        Assert.Equal((ulong)99, values["CorrelationId"]);
-        Assert.Equal("AuthenticateUser", values["CommandMethod"]);
-        Assert.Equal("Bearer mxgw_admin_[redacted]", values["ClientIdentity"]);
-    }
-}

src/MxGateway.Tests/Gateway/GatewayApplicationTests.cs

@@ -1,9 +1,6 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Routing;
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Options;
 using MxGateway.Server;
-using MxGateway.Server.Metrics;
 
 namespace MxGateway.Tests.Gateway;
 
@@ -22,47 +19,4 @@ public sealed class GatewayApplicationTests
 
         Assert.Equal("LiveHealth", endpoint.Metadata.GetMetadata<IEndpointNameMetadata>()?.EndpointName);
     }
-
-    [Fact]
-    public void Build_RegistersGatewayMetrics()
-    {
-        WebApplication app = GatewayApplication.Build([]);
-
-        GatewayMetrics metrics = app.Services.GetRequiredService<GatewayMetrics>();
-
-        Assert.NotNull(metrics);
-    }
-
-    [Theory]
-    [InlineData(
-        "MxGateway:Worker:ExecutablePath",
-        "worker.dll",
-        "MxGateway:Worker:ExecutablePath must point to a .exe file.")]
-    [InlineData(
-        "MxGateway:Events:QueueCapacity",
-        "0",
-        "MxGateway:Events:QueueCapacity must be greater than zero.")]
-    [InlineData(
-        "MxGateway:Authentication:PepperSecretName",
-        "",
-        "MxGateway:Authentication:PepperSecretName is required")]
-    [InlineData(
-        "MxGateway:Dashboard:PathBase",
-        "dashboard",
-        "MxGateway:Dashboard:PathBase must start with '/'.")]
-    public async Task StartAsync_InvalidGatewayConfiguration_FailsStartup(
-        string key,
-        string value,
-        string expectedFailure)
-    {
-        await using WebApplication app = GatewayApplication.Build(
-            [$"--{key}={value}", "--urls=http://127.0.0.1:0"]);
-
-        OptionsValidationException exception = await Assert.ThrowsAsync<OptionsValidationException>(
-            () => app.StartAsync());
-
-        Assert.Contains(
-            exception.Failures,
-            failure => failure.Contains(expectedFailure, StringComparison.Ordinal));
-    }
 }

