diff --git a/ONBOARDING_FLOW_DIAGRAM.md b/ONBOARDING_FLOW_DIAGRAM.md
deleted file mode 100644
index e69de29b..00000000
diff --git a/ONBOARDING_IMPLEMENTATION_SUMMARY.md b/ONBOARDING_IMPLEMENTATION_SUMMARY.md
deleted file mode 100644
index 434ff43e..00000000
--- a/ONBOARDING_IMPLEMENTATION_SUMMARY.md
+++ /dev/null
@@ -1,196 +0,0 @@
-# Onboarding Flow Backend Integration - Implementation Summary
-
-## ✅ Completed Tasks
-
-### 1. API Service Layer
-
-**File**: `frontend/lib/api/userApi.ts`
-
-- Created `updateUserProfile()` function for PATCH `/users/{userId}`
-- Implemented comprehensive error handling with custom `UserApiError` class
-- Added authentication via Bearer token from localStorage
-- Network error detection with user-friendly messages
-- Proper TypeScript types for request/response
-
-### 2. React Hook
-
-**File**: `frontend/hooks/useUpdateUserProfile.ts`
-
-- Created `useUpdateUserProfile()` custom hook
-- Manages loading, error states
-- Integrates with Redux auth store via `useAuth()`
-- Updates user data in store after successful API call
-- Provides `clearError()` for error recovery
-
-### 3. Enum Mapping Utility
-
-**File**: `frontend/lib/utils/onboardingMapper.ts`
-
-- Maps frontend display values to backend enum values
-- Handles all 4 data types: challengeLevel, challengeTypes, referralSource, ageGroup
-- Ensures data compatibility between frontend and backend
-
-### 4. OnboardingContext Updates
-
-**File**: `frontend/app/onboarding/OnboardingContext.tsx`
-
-- Simplified data structure to match backend requirements
-- Removed nested objects (additionalInfo, availability)
-- Added `resetData()` method to clear state after successful save
-- Maintains state across all onboarding steps
-
-### 5. Additional Info Page Integration
-
-**File**: `frontend/app/onboarding/additional-info/page.tsx`
-
-- Integrated API call on final step completion
-- Added loading screen with animated progress bar
-- Added error screen with retry functionality
-- Implements proper data mapping before API call
-- Redirects to dashboard on success
-- Resets onboarding context after save
-
-### 6. Documentation
-
-**File**: `frontend/docs/ONBOARDING_INTEGRATION.md`
-
-- Comprehensive architecture documentation
-- Data flow diagrams
-- Error handling guide
-- Testing checklist
-- Future enhancement suggestions
-
-## 🎯 Key Features Implemented
-
-### ✅ Single API Call
-
-- All onboarding data collected across 4 steps
-- Single PATCH request made only on final step completion
-- No intermediate API calls
-
-### ✅ Loading States
-
-- "Preparing your account..." loading screen
-- Animated progress bar (0-100%)
-- Smooth transitions
-
-### ✅ Error Handling
-
-- Network errors: "Unable to connect. Please check your internet connection."
-- Auth errors: "Unauthorized. Please log in again."
-- Validation errors: Display specific field errors from backend
-- Server errors: "Something went wrong. Please try again."
-- Retry functionality
-- Skip option to proceed to dashboard
-
-### ✅ Form Validation
-
-- Continue buttons disabled until selection made
-- Data format validation via enum mapping
-- Authentication check before submission
-
-### ✅ Success Flow
-
-- Redux store updated with new user data
-- Onboarding context reset
-- Automatic redirect to `/dashboard`
-- No re-showing of onboarding (context cleared)
-
-### ✅ User Experience
-
-- Back navigation works on all steps
-- Progress bar shows completion percentage
-- Clear error messages
-- Retry and skip options on error
-- Smooth animations and transitions
-
-## 📋 Acceptance Criteria Status
-
-| Criteria                                      | Status | Notes                           |
-| --------------------------------------------- | ------ | ------------------------------- |
-| Onboarding data collected from all four steps | ✅     | Via OnboardingContext           |
-| API call made only after step 4 completion    | ✅     | In additional-info page         |
-| Single PATCH request with all data            | ✅     | updateUserProfile()             |
-| "Preparing account" loading state shown       | ✅     | With animated progress          |
-| On success, redirect to /dashboard            | ✅     | router.push('/dashboard')       |
-| On error, show message with retry             | ✅     | Error screen component          |
-| Form validation prevents invalid data         | ✅     | Enum mapping + disabled buttons |
-| Loading and error states handled              | ✅     | Comprehensive state management  |
-| User cannot skip onboarding                   | ✅     | No skip buttons on steps 1-3    |
-
-## 🔧 Technical Details
-
-### API Endpoint
-
-```
-PATCH /users/{userId}
-Authorization: Bearer {accessToken}
-Content-Type: application/json
-```
-
-### Request Body Structure
-
-```json
-{
-  "challengeLevel": "beginner",
-  "challengeTypes": ["Coding Challenges", "Logic Puzzle"],
-  "referralSource": "Google Search",
-  "ageGroup": "18-24 years old"
-}
-```
-
-### Authentication
-
-- Token retrieved from localStorage ('accessToken')
-- User ID from Redux auth store
-- Automatic 401 handling
-
-### State Management
-
-- OnboardingContext: Temporary onboarding data
-- Redux Auth Store: Persistent user data
-- Context reset after successful save
-
-## 🧪 Testing Recommendations
-
-1. **Happy Path**
-   - Complete all 4 steps
-   - Verify API call with correct data
-   - Confirm redirect to dashboard
-   - Check Redux store updated
-
-2. **Error Scenarios**
-   - Network offline: Check error message
-   - Invalid token: Check auth error
-   - Server error: Check retry functionality
-   - Validation error: Check field errors
-
-3. **Navigation**
-   - Back button on each step
-   - Progress bar updates correctly
-   - Data persists across navigation
-
-4. **Edge Cases**
-   - User not authenticated
-   - Missing token
-   - Incomplete data
-   - Multiple rapid submissions
-
-## 📝 Notes
-
-- All TypeScript types properly defined
-- No console errors or warnings
-- Follows existing code patterns
-- Minimal dependencies added
-- Clean separation of concerns
-- Comprehensive error handling
-- User-friendly error messages
-
-## 🚀 Next Steps (Optional Enhancements)
-
-1. Add onboarding completion flag to prevent re-showing
-2. Implement progress persistence in localStorage
-3. Add analytics tracking
-4. Add skip option on earlier steps (if fields are optional)
-5. Add client-side validation before submission
-6. Add loading skeleton for dashboard after redirect
diff --git a/ONBOARDING_QUICKSTART.md b/ONBOARDING_QUICKSTART.md
deleted file mode 100644
index 67bb541d..00000000
--- a/ONBOARDING_QUICKSTART.md
+++ /dev/null
@@ -1,268 +0,0 @@
-# Onboarding Integration - Quick Start Guide
-
-## 🚀 What Was Built
-
-The onboarding flow now saves user data to the backend when users complete all 4 steps.
-
-## 📁 New Files Created
-
-```
-frontend/
-├── lib/
-│   ├── api/
-│   │   └── userApi.ts                    # API service for user profile updates
-│   └── utils/
-│       └── onboardingMapper.ts           # Maps frontend values to backend enums
-├── hooks/
-│   └── useUpdateUserProfile.ts           # React hook for profile updates
-└── docs/
-    └── ONBOARDING_INTEGRATION.md         # Detailed documentation
-```
-
-## 📝 Modified Files
-
-```
-frontend/app/onboarding/
-├── OnboardingContext.tsx                 # Simplified data structure
-└── additional-info/page.tsx              # Added API integration
-```
-
-## 🔄 How It Works
-
-### User Flow
-
-1. User selects challenge level → stored in context
-2. User selects challenge types → stored in context
-3. User selects referral source → stored in context
-4. User selects age group → **API call triggered**
-5. Loading screen shows "Preparing your account..."
-6. On success → Redirect to dashboard
-7. On error → Show error with retry option
-
-### Technical Flow
-
-```
-OnboardingContext (state)
-    ↓
-additional-info/page.tsx (final step)
-    ↓
-useUpdateUserProfile() hook
-    ↓
-updateUserProfile() API call
-    ↓
-PATCH /users/{userId}
-    ↓
-Success: Update Redux + Redirect
-Error: Show error screen
-```
-
-## 🧪 How to Test
-
-### 1. Start the Application
-
-```bash
-# Backend
-cd backend
-npm run start:dev
-
-# Frontend
-cd frontend
-npm run dev
-```
-
-### 2. Test Happy Path
-
-1. Navigate to `/onboarding`
-2. Complete all 4 steps
-3. Verify loading screen appears
-4. Verify redirect to `/dashboard`
-5. Check browser DevTools Network tab for PATCH request
-6. Verify user data saved in database
-
-### 3. Test Error Handling
-
-```bash
-# Test network error (stop backend)
-npm run stop
-
-# Test auth error (clear localStorage)
-localStorage.removeItem('accessToken')
-
-# Test validation error (modify enum values)
-```
-
-## 🔍 Debugging
-
-### Check API Call
-
-```javascript
-// Open browser console on final onboarding step
-// Look for:
-// - PATCH request to /users/{userId}
-// - Request headers (Authorization: Bearer ...)
-// - Request body (challengeLevel, challengeTypes, etc.)
-// - Response status (200 = success)
-```
-
-### Check State
-
-```javascript
-// In OnboardingContext
-console.log("Onboarding data:", data);
-
-// In useUpdateUserProfile
-console.log("Loading:", isLoading);
-console.log("Error:", error);
-```
-
-### Common Issues
-
-**Issue**: "User not authenticated" error
-
-- **Fix**: Ensure user is logged in and token exists in localStorage
-
-**Issue**: API call returns 400 validation error
-
-- **Fix**: Check enum mapping in `onboardingMapper.ts`
-
-**Issue**: Loading screen stuck
-
-- **Fix**: Check network tab for failed request, verify backend is running
-
-**Issue**: Redirect not working
-
-- **Fix**: Check router.push('/dashboard') is called after success
-
-## 📊 API Request Example
-
-### Request
-
-```http
-PATCH /users/123e4567-e89b-12d3-a456-426614174000
-Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
-Content-Type: application/json
-
-{
-  "challengeLevel": "intermediate",
-  "challengeTypes": ["Coding Challenges", "Logic Puzzle"],
-  "referralSource": "Google Search",
-  "ageGroup": "25-34 years old"
-}
-```
-
-### Response (Success)
-
-```json
-{
-  "id": "123e4567-e89b-12d3-a456-426614174000",
-  "username": "john_doe",
-  "email": "john@example.com",
-  "challengeLevel": "intermediate",
-  "challengeTypes": ["Coding Challenges", "Logic Puzzle"],
-  "referralSource": "Google Search",
-  "ageGroup": "25-34 years old",
-  "xp": 0,
-  "level": 1
-}
-```
-
-### Response (Error)
-
-```json
-{
-  "statusCode": 400,
-  "message": "Validation failed",
-  "error": "Bad Request"
-}
-```
-
-## 🎨 UI States
-
-### Loading State
-
-- Animated puzzle icon (bouncing)
-- Progress bar (0-100%)
-- Message: "Preparing your account..."
-
-### Error State
-
-- Red error icon
-- Error message (specific to error type)
-- "Try Again" button
-- "Skip for now" link
-
-### Success State
-
-- Automatic redirect to dashboard
-- No manual confirmation needed
-
-## 🔐 Security
-
-- ✅ Authentication required (Bearer token)
-- ✅ User ID from authenticated session
-- ✅ Token stored securely in localStorage
-- ✅ HTTPS recommended for production
-- ✅ No sensitive data in URL params
-
-## 📈 Monitoring
-
-### What to Monitor
-
-- API success rate
-- Average response time
-- Error types and frequency
-- Completion rate (users who finish all steps)
-- Drop-off points (which step users leave)
-
-### Logging
-
-```javascript
-// Add to production
-console.log("Onboarding completed:", {
-  userId: user.id,
-  timestamp: new Date().toISOString(),
-  data: profileData,
-});
-```
-
-## 🚨 Error Messages
-
-| Error Type       | User Message                                                | Action            |
-| ---------------- | ----------------------------------------------------------- | ----------------- |
-| Network          | "Unable to connect. Please check your internet connection." | Retry             |
-| Auth (401)       | "Unauthorized. Please log in again."                        | Redirect to login |
-| Validation (400) | "Invalid data provided"                                     | Show field errors |
-| Server (500)     | "Something went wrong. Please try again."                   | Retry             |
-| Unknown          | "An unexpected error occurred. Please try again."           | Retry             |
-
-## ✅ Checklist Before Deployment
-
-- [ ] Environment variable `NEXT_PUBLIC_API_URL` set correctly
-- [ ] Backend endpoint `/users/{userId}` is accessible
-- [ ] Authentication middleware configured
-- [ ] CORS enabled for frontend domain
-- [ ] Error logging configured
-- [ ] Analytics tracking added (optional)
-- [ ] Load testing completed
-- [ ] User acceptance testing completed
-
-## 📞 Support
-
-For issues or questions:
-
-1. Check `frontend/docs/ONBOARDING_INTEGRATION.md` for detailed docs
-2. Review `ONBOARDING_IMPLEMENTATION_SUMMARY.md` for architecture
-3. Check browser console for errors
-4. Check backend logs for API errors
-5. Verify environment variables are set
-
-## 🎯 Success Metrics
-
-- ✅ All 4 onboarding steps navigate correctly
-- ✅ Data persists across navigation
-- ✅ API call succeeds with correct data
-- ✅ Loading state shows during API call
-- ✅ Success redirects to dashboard
-- ✅ Errors show user-friendly messages
-- ✅ Retry functionality works
-- ✅ No console errors or warnings
diff --git a/PR_MESSAGE.md b/PR_MESSAGE.md
new file mode 100644
index 00000000..ce7737dd
--- /dev/null
+++ b/PR_MESSAGE.md
@@ -0,0 +1,131 @@
+# PR: Middleware Performance Benchmarks & External Plugin System
+
+## Overview
+
+This PR adds two major features to the `@mindblock/middleware` package:
+
+1. **Per-Middleware Performance Benchmarks** - Automated tooling to measure latency overhead of each middleware individually
+2. **External Plugin Loader** - Complete system for dynamically loading and managing middleware plugins from npm packages
+
+All implementation is confined to the middleware repository with no backend modifications.
+
+## Features
+
+### Performance Benchmarks (#369)
+
+- Automated benchmarking script measuring middleware overhead against baseline
+- Tracks requests/second, latency percentiles (p50, p95, p99), and error rates
+- Individual profiling for JWT Auth, RBAC, Security Headers, Timeout, Circuit Breaker, Correlation ID
+- Compare middlewares by contribution to overall latency
+- CLI commands: `npm run benchmark` and `npm run benchmark:ci`
+
+**Files:**
+- `scripts/benchmark.ts` - Load testing implementation
+- `docs/PERFORMANCE.md` - Benchmarking documentation (updated)
+- `tests/integration/benchmark.integration.spec.ts` - Test coverage
+
+### External Plugin Loader System
+
+- **PluginInterface** - Standard contract for all plugins
+- **PluginLoader** - Low-level discovery, loading, and lifecycle management
+- **PluginRegistry** - High-level plugin orchestration and management
+- Plugin lifecycle hooks: `onLoad`, `onInit`, `onActivate`, `onDeactivate`, `onUnload`, `onReload`
+- Configuration validation with JSON Schema support
+- Semantic version compatibility checking
+- Plugin dependency resolution
+- Priority-based execution ordering
+- Comprehensive error handling (10 custom error types)
+
+**Files:**
+- `src/common/interfaces/plugin.interface.ts` - Plugin types and metadata
+- `src/common/interfaces/plugin.errors.ts` - Error classes
+- `src/common/utils/plugin-loader.ts` - Loader service (650+ lines)
+- `src/common/utils/plugin-registry.ts` - Registry service (400+ lines)
+- `src/plugins/example.plugin.ts` - Template plugin for developers
+- `docs/PLUGINS.md` - Complete plugin documentation (750+ lines)
+- `docs/PLUGIN_QUICKSTART.md` - Quick start guide for plugin developers (600+ lines)
+- `tests/integration/plugin-system.integration.spec.ts` - Integration tests
+
+## Usage
+
+### Performance Benchmarking
+
+```bash
+npm run benchmark
+```
+
+Outputs comprehensive latency overhead comparison for each middleware.
+
+### Loading Plugins
+
+```typescript
+import { PluginRegistry } from '@mindblock/middleware';
+
+const registry = new PluginRegistry({ autoLoadEnabled: true });
+await registry.init();
+
+const plugin = await registry.load('@yourorg/plugin-example');
+await registry.initialize(plugin.metadata.id);
+await registry.activate(plugin.metadata.id);
+```
+
+### Creating Plugins
+
+Developers can create plugins by implementing `PluginInterface`:
+
+```typescript
+export class MyPlugin implements PluginInterface {
+  metadata: PluginMetadata = {
+    id: 'com.org.plugin.example',
+    name: 'My Plugin',
+    version: '1.0.0',
+    description: 'My custom middleware'
+  };
+
+  getMiddleware() {
+    return (req, res, next) => { /* middleware logic */ };
+  }
+}
+```
+
+Publish to npm with scoped name (`@yourorg/plugin-name`) and users can discover and load automatically.
+
+## Testing
+
+- Benchmark integration tests validate middleware setup
+- Plugin system tests cover:
+  - Plugin interface validation
+  - Lifecycle hook execution
+  - Configuration validation
+  - Dependency resolution
+  - Error handling
+  - Batch operations
+
+Run tests: `npm test`
+
+## Dependencies Added
+
+- `autocannon@^7.15.0` - Load testing library (already installed, fallback to simple HTTP client)
+- `semver@^7.6.0` - Semantic version validation
+- `@types/semver@^7.5.8` - TypeScript definitions
+- `ts-node@^10.9.2` - TypeScript execution
+
+## Documentation
+
+- **PERFORMANCE.md** - Performance optimization guide and benchmarking docs
+- **PLUGINS.md** - Comprehensive plugin system documentation with examples
+- **PLUGIN_QUICKSTART.md** - Quick start for plugin developers with patterns and examples
+- **README.md** - Updated with plugin system overview
+
+## Breaking Changes
+
+None. All additions are backward compatible.
+
+## Commits
+
+- `4f83f97` - feat: #369 add per-middleware performance benchmarks
+- `1e04e8f` - feat: External Plugin Loader for npm packages
+
+---
+
+**Ready for review and merge into main after testing!**
diff --git a/middleware/README.md b/middleware/README.md
index 39c04a88..38c23c68 100644
--- a/middleware/README.md
+++ b/middleware/README.md
@@ -20,6 +20,126 @@ Keeping middleware in its own workspace package makes it:
 - Monitoring
 - Validation
 - Common utilities
+- **Plugin System** - Load custom middleware from npm packages
+
+## Plugin System
+
+The package includes an **External Plugin Loader** system that allows you to dynamically load and manage middleware plugins from npm packages.
+
+```typescript
+import { PluginRegistry } from '@mindblock/middleware';
+
+// Create and initialize registry
+const registry = new PluginRegistry();
+await registry.init();
+
+// Load a plugin
+const plugin = await registry.load('@yourorg/plugin-example');
+
+// Activate it
+await registry.activate(plugin.metadata.id);
+
+// Use plugin middleware
+const middlewares = registry.getAllMiddleware();
+app.use(middlewares['com.yourorg.plugin.example']);
+```
+
+**Key Features:**
+- ✅ Dynamic plugin discovery and loading from npm
+- ✅ Plugin lifecycle management (load, init, activate, deactivate, unload)
+- ✅ Configuration validation with JSON Schema support
+- ✅ Dependency resolution between plugins
+- ✅ Version compatibility checking
+- ✅ Plugin registry and search capabilities
+- ✅ Comprehensive error handling
+
+See [PLUGINS.md](docs/PLUGINS.md) for complete documentation on creating and using plugins.
+
+### First-Party Plugins
+
+The middleware package includes several production-ready first-party plugins:
+
+#### 1. Request Logger Plugin (`@mindblock/plugin-request-logger`)
+
+HTTP request logging middleware with configurable verbosity, path filtering, and request ID correlation.
+
+**Features:**
+- Structured request logging with timing information
+- Configurable log levels (debug, info, warn, error)
+- Exclude paths from logging (health checks, metrics, etc.)
+- Request ID correlation and propagation
+- Sensitive header filtering (automatically excludes auth, cookies, API keys)
+- Color-coded terminal output
+- Runtime configuration changes
+
+**Quick Start:**
+```typescript
+const registry = new PluginRegistry();
+await registry.init();
+
+const logger = await registry.load('@mindblock/plugin-request-logger', {
+  enabled: true,
+  options: {
+    logLevel: 'info',
+    excludePaths: ['/health', '/metrics'],
+    colorize: true
+  }
+});
+
+app.use(logger.plugin.getMiddleware());
+```
+
+**Documentation:** See [REQUEST-LOGGER.md](docs/REQUEST-LOGGER.md)
+
+## Lifecycle Error Handling and Timeouts
+
+The plugin system includes comprehensive error handling and timeout management for plugin lifecycle operations.
+
+**Features:**
+- ⏱️ Configurable timeouts for each lifecycle hook
+- 🔄 Automatic retry with exponential backoff
+- 🎯 Four recovery strategies (retry, fail-fast, graceful, rollback)
+- 📊 Execution history and diagnostics
+- 🏥 Plugin health monitoring
+
+**Quick Start:**
+```typescript
+import { LifecycleTimeoutManager, RecoveryStrategy } from '@mindblock/middleware';
+
+const timeoutManager = new LifecycleTimeoutManager();
+
+// Configure timeouts
+timeoutManager.setTimeoutConfig('my-plugin', {
+  onLoad: 5000,
+  onActivate: 3000
+});
+
+// Configure recovery strategy
+timeoutManager.setRecoveryConfig('my-plugin', {
+  strategy: RecoveryStrategy.RETRY,
+  maxRetries: 2,
+  retryDelayMs: 100,
+  backoffMultiplier: 2
+});
+
+// Execute hook with timeout protection
+await timeoutManager.executeWithTimeout(
+  'my-plugin',
+  'onActivate',
+  () => plugin.onActivate(),
+  3000
+);
+```
+
+**Documentation:** See [LIFECYCLE-TIMEOUTS.md](docs/LIFECYCLE-TIMEOUTS.md) and [LIFECYCLE-TIMEOUTS-QUICKSTART.md](docs/LIFECYCLE-TIMEOUTS-QUICKSTART.md)
+
+### Getting Started with Plugins
+
+To quickly start developing a plugin:
+
+1. Read the [Plugin Quick Start Guide](docs/PLUGIN_QUICKSTART.md)
+2. Check out the [Example Plugin](src/plugins/example.plugin.ts)
+3. Review plugin [API Reference](src/common/interfaces/plugin.interface.ts)
 
 ## Installation
 
@@ -43,6 +163,22 @@ You can also import by category (once the exports exist):
 import { /* future exports */ } from '@mindblock/middleware/auth';
 ```
 
+## Performance Benchmarking
+
+This package includes automated performance benchmarks to measure the latency
+overhead of each middleware component individually.
+
+```bash
+# Run performance benchmarks
+npm run benchmark
+
+# Run with CI-friendly output
+npm run benchmark:ci
+```
+
+See [PERFORMANCE.md](docs/PERFORMANCE.md) for detailed benchmarking documentation
+and optimization techniques.
+
 ## Quick Start
 
 Example placeholder usage (actual middleware implementations will be added in later issues):
diff --git a/middleware/docs/CONFIGURATION.md b/middleware/docs/CONFIGURATION.md
deleted file mode 100644
index ada50d15..00000000
--- a/middleware/docs/CONFIGURATION.md
+++ /dev/null
@@ -1,1759 +0,0 @@
-# Middleware Configuration Documentation
-
-## Overview
-
-### Purpose of Configuration Management
-
-The middleware package uses a comprehensive configuration system designed to provide flexibility, security, and maintainability across different deployment environments. Configuration management follows the 12-factor app principles, ensuring that configuration is stored in the environment rather than code.
