@mycadet/gateway 0.12.10 → 0.12.11

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/node_modules/@mycadet/ces-client/src/http-credentials.ts

@@ -143,6 +143,19 @@ export interface CesHttpCredentialClient {
 // Factory
 // ---------------------------------------------------------------------------
 
+function listErrorContext(
+  response: Response,
+  path: string,
+): Record<string, unknown> {
+  const requestId = response.headers.get("x-ces-error-id");
+  return {
+    status: response.status,
+    method: "GET",
+    path,
+    ...(requestId && /^[a-f0-9-]{36}$/i.test(requestId) ? { requestId } : {}),
+  };
+}
+
 export function createCesHttpCredentialClient(
   config: CesHttpCredentialConfig,
   logger: CesHttpLogger,
@@ -298,7 +311,7 @@ export function createCesHttpCredentialClient(
         if (!res) return { accounts: [], unreachable: true };
         if (!res.ok) {
           logger.warn(
-            { status: res.status },
+            listErrorContext(res, "/v1/credentials"),
             "CES credential list returned non-OK status",
           );
           return { accounts: [], unreachable: true };
@@ -399,6 +412,10 @@ export function createCesHttpCredentialClient(
           return { records: [], unreachable: true };
         }
         if (!res.ok) {
+          logger.warn(
+            listErrorContext(res, "/v1/metadata"),
+            "CES metadata list returned non-OK status",
+          );
           return { records: [], unreachable: true };
         }
         const data = (await res.json()) as {

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -10,7 +10,7 @@ import {
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
   type TunnelRecord,
-  tunnelHostForPlatformHost,
+  tunnelHostForCloudHost,
 } from "../ingress.js";
 import {
   buildTwilioMediaStreamUrl,
@@ -19,27 +19,27 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
 
-describe("tunnelHostForPlatformHost", () => {
+describe("tunnelHostForCloudHost", () => {
   test("maps the prod platform host to the prod tunnel", () => {
-    expect(tunnelHostForPlatformHost("cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("cloud.mycadet.ai")).toBe(
       "tunnel.mycadet.ai",
     );
   });
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
-    expect(tunnelHostForPlatformHost("staging-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
       "tunnel-staging.mycadet.ai",
     );
-    expect(tunnelHostForPlatformHost("dev-cloud.mycadet.ai")).toBe(
+    expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
       "tunnel-dev.mycadet.ai",
     );
   });
 
   test("returns null for hosts outside the deployment convention", () => {
-    expect(tunnelHostForPlatformHost("localhost")).toBeNull();
-    expect(tunnelHostForPlatformHost("platform.example.com")).toBeNull();
+    expect(tunnelHostForCloudHost("localhost")).toBeNull();
+    expect(tunnelHostForCloudHost("platform.example.com")).toBeNull();
     expect(
-      tunnelHostForPlatformHost("staging-cloud.mycadet.ai.evil.com"),
+      tunnelHostForCloudHost("staging-cloud.mycadet.ai.evil.com"),
     ).toBeNull();
   });
 });

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -6,7 +6,7 @@
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
  */
-export function tunnelHostForPlatformHost(host: string): string | null {
+export function tunnelHostForCloudHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
     return "tunnel.mycadet.ai";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/gateway",
-  "version": "0.12.10",
+  "version": "0.12.11",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/guardian-bootstrap-lookups.test.ts

@@ -337,7 +337,7 @@ describe("resolve-or-mint (resolveOrCreateCadetGuardian)", () => {
     assistantBackend = makeAssistantBackend();
 
     const principalId = await ensureCadetGuardianBinding();
-    expect(principalId).toMatch(/^cadet-principal-/);
+    expect(principalId).toMatch(/^principal-/);
 
     // Gateway now has the row; the assistant DB must not be read again.
     assistantBackend = throwingBackend;
@@ -350,7 +350,7 @@ describe("resolve-or-mint (resolveOrCreateCadetGuardian)", () => {
 
     const principalId = await ensureCadetGuardianBinding();
 