src/MxGateway.Tests/Gateway/Workers/WorkerProcessLauncherTests.cs

@@ -1,307 +0,0 @@
-using System.Diagnostics;
-using Microsoft.Extensions.Options;
-using MxGateway.Contracts;
-using MxGateway.Server.Configuration;
-using MxGateway.Server.Metrics;
-using MxGateway.Server.Workers;
-
-namespace MxGateway.Tests.Gateway.Workers;
-
-public sealed class WorkerProcessLauncherTests
-{
-    private const string SessionId = "session-1";
-    private const string PipeName = "mxaccess-gateway-123-session-1";
-    private const string Nonce = "super-secret-nonce";
-
-    [Fact]
-    public async Task LaunchAsync_WithValidWorker_StartsProcessWithBootstrapArgumentsAndNonceEnvironment()
-    {
-        using TestDirectory directory = TestDirectory.Create();
-        string executablePath = directory.CreateWorkerExecutable(machine: 0x014c);
-        FakeWorkerProcess process = new(processId: 1234);
-        FakePipeReservation pipeReservation = new();
-        FakeWorkerProcessFactory processFactory = new(process);
-        GatewayMetrics metrics = new();
-        WorkerProcessLauncher launcher = CreateLauncher(executablePath, processFactory, new SucceedingStartupProbe(), metrics);
-
-        using WorkerProcessHandle handle = await launcher.LaunchAsync(CreateRequest(pipeReservation));
-
-        Assert.Equal(1234, handle.ProcessId);
-        Assert.Same(process, handle.Process);
-        Assert.NotNull(processFactory.LastStartInfo);
-        Assert.Equal(Path.GetFullPath(executablePath), processFactory.LastStartInfo.FileName);
-        Assert.False(processFactory.LastStartInfo.UseShellExecute);
-        Assert.True(processFactory.LastStartInfo.CreateNoWindow);
-        Assert.Equal(
-            ["--session-id", SessionId, "--pipe-name", PipeName, "--protocol-version", "1"],
-            processFactory.LastStartInfo.ArgumentList);
-        Assert.Equal(Nonce, processFactory.LastStartInfo.Environment[WorkerProcessLauncher.WorkerNonceEnvironmentVariableName]);
-        Assert.DoesNotContain(Nonce, handle.CommandLine.ToString(), StringComparison.Ordinal);
-        Assert.DoesNotContain(Nonce, string.Join(" ", handle.CommandLine.Arguments), StringComparison.Ordinal);
-        Assert.False(pipeReservation.DisposeCalled);
-        Assert.Equal(1, metrics.GetSnapshot().WorkersRunning);
-    }
-
-    [Fact]
-    public async Task LaunchAsync_WhenStartupProbeFails_KillsAndDisposesWorker()
-    {
-        using TestDirectory directory = TestDirectory.Create();
-        string executablePath = directory.CreateWorkerExecutable(machine: 0x014c);
-        FakeWorkerProcess process = new(processId: 1234);
-        FakePipeReservation pipeReservation = new();
-        GatewayMetrics metrics = new();
-        WorkerProcessLauncher launcher = CreateLauncher(
-            executablePath,
-            new FakeWorkerProcessFactory(process),
-            new FailingStartupProbe(),
-            metrics);
-
-        WorkerProcessLaunchException exception =
-            await Assert.ThrowsAsync<WorkerProcessLaunchException>(
-                async () => await launcher.LaunchAsync(CreateRequest(pipeReservation)));
-
-        Assert.Equal(WorkerProcessLaunchErrorCode.StartupFailed, exception.ErrorCode);
-        Assert.True(process.KillCalled);
-        Assert.True(process.DisposeCalled);
-        Assert.True(pipeReservation.DisposeCalled);
-        Assert.Equal(1, metrics.GetSnapshot().WorkerKills);
-    }
-
-    [Fact]
-    public async Task LaunchAsync_WhenStartupTimesOut_KillsAndDisposesWorker()
-    {
-        using TestDirectory directory = TestDirectory.Create();
-        string executablePath = directory.CreateWorkerExecutable(machine: 0x014c);
-        FakeWorkerProcess process = new(processId: 1234);
-        GatewayMetrics metrics = new();
-        WorkerProcessLauncher launcher = CreateLauncher(
-            executablePath,
-            new FakeWorkerProcessFactory(process),
-            new WaitingStartupProbe(),
-            metrics,
-            startupTimeoutSeconds: 1);
-
-        WorkerProcessLaunchException exception =
-            await Assert.ThrowsAsync<WorkerProcessLaunchException>(
-                async () => await launcher.LaunchAsync(CreateRequest()));
-
-        Assert.Equal(WorkerProcessLaunchErrorCode.StartupTimeout, exception.ErrorCode);
-        Assert.True(process.KillCalled);
-        Assert.True(process.DisposeCalled);
-        Assert.Equal(1, metrics.GetSnapshot().WorkerKills);
-    }
-
-    [Fact]
-    public async Task LaunchAsync_WhenExecutableDoesNotExist_FailsBeforeStartingProcess()
-    {
-        using TestDirectory directory = TestDirectory.Create();
-        string executablePath = Path.Combine(directory.Path, "missing-worker.exe");
-        FakeWorkerProcessFactory processFactory = new(new FakeWorkerProcess(processId: 1234));
-        WorkerProcessLauncher launcher = CreateLauncher(executablePath, processFactory, new SucceedingStartupProbe());
-
-        WorkerProcessLaunchException exception =
-            await Assert.ThrowsAsync<WorkerProcessLaunchException>(
-                async () => await launcher.LaunchAsync(CreateRequest()));
-
-        Assert.Equal(WorkerProcessLaunchErrorCode.ExecutableNotFound, exception.ErrorCode);
-        Assert.Null(processFactory.LastStartInfo);
-    }
-
-    [Fact]
-    public async Task LaunchAsync_WhenExecutableArchitectureDoesNotMatch_FailsBeforeStartingProcess()
-    {
-        using TestDirectory directory = TestDirectory.Create();
-        string executablePath = directory.CreateWorkerExecutable(machine: 0x8664);
-        FakeWorkerProcessFactory processFactory = new(new FakeWorkerProcess(processId: 1234));
-        WorkerProcessLauncher launcher = CreateLauncher(executablePath, processFactory, new SucceedingStartupProbe());
-
-        WorkerProcessLaunchException exception =
-            await Assert.ThrowsAsync<WorkerProcessLaunchException>(