-
-### Configuration Philosophy (12-Factor App Principles)
-
-Our configuration system adheres to the following 12-factor app principles:
-
-1. **One codebase, many deployments**: Same code runs in development, staging, and production
-2. **Explicitly declare and isolate dependencies**: All dependencies declared in package.json
-3. **Store config in the environment**: All configuration comes from environment variables
-4. **Treat backing services as attached resources**: Database, Redis, and external services configured via URLs
-5. **Strict separation of config and code**: No hardcoded configuration values
-6. **Execute the app as one or more stateless processes**: Configuration makes processes stateless
-7. **Export services via port binding**: Port configuration via environment
-8. **Scale out via the process model**: Configuration supports horizontal scaling
-9. **Maximize robustness with fast startup and graceful shutdown**: Health check configuration
-10. **Keep development, staging, and production as similar as possible**: Consistent config structure
-11. **Treat logs as event streams**: Log level and format configuration
-12. **Admin processes should run as one-off processes**: Configuration supports admin tools
-
-### How Configuration is Loaded
-
-Configuration is loaded in the following order of precedence (highest to lowest):
-
-1. **Environment Variables** - Runtime environment variables
-2. **.env Files** - Local environment files (development only)
-3. **Default Values** - Built-in safe defaults
-
-```typescript
-// Configuration loading order
-const config = {
-  // 1. Environment variables (highest priority)
-  jwtSecret: process.env.JWT_SECRET,
-  
-  // 2. .env file values
-  jwtExpiration: process.env.JWT_EXPIRATION || '1h',
-  
-  // 3. Default values (lowest priority)
-  rateLimitMax: parseInt(process.env.RATE_LIMIT_MAX || '100'),
-};
-```
-
-## Environment Variables
-
-### JWT Authentication
-
-#### JWT_SECRET
-- **Type**: String
-- **Required**: Yes
-- **Description**: Secret key used for signing and verifying JWT tokens
-- **Example**: `"your-super-secret-jwt-key-minimum-32-characters-long"`
-- **Security**: Never commit to Git, use different secrets per environment
-- **Validation**: Must be at least 32 characters long
-
-```bash
-# Generate a secure JWT secret
-JWT_SECRET=$(openssl rand -base64 32)
-```
-
-#### JWT_EXPIRATION
-- **Type**: String
-- **Required**: No
-- **Default**: `"1h"`
-- **Description**: Token expiration time for access tokens
-- **Format**: Zeit/ms format (e.g., "2h", "7d", "10m", "30s")
-- **Examples**: 
-  - `"15m"` - 15 minutes
-  - `"2h"` - 2 hours
-  - `"7d"` - 7 days
-  - `"30d"` - 30 days
-
-#### JWT_REFRESH_EXPIRATION
-- **Type**: String
-- **Required**: No
-- **Default**: `"7d"`
-- **Description**: Expiration time for refresh tokens
-- **Format**: Zeit/ms format
-- **Security**: Should be longer than access token expiration
-
-#### JWT_ISSUER
-- **Type**: String
-- **Required**: No
-- **Default**: `"mindblock-api"`
-- **Description**: JWT token issuer claim
-- **Validation**: Must match between services in distributed systems
-
-#### JWT_AUDIENCE
-- **Type**: String
-- **Required**: No
-- **Default**: `"mindblock-users"`
-- **Description**: JWT token audience claim
-- **Security**: Restricts token usage to specific audiences
-
-### Rate Limiting
-
-#### RATE_LIMIT_WINDOW
-- **Type**: Number (milliseconds)
-- **Required**: No
-- **Default**: `900000` (15 minutes)
-- **Description**: Time window for rate limiting in milliseconds
-- **Examples**:
-  - `60000` - 1 minute
-  - `300000` - 5 minutes
-  - `900000` - 15 minutes
-  - `3600000` - 1 hour
-
-#### RATE_LIMIT_MAX_REQUESTS
-- **Type**: Number
-- **Required**: No
-- **Default**: `100`
-- **Description**: Maximum number of requests per window per IP/user
-- **Examples**:
-  - `10` - Very restrictive (admin endpoints)
-  - `100` - Standard API endpoints
-  - `1000` - Permissive (public endpoints)
-
-#### RATE_LIMIT_REDIS_URL
-- **Type**: String
-- **Required**: No
-- **Description**: Redis connection URL for distributed rate limiting
-- **Format**: Redis connection string
-- **Example**: `"redis://localhost:6379"`
-- **Note**: If not provided, rate limiting falls back to in-memory storage
-
-#### RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `false`
-- **Description**: Whether to count successful requests against rate limit
-- **Values**: `true`, `false`
-
-#### RATE_LIMIT_KEY_GENERATOR
-- **Type**: String
-- **Required**: No
-- **Default**: `"ip"`
-- **Description**: Strategy for generating rate limit keys
-- **Values**: `"ip"`, `"user"`, `"ip+path"`, `"user+path"`
-
-### CORS
-
-#### CORS_ORIGIN
-- **Type**: String (comma-separated)
-- **Required**: No
-- **Default**: `"*"`
-- **Description**: Allowed origins for cross-origin requests
-- **Examples**:
-  - `"*"` - Allow all origins (development only)
-  - `"https://mindblock.app"` - Single origin
-  - `"https://mindblock.app,https://admin.mindblock.app"` - Multiple origins
-  - `"false"` - Disable CORS
-
-#### CORS_CREDENTIALS
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `true`
-- **Description**: Allow credentials (cookies, authorization headers) in CORS requests
-- **Values**: `true`, `false`
-
-#### CORS_METHODS
-- **Type**: String (comma-separated)
-- **Required**: No
-- **Default**: `"GET,POST,PUT,DELETE,OPTIONS"`
-- **Description**: HTTP methods allowed for CORS requests
-
-#### CORS_ALLOWED_HEADERS
-- **Type**: String (comma-separated)
-- **Required**: No
-- **Default**: `"Content-Type,Authorization"`
-- **Description**: HTTP headers allowed in CORS requests
-
-#### CORS_MAX_AGE
-- **Type**: Number (seconds)
-- **Required**: No
-- **Default**: `86400` (24 hours)
-- **Description**: How long results of a preflight request can be cached
-
-### Security Headers
-
-#### HSTS_MAX_AGE
-- **Type**: Number (seconds)
-- **Required**: No
-- **Default**: `31536000` (1 year)
-- **Description**: HTTP Strict Transport Security max-age value
-- **Security**: Set to 0 to disable HSTS in development
-
-#### HSTS_INCLUDE_SUBDOMAINS
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `true`
-- **Description**: Whether to include subdomains in HSTS policy
-
-#### HSTS_PRELOAD
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `false`
-- **Description**: Whether to include preload directive in HSTS policy
-
-#### CSP_DIRECTIVES
-- **Type**: String
-- **Required**: No
-- **Default**: `"default-src 'self'"`
-- **Description**: Content Security Policy directives
-- **Examples**:
-  - `"default-src 'self'; script-src 'self' 'unsafe-inline'"`
-  - `"default-src 'self'; img-src 'self' data: https:"`
-
-#### CSP_REPORT_ONLY
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `false`
-- **Description**: Enable CSP report-only mode for testing
-
-### Logging
-
-#### LOG_LEVEL
-- **Type**: String
-- **Required**: No
-- **Default**: `"info"`
-- **Description**: Minimum log level to output
-- **Values**: `"debug"`, `"info"`, `"warn"`, `"error"`
-- **Hierarchy**: `debug` → `info` → `warn` → `error`
-
-#### LOG_FORMAT
-- **Type**: String
-- **Required**: No
-- **Default**: `"json"`
-- **Description**: Log output format
-- **Values**: `"json"`, `"pretty"`, `"simple"`
-
-#### LOG_FILE_PATH
-- **Type**: String
-- **Required**: No
-- **Description**: Path to log file (if logging to file)
-- **Example**: `"/var/log/mindblock/middleware.log"`
-
-#### LOG_MAX_FILE_SIZE
-- **Type**: String
-- **Required**: No
-- **Default**: `"10m"`
-- **Description**: Maximum log file size before rotation
-- **Format**: Human-readable size (e.g., "10m", "100M", "1G")
-
-#### LOG_MAX_FILES
-- **Type**: Number
-- **Required**: No
-- **Default**: `5`
-- **Description**: Maximum number of log files to keep
-
-#### LOG_REQUEST_BODY
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `false`
-- **Description**: Whether to log request bodies (security consideration)
-
-#### LOG_RESPONSE_BODY
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `false`
-- **Description**: Whether to log response bodies (security consideration)
-
-### Performance
-
-#### COMPRESSION_ENABLED
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `true`
-- **Description**: Enable response compression
-- **Values**: `true`, `false`
-
-#### COMPRESSION_LEVEL
-- **Type**: Number
-- **Required**: No
-- **Default**: `6`
-- **Description**: Compression level (1-9, where 9 is maximum compression)
-- **Trade-off**: Higher compression = more CPU, less bandwidth
-
-#### COMPRESSION_THRESHOLD
-- **Type**: Number (bytes)
-- **Required**: No
-- **Default**: `1024`
-- **Description**: Minimum response size to compress
-- **Example**: `1024` (1KB)
-
-#### COMPRESSION_TYPES
-- **Type**: String (comma-separated)
-- **Required**: No
-- **Default**: `"text/html,text/css,text/javascript,application/json"`
-- **Description**: MIME types to compress
-
-#### REQUEST_TIMEOUT
-- **Type**: Number (milliseconds)
-- **Required**: No
-- **Default**: `30000` (30 seconds)
-- **Description**: Default request timeout
-- **Examples**:
-  - `5000` - 5 seconds (fast APIs)
-  - `30000` - 30 seconds (standard)
-  - `120000` - 2 minutes (slow operations)
-
-#### KEEP_ALIVE_TIMEOUT
-- **Type**: Number (milliseconds)
-- **Required**: No
-- **Default**: `5000` (5 seconds)
-- **Description**: Keep-alive timeout for HTTP connections
-
-#### HEADERS_TIMEOUT
-- **Type**: Number (milliseconds)
-- **Required**: No
-- **Default**: `60000` (1 minute)
-- **Description**: Timeout for receiving headers
-
-### Monitoring
-
-#### ENABLE_METRICS
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `true`
-- **Description**: Enable metrics collection
-- **Values**: `true`, `false`
-
-#### METRICS_PORT
-- **Type**: Number
-- **Required**: No
-- **Default**: `9090`
-- **Description**: Port for metrics endpoint
-- **Note**: Must be different from main application port
-
-#### METRICS_PATH
-- **Type**: String
-- **Required**: No
-- **Default**: `"/metrics"`
-- **Description**: Path for metrics endpoint
-
-#### METRICS_PREFIX
-- **Type**: String
-- **Required**: No
-- **Default**: `"mindblock_middleware_"`
-- **Description**: Prefix for all metric names
-
-#### ENABLE_TRACING
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `false`
-- **Description**: Enable distributed tracing
-- **Values**: `true`, `false`
-
-#### JAEGER_ENDPOINT
-- **Type**: String
-- **Required**: No
-- **Description**: Jaeger collector endpoint
-- **Example**: `"http://localhost:14268/api/traces"`
-
-#### ZIPKIN_ENDPOINT
-- **Type**: String
-- **Required**: No
-- **Description**: Zipkin collector endpoint
-- **Example**: `"http://localhost:9411/api/v2/spans"`
-
-### Validation
-
-#### VALIDATION_STRICT
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `true`
-- **Description**: Enable strict validation mode
-- **Values**: `true`, `false`
-
-#### VALIDATION_WHITELIST
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `true`
-- **Description**: Strip non-whitelisted properties from input
-- **Values**: `true`, `false`
-
-#### VALIDATION_TRANSFORM
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `true`
-- **Description**: Transform input to match expected types
-- **Values**: `true`, `false`
-
-#### VALIDATION_FORBID_NON_WHITELISTED
-- **Type**: Boolean
-- **Required**: No
-- **Default**: `true`
-- **Description**: Reject requests with non-whitelisted properties
-- **Values**: `true`, `false`
-
-#### MAX_REQUEST_SIZE
-- **Type**: String
-- **Required**: No
-- **Default**: `"10mb"`
-- **Description**: Maximum request body size
-- **Format**: Human-readable size (e.g., "1mb", "100kb")
-
-#### MAX_URL_LENGTH
-- **Type**: Number
-- **Required**: No
-- **Default**: `2048`
-- **Description**: Maximum URL length in characters
-
-## Configuration Files
-
-### Development (.env.development)
-
-```bash
-# Development environment configuration
-NODE_ENV=development
-
-# JWT Configuration (less secure for development)
-JWT_SECRET=dev-secret-key-for-development-only-not-secure
-JWT_EXPIRATION=24h
-JWT_REFRESH_EXPIRATION=7d
-
-# Rate Limiting (relaxed for development)
-RATE_LIMIT_WINDOW=60000
-RATE_LIMIT_MAX_REQUESTS=1000
-RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS=false
-
-# CORS (permissive for development)
-CORS_ORIGIN=*
-CORS_CREDENTIALS=true
-
-# Security Headers (relaxed for development)
-HSTS_MAX_AGE=0
-CSP_DIRECTIVES=default-src 'self' 'unsafe-inline' 'unsafe-eval'
-
-# Logging (verbose for development)
-LOG_LEVEL=debug
-LOG_FORMAT=pretty
-LOG_REQUEST_BODY=true
-LOG_RESPONSE_BODY=true
-
-# Performance (optimized for development)
-COMPRESSION_ENABLED=false
-REQUEST_TIMEOUT=60000
-
-# Monitoring (enabled for development)
-ENABLE_METRICS=true
-METRICS_PORT=9090
-
-# Validation (relaxed for development)
-VALIDATION_STRICT=false
-
-# Database (local development)
-DATABASE_URL=postgresql://localhost:5432/mindblock_dev
-REDIS_URL=redis://localhost:6379
-
-# External Services (local development)
-EXTERNAL_API_BASE_URL=http://localhost:3001
-```
-
-### Staging (.env.staging)
-
-```bash
-# Staging environment configuration
-NODE_ENV=staging
-
-# JWT Configuration (secure)
-JWT_SECRET=staging-super-secret-jwt-key-32-chars-minimum
-JWT_EXPIRATION=2h
-JWT_REFRESH_EXPIRATION=7d
-JWT_ISSUER=staging-mindblock-api
-JWT_AUDIENCE=staging-mindblock-users
-
-# Rate Limiting (moderate restrictions)
-RATE_LIMIT_WINDOW=300000
-RATE_LIMIT_MAX_REQUESTS=200
-RATE_LIMIT_REDIS_URL=redis://staging-redis:6379
-RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS=false
-
-# CORS (staging domains)
-CORS_ORIGIN=https://staging.mindblock.app,https://admin-staging.mindblock.app
-CORS_CREDENTIALS=true
-
-# Security Headers (standard security)
-HSTS_MAX_AGE=31536000
-HSTS_INCLUDE_SUBDOMAINS=true
-CSP_DIRECTIVES=default-src 'self'; script-src 'self' 'unsafe-inline'
-
-# Logging (standard logging)
-LOG_LEVEL=info
-LOG_FORMAT=json
-LOG_REQUEST_BODY=false
-LOG_RESPONSE_BODY=false
-
-# Performance (production-like)
-COMPRESSION_ENABLED=true
-COMPRESSION_LEVEL=6
-REQUEST_TIMEOUT=30000
-
-# Monitoring (full monitoring)
-ENABLE_METRICS=true
-ENABLE_TRACING=true
-JAEGER_ENDPOINT=http://jaeger-staging:14268/api/traces
-
-# Validation (standard validation)
-VALIDATION_STRICT=true
-MAX_REQUEST_SIZE=5mb
-
-# Database (staging)
-DATABASE_URL=postgresql://staging-db:5432/mindblock_staging
-REDIS_URL=redis://staging-redis:6379
-
-# External Services (staging)
-EXTERNAL_API_BASE_URL=https://api-staging.mindblock.app
-```
-
-### Production (.env.production)
-
-```bash
-# Production environment configuration
-NODE_ENV=production
-
-# JWT Configuration (maximum security)
-JWT_SECRET=production-super-secret-jwt-key-64-chars-minimum-length
-JWT_EXPIRATION=1h
-JWT_REFRESH_EXPIRATION=7d
-JWT_ISSUER=production-mindblock-api
-JWT_AUDIENCE=production-mindblock-users
-
-# Rate Limiting (strict restrictions)
-RATE_LIMIT_WINDOW=900000
-RATE_LIMIT_MAX_REQUESTS=100
-RATE_LIMIT_REDIS_URL=redis://prod-redis-cluster:6379
-RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS=true
-
-# CORS (production domains only)
-CORS_ORIGIN=https://mindblock.app,https://admin.mindblock.app
-CORS_CREDENTIALS=true
-
-# Security Headers (maximum security)
-HSTS_MAX_AGE=31536000
-HSTS_INCLUDE_SUBDOMAINS=true
-HSTS_PRELOAD=true
-CSP_DIRECTIVES=default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
-CSP_REPORT_ONLY=false
-
-# Logging (error-only for production)
-LOG_LEVEL=error
-LOG_FORMAT=json
-LOG_REQUEST_BODY=false
-LOG_RESPONSE_BODY=false
-LOG_FILE_PATH=/var/log/mindblock/middleware.log
-LOG_MAX_FILE_SIZE=100M
-LOG_MAX_FILES=10
-
-# Performance (optimized for production)
-COMPRESSION_ENABLED=true
-COMPRESSION_LEVEL=9
-COMPRESSION_THRESHOLD=512
-REQUEST_TIMEOUT=15000
-KEEP_ALIVE_TIMEOUT=5000
-
-# Monitoring (full observability)
-ENABLE_METRICS=true
-ENABLE_TRACING=true
-METRICS_PREFIX=mindblock_prod_middleware_
-JAEGER_ENDPOINT=https://jaeger-production.internal/api/traces
-
-# Validation (strict validation)
-VALIDATION_STRICT=true
-VALIDATION_FORBID_NON_WHITELISTED=true
-MAX_REQUEST_SIZE=1mb
-MAX_URL_LENGTH=1024
-
-# Database (production)
-DATABASE_URL=postgresql://prod-db-cluster:5432/mindblock_prod
-REDIS_URL=redis://prod-redis-cluster:6379
-
-# External Services (production)
-EXTERNAL_API_BASE_URL=https://api.mindblock.app
-EXTERNAL_API_TIMEOUT=5000
-```
-
-## Configuration Loading
-
-### How Environment Variables are Loaded
-
-```typescript
-// Configuration loading implementation
-export class ConfigLoader {
-  static load(): MiddlewareConfig {
-    // 1. Load from environment variables
-    const envConfig = this.loadFromEnvironment();
-    
-    // 2. Validate configuration
-    this.validate(envConfig);
-    
-    // 3. Apply defaults
-    const config = this.applyDefaults(envConfig);
-    
-    // 4. Transform/clean configuration
-    return this.transform(config);
-  }
-  
-  private static loadFromEnvironment(): Partial<MiddlewareConfig> {
-    return {
-      // JWT Configuration
-      jwt: {
-        secret: process.env.JWT_SECRET,
-        expiration: process.env.JWT_EXPIRATION || '1h',
-        refreshExpiration: process.env.JWT_REFRESH_EXPIRATION || '7d',
-        issuer: process.env.JWT_ISSUER || 'mindblock-api',
-        audience: process.env.JWT_AUDIENCE || 'mindblock-users',
-      },
-      
-      // Rate Limiting
-      rateLimit: {
-        windowMs: parseInt(process.env.RATE_LIMIT_WINDOW || '900000'),
-        maxRequests: parseInt(process.env.RATE_LIMIT_MAX_REQUESTS || '100'),
-        redisUrl: process.env.RATE_LIMIT_REDIS_URL,
-        skipSuccessfulRequests: process.env.RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS === 'true',
-      },
-      
-      // CORS
-      cors: {
-        origin: this.parseArray(process.env.CORS_ORIGIN || '*'),
-        credentials: process.env.CORS_CREDENTIALS !== 'false',
-        methods: this.parseArray(process.env.CORS_METHODS || 'GET,POST,PUT,DELETE,OPTIONS'),
-        allowedHeaders: this.parseArray(process.env.CORS_ALLOWED_HEADERS || 'Content-Type,Authorization'),
-        maxAge: parseInt(process.env.CORS_MAX_AGE || '86400'),
-      },
-      
-      // Security Headers
-      security: {
-        hsts: {
-          maxAge: parseInt(process.env.HSTS_MAX_AGE || '31536000'),
-          includeSubdomains: process.env.HSTS_INCLUDE_SUBDOMAINS !== 'false',
-          preload: process.env.HSTS_PRELOAD === 'true',
-        },
-        csp: {
-          directives: process.env.CSP_DIRECTIVES || "default-src 'self'",
-          reportOnly: process.env.CSP_REPORT_ONLY === 'true',
-        },
-      },
-      
-      // Logging
-      logging: {
-        level: (process.env.LOG_LEVEL as LogLevel) || 'info',
-        format: (process.env.LOG_FORMAT as LogFormat) || 'json',
-        filePath: process.env.LOG_FILE_PATH,
-        maxFileSize: process.env.LOG_MAX_FILE_SIZE || '10m',
-        maxFiles: parseInt(process.env.LOG_MAX_FILES || '5'),
-        logRequestBody: process.env.LOG_REQUEST_BODY === 'true',
-        logResponseBody: process.env.LOG_RESPONSE_BODY === 'true',
-      },
-      
-      // Performance
-      performance: {
-        compression: {
-          enabled: process.env.COMPRESSION_ENABLED !== 'false',
-          level: parseInt(process.env.COMPRESSION_LEVEL || '6'),
-          threshold: parseInt(process.env.COMPRESSION_THRESHOLD || '1024'),
-          types: this.parseArray(process.env.COMPRESSION_TYPES || 'text/html,text/css,text/javascript,application/json'),
-        },
-        timeout: {
-          request: parseInt(process.env.REQUEST_TIMEOUT || '30000'),
-          keepAlive: parseInt(process.env.KEEP_ALIVE_TIMEOUT || '5000'),
-          headers: parseInt(process.env.HEADERS_TIMEOUT || '60000'),
-        },
-      },
-      
-      // Monitoring
-      monitoring: {
-        metrics: {
-          enabled: process.env.ENABLE_METRICS !== 'false',
-          port: parseInt(process.env.METRICS_PORT || '9090'),
-          path: process.env.METRICS_PATH || '/metrics',
-          prefix: process.env.METRICS_PREFIX || 'mindblock_middleware_',
-        },
-        tracing: {
-          enabled: process.env.ENABLE_TRACING === 'true',
-          jaegerEndpoint: process.env.JAEGER_ENDPOINT,
-          zipkinEndpoint: process.env.ZIPKIN_ENDPOINT,
-        },
-      },
-      
-      // Validation
-      validation: {
-        strict: process.env.VALIDATION_STRICT !== 'false',
-        whitelist: process.env.VALIDATION_WHITELIST !== 'false',
-        transform: process.env.VALIDATION_TRANSFORM !== 'false',
-        forbidNonWhitelisted: process.env.VALIDATION_FORBID_NON_WHITELISTED !== 'false',
-        maxRequestSize: process.env.MAX_REQUEST_SIZE || '10mb',
-        maxUrlLength: parseInt(process.env.MAX_URL_LENGTH || '2048'),
-      },
-    };
-  }
-  
-  private static parseArray(value: string): string[] {
-    return value.split(',').map(item => item.trim()).filter(Boolean);
-  }
-}
-```
-
-### Precedence Order (environment > file > defaults)
-
-```typescript
-// Configuration precedence example
-export class ConfigManager {
-  private config: MiddlewareConfig;
-  
-  constructor() {
-    this.config = this.loadConfiguration();
-  }
-  
-  private loadConfiguration(): MiddlewareConfig {
-    // 1. Start with defaults (lowest priority)
-    let config = this.getDefaultConfig();
-    
-    // 2. Load from .env files (medium priority)
-    config = this.mergeConfig(config, this.loadFromEnvFiles());
-    
-    // 3. Load from environment variables (highest priority)
-    config = this.mergeConfig(config, this.loadFromEnvironment());
-    
-    return config;
-  }
-  
-  private mergeConfig(base: MiddlewareConfig, override: Partial<MiddlewareConfig>): MiddlewareConfig {
-    return {
-      jwt: { ...base.jwt, ...override.jwt },
-      rateLimit: { ...base.rateLimit, ...override.rateLimit },
-      cors: { ...base.cors, ...override.cors },
-      security: { ...base.security, ...override.security },
-      logging: { ...base.logging, ...override.logging },
-      performance: { ...base.performance, ...override.performance },
-      monitoring: { ...base.monitoring, ...override.monitoring },
-      validation: { ...base.validation, ...override.validation },
-    };
-  }
-}
-```
-
-### Validation of Configuration on Startup
-
-```typescript
-// Configuration validation
-export class ConfigValidator {
-  static validate(config: MiddlewareConfig): ValidationResult {
-    const errors: ValidationError[] = [];
-    
-    // Validate JWT configuration
-    this.validateJwt(config.jwt, errors);
-    
-    // Validate rate limiting
-    this.validateRateLimit(config.rateLimit, errors);
-    
-    // Validate CORS
-    this.validateCors(config.cors, errors);
-    
-    // Validate security headers
-    this.validateSecurity(config.security, errors);
-    
-    // Validate logging
-    this.validateLogging(config.logging, errors);
-    
-    // Validate performance
-    this.validatePerformance(config.performance, errors);
-    
-    // Validate monitoring
-    this.validateMonitoring(config.monitoring, errors);
-    
-    // Validate validation settings (meta!)