-    expect(principalId).toMatch(/^cadet-principal-/);
+    expect(principalId).toMatch(/^principal-/);
     const gwRows = gatewayCadetGuardians();
     expect(gwRows).toHaveLength(1);
     expect(gwRows[0]?.principalId).toBe(principalId);
@@ -383,7 +383,7 @@ describe("resolve-or-mint (resolveOrCreateCadetGuardian)", () => {
       deviceId: "device-1",
     });
 
-    expect(result.guardianPrincipalId).toMatch(/^cadet-principal-/);
+    expect(result.guardianPrincipalId).toMatch(/^principal-/);
     expect(result.isNew).toBe(true);
     expect(result.mintedOverPriorEvidence).toBe(false);
   });
@@ -606,7 +606,7 @@ describe("resolve-or-mint (resolveOrCreateCadetGuardian)", () => {
       deviceId: "device-1",
     });
 
-    expect(result.guardianPrincipalId).toMatch(/^cadet-principal-/);
+    expect(result.guardianPrincipalId).toMatch(/^principal-/);
     expect(result.isNew).toBe(true);
     expect(result.mintedOverPriorEvidence).toBe(true);
     expect(gatewayCadetGuardians()).toHaveLength(1);

package/src/__tests__/guardian-init-lockfile.test.ts

@@ -271,7 +271,7 @@ describe("guardian/init bootstrap secret", () => {
 
     expect(res.status).toBe(200);
     const body = await res.json();
-    expect(body.guardianPrincipalId).toMatch(/^cadet-principal-/);
+    expect(body.guardianPrincipalId).toMatch(/^principal-/);
     expect(body.accessToken).toBeTruthy();
     expect(body.refreshToken).toBeTruthy();
     expect(body.isNew).toBe(true);
@@ -391,7 +391,7 @@ describe("guardian/init one-time-use lockfile", () => {
 
     expect(res.status).toBe(200);
     const body = await res.json();
-    expect(body.guardianPrincipalId).toMatch(/^cadet-principal-/);
+    expect(body.guardianPrincipalId).toMatch(/^principal-/);
     expect(body.accessToken).toBeTruthy();
     expect(body.refreshToken).toBeTruthy();
     expect(lockFileExists()).toBe(true);

package/src/__tests__/remote-web-pairing-token.test.ts

@@ -622,7 +622,7 @@ describe("remote web pairing token exchange", () => {
       .where(eq(contacts.role, "guardian"))
       .all();
     expect(gwGuardian).toHaveLength(1);
-    expect(gwGuardian[0].principalId).toMatch(/^cadet-principal-/);
+    expect(gwGuardian[0].principalId).toMatch(/^principal-/);
   });
 
   test("gateway binding write failure fails the mint and leaves the code retryable", async () => {

package/src/auth/guardian-bootstrap.ts

@@ -1220,7 +1220,7 @@ async function resolveOrCreateCadetGuardian(options: {
 
   // No gateway guardian — mint a fresh principal.
   const displayName = await fetchPlatformOwnerDisplayName();
-  const guardianPrincipalId = `cadet-principal-${uuid()}`;
+  const guardianPrincipalId = `principal-${uuid()}`;
   await createGuardianBinding({
     channel: "cadet",
     externalUserId: guardianPrincipalId,

package/src/http/routes/speech-relay-websocket.ts

@@ -22,7 +22,7 @@
 
 import type { OutgoingHttpHeaders } from "node:http";
 
-import { tunnelHostForPlatformHost } from "@mycadet/service-contracts/ingress";
+import { tunnelHostForCloudHost } from "@mycadet/service-contracts/ingress";
 
 import { resolveScopeProfile } from "../../auth/scopes.js";
 import { validateEdgeToken } from "../../auth/token-exchange.js";
@@ -163,7 +163,7 @@ function jsonError(status: number, code: string, detail: string): Response {
  * shared with the web live-voice client; this wrapper adds the scheme.
  */
 export function tunnelOriginForPlatformHost(host: string): string | null {
-  const tunnelHost = tunnelHostForPlatformHost(host);
+  const tunnelHost = tunnelHostForCloudHost(host);
   return tunnelHost ? `https://${tunnelHost}` : null;
 }