-                async () => await launcher.LaunchAsync(CreateRequest()));
-
-        Assert.Equal(WorkerProcessLaunchErrorCode.InvalidExecutable, exception.ErrorCode);
-        Assert.Null(processFactory.LastStartInfo);
-    }
-
-    [Fact]
-    public async Task LaunchAsync_WhenWorkerAlreadyExited_FailsAndDisposesWorkerWithoutKill()
-    {
-        using TestDirectory directory = TestDirectory.Create();
-        string executablePath = directory.CreateWorkerExecutable(machine: 0x014c);
-        FakeWorkerProcess process = new(processId: 1234)
-        {
-            HasExited = true,
-            ExitCode = 42,
-        };
-        WorkerProcessLauncher launcher = CreateLauncher(
-            executablePath,
-            new FakeWorkerProcessFactory(process),
-            new WorkerProcessStartedProbe());
-
-        WorkerProcessLaunchException exception =
-            await Assert.ThrowsAsync<WorkerProcessLaunchException>(
-                async () => await launcher.LaunchAsync(CreateRequest()));
-
-        Assert.Equal(WorkerProcessLaunchErrorCode.StartupFailed, exception.ErrorCode);
-        Assert.False(process.KillCalled);
-        Assert.True(process.DisposeCalled);
-    }
-
-    private static WorkerProcessLauncher CreateLauncher(
-        string executablePath,
-        IWorkerProcessFactory processFactory,
-        IWorkerStartupProbe startupProbe,
-        GatewayMetrics? metrics = null,
-        int startupTimeoutSeconds = 30)
-    {
-        GatewayOptions options = new()
-        {
-            Worker = new WorkerOptions
-            {
-                ExecutablePath = executablePath,
-                RequiredArchitecture = WorkerArchitecture.X86,
-                StartupTimeoutSeconds = startupTimeoutSeconds,
-            },
-        };
-
-        return new WorkerProcessLauncher(
-            Options.Create(options),
-            processFactory,
-            startupProbe,
-            metrics ?? new GatewayMetrics());
-    }
-
-    private static WorkerProcessLaunchRequest CreateRequest(IDisposable? pipeReservation = null)
-    {
-        return new WorkerProcessLaunchRequest(
-            SessionId,
-            PipeName,
-            GatewayContractInfo.WorkerProtocolVersion,
-            Nonce,
-            pipeReservation);
-    }
-
-    private sealed class FakeWorkerProcessFactory(IWorkerProcess process) : IWorkerProcessFactory
-    {
-        public ProcessStartInfo? LastStartInfo { get; private set; }
-
-        public IWorkerProcess Start(ProcessStartInfo startInfo)
-        {
-            LastStartInfo = startInfo;
-            return process;
-        }
-    }
-
-    private sealed class FakeWorkerProcess(int processId) : IWorkerProcess
-    {
-        public int Id { get; } = processId;
-
-        public bool HasExited { get; set; }
-
-        public int? ExitCode { get; set; }
-
-        public bool DisposeCalled { get; private set; }
-
-        public bool KillCalled { get; private set; }
-
-        public ValueTask WaitForExitAsync(CancellationToken cancellationToken)
-        {
-            return ValueTask.CompletedTask;
-        }
-
-        public void Kill(bool entireProcessTree)
-        {
-            Assert.True(entireProcessTree);
-            KillCalled = true;
-            HasExited = true;
-        }
-
-        public void Dispose()
-        {
-            DisposeCalled = true;
-        }
-    }
-
-    private sealed class SucceedingStartupProbe : IWorkerStartupProbe
-    {
-        public Task WaitUntilReadyAsync(
-            IWorkerProcess process,
-            WorkerProcessLaunchRequest request,
-            CancellationToken cancellationToken)
-        {
-            return Task.CompletedTask;
-        }
-    }
-
-    private sealed class FailingStartupProbe : IWorkerStartupProbe
-    {
-        public Task WaitUntilReadyAsync(
-            IWorkerProcess process,
-            WorkerProcessLaunchRequest request,
-            CancellationToken cancellationToken)
-        {
-            throw new InvalidOperationException("Fake worker startup failed.");
-        }
-    }
-
-    private sealed class WaitingStartupProbe : IWorkerStartupProbe
-    {
-        public async Task WaitUntilReadyAsync(
-            IWorkerProcess process,
-            WorkerProcessLaunchRequest request,
-            CancellationToken cancellationToken)
-        {
-            await Task.Delay(Timeout.InfiniteTimeSpan, cancellationToken);
-        }
-    }
-
-    private sealed class FakePipeReservation : IDisposable
-    {
-        public bool DisposeCalled { get; private set; }
-
-        public void Dispose()
-        {
-            DisposeCalled = true;
-        }
-    }
-
-    private sealed class TestDirectory : IDisposable
-    {
-        private TestDirectory(string path)
-        {
-            Path = path;
-        }
-
-        public string Path { get; }
-
-        public static TestDirectory Create()
-        {
-            string path = System.IO.Path.Combine(System.IO.Path.GetTempPath(), $"mxgateway-tests-{Guid.NewGuid():N}");
-            Directory.CreateDirectory(path);
-
-            return new TestDirectory(path);
-        }
-
-        public string CreateWorkerExecutable(ushort machine)
-        {
-            string path = System.IO.Path.Combine(Path, "MxGateway.Worker.exe");
-            byte[] bytes = new byte[0x100];
-            bytes[0] = (byte)'M';
-            bytes[1] = (byte)'Z';
-            BitConverter.GetBytes(0x80).CopyTo(bytes, 0x3c);
-            bytes[0x80] = (byte)'P';
-            bytes[0x81] = (byte)'E';
-            bytes[0x82] = 0;
-            bytes[0x83] = 0;
-            BitConverter.GetBytes(machine).CopyTo(bytes, 0x84);
-            File.WriteAllBytes(path, bytes);
-
-            return path;
-        }
-
-        public void Dispose()
-        {
-            Directory.Delete(Path, recursive: true);
-        }
-    }
-}