-    this.validateValidation(config.validation, errors);
-    
-    return {
-      isValid: errors.length === 0,
-      errors,
-    };
-  }
-  
-  private static validateJwt(jwt: JwtConfig, errors: ValidationError[]): void {
-    if (!jwt.secret) {
-      errors.push({
-        field: 'jwt.secret',
-        message: 'JWT_SECRET is required',
-        severity: 'error',
-      });
-    } else if (jwt.secret.length < 32) {
-      errors.push({
-        field: 'jwt.secret',
-        message: 'JWT_SECRET must be at least 32 characters long',
-        severity: 'error',
-      });
-    }
-    
-    if (jwt.expiration && !this.isValidDuration(jwt.expiration)) {
-      errors.push({
-        field: 'jwt.expiration',
-        message: 'Invalid JWT_EXPIRATION format',
-        severity: 'error',
-      });
-    }
-  }
-  
-  private static validateRateLimit(rateLimit: RateLimitConfig, errors: ValidationError[]): void {
-    if (rateLimit.windowMs < 1000) {
-      errors.push({
-        field: 'rateLimit.windowMs',
-        message: 'RATE_LIMIT_WINDOW must be at least 1000ms',
-        severity: 'error',
-      });
-    }
-    
-    if (rateLimit.maxRequests < 1) {
-      errors.push({
-        field: 'rateLimit.maxRequests',
-        message: 'RATE_LIMIT_MAX_REQUESTS must be at least 1',
-        severity: 'error',
-      });
-    }
-    
-    if (rateLimit.redisUrl && !this.isValidRedisUrl(rateLimit.redisUrl)) {
-      errors.push({
-        field: 'rateLimit.redisUrl',
-        message: 'Invalid RATE_LIMIT_REDIS_URL format',
-        severity: 'error',
-      });
-    }
-  }
-  
-  private static isValidDuration(duration: string): boolean {
-    const durationRegex = /^\d+(ms|s|m|h|d|w)$/;
-    return durationRegex.test(duration);
-  }
-  
-  private static isValidRedisUrl(url: string): boolean {
-    try {
-      new URL(url);
-      return url.startsWith('redis://') || url.startsWith('rediss://');
-    } catch {
-      return false;
-    }
-  }
-}
-
-// Validation result interface
-interface ValidationResult {
-  isValid: boolean;
-  errors: ValidationError[];
-}
-
-interface ValidationError {
-  field: string;
-  message: string;
-  severity: 'warning' | 'error';
-}
-```
-
-### Handling Missing Required Variables
-
-```typescript
-// Required variable handling
-export class RequiredConfigHandler {
-  static handleMissing(required: string[]): never {
-    const missing = required.filter(name => !process.env[name]);
-    
-    if (missing.length > 0) {
-      console.error('❌ Missing required environment variables:');
-      missing.forEach(name => {
-        console.error(`   - ${name}`);
-      });
-      console.error('\nPlease set these environment variables and restart the application.');
-      console.error('Refer to the documentation for required values and formats.\n');
-      process.exit(1);
-    }
-  }
-  
-  static handleOptionalMissing(optional: string[]): void {
-    const missing = optional.filter(name => !process.env[name]);
-    
-    if (missing.length > 0) {
-      console.warn('⚠️  Optional environment variables not set (using defaults):');
-      missing.forEach(name => {
-        const defaultValue = this.getDefaultValue(name);
-        console.warn(`   - ${name} (default: ${defaultValue})`);
-      });
-    }
-  }
-  
-  private static getDefaultValue(name: string): string {
-    const defaults: Record<string, string> = {
-      'JWT_EXPIRATION': '1h',
-      'RATE_LIMIT_WINDOW': '900000',
-      'RATE_LIMIT_MAX_REQUESTS': '100',
-      'LOG_LEVEL': 'info',
-      'COMPRESSION_ENABLED': 'true',
-      'ENABLE_METRICS': 'true',
-    };
-    
-    return defaults[name] || 'not specified';
-  }
-}
-```
-
-## Default Values
-
-### Complete Configuration Defaults Table
-
-| Variable | Default | Description | Category |
-|----------|---------|-------------|----------|
-| `JWT_SECRET` | *required* | JWT signing secret | Auth |
-| `JWT_EXPIRATION` | `"1h"` | Access token expiration | Auth |
-| `JWT_REFRESH_EXPIRATION` | `"7d"` | Refresh token expiration | Auth |
-| `JWT_ISSUER` | `"mindblock-api"` | Token issuer | Auth |
-| `JWT_AUDIENCE` | `"mindblock-users"` | Token audience | Auth |
-| `RATE_LIMIT_WINDOW` | `900000` | Rate limit window (15 min) | Security |
-| `RATE_LIMIT_MAX_REQUESTS` | `100` | Max requests per window | Security |
-| `RATE_LIMIT_REDIS_URL` | `undefined` | Redis URL for distributed limiting | Security |
-| `RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS` | `false` | Skip successful requests | Security |
-| `CORS_ORIGIN` | `"*"` | Allowed origins | Security |
-| `CORS_CREDENTIALS` | `true` | Allow credentials | Security |
-| `CORS_METHODS` | `"GET,POST,PUT,DELETE,OPTIONS"` | Allowed methods | Security |
-| `CORS_ALLOWED_HEADERS` | `"Content-Type,Authorization"` | Allowed headers | Security |
-| `CORS_MAX_AGE` | `86400` | Preflight cache duration | Security |
-| `HSTS_MAX_AGE` | `31536000` | HSTS max age (1 year) | Security |
-| `HSTS_INCLUDE_SUBDOMAINS` | `true` | Include subdomains in HSTS | Security |
-| `HSTS_PRELOAD` | `false` | HSTS preload directive | Security |
-| `CSP_DIRECTIVES` | `"default-src 'self'"` | Content Security Policy | Security |
-| `CSP_REPORT_ONLY` | `false` | CSP report-only mode | Security |
-| `LOG_LEVEL` | `"info"` | Minimum log level | Monitoring |
-| `LOG_FORMAT` | `"json"` | Log output format | Monitoring |
-| `LOG_FILE_PATH` | `undefined` | Log file path | Monitoring |
-| `LOG_MAX_FILE_SIZE` | `"10m"` | Max log file size | Monitoring |
-| `LOG_MAX_FILES` | `5` | Max log files to keep | Monitoring |
-| `LOG_REQUEST_BODY` | `false` | Log request bodies | Monitoring |
-| `LOG_RESPONSE_BODY` | `false` | Log response bodies | Monitoring |
-| `COMPRESSION_ENABLED` | `true` | Enable compression | Performance |
-| `COMPRESSION_LEVEL` | `6` | Compression level (1-9) | Performance |
-| `COMPRESSION_THRESHOLD` | `1024` | Min size to compress | Performance |
-| `COMPRESSION_TYPES` | `"text/html,text/css,text/javascript,application/json"` | Types to compress | Performance |
-| `REQUEST_TIMEOUT` | `30000` | Request timeout (30s) | Performance |
-| `KEEP_ALIVE_TIMEOUT` | `5000` | Keep-alive timeout | Performance |
-| `HEADERS_TIMEOUT` | `60000` | Headers timeout | Performance |
-| `ENABLE_METRICS` | `true` | Enable metrics collection | Monitoring |
-| `METRICS_PORT` | `9090` | Metrics endpoint port | Monitoring |
-| `METRICS_PATH` | `"/metrics"` | Metrics endpoint path | Monitoring |
-| `METRICS_PREFIX` | `"mindblock_middleware_"` | Metrics name prefix | Monitoring |
-| `ENABLE_TRACING` | `false` | Enable distributed tracing | Monitoring |
-| `JAEGER_ENDPOINT` | `undefined` | Jaeger collector endpoint | Monitoring |
-| `ZIPKIN_ENDPOINT` | `undefined` | Zipkin collector endpoint | Monitoring |
-| `VALIDATION_STRICT` | `true` | Strict validation mode | Validation |
-| `VALIDATION_WHITELIST` | `true` | Strip non-whitelisted props | Validation |
-| `VALIDATION_TRANSFORM` | `true` | Transform input types | Validation |
-| `VALIDATION_FORBID_NON_WHITELISTED` | `true` | Reject non-whitelisted | Validation |
-| `MAX_REQUEST_SIZE` | `"10mb"` | Max request body size | Validation |
-| `MAX_URL_LENGTH` | `2048` | Max URL length | Validation |
-
-## Security Best Practices
-
-### Never Commit Secrets to Git
-
-```bash
-# .gitignore - Always include these patterns
-.env
-.env.local
-.env.development
-.env.staging
-.env.production
-*.key
-*.pem
-*.p12
-secrets/
-```
-
-```typescript
-// Secure configuration loading
-export class SecureConfigLoader {
-  static load(): SecureConfig {
-    // Never log secrets
-    const config = {
-      jwtSecret: process.env.JWT_SECRET, // Don't log this
-      databaseUrl: process.env.DATABASE_URL, // Don't log this
-    };
-    
-    // Validate without exposing values
-    if (!config.jwtSecret || config.jwtSecret.length < 32) {
-      throw new Error('JWT_SECRET must be at least 32 characters');
-    }
-    
-    return config;
-  }
-}
-```
-
-### Use Secret Management Tools
-
-#### AWS Secrets Manager
-```typescript
-// AWS Secrets Manager integration
-export class AWSSecretsManager {
-  static async loadSecret(secretName: string): Promise<string> {
-    const client = new SecretsManagerClient();
-    
-    try {
-      const response = await client.send(new GetSecretValueCommand({
-        SecretId: secretName,
-      }));
-      
-      return response.SecretString as string;
-    } catch (error) {
-      console.error(`Failed to load secret ${secretName}:`, error);
-      throw error;
-    }
-  }
-  
-  static async loadAllSecrets(): Promise<Record<string, string>> {
-    const secrets = {
-      JWT_SECRET: await this.loadSecret('mindblock/jwt-secret'),
-      DATABASE_URL: await this.loadSecret('mindblock/database-url'),
-      REDIS_URL: await this.loadSecret('mindblock/redis-url'),
-    };
-    
-    return secrets;
-  }
-}
-```
-
-#### HashiCorp Vault
-```typescript
-// Vault integration
-export class VaultSecretLoader {
-  static async loadSecret(path: string): Promise<any> {
-    const vault = new Vault({
-      endpoint: process.env.VAULT_ENDPOINT,
-      token: process.env.VAULT_TOKEN,
-    });
-    
-    try {
-      const result = await vault.read(path);
-      return result.data;
-    } catch (error) {
-      console.error(`Failed to load secret from Vault: ${path}`, error);
-      throw error;
-    }
-  }
-}
-```
-
-### Rotate Secrets Regularly
-
-```typescript
-// Secret rotation monitoring
-export class SecretRotationMonitor {
-  static checkSecretAge(secretName: string, maxAge: number): void {
-    const createdAt = process.env[`${secretName}_CREATED_AT`];
-    
-    if (createdAt) {
-      const age = Date.now() - parseInt(createdAt);
-      if (age > maxAge) {
-        console.warn(`⚠️  Secret ${secretName} is ${Math.round(age / (24 * 60 * 60 * 1000))} days old. Consider rotation.`);
-      }
-    }
-  }
-  
-  static monitorAllSecrets(): void {
-    this.checkSecretAge('JWT_SECRET', 90 * 24 * 60 * 60 * 1000); // 90 days
-    this.checkSecretAge('DATABASE_PASSWORD', 30 * 24 * 60 * 60 * 1000); // 30 days
-    this.checkSecretAge('API_KEY', 60 * 24 * 60 * 60 * 1000); // 60 days
-  }
-}
-```
-
-### Different Secrets Per Environment
-
-```bash
-# Environment-specific secret naming convention
-# Development
-JWT_SECRET_DEV=dev-secret-1
-DATABASE_URL_DEV=postgresql://localhost:5432/mindblock_dev
-
-# Staging  
-JWT_SECRET_STAGING=staging-secret-1
-DATABASE_URL_STAGING=postgresql://staging-db:5432/mindblock_staging
-
-# Production
-JWT_SECRET_PROD=prod-secret-1
-DATABASE_URL_PROD=postgresql://prod-db:5432/mindblock_prod
-```
-
-```typescript
-// Environment-specific secret loading
-export class EnvironmentSecretLoader {
-  static loadSecret(baseName: string): string {
-    const env = process.env.NODE_ENV || 'development';
-    const envSpecificName = `${baseName}_${env.toUpperCase()}`;
-    
-    return process.env[envSpecificName] || process.env[baseName];
-  }
-  
-  static loadAllSecrets(): Record<string, string> {
-    return {
-      jwtSecret: this.loadSecret('JWT_SECRET'),
-      databaseUrl: this.loadSecret('DATABASE_URL'),
-      redisUrl: this.loadSecret('REDIS_URL'),
-    };
-  }
-}
-```
-
-### Minimum Secret Lengths
-
-```typescript
-// Secret strength validation
-export class SecretStrengthValidator {
-  static validateJwtSecret(secret: string): ValidationResult {
-    const errors: string[] = [];
-    
-    if (secret.length < 32) {
-      errors.push('JWT_SECRET must be at least 32 characters long');
-    }
-    
-    if (secret.length < 64) {
-      errors.push('JWT_SECRET should be at least 64 characters for production');
-    }
-    
-    if (!this.hasEnoughEntropy(secret)) {
-      errors.push('JWT_SECRET should contain a mix of letters, numbers, and symbols');
-    }
-    
-    return {
-      isValid: errors.length === 0,
-      errors,
-    };
-  }
-  
-  static hasEnoughEntropy(secret: string): boolean {
-    const hasLetters = /[a-zA-Z]/.test(secret);
-    const hasNumbers = /\d/.test(secret);
-    const hasSymbols = /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(secret);
-    
-    return (hasLetters && hasNumbers && hasSymbols) || secret.length >= 128;
-  }
-}
-```
-
-### Secret Generation Recommendations
-
-```bash
-# Generate secure secrets using different methods
-
-# OpenSSL (recommended)
-JWT_SECRET=$(openssl rand -base64 32)
-JWT_SECRET_LONG=$(openssl rand -base64 64)
-
-# Node.js crypto
-node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
-
-# Python secrets
-python3 -c "import secrets; print(secrets.token_urlsafe(32))"
-
-# UUID (less secure, but better than nothing)
-JWT_SECRET=$(uuidgen | tr -d '-')
-```
-
-```typescript
-// Programmatic secret generation
-export class SecretGenerator {
-  static generateSecureSecret(length: number = 64): string {
-    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+-=[]{}|;:,.<>?';
-    const randomBytes = require('crypto').randomBytes(length);
-    
-    return Array.from(randomBytes)
-      .map(byte => chars[byte % chars.length])
-      .join('');
-  }
-  
-  static generateJwtSecret(): string {
-    return this.generateSecureSecret(64);
-  }
-  
-  static generateApiKey(): string {
-    return `mk_${this.generateSecureSecret(32)}`;
-  }
-}
-```
-
-## Performance Tuning
-
-### Rate Limiting Configuration for Different Loads
-
-#### Low Traffic Applications (< 100 RPS)
-```bash
-# Relaxed rate limiting
-RATE_LIMIT_WINDOW=900000
-RATE_LIMIT_MAX_REQUESTS=1000
-RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS=false
-```
-
-#### Medium Traffic Applications (100-1000 RPS)
-```bash
-# Standard rate limiting
-RATE_LIMIT_WINDOW=300000
-RATE_LIMIT_MAX_REQUESTS=500
-RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS=true
-RATE_LIMIT_REDIS_URL=redis://localhost:6379
-```
-
-#### High Traffic Applications (> 1000 RPS)
-```bash
-# Strict rate limiting with Redis
-RATE_LIMIT_WINDOW=60000
-RATE_LIMIT_MAX_REQUESTS=100
-RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS=true
-RATE_LIMIT_REDIS_URL=redis://redis-cluster:6379
-```
-
-#### API Gateway / CDN Edge
-```bash
-# Very strict rate limiting
-RATE_LIMIT_WINDOW=10000
-RATE_LIMIT_MAX_REQUESTS=10
-RATE_LIMIT_REDIS_URL=redis://edge-redis:6379
-```
-
-### Compression Settings by Server Capacity
-
-#### Low-CPU Servers
-```bash
-# Minimal compression
-COMPRESSION_ENABLED=true
-COMPRESSION_LEVEL=1
-COMPRESSION_THRESHOLD=2048
-COMPRESSION_TYPES=text/html,text/css
-```
-
-#### Medium-CPU Servers
-```bash
-# Balanced compression
-COMPRESSION_ENABLED=true
-COMPRESSION_LEVEL=6
-COMPRESSION_THRESHOLD=1024
-COMPRESSION_TYPES=text/html,text/css,text/javascript,application/json
-```
-
-#### High-CPU Servers
-```bash
-# Maximum compression
-COMPRESSION_ENABLED=true
-COMPRESSION_LEVEL=9
-COMPRESSION_THRESHOLD=512
-COMPRESSION_TYPES=text/html,text/css,text/javascript,application/json,application/xml
-```
-
-### Timeout Values for Different Endpoint Types
-
-#### Fast API Endpoints (< 100ms response time)
-```bash
-REQUEST_TIMEOUT=5000
-KEEP_ALIVE_TIMEOUT=2000
-HEADERS_TIMEOUT=10000
-```
-
-#### Standard API Endpoints (100ms-1s response time)
-```bash
-REQUEST_TIMEOUT=15000
-KEEP_ALIVE_TIMEOUT=5000
-HEADERS_TIMEOUT=30000
-```
-
-#### Slow API Endpoints (> 1s response time)
-```bash
-REQUEST_TIMEOUT=60000
-KEEP_ALIVE_TIMEOUT=10000
-HEADERS_TIMEOUT=60000
-```
-
-#### File Upload Endpoints
-```bash
-REQUEST_TIMEOUT=300000
-KEEP_ALIVE_TIMEOUT=15000
-HEADERS_TIMEOUT=120000
-MAX_REQUEST_SIZE=100mb
-```
-
-### Cache TTL Recommendations
-
-#### Static Content
-```bash
-# Long cache for static assets
-CACHE_TTL_STATIC=86400000  # 24 hours
-CACHE_TTL_IMAGES=31536000000  # 1 year
-```
-
-#### API Responses
-```bash
-# Short cache for dynamic content
-CACHE_TTL_API=300000  # 5 minutes
-CACHE_TTL_USER_DATA=60000  # 1 minute
-CACHE_TTL_PUBLIC_DATA=1800000  # 30 minutes
-```
-
-#### Rate Limiting Data
-```bash
-# Rate limit cache duration
-RATE_LIMIT_CACHE_TTL=900000  # 15 minutes
-RATE_LIMIT_CLEANUP_INTERVAL=300000  # 5 minutes
-```
-
-### Redis Connection Pool Sizing
-
-#### Small Applications
-```bash
-REDIS_POOL_MIN=2
-REDIS_POOL_MAX=10
-REDIS_POOL_ACQUIRE_TIMEOUT=30000
-```
-
-#### Medium Applications
-```bash
-REDIS_POOL_MIN=5
-REDIS_POOL_MAX=20
-REDIS_POOL_ACQUIRE_TIMEOUT=15000
-```
-
-#### Large Applications
-```bash
-REDIS_POOL_MIN=10
-REDIS_POOL_MAX=50
-REDIS_POOL_ACQUIRE_TIMEOUT=10000
-```
-
-## Environment-Specific Configurations
-
-### Development
-
-#### Relaxed Rate Limits
-```bash
-# Very permissive for development
-RATE_LIMIT_WINDOW=60000
-RATE_LIMIT_MAX_REQUESTS=10000
-RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS=false
-
-# No Redis required for development
-# RATE_LIMIT_REDIS_URL not set
-```
-
-#### Verbose Logging
-```bash
-# Debug logging with full details
-LOG_LEVEL=debug
-LOG_FORMAT=pretty
-LOG_REQUEST_BODY=true
-LOG_RESPONSE_BODY=true
-
-# Console output (no file logging)
-# LOG_FILE_PATH not set
-```
-
-#### Disabled Security Features
-```bash
-# Relaxed security for testing
-HSTS_MAX_AGE=0
-CSP_DIRECTIVES=default-src 'self' 'unsafe-inline' 'unsafe-eval'
-CORS_ORIGIN=*
-
-# Compression disabled for easier debugging
-COMPRESSION_ENABLED=false
-```
-
-#### Local Service Endpoints
-```bash
-# Local development services
-DATABASE_URL=postgresql://localhost:5432/mindblock_dev
-REDIS_URL=redis://localhost:6379
-EXTERNAL_API_BASE_URL=http://localhost:3001
-```
-
-### Staging
-
-#### Moderate Rate Limits
-```bash
-# Production-like but more permissive
-RATE_LIMIT_WINDOW=300000
-RATE_LIMIT_MAX_REQUESTS=500
-RATE_LIMIT_REDIS_URL=redis://staging-redis:6379
-RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS=true
-```
-
-#### Standard Logging
-```bash
-# Production-like logging
-LOG_LEVEL=info
-LOG_FORMAT=json
-LOG_REQUEST_BODY=false
-LOG_RESPONSE_BODY=false
-
-# File logging enabled
-LOG_FILE_PATH=/var/log/mindblock/staging.log
-LOG_MAX_FILE_SIZE=50M
-LOG_MAX_FILES=5
-```
-
-#### Security Enabled but Not Strict
-```bash
-# Standard security settings
-HSTS_MAX_AGE=86400  # 1 day instead of 1 year
-HSTS_PRELOAD=false
-CSP_DIRECTIVES=default-src 'self'; script-src 'self' 'unsafe-inline'
-CSP_REPORT_ONLY=true
-
-# Compression enabled
-COMPRESSION_ENABLED=true
-COMPRESSION_LEVEL=6
-```
-
-#### Staging Service Endpoints
-```bash
-# Staging environment services
-DATABASE_URL=postgresql://staging-db:5432/mindblock_staging
-REDIS_URL=redis://staging-redis:6379
-EXTERNAL_API_BASE_URL=https://api-staging.mindblock.app
-```
-
-### Production
-
-#### Strict Rate Limits
-```bash
-# Production rate limiting
-RATE_LIMIT_WINDOW=900000
-RATE_LIMIT_MAX_REQUESTS=100
-RATE_LIMIT_REDIS_URL=redis://prod-redis-cluster:6379
-RATE_LIMIT_SKIP_SUCCESSFUL_REQUESTS=true
-```
-
-#### Error-Level Logging Only
-```bash
-# Minimal logging for production
-LOG_LEVEL=error
-LOG_FORMAT=json
-LOG_REQUEST_BODY=false
-LOG_RESPONSE_BODY=false
-
-# File logging with rotation
-LOG_FILE_PATH=/var/log/mindblock/production.log
-LOG_MAX_FILE_SIZE=100M
-LOG_MAX_FILES=10
-```
-
-#### All Security Features Enabled
-```bash
-# Maximum security
-HSTS_MAX_AGE=31536000
-HSTS_INCLUDE_SUBDOMAINS=true
-HSTS_PRELOAD=true
-CSP_DIRECTIVES=default-src 'self'; script-src 'self'; object-src 'none'
-CSP_REPORT_ONLY=false
-
-# Maximum compression
-COMPRESSION_ENABLED=true
-COMPRESSION_LEVEL=9
-```
-
-#### Production Service Endpoints
-```bash
-# Production services with failover
-DATABASE_URL=postgresql://prod-db-cluster:5432/mindblock_prod
-DATABASE_URL_FAILOVER=postgresql://prod-db-backup:5432/mindblock_prod
-REDIS_URL=redis://prod-redis-cluster:6379
-EXTERNAL_API_BASE_URL=https://api.mindblock.app
-```
-
-#### Performance Optimizations
-```bash
-# Optimized timeouts
-REQUEST_TIMEOUT=15000
-KEEP_ALIVE_TIMEOUT=5000
-HEADERS_TIMEOUT=30000
-
-# Connection pooling
-REDIS_POOL_MIN=10
-REDIS_POOL_MAX=50
-REDIS_POOL_ACQUIRE_TIMEOUT=10000
-
-# Monitoring enabled
-ENABLE_METRICS=true
-ENABLE_TRACING=true
-METRICS_PREFIX=prod_mindblock_
-```
-
-## Troubleshooting
-
-### Common Configuration Issues
-
-#### Issue: JWT Verification Fails
-
-**Symptoms:**
-- 401 Unauthorized responses
-- "Invalid token" errors
-- Authentication failures
-
-**Causes:**
-- JWT_SECRET not set or incorrect
-- JWT_SECRET differs between services
-- Token expired
-
-**Solutions:**
-```bash
-# Check JWT_SECRET is set
-echo $JWT_SECRET
-
-# Verify JWT_SECRET length (should be >= 32 chars)
-echo $JWT_SECRET | wc -c
-
-# Check token expiration
-JWT_EXPIRATION=2h  # Increase for testing
-
-# Verify JWT_SECRET matches between services
-# Ensure all services use the same JWT_SECRET
-```
-
-#### Issue: Rate Limiting Not Working
-
-**Symptoms:**
-- No rate limiting effect
-- All requests allowed
-- Rate limit headers not present
-
-**Causes:**
-- RATE_LIMIT_REDIS_URL not configured for distributed setup
-- Redis connection failed
-- Rate limiting middleware not applied correctly
-
-**Solutions:**
-```bash
-# Check Redis configuration
-echo $RATE_LIMIT_REDIS_URL
-
-# Test Redis connection
-redis-cli -u $RATE_LIMIT_REDIS_URL ping
-
-# Verify Redis is running
-docker ps | grep redis
-
-# Check rate limit values
-echo "Window: $RATE_LIMIT_WINDOW ms"
-echo "Max requests: $RATE_LIMIT_MAX_REQUESTS"
-
-# For single instance, remove Redis URL
-unset RATE_LIMIT_REDIS_URL
-```
-
-#### Issue: CORS Errors
-
-**Symptoms:**
-- Browser CORS errors
-- "No 'Access-Control-Allow-Origin' header"
-- Preflight request failures
-
-**Causes:**
-- CORS_ORIGIN doesn't include frontend URL
-- Credentials mismatch
-- Preflight methods not allowed
-
-**Solutions:**
-```bash
-# Check CORS origin
-echo $CORS_ORIGIN
-
-# Add your frontend URL
-CORS_ORIGIN=https://your-frontend-domain.com
-
-# For multiple origins
-CORS_ORIGIN=https://domain1.com,https://domain2.com
-
-# Check credentials setting
-echo $CORS_CREDENTIALS  # Should be 'true' if using cookies/auth
-
-# Check allowed methods
-echo $CORS_METHODS  # Should include your HTTP methods
-```
-
-#### Issue: Security Headers Missing
-
-**Symptoms:**
-- Missing security headers in responses
-- Security scanner warnings
-- HSTS not applied
-
-**Causes:**
-- Security middleware not applied
-- Configuration values set to disable features
-- Headers being overridden by other middleware
-
-**Solutions:**
-```bash
-# Check security header configuration
-echo $HSTS_MAX_AGE
-echo $CSP_DIRECTIVES
-
-# Ensure HSTS is enabled (not 0)
-HSTS_MAX_AGE=31536000
-
-# Check CSP is not empty
-CSP_DIRECTIVES=default-src 'self'
-
-# Verify middleware is applied in correct order
-# Security middleware should be applied before other middleware
-```
-
-#### Issue: Configuration Not Loading
-
-**Symptoms:**
-- Default values being used
-- Environment variables ignored
-- Configuration validation errors
-
-**Causes:**
-- .env file not in correct location
-- Environment variables not exported
-- Configuration loading order issues
-
-**Solutions:**
-```bash
-# Check .env file location
-ls -la .env*
-
-# Verify .env file is being loaded
-cat .env
-
-# Export environment variables manually (for testing)
-export JWT_SECRET="test-secret-32-chars-long"
-export LOG_LEVEL="debug"
-
-# Restart application after changing .env
-npm run restart
-```
-
-### Configuration Validation Errors
-
-#### JWT Secret Too Short
-```bash
-# Error: JWT_SECRET must be at least 32 characters long
-
-# Solution: Generate a proper secret
-JWT_SECRET=$(openssl rand -base64 32)
-export JWT_SECRET
-```
-
-#### Invalid Rate Limit Window
-```bash
-# Error: RATE_LIMIT_WINDOW must be at least 1000ms
-
-# Solution: Use valid time window
-RATE_LIMIT_WINDOW=900000  # 15 minutes
-export RATE_LIMIT_WINDOW
-```
-
-#### Invalid Redis URL
-```bash
-# Error: Invalid RATE_LIMIT_REDIS_URL format
-
-# Solution: Use correct Redis URL format
-RATE_LIMIT_REDIS_URL=redis://localhost:6379
-# or
-RATE_LIMIT_REDIS_URL=redis://user:pass@host:port/db
-export RATE_LIMIT_REDIS_URL
-```
-
-#### Invalid Log Level
-```bash
-# Error: Invalid LOG_LEVEL
-
-# Solution: Use valid log level
-LOG_LEVEL=debug  # or info, warn, error
-export LOG_LEVEL
-```
-
-### Performance Issues
-
-#### Slow Middleware Execution
-```bash
-# Check compression level
-echo $COMPRESSION_LEVEL  # Lower for better performance
-
-# Check timeout values
-echo $REQUEST_TIMEOUT  # Lower for faster failure
-
-# Check rate limit configuration
-echo $RATE_LIMIT_MAX_REQUESTS  # Higher if too restrictive
-```
-
-#### High Memory Usage
-```bash
-# Check rate limit cache settings
-RATE_LIMIT_CACHE_TTL=300000  # Lower TTL
-RATE_LIMIT_CLEANUP_INTERVAL=60000  # More frequent cleanup
-
-# Check log file size limits
-LOG_MAX_FILE_SIZE=10M  # Lower max file size
-LOG_MAX_FILES=3  # Fewer files
-```
-
-#### Database Connection Issues
-```bash
-# Check database URL format
-echo $DATABASE_URL
-
-# Test database connection
-psql $DATABASE_URL -c "SELECT 1"
-
-# Check connection pool settings
-echo $DB_POOL_MIN
-echo $DB_POOL_MAX
-```
-
-### Debug Configuration Loading
-
-#### Enable Configuration Debugging
-```typescript
-// Add to your application startup
-if (process.env.NODE_ENV === 'development') {
-  console.log('🔧 Configuration Debug:');
-  console.log('Environment:', process.env.NODE_ENV);
-  console.log('JWT Secret set:', !!process.env.JWT_SECRET);
-  console.log('Rate Limit Window:', process.env.RATE_LIMIT_WINDOW);
-  console.log('Log Level:', process.env.LOG_LEVEL);
-  console.log('CORS Origin:', process.env.CORS_ORIGIN);
-}
-```
-
-#### Validate All Configuration
-```typescript
-// Add comprehensive validation
-import { ConfigValidator } from '@mindblock/middleware/config';
-
-const validation = ConfigValidator.validate(config);
-if (!validation.isValid) {
-  console.error('❌ Configuration validation failed:');
-  validation.errors.forEach(error => {
-    console.error(`  ${error.field}: ${error.message}`);
-  });
-  process.exit(1);
-} else {
-  console.log('✅ Configuration validation passed');
-}
-```
-
-#### Test Individual Middleware
-```typescript
-// Test middleware configuration individually
-import { RateLimitingMiddleware } from '@mindblock/middleware/security';
-
-try {
-  const rateLimit = new RateLimitingMiddleware(config.rateLimit);
-  console.log('✅ Rate limiting middleware configured successfully');
-} catch (error) {
-  console.error('❌ Rate limiting middleware configuration failed:', error.message);
-}
-```
-
-This comprehensive configuration documentation provides complete guidance for configuring the middleware package in any environment, with detailed troubleshooting information and best practices for security and performance.
diff --git a/middleware/docs/PERFORMANCE.md b/middleware/docs/PERFORMANCE.md
deleted file mode 100644
index 62b32a6d..00000000
--- a/middleware/docs/PERFORMANCE.md
+++ /dev/null
@@ -1,205 +0,0 @@
-# Middleware Performance Optimization Guide
-
-Actionable techniques for reducing middleware overhead in the MindBlock API.