src/MxGateway.Tests/Metrics/GatewayMetricsTests.cs

@@ -1,60 +0,0 @@
-using MxGateway.Server.Metrics;
-
-namespace MxGateway.Tests.Metrics;
-
-public sealed class GatewayMetricsTests
-{
-    [Fact]
-    public void GetSnapshot_ReflectsSessionWorkerCommandEventAndFaultUpdates()
-    {
-        using GatewayMetrics metrics = new();
-
-        metrics.SessionOpened();
-        metrics.WorkerStarted(TimeSpan.FromMilliseconds(250));
-        metrics.CommandStarted("Register");
-        metrics.CommandSucceeded("Register", TimeSpan.FromMilliseconds(10));
-        metrics.CommandStarted("WriteSecured");
-        metrics.CommandFailed("WriteSecured", "AuthorizationFailed", TimeSpan.FromMilliseconds(12));
-        metrics.EventReceived("session-1", "OnDataChange");
-        metrics.EventReceived("session-1", "OnDataChange");
-        metrics.SetEventQueueDepth(7);
-        metrics.QueueOverflow("session-events");
-        metrics.Fault("CommandTimeout");
-        metrics.WorkerKilled("CommandTimeout");
-        metrics.WorkerStopped("Killed");
-        metrics.HeartbeatFailed("session-1");
-        metrics.StreamDisconnected("ClientCancelled");
-        metrics.SessionClosed();
-
-        GatewayMetricsSnapshot snapshot = metrics.GetSnapshot();
-
-        Assert.Equal(0, snapshot.OpenSessions);
-        Assert.Equal(0, snapshot.WorkersRunning);
-        Assert.Equal(7, snapshot.EventQueueDepth);
-        Assert.Equal(1, snapshot.SessionsOpened);
-        Assert.Equal(1, snapshot.SessionsClosed);
-        Assert.Equal(2, snapshot.CommandsStarted);
-        Assert.Equal(1, snapshot.CommandsSucceeded);
-        Assert.Equal(1, snapshot.CommandsFailed);
-        Assert.Equal(2, snapshot.EventsReceived);
-        Assert.Equal(1, snapshot.QueueOverflows);
-        Assert.Equal(1, snapshot.Faults);
-        Assert.Equal(1, snapshot.WorkerKills);
-        Assert.Equal(1, snapshot.WorkerExits);
-        Assert.Equal(1, snapshot.HeartbeatFailures);
-        Assert.Equal(1, snapshot.StreamDisconnects);
-        Assert.Equal(1, snapshot.CommandFailuresByMethod["WriteSecured"]);
-        Assert.Equal(2, snapshot.EventsByFamily["OnDataChange"]);
-    }
-
-    [Fact]
-    public void SetEventQueueDepth_RejectsNegativeDepth()
-    {
-        using GatewayMetrics metrics = new();
-
-        ArgumentOutOfRangeException exception = Assert.Throws<ArgumentOutOfRangeException>(
-            () => metrics.SetEventQueueDepth(-1));
-
-        Assert.Equal("depth", exception.ParamName);
-    }
-}

src/MxGateway.Tests/Security/Authentication/ApiKeyAdminCliRunnerTests.cs

@@ -1,242 +0,0 @@
-using System.Text.Json;
-using Microsoft.Extensions.Configuration;
-using Microsoft.Extensions.DependencyInjection;
-using MxGateway.Server.Configuration;
-using MxGateway.Server.Security.Authentication;
-
-namespace MxGateway.Tests.Security.Authentication;
-
-public sealed class ApiKeyAdminCliRunnerTests
-{
-    [Fact]
-    public async Task CreateKeyAsync_CreatesAuthenticatingKeyAndAudits()
-    {
-        await using ServiceProvider services = BuildServices(CreateTempDatabasePath());
-        ApiKeyAdminCliRunner runner = services.GetRequiredService<ApiKeyAdminCliRunner>();
-        StringWriter output = new();
-
-        await runner.RunAsync(
-            new ApiKeyAdminCommand(
-                Kind: ApiKeyAdminCommandKind.CreateKey,
-                Json: true,
-                SqlitePath: null,
-                Pepper: null,
-                KeyId: "operator01",
-                DisplayName: "Operator",
-                Scopes: new HashSet<string>(StringComparer.Ordinal) { "session:open", "events:read" }),
-            output,
-            CancellationToken.None);
-
-        string apiKey = ReadApiKey(output.ToString());
-
-        IApiKeyVerifier verifier = services.GetRequiredService<IApiKeyVerifier>();
-        ApiKeyVerificationResult verification = await verifier.VerifyAsync($"Bearer {apiKey}", CancellationToken.None);
-
-        Assert.True(verification.Succeeded);
-        Assert.NotNull(verification.Identity);
-        Assert.Equal("operator01", verification.Identity.KeyId);
-        Assert.Contains("session:open", verification.Identity.Scopes);
-
-        IReadOnlyList<ApiKeyAuditRecord> auditRecords = await services
-            .GetRequiredService<IApiKeyAuditStore>()
-            .ListRecentAsync(10, CancellationToken.None);
-
-        Assert.Contains(auditRecords, record => record.EventType == "create-key" && record.KeyId == "operator01");
-    }
-
-    [Fact]
-    public async Task ListKeysAsync_DoesNotPrintRawSecret()
-    {
-        await using ServiceProvider services = BuildServices(CreateTempDatabasePath());
-        ApiKeyAdminCliRunner runner = services.GetRequiredService<ApiKeyAdminCliRunner>();
-        string apiKey = await CreateKeyAsync(runner, "operator01");
-        StringWriter listOutput = new();
-
-        await runner.RunAsync(
-            new ApiKeyAdminCommand(
-                Kind: ApiKeyAdminCommandKind.ListKeys,
-                Json: true,
-                SqlitePath: null,
-                Pepper: null,
-                KeyId: null,
-                DisplayName: null,
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
-            listOutput,
-            CancellationToken.None);
-
-        string listJson = listOutput.ToString();
-
-        Assert.Contains("operator01", listJson, StringComparison.Ordinal);
-        Assert.DoesNotContain(apiKey, listJson, StringComparison.Ordinal);
-        Assert.DoesNotContain(ApiKeySecret(apiKey), listJson, StringComparison.Ordinal);
-        Assert.DoesNotContain("secret_hash", listJson, StringComparison.OrdinalIgnoreCase);
-    }
-
-    [Fact]
-    public async Task RevokeKeyAsync_RevokedKeyFailsVerificationAndAudits()
-    {
-        await using ServiceProvider services = BuildServices(CreateTempDatabasePath());
-        ApiKeyAdminCliRunner runner = services.GetRequiredService<ApiKeyAdminCliRunner>();
-        string apiKey = await CreateKeyAsync(runner, "operator01");
-
-        await runner.RunAsync(
-            new ApiKeyAdminCommand(
-                Kind: ApiKeyAdminCommandKind.RevokeKey,
-                Json: true,
-                SqlitePath: null,
-                Pepper: null,
-                KeyId: "operator01",
-                DisplayName: null,
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
-            TextWriter.Null,
-            CancellationToken.None);
-
-        ApiKeyVerificationResult verification = await services
-            .GetRequiredService<IApiKeyVerifier>()
-            .VerifyAsync($"Bearer {apiKey}", CancellationToken.None);
-
-        Assert.False(verification.Succeeded);
-        Assert.Equal(ApiKeyVerificationFailure.KeyRevoked, verification.Failure);
-
-        IReadOnlyList<ApiKeyAuditRecord> auditRecords = await services
-            .GetRequiredService<IApiKeyAuditStore>()
-            .ListRecentAsync(10, CancellationToken.None);
-
-        Assert.Contains(auditRecords, record => record.EventType == "revoke-key" && record.KeyId == "operator01");
-    }
-
-    [Fact]
-    public async Task RotateKeyAsync_PrintsNewSecretOnceAndInvalidatesOldSecret()
-    {
-        await using ServiceProvider services = BuildServices(CreateTempDatabasePath());
-        ApiKeyAdminCliRunner runner = services.GetRequiredService<ApiKeyAdminCliRunner>();
-        string oldApiKey = await CreateKeyAsync(runner, "operator01");
-        StringWriter rotateOutput = new();
-
-        await runner.RunAsync(
-            new ApiKeyAdminCommand(
-                Kind: ApiKeyAdminCommandKind.RotateKey,
-                Json: true,
-                SqlitePath: null,
-                Pepper: null,
-                KeyId: "operator01",
-                DisplayName: null,
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
-            rotateOutput,
-            CancellationToken.None);
-
-        string rotateJson = rotateOutput.ToString();
-        string newApiKey = ReadApiKey(rotateJson);
-
-        Assert.NotEqual(oldApiKey, newApiKey);
-        Assert.Equal(1, CountOccurrences(rotateJson, newApiKey));
-
-        IApiKeyVerifier verifier = services.GetRequiredService<IApiKeyVerifier>();
-        ApiKeyVerificationResult oldVerification = await verifier.VerifyAsync($"Bearer {oldApiKey}", CancellationToken.None);
-        ApiKeyVerificationResult newVerification = await verifier.VerifyAsync($"Bearer {newApiKey}", CancellationToken.None);
-
-        Assert.False(oldVerification.Succeeded);
-        Assert.Equal(ApiKeyVerificationFailure.SecretMismatch, oldVerification.Failure);
-        Assert.True(newVerification.Succeeded);
-    }
-
-    [Fact]
-    public async Task CreateKeyAsync_PrintsRawSecretExactlyOnce()
-    {
-        await using ServiceProvider services = BuildServices(CreateTempDatabasePath());
-        ApiKeyAdminCliRunner runner = services.GetRequiredService<ApiKeyAdminCliRunner>();
-        StringWriter output = new();
-
-        await runner.RunAsync(
-            new ApiKeyAdminCommand(
-                Kind: ApiKeyAdminCommandKind.CreateKey,
-                Json: true,
-                SqlitePath: null,
-                Pepper: null,
-                KeyId: "operator01",
-                DisplayName: "Operator",
-                Scopes: new HashSet<string>(StringComparer.Ordinal)),
-            output,
-            CancellationToken.None);
-
-        string json = output.ToString();
-        string apiKey = ReadApiKey(json);
-
-        Assert.Equal(1, CountOccurrences(json, apiKey));
-        Assert.Equal(1, CountOccurrences(json, ApiKeySecret(apiKey)));
-    }
-
-    private static async Task<string> CreateKeyAsync(ApiKeyAdminCliRunner runner, string keyId)
-    {
-        StringWriter output = new();
-        await runner.RunAsync(
-            new ApiKeyAdminCommand(
-                Kind: ApiKeyAdminCommandKind.CreateKey,
-                Json: true,
-                SqlitePath: null,
-                Pepper: null,
-                KeyId: keyId,
-                DisplayName: "Operator",
-                Scopes: new HashSet<string>(StringComparer.Ordinal) { "session:open" }),
-            output,
-            CancellationToken.None);
-
-        return ReadApiKey(output.ToString());
-    }
-
-    private static ServiceProvider BuildServices(string databasePath)
-    {
-        IConfigurationRoot configuration = new ConfigurationBuilder()
-            .AddInMemoryCollection(
-                new Dictionary<string, string?>
-                {
-                    ["MxGateway:Authentication:SqlitePath"] = databasePath,
-                    ["MxGateway:ApiKeyPepper"] = "test-pepper"
-                })
-            .Build();
-
-        ServiceCollection services = new();
-        services.AddSingleton<IConfiguration>(configuration);
-        services.AddGatewayConfiguration();
-        services.AddSqliteAuthStore();
-
-        return services.BuildServiceProvider(validateScopes: true);
-    }
-
-    private static string CreateTempDatabasePath()
-    {
-        string directory = Path.Combine(Path.GetTempPath(), "mxgateway-auth-cli-tests", Guid.NewGuid().ToString("N"));
-        Directory.CreateDirectory(directory);
-
-        return Path.Combine(directory, "gateway-auth.db");
-    }
-
-    private static string ReadApiKey(string json)
-    {
-        using JsonDocument document = JsonDocument.Parse(json);
-
-        return document.RootElement.GetProperty("ApiKey").GetString()
-            ?? throw new InvalidOperationException("API key was not present in command output.");
-    }
-
-    private static string ApiKeySecret(string apiKey)
-    {
-        string[] parts = apiKey.Split('_', 3);
-
-        return parts[2];
-    }
-
-    private static int CountOccurrences(string value, string pattern)
-    {
-        int count = 0;
-        int index = 0;
-
-        while ((index = value.IndexOf(pattern, index, StringComparison.Ordinal)) >= 0)
-        {
-            count++;
-            index += pattern.Length;
-        }
-
-        return count;
-    }
-}