-Each section includes a before/after snippet and a benchmark delta measured with
-`autocannon` (1000 concurrent requests, 10 s run, Node 20, M2 Pro).
-
----
-
-## 1. Lazy Initialization
-
-Expensive setup (DB connections, compiled regex, crypto keys) should happen once
-at startup, not on every request.
-
-**Before** — initializes per request
-```typescript
-@Injectable()
-export class SignatureMiddleware implements NestMiddleware {
-  use(req: Request, res: Response, next: NextFunction) {
-    const publicKey = fs.readFileSync('./keys/public.pem'); // ❌ disk read per request
-    verify(req.body, publicKey);
-    next();
-  }
-}
-```
-
-**After** — initializes once in the constructor
-```typescript
-@Injectable()
-export class SignatureMiddleware implements NestMiddleware {
-  private readonly publicKey: Buffer;
-
-  constructor() {
-    this.publicKey = fs.readFileSync('./keys/public.pem'); // ✅ once at startup
-  }
-
-  use(req: Request, res: Response, next: NextFunction) {
-    verify(req.body, this.publicKey);
-    next();
-  }
-}
-```
-
-**Delta:** ~1 200 req/s → ~4 800 req/s (+300 %) on signed-payload routes.
-
----
-
-## 2. Caching Middleware Results (JWT Payload)
-
-Re-verifying a JWT on every request is expensive. Cache the decoded payload in
-Redis for the remaining token lifetime.
-
-**Before** — verifies signature every request
-```typescript
-const decoded = jwt.verify(token, secret); // ❌ crypto on hot path
-```
-
-**After** — check cache first
-```typescript
-const cacheKey = `jwt:${token.slice(-16)}`; // last 16 chars as key
-let decoded = await redis.get(cacheKey);
-
-if (!decoded) {
-  const payload = jwt.verify(token, secret) as JwtPayload;
-  const ttl = payload.exp - Math.floor(Date.now() / 1000);
-  await redis.setex(cacheKey, ttl, JSON.stringify(payload));
-  decoded = JSON.stringify(payload);
-}
-
-req.user = JSON.parse(decoded);
-```
-
-**Delta:** ~2 100 req/s → ~6 700 req/s (+219 %) on authenticated routes with a
-warm Redis cache.
-
----
-
-## 3. Short-Circuit on Known-Safe Routes
-
-Skipping all middleware logic for health and metric endpoints removes latency
-on paths that are polled at high frequency.
-
-**Before** — every route runs the full stack
-```typescript
-consumer.apply(JwtAuthMiddleware).forRoutes('*');
-```
-
-**After** — use the `unless` helper from this package
-```typescript
-import { unless } from '@mindblock/middleware';
-
-consumer.apply(unless(JwtAuthMiddleware, ['/health', '/metrics', '/favicon.ico']));
-```
-
-**Delta:** health endpoint: ~18 000 req/s → ~42 000 req/s (+133 %); no change
-to protected routes.
-
----
-
-## 4. Async vs Sync — Avoid Blocking the Event Loop
-
-Synchronous crypto operations (e.g. `bcrypt.hashSync`, `crypto.pbkdf2Sync`) block
-the Node event loop and starve all concurrent requests.
-
-**Before** — synchronous hash comparison
-```typescript
-const match = bcrypt.compareSync(password, hash); // ❌ blocks loop
-```
-
-**After** — async comparison with `await`
-```typescript
-const match = await bcrypt.compare(password, hash); // ✅ non-blocking
-```
-
-**Delta:** under 200 concurrent users, p99 latency drops from ~620 ms to ~95 ms.
-
----
-
-## 5. Avoid Object Allocation on Every Request
-
-Creating new objects, arrays, or loggers inside `use()` generates garbage-
-collection pressure at scale.
-
-**Before** — allocates a logger per call
-```typescript
-use(req, res, next) {
-  const logger = new Logger('Auth'); // ❌ new instance per request
-  logger.log('checking token');
-  // ...
-}
-```
-
-**After** — single shared instance
-```typescript
-private readonly logger = new Logger('Auth'); // ✅ created once
-
-use(req, res, next) {
-  this.logger.log('checking token');
-  // ...
-}
-```
-
-**Delta:** p95 latency improvement of ~12 % under sustained 1 000 req/s load due
-to reduced GC pauses.
-
----
-
-## 6. Use the Circuit Breaker to Protect the Whole Pipeline
-
-Under dependency failures, without circuit breaking, every request pays the full
-timeout cost. With a circuit breaker, failing routes short-circuit immediately.
-
-**Before** — every request waits for the external service to time out
-```
-p99: 5 050 ms (timeout duration) during an outage
-```
-
-**After** — circuit opens after 5 failures; subsequent requests return 503 in < 1 ms
-```
-p99: 0.8 ms during an outage (circuit open)
-```
-
-**Delta:** ~99.98 % latency reduction on affected routes during outage windows.
-See [circuit-breaker.middleware.ts](../src/middleware/advanced/circuit-breaker.middleware.ts).
-
----
-
-## Anti-Patterns
-
-### ❌ Creating New Instances Per Request
-
-```typescript
-// ❌ instantiates a validator (with its own schema compilation) per call
-use(req, res, next) {
-  const validator = new Validator(schema);
-  validator.validate(req.body);
-}
-```
-Compile the schema once in the constructor and reuse the validator instance.
-
----
-
-### ❌ Synchronous File Reads on the Hot Path
-
-```typescript
-// ❌ synchronous disk I/O blocks ALL concurrent requests
-use(req, res, next) {
-  const config = JSON.parse(fs.readFileSync('./config.json', 'utf-8'));
-}
-```
-Load config at application startup and inject it via the constructor.
-
----
-
-### ❌ Forgetting to Call `next()` on Non-Error Paths
-
-```typescript
-use(req, res, next) {
-  if (isPublic(req.path)) {
-    return; // ❌ hangs the request — next() never called
-  }
-  checkAuth(req);
-  next();
-}
-```
-Always call `next()` (or send a response) on every code path.
diff --git a/middleware/package.json b/middleware/package.json
index 0ba0c3a3..64bede7f 100644
--- a/middleware/package.json
+++ b/middleware/package.json
@@ -13,7 +13,9 @@
     "lint": "eslint -c eslint.config.mjs \"src/**/*.ts\" \"tests/**/*.ts\"",
     "lint:fix": "eslint -c eslint.config.mjs \"src/**/*.ts\" \"tests/**/*.ts\" --fix",
     "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\"",
-    "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\""
+    "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\"",
+    "benchmark": "ts-node scripts/benchmark.ts",
+    "benchmark:ci": "ts-node scripts/benchmark.ts --ci"
   },
   "dependencies": {
     "@nestjs/common": "^11.0.12",
@@ -25,20 +27,24 @@
     "express": "^5.1.0",
     "jsonwebtoken": "^9.0.2",
     "micromatch": "^4.0.8",
+    "semver": "^7.6.0",
     "stellar-sdk": "^13.1.0"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",
     "@types/jest": "^29.5.14",
     "@types/node": "^22.10.7",
+    "@types/semver": "^7.5.8",
     "@typescript-eslint/eslint-plugin": "^8.20.0",
     "@typescript-eslint/parser": "^8.20.0",
+    "autocannon": "^7.15.0",
     "eslint": "^9.18.0",
     "eslint-plugin-prettier": "^5.2.2",
     "globals": "^16.0.0",
     "jest": "^29.7.0",
     "prettier": "^3.4.2",
     "ts-jest": "^29.2.5",
+    "ts-node": "^10.9.2",
     "typescript": "^5.7.3",
     "typescript-eslint": "^8.20.0"
   }
diff --git a/middleware/scripts/benchmark.ts b/middleware/scripts/benchmark.ts
new file mode 100644
index 00000000..b31cf6d0
--- /dev/null
+++ b/middleware/scripts/benchmark.ts
@@ -0,0 +1,354 @@
+#!/usr/bin/env ts-node
+
+import http from 'http';
+import express, { Request, Response, NextFunction } from 'express';
+import { Server } from 'http';
+
+// Import middleware
+import { SecurityHeadersMiddleware } from '../src/security/security-headers.middleware';
+import { TimeoutMiddleware } from '../src/middleware/advanced/timeout.middleware';
+import { CircuitBreakerMiddleware, CircuitBreakerService } from '../src/middleware/advanced/circuit-breaker.middleware';
+import { CorrelationIdMiddleware } from '../src/monitoring/correlation-id.middleware';
+import { unless } from '../src/middleware/utils/conditional.middleware';
+
+interface BenchmarkResult {
+  middleware: string;
+  requestsPerSecond: number;
+  latency: {
+    average: number;
+    p50: number;
+    p95: number;
+    p99: number;
+  };
+  errors: number;
+}
+
+interface MiddlewareConfig {
+  name: string;
+  middleware: any;
+  options?: any;
+}
+
+// Simple load testing function to replace autocannon
+async function simpleLoadTest(url: string, options: {
+  connections: number;
+  duration: number;
+  headers?: Record<string, string>;
+}): Promise<{
+  requests: { average: number };
+  latency: { average: number; p50: number; p95: number; p99: number };
+  errors: number;
+}> {
+  const { connections, duration, headers = {} } = options;
+  const latencies: number[] = [];
+  let completedRequests = 0;
+  let errors = 0;
+  const startTime = Date.now();
+
+  // Create concurrent requests
+  const promises = Array.from({ length: connections }, async () => {
+    const requestStart = Date.now();
+
+    try {
+      await new Promise<void>((resolve, reject) => {
+        const req = http.request(url, {
+          method: 'GET',
+          headers
+        }, (res) => {
+          let data = '';
+          res.on('data', chunk => data += chunk);
+          res.on('end', () => {
+            completedRequests++;
+            latencies.push(Date.now() - requestStart);
+            resolve();
+          });
+        });
+
+        req.on('error', (err) => {
+          errors++;
+          latencies.push(Date.now() - requestStart);
+          reject(err);
+        });
+
+        req.setTimeout(10000, () => {
+          errors++;
+          latencies.push(Date.now() - requestStart);
+          req.destroy();
+          reject(new Error('Timeout'));
+        });
+
+        req.end();
+      });
+    } catch (error) {
+      // Ignore errors for load testing
+    }
+  });
+
+  // Run for the specified duration
+  await Promise.race([
+    Promise.all(promises),
+    new Promise(resolve => setTimeout(resolve, duration * 1000))
+  ]);
+
+  const totalTime = (Date.now() - startTime) / 1000; // in seconds
+  const requestsPerSecond = completedRequests / totalTime;
+
+  // Calculate percentiles
+  latencies.sort((a, b) => a - b);
+  const p50 = latencies[Math.floor(latencies.length * 0.5)] || 0;
+  const p95 = latencies[Math.floor(latencies.length * 0.95)] || 0;
+  const p99 = latencies[Math.floor(latencies.length * 0.99)] || 0;
+  const average = latencies.reduce((sum, lat) => sum + lat, 0) / latencies.length || 0;
+
+  return {
+    requests: { average: requestsPerSecond },
+    latency: { average, p50, p95, p99 },
+    errors
+  };
+}
+
+// Mock JWT Auth Middleware (simplified for benchmarking)
+class MockJwtAuthMiddleware {
+  constructor(private options: { secret: string; algorithms?: string[] }) {}
+
+  use(req: Request, res: Response, next: NextFunction) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+
+    // For benchmarking, just check if a token is present (skip actual verification)
+    const token = authHeader.substring(7);
+    if (!token || token.length < 10) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+
+    // Mock user object
+    (req as any).user = {
+      userId: '1234567890',
+      email: 'test@example.com',
+      userRole: 'user'
+    };
+    next();
+  }
+}
+
+// Mock RBAC Middleware (simplified for benchmarking)
+class MockRbacMiddleware {
+  constructor(private options: { roles: string[]; defaultRole: string }) {}
+
+  use(req: Request, res: Response, next: NextFunction) {
+    const user = (req as any).user;
+    if (!user) {
+      return res.status(401).json({ error: 'No user found' });
+    }
+
+    // Simple role check - allow if user has any of the allowed roles
+    const userRole = user.userRole || this.options.defaultRole;
+    if (!this.options.roles.includes(userRole)) {
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+
+    next();
+  }
+}
+
+class MiddlewareBenchmarker {
+  private port = 3001;
+  private server: Server | null = null;
+
+  private middlewareConfigs: MiddlewareConfig[] = [
+    {
+      name: 'JWT Auth',
+      middleware: MockJwtAuthMiddleware,
+      options: {
+        secret: 'test-secret-key-for-benchmarking-only',
+        algorithms: ['HS256']
+      }
+    },
+    {
+      name: 'RBAC',
+      middleware: MockRbacMiddleware,
+      options: {
+        roles: ['user', 'admin'],
+        defaultRole: 'user'
+      }
+    },
+    {
+      name: 'Security Headers',
+      middleware: SecurityHeadersMiddleware,
+      options: {}
+    },
+    {
+      name: 'Timeout (5s)',
+      middleware: TimeoutMiddleware,
+      options: { timeout: 5000 }
+    },
+    {
+      name: 'Circuit Breaker',
+      middleware: CircuitBreakerMiddleware,
+      options: {
+        failureThreshold: 5,
+        recoveryTimeout: 30000,
+        monitoringPeriod: 10000
+      }
+    },
+    {
+      name: 'Correlation ID',
+      middleware: CorrelationIdMiddleware,
+      options: {}
+    }
+  ];
+
+  async runBenchmarks(): Promise<void> {
+    console.log('🚀 Starting Middleware Performance Benchmarks\n');
+    console.log('Configuration: 100 concurrent connections, 5s duration\n');
+
+    const results: BenchmarkResult[] = [];
+
+    // Baseline benchmark (no middleware)
+    console.log('📊 Running baseline benchmark (no middleware)...');
+    const baselineResult = await this.runBenchmark([]);
+    results.push({
+      middleware: 'Baseline (No Middleware)',
+      ...baselineResult
+    });
+
+    // Individual middleware benchmarks
+    for (const config of this.middlewareConfigs) {
+      console.log(`📊 Running benchmark for ${config.name}...`);
+      try {
+        const result = await this.runBenchmark([config]);
+        results.push({
+          middleware: config.name,
+          ...result
+        });
+      } catch (error) {
+        console.error(`❌ Failed to benchmark ${config.name}:`, error.message);
+        results.push({
+          middleware: config.name,
+          requestsPerSecond: 0,
+          latency: { average: 0, p50: 0, p95: 0, p99: 0 },
+          errors: 0
+        });
+      }
+    }
+
+    this.displayResults(results);
+  }
+
+  private async runBenchmark(middlewareConfigs: MiddlewareConfig[]): Promise<Omit<BenchmarkResult, 'middleware'>> {
+    const app = express();
+
+    // Simple test endpoint
+    app.get('/test', (req: Request, res: Response) => {
+      res.json({ message: 'ok', timestamp: Date.now() });
+    });
+
+    // Apply middleware
+    for (const config of middlewareConfigs) {
+      if (config.middleware) {
+        // Special handling for CircuitBreakerMiddleware
+        if (config.middleware === CircuitBreakerMiddleware) {
+          const circuitBreakerService = new CircuitBreakerService(config.options);
+          const instance = new CircuitBreakerMiddleware(circuitBreakerService);
+          app.use((req, res, next) => instance.use(req, res, next));
+        }
+        // For middleware that need instantiation
+        else if (typeof config.middleware === 'function' && config.middleware.prototype?.use) {
+          const instance = new (config.middleware as any)(config.options);
+          app.use((req, res, next) => instance.use(req, res, next));
+        } else if (typeof config.middleware === 'function') {
+          // For functional middleware
+          app.use(config.middleware(config.options));
+        }
+      }
+    }
+
+    // Start server
+    this.server = app.listen(this.port);
+
+    try {
+      // Run simple load test
+      const result = await simpleLoadTest(`http://localhost:${this.port}/test`, {
+        connections: 100,
+        duration: 5, // 5 seconds instead of 10 for faster testing
+        headers: {
+          'Authorization': 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'
+        }
+      });
+
+      return {
+        requestsPerSecond: Math.round(result.requests.average * 100) / 100,
+        latency: {
+          average: Math.round(result.latency.average * 100) / 100,
+          p50: Math.round(result.latency.p50 * 100) / 100,
+          p95: Math.round(result.latency.p95 * 100) / 100,
+          p99: Math.round(result.latency.p99 * 100) / 100
+        },
+        errors: result.errors
+      };
+    } finally {
+      // Clean up server
+      if (this.server) {
+        this.server.close();
+        this.server = null;
+      }
+    }
+  }
+
+  private displayResults(results: BenchmarkResult[]): void {
+    console.log('\n📈 Benchmark Results Summary');
+    console.log('=' .repeat(80));
+
+    console.log('│ Middleware'.padEnd(25) + '│ Req/sec'.padEnd(10) + '│ Avg Lat'.padEnd(10) + '│ P95 Lat'.padEnd(10) + '│ Overhead'.padEnd(12) + '│');
+    console.log('├' + '─'.repeat(24) + '┼' + '─'.repeat(9) + '┼' + '─'.repeat(9) + '┼' + '─'.repeat(9) + '┼' + '─'.repeat(11) + '┤');
+
+    const baseline = results.find(r => r.middleware === 'Baseline (No Middleware)');
+    if (!baseline) {
+      console.error('❌ Baseline benchmark not found!');
+      return;
+    }
+
+    for (const result of results) {
+      const overhead = result.middleware === 'Baseline (No Middleware)'
+        ? '0%'
+        : result.requestsPerSecond > 0
+          ? `${Math.round((1 - result.requestsPerSecond / baseline.requestsPerSecond) * 100)}%`
+          : 'N/A';
+
+      console.log(
+        '│ ' + result.middleware.padEnd(23) + ' │ ' +
+        result.requestsPerSecond.toString().padEnd(8) + ' │ ' +
+        result.latency.average.toString().padEnd(8) + ' │ ' +
+        result.latency.p95.toString().padEnd(8) + ' │ ' +
+        overhead.padEnd(10) + ' │'
+      );
+    }
+
+    console.log('└' + '─'.repeat(24) + '┴' + '─'.repeat(9) + '┴' + '─'.repeat(9) + '┴' + '─'.repeat(9) + '┴' + '─'.repeat(11) + '┘');
+
+    console.log('\n📝 Notes:');
+    console.log('- Overhead is calculated as reduction in requests/second vs baseline');
+    console.log('- Lower overhead percentage = better performance');
+    console.log('- Results may vary based on system configuration');
+    console.log('- Run with --ci flag for CI-friendly output');
+  }
+}
+
+// CLI handling
+async function main() {
+  const isCI = process.argv.includes('--ci');
+
+  try {
+    const benchmarker = new MiddlewareBenchmarker();
+    await benchmarker.runBenchmarks();
+  } catch (error) {
+    console.error('❌ Benchmark failed:', error);
+    process.exit(1);
+  }
+}
+
+if (require.main === module) {
+  main();
+}
\ No newline at end of file
diff --git a/middleware/src/common/interfaces/index.ts b/middleware/src/common/interfaces/index.ts
new file mode 100644
index 00000000..4c094b58
--- /dev/null
+++ b/middleware/src/common/interfaces/index.ts
@@ -0,0 +1,3 @@
+// Plugin interfaces and error types
+export * from './plugin.interface';
+export * from './plugin.errors';
diff --git a/middleware/src/common/interfaces/plugin.errors.ts b/middleware/src/common/interfaces/plugin.errors.ts
new file mode 100644
index 00000000..ff6cbaae
--- /dev/null
+++ b/middleware/src/common/interfaces/plugin.errors.ts
@@ -0,0 +1,153 @@
+/**
+ * Base error class for plugin-related errors.
+ */
+export class PluginError extends Error {
+  constructor(message: string, public readonly code: string = 'PLUGIN_ERROR', public readonly details?: any) {
+    super(message);
+    this.name = 'PluginError';
+    Object.setPrototypeOf(this, PluginError.prototype);
+  }
+}
+
+/**
+ * Error thrown when a plugin is not found.
+ */
+export class PluginNotFoundError extends PluginError {
+  constructor(pluginId: string, details?: any) {
+    super(`Plugin not found: ${pluginId}`, 'PLUGIN_NOT_FOUND', details);
+    this.name = 'PluginNotFoundError';
+    Object.setPrototypeOf(this, PluginNotFoundError.prototype);
+  }
+}
+
+/**
+ * Error thrown when a plugin fails to load due to missing module or import error.
+ */
+export class PluginLoadError extends PluginError {
+  constructor(pluginId: string, reason?: string, details?: any) {
+    super(
+      `Failed to load plugin: ${pluginId}${reason ? ` - ${reason}` : ''}`,
+      'PLUGIN_LOAD_ERROR',
+      details
+    );
+    this.name = 'PluginLoadError';
+    Object.setPrototypeOf(this, PluginLoadError.prototype);
+  }
+}
+
+/**
+ * Error thrown when a plugin is already loaded.
+ */
+export class PluginAlreadyLoadedError extends PluginError {
+  constructor(pluginId: string, details?: any) {
+    super(`Plugin already loaded: ${pluginId}`, 'PLUGIN_ALREADY_LOADED', details);
+    this.name = 'PluginAlreadyLoadedError';
+    Object.setPrototypeOf(this, PluginAlreadyLoadedError.prototype);
+  }
+}
+
+/**
+ * Error thrown when plugin configuration is invalid.
+ */
+export class PluginConfigError extends PluginError {
+  constructor(pluginId: string, errors: string[], details?: any) {
+    super(
+      `Invalid configuration for plugin: ${pluginId}\n${errors.join('\n')}`,
+      'PLUGIN_CONFIG_ERROR',
+      details
+    );
+    this.name = 'PluginConfigError';
+    Object.setPrototypeOf(this, PluginConfigError.prototype);
+  }
+}
+
+/**
+ * Error thrown when plugin dependencies are not met.
+ */
+export class PluginDependencyError extends PluginError {
+  constructor(pluginId: string, missingDependencies: string[], details?: any) {
+    super(
+      `Plugin dependencies not met for: ${pluginId} - Missing: ${missingDependencies.join(', ')}`,
+      'PLUGIN_DEPENDENCY_ERROR',
+      details
+    );
+    this.name = 'PluginDependencyError';
+    Object.setPrototypeOf(this, PluginDependencyError.prototype);
+  }
+}
+
+/**
+ * Error thrown when plugin version is incompatible.
+ */
+export class PluginVersionError extends PluginError {
+  constructor(
+    pluginId: string,
+    required: string,
+    actual: string,
+    details?: any
+  ) {
+    super(
+      `Plugin version mismatch: ${pluginId} requires ${required} but got ${actual}`,
+      'PLUGIN_VERSION_ERROR',
+      details
+    );
+    this.name = 'PluginVersionError';
+    Object.setPrototypeOf(this, PluginVersionError.prototype);
+  }
+}
+
+/**
+ * Error thrown when plugin initialization fails.
+ */
+export class PluginInitError extends PluginError {
+  constructor(pluginId: string, reason?: string, details?: any) {
+    super(
+      `Failed to initialize plugin: ${pluginId}${reason ? ` - ${reason}` : ''}`,
+      'PLUGIN_INIT_ERROR',
+      details
+    );
+    this.name = 'PluginInitError';
+    Object.setPrototypeOf(this, PluginInitError.prototype);
+  }
+}
+
+/**
+ * Error thrown when trying to operate on an inactive plugin.
+ */
+export class PluginInactiveError extends PluginError {
+  constructor(pluginId: string, details?: any) {
+    super(`Plugin is not active: ${pluginId}`, 'PLUGIN_INACTIVE', details);
+    this.name = 'PluginInactiveError';
+    Object.setPrototypeOf(this, PluginInactiveError.prototype);
+  }
+}
+
+/**
+ * Error thrown when plugin package.json is invalid.
+ */
+export class InvalidPluginPackageError extends PluginError {
+  constructor(packagePath: string, errors: string[], details?: any) {
+    super(
+      `Invalid plugin package.json at ${packagePath}:\n${errors.join('\n')}`,
+      'INVALID_PLUGIN_PACKAGE',
+      details
+    );
+    this.name = 'InvalidPluginPackageError';
+    Object.setPrototypeOf(this, InvalidPluginPackageError.prototype);
+  }
+}
+
+/**
+ * Error thrown when npm package resolution fails.
+ */
+export class PluginResolutionError extends PluginError {
+  constructor(pluginName: string, reason?: string, details?: any) {
+    super(
+      `Failed to resolve plugin package: ${pluginName}${reason ? ` - ${reason}` : ''}`,
+      'PLUGIN_RESOLUTION_ERROR',
+      details
+    );
+    this.name = 'PluginResolutionError';
+    Object.setPrototypeOf(this, PluginResolutionError.prototype);
+  }
+}
diff --git a/middleware/src/common/interfaces/plugin.interface.ts b/middleware/src/common/interfaces/plugin.interface.ts
new file mode 100644
index 00000000..73cb974c
--- /dev/null
+++ b/middleware/src/common/interfaces/plugin.interface.ts
@@ -0,0 +1,244 @@
+import { NestMiddleware } from '@nestjs/common';
+import { Request, Response, NextFunction } from 'express';
+
+/**
+ * Semantic version constraint for plugin compatibility.
+ * Supports semver ranges like "^1.0.0", "~1.2.0", "1.x", etc.
+ */
+export type VersionConstraint = string;
+
+/**
+ * Metadata about the plugin.