src/MxGateway.Tests/Security/Authentication/ApiKeyAdminCommandLineParserTests.cs

@@ -1,70 +0,0 @@
-using MxGateway.Server.Security.Authentication;
-
-namespace MxGateway.Tests.Security.Authentication;
-
-public sealed class ApiKeyAdminCommandLineParserTests
-{
-    [Fact]
-    public void Parse_NonApiKeyCommand_ReturnsNotApiKeyCommand()
-    {
-        ApiKeyAdminParseResult result = ApiKeyAdminCommandLineParser.Parse(["--urls=http://localhost:5000"]);
-
-        Assert.False(result.IsApiKeyCommand);
-        Assert.Null(result.Command);
-    }
-
-    [Fact]
-    public void Parse_CreateKeyCommand_ReturnsOptions()
-    {
-        ApiKeyAdminParseResult result = ApiKeyAdminCommandLineParser.Parse(
-            [
-                "apikey",
-                "create-key",
-                "--key-id",
-                "operator01",
-                "--display-name",
-                "Operator",
-                "--scopes",
-                "session:open,events:read",
-                "--sqlite-path",
-                "auth.db",
-                "--pepper",
-                "pepper",
-                "--json"
-            ]);
-
-        Assert.True(result.IsApiKeyCommand);
-        Assert.Null(result.Error);
-        Assert.NotNull(result.Command);
-        Assert.Equal(ApiKeyAdminCommandKind.CreateKey, result.Command.Kind);
-        Assert.True(result.Command.Json);
-        Assert.Equal("operator01", result.Command.KeyId);
-        Assert.Equal("Operator", result.Command.DisplayName);
-        Assert.Equal("auth.db", result.Command.SqlitePath);
-        Assert.Equal("pepper", result.Command.Pepper);
-        Assert.Contains("session:open", result.Command.Scopes);
-        Assert.Contains("events:read", result.Command.Scopes);
-    }
-
-    [Fact]
-    public void Parse_CreateKeyWithoutDisplayName_ReturnsError()
-    {
-        ApiKeyAdminParseResult result = ApiKeyAdminCommandLineParser.Parse(
-            ["apikey", "create-key", "--key-id", "operator01"]);
-
-        Assert.True(result.IsApiKeyCommand);
-        Assert.Null(result.Command);
-        Assert.Contains("--display-name", result.Error, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public void Parse_KeyIdWithUnderscore_ReturnsError()
-    {
-        ApiKeyAdminParseResult result = ApiKeyAdminCommandLineParser.Parse(
-            ["apikey", "revoke-key", "--key-id", "operator_01"]);
-
-        Assert.True(result.IsApiKeyCommand);
-        Assert.Null(result.Command);
-        Assert.Contains("letters, numbers, periods, and hyphens", result.Error, StringComparison.Ordinal);
-    }
-}

src/MxGateway.Tests/Security/Authentication/ApiKeyParserTests.cs

@@ -1,38 +0,0 @@
-using MxGateway.Server.Security.Authentication;
-
-namespace MxGateway.Tests.Security.Authentication;
-
-public sealed class ApiKeyParserTests
-{
-    [Fact]
-    public void TryParseAuthorizationHeader_ValidBearerToken_ReturnsKeyIdAndSecret()
-    {
-        ApiKeyParser parser = new();
-
-        bool parsed = parser.TryParseAuthorizationHeader(
-            "Bearer mxgw_operator01_secret_value",
-            out ParsedApiKey? apiKey);
-
-        Assert.True(parsed);
-        Assert.NotNull(apiKey);
-        Assert.Equal("operator01", apiKey.KeyId);
-        Assert.Equal("secret_value", apiKey.Secret);
-    }
-
-    [Theory]
-    [InlineData(null)]
-    [InlineData("")]
-    [InlineData("mxgw_operator01_secret")]
-    [InlineData("Bearer not-a-gateway-key")]
-    [InlineData("Bearer mxgw__secret")]
-    [InlineData("Bearer mxgw_operator01_")]
-    public void TryParseAuthorizationHeader_MalformedToken_ReturnsFalse(string? authorizationHeader)
-    {
-        ApiKeyParser parser = new();
-
-        bool parsed = parser.TryParseAuthorizationHeader(authorizationHeader, out ParsedApiKey? apiKey);
-
-        Assert.False(parsed);
-        Assert.Null(apiKey);
-    }
-}

src/MxGateway.Tests/Security/Authentication/ApiKeySecretHasherTests.cs

@@ -1,62 +0,0 @@
-using Microsoft.Extensions.Configuration;
-using Microsoft.Extensions.Options;
-using MxGateway.Server.Configuration;
-using MxGateway.Server.Security.Authentication;
-
-namespace MxGateway.Tests.Security.Authentication;
-
-public sealed class ApiKeySecretHasherTests
-{
-    [Fact]
-    public void HashSecret_SamePepperAndSecret_ReturnsSameHash()
-    {
-        ApiKeySecretHasher hasher = CreateHasher("pepper-one");
-
-        byte[] firstHash = hasher.HashSecret("raw-secret");
-        byte[] secondHash = hasher.HashSecret("raw-secret");
-
-        Assert.Equal(firstHash, secondHash);
-        Assert.NotEqual("raw-secret"u8.ToArray(), firstHash);
-    }
-
-    [Fact]
-    public void HashSecret_DifferentPepper_ReturnsDifferentHash()
-    {
-        byte[] firstHash = CreateHasher("pepper-one").HashSecret("raw-secret");
-        byte[] secondHash = CreateHasher("pepper-two").HashSecret("raw-secret");
-
-        Assert.NotEqual(firstHash, secondHash);
-    }
-
-    [Fact]
-    public void HashSecret_MissingPepper_Throws()
-    {
-        ApiKeySecretHasher hasher = CreateHasher(pepper: null);
-
-        Assert.Throws<ApiKeyPepperUnavailableException>(() => hasher.HashSecret("raw-secret"));
-    }
-
-    private static ApiKeySecretHasher CreateHasher(string? pepper)
-    {
-        Dictionary<string, string?> values = [];
-
-        if (pepper is not null)
-        {
-            values["TestPepper"] = pepper;
-        }
-
-        IConfigurationRoot configuration = new ConfigurationBuilder()
-            .AddInMemoryCollection(values)
-            .Build();
-
-        GatewayOptions options = new()
-        {
-            Authentication = new AuthenticationOptions
-            {
-                PepperSecretName = "TestPepper"
-            }
-        };
-
-        return new ApiKeySecretHasher(configuration, Options.Create(options));
-    }
-}