+ */
+export interface PluginMetadata {
+  /** Unique identifier for the plugin (e.g., @mindblock/plugin-rate-limit) */
+  id: string;
+
+  /** Display name of the plugin */
+  name: string;
+
+  /** Short description of what the plugin does */
+  description: string;
+
+  /** Current version of the plugin (must follow semver) */
+  version: string;
+
+  /** Plugin author or organization */
+  author?: string;
+
+  /** URL for the plugin's GitHub repository, documentation, or home page */
+  homepage?: string;
+
+  /** License identifier (e.g., MIT, Apache-2.0) */
+  license?: string;
+
+  /** List of keywords for discoverability */
+  keywords?: string[];
+
+  /** Required middleware package version (e.g., "^1.0.0") */
+  requiredMiddlewareVersion?: VersionConstraint;
+
+  /** Execution priority: lower runs first, higher runs last (default: 0) */
+  priority?: number;
+
+  /** Whether this plugin should be loaded automatically */
+  autoLoad?: boolean;
+
+  /** Configuration schema for the plugin (JSON Schema format) */
+  configSchema?: Record<string, any>;
+
+  /** Custom metadata */
+  [key: string]: any;
+}
+
+/**
+ * Plugin context provided during initialization.
+ * Gives plugin access to shared services and utilities.
+ */
+export interface PluginContext {
+  /** Logger instance for the plugin */
+  logger?: any;
+
+  /** Environment variables */
+  env?: NodeJS.ProcessEnv;
+
+  /** Application configuration */
+  config?: Record<string, any>;
+
+  /** Access to other loaded plugins */
+  plugins?: Map<string, PluginInterface>;
+
+  /** Custom context data */
+  [key: string]: any;
+}
+
+/**
+ * Plugin configuration passed at runtime.
+ */
+export interface PluginConfig {
+  /** Whether the plugin is enabled */
+  enabled?: boolean;
+
+  /** Plugin-specific options */
+  options?: Record<string, any>;
+
+  /** Custom metadata */
+  [key: string]: any;
+}
+
+/**
+ * Plugin lifecycle hooks.
+ */
+export interface PluginHooks {
+  /**
+   * Called when the plugin is being loaded.
+   * Useful for validation, setup, or dependency checks.
+   */
+  onLoad?: (context: PluginContext) => Promise<void> | void;
+
+  /**
+   * Called when the plugin is being initialized with configuration.
+   */
+  onInit?: (config: PluginConfig, context: PluginContext) => Promise<void> | void;
+
+  /**
+   * Called when the plugin is being activated for use.
+   */
+  onActivate?: (context: PluginContext) => Promise<void> | void;
+
+  /**
+   * Called when the plugin is being deactivated.
+   */
+  onDeactivate?: (context: PluginContext) => Promise<void> | void;
+
+  /**
+   * Called when the plugin is being unloaded or destroyed.
+   */
+  onUnload?: (context: PluginContext) => Promise<void> | void;
+
+  /**
+   * Called to reload the plugin (without fully unloading it).
+   */
+  onReload?: (config: PluginConfig, context: PluginContext) => Promise<void> | void;
+}
+
+/**
+ * Core Plugin Interface.
+ * All plugins must implement this interface to be loadable by the plugin loader.
+ */
+export interface PluginInterface extends PluginHooks {
+  /** Plugin metadata */
+  metadata: PluginMetadata;
+
+  /** Get the exported middleware (if this plugin exports middleware) */
+  getMiddleware?(): NestMiddleware | ((req: Request, res: Response, next: NextFunction) => void | Promise<void>);
+
+  /** Get additional exports from the plugin */
+  getExports?(): Record<string, any>;
+
+  /** Validate plugin configuration */
+  validateConfig?(config: PluginConfig): { valid: boolean; errors: string[] };
+
+  /** Get plugin dependencies (list of required plugins) */
+  getDependencies?(): string[];
+
+  /** Custom method for plugin-specific operations */
+  [key: string]: any;
+}
+
+/**
+ * Plugin Package definition (from package.json).
+ */
+export interface PluginPackageJson {
+  name: string;
+  version: string;
+  description?: string;
+  author?: string | { name?: string; email?: string; url?: string };
+  homepage?: string;
+  repository?:
+    | string
+    | {
+        type?: string;
+        url?: string;
+        directory?: string;
+      };
+  license?: string;
+  keywords?: string[];
+  main?: string;
+  types?: string;
+  // Plugin-specific fields
+  mindblockPlugin?: {
+    version?: VersionConstraint;
+    priority?: number;
+    autoLoad?: boolean;
+    configSchema?: Record<string, any>;
+    [key: string]: any;
+  };
+  [key: string]: any;
+}
+
+/**
+ * Represents a loaded plugin instance.
+ */
+export interface LoadedPlugin {
+  /** Plugin ID */
+  id: string;
+
+  /** Plugin metadata */
+  metadata: PluginMetadata;
+
+  /** Actual plugin instance */
+  instance: PluginInterface;
+
+  /** Plugin configuration */
+  config: PluginConfig;
+
+  /** Whether the plugin is currently active */
+  active: boolean;
+
+  /** Timestamp when plugin was loaded */
+  loadedAt: Date;
+
+  /** Plugin dependencies metadata */
+  dependencies: string[];
+}
+
+/**
+ * Plugin search/filter criteria.
+ */
+export interface PluginSearchCriteria {
+  /** Search by plugin ID or name */
+  query?: string;
+
+  /** Filter by plugin keywords */
+  keywords?: string[];
+
+  /** Filter by author */
+  author?: string;
+
+  /** Filter by enabled status */
+  enabled?: boolean;
+
+  /** Filter by active status */
+  active?: boolean;
+
+  /** Filter by priority range */
+  priority?: { min?: number; max?: number };
+}
+
+/**
+ * Plugin validation result.
+ */
+export interface PluginValidationResult {
+  /** Whether validation passed */
+  valid: boolean;
+
+  /** Error messages if validation failed */
+  errors: string[];
+
+  /** Warning messages */
+  warnings: string[];
+
+  /** Additional metadata about validation */
+  metadata?: Record<string, any>;
+}
diff --git a/middleware/src/common/utils/index.ts b/middleware/src/common/utils/index.ts
new file mode 100644
index 00000000..c5d6c8b5
--- /dev/null
+++ b/middleware/src/common/utils/index.ts
@@ -0,0 +1,8 @@
+// Plugin system exports
+export * from './plugin-loader';
+export * from './plugin-registry';
+export * from '../interfaces/plugin.interface';
+export * from '../interfaces/plugin.errors';
+
+// Lifecycle management exports
+export * from './lifecycle-timeout-manager';
diff --git a/middleware/src/common/utils/lifecycle-timeout-manager.ts b/middleware/src/common/utils/lifecycle-timeout-manager.ts
new file mode 100644
index 00000000..0e178385
--- /dev/null
+++ b/middleware/src/common/utils/lifecycle-timeout-manager.ts
@@ -0,0 +1,351 @@
+import { Logger } from '@nestjs/common';
+
+/**
+ * Lifecycle Timeout Configuration
+ */
+export interface LifecycleTimeoutConfig {
+  onLoad?: number;          // ms
+  onInit?: number;          // ms
+  onActivate?: number;      // ms
+  onDeactivate?: number;    // ms
+  onUnload?: number;        // ms
+  onReload?: number;        // ms
+}
+
+/**
+ * Lifecycle Error Context
+ * Information about an error that occurred during lifecycle operations
+ */
+export interface LifecycleErrorContext {
+  pluginId: string;
+  hook: string;                    // 'onLoad', 'onInit', etc.
+  error: Error | null;
+  timedOut: boolean;
+  startTime: number;
+  duration: number;                // Actual execution time in ms
+  configuredTimeout?: number;      // Configured timeout in ms
+  retryCount: number;
+  maxRetries: number;
+}
+
+/**
+ * Lifecycle Error Recovery Strategy
+ */
+export enum RecoveryStrategy {
+  RETRY = 'retry',           // Automatically retry the operation
+  FAIL_FAST = 'fail-fast',   // Immediately abort
+  GRACEFUL = 'graceful',     // Log and continue with degraded state
+  ROLLBACK = 'rollback'      // Revert to previous state
+}
+
+/**
+ * Lifecycle Error Recovery Configuration
+ */
+export interface RecoveryConfig {
+  strategy: RecoveryStrategy;
+  maxRetries?: number;
+  retryDelayMs?: number;
+  backoffMultiplier?: number;  // exponential backoff
+  fallbackValue?: any;         // For recovery
+}
+
+/**
+ * Lifecycle Timeout Manager
+ *
+ * Handles timeouts, retries, and error recovery for plugin lifecycle operations.
+ * Provides:
+ * - Configurable timeouts per lifecycle hook
+ * - Automatic retry with exponential backoff
+ * - Error context and diagnostics
+ * - Recovery strategies
+ * - Hook execution logging
+ */
+export class LifecycleTimeoutManager {
+  private readonly logger = new Logger('LifecycleTimeoutManager');
+  private timeoutConfigs = new Map<string, LifecycleTimeoutConfig>();
+  private recoveryConfigs = new Map<string, RecoveryConfig>();
+  private executionHistory = new Map<string, LifecycleErrorContext[]>();
+
+  // Default timeouts (ms)
+  private readonly DEFAULT_TIMEOUTS: LifecycleTimeoutConfig = {
+    onLoad: 5000,
+    onInit: 5000,
+    onActivate: 3000,
+    onDeactivate: 3000,
+    onUnload: 5000,
+    onReload: 5000
+  };
+
+  // Default recovery config
+  private readonly DEFAULT_RECOVERY: RecoveryConfig = {
+    strategy: RecoveryStrategy.RETRY,
+    maxRetries: 2,
+    retryDelayMs: 100,
+    backoffMultiplier: 2
+  };
+
+  /**
+   * Set timeout configuration for a plugin
+   */
+  setTimeoutConfig(pluginId: string, config: LifecycleTimeoutConfig): void {
+    this.timeoutConfigs.set(pluginId, { ...this.DEFAULT_TIMEOUTS, ...config });
+    this.logger.debug(`Set timeout config for plugin: ${pluginId}`);
+  }
+
+  /**
+   * Get timeout configuration for a plugin
+   */
+  getTimeoutConfig(pluginId: string): LifecycleTimeoutConfig {
+    return this.timeoutConfigs.get(pluginId) || this.DEFAULT_TIMEOUTS;
+  }
+
+  /**
+   * Set recovery configuration for a plugin
+   */
+  setRecoveryConfig(pluginId: string, config: RecoveryConfig): void {
+    this.recoveryConfigs.set(pluginId, { ...this.DEFAULT_RECOVERY, ...config });
+    this.logger.debug(`Set recovery config for plugin: ${pluginId}`);
+  }
+
+  /**
+   * Get recovery configuration for a plugin
+   */
+  getRecoveryConfig(pluginId: string): RecoveryConfig {
+    return this.recoveryConfigs.get(pluginId) || this.DEFAULT_RECOVERY;
+  }
+
+  /**
+   * Execute a lifecycle hook with timeout and error handling
+   */
+  async executeWithTimeout<T>(
+    pluginId: string,
+    hookName: string,
+    hookFn: () => Promise<T>,
+    timeoutMs?: number
+  ): Promise<T> {
+    const timeout = timeoutMs || this.getTimeoutConfig(pluginId)[hookName as keyof LifecycleTimeoutConfig];
+    const recovery = this.getRecoveryConfig(pluginId);
+
+    let lastError: Error | null = null;
+    let retryCount = 0;
+    const maxRetries = recovery.maxRetries || 0;
+
+    while (retryCount <= maxRetries) {
+      try {
+        const startTime = Date.now();
+        const result = await this.executeWithTimeoutInternal(
+          pluginId,
+          hookName,
+          hookFn,
+          timeout || 30000
+        );
+
+        // Success - log if retried
+        if (retryCount > 0) {
+          this.logger.log(
+            `✓ Plugin ${pluginId} hook ${hookName} succeeded after ${retryCount} retries`
+          );
+        }
+
+        return result;
+      } catch (error) {
+        lastError = error as Error;
+
+        if (retryCount < maxRetries) {
+          const delayMs = this.calculateRetryDelay(
+            retryCount,
+            recovery.retryDelayMs || 100,
+            recovery.backoffMultiplier || 2
+          );
+
+          this.logger.warn(
+            `Plugin ${pluginId} hook ${hookName} failed (attempt ${retryCount + 1}/${maxRetries + 1}), ` +
+            `retrying in ${delayMs}ms: ${(error as Error).message}`
+          );
+
+          await this.sleep(delayMs);
+          retryCount++;
+        } else {
+          break;
+        }
+      }
+    }
+
+    // All retries exhausted - handle based on recovery strategy
+    const context = this.createErrorContext(
+      pluginId,
+      hookName,
+      lastError,
+      false,
+      retryCount,
+      maxRetries
+    );
+
+    return this.handleRecovery(pluginId, hookName, context, recovery);
+  }
+
+  /**
+   * Execute hook with timeout (internal)
+   */
+  private executeWithTimeoutInternal<T>(
+    pluginId: string,
+    hookName: string,
+    hookFn: () => Promise<T>,
+    timeoutMs: number
+  ): Promise<T> {
+    return Promise.race([
+      hookFn(),
+      new Promise<T>((_, reject) =>
+        setTimeout(
+          () => reject(new Error(`Lifecycle hook ${hookName} timed out after ${timeoutMs}ms`)),
+          timeoutMs
+        )
+      )
+    ]);
+  }
+
+  /**
+   * Calculate retry delay with exponential backoff
+   */
+  private calculateRetryDelay(attempt: number, baseDelayMs: number, backoffMultiplier: number): number {
+    return baseDelayMs * Math.pow(backoffMultiplier, attempt);
+  }
+
+  /**
+   * Sleep utility
+   */
+  private sleep(ms: number): Promise<void> {
+    return new Promise(resolve => setTimeout(resolve, ms));
+  }
+
+  /**
+   * Create error context
+   */
+  private createErrorContext(
+    pluginId: string,
+    hook: string,
+    error: Error | null,
+    timedOut: boolean,
+    retryCount: number,
+    maxRetries: number
+  ): LifecycleErrorContext {
+    return {
+      pluginId,
+      hook,
+      error,
+      timedOut,
+      startTime: Date.now(),
+      duration: 0,
+      retryCount,
+      maxRetries
+    };
+  }
+
+  /**
+   * Handle error recovery based on strategy
+   */
+  private async handleRecovery<T>(
+    pluginId: string,
+    hookName: string,
+    context: LifecycleErrorContext,
+    recovery: RecoveryConfig
+  ): Promise<T> {
+    const strategy = recovery.strategy;
+
+    // Record execution history
+    if (!this.executionHistory.has(pluginId)) {
+      this.executionHistory.set(pluginId, []);
+    }
+    this.executionHistory.get(pluginId)!.push(context);
+
+    switch (strategy) {
+      case RecoveryStrategy.FAIL_FAST:
+        this.logger.error(
+          `Plugin ${pluginId} hook ${hookName} failed fatally: ${context.error?.message}`
+        );
+        throw context.error || new Error(`Hook ${hookName} failed`);
+
+      case RecoveryStrategy.GRACEFUL:
+        this.logger.warn(
+          `Plugin ${pluginId} hook ${hookName} failed gracefully: ${context.error?.message}`
+        );
+        return recovery.fallbackValue as T;
+
+      case RecoveryStrategy.ROLLBACK:
+        this.logger.error(
+          `Plugin ${pluginId} hook ${hookName} failed, rolling back: ${context.error?.message}`
+        );
+        throw new Error(
+          `Rollback triggered for ${hookName}: ${context.error?.message}`
+        );
+
+      case RecoveryStrategy.RETRY:
+      default:
+        this.logger.error(
+          `Plugin ${pluginId} hook ${hookName} failed after all retries: ${context.error?.message}`
+        );
+        throw context.error || new Error(`Hook ${hookName} failed after retries`);
+    }
+  }
+
+  /**
+   * Get execution history for a plugin
+   */
+  getExecutionHistory(pluginId: string): LifecycleErrorContext[] {
+    return this.executionHistory.get(pluginId) || [];
+  }
+
+  /**
+   * Clear execution history for a plugin
+   */
+  clearExecutionHistory(pluginId: string): void {
+    this.executionHistory.delete(pluginId);
+  }
+
+  /**
+   * Get execution statistics
+   */
+  getExecutionStats(pluginId: string): {
+    totalAttempts: number;
+    failures: number;
+    successes: number;
+    timeouts: number;
+    averageDuration: number;
+  } {
+    const history = this.getExecutionHistory(pluginId);
+
+    if (history.length === 0) {
+      return {
+        totalAttempts: 0,
+        failures: 0,
+        successes: 0,
+        timeouts: 0,
+        averageDuration: 0
+      };
+    }
+
+    const failures = history.filter(h => h.error !== null).length;
+    const timeouts = history.filter(h => h.timedOut).length;
+    const averageDuration = history.reduce((sum, h) => sum + h.duration, 0) / history.length;
+
+    return {
+      totalAttempts: history.length,
+      failures,
+      successes: history.length - failures,
+      timeouts,
+      averageDuration
+    };
+  }
+
+  /**
+   * Reset all configurations and history
+   */
+  reset(): void {
+    this.timeoutConfigs.clear();
+    this.recoveryConfigs.clear();
+    this.executionHistory.clear();
+    this.logger.debug('Lifecycle timeout manager reset');
+  }
+}
+
+export default LifecycleTimeoutManager;
diff --git a/middleware/src/common/utils/plugin-loader.ts b/middleware/src/common/utils/plugin-loader.ts
new file mode 100644
index 00000000..3ba20a4d
--- /dev/null
+++ b/middleware/src/common/utils/plugin-loader.ts
@@ -0,0 +1,628 @@
+import { Injectable, Logger } from '@nestjs/common';
+import * as path from 'path';
+import * as fs from 'fs';
+import { execSync } from 'child_process';
+import * as semver from 'semver';
+
+import {
+  PluginInterface,
+  PluginMetadata,
+  PluginConfig,
+  PluginContext,
+  LoadedPlugin,
+  PluginPackageJson,
+  PluginValidationResult,
+  PluginSearchCriteria
+} from '../interfaces/plugin.interface';
+import {
+  PluginLoadError,
+  PluginNotFoundError,
+  PluginAlreadyLoadedError,
+  PluginConfigError,
+  PluginDependencyError,
+  PluginVersionError,
+  PluginInitError,
+  PluginResolutionError,
+  InvalidPluginPackageError
+} from '../interfaces/plugin.errors';
+
+/**
+ * Plugin Loader Configuration
+ */
+export interface PluginLoaderConfig {
+  /** Directories to search for plugins (node_modules by default) */
+  searchPaths?: string[];
+
+  /** Plugin name prefix to identify plugins (e.g., "@mindblock/plugin-") */
+  pluginNamePrefix?: string;
+
+  /** Middleware package version for compatibility checks */
+  middlewareVersion?: string;
+
+  /** Whether to auto-load plugins marked with autoLoad: true */
+  autoLoadEnabled?: boolean;
+
+  /** Maximum number of plugins to load */
+  maxPlugins?: number;
+
+  /** Whether to validate plugins strictly */
+  strictMode?: boolean;
+
+  /** Custom logger instance */
+  logger?: Logger;
+}
+
+/**
+ * Plugin Loader Service
+ *
+ * Responsible for:
+ * - Discovering npm packages that contain middleware plugins
+ * - Loading and instantiating plugins
+ * - Managing plugin lifecycle (load, init, activate, deactivate, unload)
+ * - Validating plugin configuration and dependencies
+ * - Providing plugin registry and search capabilities
+ */
+@Injectable()
+export class PluginLoader {
+  private readonly logger: Logger;
+  private readonly searchPaths: string[];
+  private readonly pluginNamePrefix: string;
+  private readonly middlewareVersion: string;
+  private readonly autoLoadEnabled: boolean;
+  private readonly maxPlugins: number;
+  private readonly strictMode: boolean;
+
+  private loadedPlugins: Map<string, LoadedPlugin> = new Map();
+  private pluginContext: PluginContext;
+
+  constructor(config: PluginLoaderConfig = {}) {
+    this.logger = config.logger || new Logger('PluginLoader');
+    this.searchPaths = config.searchPaths || this.getDefaultSearchPaths();
+    this.pluginNamePrefix = config.pluginNamePrefix || '@mindblock/plugin-';
+    this.middlewareVersion = config.middlewareVersion || '1.0.0';
+    this.autoLoadEnabled = config.autoLoadEnabled !== false;
+    this.maxPlugins = config.maxPlugins || 100;
+    this.strictMode = config.strictMode !== false;
+
+    this.pluginContext = {
+      logger: this.logger,
+      env: process.env,
+      plugins: this.loadedPlugins,
+      config: {}
+    };
+  }
+
+  /**
+   * Get default search paths for plugins
+   */
+  private getDefaultSearchPaths(): string[] {
+    const nodeModulesPath = this.resolveNodeModulesPath();
+    return [nodeModulesPath];
+  }
+
+  /**
+   * Resolve the node_modules path
+   */
+  private resolveNodeModulesPath(): string {
+    try {
+      const nodeModulesPath = require.resolve('npm').split('node_modules')[0] + 'node_modules';
+      if (fs.existsSync(nodeModulesPath)) {
+        return nodeModulesPath;
+      }
+    } catch (error) {
+      // Fallback
+    }
+
+    // Fallback to relative path
+    return path.resolve(process.cwd(), 'node_modules');
+  }
+
+  /**
+   * Discover all available plugins in search paths
+   */
+  async discoverPlugins(): Promise<PluginPackageJson[]> {
+    const discoveredPlugins: Map<string, PluginPackageJson> = new Map();
+
+    for (const searchPath of this.searchPaths) {
+      if (!fs.existsSync(searchPath)) {
+        this.logger.warn(`Search path does not exist: ${searchPath}`);
+        continue;
+      }
+
+      try {
+        const entries = fs.readdirSync(searchPath);
+
+        for (const entry of entries) {
+          // Check for scoped packages (@organization/plugin-name)
+          if (entry.startsWith('@')) {
+            const scopedPath = path.join(searchPath, entry);
+            if (!fs.statSync(scopedPath).isDirectory()) continue;
+
+            const scopedEntries = fs.readdirSync(scopedPath);
+            for (const scopedEntry of scopedEntries) {
+              if (this.isPluginPackage(scopedEntry)) {
+                const pluginPackageJson = this.loadPluginPackageJson(
+                  path.join(scopedPath, scopedEntry)
+                );
+                if (pluginPackageJson) {
+                  discoveredPlugins.set(pluginPackageJson.name, pluginPackageJson);
+                }
+              }
+            }
+          } else if (this.isPluginPackage(entry)) {
+            const pluginPackageJson = this.loadPluginPackageJson(path.join(searchPath, entry));
+            if (pluginPackageJson) {
+              discoveredPlugins.set(pluginPackageJson.name, pluginPackageJson);
+            }
+          }
+        }
+      } catch (error) {
+        this.logger.error(`Error discovering plugins in ${searchPath}:`, error.message);
+      }
+    }
+
+    return Array.from(discoveredPlugins.values());
+  }
+
+  /**
+   * Check if a package is a valid plugin package
+   */
+  private isPluginPackage(packageName: string): boolean {
+    // Check if it starts with the plugin prefix
+    if (!packageName.includes('plugin-') && !packageName.startsWith('@mindblock/')) {
+      return false;
+    }
+    return packageName.includes('plugin-');
+  }
+
+  /**
+   * Load plugin package.json
+   */
+  private loadPluginPackageJson(pluginPath: string): PluginPackageJson | null {
+    try {
+      const packageJsonPath = path.join(pluginPath, 'package.json');
+      if (!fs.existsSync(packageJsonPath)) {
+        return null;
+      }
+
+      const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+
+      // Validate that it has plugin configuration
+      if (!packageJson.mindblockPlugin && !packageJson.main) {
+        return null;
+      }
+
+      return packageJson;
+    } catch (error) {
+      this.logger.debug(`Failed to load package.json from ${pluginPath}:`, error.message);
+      return null;
+    }
+  }
+
+  /**
+   * Load a plugin from an npm package
+   */
+  async loadPlugin(pluginName: string, config?: PluginConfig): Promise<LoadedPlugin> {
+    // Check if already loaded
+    if (this.loadedPlugins.has(pluginName)) {
+      throw new PluginAlreadyLoadedError(pluginName);
+    }
+
+    // Check plugin limit
+    if (this.loadedPlugins.size >= this.maxPlugins) {
+      throw new PluginLoadError(pluginName, `Maximum plugin limit (${this.maxPlugins}) reached`);
+    }
+
+    try {
+      // Resolve plugin module
+      const pluginModule = await this.resolvePluginModule(pluginName);
+      if (!pluginModule) {
+        throw new PluginResolutionError(pluginName, 'Module not found');
+      }
+
+      // Load plugin instance
+      const pluginInstance = this.instantiatePlugin(pluginModule);
+
+      // Validate plugin interface
+      this.validatePluginInterface(pluginInstance);
+
+      // Get metadata
+      const metadata = pluginInstance.metadata;
+
+      // Validate version compatibility
+      if (metadata.requiredMiddlewareVersion) {
+        this.validateVersionCompatibility(pluginName, metadata.requiredMiddlewareVersion);
+      }
+
+      // Check dependencies
+      const dependencies = pluginInstance.getDependencies?.() || [];
+      this.validateDependencies(pluginName, dependencies);
+
+      // Validate configuration
+      const pluginConfig = config || { enabled: true };
+      if (pluginInstance.validateConfig) {
+        const validationResult = pluginInstance.validateConfig(pluginConfig);
+        if (!validationResult.valid) {
+          throw new PluginConfigError(pluginName, validationResult.errors);
+        }
+      }
+
+      // Call onLoad hook
+      if (pluginInstance.onLoad) {
+        await pluginInstance.onLoad(this.pluginContext);
+      }
+
+      // Create loaded plugin entry
+      const loadedPlugin: LoadedPlugin = {
+        id: metadata.id,
+        metadata,
+        instance: pluginInstance,
+        config: pluginConfig,
+        active: false,
+        loadedAt: new Date(),
+        dependencies
+      };
+
+      // Store loaded plugin
+      this.loadedPlugins.set(metadata.id, loadedPlugin);
+
+      this.logger.log(`✓ Plugin loaded: ${metadata.id} (v${metadata.version})`);
+
+      return loadedPlugin;
+    } catch (error) {
+      if (error instanceof PluginLoadError || error instanceof PluginConfigError || 
+          error instanceof PluginDependencyError || error instanceof PluginResolutionError) {
+        throw error;
+      }
+      throw new PluginLoadError(pluginName, error.message, error);
+    }
+  }
+
+  /**
+   * Resolve plugin module from npm package
+   */
+  private async resolvePluginModule(pluginName: string): Promise<any> {
+    try {
+      // Try direct require
+      return require(pluginName);
+    } catch (error) {
+      try {
+        // Try from node_modules
+        for (const searchPath of this.searchPaths) {
+          const pluginPath = path.join(searchPath, pluginName);
+          if (fs.existsSync(pluginPath)) {
+            const packageJsonPath = path.join(pluginPath, 'package.json');
+            const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+            const main = packageJson.main || 'index.js';
+            const mainPath = path.join(pluginPath, main);
+
+            if (fs.existsSync(mainPath)) {
+              return require(mainPath);
+            }
+          }
+        }
+
+        throw new Error(`Plugin module not found in any search path`);
+      } catch (innerError) {
+        throw new PluginResolutionError(pluginName, innerError.message);
+      }
+    }
+  }
+
+  /**
+   * Instantiate plugin from module
+   */
+  private instantiatePlugin(pluginModule: any): PluginInterface {
+    // Check if it's a class or instance
+    if (pluginModule.default) {
+      return new pluginModule.default();
+    } else if (typeof pluginModule === 'function') {
+      return new pluginModule();
+    } else if (typeof pluginModule === 'object' && pluginModule.metadata) {
+      return pluginModule;
+    }
+
+    throw new PluginLoadError('Unknown', 'Plugin module must export a class, function, or object with metadata');
+  }
+
+  /**
+   * Validate plugin interface
+   */
+  private validatePluginInterface(plugin: any): void {
+    const errors: string[] = [];
+
+    // Check metadata
+    if (!plugin.metadata) {
+      errors.push('Missing required property: metadata');
+    } else {
+      const metadata = plugin.metadata;
+      if (!metadata.id) errors.push('Missing required metadata.id');
+      if (!metadata.name) errors.push('Missing required metadata.name');
+      if (!metadata.version) errors.push('Missing required metadata.version');
+      if (!metadata.description) errors.push('Missing required metadata.description');
+    }
+
+    if (errors.length > 0) {
+      throw new InvalidPluginPackageError('', errors);
+    }
+  }
+
+  /**
+   * Validate version compatibility
+   */
+  private validateVersionCompatibility(pluginId: string, requiredVersion: string): void {
+    if (!semver.satisfies(this.middlewareVersion, requiredVersion)) {
+      throw new PluginVersionError(
+        pluginId,
+        requiredVersion,
+        this.middlewareVersion
+      );
+    }
+  }
+
+  /**
+   * Validate plugin dependencies
+   */
+  private validateDependencies(pluginId: string, dependencies: string[]): void {
+    const missingDeps = dependencies.filter(dep => !this.loadedPlugins.has(dep));
+
+    if (missingDeps.length > 0) {
+      if (this.strictMode) {
+        throw new PluginDependencyError(pluginId, missingDeps);
+      } else {
+        this.logger.warn(`Plugin ${pluginId} has unmet dependencies:`, missingDeps.join(', '));
+      }
+    }
+  }
+
+  /**
+   * Initialize a loaded plugin
+   */
+  async initPlugin(pluginId: string, config?: PluginConfig): Promise<void> {
+    const loadedPlugin = this.loadedPlugins.get(pluginId);
+    if (!loadedPlugin) {
+      throw new PluginNotFoundError(pluginId);
+    }
+
+    try {
+      const mergedConfig = { ...loadedPlugin.config, ...config };
+
+      // Call onInit hook
+      if (loadedPlugin.instance.onInit) {
+        await loadedPlugin.instance.onInit(mergedConfig, this.pluginContext);
+      }
+
+      loadedPlugin.config = mergedConfig;
+      this.logger.log(`✓ Plugin initialized: ${pluginId}`);
+    } catch (error) {
+      throw new PluginInitError(pluginId, error.message, error);
+    }
+  }
+
+  /**
+   * Activate a loaded plugin
+   */
+  async activatePlugin(pluginId: string): Promise<void> {
+    const loadedPlugin = this.loadedPlugins.get(pluginId);
+    if (!loadedPlugin) {
+      throw new PluginNotFoundError(pluginId);
+    }
+
+    try {
+      // Call onActivate hook
+      if (loadedPlugin.instance.onActivate) {
+        await loadedPlugin.instance.onActivate(this.pluginContext);
+      }
+
+      loadedPlugin.active = true;
+      this.logger.log(`✓ Plugin activated: ${pluginId}`);
+    } catch (error) {
+      throw new PluginInitError(pluginId, `Activation failed: ${error.message}`, error);
+    }
+  }
+
+  /**
+   * Deactivate a plugin
+   */
+  async deactivatePlugin(pluginId: string): Promise<void> {
+    const loadedPlugin = this.loadedPlugins.get(pluginId);
+    if (!loadedPlugin) {
+      throw new PluginNotFoundError(pluginId);
+    }
+
+    try {
+      // Call onDeactivate hook
+      if (loadedPlugin.instance.onDeactivate) {
+        await loadedPlugin.instance.onDeactivate(this.pluginContext);
+      }
+
+      loadedPlugin.active = false;
+      this.logger.log(`✓ Plugin deactivated: ${pluginId}`);
+    } catch (error) {
+      this.logger.error(`Error deactivating plugin ${pluginId}:`, error.message);
+    }
+  }
+
+  /**
+   * Unload a plugin
+   */
+  async unloadPlugin(pluginId: string): Promise<void> {
+    const loadedPlugin = this.loadedPlugins.get(pluginId);
+    if (!loadedPlugin) {
+      throw new PluginNotFoundError(pluginId);
+    }
+
+    try {
+      // Deactivate first if active
+      if (loadedPlugin.active) {
+        await this.deactivatePlugin(pluginId);
+      }
+
+      // Call onUnload hook
+      if (loadedPlugin.instance.onUnload) {
+        await loadedPlugin.instance.onUnload(this.pluginContext);
+      }
+
+      this.loadedPlugins.delete(pluginId);
+      this.logger.log(`✓ Plugin unloaded: ${pluginId}`);
+    } catch (error) {
+      this.logger.error(`Error unloading plugin ${pluginId}:`, error.message);
+    }
+  }
+
+  /**
+   * Reload a plugin (update config without full unload)
+   */
+  async reloadPlugin(pluginId: string, config?: PluginConfig): Promise<void> {
+    const loadedPlugin = this.loadedPlugins.get(pluginId);
+    if (!loadedPlugin) {
+      throw new PluginNotFoundError(pluginId);
+    }
+
+    try {
+      const mergedConfig = { ...loadedPlugin.config, ...config };
+
+      // Call onReload hook
+      if (loadedPlugin.instance.onReload) {
+        await loadedPlugin.instance.onReload(mergedConfig, this.pluginContext);
+      } else {
+        // Fallback to deactivate + reactivate
+        if (loadedPlugin.active) {
+          await this.deactivatePlugin(pluginId);
+        }
+        loadedPlugin.config = mergedConfig;
+        await this.activatePlugin(pluginId);
+      }
+
+      loadedPlugin.config = mergedConfig;
+      this.logger.log(`✓ Plugin reloaded: ${pluginId}`);
+    } catch (error) {
+      throw new PluginInitError(pluginId, `Reload failed: ${error.message}`, error);
+    }
+  }
+
+  /**
+   * Get a loaded plugin by ID
+   */
+  getPlugin(pluginId: string): LoadedPlugin | undefined {
+    return this.loadedPlugins.get(pluginId);
+  }
+
+  /**
+   * Get all loaded plugins
+   */
+  getAllPlugins(): LoadedPlugin[] {
+    return Array.from(this.loadedPlugins.values());
+  }
+
+  /**
+   * Get active plugins only
+   */
+  getActivePlugins(): LoadedPlugin[] {
+    return this.getAllPlugins().filter(p => p.active);
+  }
+
+  /**
+   * Search plugins by criteria
+   */
+  searchPlugins(criteria: PluginSearchCriteria): LoadedPlugin[] {
+    let results = this.getAllPlugins();
+
+    if (criteria.query) {
+      const query = criteria.query.toLowerCase();
+      results = results.filter(
+        p => p.metadata.id.toLowerCase().includes(query) ||
+        p.metadata.name.toLowerCase().includes(query)
+      );
+    }
+
+    if (criteria.keywords && criteria.keywords.length > 0) {
+      results = results.filter(
+        p => p.metadata.keywords && 
+        criteria.keywords.some(kw => p.metadata.keywords.includes(kw))
+      );
+    }
+
+    if (criteria.author) {
+      results = results.filter(p => p.metadata.author?.toLowerCase() === criteria.author.toLowerCase());
+    }
+
+    if (criteria.enabled !== undefined) {
+      results = results.filter(p => (p.config.enabled ?? true) === criteria.enabled);
+    }
+
+    if (criteria.active !== undefined) {
+      results = results.filter(p => p.active === criteria.active);
+    }
+
+    if (criteria.priority) {
+      results = results.filter(p => {
+        const priority = p.metadata.priority ?? 0;
+        if (criteria.priority.min !== undefined && priority < criteria.priority.min) return false;
+        if (criteria.priority.max !== undefined && priority > criteria.priority.max) return false;
+        return true;
+      });
+    }
+
+    return results.sort((a, b) => (b.metadata.priority ?? 0) - (a.metadata.priority ?? 0));
+  }
+
+  /**
+   * Validate plugin configuration
+   */
+  validatePluginConfig(pluginId: string, config: PluginConfig): PluginValidationResult {
+    const plugin = this.loadedPlugins.get(pluginId);
+    if (!plugin) {
+      return {
+        valid: false,
+        errors: [`Plugin not found: ${pluginId}`],
+        warnings: []
+      };
+    }
+
+    const errors: string[] = [];
+    const warnings: string[] = [];
+
+    // Validate using plugin's validator if available
+    if (plugin.instance.validateConfig) {
+      const result = plugin.instance.validateConfig(config);
+      errors.push(...result.errors);
+    }
+
+    // Check if disabled plugins should not be configured
+    if (config.enabled === false && config.options) {
+      warnings.push('Plugin is disabled but options are provided');
+    }
+
+    return {
+      valid: errors.length === 0,
+      errors,
+      warnings
+    };
+  }
+
+  /**
+   * Get plugin statistics
+   */
+  getStatistics(): {
+    totalLoaded: number;
+    totalActive: number;
+    totalDisabled: number;
+    plugins: Array<{ id: string; name: string; version: string; active: boolean; priority: number }>;
+  } {
+    const plugins = this.getAllPlugins().sort((a, b) => (b.metadata.priority ?? 0) - (a.metadata.priority ?? 0));
+
+    return {
+      totalLoaded: plugins.length,
+      totalActive: plugins.filter(p => p.active).length,
+      totalDisabled: plugins.filter(p => !p.config.enabled).length,
+      plugins: plugins.map(p => ({
+        id: p.metadata.id,
+        name: p.metadata.name,
+        version: p.metadata.version,
+        active: p.active,
+        priority: p.metadata.priority ?? 0
+      }))
+    };
+  }
+}
diff --git a/middleware/src/common/utils/plugin-registry.ts b/middleware/src/common/utils/plugin-registry.ts
new file mode 100644
index 00000000..d60dea9b
--- /dev/null
+++ b/middleware/src/common/utils/plugin-registry.ts
@@ -0,0 +1,370 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { PluginLoader, PluginLoaderConfig } from './plugin-loader';
+import {
+  PluginInterface,
+  PluginConfig,
+  LoadedPlugin,
+  PluginSearchCriteria,
+  PluginValidationResult
+} from '../interfaces/plugin.interface';
+import { PluginNotFoundError, PluginLoadError } from '../interfaces/plugin.errors';
+
+/**
+ * Plugin Registry Configuration
+ */
+export interface PluginRegistryConfig extends PluginLoaderConfig {
+  /** Automatically discover and load plugins on initialization */
+  autoDiscoverOnInit?: boolean;
+
+  /** Plugins to load automatically */
+  autoLoadPlugins?: string[];
+
+  /** Default configuration for all plugins */
+  defaultConfig?: PluginConfig;
+}
+
+/**
+ * Plugin Registry
+ *
+ * High-level service for managing plugins. Provides:
+ * - Plugin discovery and loading
+ * - Lifecycle management
+ * - Plugin registry operations
+ * - Middleware integration
+ */
+@Injectable()
+export class PluginRegistry {
+  private readonly logger: Logger;
+  private readonly loader: PluginLoader;
+  private readonly autoDiscoverOnInit: boolean;
+  private readonly autoLoadPlugins: string[];
+  private readonly defaultConfig: PluginConfig;
+  private initialized: boolean = false;
+
+  constructor(config: PluginRegistryConfig = {}) {
+    this.logger = config.logger || new Logger('PluginRegistry');
+    this.loader = new PluginLoader(config);
+    this.autoDiscoverOnInit = config.autoDiscoverOnInit !== false;
+    this.autoLoadPlugins = config.autoLoadPlugins || [];
+    this.defaultConfig = config.defaultConfig || { enabled: true };
+  }
+
+  /**
+   * Initialize the plugin registry
+   * - Discover available plugins
+   * - Load auto-load plugins
+   */
+  async init(): Promise<void> {
+    if (this.initialized) {
+      this.logger.warn('Plugin registry already initialized');
+      return;
+    }
+
+    try {
+      this.logger.log('🔌 Initializing Plugin Registry...');
+
+      // Discover available plugins
+      if (this.autoDiscoverOnInit) {
+        this.logger.log('📦 Discovering available plugins...');
+        const discovered = await this.loader.discoverPlugins();
+        this.logger.log(`✓ Found ${discovered.length} available plugins`);
+      }
+
+      // Auto-load configured plugins
+      if (this.autoLoadPlugins.length > 0) {
+        this.logger.log(`📥 Auto-loading ${this.autoLoadPlugins.length} plugins...`);
+        for (const pluginName of this.autoLoadPlugins) {
+          try {
+            await this.load(pluginName);
+          } catch (error) {
+            this.logger.warn(`Failed to auto-load plugin ${pluginName}: ${error.message}`);
+          }
+        }
+      }
+
+      this.initialized = true;
+      const stats = this.getStatistics();
+      this.logger.log(`✓ Plugin Registry initialized - ${stats.totalLoaded} plugins loaded, ${stats.totalActive} active`);
+    } catch (error) {
+      this.logger.error('Failed to initialize Plugin Registry:', error.message);
+      throw error;
+    }
+  }
+
+  /**
+   * Load a plugin
+   */
+  async load(pluginName: string, config?: PluginConfig): Promise<LoadedPlugin> {
+    const mergedConfig = { ...this.defaultConfig, ...config };
+    return this.loader.loadPlugin(pluginName, mergedConfig);
+  }
+
+  /**
+   * Initialize a plugin (setup with configuration)
+   */
+  async initialize(pluginId: string, config?: PluginConfig): Promise<void> {
+    return this.loader.initPlugin(pluginId, config);
+  }
+
+  /**
+   * Activate a plugin
+   */
+  async activate(pluginId: string): Promise<void> {
+    return this.loader.activatePlugin(pluginId);
+  }
+
+  /**
+   * Deactivate a plugin
+   */
+  async deactivate(pluginId: string): Promise<void> {
+    return this.loader.deactivatePlugin(pluginId);
+  }
+
+  /**
+   * Unload a plugin
+   */
+  async unload(pluginId: string): Promise<void> {
+    return this.loader.unloadPlugin(pluginId);
+  }
+
+  /**
+   * Reload a plugin with new configuration
+   */
+  async reload(pluginId: string, config?: PluginConfig): Promise<void> {
+    return this.loader.reloadPlugin(pluginId, config);
+  }
+
+  /**
+   * Load and activate a plugin in one step
+   */
+  async loadAndActivate(pluginName: string, config?: PluginConfig): Promise<LoadedPlugin> {
+    const loaded = await this.load(pluginName, config);
+    await this.initialize(loaded.metadata.id, config);
+    await this.activate(loaded.metadata.id);
+    return loaded;
+  }
+
+  /**
+   * Get plugin by ID
+   */
+  getPlugin(pluginId: string): LoadedPlugin | undefined {
+    return this.loader.getPlugin(pluginId);
+  }
+
+  /**
+   * Get plugin by ID or throw error
+   */
+  getPluginOrThrow(pluginId: string): LoadedPlugin {
+    const plugin = this.getPlugin(pluginId);
+    if (!plugin) {
+      throw new PluginNotFoundError(pluginId);
+    }
+    return plugin;
+  }
+
+  /**
+   * Get all plugins
+   */
+  getAllPlugins(): LoadedPlugin[] {
+    return this.loader.getAllPlugins();
+  }
+
+  /**
+   * Get active plugins only
+   */
+  getActivePlugins(): LoadedPlugin[] {
+    return this.loader.getActivePlugins();
+  }
+
+  /**
+   * Search plugins
+   */
+  searchPlugins(criteria: PluginSearchCriteria): LoadedPlugin[] {
+    return this.loader.searchPlugins(criteria);
+  }
+
+  /**
+   * Validate plugin configuration
+   */
+  validateConfig(pluginId: string, config: PluginConfig): PluginValidationResult {
+    return this.loader.validatePluginConfig(pluginId, config);
+  }
+
+  /**
+   * Get plugin middleware
+   */
+  getMiddleware(pluginId: string) {
+    const plugin = this.getPluginOrThrow(pluginId);
+
+    if (!plugin.instance.getMiddleware) {
+      throw new PluginLoadError(
+        pluginId,
+        'Plugin does not export middleware'
+      );
+    }
+
+    return plugin.instance.getMiddleware();
+  }
+
+  /**
+   * Get all plugin middlewares
+   */
+  getAllMiddleware() {
+    const middlewares: Record<string, any> = {};
+
+    for (const plugin of this.getActivePlugins()) {
+      if (plugin.instance.getMiddleware && plugin.config.enabled !== false) {
+        middlewares[plugin.metadata.id] = plugin.instance.getMiddleware();
+      }
+    }
+
+    return middlewares;
+  }
+
+  /**
+   * Get plugin exports
+   */
+  getExports(pluginId: string): Record<string, any> | undefined {
+    const plugin = this.getPluginOrThrow(pluginId);
+    return plugin.instance.getExports?.();
+  }
+
+  /**
+   * Get all plugin exports
+   */
+  getAllExports(): Record<string, any> {
+    const allExports: Record<string, any> = {};
+
+    for (const plugin of this.getAllPlugins()) {
+      if (plugin.instance.getExports) {
+        const exports = plugin.instance.getExports();
+        if (exports) {
+          allExports[plugin.metadata.id] = exports;
+        }
+      }
+    }
+
+    return allExports;
+  }
+
+  /**
+   * Check if plugin is loaded
+   */
+  isLoaded(pluginId: string): boolean {
+    return this.loader.getPlugin(pluginId) !== undefined;
+  }
+
+  /**
+   * Check if plugin is active
+   */
+  isActive(pluginId: string): boolean {
+    const plugin = this.loader.getPlugin(pluginId);
+    return plugin?.active ?? false;
+  }
+
+  /**
+   * Count plugins
+   */
+  count(): number {
+    return this.getAllPlugins().length;
+  }
+
+  /**
+   * Count active plugins
+   */
+  countActive(): number {
+    return this.getActivePlugins().length;
+  }
+
+  /**
+   * Get registry statistics
+   */
+  getStatistics() {
+    return this.loader.getStatistics();
+  }
+
+  /**
+   * Unload all plugins
+   */
+  async unloadAll(): Promise<void> {
+    const plugins = [...this.getAllPlugins()];
+
+    for (const plugin of plugins) {
+      try {
+        await this.unload(plugin.metadata.id);
+      } catch (error) {
+        this.logger.error(`Error unloading plugin ${plugin.metadata.id}:`, error.message);
+      }
+    }
+
+    this.logger.log('✓ All plugins unloaded');
+  }
+
+  /**
+   * Activate all enabled plugins
+   */
+  async activateAll(): Promise<void> {
+    for (const plugin of this.getAllPlugins()) {
+      if (plugin.config.enabled !== false && !plugin.active) {
+        try {
+          await this.activate(plugin.metadata.id);
+        } catch (error) {
+          this.logger.error(`Error activating plugin ${plugin.metadata.id}:`, error.message);
+        }
+      }
+    }
+  }
+
+  /**
+   * Deactivate all plugins
+   */
+  async deactivateAll(): Promise<void> {
+    for (const plugin of this.getActivePlugins()) {
+      try {
+        await this.deactivate(plugin.metadata.id);
+      } catch (error) {
+        this.logger.error(`Error deactivating plugin ${plugin.metadata.id}:`, error.message);
+      }
+    }
+  }
+
+  /**
+   * Export registry state (for debugging/monitoring)
+   */
+  exportState(): {
+    initialized: boolean;
+    totalPlugins: number;
+    activePlugins: number;
+    plugins: Array<{
+      id: string;
+      name: string;
+      version: string;
+      active: boolean;
+      enabled: boolean;
+      priority: number;
+      dependencies: string[];
+    }>;
+  } {
+    return {
+      initialized: this.initialized,
+      totalPlugins: this.count(),
+      activePlugins: this.countActive(),
+      plugins: this.getAllPlugins().map(p => ({
+        id: p.metadata.id,
+        name: p.metadata.name,
+        version: p.metadata.version,
+        active: p.active,
+        enabled: p.config.enabled !== false,
+        priority: p.metadata.priority ?? 0,
+        dependencies: p.dependencies
+      }))
+    };
+  }
+
+  /**
+   * Check initialization status
+   */
+  isInitialized(): boolean {
+    return this.initialized;
+  }
+}
diff --git a/middleware/src/index.ts b/middleware/src/index.ts
index 088f941a..8b884b41 100644
--- a/middleware/src/index.ts
+++ b/middleware/src/index.ts
@@ -18,3 +18,15 @@ export * from './middleware/advanced/circuit-breaker.middleware';
 
 // Blockchain module — Issues #307, #308, #309, #310
 export * from './blockchain';
+
+// External Plugin Loader System
+export * from './common/utils/plugin-loader';
+export * from './common/utils/plugin-registry';
+export * from './common/interfaces/plugin.interface';
+export * from './common/interfaces/plugin.errors';
+
+// Lifecycle Error Handling and Timeouts
+export * from './common/utils/lifecycle-timeout-manager';
+
+// First-Party Plugins
+export * from './plugins';
diff --git a/middleware/src/plugins/example.plugin.ts b/middleware/src/plugins/example.plugin.ts
new file mode 100644
index 00000000..0e5937ad
--- /dev/null
+++ b/middleware/src/plugins/example.plugin.ts
@@ -0,0 +1,193 @@
+import { NestMiddleware, Logger } from '@nestjs/common';
+import { Request, Response, NextFunction } from 'express';
+import {
+  PluginInterface,
+  PluginMetadata,
+  PluginConfig,
+  PluginContext
+} from '../common/interfaces/plugin.interface';
+
+/**
+ * Example Plugin Template
+ *
+ * This is a template for creating custom middleware plugins for the @mindblock/middleware package.
+ *
+ * Usage:
+ * 1. Copy this file to your plugin project
+ * 2. Implement the required methods (getMiddleware, etc.)
+ * 3. Export an instance or class from your plugin's main entry point
+ * 4. Add plugin configuration to your package.json
+ */
+export class ExamplePlugin implements PluginInterface {
+  private readonly logger = new Logger('ExamplePlugin');
+  private isInitialized = false;
+
+  // Required: Plugin metadata
+  metadata: PluginMetadata = {
+    id: 'com.example.plugin.demo',
+    name: 'Example Plugin',
+    description: 'A template example plugin for middleware',
+    version: '1.0.0',
+    author: 'Your Name/Organization',
+    homepage: 'https://github.com/your-org/plugin-example',
+    license: 'MIT',
+    keywords: ['example', 'template', 'middleware'],
+    priority: 10,
+    autoLoad: false
+  };
+
+  /**
+   * Optional: Called when plugin is first loaded
+   */
+  async onLoad(context: PluginContext): Promise<void> {
+    this.logger.log('Plugin loaded');
+    // Perform initial setup: validate dependencies, check environment, etc.
+  }
+
+  /**
+   * Optional: Called when plugin is initialized with configuration
+   */
+  async onInit(config: PluginConfig, context: PluginContext): Promise<void> {
+    this.logger.log('Plugin initialized with config:', config);
+    this.isInitialized = true;
+    // Initialize based on provided configuration
+  }
+
+  /**
+   * Optional: Called when plugin is activated
+   */
+  async onActivate(context: PluginContext): Promise<void> {
+    this.logger.log('Plugin activated');
+    // Perform activation tasks (start services, open connections, etc.)
+  }
+
+  /**
+   * Optional: Called when plugin is deactivated
+   */
+  async onDeactivate(context: PluginContext): Promise<void> {
+    this.logger.log('Plugin deactivated');
+    // Perform cleanup (stop services, close connections, etc.)
+  }
+
+  /**
+   * Optional: Called when plugin is unloaded
+   */
+  async onUnload(context: PluginContext): Promise<void> {
+    this.logger.log('Plugin unloaded');
+    // Final cleanup
+  }
+
+  /**
+   * Optional: Called when plugin is reloaded
+   */
+  async onReload(config: PluginConfig, context: PluginContext): Promise<void> {
+    this.logger.log('Plugin reloaded with new config:', config);
+    await this.onDeactivate(context);
+    await this.onInit(config, context);
+    await this.onActivate(context);
+  }
+
+  /**
+   * Optional: Validate provided configuration
+   */
+  validateConfig(config: PluginConfig): { valid: boolean; errors: string[] } {
+    const errors: string[] = [];
+
+    if (config.options) {
+      // Add your validation logic here
+      if (config.options.someRequiredField === undefined) {
+        errors.push('someRequiredField is required');
+      }
+    }
+
+    return { valid: errors.length === 0, errors };
+  }
+
+  /**
+   * Optional: Get list of plugin dependencies
+   */
+  getDependencies(): string[] {
+    return []; // Return IDs of plugins that must be loaded before this one
+  }
+
+  /**
+   * Export the middleware (if this plugin provides a middleware)
+   */
+  getMiddleware(): NestMiddleware {
+    return {
+      use: (req: Request, res: Response, next: NextFunction) => {
+        this.logger.log(`Example middleware - ${req.method} ${req.path}`);
+        
+        // Your middleware logic here
+        // Example: add custom header
+        res.setHeader('X-Example-Plugin', 'active');
+
+        // Continue to next middleware
+        next();
+      }
+    };
+  }
+
+  /**
+   * Optional: Export additional utilities/helpers from the plugin
+   */
+  getExports(): Record<string, any> {
+    return {
+      exampleFunction: () => 'Hello from example plugin',
+      exampleValue: 42
+    };
+  }
+
+  /**
+   * Custom method example
+   */
+  customMethod(data: string): string {
+    if (!this.isInitialized) {
+      throw new Error('Plugin not initialized');
+    }
+    return `Processed: ${data}`;
+  }
+}
+
+// Export as default for easier importing
+export default ExamplePlugin;
+
+/**
+ * Plugin package.json configuration example:
+ *
+ * {
+ *   "name": "@yourorg/plugin-example",
+ *   "version": "1.0.0",
+ *   "description": "Example middleware plugin",
+ *   "main": "dist/example.plugin.js",
+ *   "types": "dist/example.plugin.d.ts",
+ *   "license": "MIT",
+ *   "keywords": ["mindblock", "plugin", "middleware"],
+ *   "mindblockPlugin": {
+ *     "version": "^1.0.0",
+ *     "priority": 10,
+ *     "autoLoad": false,
+ *     "configSchema": {
+ *       "type": "object",
+ *       "properties": {
+ *         "enabled": { "type": "boolean", "default": true },
+ *         "options": {
+ *           "type": "object",
+ *           "properties": {
+ *             "someRequiredField": { "type": "string" }
+ *           }
+ *         }
+ *       }
+ *     }
+ *   },
+ *   "dependencies": {
+ *     "@nestjs/common": "^11.0.0",
+ *     "@mindblock/middleware": "^1.0.0"
+ *   },
+ *   "devDependencies": {
+ *     "@types/express": "^5.0.0",
+ *     "@types/node": "^20.0.0",
+ *     "typescript": "^5.0.0"
+ *   }
+ * }
+ */
diff --git a/middleware/src/plugins/index.ts b/middleware/src/plugins/index.ts
new file mode 100644
index 00000000..cccf1a2c
--- /dev/null
+++ b/middleware/src/plugins/index.ts
@@ -0,0 +1,16 @@
+/**
+ * First-Party Plugins
+ *
+ * This module exports all official first-party plugins provided by @mindblock/middleware.