src/MxGateway.Tests/Security/Authentication/ApiKeyVerifierTests.cs

@@ -1,193 +0,0 @@
-using System.Text.Json;
-using Microsoft.Extensions.Configuration;
-using Microsoft.Extensions.Options;
-using MxGateway.Server.Configuration;
-using MxGateway.Server.Security.Authentication;
-
-namespace MxGateway.Tests.Security.Authentication;
-
-public sealed class ApiKeyVerifierTests
-{
-    [Fact]
-    public async Task VerifyAsync_ValidKey_ReturnsIdentityAndScopes()
-    {
-        ApiKeySecretHasher hasher = CreateHasher("pepper");
-        FakeApiKeyStore store = new(CreateRecord(hasher, revokedUtc: null));
-        ApiKeyVerifier verifier = new(new ApiKeyParser(), hasher, store);
-
-        ApiKeyVerificationResult result = await verifier.VerifyAsync(
-            "Bearer mxgw_operator01_correct-secret",
-            CancellationToken.None);
-
-        Assert.True(result.Succeeded);
-        Assert.NotNull(result.Identity);
-        Assert.Equal("operator01", result.Identity.KeyId);
-        Assert.Equal("Operator Key", result.Identity.DisplayName);
-        Assert.Contains("session:open", result.Identity.Scopes);
-        Assert.Contains("events:read", result.Identity.Scopes);
-        Assert.True(store.MarkedUsed);
-    }
-
-    [Fact]
-    public async Task VerifyAsync_ValidKey_DoesNotExposeRawSecretInResult()
-    {
-        ApiKeySecretHasher hasher = CreateHasher("pepper");
-        FakeApiKeyStore store = new(CreateRecord(hasher, revokedUtc: null));
-        ApiKeyVerifier verifier = new(new ApiKeyParser(), hasher, store);
-
-        ApiKeyVerificationResult result = await verifier.VerifyAsync(
-            "Bearer mxgw_operator01_correct-secret",
-            CancellationToken.None);
-
-        string serialized = JsonSerializer.Serialize(result);
-
-        Assert.DoesNotContain("correct-secret", serialized, StringComparison.Ordinal);
-    }
-
-    [Theory]
-    [InlineData(null)]
-    [InlineData("Bearer mxgw_operator01")]
-    [InlineData("Bearer wrong")]
-    public async Task VerifyAsync_MalformedKey_FailsUnauthenticated(string? authorizationHeader)
-    {
-        ApiKeyVerifier verifier = new(
-            new ApiKeyParser(),
-            CreateHasher("pepper"),
-            new FakeApiKeyStore(storedKey: null));
-
-        ApiKeyVerificationResult result = await verifier.VerifyAsync(
-            authorizationHeader,
-            CancellationToken.None);
-
-        Assert.False(result.Succeeded);
-        Assert.Equal(ApiKeyVerificationFailure.MissingOrMalformedCredentials, result.Failure);
-    }
-
-    [Fact]
-    public async Task VerifyAsync_UnknownKey_Fails()
-    {
-        ApiKeyVerifier verifier = new(
-            new ApiKeyParser(),
-            CreateHasher("pepper"),
-            new FakeApiKeyStore(storedKey: null));
-
-        ApiKeyVerificationResult result = await verifier.VerifyAsync(
-            "Bearer mxgw_missing_secret",
-            CancellationToken.None);
-
-        Assert.False(result.Succeeded);
-        Assert.Equal(ApiKeyVerificationFailure.KeyNotFound, result.Failure);
-    }
-
-    [Fact]
-    public async Task VerifyAsync_WrongSecret_Fails()
-    {
-        ApiKeySecretHasher hasher = CreateHasher("pepper");
-        FakeApiKeyStore store = new(CreateRecord(hasher, revokedUtc: null));
-        ApiKeyVerifier verifier = new(new ApiKeyParser(), hasher, store);
-
-        ApiKeyVerificationResult result = await verifier.VerifyAsync(
-            "Bearer mxgw_operator01_wrong-secret",
-            CancellationToken.None);
-
-        Assert.False(result.Succeeded);
-        Assert.Equal(ApiKeyVerificationFailure.SecretMismatch, result.Failure);
-        Assert.False(store.MarkedUsed);
-    }
-
-    [Fact]
-    public async Task VerifyAsync_RevokedKey_Fails()
-    {
-        ApiKeySecretHasher hasher = CreateHasher("pepper");
-        FakeApiKeyStore store = new(CreateRecord(hasher, DateTimeOffset.UtcNow));
-        ApiKeyVerifier verifier = new(new ApiKeyParser(), hasher, store);
-
-        ApiKeyVerificationResult result = await verifier.VerifyAsync(
-            "Bearer mxgw_operator01_correct-secret",
-            CancellationToken.None);
-
-        Assert.False(result.Succeeded);
-        Assert.Equal(ApiKeyVerificationFailure.KeyRevoked, result.Failure);
-        Assert.False(store.MarkedUsed);
-    }
-
-    [Fact]
-    public async Task VerifyAsync_MissingPepper_Fails()
-    {
-        FakeApiKeyStore store = new(CreateRecord(CreateHasher("pepper"), revokedUtc: null));
-        ApiKeyVerifier verifier = new(new ApiKeyParser(), CreateHasher(pepper: null), store);
-
-        ApiKeyVerificationResult result = await verifier.VerifyAsync(
-            "Bearer mxgw_operator01_correct-secret",
-            CancellationToken.None);
-
-        Assert.False(result.Succeeded);
-        Assert.Equal(ApiKeyVerificationFailure.PepperUnavailable, result.Failure);
-    }
-
-    private static ApiKeyRecord CreateRecord(ApiKeySecretHasher hasher, DateTimeOffset? revokedUtc)
-    {
-        return new ApiKeyRecord(
-            KeyId: "operator01",
-            KeyPrefix: "mxgw_operator01",
-            SecretHash: hasher.HashSecret("correct-secret"),
-            DisplayName: "Operator Key",
-            Scopes: new HashSet<string>(StringComparer.Ordinal)
-            {
-                "session:open",
-                "events:read"
-            },
-            CreatedUtc: DateTimeOffset.UtcNow,
-            LastUsedUtc: null,
-            RevokedUtc: revokedUtc);
-    }
-
-    private static ApiKeySecretHasher CreateHasher(string? pepper)
-    {
-        Dictionary<string, string?> values = [];
-
-        if (pepper is not null)
-        {
-            values["TestPepper"] = pepper;
-        }
-
-        IConfigurationRoot configuration = new ConfigurationBuilder()
-            .AddInMemoryCollection(values)
-            .Build();
-
-        GatewayOptions options = new()
-        {
-            Authentication = new AuthenticationOptions
-            {
-                PepperSecretName = "TestPepper"
-            }
-        };
-
-        return new ApiKeySecretHasher(configuration, Options.Create(options));
-    }
-
-    private sealed class FakeApiKeyStore(ApiKeyRecord? storedKey) : IApiKeyStore
-    {
-        public bool MarkedUsed { get; private set; }
-
-        public Task<ApiKeyRecord?> FindByKeyIdAsync(string keyId, CancellationToken cancellationToken)
-        {
-            return Task.FromResult(storedKey?.KeyId == keyId ? storedKey : null);
-        }
-
-        public Task<ApiKeyRecord?> FindActiveByKeyIdAsync(string keyId, CancellationToken cancellationToken)
-        {
-            return Task.FromResult(
-                storedKey?.KeyId == keyId && storedKey.RevokedUtc is null
-                    ? storedKey
-                    : null);
-        }
-
-        public Task MarkKeyUsedAsync(string keyId, DateTimeOffset usedUtc, CancellationToken cancellationToken)
-        {
-            MarkedUsed = storedKey?.KeyId == keyId;
-
-            return Task.CompletedTask;
-        }
-    }
-}