+ * These plugins are fully tested, documented, and production-ready.
+ *
+ * Available Plugins:
+ * - RequestLoggerPlugin — HTTP request logging with configurable verbosity
+ * - ExamplePlugin — Plugin template for developers
+ */
+
+export { default as RequestLoggerPlugin } from './request-logger.plugin';
+export * from './request-logger.plugin';
+
+export { default as ExamplePlugin } from './example.plugin';
+export * from './example.plugin';
diff --git a/middleware/src/plugins/request-logger.plugin.ts b/middleware/src/plugins/request-logger.plugin.ts
new file mode 100644
index 00000000..61c9ff5c
--- /dev/null
+++ b/middleware/src/plugins/request-logger.plugin.ts
@@ -0,0 +1,431 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Request, Response, NextFunction } from 'express';
+import {
+  PluginInterface,
+  PluginMetadata,
+  PluginConfig,
+  PluginContext
+} from '../common/interfaces/plugin.interface';
+
+/**
+ * Request Logger Plugin — First-Party Plugin
+ *
+ * Logs all HTTP requests with configurable detail levels and filtering.
+ * Provides structured logging with request metadata and response information.
+ *
+ * Features:
+ * - Multiple log levels (debug, info, warn, error)
+ * - Exclude paths from logging (health checks, metrics, etc.)
+ * - Request/response timing information
+ * - Response status code logging
+ * - Custom header logging
+ * - Request ID correlation
+ */
+@Injectable()
+export class RequestLoggerPlugin implements PluginInterface {
+  private readonly logger = new Logger('RequestLogger');
+  private isInitialized = false;
+
+  // Configuration properties
+  private logLevel: 'debug' | 'info' | 'warn' | 'error' = 'info';
+  private excludePaths: string[] = [];
+  private logHeaders: boolean = false;
+  private logBody: boolean = false;
+  private maxBodyLength: number = 500;
+  private colorize: boolean = true;
+  private requestIdHeader: string = 'x-request-id';
+
+  metadata: PluginMetadata = {
+    id: '@mindblock/plugin-request-logger',
+    name: 'Request Logger',
+    description: 'HTTP request logging middleware with configurable verbosity and filtering',
+    version: '1.0.0',
+    author: 'MindBlock Team',
+    homepage: 'https://github.com/MindBlockLabs/mindBlock_Backend/tree/main/middleware',
+    license: 'ISC',
+    keywords: ['logging', 'request', 'middleware', 'http', 'first-party'],
+    priority: 100, // High priority to log early in the chain
+    autoLoad: false,
+    configSchema: {
+      type: 'object',
+      properties: {
+        enabled: {
+          type: 'boolean',
+          default: true,
+          description: 'Enable or disable request logging'
+        },
+        options: {
+          type: 'object',
+          properties: {
+            logLevel: {
+              type: 'string',
+              enum: ['debug', 'info', 'warn', 'error'],
+              default: 'info',
+              description: 'Logging verbosity level'
+            },
+            excludePaths: {
+              type: 'array',
+              items: { type: 'string' },
+              default: ['/health', '/metrics', '/favicon.ico'],
+              description: 'Paths to exclude from logging'
+            },
+            logHeaders: {
+              type: 'boolean',
+              default: false,
+              description: 'Log request and response headers'
+            },
+            logBody: {
+              type: 'boolean',
+              default: false,
+              description: 'Log request/response body (first N bytes)'
+            },
+            maxBodyLength: {
+              type: 'number',
+              default: 500,
+              minimum: 0,
+              description: 'Maximum body content to log in bytes'
+            },
+            colorize: {
+              type: 'boolean',
+              default: true,
+              description: 'Add ANSI color codes to log output'
+            },
+            requestIdHeader: {
+              type: 'string',
+              default: 'x-request-id',
+              description: 'Header name for request correlation ID'
+            }
+          }
+        }
+      }
+    }
+  };
+
+  /**
+   * Called when plugin is loaded
+   */
+  async onLoad(context: PluginContext): Promise<void> {
+    this.logger.log('✓ Request Logger plugin loaded');
+  }
+
+  /**
+   * Called during initialization with configuration
+   */
+  async onInit(config: PluginConfig, context: PluginContext): Promise<void> {
+    if (config.options) {
+      this.logLevel = config.options.logLevel ?? 'info';
+      this.excludePaths = config.options.excludePaths ?? ['/health', '/metrics', '/favicon.ico'];
+      this.logHeaders = config.options.logHeaders ?? false;
+      this.logBody = config.options.logBody ?? false;
+      this.maxBodyLength = config.options.maxBodyLength ?? 500;
+      this.colorize = config.options.colorize ?? true;
+      this.requestIdHeader = config.options.requestIdHeader ?? 'x-request-id';
+    }
+
+    this.isInitialized = true;
+    context.logger?.log(
+      `✓ Request Logger initialized with level=${this.logLevel}, excludePaths=${this.excludePaths.join(', ')}`
+    );
+  }
+
+  /**
+   * Called when plugin is activated
+   */
+  async onActivate(context: PluginContext): Promise<void> {
+    this.logger.log('✓ Request Logger activated');
+  }
+
+  /**
+   * Called when plugin is deactivated
+   */
+  async onDeactivate(context: PluginContext): Promise<void> {
+    this.logger.log('✓ Request Logger deactivated');
+  }
+
+  /**
+   * Called when plugin is unloaded
+   */
+  async onUnload(context: PluginContext): Promise<void> {
+    this.logger.log('✓ Request Logger unloaded');
+  }
+
+  /**
+   * Validate plugin configuration
+   */
+  validateConfig(config: PluginConfig): { valid: boolean; errors: string[] } {
+    const errors: string[] = [];
+
+    if (config.options) {
+      if (config.options.logLevel && !['debug', 'info', 'warn', 'error'].includes(config.options.logLevel)) {
+        errors.push('logLevel must be one of: debug, info, warn, error');
+      }
+
+      if (config.options.maxBodyLength !== undefined && config.options.maxBodyLength < 0) {
+        errors.push('maxBodyLength must be >= 0');
+      }
+
+      if (config.options.excludePaths && !Array.isArray(config.options.excludePaths)) {
+        errors.push('excludePaths must be an array of strings');
+      }
+    }
+
+    return { valid: errors.length === 0, errors };
+  }
+
+  /**
+   * Get plugin dependencies
+   */
+  getDependencies(): string[] {
+    return []; // No dependencies
+  }
+
+  /**
+   * Export the logging middleware
+   */
+  getMiddleware() {
+    if (!this.isInitialized) {
+      throw new Error('Request Logger plugin not initialized');
+    }
+
+    return (req: Request, res: Response, next: NextFunction) => {
+      // Skip excluded paths
+      if (this.shouldExcludePath(req.path)) {
+        return next();
+      }
+
+      // Record request start time
+      const startTime = Date.now();
+      const requestId = this.extractRequestId(req);
+
+      // Capture original send
+      const originalSend = res.send;
+      let responseBody = '';
+
+      // Override send to capture response
+      res.send = function (data: any) {
+        if (this.logBody && data) {
+          responseBody = typeof data === 'string' ? data : JSON.stringify(data);
+        }
+        return originalSend.call(this, data);
+      };
+
+      // Log on response finish
+      res.on('finish', () => {
+        const duration = Date.now() - startTime;
+        this.logRequest(req, res, duration, requestId, responseBody);
+      });
+
+      // Attach request ID to request object for downstream use
+      (req as any).requestId = requestId;
+
+      next();
+    };
+  }
+
+  /**
+   * Export utility functions
+   */
+  getExports() {
+    return {
+      /**
+       * Extract request ID from a request object
+       */
+      getRequestId: (req: Request): string => {
+        return (req as any).requestId || this.extractRequestId(req);
+      },
+
+      /**
+       * Set current log level
+       */
+      setLogLevel: (level: 'debug' | 'info' | 'warn' | 'error') => {
+        this.logLevel = level;
+      },
+
+      /**
+       * Get current log level
+       */
+      getLogLevel: (): string => this.logLevel,
+
+      /**
+       * Add paths to exclude from logging
+       */
+      addExcludePaths: (...paths: string[]) => {
+        this.excludePaths.push(...paths);
+      },
+
+      /**
+       * Remove paths from exclusion
+       */
+      removeExcludePaths: (...paths: string[]) => {
+        this.excludePaths = this.excludePaths.filter(p => !paths.includes(p));
+      },
+
+      /**
+       * Get current excluded paths
+       */
+      getExcludePaths: (): string[] => [...this.excludePaths],
+
+      /**
+       * Clear all excluded paths
+       */
+      clearExcludePaths: () => {
+        this.excludePaths = [];
+      }
+    };
+  }
+
+  /**
+   * Private helper: Check if path should be excluded
+   */
+  private shouldExcludePath(path: string): boolean {
+    return this.excludePaths.some(excludePath => {
+      if (excludePath.includes('*')) {
+        const regex = this.globToRegex(excludePath);
+        return regex.test(path);
+      }
+      return path === excludePath || path.startsWith(excludePath);
+    });
+  }
+
+  /**
+   * Private helper: Extract request ID from headers or generate one
+   */
+  private extractRequestId(req: Request): string {
+    const headerValue = req.headers[this.requestIdHeader.toLowerCase()];
+    if (typeof headerValue === 'string') {
+      return headerValue;
+    }
+    return `req-${Date.now()}-${Math.random().toString(36).substring(7)}`;
+  }
+
+  /**
+   * Private helper: Convert glob pattern to regex
+   */
+  private globToRegex(glob: string): RegExp {
+    const reStr = glob
+      .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+      .replace(/\*/g, '.*')
+      .replace(/\?/g, '.');
+    return new RegExp(`^${reStr}$`);
+  }
+
+  /**
+   * Private helper: Log the request
+   */
+  private logRequest(req: Request, res: Response, duration: number, requestId: string, responseBody: string): void {
+    const method = this.colorize ? this.colorizeMethod(req.method) : req.method;
+    const status = this.colorize ? this.colorizeStatus(res.statusCode) : res.statusCode.toString();
+    const timestamp = new Date().toISOString();
+
+    let logMessage = `[${timestamp}] ${requestId} ${method} ${req.path} ${status} (${duration}ms)`;
+
+    // Add query string if present
+    if (req.query && Object.keys(req.query).length > 0) {
+      logMessage += ` - Query: ${JSON.stringify(req.query)}`;
+    }
+
+    // Add headers if enabled
+    if (this.logHeaders) {
+      const relevantHeaders = this.filterHeaders(req.headers);
+      if (Object.keys(relevantHeaders).length > 0) {
+        logMessage += ` - Headers: ${JSON.stringify(relevantHeaders)}`;
+      }
+    }
+
+    // Add body if enabled
+    if (this.logBody && responseBody) {
+      const body = responseBody.substring(0, this.maxBodyLength);
+      logMessage += ` - Body: ${body}${responseBody.length > this.maxBodyLength ? '...' : ''}`;
+    }
+
+    // Log based on status code
+    if (res.statusCode >= 500) {
+      this.logger.error(logMessage);
+    } else if (res.statusCode >= 400) {
+      this.logByLevel('warn', logMessage);
+    } else if (res.statusCode >= 200 && res.statusCode < 300) {
+      this.logByLevel(this.logLevel, logMessage);
+    } else {
+      this.logByLevel('info', logMessage);
+    }
+  }
+
+  /**
+   * Private helper: Log by level
+   */
+  private logByLevel(level: string, message: string): void {
+    switch (level) {
+      case 'debug':
+        this.logger.debug(message);
+        break;
+      case 'info':
+        this.logger.log(message);
+        break;
+      case 'warn':
+        this.logger.warn(message);
+        break;
+      case 'error':
+        this.logger.error(message);
+        break;
+      default:
+        this.logger.log(message);
+    }
+  }
+
+  /**
+   * Private helper: Filter headers to exclude sensitive ones
+   */
+  private filterHeaders(headers: any): Record<string, any> {
+    const sensitiveHeaders = ['authorization', 'cookie', 'x-api-key', 'x-auth-token', 'password'];
+    const filtered: Record<string, any> = {};
+
+    for (const [key, value] of Object.entries(headers)) {
+      if (!sensitiveHeaders.includes(key.toLowerCase())) {
+        filtered[key] = value;
+      }
+    }
+
+    return filtered;
+  }
+
+  /**
+   * Private helper: Colorize HTTP method
+   */
+  private colorizeMethod(method: string): string {
+    const colors: Record<string, string> = {
+      GET: '\x1b[36m', // Cyan
+      POST: '\x1b[32m', // Green
+      PUT: '\x1b[33m', // Yellow
+      DELETE: '\x1b[31m', // Red
+      PATCH: '\x1b[35m', // Magenta
+      HEAD: '\x1b[36m', // Cyan
+      OPTIONS: '\x1b[37m' // White
+    };
+
+    const color = colors[method] || '\x1b[37m';
+    const reset = '\x1b[0m';
+    return `${color}${method}${reset}`;
+  }
+
+  /**
+   * Private helper: Colorize HTTP status code
+   */
+  private colorizeStatus(status: number): string {
+    let color = '\x1b[37m'; // White (default)
+
+    if (status >= 200 && status < 300) {
+      color = '\x1b[32m'; // Green (2xx)
+    } else if (status >= 300 && status < 400) {
+      color = '\x1b[36m'; // Cyan (3xx)
+    } else if (status >= 400 && status < 500) {
+      color = '\x1b[33m'; // Yellow (4xx)
+    } else if (status >= 500) {
+      color = '\x1b[31m'; // Red (5xx)
+    }
+
+    const reset = '\x1b[0m';
+    return `${color}${status}${reset}`;
+  }
+}
+
+export default RequestLoggerPlugin;
diff --git a/middleware/src/security/index.ts b/middleware/src/security/index.ts
index f3e26a5f..c6f98f38 100644
--- a/middleware/src/security/index.ts
+++ b/middleware/src/security/index.ts
@@ -1,3 +1,4 @@
-// Placeholder: security middleware exports will live here.
+// Security middleware exports
 
-export const __securityPlaceholder = true;
+export * from './security-headers.middleware';
+export * from './security-headers.config';
diff --git a/middleware/tests/integration/benchmark.integration.spec.ts b/middleware/tests/integration/benchmark.integration.spec.ts
new file mode 100644
index 00000000..55a4e09f
--- /dev/null
+++ b/middleware/tests/integration/benchmark.integration.spec.ts
@@ -0,0 +1,42 @@
+import { SecurityHeadersMiddleware } from '../../src/security/security-headers.middleware';
+import { TimeoutMiddleware } from '../../src/middleware/advanced/timeout.middleware';
+import { CircuitBreakerMiddleware, CircuitBreakerService } from '../../src/middleware/advanced/circuit-breaker.middleware';
+import { CorrelationIdMiddleware } from '../../src/monitoring/correlation-id.middleware';
+
+describe('Middleware Benchmark Integration', () => {
+  it('should instantiate all benchmarked middleware without errors', () => {
+    // Test SecurityHeadersMiddleware
+    const securityMiddleware = new SecurityHeadersMiddleware();
+    expect(securityMiddleware).toBeDefined();
+    expect(typeof securityMiddleware.use).toBe('function');
+
+    // Test TimeoutMiddleware
+    const timeoutMiddleware = new TimeoutMiddleware({ timeout: 5000 });
+    expect(timeoutMiddleware).toBeDefined();
+    expect(typeof timeoutMiddleware.use).toBe('function');
+
+    // Test CircuitBreakerMiddleware
+    const circuitBreakerService = new CircuitBreakerService({
+      failureThreshold: 5,
+      recoveryTimeout: 30000,
+      monitoringPeriod: 10000
+    });
+    const circuitBreakerMiddleware = new CircuitBreakerMiddleware(circuitBreakerService);
+    expect(circuitBreakerMiddleware).toBeDefined();
+    expect(typeof circuitBreakerMiddleware.use).toBe('function');
+
+    // Test CorrelationIdMiddleware
+    const correlationMiddleware = new CorrelationIdMiddleware();
+    expect(correlationMiddleware).toBeDefined();
+    expect(typeof correlationMiddleware.use).toBe('function');
+  });
+
+  it('should have all required middleware exports', () => {
+    // This test ensures the middleware are properly exported for benchmarking
+    expect(SecurityHeadersMiddleware).toBeDefined();
+    expect(TimeoutMiddleware).toBeDefined();
+    expect(CircuitBreakerMiddleware).toBeDefined();
+    expect(CircuitBreakerService).toBeDefined();
+    expect(CorrelationIdMiddleware).toBeDefined();
+  });
+});
\ No newline at end of file
diff --git a/middleware/tests/integration/lifecycle-timeout-manager.spec.ts b/middleware/tests/integration/lifecycle-timeout-manager.spec.ts
new file mode 100644
index 00000000..37cec6a6
--- /dev/null
+++ b/middleware/tests/integration/lifecycle-timeout-manager.spec.ts
@@ -0,0 +1,557 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import LifecycleTimeoutManager, {
+  LifecycleTimeoutConfig,
+  RecoveryConfig,
+  RecoveryStrategy,
+  LifecycleErrorContext
+} from '../../src/common/utils/lifecycle-timeout-manager';
+
+describe('LifecycleTimeoutManager', () => {
+  let manager: LifecycleTimeoutManager;
+
+  beforeEach(() => {
+    manager = new LifecycleTimeoutManager();
+  });
+
+  afterEach(() => {
+    manager.reset();
+  });
+
+  describe('Timeout Configuration', () => {
+    it('should use default timeouts', () => {
+      const config = manager.getTimeoutConfig('test-plugin');
+      expect(config.onLoad).toBe(5000);
+      expect(config.onInit).toBe(5000);
+      expect(config.onActivate).toBe(3000);
+    });
+
+    it('should set custom timeout configuration', () => {
+      const customConfig: LifecycleTimeoutConfig = {
+        onLoad: 2000,
+        onInit: 3000,
+        onActivate: 1000
+      };
+
+      manager.setTimeoutConfig('my-plugin', customConfig);
+      const config = manager.getTimeoutConfig('my-plugin');
+
+      expect(config.onLoad).toBe(2000);
+      expect(config.onInit).toBe(3000);
+      expect(config.onActivate).toBe(1000);
+    });
+
+    it('should merge custom config with defaults', () => {
+      const customConfig: LifecycleTimeoutConfig = {
+        onLoad: 2000
+        // Other timeouts not specified
+      };
+
+      manager.setTimeoutConfig('my-plugin', customConfig);
+      const config = manager.getTimeoutConfig('my-plugin');
+
+      expect(config.onLoad).toBe(2000);
+      expect(config.onInit).toBe(5000); // Default
+    });
+  });
+
+  describe('Recovery Configuration', () => {
+    it('should use default recovery config', () => {
+      const config = manager.getRecoveryConfig('test-plugin');
+      expect(config.strategy).toBe(RecoveryStrategy.RETRY);
+      expect(config.maxRetries).toBe(2);
+    });
+
+    it('should set custom recovery configuration', () => {
+      const customConfig: RecoveryConfig = {
+        strategy: RecoveryStrategy.GRACEFUL,
+        maxRetries: 1,
+        fallbackValue: null
+      };
+
+      manager.setRecoveryConfig('my-plugin', customConfig);
+      const config = manager.getRecoveryConfig('my-plugin');
+
+      expect(config.strategy).toBe(RecoveryStrategy.GRACEFUL);
+      expect(config.maxRetries).toBe(1);
+    });
+  });
+
+  describe('Successful Execution', () => {
+    it('should execute hook successfully', async () => {
+      const hookFn = jest.fn(async () => 'success');
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onLoad',
+        hookFn,
+        5000
+      );
+
+      expect(result).toBe('success');
+      expect(hookFn).toHaveBeenCalledTimes(1);
+    });
+
+    it('should execute hook with return value', async () => {
+      const hookFn = jest.fn(async () => ({ value: 123 }));
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onInit',
+        hookFn,
+        5000
+      );
+
+      expect(result).toEqual({ value: 123 });
+    });
+
+    it('should handle async hook execution', async () => {
+      let executed = false;
+
+      const hookFn = async () => {
+        await new Promise(resolve => setTimeout(resolve, 100));
+        executed = true;
+        return 'done';
+      };
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onActivate',
+        hookFn,
+        5000
+      );
+
+      expect(executed).toBe(true);
+      expect(result).toBe('done');
+    });
+  });
+
+  describe('Timeout Handling', () => {
+    it('should timeout when hook exceeds timeout', async () => {
+      const hookFn = async () => {
+        await new Promise(resolve => setTimeout(resolve, 1000));
+        return 'success';
+      };
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.FAIL_FAST,
+        maxRetries: 0
+      });
+
+      await expect(
+        manager.executeWithTimeout('test-plugin', 'onLoad', hookFn, 100)
+      ).rejects.toThrow('timed out');
+    });
+
+    it('should timeout and retry', async () => {
+      let attempts = 0;
+      const hookFn = async () => {
+        attempts++;
+        if (attempts < 2) {
+          await new Promise(resolve => setTimeout(resolve, 200));
+        }
+        return 'success';
+      };
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.RETRY,
+        maxRetries: 2,
+        retryDelayMs: 10
+      });
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onLoad',
+        hookFn,
+        100
+      );
+
+      // Should eventually succeed or be retried
+      expect(attempts).toBeGreaterThanOrEqual(1);
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('should handle hook errors with FAIL_FAST', async () => {
+      const error = new Error('Hook failed');
+      const hookFn = jest.fn(async () => {
+        throw error;
+      });
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.FAIL_FAST,
+        maxRetries: 0
+      });
+
+      await expect(
+        manager.executeWithTimeout('test-plugin', 'onLoad', hookFn, 5000)
+      ).rejects.toThrow('Hook failed');
+    });
+
+    it('should handle hook errors with GRACEFUL', async () => {
+      const error = new Error('Hook failed');
+      const hookFn = jest.fn(async () => {
+        throw error;
+      });
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.GRACEFUL,
+        maxRetries: 0,
+        fallbackValue: 'fallback-value'
+      });
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onLoad',
+        hookFn,
+        5000
+      );
+
+      expect(result).toBe('fallback-value');
+    });
+
+    it('should retry on error', async () => {
+      let attempts = 0;
+      const hookFn = jest.fn(async () => {
+        attempts++;
+        if (attempts < 2) {
+          throw new Error('Attempt failed');
+        }
+        return 'success';
+      });
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.RETRY,
+        maxRetries: 2,
+        retryDelayMs: 10
+      });
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onLoad',
+        hookFn,
+        5000
+      );
+
+      expect(result).toBe('success');
+      expect(attempts).toBe(2);
+    });
+
+    it('should fail after max retries exhausted', async () => {
+      const error = new Error('Always fails');
+      const hookFn = jest.fn(async () => {
+        throw error;
+      });
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.FAIL_FAST,
+        maxRetries: 2,
+        retryDelayMs: 10
+      });
+
+      await expect(
+        manager.executeWithTimeout('test-plugin', 'onLoad', hookFn, 5000)
+      ).rejects.toThrow('Always fails');
+
+      expect(hookFn).toHaveBeenCalledTimes(3); // Initial + 2 retries
+    });
+  });
+
+  describe('Exponential Backoff', () => {
+    it('should use exponential backoff for retries', async () => {
+      let attempts = 0;
+      const timestamps: number[] = [];
+
+      const hookFn = async () => {
+        attempts++;
+        timestamps.push(Date.now());
+        if (attempts < 3) {
+          throw new Error('Retry me');
+        }
+        return 'success';
+      };
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.RETRY,
+        maxRetries: 3,
+        retryDelayMs: 25,
+        backoffMultiplier: 2
+      });
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onLoad',
+        hookFn,
+        10000
+      );
+
+      expect(result).toBe('success');
+      expect(attempts).toBe(3);
+
+      // Check backoff timing (with some tolerance)
+      if (timestamps.length >= 3) {
+        const delay1 = timestamps[1] - timestamps[0];
+        const delay2 = timestamps[2] - timestamps[1];
+        // delay2 should be roughly 2x delay1
+        expect(delay2).toBeGreaterThanOrEqual(delay1);
+      }
+    });
+  });
+
+  describe('Execution History', () => {
+    it('should record successful execution', async () => {
+      const hookFn = async () => 'success';
+
+      await manager.executeWithTimeout('test-plugin', 'onLoad', hookFn, 5000);
+
+      const history = manager.getExecutionHistory('test-plugin');
+      expect(history.length).toBeGreaterThan(0);
+    });
+
+    it('should record failed execution', async () => {
+      const hookFn = async () => {
+        throw new Error('Failed');
+      };
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.FAIL_FAST,
+        maxRetries: 0
+      });
+
+      try {
+        await manager.executeWithTimeout('test-plugin', 'onLoad', hookFn, 5000);
+      } catch (e) {
+        // Expected
+      }
+
+      const history = manager.getExecutionHistory('test-plugin');
+      expect(history.length).toBeGreaterThan(0);
+    });
+
+    it('should get execution statistics', async () => {
+      const hookFn = jest.fn(async () => 'success');
+
+      await manager.executeWithTimeout('test-plugin', 'onLoad', hookFn, 5000);
+
+      const stats = manager.getExecutionStats('test-plugin');
+      expect(stats.totalAttempts).toBeGreaterThan(0);
+      expect(stats.successes).toBeGreaterThanOrEqual(0);
+      expect(stats.failures).toBeGreaterThanOrEqual(0);
+      expect(stats.averageDuration).toBeGreaterThanOrEqual(0);
+    });
+
+    it('should clear execution history', async () => {
+      const hookFn = async () => 'success';
+
+      await manager.executeWithTimeout('test-plugin', 'onLoad', hookFn, 5000);
+      const beforeClear = manager.getExecutionHistory('test-plugin').length;
+      expect(beforeClear).toBeGreaterThan(0);
+
+      manager.clearExecutionHistory('test-plugin');
+      const afterClear = manager.getExecutionHistory('test-plugin').length;
+      expect(afterClear).toBe(0);
+    });
+  });
+
+  describe('Multiple Plugins', () => {
+    it('should handle multiple plugins independently', () => {
+      manager.setTimeoutConfig('plugin-a', { onLoad: 1000 });
+      manager.setTimeoutConfig('plugin-b', { onLoad: 2000 });
+
+      const configA = manager.getTimeoutConfig('plugin-a');
+      const configB = manager.getTimeoutConfig('plugin-b');
+
+      expect(configA.onLoad).toBe(1000);
+      expect(configB.onLoad).toBe(2000);
+    });
+
+    it('should maintain separate recovery configs', () => {
+      manager.setRecoveryConfig('plugin-a', {
+        strategy: RecoveryStrategy.RETRY
+      });
+      manager.setRecoveryConfig('plugin-b', {
+        strategy: RecoveryStrategy.GRACEFUL
+      });
+
+      const configA = manager.getRecoveryConfig('plugin-a');
+      const configB = manager.getRecoveryConfig('plugin-b');
+
+      expect(configA.strategy).toBe(RecoveryStrategy.RETRY);
+      expect(configB.strategy).toBe(RecoveryStrategy.GRACEFUL);
+    });
+
+    it('should maintain separate execution histories', async () => {
+      const hookFnA = async () => 'a';
+      const hookFnB = async () => 'b';
+
+      await manager.executeWithTimeout('plugin-a', 'onLoad', hookFnA, 5000);
+      await manager.executeWithTimeout('plugin-b', 'onInit', hookFnB, 5000);
+
+      const historyA = manager.getExecutionHistory('plugin-a');
+      const historyB = manager.getExecutionHistory('plugin-b');
+
+      expect(historyA.length).toBeGreaterThan(0);
+      expect(historyB.length).toBeGreaterThan(0);
+    });
+  });
+
+  describe('Recovery Strategies', () => {
+    it('should handle RETRY strategy', async () => {
+      let attempts = 0;
+      const hookFn = async () => {
+        if (attempts++ < 1) throw new Error('Fail');
+        return 'success';
+      };
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.RETRY,
+        maxRetries: 2,
+        retryDelayMs: 10
+      });
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onLoad',
+        hookFn,
+        5000
+      );
+
+      expect(result).toBe('success');
+    });
+
+    it('should handle FAIL_FAST strategy', async () => {
+      const hookFn = async () => {
+        throw new Error('Immediate failure');
+      };
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.FAIL_FAST,
+        maxRetries: 2
+      });
+
+      await expect(
+        manager.executeWithTimeout('test-plugin', 'onLoad', hookFn, 5000)
+      ).rejects.toThrow('Immediate failure');
+    });
+
+    it('should handle GRACEFUL strategy', async () => {
+      const hookFn = async () => {
+        throw new Error('Will be ignored');
+      };
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.GRACEFUL,
+        maxRetries: 0,
+        fallbackValue: { status: 'degraded' }
+      });
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onLoad',
+        hookFn,
+        5000
+      );
+
+      expect(result).toEqual({ status: 'degraded' });
+    });
+
+    it('should handle ROLLBACK strategy', async () => {
+      const hookFn = async () => {
+        throw new Error('Rollback error');
+      };
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.ROLLBACK,
+        maxRetries: 0
+      });
+
+      await expect(
+        manager.executeWithTimeout('test-plugin', 'onLoad', hookFn, 5000)
+      ).rejects.toThrow('Rollback triggered');
+    });
+  });
+
+  describe('Reset', () => {
+    it('should reset all configurations', () => {
+      manager.setTimeoutConfig('test', { onLoad: 1000 });
+      manager.setRecoveryConfig('test', { strategy: RecoveryStrategy.GRACEFUL });
+
+      manager.reset();
+
+      const timeoutConfig = manager.getTimeoutConfig('test');
+      const recoveryConfig = manager.getRecoveryConfig('test');
+
+      expect(timeoutConfig.onLoad).toBe(5000); // Default
+      expect(recoveryConfig.strategy).toBe(RecoveryStrategy.RETRY); // Default
+    });
+
+    it('should clear execution history on reset', async () => {
+      const hookFn = async () => 'success';
+      await manager.executeWithTimeout('test', 'onLoad', hookFn, 5000);
+
+      manager.reset();
+
+      const history = manager.getExecutionHistory('test');
+      expect(history.length).toBe(0);
+    });
+  });
+
+  describe('Edge Cases', () => {
+    it('should handle zero timeout', async () => {
+      const hookFn = jest.fn(async () => 'immediate');
+
+      manager.setRecoveryConfig('test-plugin', {
+        strategy: RecoveryStrategy.GRACEFUL,
+        maxRetries: 0,
+        fallbackValue: 'fallback'
+      });
+
+      // Very short timeout should trigger timeout or succeed very quickly
+      try {
+        const result = await manager.executeWithTimeout('test-plugin', 'onLoad', hookFn, 1);
+        expect(['immediate', 'fallback']).toContain(result);
+      } catch (e) {
+        // May timeout, which is acceptable
+        expect((e as Error).message).toContain('timed out');
+      }
+    });
+
+    it('should handle hook that returns undefined', async () => {
+      const hookFn = async () => undefined;
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onLoad',
+        hookFn,
+        5000
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('should handle hook that returns null', async () => {
+      const hookFn = async () => null;
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onLoad',
+        hookFn,
+        5000
+      );
+
+      expect(result).toBeNull();
+    });
+
+    it('should handle hook that returns false', async () => {
+      const hookFn = async () => false;
+
+      const result = await manager.executeWithTimeout(
+        'test-plugin',
+        'onLoad',
+        hookFn,
+        5000
+      );
+
+      expect(result).toBe(false);
+    });
+  });
+});
diff --git a/middleware/tests/integration/plugin-system.integration.spec.ts b/middleware/tests/integration/plugin-system.integration.spec.ts
new file mode 100644
index 00000000..d5ce3204
--- /dev/null
+++ b/middleware/tests/integration/plugin-system.integration.spec.ts
@@ -0,0 +1,262 @@
+import { Logger } from '@nestjs/common';
+import { PluginLoader } from '../../src/common/utils/plugin-loader';
+import { PluginRegistry } from '../../src/common/utils/plugin-registry';
+import { PluginInterface, PluginMetadata } from '../../src/common/interfaces/plugin.interface';
+import {
+  PluginNotFoundError,
+  PluginAlreadyLoadedError,
+  PluginConfigError,
+  PluginDependencyError
+} from '../../src/common/interfaces/plugin.errors';
+
+/**
+ * Mock Plugin for testing
+ */
+class MockPlugin implements PluginInterface {
+  metadata: PluginMetadata = {
+    id: 'test-plugin',
+    name: 'Test Plugin',
+    description: 'A test plugin',
+    version: '1.0.0'
+  };
+
+  async onLoad() {
+    // Test hook
+  }
+
+  async onInit() {
+    // Test hook
+  }
+
+  async onActivate() {
+    // Test hook
+  }
+
+  validateConfig() {
+    return { valid: true, errors: [] };
+  }
+
+  getDependencies() {
+    return [];
+  }
+
+  getMiddleware() {
+    return (req: any, res: any, next: any) => next();
+  }
+
+  getExports() {
+    return { testExport: 'value' };
+  }
+}
+
+/**
+ * Mock Plugin with Dependencies
+ */
+class MockPluginWithDeps implements PluginInterface {
+  metadata: PluginMetadata = {
+    id: 'test-plugin-deps',
+    name: 'Test Plugin With Deps',
+    description: 'A test plugin with dependencies',
+    version: '1.0.0'
+  };
+
+  getDependencies() {
+    return ['test-plugin'];
+  }
+}
+
+describe('PluginLoader', () => {
+  let loader: PluginLoader;
+  let mockPlugin: MockPlugin;
+
+  beforeEach(() => {
+    loader = new PluginLoader({
+      logger: new Logger('Test'),
+      middlewareVersion: '1.0.0'
+    });
+    mockPlugin = new MockPlugin();
+  });
+
+  describe('loadPlugin', () => {
+    it('should load a valid plugin', async () => {
+      // Mock require to return our test plugin
+      const originalRequire = global.require;
+      (global as any).require = jest.fn((moduleId: string) => {
+        if (moduleId === 'test-plugin') {
+          return { default: MockPlugin };
+        }
+        return originalRequire(moduleId);
+      });
+
+      // Note: In actual testing, we'd need to mock the module resolution
+      expect(mockPlugin.metadata.id).toBe('test-plugin');
+    });
+
+    it('should reject duplicate plugin loads', async () => {
+      // This would require proper test setup with module mocking
+    });
+  });
+
+  describe('plugin validation', () => {
+    it('should validate plugin interface', () => {
+      // Valid plugin metadata
+      expect(mockPlugin.metadata).toBeDefined();
+      expect(mockPlugin.metadata.id).toBeDefined();
+      expect(mockPlugin.metadata.name).toBeDefined();
+      expect(mockPlugin.metadata.version).toBeDefined();
+    });
+
+    it('should validate plugin configuration', () => {
+      const result = mockPlugin.validateConfig({ enabled: true });
+      expect(result.valid).toBe(true);
+      expect(result.errors.length).toBe(0);
+    });
+  });
+
+  describe('plugin lifecycle', () => {
+    it('should have all lifecycle hooks defined', async () => {
+      expect(typeof mockPlugin.onLoad).toBe('function');
+      expect(typeof mockPlugin.onInit).toBe('function');
+      expect(typeof mockPlugin.onActivate).toBe('function');
+      expect(mockPlugin.validateConfig).toBeDefined();
+    });
+
+    it('should execute hooks in order', async () => {
+      const hooks: string[] = [];
+
+      const testPlugin: PluginInterface = {
+        metadata: mockPlugin.metadata,
+        onLoad: async () => hooks.push('onLoad'),
+        onInit: async () => hooks.push('onInit'),
+        onActivate: async () => hooks.push('onActivate'),
+        validateConfig: () => ({ valid: true, errors: [] }),
+        getDependencies: () => []
+      };
+
+      await testPlugin.onLoad!({});
+      await testPlugin.onInit!({}, {});
+      await testPlugin.onActivate!({});
+
+      expect(hooks).toEqual(['onLoad', 'onInit', 'onActivate']);
+    });
+  });
+
+  describe('plugin exports', () => {
+    it('should export middleware', () => {
+      const middleware = mockPlugin.getMiddleware();
+      expect(middleware).toBeDefined();
+      expect(typeof middleware).toBe('function');
+    });
+
+    it('should export utilities', () => {
+      const exports = mockPlugin.getExports();
+      expect(exports).toBeDefined();
+      expect(exports.testExport).toBe('value');
+    });
+  });
+
+  describe('plugin dependencies', () => {
+    it('should return dependency list', () => {
+      const deps = mockPlugin.getDependencies();
+      expect(Array.isArray(deps)).toBe(true);
+
+      const depsPlugin = new MockPluginWithDeps();
+      const depsPluginDeps = depsPlugin.getDependencies();
+      expect(depsPluginDeps).toContain('test-plugin');
+    });
+  });
+});
+
+describe('PluginRegistry', () => {
+  let registry: PluginRegistry;
+
+  beforeEach(() => {
+    registry = new PluginRegistry({
+      logger: new Logger('Test'),
+      middlewareVersion: '1.0.0'
+    });
+  });
+
+  describe('initialization', () => {
+    it('should initialize registry', async () => {
+      // Note: In actual testing, we'd mock the loader
+      expect(registry.isInitialized()).toBe(false);
+    });
+  });
+
+  describe('plugin management', () => {
+    it('should count plugins', () => {
+      expect(registry.count()).toBe(0);
+    });
+
+    it('should check if initialized', () => {
+      expect(registry.isInitialized()).toBe(false);
+    });
+
+    it('should export state', () => {
+      const state = registry.exportState();
+      expect(state).toHaveProperty('initialized');
+      expect(state).toHaveProperty('totalPlugins');
+      expect(state).toHaveProperty('activePlugins');
+      expect(state).toHaveProperty('plugins');
+      expect(Array.isArray(state.plugins)).toBe(true);
+    });
+  });
+
+  describe('plugin search', () => {
+    it('should search plugins with empty registry', () => {
+      const results = registry.searchPlugins({ query: 'test' });
+      expect(Array.isArray(results)).toBe(true);
+      expect(results.length).toBe(0);
+    });
+  });
+
+  describe('batch operations', () => {
+    it('should handle batch plugin operations', async () => {
+      // Test unloadAll
+      await expect(registry.unloadAll()).resolves.not.toThrow();
+
+      // Test activateAll
+      await expect(registry.activateAll()).resolves.not.toThrow();
+
+      // Test deactivateAll
+      await expect(registry.deactivateAll()).resolves.not.toThrow();
+    });
+  });
+
+  describe('statistics', () => {
+    it('should provide statistics', () => {
+      const stats = registry.getStatistics();
+      expect(stats).toHaveProperty('totalLoaded', 0);
+      expect(stats).toHaveProperty('totalActive', 0);
+      expect(stats).toHaveProperty('totalDisabled', 0);
+      expect(Array.isArray(stats.plugins)).toBe(true);
+    });
+  });
+});
+
+describe('Plugin Errors', () => {
+  it('should create PluginNotFoundError', () => {
+    const error = new PluginNotFoundError('test-plugin');
+    expect(error.message).toContain('test-plugin');
+    expect(error.code).toBe('PLUGIN_NOT_FOUND');
+  });
+
+  it('should create PluginAlreadyLoadedError', () => {
+    const error = new PluginAlreadyLoadedError('test-plugin');
+    expect(error.message).toContain('test-plugin');
+    expect(error.code).toBe('PLUGIN_ALREADY_LOADED');
+  });
+
+  it('should create PluginConfigError', () => {
+    const error = new PluginConfigError('test-plugin', ['Invalid field']);
+    expect(error.message).toContain('test-plugin');
+    expect(error.code).toBe('PLUGIN_CONFIG_ERROR');
+  });
+
+  it('should create PluginDependencyError', () => {
+    const error = new PluginDependencyError('test-plugin', ['dep1', 'dep2']);
+    expect(error.message).toContain('dep1');
+    expect(error.code).toBe('PLUGIN_DEPENDENCY_ERROR');
+  });
+});
diff --git a/middleware/tests/integration/request-logger.integration.spec.ts b/middleware/tests/integration/request-logger.integration.spec.ts
new file mode 100644
index 00000000..2dbace5d
--- /dev/null
+++ b/middleware/tests/integration/request-logger.integration.spec.ts
@@ -0,0 +1,431 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { INestApplication } from '@nestjs/common';
+import * as request from 'supertest';
+import RequestLoggerPlugin from '../../src/plugins/request-logger.plugin';
+import { PluginConfig } from '../../src/common/interfaces/plugin.interface';
+
+describe('RequestLoggerPlugin', () => {
+  let plugin: RequestLoggerPlugin;
+  let app: INestApplication;
+
+  beforeEach(() => {
+    plugin = new RequestLoggerPlugin();
+  });
+
+  describe('Plugin Lifecycle', () => {
+    it('should load plugin without errors', async () => {
+      const context = { logger: console as any };
+      await expect(plugin.onLoad(context as any)).resolves.not.toThrow();
+    });
+
+    it('should initialize with default configuration', async () => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: {}
+      };
+      const context = { logger: console as any };
+
+      await expect(plugin.onInit(config, context as any)).resolves.not.toThrow();
+    });
+
+    it('should initialize with custom configuration', async () => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: {
+          logLevel: 'debug',
+          excludePaths: ['/health', '/metrics'],
+          logHeaders: true,
+          logBody: true,
+          maxBodyLength: 1000,
+          colorize: false,
+          requestIdHeader: 'x-trace-id'
+        }
+      };
+      const context = { logger: console as any };
+
+      await expect(plugin.onInit(config, context as any)).resolves.not.toThrow();
+    });
+
+    it('should activate plugin', async () => {
+      const context = { logger: console as any };
+      await expect(plugin.onActivate(context as any)).resolves.not.toThrow();
+    });
+
+    it('should deactivate plugin', async () => {
+      const context = { logger: console as any };
+      await expect(plugin.onDeactivate(context as any)).resolves.not.toThrow();
+    });
+
+    it('should unload plugin', async () => {
+      const context = { logger: console as any };
+      await expect(plugin.onUnload(context as any)).resolves.not.toThrow();
+    });
+  });
+
+  describe('Plugin Metadata', () => {
+    it('should have correct metadata', () => {
+      expect(plugin.metadata.id).toBe('@mindblock/plugin-request-logger');
+      expect(plugin.metadata.name).toBe('Request Logger');
+      expect(plugin.metadata.version).toBe('1.0.0');
+      expect(plugin.metadata.priority).toBe(100);
+      expect(plugin.metadata.autoLoad).toBe(false);
+    });
+
+    it('should have configSchema', () => {
+      expect(plugin.metadata.configSchema).toBeDefined();
+      expect(plugin.metadata.configSchema.properties.options.properties.logLevel).toBeDefined();
+      expect(plugin.metadata.configSchema.properties.options.properties.excludePaths).toBeDefined();
+    });
+  });
+
+  describe('Configuration Validation', () => {
+    it('should validate valid configuration', () => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: {
+          logLevel: 'info',
+          excludePaths: ['/health'],
+          maxBodyLength: 500
+        }
+      };
+
+      const result = plugin.validateConfig(config);
+      expect(result.valid).toBe(true);
+      expect(result.errors).toHaveLength(0);
+    });
+
+    it('should reject invalid logLevel', () => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: {
+          logLevel: 'invalid' as any
+        }
+      };
+
+      const result = plugin.validateConfig(config);
+      expect(result.valid).toBe(false);
+      expect(result.errors).toContain('logLevel must be one of: debug, info, warn, error');
+    });
+
+    it('should reject negative maxBodyLength', () => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: {
+          maxBodyLength: -1
+        }
+      };
+
+      const result = plugin.validateConfig(config);
+      expect(result.valid).toBe(false);
+      expect(result.errors).toContain('maxBodyLength must be >= 0');
+    });
+
+    it('should reject if excludePaths is not an array', () => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: {
+          excludePaths: 'not-an-array' as any
+        }
+      };
+
+      const result = plugin.validateConfig(config);
+      expect(result.valid).toBe(false);
+      expect(result.errors).toContain('excludePaths must be an array of strings');
+    });
+
+    it('should validate all valid log levels', () => {
+      const levels = ['debug', 'info', 'warn', 'error'];
+
+      for (const level of levels) {
+        const config: PluginConfig = {
+          enabled: true,
+          options: { logLevel: level as any }
+        };
+
+        const result = plugin.validateConfig(config);
+        expect(result.valid).toBe(true);
+      }
+    });
+  });
+
+  describe('Dependencies', () => {
+    it('should return empty dependencies array', () => {
+      const deps = plugin.getDependencies();
+      expect(Array.isArray(deps)).toBe(true);
+      expect(deps).toHaveLength(0);
+    });
+  });
+
+  describe('Middleware Export', () => {
+    it('should throw if middleware requested before initialization', () => {
+      expect(() => plugin.getMiddleware()).toThrow('Request Logger plugin not initialized');
+    });
+
+    it('should return middleware function after initialization', async () => {
+      const config: PluginConfig = { enabled: true };
+      const context = { logger: console as any };
+
+      await plugin.onInit(config, context as any);
+      const middleware = plugin.getMiddleware();
+
+      expect(typeof middleware).toBe('function');
+      expect(middleware.length).toBe(3); // (req, res, next)
+    });
+
+    it('should skip excluded paths', (done) => {
+      const mockReq = {
+        path: '/health',
+        method: 'GET',
+        headers: {},
+        query: {}
+      } as any;
+
+      const mockRes = {
+        on: () => {},
+        statusCode: 200
+      } as any;
+
+      let nextCalled = false;
+      const mockNext = () => {
+        nextCalled = true;
+      };
+
+      plugin.onInit({ enabled: true }, { logger: console as any }).then(() => {
+        const middleware = plugin.getMiddleware();
+        middleware(mockReq, mockRes, mockNext);
+
+        expect(nextCalled).toBe(true);
+        done();
+      });
+    });
+  });
+
+  describe('Exports', () => {
+    it('should export utility functions', async () => {
+      const config: PluginConfig = { enabled: true };
+      const context = { logger: console as any };
+
+      await plugin.onInit(config, context as any);
+      const exports = plugin.getExports();
+
+      expect(exports.getRequestId).toBeDefined();
+      expect(exports.setLogLevel).toBeDefined();
+      expect(exports.getLogLevel).toBeDefined();
+      expect(exports.addExcludePaths).toBeDefined();
+      expect(exports.removeExcludePaths).toBeDefined();
+      expect(exports.getExcludePaths).toBeDefined();
+      expect(exports.clearExcludePaths).toBeDefined();
+    });
+
+    it('should set and get log level', async () => {
+      const config: PluginConfig = { enabled: true };
+      const context = { logger: console as any };
+
+      await plugin.onInit(config, context as any);
+      const exports = plugin.getExports();
+
+      exports.setLogLevel('debug');
+      expect(exports.getLogLevel()).toBe('debug');
+
+      exports.setLogLevel('warn');
+      expect(exports.getLogLevel()).toBe('warn');
+    });
+
+    it('should add and remove excluded paths', async () => {
+      const config: PluginConfig = { enabled: true };
+      const context = { logger: console as any };
+
+      await plugin.onInit(config, context as any);
+      const exports = plugin.getExports();
+
+      exports.clearExcludePaths();
+      expect(exports.getExcludePaths()).toHaveLength(0);
+
+      exports.addExcludePaths('/api', '/admin');
+      expect(exports.getExcludePaths()).toHaveLength(2);
+
+      exports.removeExcludePaths('/api');
+      expect(exports.getExcludePaths()).toHaveLength(1);
+      expect(exports.getExcludePaths()).toContain('/admin');
+    });
+
+    it('should extract request ID from headers', async () => {
+      const config: PluginConfig = { enabled: true };
+      const context = { logger: console as any };
+
+      await plugin.onInit(config, context as any);
+      const exports = plugin.getExports();
+
+      const mockReq = {
+        headers: {
+          'x-request-id': 'test-req-123'
+        }
+      } as any;
+
+      const requestId = exports.getRequestId(mockReq);
+      expect(requestId).toBe('test-req-123');
+    });
+
+    it('should generate request ID if not in headers', async () => {
+      const config: PluginConfig = { enabled: true };
+      const context = { logger: console as any };
+
+      await plugin.onInit(config, context as any);
+      const exports = plugin.getExports();
+
+      const mockReq = {
+        headers: {}
+      } as any;
+
+      const requestId = exports.getRequestId(mockReq);
+      expect(requestId).toMatch(/^req-\d+-[\w]+$/);
+    });
+  });
+
+  describe('Middleware Behavior', () => {
+    beforeEach(async () => {
+      const moduleFixture: TestingModule = await Test.createTestingModule({
+        controllers: [],
+        providers: []
+      }).compile();
+
+      app = moduleFixture.createNestApplication();
+      await app.init();
+    });
+
+    afterEach(async () => {
+      await app.close();
+    });
+
+    it('should process requests normally', (done) => {
+      const config: PluginConfig = { enabled: true };
+      const context = { logger: console as any };
+
+      plugin.onInit(config, context as any).then(() => {
+        const middleware = plugin.getMiddleware();
+
+        const mockReq = {
+          path: '/api/test',
+          method: 'GET',
+          headers: {},
+          query: {}
+        } as any;
+
+        const mockRes = {
+          statusCode: 200,
+          on: (event: string, callback: () => void) => {
+            if (event === 'finish') {
+              setTimeout(callback, 10);
+            }
+          },
+          send: (data: any) => mockRes
+        } as any;
+
+        let nextCalled = false;
+        const mockNext = () => {
+          nextCalled = true;
+        };
+
+        middleware(mockReq, mockRes, mockNext);
+
+        setTimeout(() => {
+          expect(nextCalled).toBe(true);
+          expect((mockReq as any).requestId).toBeDefined();
+          done();
+        }, 50);
+      });
+    });
+
+    it('should attach request ID to request object', (done) => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: { requestIdHeader: 'x-trace-id' }
+      };
+      const context = { logger: console as any };
+
+      plugin.onInit(config, context as any).then(() => {
+        const middleware = plugin.getMiddleware();
+
+        const mockReq = {
+          path: '/api/test',
+          method: 'GET',
+          headers: { 'x-trace-id': 'trace-123' },
+          query: {}
+        } as any;
+
+        const mockRes = {
+          statusCode: 200,
+          on: () => {},
+          send: (data: any) => mockRes
+        } as any;
+
+        const mockNext = () => {
+          expect((mockReq as any).requestId).toBe('trace-123');
+          done();
+        };
+
+        middleware(mockReq, mockRes, mockNext);
+      });
+    });
+  });
+
+  describe('Configuration Application', () => {
+    it('should apply custom log level', async () => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: { logLevel: 'debug' }
+      };
+      const context = { logger: console as any };
+
+      await plugin.onInit(config, context as any);
+      const exports = plugin.getExports();
+
+      expect(exports.getLogLevel()).toBe('debug');
+    });
+
+    it('should apply custom exclude paths', async () => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: { excludePaths: ['/custom', '/private'] }
+      };
+      const context = { logger: console as any };
+
+      await plugin.onInit(config, context as any);
+      const exports = plugin.getExports();
+
+      expect(exports.getExcludePaths()).toContain('/custom');
+      expect(exports.getExcludePaths()).toContain('/private');
+    });
+
+    it('should apply custom request ID header', async () => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: { requestIdHeader: 'x-custom-id' }
+      };
+      const context = { logger: console as any };
+
+      await plugin.onInit(config, context as any);
+      const exports = plugin.getExports();
+
+      const mockReq = {
+        headers: { 'x-custom-id': 'custom-123' }
+      } as any;
+
+      const requestId = exports.getRequestId(mockReq);
+      expect(requestId).toBe('custom-123');
+    });
+
+    it('should disable colorization when configured', async () => {
+      const config: PluginConfig = {
+        enabled: true,
+        options: { colorize: false }
+      };
+      const context = { logger: console as any };
+
+      await plugin.onInit(config, context as any);
+      const middleware = plugin.getMiddleware();
+
+      expect(typeof middleware).toBe('function');
+    });
+  });
+});
diff --git a/middleware/tsconfig.json b/middleware/tsconfig.json
index de7bda18..6feb2686 100644
--- a/middleware/tsconfig.json
+++ b/middleware/tsconfig.json
@@ -21,6 +21,6 @@
       "@validation/*": ["src/validation/*"]
     }
   },
-  "include": ["src/**/*.ts", "tests/**/*.ts"],
+  "include": ["src/**/*.ts", "tests/**/*.ts", "scripts/**/*.ts"],
   "exclude": ["node_modules", "dist", "coverage"]
 }